Thursday, November 24, 2011

Dirt Cheap Terminal Servers

My job puts me in contact with lots of first-rate network gear.  I like much of that shiny stuff, but there are some relics for which I continue to have a soft spot.

One of those relics remains relevant today, but few seem to know about it.

It's the Xyplex MaxServer line of terminal servers.  When deployed for out-of-band console access, these things are capable of doing essentially the same job as a Cisco router with asynchronous serial ports, but at a tiny fraction of the price, and without the annoying octopus cable that's required for most Cisco async ports.

MX-1640 on top, MX-1620 below
MX-1640 on top, MX-1620 below
The main thing that's so great about these guys is the price.  I bought that 40-port unit for US $26 including delivery to my door.  That's only $0.65 per serial port.

They're cheap enough that I've got a flock of these things at home.  Everything with a serial port in my house is wired up.  I can take them to customer sites for labbing purposes and don't care if I get them back.

For comparison, the cheapest NM-16A (16 port asynchronous serial module) on ebay right now is $184.  Figure about $20 each for a couple of octal cables, plus $30 for a 2600 series router to run it all, and the cheapest Cisco alternative runs over $250, nearly $16 per serial port.

I know that people are buying Cisco 2511s and NM-16As for their home labs, and I'm guessing that ignorance of cheaper options is the reason the Cisco stuff bids to such ridiculous levels on ebay.

In an effort to spread the love for these relics, I'm sharing what I know about them.


The same basic product is available as both Xyplex MaxServer and MRV MaxServer.  I've seen an MRV unit once, but never configured one.  It looks identical, but may behave differently.

There is an older model MaxServer 1600 that has 8 or 16 ports, a rounded face with integrated rack ears, and no onboard 10Base-T transceiver.  You'll need an AUI transceiver for 10Base-T to use one of these older units.  I haven't used one since 1999 or 2000, so I don't remember if they're completely the same, and can't recommend them.

The 1620 and 1640 units have a label on the bottom indicating that their "Model" is MX-1620-xxx or MX-1640-xxx.  I'm not sure what the xxx suffix means, but I've got units with suffixes 002, 004 and 014, and I can't tell any difference between them.

Flash Cards
Sometimes these boxes come with a hard-to-find PCMCIA card.  If you have the card, then these guys can run totally independently.  Without the card, a TFTP server is required for boot and configuration.  The TFTP server can be anywhere on the network.  It doesn't need L2 adjacency to the MaxServer.  If one unit has the card, it can serve other units without cards.

The card has to be some ancient small capacity "linear" flash card, and not just any linear flash card will do.  I've tried lots of cards from different vendors, and only found a single 3rd party card that's recognized by the Xyplex (pictured below).  They run fine without the cards, so don't sweat looking for the card.

Rack Mounting
OEM rack ears are tough to find.

But the screws and ears from a Cisco 2600 work fine with the addition of a couple holes to the MaxServer chassis:
Cisco 2600, MaxServer with Cisco ear installed, unmolested MaxServer
Use a 1/16" bit and chuck it deep in the drill so that it won't reach more than about 1/4" into the chassis when it punches through.

You'll need a file called xpcsrv20.sys.  The md5sum of the file I use is:

Drop this file on the root of your TFTP server.  While you're there, if your TFTP server doesn't allow remote file creation (most don't), create a couple of empty files for your server to use for its configuration.  The format is:

x<last-6-of-MAC>.prm and x<last-6-of-MAC >.bck

So, I've got files named x0eb6b1.prm and x0eb6b1.bck that are used by my MaxServer with hardware address 0800.870e.b6b1.  The address is printed on a label near the Ethernet port.

Serial Pinout
Connecting these guys to a Cisco console requires a rollover cable.  I like to make my own using 2-pair cable for reasons I've previously explained.

Here's how I go about configuring one of these guys for:
  • Static IP addressing
  • TFTP download of the system software
  • TFTP download and storage of configuration elements
  • Telnet access to the serial ports
  • Telnet access for admin functions
The first step is to reset the box to factory defaults.

