11/17/2017

Unbricking a Cyclades Terminal Server

Unbricking and Updating a Cyclades Terminal Server (TS)  After a Failed OS Flash


This is a formerly bricked Cyclades TS3000, just one of many models (TS400, TS800, TS1000, TS2000, and TS3000) of Terminal Servers originally sold by Cyclades  which was bought by Avocade, which was bought by Emerson Network Power,  who changed their name to Vertiv.  The last OS update was released in 2008 and it reached it's end of life years go,  they can be found for a few hundred dollars on eBay or various re-sellers.



They are a 1U piece of rack mount gear, the TS3000 has forty-eight (48) RJ-45 serial ports, one 10/100 Ethernet port, and a Console port.  Inside the box it is has a 48mhz PowerPC CPU,  128 megabytes of ram , and a 8 megabyte CF (compact flash) card.  It runs on an embedded Linux (TS-Linux), which is stored as an image on the CF card.

If the OS/Firmware image is no longer bootable, the device's documentation states that it will attempt to get an image (file name zvmppcts.bin) from a TFTP server, and provides a default addresses for which it send the request to (192.168.160.1).   BUT,  if the device has been configured the IP address it will send the default to or from could have been changed.  The boot loader/recovery software that makes the TFTP request is very limited, with just enough functionality to find and download the image.  This can make it difficult to unbrick the device in the event that it has been improperly updated.

This makes recovery of the device somewhat difficult but not impossible. Here is the process in which I was able to recover my Cyclades TS3000:

First, prepare the environment of the Cyclades TS and computer.

Run an Ethernet cable and console cable between the Cyclades TS and make sure the Cyclades TS is turned off.

On the computer,  disable or disconnect all network interfaces but the one connected tot he Cyclades TS.  Configure  the Ethernet port a static IP address, I suggest trying the default address it will send the TFTP get request to, 192.168.160.1 255.255.255.0

Next, three pieces of software will be needed.   A TFTP server, I used Pumpkin http://kin.klever.net/pumpkin ,  A packet capture software,  Wireshark  is probably the most widely uses https://www.wireshark.org/,  And A Terminal Emulator,  I used Putty http://www.putty.org/


After installing Pumpkin 1. Rename a copy of the OS image to zvmppcts.bin and place it into it's root directory.  2. Configure it to "give all files." 3. Start the server and leave it running/waiting for requests.


Install  and/or load Wireshark, start a capture for the port you plan on connecting to the Terminal server.



Open up Putty (or your terminal emulator of choice), and start a console connection session.

Once all the software is set up on the computer, turn on the Cyclades TS.  And watch the network traffic flow in Wireshark.

Wireshark capture of a successful ARP request, TFTP get request, and start of transfer. 

You should see an ARP request originating  the Cyclades TS's physical address. It will repeat a few times if not answered.   If answered it will send the request, and it is up to the TFTP server to send the file nor not. 

 In my experience  it asks for 192.168.160.1 (default IP that it will look for the TFTP server at) but wants the Mac Address of 192.168.160.1 to be told to 172.16.42.150.   172.16.42.150 is an address I gave the device some time ago.    Obviously,  a host with the address of 192.168.160.1 can't send a packet directly to 172.16.42.150, they are on completely different logical networks.  A host with 192.168.160.1 will send the response to it's default gateway.   The ARP request doesn't traverse Layer 3 gateways, nor does it seem like the Cyclades TS's boot loader/recovery rom have a default gateway or the ability to find one.

  If the request is for the IP address suggested above (the default address to request from) and the address that needs to be told about it are within the same network the TFTP transfer should start. Skip to the Next Step,


To fix this problem you will need to have two IP addresses on the interface, one to receive and the other to send.    Add the address the ARP request was looking for and another address with subnet mask that would place the "tell" address and your interface's second address on the same logical network.  For me the Tell address was 172.16.42.150, so I gave gave it a second address of 172.16.42.151 255.255.255.0.    Turn off and on the Cyclades TS to trigger the boot loader/recovery rom to attempt the TFTP transfer again



If addressed correctly your Cyclades TS should be able to request an OS image and the TFTP server should be able to send it.


After a successful do TFTP transfer, the Cyclades TS will reboot and should give similar is not identical output as above.

WARNING ! YOU ARE NOT DONE YET! The OS image is not saved in flash.


In your terminal window, login to terminal server.  If your previous password doesn't work, the default login for Cyclades TS-Linux is "root" and password is "tslinux"



Once logged in run "wiz" to configure the IP address to set an IP of your choice.


While optional, once the IP address has been configured you can access the the web based GUI through your favorite browser.

You still need to upload the image again to be saved into flash. You've still got the TFTP server up and running, there is no harm using it again.  This is easily done in the CLI  with the current  TFTP server.  Just make sure whatever IP you have given to the Cyclades TS it can communicate with the TFTP already configured.

use the following commands:
cd /proc/flash
tftp -l zImage -r zvmppcts.bin -g 192.168.160.1
md5sum zImage

The OS image needs to be named zImage and placed in the /proc/flash directory where the CF card seems to be mounted.  There shouldn't be any dialogue  for completing the TFTP transfer successfully, check your TFTP server's log if you want to be sure.   TFTP has no error correction,  compare the check sum of  the zImage file to make sure it got transferred intact.

After you are sure it was transferred correctly reboot the Cyclades TS,  it should reboot on it's own.

No comments:

Post a Comment

Debian/Ubunt Package Installation from Default Repositories.

Before you Begin Note: This is meant to be a building upon the previous posts with minimal repetition, the previous post has relevant info...