ZyXEL HES-319M2W

Ultimate WiMAX MIMO Technology for Outdoor Application

The ZyXEL HES-319M2W a.k.a. Linkem HES-319M2W, but please don't be confused to its original hardware manufacturer the Huawei Technologies. The Huawei model HES-319 and HES-319M2W on other country ISP is being loaded with ZyXEL operating system or. and by Linkem.

Benefits

Built-In High-Gain MIMO Antenna in the Outdoor Unit

The HES-319M2W Outdoor CPE provides integrated antenna (The CROSS- Polarization 14dBi) for easy installation and high performance in different environments. The MIMO technology will increase the coverage, bandwidth and reduce the edge corner which cannot get the better sensitivity. Tx Diversity is supported.

credits image

High Transmission Power with Low Power Consumption

The HES-319M2W supports the maximum transmission power on nominal 26 ± 1dBm at room temperature. This enable network operator to easily extend its radio network coverage.

credits image

Ultimate Broadband Wireless Technology

MIMO products support state-of-the-art Matrix A and Matrix B modes.

Software Upgrade over the Air

Through the WiMAX radio interface, the HES-319M2W Outdoor CPE supports TR-069 or OMA-DM fully configurable and software upgradeable through events triggered by the operators.

VoIP embedded in Outdoor Unit

The HES-319M2W Outdoor Unit supports two SIP (RFC3261)-based VoIP. It will be cost effective and price performance design concept. As for Indoor unit, it just simply provides power via PoE Ethernet Cable.

WiFi 11b/g/n and Ethernet

The HES-319M2W supports one WiFi (11 b/g/n) with two Ethernet RJ45 ports.

Advanced IP Networking Features

The HES-319M2W Outdoor CPE supports advanced IP networking functionalities, including all Secure NAT Router features needed to access the Internet safely.

Easy-to-Install Multi-User Solution

The HES-319M2W comprises an integrated antenna. The LED bars as well as buzzer showing the WiMAX radio signal strength can be used

Specifications

WiMAX Air Interface	Reference standard: IEEE 802.16e-2005 SOFDMA Duplex mode: TDD Frequency: 3,400-3,600GHz Channel Bandwidth / FFT size: 5MHz / 512FFT, 7MHz/ 1024FFT, and 10MHz/1024FFT Modulation: QPSK, 16QAM, 64QAM(DL Only) Matrix A & Matrix B support Sensitivity: -96dBm @ QPSK 1/2 Antenna: 14 dBi MIMO CROSS- Polarization Aggregate throughput Up to 20 Mbps QoS management based on classification: BE, UGS, rtVR, nrtVR, ertVR Security: PKMv2, EAP-TLS, EAP-TTLS/CHAP/PAP/MSCHAP/MSCHAPv2, CMAC message authentication, CCM mode 128-bit AES data ciphering Idle mode, Sleep mode, Hand Over, BS-initiated scanning and reporting.
ND&S*2	Auto selection User selection
Wi-Fi Air Interface	Reference standard: IEEE802.11b/g/n Transmit Output Power: o 802.11b: 16 dBm +/-2.0 dBm o 802.11g: 14 dBm +/-2.0 dBm o 802.11n: 13 dBm +/-2.0 dBm Receiver Sensitivity: o 802.11b: -86dBm @ Typical o 802.11g: -71dBm @ Typical o 802.11n: -65dBm @ Typical
IP Networking	Support IPv4 Static IP, DHCP client/server/relay DNS relay, DNS cache User configurable Router (RIPv1, RIPv2) and NAT (one-to-one, many-to-one) VPN Pass Through (PPTP & L2TP Pass-Through)
Voice over IP	SIP V2 (RFC 3261) and SDP (RFC 2327) G.711 a/u and G.729 codec Echo cancellation G.168 VAD (Voice Activity Detection), Silence suppression and CNG (Comfort Noise Generation) DTMF Detection and Generation Fax pass-through(T.38)
Phone Features	Caller ID and Message Waiting Indicator (MWI, RFC 3842) Call Waiting, Call Hold, Call Forward (Unconditional/Busy/No Answer) and Call transfer (Unattended and Attended Transfer) Early Media, Music on Hold
Management	Remote TFTP/HTTP Firmware Upgrade Web-based/SNMP/Telnet Management Over-The-Air firmware upgrade(OMA-DM,TR-069)
Hardware Specifications
Outdoor Unit	Provides Power over Ethernet via PoE ports (one for Ethernet, one for VoIP). Five Intelligence LEDs Reset to Factory Defaults The pole-mounting kits Rated for outdoor weather environment including ultraviolet sun radiation
Indoor Unit	Provides Power over Ethernet via PoE ports (one for Ethernet, one for VoIP) Two RJ-11 ports for VoIP Two RJ-45 ports for Ethernet 802.11b/g/n Wi-Fi interface LEDs: Power indication, WiMAX connection status, WiMAX Signal status, Wi-Fi connection status, VoIP status LED
Power Specification	External power supply: 48V DC Average power consumption at peak: 24 W
Physical Specifications
Outdoor Unit	Dimension: 255(W) x 254(D) x 58(H) mm Weight: 1071 g
Indoor Unit	Dimension:188(W) x 131(D) x 41(H) mm Weight: 284 g
Environmental Specifications
Outdoor Unit	Operation Temperature: -40oC ~ 60oC Operation Humidity: 10% ~ 90% (Non-condensing) Storage Temperature: -40oC ~ 65oC Storage Humidity: 10% ~ 95% (Non-condensing)
Indoor Unit	Operation Temperature: 0oC ~ 45oC Operation Humidity: 10% ~ 90% (Non-condensing) Storage Temperature: -40oC ~ 65oC Storage Humidity: 10% ~ 95% (Non-condensing)
Certification	CE certification marked for EMC and Safety Water Tightness: IEC529 / IP65

