U

Visitor

 • 

3 Messages

Tuesday, September 13th, 2022 4:53 PM

Closed

Please explain event "CcspPandMSsp[4096]: system.syscfg commit to store" in my modem log.

I have noticed these entries in my modem event log the past week:

"CcspPandMSsp[4096]: system.syscfg commit to store 2022/9/12 21:53:54 Notice"

I researched  "system.syscfg"  and found a description of a command line utility for Intel based servers:

Intel® DOS-Based Save and Restore 
System Configuration Utility 
For 
SE7500 and SE8500 Based Intel® Servers

I did have 2 unidentified Intel devices appear and disappear on my network a few weeks ago. I use only HP products with AMD processors. 

I have had to replace the Xfinity based router once due to a possibly compromised device. I also appear to have a Remote Access Trojan accessing my system, so I'm trying to troubleshoot what is going on.

Problems I have had include:

>Modem randomly resetting

>Modem logs getting erased

>Modem appears offline on Xfinity app, even after refreshing, but is operational.

>Download and upload speeds are reported @120% of a 600 mbps service plan, but speeds are still lagging at the connected device level.

>Service outage reported only for my house, momentarily.

>Certain streaming apps subscribed through xfinity, such as Hulu are inaccessible.

Registered device was not my own.

*Router info and screenshots of logs are attached.

Please advise on this issue!

Accepted Solution

Problem Solver

 • 

1.5K Messages

3 years ago

Ccsp...XXX is part of RDK-B.  Runs on embedded devices.  That's your gateway.  Here's other features in it:  https://wiki.rdkcentral.com/display/RDK/RDK-B+Components

I don't know which parts technicolor implemented, and I don't program in it.  Just seen it before.

Random reset/Logs erased.  Resets can happen spontaneously due to poor line conditions.  Upstream power too high does it.  Too many errors or PLL lock fail does it.  When your gateway reboots it also loses it's log.  There's no space to write it, and no sense of 'log history' on a gateway.  They all do that. 

That could very well be your service outage and line speed problems as well.   If you want to diagnose that, then what do the signals look like on the line?  Start here.  There's some trouble shooting information about what they should look like, as well as other things to look for:  https://forums.xfinity.com/conversations/your-home-network/internet-troubleshooting-tips/602dae4ac5375f08cde52ea0  You can also post the signal tables here and we can look at it.  Sometimes the error logs are helpful too, but you'll have to redact your hardware MAC address in the error logs or the bot will flag it and mark it private (personal information).

As far as Hulu goes, you'll need a steady 5-6Mbps to get the service to even work.  Other services buffer better and can get away with less.  Hulu also splices in commercials that run at higher stream rates, and your app will fail if those can't be delivered or your connection stalls.  It's kind of a rotten app with the commercials.

Devices not known?  Change your Hulu password, remove the devices.  Use a password you don't use somewhere else, and pick a secure one (numbers, upper lower case, numbers, special chars....). 

Visitor

 • 

3 Messages

@flatlander3​ in response to the modem log history, I normally can access at least 3 months of history in the event, system and firewall diagnostic logs. I'm concerned my router/modem access is compromised by proxy of my network connected devices. The Intel device is not the router or any part of it.

I do need to take a look at the signal tables and compare them.

The Hulu account was linked to my xfinity streaming device, but when I attempt to log in, it says my Hulu account is already linked to email address and it prompts me to sign in, but the account is just a normal account, not linked to my xfinity account, if that makes sense. 

Problem Solver

 • 

1.5K Messages

3 years ago

RDK runs on a lot of stuff, not just Intel server boards.  They use it for the CMC/BMC controllers.  They've also got a lot of framework used on gateways and an MoCA stack.  I doubt someone "flashed" your modem without physical access, but exploits happen and firmware bios guy has never screamed "security" to me.   All bets are off when these things do a self initiated reset.  Depends on their startup sequence and if they rebuild the database --->>  that's what "Function.Store" usually means on embedded stuff, it's a database write.  A reset might show up.....or not.  I don't have their code base.

For your 'linked account', did you originally setup Hulu with another service?  Amazon offer.  RoKu offer.  Xfinity offer?  They run promo's on other services.  You could pick it up for $12/year last Christmas on Amazon.  You might want to look at subscriptions on one of those if you have them.

(edited)

Problem Solver

 • 

1.5K Messages

3 years ago

You still got one other issue (beside the signal cutouts), perhaps a more important one.   Two devices you saw connected?  Do you have an MoCA/POE (point of entry) filter installed?  It should go where the cable comes into your house/apartment.  About an inch or so long, silver usually.  Looks like a long connector.  It's a low pass filter that will block your neighbors from connecting to your gateway via coax.  It's high frequency network communication injected on top of your DOCSIS signal on the coax.  That can happen intentionally (stealing internet), or unintentionally (your neighbors might not have a filter either).  They are about $5.

MoCA implemented on these devices is NOT secure.  If you have no MoCA devices yourself, or a cable TV box, the POE filter can go right on the back of your gateway.  That eliminates the problem.  I'd look for it. 

Things you don't recognize are never good. 

forum icon

New to the Community?

Start Here