You're going to get maximum functionality for experimenting by going with the IP+ feature set over the base feature set. Still, this is a broadband router running IOS 12.3.23 mainline, so you're going to be limited in the features available.
DOCSIS 2-WAY 3DES IP+ LAWFUL INTERCEPT
ubr7200-ik9su2-mz.123-23.BC.bin
This unit is based on the Cisco 7200 platform and uses the same NPE modules, so it may be worth shoehorning the standard 7200 IOS into it to see how much functionality you get. Worst case scenario is that you have to reload it with the original software.