Read More

How-To Upload myBRO Device Certificate and Private Key

I made this write ups for the request of my guest readers who has having a hard time on uploading their myBRO DV235T device certificate and private key aka the Green Packet 4G wireless broadband WiMAX CPEs. Let me tell you that this WiMAX modem have different flavor, the first firmware release and being loaded by PLDT/Smart Telco were version: v2.10.14-g1.0.6-smart then v2.10.14-g1.0.7-smart and next is v2.10.14-g1.0.8-smart similarly there is also stock firmware of Green Packet which is used by subscriber/s and Netizen who are avid of getting the full access to this device such as the web_update-2_3G-v2.10.14-g1.0.4-gp and the web_update-3_5G-v2.10.14-g.1.0.5-gp all of this said firmwares work for this tutorial.

This guide will help you upload your myBRO DV235T Green Packet 4G WiMAX modem broadband device certificate and private key only via any web browser will do.

First, open any web browser such as Firefox, IE, SeaMonkey or any other similar browser and point to https://192.168.15.1 if you are using PLDT/Smart Firmware and https://10.1.1.254 if your device is loaded with Green Packet stock firmware.

Once you are login to the graphical user interface (gui) as the above screenshot, navigate your mouse  on the left Main Menu point to WIMAX menu  it will prompt you the sub-menu on Authentication Setting.On the Authentication Mode drop down and select User and Device Authentication. Just leave the below setting that has check/tick.

Next, on the EAP Supplicant just follow the Screenshot above I hope it is very clear to you on how to fill up the following space provided make sure your MAC address the colon (:) is omitted, then upload the device certificate wmx_client_ca.pem  likewise the private key wmx_priv_key.key.

Scrolling down, on the Options Menu please do not forget to untick or uncheck the Ignore Cert Verification and then click the Save button to apply the changes you have done.

Finally, go back to Main Menu, navigate your mouse and point  it to Network menu, then on the WAN sub-menu. Locate the space provided labeled with Clone MAC Address as what the snapshot show you. You can now input your desired MAC Address make it sure that the colon (:) now is not omitted. Again scroll down hit the button Save, your myBRO DV235T 4G WiMAX broadband modem will now reboot in 70 seconds. Login again on the stated IP addresses to your corresponding firmware now you are connected. Enjoy!

