Things I've Learned about the modems RCN uses.

Hybrid Networks Inc. N-231 (no linked docs on hybrid.com's web page).

Modem case can be removed with four screws.

Connectors:

Power (DIN-5)
RJ-11 (hidden)
RJ-11 (hidden)
RJ-45 Local Ethernet
DB-9  Com port of some kind
TV-F  Cable input

Coax goes into metal-shielded box (susprise!) which connects to the
part of the system board with a daugtercard on it. 
daugtercard is labeled "Hybrid Networks QPSK upstream Mod." 

Silkscreened on the board is "Sharp X0540YA-8"

From Hybrid's web page we learn that the downstream and upstream
channels are in separate bands. This explains why a traceroute from
one host to another always goes through an intermediate box; the head
end acts as a protocol-layer repeater.

No data is ever seen on the Ethernet side of the modem which isn't
intended for the host. The cable modem seems to act like a router
rather than as a bridge (again in contrast to the LanCity modems), and
does its job as a router pretty well.

Port-scanning the modem from the ethernet side produces nothing in
TCP; in UDP, we get:

Interesting ports on  (209.6.162.71):
Port    State       Protocol  Service
67      open        udp        bootps          
473     open        udp        hybrid-pop
9876    open        udp        sd              

bootp server is consistent with the DHCP service that is offered. The
"business" (multi-host) model of the modem can supposedly provide DHCP
service to several machines. The difference may just be configuration.

Don't know anything about 473 or 9876. 

The modem does not respond to SNMP from either side.

No data is observed on the serial port when the modem boots. Or any
other time, for that matter. Hybrid's documentation/white papers have
several references to using external modems with their boxes for the
asymmetric cable-down/modem-up scenario; the com port may be used for
that, not for system control. This seems slightly odd given the two
RJ11 connectors inside the box, which I had presumed were the standard
line/phone pair of modem plugs for an internally-implemented POTS modem.

The modem ARPs for the local host on the ethernet when it boots,
whether or not the coax is plugged in. This implies that the address
is in the modem's firmware, not downloaded from the head end.

Experimentally we learn that the modem can serve DHCP to the host box
when the coax is not plugged in.

Modem's MAC prefix is 02:00:d1.

Modem can acquire lock while powered on.

Boot sequence lights:

R T
* *
* *
* *
  *
*
* *
* *
* *
  *
*


Chips:

VALOR SF1012 wired to the Ethernet jack
ST16C552CJ (64-pin QFP) with a wire connection to the com port. dual UART.

2x DP83936AUVL-33 (160-pin QFP) (National Semiconductor ethernet
controller)

Altera FLEX EPF6016TC144-2 (144-pin QFP) (CAA189807) (some random PLD)
Altera EPC1441 LC20 CDA079801 (16-pin square socketed) (PLD EPROM)

Sharp LH28F008SCT-F85 (1Mbyte flash memory)

Hitachi HM62C3232FP8 (100-pin FP 30x20)
Hitachi SH-3 HD6417708 (144-pin QFP) (CPU)

2x TI 81CX8JK (48-pin inline FP)



Things to try:

Port-scan on the cable side.

Attach wires to 10baseT pins of the Ethernet chips and see if we get an
Ethernet-format of either the downstream or upstream channel.

Figure out which chip has the system firmware. Download and
disassemble (gdb does know aboout the SH-3).