@dmfan wrote:
In addition to it being Wifi 6, the XB7 is also compatible with the Gen-2 pods, while the XB6 is only compatible with the Gen-1 pods.
That's strange. The 2nd Generation Pods are 802.11ac (Wi-Fi 5) devices, so they should work with both the XB6 and XB7 gateways.
https://www.xfinity.com/learn/internet-service/wifi/xfi-pod
https://www.xfinity.com/support/articles/xfi-pods-faqs
One Gen-2 will perform better than three Gen-1 pods. It has a much higher throughput (because it is Wifi 6, and I believe a dedicated channel for wireless backhauling) in addition to higher signal strength.
I can't confirm the higher signal strength but having a dedicated radio for the backhaul should double the throughput of the previous generation Ignite Pods.
@Phil307 I sympathize with you. Also, all of the issues that you just raised have been discussed at length in these Forums. I have also cautioned CODA users not to blindly upgrade to the new Ignite gateways:
The Ignite (XB6 and XB7) gateways are not bad devices, and they work well for most users that have simple networking needs and who like the convenience of managing their setup through a mobile app. However, those looking for even a moderate amount of control will be frustrated.
Re: your port forwarding issues, you may find this tip helpful: https://communityforums.rogers.com/t5/Internet/Cannot-setup-Port-Forwarding-using-Ignite-XB6-Modem/m...
@dmfan wrote:
Blindly is a harsh word. Are we expecting people to read all forum posts and do all the research before getting a modem from Rogers?
Sorry, I didn't mean for that to come across quite the way that it did.
When the XB6 was available exclusively to Ignite TV customers, some (legacy) Rogers Internet customers were clamoring to get the Technicolor XB6 gateway as well. We tried to warn and advise them back then as best as we could, and did so again when they asked about switching to Ignite Internet when it launched.
When I first subscribed to Ignite TV a few years ago, I was given an XB6 and 3 EERO pods. Can people actually choose what modem to get?
Last I heard, there was no way to request a specific make/model in the order. The Rogers support teams can add comments requesting specific hardware; there's just no guarantee that you will get it when the requisition for the modem replacement gets fulfilled.
@Phil307 wrote:
I would agree - Blindly is a harsh word considering I had no choice. I "upgraded" from the legacy system to the new ignite system and therefore had to get a new modem. They sent me the xb7 - I then proceeded to read about it because I didn't know it existed. From the research (promotional material) I figured why not, I have never used a rogers device as my main gear, this seems to fit all the check boxes for performance/features... And....it bit me in the butt!! So many bugs one needs to call the exterminator.
By the way, that "harsh" comment also applies equally to me. 😊
I definitely took a leap of faith when I signed up for Ignite TV. I could test Ignite TV out in the store but I was totally surprised that the XB6 had so many quirks and limitations. When the Ignite WiFi Hub went live, I got even more surprises.
Right now, things are working very well for me, with my own router and Wi-Fi gear and with Bridge Mode enabled on my XB6. I have no desire to switch to the XB7.
@dmfan wrote:
Out of curiosity, how do the Ignite set top boxes communicate with the modem via bridge mode?
In normal operations, the Ignite set-top box connects to the same Wi-Fi SSID that all of your other devices connect to. I have my own router and access points, my Ignite gateway is in bridge mode, and the Ignite set-top boxes connect to my in-home Wi-Fi like any other device. Channels are streamed over your Internet connection. (Ignite TV is an IPTV service.)
Since the Ignite set up boxes require zero configuration (without an SSID and a password), I always assume that there is a hidden channel that allow the modem to talk to the set top boxes. When there is a 3rd party router/access point between the modem and the set top boxes, how do they communicate exactly?
The Ignite gateway runs a "Lost & Found" service internally. If the Ignite set-top box is not paired to Wi-Fi, it connects to a special hidden SSID on the gateway to obtain the SSID and passphrase for your Wi-Fi network. If it is unable to obtain valid Wi-Fi credentials through LnF, then the STB will prompt to connect to a Wi-Fi network.
@ColdGranite wrote:
@-G- wrote:
The Ignite gateway runs a "Lost & Found" service internally. If the Ignite set-top box is not paired to Wi-Fi, it connects to a special hidden SSID on the gateway to obtain the SSID and passphrase for your Wi-Fi network. If it is unable to obtain valid Wi-Fi credentials through LnF, then the STB will prompt to connect to a Wi-Fi network.Two things:
How does the set top box know that it belongs to "this" gateway? Could it not connect to the guy next door?
I don't know the specifics of the implementation. When the STB tries to connect to that SSID, it would connect to the strongest access point. I don't know what other logic has been implemented to ensure that the set-top box gets the correct Wi-Fi credentials.