Read More

MyBro : How-To Change MAC Green Packet DV-235T

We all know that the new product of SmartBro the "MyBro Abot Kaya Broadband" 4G WIMAX is a super secured customized firmware by Smart/PLDT ISP as of today. Saying that so its not insecured because many of us has already have tried navigating it graphical interface (gui) including the telnet portion with used of "smart" username and password account but end up with limited privileged, some of the menus are missing likewise on the command line interface (cli) if your wireless modem device is already updated with the firmware v2.10.14-g1.0.6-smart over the air (OTA) then the chances on tweaking your MyBro CPE is none of the above.

In this section, the oldest released of MyBro 4G WiMAX DV-235T that the firmware has not been updated OTA is firmware version v2.8.7.2-154 if you have this kind of CPE customized firmware by Smart/PLDT then you are all the way to be able to change the WAN MAC address of your Green Packet DV235T.

So here's the DIY on how-to change the MAC address of MyBro 4G WiMAX Green Packet DV-235T.

First, if you are not at eased with telnet utility then you can use Putty as an alternative to it you can download from here. Extract anywhere on your desktop, then login to the Web gui default address http://192.168.0.254 with the username and password as "admin".

Check the Network Status, take note of your current WAN MAC address in case you want to put it back just save it on a notepad. Next is open the Putty utility via SSH or Telnet the option is yours with the default IP address 192.168.0.254.

Login as "admin" for the username and password its same with the web gui account.

The next thing we do is use these following commands orderly to change the WAN MAC address successfully.

enable

router

wan mac
commit
exit
wimax
wmx freq add 2505000 10
wmx freq add 2507500 10
wmx freq add 2510000 10
wmx freq add 2602000 10
wmx freq add 2612000 10
wmx freq add 2622000 10
wmx freq add 2638000 10
commit
wmx widescan add 2505000 2639000 1000 10
commit
exit
reboot

From the screenshot above we have just successfully change the WAN MAC address of MyBro 4G WiMAX Green Packet DV-235T likewise the allotted working frequency of the wireless broadband modem. Please wait the CPE will reboot, login again verify that your MyBro DV235T WAN MAC address now has totally changed.

The MyBro firmware version v2.8.7.2-154 is very rare to find since all CPEs are being updated thru TR069 over the air (OTA) by the Smart/PLDT system the chances to get this firmware is very reluctant because the person who have this don't want to leak or seed it to any forum (their business). Its not totally a hopeless for us since there is already an alternative of doing this, there is another Green Packet firmware its a stock firmware you can upload the firmware via web gui if you do not have the NAND flash programmer or write it directly with the TSOP48 socket with any alternative NAND flasher.

Read More

Huawei WiMAX Password Generator

Recently, Globe Telecom one of the major wireless ISP in the Philippines updated all their Huawei devices 4G WiMAX CPE remotely using TR069  that is connected to their network and this will enhance some features to the wireless modem especially firmware version V100R001PHLC08B025.

The delima with the new firmware 2011 updates is that the old tricks to locate the admin password for the subscriber to gain access to the advanced features on the CPE device such as Huawei BM622i will no longer co-exist.

This how-to is an alternative way to generate the admin password in order to login as admin account with the privilege unchanged of the 4G WiMAX CPE. Things you need are:

1. Download this file Huawei WiMAX BM622i password generator here
2. Extract the downloaded file using WINRAR, 7zip, or compatible .rar extractor
3. Open/Click this file 'ExcelAccess.exe' from the extracted folder.

You can check this previous post on how to get the MAC address on Globe Broadband 4G WiMAX Huawei Bm622i using default username and password.

4. Now you will have to get you MAC address under your Huawei BM622i modem (under the bar code you will see MAC: AA11BB22CC33) something like that.

5. Enter your MAC here

6. Click 'GENERATE' button to generate your admin password and will show something like this below

7. Now copy/paste that in your notepad (you can use ctrl-c & ctrl-v to copy paste), so you can remember easily.

8. On your web browser got to URL: http://192.168.254.1/globe and then enter username: admin and your generated password.

9. After a successful login, you will now be able to fully administer your BM622i 4G modem, and will be able to open other special tabs.

Hope this helps.... just leave a comment if you appreciate my post.

I got this from another forum site, and wanted to share my own experiment, and so I made my own procedures. Enjoy!

