ONU Remote Debug (ME158)
Author: Marcin Kuczera
OMCI standard includes one object, that in my opinion is quite useful...
...however not all OLT vendors implement it. The object (manage entity) name is ONU Remote Debug (ME158) It's purpose is receiving command from OLT to be executed in ONT environment (can be regular unix shell) and to send back response to that command.
From specification (i.e. G.988) we can see, ME158 consists of:
Max length of command sent to ONT can consists of 25 ASCII characters (ASCII is mostly used), but exact length and format can be limited by OLT implementation (CLI limitation i.e.).
From ONT perspective (Realtek's SDK) it looks like that:
# omcicli mib get 158
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
OnuRemoteDebug
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
=================================
EntityId: 0x0000
CmdFmt: 0
Cmd:
EntryCnt: 0
ReplyTbl:
=================================
Now, let's try on Nokia (ISAM7360) OLT and XGSPON ONT:
typ:isadmin># remote-debug ont 1/1/4/2/105 uptime
Format: ASCII
22:47:30 up 3 days, 22:
Status: SUCCESS
typ:isadmin>#
and OMCI log:
0x0538 OnuRemoteDebug Get(0x0000,CmdFmt)
0x0538 OnuRemoteDebug GetRsp(0x0000,Result=0x0,CmdFmt=0x00)
0x0539 OnuRemoteDebug Set(0x0000,Cmd=0x757074696d6500000000000000000000000000000000000000)
0x0539 OnuRemoteDebug SetRsp(0x0000,Result=0x0)
0x053a OnuRemoteDebug Get(0x0000,ReplyTbl)
0x053a OnuRemoteDebug GetRsp(0x0000,Result=0x0,ReplyTbl=0x0000004b000000000000000000000000000000000000000000)
0x053b OnuRemoteDebug GetNext(0x0000)
0x053b OnuRemoteDebug GetNextRsp(0x0000)
0x053c OnuRemoteDebug GetNext(0x0000)
0x053c OnuRemoteDebug GetNextRsp(0x0000)
0x053d OnuRemoteDebug GetNext(0x0000)
0x053d OnuRemoteDebug GetNextRsp(0x0000)
05 38 49 0a 00 9e 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 00 e7 fe 56
05 38 29 0a 00 9e 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 f7 34 b3 85
05 39 48 0a 00 9e 00 00 40 00 75 70 74 69 6d 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 7e c4 67 3c
05 39 28 0a 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 04 4d 3e e5
05 3a 49 0a 00 9e 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 b3 c3 c1 61
05 3a 29 0a 00 9e 00 00 00 20 00 00 00 00 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 ea 56 0a 40
05 3b 5a 0a 00 9e 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 f9 af 65 41
05 3b 3a 0a 00 9e 00 00 00 20 00 20 32 32 3a 34 37 3a 33 30 20 75 70 20 33 20 64 61 79 73 2c 20 32 32 3a 00 34 37 2c 20 00 00 00 28 6b a6 1d 00
05 3c 5a 0a 00 9e 00 00 20 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 24 6b e6 0c
05 3c 3a 0a 00 9e 00 00 00 20 00 20 6c 6f 61 64 20 61 76 65 72 61 67 65 3a 20 36 2e 30 38 2c 00 20 35 2e 35 38 2c 20 35 00 00 00 28 9b 6f ae e9
05 3d 5a 0a 00 9e 00 00 20 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 f7 1e a1 44
05 3d 3a 0a 00 9e 00 00 00 20 00 2e 32 33 0a 00 72 61 67 65 3a 20 36 2e 30 38 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a4 69 72 3d
In this case, we can observe command "uptime" sent from OLT to ONT via remote-debug managed entity.
