APC Smart-Signaling Cable (940-0024) Proprietary Analysis: Serial Port Access & Network Card Recovery for UPS Units


2 views

After inheriting an APC UPS with an AP9606 network card, we encountered IP configuration loss after host reboots. The serial port approach became necessary when:

  • Manual ARP entries (192.168.1.100 → 00:C0:B7:XX:XX:XX) failed
  • Switch port mirroring showed no ARP replies from UPS MAC
  • Hard reset didn't restore DHCP functionality

The Cisco YC cable (RJ45-DB9) initially seemed promising, but pin mapping differs:

APC 940-0024 Pinout:
1 - CTS  2 - RTS  3 - TXD  4 - GND  5 - RXD  6-8 - N/C

Cisco YC Pinout:
1 - DCD  2 - DTR  3 - TXD  4 - GND  5 - RXD  6 - DSR  7 - RTS  8 - CTS

When physical cables don't match, consider these approaches:

  1. USB-Serial Adapter with Custom Wiring:
    # Python snippet for serial testing
    import serial
    try:
        ser = serial.Serial(
            port='/dev/ttyUSB0',
            baudrate=2400,
            parity=serial.PARITY_NONE,
            stopbits=serial.STOPBITS_ONE,
            bytesize=serial.EIGHTBITS,
            timeout=1
        )
        ser.write(b'\r\nstatus\r\n')
        response = ser.read(100)
        print(response.decode('ascii'))
    except Exception as e:
        print(f"Serial error: {str(e)}")
    
  2. Network Card Recovery via TFTP:
    # Bash TFTP upload example
    tftp 192.168.1.100 <
    

APC uses modified Modbus RTU for serial communication. Observe these patterns:

  • Startup sequence requires \x00\x00\x00\x00\x00\x00\x00\x00\x00
  • Command structure: [Address][Function][Data][CRC]
  • Default baud rate alternates between 1200 and 2400 during handshake

For immediate results without original cable:

# Custom cable wiring solution
APC RJ45 Pin | DB9 Adapter
-------------------------
3 (TXD)     → 2 (RX)
5 (RXD)     → 3 (TX)
4 (GND)     → 5 (GND)

Combine with null modem adapter if handshake fails. Test connection with:

stty -F /dev/ttyUSB0 2400 raw
cat /dev/ttyUSB0

When dealing with legacy APC UPS units like the AP9606 network card model, IP configuration drops after reboots are surprisingly common. Through packet sniffing with Wireshark, I observed the card fails to respond to ARP requests when this occurs - suggesting either firmware corruption or a deeper DHCP lease issue.

The DB9 serial port on these units uses modified RS-232 signaling at 2400 baud rate. While APC claims their 940-0024 cable is proprietary, pinout analysis reveals:

APC Pinout:
1: DCD (Input)
2: RXD (Input)
3: TXD (Output)
4: DTR (Output)
5: GND
6: DSR (Input)
7: RTS (Output)
8: CTS (Input)
9: RI (Input)

A standard Cisco YC cable can be adapted with this wiring scheme. Here's a Python script to test connectivity:

import serial

def test_apc_connection(port):
    try:
        ser = serial.Serial(
            port=port,
            baudrate=2400,
            parity=serial.PARITY_NONE,
            stopbits=serial.STOPBITS_ONE,
            bytesize=serial.EIGHTBITS,
            timeout=1
        )
        ser.write(b'\r\nstatus\r\n')
        response = ser.read(100)
        return response.decode('ascii')
    except Exception as e:
        return f"Connection failed: {str(e)}"

When the network configuration disappears, follow this recovery sequence:

  1. Power cycle the UPS completely (including battery disconnect)
  2. Within 30 seconds of reboot, send ARP ping to 192.168.1.2 (default fallback IP)
  3. If no response, attempt serial connection with the YC cable adapter

To prevent future IP drops, configure the network card via serial with these commands:

set netsettings static
set ipaddress 192.168.1.100
set netmask 255.255.255.0
set gateway 192.168.1.1
config write
config save

The key is forcing static IP assignment - these cards often fail to persist DHCP leases across power cycles due to flawed NVRAM implementation in early firmware versions.