Netgear WNR3500v2

From TechInfoDepot
(Redirected from Netgear WNR3500 v2.0)
Jump to navigationJump to search
multiple revisions of this device, use caution
bgn (N300)
RangeMax Wireless-N Gigabit Router
Netgear WNR3500-01.jpg
Support
Wikipedia
WikiDevi.wi-cat.ru
3rd Party Firmware
dd-wrt
OpenWrt
Tomato any flavor
Gargoyle
Status Unknown
Platform
BrandModelRev
Netgear WNR3500 v2
Serial number prefix
25V20
FCC ID
IC ID
Board ID
U12H127T00
Type
wireless router
Series
WNR3500
CPU1
Broadcom BCM4718A1
CPU1 Type
MIPS 74Kc (R2)
CPU1 Speed
453 MHz
Flash1 Chip
Macronix MX25L3205DMI-12G
Flash1 Size
4 MiB4,194,304 B <br />32,768 Kib <br />4,096 KiB <br />32 Mib <br />0.00391 GiB <br /> (Serial)
RAM1 Size
32 MiB33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br />
RAM1 Chip
Samsung K4T51163QG-HCE6
ETH chip1
Broadcom BCM4718A1
Switch
Broadcom BCM53115S
Ethernet Port Count
1-1GbE-WAN
4-1GbE-LAN
Wired Standard
IEEE 802.3/3u/3ab

802dot11 OUI: C0:3F:0E (14 E, 12 W), 00:26:F2 (10 E, 10 W)
Ethernet OUI: C0:3F:0E (14 E, 12 W), 00:26:F2 (10 E, 10 W)

Stock bootloader
CFE (128k)
Stock FW OS
Linux
Expansion IF types
none specified
Power
12 VDC, 1 A
Connector type
barrel
Serial Port (UART)
yes, 6-pin header, unpopulated, (115200 8N1)
JTAG Port
yes, 12-pin header, unpopulated
Other

Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1308 additional devices
of which 105 are Netgear devices
Default login user: admin
Default login password: password
admin:password credentials used by 420 additional devices
of which 301 are Netgear devices

Manuf/OEM/ODM
Foxconn U12H127 T00
3rd Party Firmware Support
DD-WRT • (List)
, FreshTomato • (List | DLs)
Retail
FCC approval date 23 January 2009
Country of manuf China
Physical
LEDs/Color
Yellow, Green, Blue
Dimensions
175 x 130 x 35 mm (6.89 x 5.12 x 1.38 in)
Radio 1
Chip1
Broadcom BCM4718A1
Wireless interface OUI
C0:3F:0E, 00:26:F2
Antenna Connector Type
Internal
MIMO status
2x2:2
Wireless Standard
IEEE 802.11b/g/n
802.11n
up to 300 Mbps
802.11g
up to 54 Mbps
802.11b
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz
Radio cor_rev
17
Radio Capabilities
ap sta wet led wme pio 802.11d 802.11h rm cqa mbss16 afterburner ampdu amsdurx amsdutx acktiming rxchain_pwrsave radio_pwrsave bcm_dcs
 FCC ID
Netgear WNR3500Lv1PY308400093
Netgear WNR3500UPY308400093
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
Netgear WNR3500Lv1BroadcomBroadcom
Netgear WNR3500Lv2BroadcomBroadcom
Netgear WNR3500UBroadcomBroadcom
Netgear WNR3500v1MarvellMarvellMarvell
Netgear WNR3500v2BroadcomBroadcom

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

For a list of all currently documented Netgear device with specifications, see Netgear.

300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class

Overview

Manuf. by Foxconn (Hon Hai) U12H127T00/U12H127T70

How To Identify Which Model Router You Have

by benryanau

After spending an hour researching the variants of the Netgear WNR3500 family and their specs prior to a purchase, I realized this would he handy to post up somewhere. So, I thought I'd table it up and share it, since there wasn't a concise guide anywhere on the web already. Hopefully this will help some people out!

Model Flash
/RAM
CPU USB Ant WLAN Eth WAN Notes FCC ID
WNR3500 v1 8/32 Marvell
88F5180NB1
@500 TopDog
No 2 int. N300 4x GbE GigE Blue Antenna LEDs on top PY307300074
WNR3500 v2 4/32 Broadcom
BCM4718A
@480 MIPS74k
No 4 int. N300 4x GbE GbE "V2" marked under orange LAN ports,
smaller housing, no antenna LEDs
PY308400093
WNR3500L V1
WNR3500U
8/64 Broadcom
BCM4718A
@480 MIPS74k
1x
USB 2.0
4 int. N300 4x GbE GbE WNR3500U/WNR3500L Marked
below yellow WAN port
PY308400093
WNR3500L V2 128/128 Broadcom
BCM47186B0
@480 MIPS74k
1x
USB 2.0
2 int. N300 4x GbE GbE Below yellow WAN port WNR3500L v2 PY310400153
Images

Links of Interest

DD-WRT forums

Flashing

Flashing DD-WRT

  1. Hard Reset/30-30-30
  2. Configurge PC for a static ip of 192.168.1.10
  3. Make sure nothing else but power and PC is hooked to router
  4. Load dd-wrt.v24-18946_NEWD-2_K2.6_mini-WNR3500v2.chk
  5. Wait 5 Minutes
  6. Browse to 192.168.1.1, make sure you get the change password page
  7. Hard Reset/30-30-30
  8. Browse to 192.168.1.1, change name and password, configure.

