TR-069 Protocol Support

This page is a reference for the TR-069/CWMP protocol features the emulator implements: the CWMP RPC methods an ACS can call, the events the CPE raises, the Connection Request transports, and the supported diagnostics, software-module and bulk-data profiles.

Most of these features are exercised by the ACS against a running emulated device (they are part of the TR-069 data model), rather than from the Web UI. Use Single Emulator Mode (or the /apiV2 API) to start a device and watch the resulting sessions in the live log.

Supported CWMP RPC Methods

When the ACS calls GetRPCMethods, the emulated CPE advertises the following methods (defined in cpe_methods.txt). The emulator processes each of them in an ACS-initiated session:

RPC Method Direction Description

GetRPCMethods

ACS → CPE

Return the list of RPC methods the CPE supports

GetParameterValues

ACS → CPE

Read one or more parameter values from the data model

SetParameterValues

ACS → CPE

Write parameter values (triggers diagnostics when a DiagnosticsState is set)

GetParameterNames

ACS → CPE

Enumerate parameter/object names under a path (honours NextLevel)

GetParameterAttributes

ACS → CPE

Read notification/access-list attributes

SetParameterAttributes

ACS → CPE

Set the notification level (active/passive/off) on parameters

AddObject

ACS → CPE

Create a new object instance (e.g. a WiFi SSID or a PortMapping)

DeleteObject

ACS → CPE

Remove an object instance and everything under it

Download

ACS → CPE

Firmware / config file download (HTTP or FTP) — see File Transfers (Download / Upload)

Upload

ACS → CPE

File upload (HTTP or FTP) — see File Transfers (Download / Upload)

Reboot

ACS → CPE

Reboot the device (raises a 1 BOOT event on return)

FactoryReset

ACS → CPE

Reset to defaults (raises a 0 BOOTSTRAP event)

ChangeDUState

ACS → CPE

Install / Update / Uninstall a Deployment Unit — see Software Modules (Deployment Units, TR-157)

The CPE also issues Inform at the start of every session and TransferComplete after a Download/Upload completes. The events that open a session are listed in TR-069 Event Codes.

TR-069 Event Codes

The emulator can raise the following CWMP events. They open a session with the ACS and appear in the device log as <code> <NAME>.

Event Name Code Meaning

BootStrap

0

Initial setup / factory reset

Boot

1

Device reboot

Periodic

2

Scheduled inform

ValueChange

4

A parameter with active notification changed

ConnectionRequest

6

ACS-initiated connection request (see Connection Request Transports)

TransferComplete

7

Download/upload completed

Diagnostics

8

Diagnostics complete (see Diagnostics)

DUStateChangeComplete

11

Deployment-unit state change complete (see Software Modules (Deployment Units, TR-157))

Events can be triggered manually for a Single Mode device through POST /apiV2/invoke (field eventName, using the exact names above).

The Single Mode Invoke Event dropdown exposes codes 0, 1, 2, 4, 6, 7, 8. DUStateChangeComplete (11) is not in the dropdown but can still be triggered through the /apiV2/invoke API.

Connection Request Transports

A Connection Request is the mechanism an ACS uses to ask a device to start a session immediately, rather than waiting for the next periodic inform. The emulator supports all three TR-069 transports:

Transport Enabled by Notes

HTTP (default)

connectionRequestEnabled (Load Test) / Enable HTTP Connection Request (Single Mode)

A listener on port 9999 accepts GET /{serial} from the ACS and opens a 6 CONNECTION REQUEST session. This is the common path and the only one with a UI toggle. See Connection Request Host.

XMPP (CWMP Annex K)

Data-model objects (ManagementServer…​XMPP)

When the device’s parameter tree contains an enabled XMPP connection-request profile, the emulator connects to the XMPP server (DNS-SRV discovery, TLS, retry/back-off) and listens for connection-request IQ stanzas. Templates: xmpp_connection_obj.xml, xmpp_server_obj.xml.

UDP / STUN

ManagementServer.STUNEnable + ManagementServer.UDPConnectionRequestAddress

When STUNEnable is true, the emulator runs a STUN client to discover its NAT-mapped address, publishes it in UDPConnectionRequestAddress, and accepts UDP connection requests.

