[Sephiroth]

Yes - The associations I mentioned are anecdotal, albeit fairly consistentl. I posted this in the other place:

All cable traffic related to an authorised CM is encrypted with a Primary Security Association ID. The key for this encryption is the TEK (and is derived from the CMTS allocated Authorisation Key).

The TEK has a finite lifetime (as does the Authorisation Key), and periodically this has to be refreshed as part of the authorisation maintenance process. The TEK packet header holds the TEK sequence number. The CM requests a new TEK from the CMTS. The response includes the new TEK and the lifetime remaining in the current TEK.

Now, here's what I think might happen. If there is an upstream problem, the next (delayed) packet sent upstream could contain the TEK sequence number of an expired TEK. hence the message: TEK Invalid - Invalid Key Sequence Number

In this case, there is a disconnexion of your session because you are non longer obeying the Security Association protocol.

There could be other causes of the Invalid Key Sequence Number. It could simply get corrupted on the way up or become corrupted at the CMTS.

The T3s are not yet a disconnect, but could be a symptom of the TEK errors.

Note that this response, which is more or less accurate, casts little/no light on what could be the cause of the BSR issues.