Connect a terminal to the first serial port using the same gear you'd use on a Cisco router's console port.  9600,8,N,1

With the system powered on, use a paperclip to manipulate the button behind the hole near the console LED on the front panel.
  1. Press the button
  2. Release the button
  3. Press the button
  4. The numbered LEDs should scan back and forth, then stop with two LEDs lit.
  5. Release the button.
Hit Enter on the terminal a couple of times.  You should see something like:
Terminal Server, Type 92, Rev G.00.00
Ethernet address 08-00-87-0B-DD-43
Configuration in progress.  Please wait
Type access and hit Enter.  The letters won't echo on screen.  You'll get a configuration menu.  The following text is the steps I follow for initial configuration purge.  Bold text is stuff that I've typed.
Terminal Server Configuration Menu
   1. Display unit configuration
   2. Modify unit configuration
   3. Initialize server and port parameters
   4. Revert to stored configuration
   S. Exit saving configuration changes
   X. Exit without saving configuration changes
Enter menu selection [X]: 2
Modify Unit Configuration Menu
   1. Initialization record #1 (Enabled)
   2. Initialization record #2 (Disabled)
   3. Initialization record #3 (Disabled)
   M. Miscellaneous unit configuration
   D. Set unit configuration to defaults
   X. Exit to main menu
The following series of answers sets everything to default.
Enter menu selection [X]: 1
Set Initialization record #1 to defaults (Y,N) [N]? Y
Enable initialization record #1 (Y,N) [N]? Y
Enter menu selection [X]: 2
Set Initialization record #2 to defaults (Y,N) [N]? Y
Enable initialization record #2 (Y,N) [N]? N
Enter menu selection [X]: 3
Set Initialization record #3 to defaults (Y,N) [N]? Y
Enable initialization record #3 (Y,N) [N]? N
Enter menu selection [X]: M
Display load status messages (Y,N) [Y]? Y
Total installed memory in megabytes (4,6,8) [4]: 4
Enter menu selection [X]: D
Initialize ALL configuration data for this unit to defaults (Y,N) [N]? Y
Still at the Modify Unit Configuration Menu, configure the first initialization record.  This information is what's used by the pre-boot environment.  We have to configure the IP information twice: the first instance represents what's used by the bootloader (or whatever), and the second instance is the IP information used by the running system.  I'm putting the terminal server at, and its TFTP server is at

Enter menu selection [X]: 1
Set Initialization record #1 to defaults (Y,N) [N]? N
Enable initialization record #1 (Y,N) [Y]? Y
Enable ALL methods for image loading (Y,N) [N]? N
Toggle (CARD,DTFTP,XMOP,MOP,BOOTP,RARP) load methods [C,X,M,B,R]: C
Toggle (CARD,DTFTP,XMOP,MOP,BOOTP,RARP) load methods [X,M,B,R]: D
Toggle (CARD,DTFTP,XMOP,MOP,BOOTP,RARP) load methods [D,X,M,B,R]: X
Toggle (CARD,DTFTP,XMOP,MOP,BOOTP,RARP) load methods [D,M,B,R]: M
Toggle (CARD,DTFTP,XMOP,MOP,BOOTP,RARP) load methods [D,B,R]: B
Toggle (CARD,DTFTP,XMOP,MOP,BOOTP,RARP) load methods [D,R]: R
Toggle (CARD,DTFTP,XMOP,MOP,BOOTP,RARP) load methods [D]: 
Enable ALL methods for parameter loading (Y,N) [Y]? N
Toggle (NVS,XMOP,MOP,BOOTP,RARP) load methods [N,X,M,B,R]: X
Toggle (NVS,XMOP,MOP,BOOTP,RARP) load methods [N,M,B,R]: M
Toggle (NVS,XMOP,MOP,BOOTP,RARP) load methods [N,B,R]: B
Toggle (NVS,XMOP,MOP,BOOTP,RARP) load methods [N,R]: R
Toggle (NVS,XMOP,MOP,BOOTP,RARP) load methods [N]:
Enable ALL methods for dumping (Y,N) [Y]? N
Toggle (XMOP,MOP,BOOTP,RARP) load methods [X,M,B,R]: X
Toggle (XMOP,MOP,BOOTP,RARP) load methods [M,B,R]: M
Toggle (XMOP,MOP,BOOTP,RARP) load methods [B,R]: B
Toggle (XMOP,MOP,BOOTP,RARP) load methods [R]: R
Toggle (XMOP,MOP,BOOTP,RARP) load methods []: 
Enter unit IP address []:
Enter host IP address []:
Enter gateway IP address []:
Enter TFTP image filename (64 characters max.) []: xpcsrv20.sys
Enter menu selection [X]: X
Now we're back at Terminal Server Configuration Menu.  We'll Initialize server and port parameters and then Exit saving configuration changes.