Read More

How-To Protect The MediaTek Firmware Destroyer

Just recently last December 2013 there have been so many releases of  MediaTek 4G WiMAX modem firmware both Huawei BM622m and myBRO DV235T of Green Packet Technology are among has the tutorials given for free by Netizens via forums on how-to tweak this both devices. These two (2) CPEs are the latest 4G WiMAX modem of Globe Telco and Smart/PLDT ISP for their wireless broadband subscribers claimed to be the high speed internet connection.

After the released of the firmwares and the tutorials, now there are so many 4G WiMAX wireless broadband modem are facing the so-called firmware destroyer. Screenshot below attached the Globe Huawei BM622m being remoted and uploaded by a malicious script.

image credit to turbotor

Another 4G WiMAX modem is myBRO DV235T manufactured by Green Packet Technology used by Smart/PLDT, since they used same MediaTek chipset they belong to same vulnerabilities. These two (2) 4G WiMAX CPEs are both insecured, if you are using this wireless home residential gateways make sure this device is fully patched, you must do something to safeguard this modem otherwise this could be a headache for you.

image credit to orl4nd

Of course, there is a solution for this exploit you can manually closed all the unprotected ports for the remoter not being able to get inside to your myBRO likewise the BM622m. Alternatively, changing the default username and password can also help you CPEs tweak by unauthorized person from the outside of your network zone.

Read More

Huawei BM622i Change MAC via Upgrade Telnet

Here's another trick to change the MAC Address of your Huawei BM622i 4G WiMAX CPE wireless broadband modem using BM622i V100R001PHLC08B029PST03.exe dis-upgrading the firmware 2011 via telnet command line interface (cli).

First you have to download here the Globe WiMAX 4G wireless broadband CPE modem upgrade utility filename for Huawei BM622i V100R001PHLC08B029PST03.EXE and run it, as you can see the screenshot above.

Just leave it open as it on the screenshot above, open up telnet client if you have Putty utility much better input 192.168.254.1 at port 23 and click open.. But if you don't have on your Windows 7 you must enable it on Control Panel  then Program and Features where telnet is located. Windows XP telnet client is enable by default just Click Start => Run then type telnet 192.168.254.1 command hit enter it will prompt you a window lead to command line interface.

You may now login using the simple steps below:

LOGIN: Firefly

PASSWORD: $P4mb1h1r4N4m4nT0!!

Then press enter

ATP>xiugai macdizhi XX:XX:XX:XX:XX:XX
ATP>diag restore default

Wait, now the Huawei BM622i WiMAX 4G Wireless broadband CPE modem will reboot. Open any your favorite browser on address bar type http://192.168.254.1 with the username and password user, use Huawei WiMAX password generator to generate the admin password to be able to login as admin privilege account.

Congratulation, you may now able to change your Huawei BM622i WiMAX 4G CPE wireless broadband modem.

Read More

Unlock myBRO DV235T Smart PLDT Firmware

I just want to share this article to all my guest readers who always come across to this resourceful tech blog about  the myBRO DV235T 4G WiMAX wireless modem broadband router that has builtin WiFi an indoor unit from Green Packet Technology Berhad Malaysia. The DV-235T CPE as we all know is only intended for Smart/PLDT WiMAX network because of its frequency assignment whereas Globe WiMAX and Wi-Tribe has higher frequency so there is no way to used it on other ISP.

Last December 2013 there were so many links and mirror of Green Packet DV235T stock firmware aka myBRO  have been leak, I am one of those eagerly wanted to have it on hand and even paid for the updates remotely just to be able to tweak this device I have on me. Without knowing that the Smart/PLDT customized firmware is even best for this 4G WiMAX wireless modem broadband router only unlocked this CPE to have the fullest administration just like the stock firmware (web_update_v2.10.14-g.1.0.4-gp.tar.gz) of Green Packet. The myBRO DV235T can be unlock using the command line interface (cli) just login with the default username and password via telnet or ssh.

Here's a few screenshot I have just grabbed from my Asus lappy, this will only proves that with the default Smart/PLDT customized firmware can be unlocked, tweaking this CPE is absolutely possible.

This is the most interesting part of myBRO DV235T, we always use the command line interface (cli) such as telnet or ssh to change the WAN MAC address of this 4G WiMAX wireless modem broadband router. As you can see below you can just input your valid credentials/account on the provided space and you are ready to go. Its hassle free if you are noob on the CLI.

