What do ITMS and TR-069 mean? The optical modem adjusts its own configuration in the middle of the night, which is the operator's remote hand

the post about the Unicom super admin password, the most frequently asked question in the comments was: The password was perfectly fine, who changed it in the middle of the night? I skipped over it at the time, but today I'll give the full answer: there's a housekeeper living in your optical modem, and the operator can reach into your weak current box anytime in the data center. Telecom is called ITMS, China Mobile is RMS, and the underlying protocol is called TR-069. Bridge modifications get pushed back, passwords change themselves, device counts get stuck—all done by the same hand. This article will take a look at this hand.

to clarify, this hand has a name—TR-069

TR-069 is not the operator's private product. It is an international standard established by the DSL Forum (later renamed Broadband Forum) in 2004, with the full name CPE WAN Management Protocol, which translates to "User Dwell Device WAN Management Protocol." The name sounds awkward, but when you break it down, it actually serves two roles: one is ACS, which automatically configures servers and installs them in the operator's data center; The other is called CPE, which is your optical modem.

the word "residence" is jargon, meaning "your home." Operators worldwide manage hundreds of millions of optical modems all relying on this system. In 2024, it just turned twenty, and its successor, the TR-369, has already arrived. The three domestic companies still can't do without it. The reason is simple: you don't need to manually fill in the parameters when the installer visits; you can remotely install them from the data center; If a malfunction occurs, you don't need to go to the site—you can remotely check light degradation, restart, and redo data. This saves the operator's own labor, and you're just the one being managed incidentally.

how it finds you, and how do you find it

Anyone who has changed the bridge should have seen that connection labeled TR-069 in the WAN connection list—that's the dedicated channel for the butler. When you click in, you'll find three things: the data center address (ACS URL), account, and password. If you want to see it in person, a regular account can go to the optical modem backend, find the "Network" or "Management" menu under the "Remote Management" page, and the ACS address will be clearly displayed there.

usually, it's the optical modem who proactively goes to the data center. There's a 'Periodic Inform' switch in the backend, with a default interval of 86,400 seconds, which means you report once a day: I'm still alive, model is this, firmware is this version. Besides this daily trip, the optical modem also proactively reports once right after powering on, restarting, or registering with a new one. So the first few minutes after plugging in the fiber are especially busy, half of which is spent exchanging codes with the data center. The check-in action is initiated by the optical modem's HTTP session. When the data center receives the receipt, it can easily insert the configuration to be sent into the packet and take it away.

data center can also wake up your optical modem in reverse. This action is called Connection Request, which defaults to port 7547. If you do nothing in the middle of the night and the optical modem restarts and upgrades the firmware itself, this is the direction that wakes you up. One way out, one in—the housekeeper's entire movement—there is no third way.

the mobile optical modem, I wrote about how to turn off periodic reporting. The path was explained in detail in that article, so I won't repeat it here.

it can change anything in the cat's interior

that's the part that really matters to you. It's not just about changing passwords; it can basically grasp all the operational parameters in the modem. I have compiled the pitfalls my family and my friends' families have made into a table:

says a few words in a row. The template section is the most frustrating: the data center stores a configuration template for the "standard family," but if you change it to bridge and the template numbers don't match, next time you issue a unified copy, they just overwrite the whole page. The VLANs you copied two months ago are all for nothing. As for the password, the super admin password for Unicom's new firmware is CUAdmin plus a string of numbers, which is regularly distributed by data centers. So 90% of the 'universal passwords' found online are expired—not to trick you, but because they really do move. As for the number of devices, some provinces are implementing household terminal count controls, with new devices directly excluded from certification. The strategy also comes from this channel.

Why do they choose the middle of the night, and how do they catch on-the-spot operations

Operations do it at dawn? It's not mystical. During the day, there are many online users, and a flood of complaint calls can overwhelm 10,000 calls. Their default maintenance window is from 2 a.m. to 5 a.m. The bridge at my home was restored, and the log's timestamp was just after 3 a.m., so it was frozen tight.

catch someone in the act, you don't need to wait and wait; the optical modem's system log will record this record. Checking logs in the background and recognizing the terms "TR-069," "ACS," and "SetParameterValues," all Huawei and ZTE machines recognize these terms. How to enter a log, what does each line mean? I wrote a dictionary-level , I won't elaborate here.

here's a fun fact: In 2016, Deutsche Telekom was scammed by someone using this hand. Some people used a variant of Mirai to scan port 7547 on public websites, exploiting vulnerabilities in the optical modem management interface, causing nearly 900,000 devices to repeatedly reboot and lose internet for most of the day. Since then, operators have been keeping a tighter watch on this door. So don't panic as soon as you hear about 7547—the data center channel and your internet access channel are separate. Home broadband users can't access someone else's fiber modem from the public network; the only thing that can access your fiber modem is the data center.

three companies' butlers each have their own names

same set of protocols, each with its own name, and each has a mobile app as a remote control:

Telecom's ITMS stands for Integrated Terminal Management System, while China Mobile's RMS stands for Remote Management System. The names are different but the character is the same: both allow remote configuration changes and come with mobile apps. The mobile app is actually the other hand of the housekeeper—you tap to restart the optical modem in the app, the command loops from the cloud, and the final route is still through this channel. This also explains one thing: if you delete the TR-069 WAN connection from the optical modem, the app will go blind because there's only that one leg. Some areas of Shanghai Telecom are migrating to the new SDN system, which is like having a new steward—the same jobs remain the same.

should we be afraid of it? How can we lock it up

Let me be fair: if you haven't changed the person you haven't bridged, this steward is a good thing. During fault reporting, technicians remotely check light degradation and redo data remotely, so you don't have to wait for your visit; Firmware vulnerabilities patched in the middle of the night; The registration step for the light modem was also taken over by the camera. Those who treat it like a thief are probably those who have been through the bridging process.

really want to touch it, choose from three tiers, and each tier costs more than the last. Stay at the first level, recommended to the vast majority, standard templates don't affect normal internet browsing. The second level of shutdown cycle reporting—a compromise for those who mess around: the optical modem no longer reports daily, and if the data center wants to batch distribute them, you have to wait for your next round of networking. The mobile firmware has ready-made switches, but some Telecom models have this switch gray. After shutting down Xiaoyi Butler and Hejiaqin, they're still alive. The third phase is to delete that TR-069 WAN and root it off. No matter who comes, it's useless. The cost is that all three mobile apps are blind, some provincial data centers can't see it, and they'll send you orders saying the device is offline. If you restore it from the factory, it will be fed back as is. Before deleting, you copied your broadband account and VLAN on paper.

By the way, there's another hidden pitfall when deleting TR-069: one day you want to change the bridge back to routing mode, but the data center can't help you anymore. I about this pitfall in the article about changing the bridge back.

my approach is the second tier: close the cycle and report with additional filing, still enjoying the benefits from the bridging process, and the steward hasn't completely turned hostile. As for the friend whose super admin password was dynamically changed, don't guess the sticker—the real way is to call customer service and have the technician show you from the side of the data center.