Enter menu selection [X]: 3
Should default server and port parameters be used (Y,N) [Y]? Y
Enter menu selection [X]: S
Save changes and exit (Y,N) [Y]? Y
At this point, the system should grab xpcsrv20.sys from the TFTP server.  Give this a minute to complete. Next you'll get a prompt like this:
               Welcome to the Xyplex Terminal Server.

Enter username>

With the way I use these boxes, it doesn't matter what username you type (at this prompt and at later prompts).  Just type something in.  I suppose it would matter if you configured RADIUS authentication, but I've never done that.  The default password is system.

Enter username> foo
Xyplex -901- Default Parameters being used

Xyplex> set priv
Password> system (doesn't echo)

Welcome to the Xyplex Terminal Server.
For information on software upgrades contact your local representative,
or call Xyplex directly at

in USA: (800) 435 7997
in Europe: +44 181 564 0564
in Asia: +65 225 0068


The prompt with >> indicates that we're in privileged user mode.  Configuration parameters are entered with either set or define commands.  set commands take effect immediately but are not persistent across reboots.  define commands don't take effect until after reboot.  Issuing set server change enabled causes define commands to take effect immediately, in addition to persisting across reboots, so I start with that one.
set server change enabled
define server change enabled
define server name My-Xyplex
define server internet name
define server welcome "My Xyplex"
define login password "myloginpassword"
define priv password "myenablepassword"
define server login prompt "passwd "
define server internet address
define server internet subnet mask autoconfigure disabled
define server internet subnet mask
define server internet broadcast address
define server internet primary gateway address
define server internet gateway auto discovery disabled
Port 0 is like line vty 0.  It's the in band management interface.  Ordinarily it listens on TCP/2000.  I move it to TCP/23.
define port 0 telnet echo remote
define port 0 telnet remote 23
define port 0 prompt "My-Xyplex"
define port 0 idle timeout 30
This next bit of configuration is the stuff I apply to the serial ports so that I can connect to them remotely.
define port 1-20 autoconnect disabled
define port 1-20 autobaud disabled
define port 1-20 access remote
define port 1-20 flow disable
define port 1-20 access remote
define port 1-20 telnet transmit immediate
define port 1-20 telnet binary session mode passall
define port 1-20 default session mode passall
define port 1-20 telnet newline nothing
define port 1-20 telnet echo character
define port 1-20 speed 9600
Accessing the ports
Once things are configured you access these ports in pretty much the same way that you would with a Cisco box configured for "reverse telnet".  Each serial port is listening on a TCP port: (portnum * 100) + 2000

So, port 1 is listening on TCP/2100, port 2 on TCP/2200, etc...

Useful commands
The only reason I log into the Xyplex directly is to kill off a stuck telnet session. Log in and access a privileged session like this:

chris$ telnet
Connected to
Escape character is '^]'.

passwd myloginpassword


Enter username> blah
My-Xyplex> set priv
Password> myenablepassword
To kill an existing session, use
My-Xyplex>> kill port X sessions all
To reload the Xyplex use
My-Xyplex>> init delay 0


  1. I have some Xyplex stuff that would have to be checked out first. Let me know if anybody wants Xyplex 1620s, 900 chassis with router and terminal server cards. I also think I may have some Network3000, Netwirk2000 Routerunners, 56K and 19200 Sportsters... sound like a former ISP? Yes. Oh Adtran CSU/DSU, and who knows what else!

  2. where are you seeing these available for $.65/port? The best price i can find on ebay is $60 for 20 ports.