The first operation is a simple GET. Just to check what command format is accepted (and it is 0x0 so ascii):
0x0538 OnuRemoteDebug Get(0x0000,CmdFmt)
0x0538 OnuRemoteDebug GetRsp(0x0000,Result=0x0,CmdFmt=0x00)
Second operation is SET - and it sets "command" atribute with "uptime value:
0x0539 OnuRemoteDebug Set(0x0000,Cmd=0x757074696d6500000000000000000000000000000000000000)
*0x0539 OnuRemoteDebug SetRsp(0x0000,Result=0x0)
*0x757074696d65 = "uptime"
Third operation is to get table value of "response" parameter. This is not show in parsed mode, we we can see some data in hex:
20 32 32 3a 34 37 3a 33 30 20 75 70 20 33 20 64 61 79 73 2c 20 32 32 3a 00 34 37 2c 20
20 6c 6f 61 64 20 61 76 65 72 61 67 65 3a 20 36 2e 30 38 2c 00 20 35 2e 35 38 2c 20 35
2e 32 33 0a 00 72 61 67 65 3a 20 36 2e 30 38 2c
-----------------------------------
Now, let's try with Dasan OLT and GPON ONT (LXT-010G-D):
DASAN-OLT-V5824G(config-gpon-olt[2])# onu remote-debug 11 uptime
Length 75
23:26:01 up 1 min, loa
DASAN-OLT-V5824G(config-gpon-olt[2])#
From ONT - and OMCI log perspective:
0x003e OnuRemoteDebug Set(0x0000,Cmd=0x757074696d6500000000000000000000000000000000000000)
0x003e OnuRemoteDebug SetRsp(0x0000,Result=0x0)
0x003f OnuRemoteDebug Get(0x0000,ReplyTbl)
0x003f OnuRemoteDebug GetRsp(0x0000,Result=0x0,ReplyTbl=0x0000004b000000000000000000000000000000000000000000)
0x0040 OnuRemoteDebug GetNext(0x0000)
0x0040 OnuRemoteDebug GetNextRsp(0x0000)
0x0041 OnuRemoteDebug GetNext(0x0000)
0x0041 OnuRemoteDebug GetNextRsp(0x0000)
0x0042 OnuRemoteDebug GetNext(0x0000)
0x0042 OnuRemoteDebug GetNextRsp(0x0000)
In this case, it looks like OLT considers only ASCII available, not even checking CmdFmt value.
80 3e 48 0a 00 9e 00 00 40 00 75 70 74 69 6d 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 77 eb c8 d8
80 3e 28 0a 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9b fc 38 38
80 3f 49 0a 00 9e 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 f5 1f 28 b9
80 3f 29 0a 00 9e 00 00 00 20 00 00 00 00 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 ad a0 63 3e
80 40 5a 0a 00 9e 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 e7 e0 03 b7
80 40 3a 0a 00 9e 00 00 00 20 00 20 32 33 3a 32 36 3a 30 31 20 75 70 20 31 20 6d 69 6e 2c 20 20 6c 6f 61 00 64 20 61 76 00 00 00 28 1c 1d 29 cf
80 41 5a 0a 00 9e 00 00 20 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a2 e3 8d a3
80 41 3a 0a 00 9e 00 00 00 20 00 65 72 61 67 65 3a 20 33 2e 32 37 2c 20 31 2e 30 39 2c 20 30 00 2e 33 39 0a 00 72 61 67 00 00 00 28 32 b5 21 45
80 42 5a 0a 00 9e 00 00 20 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 6d e7 1f 9f
80 42 3a 0a 00 9e 00 00 00 20 00 65 3a 20 33 2e 32 37 2c 20 31 2e 30 39 2c 20 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 5f 73 71 ad
If you want, you can find response string in hex content of a message.
-------------------------
Some of you will ask - what about Huawei?
My answer is - ask Huawei... it seems, that they don't need that, and as long as customers are not asking - there is no need to add such feature to CLI.
In general - it is possible to send such command over OMCI using RAW OMCI message sent mechanism over CLI.
What about ZTE?
Also not supported... at least I have no information how to use it.
I will appreciate information about other OLT SUPPORTING RemoteDebug commands.
Let me know - marcin.kuczera@leolabs.pl
Practical use case
We do have a device based on RTL9607C SoC (4x 1G LAN, 2x POTS) - Leox LXT-240G-C2. It is mostly used as L2 device, but it works in fact in hybrid mode.
It is possible to make it a router, so all the iphost functionality and WAN creation are useful as well as TR069.
So the case is that some customers configure iphost (0) to get ip address from DHCP. They could ping the ONT, but - no webGui access was possible (from WAN side).
So, we have created a binary file that operates on iptables level, and unlocks port 80 on specific interface. In this case - that specific interface is iphost interface managed by OMIC.
The command is:
iph0mgmt
That command can be also initiated from OLT side:
Dasan:
DASAN-OLT-V5824G(config-gpon-olt[2])# onu remote-debug 11 iph0mgmt
Nokia:
typ:isadmin># remote-debug ont 1/1/4/2/105 uptime
This binary opens webGui access for 60 seconds, once connected - the connection is kept as long as it is not closed by user(tcp protocol). So, new connections well be blocked again after 60 seconds, so you have enough time to start yours.
Same mechanism can be used to open telnet or ssh port on ONT device for further/deeper debugging/troubleshooting if necessary.