HomePlug specification based powerline bridges are becoming increasingly popular. I've got myself two of them; the brand name is "ZEUS"; a strange brand that only seems to exist in Switzerland, and some people say it's actually ZyXEL (have a look at the guts). Whatever, according to the HomePlug alliance homepage (www.homeplug.org), there are only two manufacturers of powerline ICs at the moment: Intellon and Cogency Semiconductor. My bridges have the Intellon chipset (INT5130 integrated powerline MAC-PHY transceiver and INT1000 analog conversion IC). Intellon calls their implementation "PowerPacket".

Now, about the only thing that has to be configured with these is the encryption password, so your neighbor won't be able to sniff your data. A Windows program is provided for that purpose - you hook up the bridge directly to your PC, enter a 2-24 character password, and the password is saved into the bridge's EEPROM.

This is a bit of an inconvenience to non-Windows users, and even if you keep Windows boxes around, at least to me the software looks ugly. It keeps running strange daemons (WinPlcMan.exe, BridgeDeCor.exe, etc.) that use up to 100% CPU at times, and sometimes it's not possible to set the password without power cycling the bridge first (although that seems to be the fault of the bridge).

So I made an attempt at writing a program to set up the encryption key. I found some inofficial information on the web, and it agreed with what I learned from sniffing the communication between the PowerPacket setup software and the bridge.

I'm making the program available here for you to try; its status is currently somewhere in between an ugly hack and a simple use-once-and-throw-away tool. I have no idea if it works with other powerline bridges; although it should work with all Intellon-based ones. If you've had success with a particular product, please let me know!

Besides setting the encryption key, it can also capture and display powerline bridge management-related packets and request statistics from the bridge(s). All outgoing packets are sent as Ethernet broadcasts via the bpf device.

Current version: 0.2 – 06/08/2003 (download source)

Linux port by Enrik Berkhan: 0.2 – 08/03/2004 (download Linux source)

plconfig should work on most BSDs and Mac OS X (tested under FreeBSD 4.8 and Mac OS X 10.2)

Previous version: 0.1 – 10/12/2002 (download source)

Supported bridges

• ZEUS Powerline Bridge PLB11/H
• Gigafast PE902-EB
• Netgear XE102
• devolo dLAN duo
• Cisco/Linksys Powerline AV PLK200
• König CMP-HOMEPLUG25 85 Mbps
• Netgear XE104
• probably others with Intellon chipset; mail me if you know of others that work

Installation

• download the source code
• untar it: tar xfvz plconfig-0.2.tar.gz; cd plconfig-0.2
• compile it: make
• run it: ./plconfig
  • note: on Mac OS X, you have to run it with sudo ./plconfig, because it must be run as root to access the bpf device

Syntax

Powerline Bridge config version 0.2 by Manuel Kasper <mk@neon1.net>

Usage:   plconfig [-pqrh] [-b device] [-s key] interface

         -s key            set network encryption key
                           (plaintext password or 8 hex bytes preceded by 0x)
         -b device         use device (default is /dev/bpf0)
         -p                don't switch interface to promiscuous mode
         -r                request parameters and statistics
         -q                request Intellon-specific network statistics
         -h                display this help

         If -s is not specified, plconfig will listen for management packets
         indefinitely (after requesting stats if -r is specified)

If you just want to set the password on all bridges that can be reached with an Ethernet broadcast, use:

plconfig -s mysecretpassword interface

...where "interface" is where your powerline bridge is attached (fxp0 or whatever). You can also specify the key directly as 8 hex bytes, e.g. 0x0123456789abcdef). If you specify a plaintext password, the key will be generated according to the HomePlug specification (compatible with the original Windows PowerPacket software).

If you start plconfig with no options (other than the interface), it will just capture and display all Intellon MAC management packets (ethertype = 0x887b).

The -b option can be used to specify an alternate bpf device (in case you're running dhclient/dhcpd/tcpdump at the same time, bpf0 may be occupied). -p can be used if you don't want plconfig to set promiscuous mode on the interface. You probably won't get any replies then (see notes). If you're using -s, promiscuous mode won't be enabled anyway (no need to read packets).

The -r and -q options (you can only specify one of them at a time) broadcast a request for statistics and then keep waiting for answers until you abort it (by pressing Ctrl-C). Sometimes the bridges don't return any answers, see the notes section.

Notes/Bugs/Caveats (read this!)

• You'll most likely have to use promiscuous mode (default in plconfig) to obtain statistics because the braindead chip sets the Ethernet destination address of the replies to its own MAC address.
• For the same reason, you'll have to connect your bridge either directly (crossover cable) or via a hub to your machine if you want to do anything that requires a reply from the bridge (just setting the key does not). Switches won't pass the replies to you.
• The encryption key is specified as 64 bits to the bridge, but only 56 bits are used for encryption. This is because DES specifies that every eighth bit is a parity bit (odd parity) and thus not used during encryption. The bit that is ignored is the least significant bit of every key byte. This means that a key byte of e.g. 0xc7 is equal to 0xc6.
• The default network key is 0x46D613E0F84A764C, which corresponds to the password "HomePlug" as per the HomePlug password to key mapping scheme. The default encryption key (EKS = 0) is 0xDDDDDDDDDDDDDDDD.
• My powerline bridges don't always respond to the Intellon-specific network statistics request. I have to power cycle them every time to get them to answer another request. This also means that before using the original PowerPacket program to set up the password, I have to power cycle first because the program insists on getting a reply to its get network statistics broadcast before it sends the encryption key.
• Intellon-specific functions (and output parsing) may be buggy due to lack of documentation.
• I don't know how to get the bridge to send a "Confirm Network Encryption Key" response after setting up the key.

Change log

• 0.2 (06/08/2003)
  • plaintext passwords are now hashed correctly (compatible with the Windows software provided by Intellon); note that if you used -s <password> with v0.1, this no longer sets the same key when used with the same password!
  • MD5 implementation now included (no longer relies on system libraries)
• 0.1 (10/12/2002)
  • initial release