    Also, where would we download the xpcsrv20.sys file?

  3. Hey Brian,

    The market seems a little steep right now. The last maxservers I bought were from ebay: $26 for 40 ports and $20 for 20 ports.

    Watch 'em for a while, I'm sure they'll come down.

    I'd hoped that the software image would be easily googlable, but am not finding it right now. Feel free to contact me by email. Assemble my first name, my last name, 'com', '@' and '.' into an email address in order to reach me privately.

  4. It seems MRV Communications has some support info for these Console servers. Here is link to a xpcsrv20.sys file...

    I haven't tried it yet but I will post my results if I ever get a chance to try this.

  5. Good find, anon!

    I grabbed the file. It's a self-extracting .exe

    Curiously, the filename suggests that it's the same version I'm running now (V6.3S15 - checksum above), but it checksum differently from the copy I'm currently using.

    Thanks for sharing, I look forward to hearing about your results!

  6. I just noticed that there are two files on the MRV link in anon's comment.

    The v63s15 file is the one I've been using, and is the one that I shared the MD5 in the article.

    The v63 file also works. I just booted an MX1620 using that one.

  7. Chris - I finally got around to trying this out. I can't get passed the TFTP download step. My TFTP server (TFTPd64) says the xpcsrv20.sys file downloads to the Xyplex just fine but then typically I get file uploaded back to my TFTP server called - loaderr.dmp. I can read the .dmp file as it appears compiled in a text editor. I've tried this about 10 times now. Once I got the "Welcome to the Xyplex Terminal Server." prompt but a crash message appeared before I could logon. I'm pain stakingly following your directions. Do you think my hardware is bad or is this likely user error? My Xyplex is surplus equipment that has never been used. When I saw your article I thought I could save some $ on an access server but I've spent hours on this now. Time is expensive too! Any ideas would be greatly appreciated.

    BTW - the v63s15 file is the one you should use. It includes a security fix. I've tried both with he same results.

  8. Bummer! I've never seen that before. The manual doesn't say much about loaderr.dmp, only that it "will be used to store the "mini-dump" that a unit generates when it cannot be loaded"

    Does the file on your tftp server have the same md5 checksum that I posted above?

    I have another idea - send me a note to myfirstname @ mylastname dot com

  9. Gents-
    Regarding this dmp file, if the Anoymous fellow could email it to me at burntkat @ the gmail place, I'd be willing to see if I can help..

    Thanks for the info on these, I'm looking for a couple for my training stack now.

  10. Thanks for the information guys!

    Today I acquired a XYPLEX MX-1608B-114 for $25 from a local computer equipment recycle place. I got most of it set up using the information and the file posted by anon. I think it got the because the card does not seem to work correctly so I had to set it up using TFTP.

    One issue I am having is that it sends the commands twice when I telnet to a device through it. I will troubleshoot some more.

  11. I'm necromancing this comment thread. Is there any particular advantage to these xyplex units over the Avocent Cyclades terminal servers?

  12. Hey Joe,

    I don't claim any advantage of the Xyplex over Cyclades.

    I just happen to know the Xyplex, and have a soft spot for it.

    They're also really cheap. 50 cents/port with shipping included on ebay right now (item 181096369855).

    OTOH, they're also quirky and terrible. I don't know the Avocent units, but people seem to like those. They're probably better :)

  13. Does anyone have the xpcsrv20.sys file? I've tried the link posted above from MRVs website and the link doesn't exist on their website.

  14. If anyone needs a copy of the xpcsrv20.sys file I put one up at

    I have a MaxServer 40 that I use for my Cisco lab and it works well for that purpose. Chris' trick for making rollover cables has saved me hours of frustration. Unfortunately, the supply of cheap ones on ebay seems to have dried up. At the moment, I can't find one for less than $75.

    If anyone is looking for a cheap terminal server I'd recommend either the Digi CM 32 or CM 48. They support SSH, have a web management interface, and you can use standard patch cables for the console connections. I picked up a CM 48 on ebay for $57 shipped.

  15. Stumbling on this in 2019 and still a great thread. Thank you Chris!