(Keep in mind that all this information about the Xfinity gear is REALLY hard to come by because virtually NOTHING is documented publicly. I also don't want to disclose too much in a public forum. With the right Internet searches and a lot of scouring, you can uncover interesting bits and pieces that get disclosed inadvertently and pull them all together. I also try to validate as much as I can with what I find on RDK Central.)
And second:
Does this bring up any security issues?
Rogers probably already has my wifi password, since no doubt they are able to access my gateway, so that particular security issue is already a given.
But now are you saying that a guy on my street... if he had the information on the hidden SSID on the gateway ... could gain access to MY network's passphrase?
Granted, that information should be hard to get (maybe), but is it not another door into my network?
It is possible to implement this with an acceptable level of security.
Again, I don't know the specifics of the implementation or how secure it actually is. Presumably, at the very least, the set-top box authenticates itself to the service on the gateway with a digital certificate, and then does some additional authentication with the back-end systems. (Here's a guess as to how LnF may work: Even if my STB connects to a neighbour's gateway, the back-end systems would know which devices are associated with what account. So, if my gateway stores my private Wi-Fi credentials centrally, it's theoretically possible that even if my set-top box contacts my neighbour's gateway, that it could still relay back the correct Wi-Fi credentials to my device for my gateway. This would prevent my STB from getting itself connected to my neighbour's gateway and prevent me, in turn, from using the "What's my WiFi password?" voice command to obtain their Wi-Fi password. Again... Just a guess on my part.)
I haven't tried doing any ethical hacking or penetration testing of the Comcast gear. Others who have occasionally find some interesting stuff, which eventually gets fixed.
I really don't like this plug-n-play/zero-configuration stuff; it really makes me nervous and I don't trust it. However, one of Comcast's design goals was to make their solution as quick and simple to install as possible... and apparently to provide only the most basic configuration options in the Gateways to prevent end-customers from breaking their service, and making the integrated solution as easy as possible for their Cable Company customers to support.
I especially dislike using hardware that has no technical documentation and relies on security-by-obscurity. Comcast's code (the bits of it that we can see and what you hear about anecdotally) is pretty awful and I'm sure that much of Xfinity's development is done by offshore developers. If given the choice, I would dump the XB6/XB7 (or any Ignite gateway) in a heartbeat and use a simple (non-gateway, no Wi-Fi) cable modem instead... but I don't have that option. All that I can do is to secure my network as best as I can.
With the right circumstances, it would be easy to determine if you could actually connect your set top boxes to someone else's wifi.
1. Download Winfi Lite from https://www.helge-keck.com/ and install that on a laptop or wifi connected laptop
2. Turn off your modem, or pull the power on the modem so that it doesn't transmit any wifi networks.
3. Start Winfi Lite and select either 2.4 or 5 Ghz or All from the band selection.
4. Have a look at the SSIDs, looking specifically for empty (hidden) SSIDs which can denote the presence of an XB6 or XB7 modem. Look for multiple hidden SSIDs where the first 4 character pairs of the BSSID are the same. The final 2 pairs will be or should be different. You should be able to see two or more BSSIDs on both of the 2.4 and 5 Ghz bands. With your modem's power disconnected, it won't transmit any wifi networks, so any networks that match the description above would belong to your neighbours.
5. Restart a set top box. Pull the power from the box, wait 10 to 15 seconds and plug it back in. After it reboots, negotiate your way to the wifi settings and see if it gives you the option to connect to another network. Since I'm not running one of these, I don't know what info is presented. Does it present a wifi mac address to connect to? In any event, try to connect to another network to see if it works. If it does, that means that there's no backend check on which wifi network the set top box is connected to. That would be an indication of poor security for this system.
The fact that the system uses WPS is another security topic all together. WPS is not secure and that's been known for several years. Hard to believe that Comcast and now Rogers and Shaw is perpetuating a known security hazard. On the other hand, maybe its not so hard to believe at all 😞
@Datalink I'm pretty sure that an Ignite STB will not connect to a neighbour's gateway via LnF, even if you go to extreme measures to try to get it to do so... but I have not tested this for myself.
The fact that the system uses WPS is another security topic all together. WPS is not secure and that's been known for several years. Hard to believe that Comcast and now Rogers and Shaw is perpetuating a known security hazard. On the other hand, maybe its not so hard to believe at all 😞
Vidéotron is in the Comcast X1 club as well: https://videotron.com/en/helix/television
(Cogego is the only major Canadian cable company that I know of that uses MediaFirst for their IPTV service: https://www.cogeco.ca/en/epico/ )
At least the Ignite gateways do not support WPS PIN... and my (enterprise) Wi-Fi AP's do not support WPS at all.
-
87645 views
-
36 Likes
-
-
