• GPON Network Security Research

  https://pierrekim.github.io/blog/2016-11-01-gpon-ftth-networks-insecurity.html

ONT Details

• GPON Serial Number / SN
  • The serial number of the device contains 16 HEX characters. The first 8 characters in HEX are the Vendor ID. The rest of the bytes might be part of the MAC address or product identifier. Example: Vendor ID of 4857544328B04E9A in HEX is HWTC in ASCII. It can also be written as HWTC28B04E9A.
• PLOAM Password / SLID / GPON Password / ONTid
  • The GPON password is used for authentication with the OLT. It's random 10 ASCII or 20 HEX characters long. Example: ga1385dfr9 in ASCII is 67613133383564667239 in HEX.
  • Sometimes the ISPs use short passwords in ASCII, so if you are configuring the PLOAM password in ASCII mode you only need to insert the characters that the ISP defined, nothing more, but in case that you are configuring the password in HEX, you need to fill the missing values with zeroes to complete it to 20 characters. Example: abcd123 in ASCII must be completed to 61626364313233000000 in HEX.
  • PLOAM password in HEX cannot always be converted to ASCII because it can contain random octets. Example: The PLOAM passwords used by Movistar/O2 in Spain have this pattern F2019023298756000000 in HEX which cannot be converted to an ASCII string.
• LOID and LOID_PW
  • The Logical Identifier is another authentication method that is 24 + 12 bytes long for the CHECKCODE (LOID_PW). It's often based on ASCII characters but, by definition, it can be random octets.
  • By default, the ZTE (and other brand) ONUs have pre-filled LOID and LOID_PW fields by the default strings of 123456789 and 123456. This authentication method does not necessarily have to be used by the OLT. The OLT will only take the values needed and all the other values will be ignored.
• VendorID
  • ID of the vendor. ALCL, SCOM, HWTC, etc.

Usage GPON module SFP in Spain - Page 2 - MikroTik

ISP GPON Authentication

• SN only
• PLOAM password only
• SN + PLOAM password
• LOID + CHECKCODE (LOID_PW)

• ITU-T G.984.3 Amendment 1, Appendix VI

GPON SFP Modules Versions

GPON SFP Class Difference

• C+ OLT SFP can be used with B+ ONT SFP as long as the loss budget of the link is appropriate.