Xfinity XB3 hardware mod: Disable WiFi and save 2 watts

xb3_disable_wifi.md

Xfinity XB3 hardware mod: Disable WiFi and save 2 watts

Background

Comcast has a prepaid "Xfinity NOW" service that's cheaper than normal Xfinity, with unlimited data instead of a 1.2TB/month cap. If you currently have Xfinity, the NOW online signup is hidden, but when I called to cancel my Xfinity service on a date a couple weeks in the future, the NOW signup started working immediately. (I initially queried a neighbor's address to confirm that NOW was available in my area.)

The catch is that you can't use your own modem. They provide a free Arris TG1682P (also known as the XB3), but it's huge and uses more power (14.9 watts) than my Arris SB8200 (9.8 watts). I suspect they retired millions of these things and treat NOW as a recycling service.

The XB3 lets you enable bridge mode via the admin page at http://10.0.0.1/, and IPv4/IPv6 works just like a plain modem, but even in bridge mode, the gateway broadcasts several hidden SSIDs with no option to disable the radios. Curiously I did not see an xfinitywifi broadcast, but your modem may vary.

The Hack

I found reversible hardware mod to disable the WiFi radios.

Refer to this disassembly video. There are 6 screws (2 hidden), lots of plastic prying, and you will probably wrinkle the rear sticker.

My circuit board is labeled TG1682/TG2472:

Notice the two shielded WiFi modules. The shields just pop off but you can leave them on. In between is an 8-pin chip labeled "54328", a TPS54328 buck regulator. My meter shows that pins 6-7 (Vout) connect to various pins on both Atheros WiFi chips. Pin 1 is EN/enable. It measures 3.3 volts, and when I connect it directly to ground, it sinks negligible current.

So that's the mod. Connect Pin 1 on the 54328 to anything grounded. I used the far side of this nearby capacitor:

The XB3's idle power consumption dropped from 14.9 watts to 12.5 watts, the WiFi lights are off, and everything else seems to work via wired ethernet. I notice that http://10.0.0.1/ is inaccessible (connection refused or HTTP 503) for a few minutes after booting, but it wakes up eventually.

Caveats

I don't actually know what circuit pulls up the EN pin, so it's possible that I'm overloading a digital output somewhere. I just measured amps to ground and saw a small number. My first idea was to lift the pin before soldering the wire, but I found that too difficult.

The XB3 uses an Intel Puma 6 chipset, which has been in the news over the years due to latency/jitter problems. So far I'm not seeing anything weird on https://gfblip.appspot.com/ or https://speed.cloudflare.com/.

Hi,

Very useful post!

Regarding the TPS54328 chip, I'm wondering if just cutting the "EN"able pin 1 short from the PCB soldering, would achieve the same objective? Or it needs to be firmly connected to ground? The Texas Instruments' data sheet states that it enables the whole circuit only on a high potential. Although it doesn't mention explicitly what happens if the pin stays NC - would that be considered Undefined Behavior (susceptible to noise)?

The reason for asking is that I don't have a soldering iron right now, and I wouldn't prefer to just buy one only for this job :-).

Thank you.

I'm wondering if just cutting the "EN"able pin 1 short from the PCB soldering, would achieve the same objective?

The datasheet doesn't say whether EN has an internal pulldown resistor, so disconnecting it might make the output unstable.

If you can only cut, then cutting the VIN pin 8 might be a better idea. Just be aware that you lack the tools to reverse the mod if needed.

Ah, yes, I was thinking about the VIN pin 8 as well, which would just cut the power off completely from the chip.

And I don't think I a need a reversible mod approach to this, since Comcast does not expect the XB3 cable modem gateways (mine is Arris TG1682P model) to be returned. As per their End User Agreement for the Internet NOW service, the customers are expected to just throw it out when service is cancelled :). And I'll never rely on an Intel wifi Puma chipset for a reliable wifi AP in my house anyway 👎).

Maybe I'll just buy a little soldering station, there is one that is thermally-controlled at Lowe's and costing less than $50.

Thank you!

This is a great resource, so I wanted to contribute in regards to this mod. My board revision was a little different, labeled TG1682_CD. The 54328 is turned 90 degrees clockwise and lives above the silk-screened circled C in copyright. But aside from location and orientation, it looks almost identical to the close up picture, with just about all components around it placed in the same fashion. It is still labeled U415, so there is no mistaking it. I cut pin 8 (VIN), and viola, same result. 2.4 and 5 GHz lights are out, no unknown broadcasts from gateway, happy camper here.