User Tools

Site Tools


No ai soldati italiani all'estero




Rigacci.Org usa energia elettrica da fonti rinnovabili, grazie al gruppo di acquisto Merci Dolci.

Merci Dolci - Energia Rinnovabile

Software libero!

Petizione contro i brevetti software

Faunalia: Soluzioni GIS professionali



Alcatel Speed Touch Home (Pro) ADSL Modem (Router)

Web configuration: a PPPoA connection

Basic configuration can be done via a web interface, at this default address: The factory password is blank.

Name VPI VCI Type
tiscali_pppoa 8 35 ppp

PPP (add a new entry)
Name tiscali_pppoa
Encap vc-mux
Status on

PPP Configuration
Password *******
Connection Sharing Everybody
Destination networks All networks
Address translation (NAT-PAT) Yes
Primary DNS
Secondary DNS
Local IP none
Remote IP none
Mode always-on
LCP echo enabled
PAP disabled
ACCOMP enabled

Command line

Here there is a manual for the Command Line Interface, it is intended for the Speed Touch Pro with Firewall, a more advanced model than the Speed Touch Pro, but most command apply the same.

Here are some examples to set a password, to set some specific NAT rules (port forward) and to set a default NAT server:

=>system setpassword password = MySecret
=>nat list
=>nat create protocol = tcp inside_addr = inside_port = 25 outside_addr = 0 outside_port = 25
=>nat delete protocol = tcp inside_addr = inside_port = 25 outside_addr = 0 outside_port = 25
=>nat defserver
=>nat defserver addr=
=>nat defserver addr=0

The default NAT server will receive all the packets received by the router on the WAN interface (TCP, UDP, ICMP, etc.).

To be safe, save the new config:

=>config save

The EXPERT mode challenge password

If a password was set, this is the prompt for a telnet session:

$ telnet
Connected to
Escape character is '^]'.
User :
SpeedTouch (00-90-D0-18-5F-7E)
Password :

You can type the password, if you know it, otherwise you can type the EXPERT backdoor password if you have an earlier version of the firmware. With a new firmware the EXPERT password is no longer valid for the telnet session, but it is still valid for the EXPERT command line mode (may be it is still vulnerable on the ATM interface? Read more).

If you want to calculate your challenge/response password goto this page.

Firmware upgrade

Note: I own an Alcatel Speed Touch Home, model number 3EC18604BCAA04. I upgraded from KHDSAA.134 to KHDSAA3.290 firmare. In my experience, uploading a new firmware from the web interface failed with an Invalid file uploaded error message. This with several images, even with the original one. So I definitely prefeer to do upload and download via FTP.

I also tried to upload the firmware GXKLAB3.426 which is reported to be the SpeedTouch Pro Firewall Software. Unfortunatelly the FTP session aborted, may be for the size of the file which is 235 kb larger than the original KHDSAA.134 file.

First of all you have to delete the passive (not used) firmware image to make room for the new image. If no passive software image is present at boot time, the active image is copied as the passive one. Active image is stored into the active subdirectory, passive image is stored into dl instead.

$ telnet
=>software deletepassive

Upload the new firmware via FTP, you can log-in as normal user or EXPERT user with challenge password:

$ ftp
Connected to
220 Inactivity timer = 120 seconds. Use 'site idle <secs>' to change.
Name ( admin
230 User 'admin' OK.  No password required.
ftp> cd dl
250 Changed to
ftp> bin
200  TYPE is now 8-bit binary
ftp> put KHDSAA3.290
150 Opening data connection for KHDSAA3.290
226 File written successfully
1007232 bytes sent in 36.62 secs (26.4 kB/s)
ftp> bye

Then we have to set the just uploaded image as passive and finally we switch images:

$ telnet
software]=>setpassive file = KHDSAA3.290
Active : KHDSAA.134             Passive : KHDSAA3.290

After the switch command, the Alcatel automatically reboots. khdsaa3_290.tgz

Convert an Home to a Pro

I did this upgrade to use the modem as a router, after this change I was able to set a PPPoA connection, doing NAT and port forward.

The upgrade consists of changing a word (two bytes) into the the EEPROM at address 2. The value for my Speed Touch Home was 0x8604, I changed it into 0x8606.

With firmware 253 or lower

 Access to expert mode is intended for qualified personnel
 only. Press ENTER to return to user mode.

'SpeedTouch (00-90-D0-18-5F-7E)'
Password :

rip>drv_read 2 1 b
the data in hex is :
rip>drv_write 2 1 b 8606

With newer firmware

=>td prompt

 Access to expert mode is intended for qualified personnel
 only. Press ENTER to return to user mode.

'SpeedTouch (00-90-D0-18-5F-7E)'
Password : *********

Switched to 'Trace & Debug' prompt.

Return to Normal mode by typing <NORMAL>

rip>drv_read 2 1 b
the data in hex is :
rip>drv_write 2 1 b 8606

Deep analysis and Recipes

Some sources for Alcatel firmwares

Alcatel "EXPERT" Mode Challenge/Response

doc/appunti/hardware/alcatel_st_dsl.txt · Last modified: 2008/10/23 10:03 (external edit)