This experiment is not to alter this device, bricking your own device is at your own responsibility. Enjoy your life while it last!

Read More

Reconnect Huawei BM622m 4G WIMAX CPE

The Huawei Echolife BM622m 4G WiMAX CPE is one of next new generation gateway to work for 4G WiMAX network. It has some difference from HUAWEI BM622i and BM622, and supports up to 20Mbps downlink and 5Mbps uplink on WiMAX network.

Specifications:

• IEEE 802. 16e-205 Wimax Air Interface
• 2.5Ghz(Huawei BM622m)
• Built-in Smart Antenna Array
• 802.16e Security for Authentication and Ciphering
• Supports MIMO 2R x 2Tx
• Supports WEB UI Configuration Tool
• Qos Management
• Local and Remote Control and SW Upgrade Capabilites
• Device Management Based on TR-069/OMA-DM(Optional)

This video above is only taken from YouTube and not merely persuade you to do this act, whether or not it is a scam posted by YouTube user it is not my responsible for the used and misused. It is only serve as for educational purpose only.

Read More

Huawei BM626e Wimax CPE

Huawei BM626e is a WiMAX CPE specifically for multi-user family and enterprise users. The BM626e is designed in compliance with IEEE802.16e 2005. The BM626e enables you not only to set up a local area network (LAN) flexibly, but also to access the Internet in a wireless mode. Besides, as an alternative, WiFi Air Interface supports a flexible data communication system by the air interface rather than traditional cable within a building or other small locations.

The BM626e provides the wireless Internet accessing function, the routing function and network address translation (NAT) function, and delivers an access rate maximum to 20Mbps downlink and 5Mbps uplink on WiMAX network.

Summarized many years of business experience, we know how to improve the performance of CPE. Built in high gain antenna array, double transmit channel. These advanced techniques will improve cell edge coverage efficiently and bring up an ultra CPE.

Additionally, the WEB UI of the BM626e provides a friendly interface to configure Bandwidth, Frequency, VoIP, WiFi, Security, and view information etc. Therefore, the BM626e delivers wireless freedom and creates a new experience in your life.

Huawei BM622e Feature:

• WiMAX CPE
• IEEE 802.16e-2005 Wimax Air Interface
• 2.5Ghz(Huawei BM626e)
• Built-in Smart Antenna Array
• 802.16e Security for Authentication and Ciphering
• Supports MIMO 2Rx2Tx
• Supports WEB UI Configuration Tool
• Qos Management
• Local and Remote Control and SW Upgrade Capablities
• Device Management Based on TR-069/OMA-DM(Optional)
• IEEE802.11b/g/n Wifi Access Point

Read More

MyBro Green Packet DV235T Stock Firmware Update Help

Recently I have posted about SmartBro new product that they wanted to promote the myBro aka "Abot kaya wireless home broadband" the 4G WiMAX wireless internet that uses the Green Packet CPE model DV235T. What I do not know is that this 4G wireless modem router device has been already tweaked silently almost a year done by many forumers and it has just leak this few weeks by SB netizen that stock firmware updates have been compromised and leak the links to Google.

With my curiosity to have also the updates whom I wish to be able to tweak my donated DV235T I'll keep on searching until I stumble upon to the source. There are at least two (2) Green Packet stock firmware for myBro DV235T that has been seeded online one is for free (web_update-3_5G-v2.10.14-g.1.0.5-gp.tar.gz) and the other is you must have to pay (web_update_v2.10.14-g.1.0.4-gp.tar.gz) whom I paid it for U$35 via remote update and the only copy I have is on the Chips itself of Hynix H27U1G8F2BTR since I badly needed it the only option of mine is "take it or leave it".

After my DV235T has been updated remotely here how it looks like, you can check on my other post the details of the Green Packet stock firmware v2.10.14-g.1.0.4-gp. The most interesting here is the Hardware model:WIXFMM-144 and also the Frequency range:2300000KHz~2400000KHz, 2490000KHz~2700000KHz. Make sure before you upgrade to any updates of your device firmware you have a screenshot for your reference and for your comparison. If you go back to the myBro Smart customized firmware v2.10.14-g1.0.7-smart here's how it looks like.