HTTP Connection Request is the only transport with a Web UI / REST toggle. XMPP and UDP/STUN are driven entirely by the device data model — include (and enable) the relevant ManagementServer objects in the parameter-tree XML you load.

HTTPS Connection Request

The HTTP listener can also serve HTTPS. Start the JVM with an https:// Connection Request address and the emulator opens an additional TLS listener using the bundled certificate (certs/server-cert.pem / certs/server-key.pem):

java -jar target/FTCpeEmulator.jar --web-mode \
  -Dconnection.request.address=https://<host>:<port>

The listener port can be overridden with -Dconnection.request.port (default 9999). See Environment Variables for the Docker mapping of CONNECTION_REQUEST_HOST.

Diagnostics

The emulator implements the standard TR-069 diagnostic state machine: the ACS sets the diagnostic object’s DiagnosticsState to Requested (via SetParameterValues), the emulator runs the test, writes the result parameters and raises an 8 DIAGNOSTICS COMPLETE event.

Diagnostic Trigger object (parameter prefix)

IP Ping

IPPingDiagnostics. / …​IPPing.

TraceRoute

TraceRouteDiagnostics. / …​TraceRoute.

Download Diagnostics

DownloadDiagnostics.

Upload Diagnostics

UploadDiagnostics.

UDP Echo (config + send)

UDPEchoConfig. / UDPEcho…​

Neighboring WiFi Diagnostic

NeighboringWiFiDiagnostic.

IP Layer Capacity Metrics

IPLayerCapacityMetrics.

Vendor WiFi (X_ATP_WiFi)

X_ATP_WiFi.

IP Ping and TraceRoute execute the host OS ping / traceroute (tracert on Windows) commands, so their results reflect the machine running the emulator. The other diagnostics are simulated against the configured target host/port.

File Transfers (Download / Upload)

The Download and Upload RPCs are handled over HTTP and FTP (with Basic authentication). On completion the emulator sends a 7 TRANSFER COMPLETE event with a TransferComplete RPC.

  • In Load Test Mode, enable Transfer Emul (transferEmulation) and set a Transfer Delay to simulate realistic transfer timing across the batch — see Emulator Configuration.

  • Transfer faults are reported with standard CWMP fault codes (e.g. 9012 login failed, 9015 could not connect, 9016 transfer failed).

Software Modules (Deployment Units, TR-157)

The emulator supports the TR-157 software-modules object model and the ChangeDUState RPC. The ACS can request three operation types:

  • Install — download a Deployment Unit (DU) from a URL, parse its metadata and create DeploymentUnit / ExecutionUnit instances.

  • Update — replace an installed DU with a new version.

  • Uninstall — remove a DU and its execution units.

Each operation result is returned via a DUStateChangeComplete (event 11) session, including per-operation fault structures where applicable. The relevant data-model objects are …​SoftwareModules.DeploymentUnit.{i}. and …​SoftwareModules.ExecutionUnit.{i}..

Bulk Data Collection (TR-157)

The emulator supports TR-157 Bulk Data Collection profiles. Each enabled profile periodically collects the parameters referenced by its collection tasks (wildcards across multi-instance tables are supported) and HTTP/HTTPS POSTs the report to the profile’s ServerURL.

Profiles are configured through the data model under …​BulkData.Profile.{i}. (Enable, ReportingInterval, CollectionTask.{j}.ParameterName, ServerURL). Collection is scheduled automatically from each profile’s ReportingInterval.

The parameterstree/707GR1_BulkData.xml tree is a ready-made example with Bulk Data profiles already defined — load it from the Parameter Tree selector to see bulk reporting in action.

TLS / Certificates

Direction Behaviour

CPE → ACS (outbound)

Any https:// ACS URL is accepted. Server certificates are not validated (trust-all), so no CA configuration is required for test ACS endpoints.

ACS → CPE (Connection Request)

Optional HTTPS listener using the bundled certs/server-cert.pem / server-key.pem — see Connection Request Transports.

Bulk Data upload

Bulk data reports are sent over HTTP or HTTPS depending on the profile ServerURL.

Related Documentation