It only shows that Green Packet stock firmware v2.10.14-g.1.0.4-gp is the right firmware updates for the myBro DV-235T 4G WiMAX wireless broadband modem router because it is for Hardware model:WIXFMM-144. In addition, the  Frequency range:2490000KHz~2700000KHz is also being added. 

On the other hand, going here to the free Green Packet stock firmware (web_update-3_5G-v2.10.14-g.1.0.5-gp.tar.gz) you will notice that the updates or firmware is for CPE Hardware model:WIXFMM-129,  likewise taking a look closely to the Frequency range:3300000KHz~3600000KHz obviously the firmware will not suite to the myBro DV235T. It may or may not work perfectly because of mismatch hardware model and firmware updates. As I have tested with the given above firmware the myBro Green Packet DV235T will not bricked  as you can see I have the screenshot of it. There are three (3) issue I have found out using this firmware, one the WiMAX LED signal has strong indicator or very high though if you open you GUI on RSSI is most likely the same dBm with ver.04. Second is the the trade off, your built-in WiFi signal is getting weaker. Third, it can connect but unstable, you will be facing frequent disconnection so there is no used of upgrading to this stock firmware (web_update-3_5G-v2.10.14-g.1.0.5-gp.tar.gz) you will be having a headache definitely.

Since I DO NOT have the stock firmware in me or I can't get any firmware online because of no one is willing to seed it. The only remedy is on the Chips Hynix H27U1G8F2BTR using NAND flasher/programmer (I/you) can copy the raw firmware but can not use it via GUI upgrade only thru TSOP48 write it directly to the NAND Flash memory to be able for you/your myBro aka DV235T work it perfectly with out worries on changing the WAN MAC address, disconnection, WiFi weak signal etc....

Hope this article will help those netizen have upgrade their myBro Green Packet DV235T 4G WiMAX wireless modem router with the wrong firmware.

Read More

Microwave RF Transceiver Accelerates WiMAX Development

WiMAX equipment is now being developed for consumer broadband and back-haul wireless applications. Based on the IEEE 802.16-2004 standard, WiMAX is getting easier to design every day. SiGe Semiconductor's latest WiMAX chip set should speed the creation of new set-top boxes and basestation systems (Fig. 1).

The SE7051L IF transceiver is a biCMOS device that interfaces directly with most commercially available baseband controllers (Fig. 2). It features low noise and high linearity, and it has selectable IQ or bandpass I/O interfaces. It operates from 10 to 70 MHz and requires only a single IF filter. Also included are dual IF and RF synthesizers as well as a high-speed digital variable gain control delivering 50 dB of gain control. The package is a 56-pin QFN that measures 8 by 8 mm.

Two versions of the RF transceiver are available, so designers can comply with most worldwide frequency assignments. The SE7351L covers the 3.3- to 3.7-GHz range used in Europe and some Asian areas. The SE7251L covers 2.3 to 2.7 GHz, which is used in the U.S. Both deliver the low phase noise and high linearity necessary for high-level modulation schemes like quadrature amplitude modulation (QAM) in orthogonal frequency-division multiplexing (OFDM).

The receiver has a third-order intercept figure of +5 dBm. The noise figure is less than 6 dB, including the switch and filter losses. The total RF gain is 100 dB with an automatic gain control (AGC) of 40 dB gain-control range. The transmitter section is optimized for OFDM and supports frequency-division duplex as well as time-division duplex (TDD) operation.

The RF transceivers are housed in a 40-pin QFN package measuring 6 by 6 mm. These ICs are made with gallium-arsenide (GaAs) heterojunction bipolar transistor (HBT) technology. An external power amplifier, also available from SiGe Semiconductor, is required.

The SE7380L is a GaAs pseudomorphic high-electronic-mobility technology (PHMET) single-pole, double-throw (SPDT) switch used for transmit-receive switching. It has low insertion loss and high linearity for maximum dynamic range with OFDM and high-level modulation schemes.

Samples are available now, with full production starting late this summer. The price per chip set is expected to be about $30 in volume quantities. A reference design with schematics, bill of materials, and design files is available.

SiGe Semiconductor Inc.
www.sige.com

Read More