Flashing OpenWrt

  • Netgear WNR3500v2:
 • On the OpenWrt ToH (techdata entry)

17.01.0

Please insert instructions here

Flashing Tomato

"Due to hard-coded jffs2 partition, flash size is reduced to only 3,473,408 bytes. As of v2022.5, FreshTomato MiniIPv6 builds (with the filename pattern freshtomato-K26-NVRAM32K_RT-MIPSR2-<version>-MiniIPv6.zip) are 3,467,534 bytes and is the only image type that will fit. It will likely become necessary before long to look back to older releases in FreshTomato's download archive for images that are still small enough to fit it's available space."

Upgrading

Updating DD-WRT

If dd-wrt is already on the router follow these instructions. If stock firmware is on the router follow the flashing instructions.

  1. Check for recommended builds here first.
  2. Set your computer to a static IP of 192.168.1.7. (or to whatever subnet the router is on) Disable all firewalls and security. Disable wireless on your computer and only have the router connected to the flashing computer by the ethernet cable between the two.
  3. Hard reset or 30/30/30 (If the router supports it, if not, reset to defults in the GUI) prior to flashing. Wait. Check for password page on re-login and change password.
  4. Flash firmware. You can use the webgui except if you have a belkin router. (For belkin use tftp.exe to flash)
  5. Wait...at least three minutes. Lights should return to normal. See important2, below. Failing to wait is how most people brick their routers.
  6. Do a power cycle of the router. (Unplug the cord, count to 30 and plug it back in.)
  7. Wait for the lights to return to normal usually about 2 minutes.
  8. Hard reset or 30/30/30 again (If the router supports it, if not, reset to defults in the GUI). Wait. Check for the password page and re-login to change the password. Then you can reconfigure your settings manually.
  9. Once configured set your computer back to autoIP and autoDNS.

Important1: This Hard reset or 30/30/30 works fine for Asus router, but you do have to power cycle after the reset.

Important2: After you flash the firmware, and before you do the hard reset, the router will be building some nvram settings. YOU MUST WAIT FOR THIS TO FINISH PRIOR TO DOING ANYTHING WITH THE ROUTER INCLUDING A HARD RESET. Usually, you can tell when this process is completed by the WAN light coming on, but it does take several minutes. Go have a beer. There are starting to be more and more people who BRICK their routers by not waiting until the nvram is rebuilt, PRIOR to doing a hard reset. YOU NEED TO WAIT!

Reverting

From DD-WRT

No GUI reversion possible yet, see serial recovery for reversion.

Reverting to stock firmware

Adapted from NETGEAR's official documentation of the TFTP bootloader recovery process

The most robust method for replacing the stock firmware on this device in the event of a bad flash or a desire to stop using a third-party firmware is done using TFTP (Trivial File Transfer Protocol). Since most third-party firmwares do not alter the device's bootloader, this method can often recover devices that has ceased functioning correctly or even connecting to other devices. As a failsafe, the bootloader is designed to probe its LAN Ethernet ports moments into the start of every boot cycle for the presence of a TFTP server at the IP address 192.168.1.10, and if one is found, to request its file list and download the first file it encounters with either an .img or a .chk file extension and write its contents into flash memory. Assuming you're working from a modern Windows PC, the process tends to closely resemble this:

  1. Download TFTPD64 to your computer and make sure it executes successfully, then exit it for now.
  2. Downloads the OEM firmware from the Netgear web site and unzip the file (either with the Windows File Manager or a utility like 7-Zip) so that the .chk file in it is in a directory by itself.
  3. Configure your computer's network adapter with a static/manual IP address of 192.168.1.10, subnet mask of 255.255.255.0 and a default gateway of 192.168.1.1. Connect your network adapter to one of the router's LAN ports via Ethernet cable with the router powered off.
  4. Launch TFTPD64 again and make sure the static IP address you just configured is selected in the drop-down menu labelled Server Interface. Configure the Base Directory for the server as the directory where you extracted the .chk file containing the OEM firmware to.
  5. Power on the router. If the process begins successfully, within a minute of being turned on the power LED with turn orange and begin blinking, signalling that the bootloader found all the conditions needed to trigger the TFTP recovery mode and has begun the process of transferring the file and flashing itself with it. This will be briefly confirmed on the Server tab of TFTPD64 when the router appears in the connection list while it's retrieving the firmware file, and thereafter in the program's Log tab.
  6. Wait at least five minutes after the router closes the TFTP connection for the flashing process to complete and the router to reboot itself into the stock firmware; the process is complete when the Power LED has returned to steadily glowing white and the wireless network lights have turned on.
  7. Return to your network adapter settings and remove the static/manual IP address, subnet mask and default gateway entries, returning it to the "Automatic" or DHCP configuration mode.
  8. Open a web browser and go to the address 192.168.1.1 to begin reconfiguring your router's new firmware.

Serial-JTAG Info

Serial

Serial Pinouts

JP1

 VCC 1 o
  RX 2 o
 N/C 3 o
 N/C 4 o
  TX 5 o
 GND 6 o

Flash partitions

 dev:  size     erasesize name
 mtd0: 00040000 00010000 "pmon"
 mtd1: 00750000 00010000 "linux"
 mtd2: 005dc000 00010000 "rootfs"
 mtd3: 00080000 00010000 "jffs2"
 mtd4: 00010000 00010000 "nvram"
 mtd5: 00010000 00010000 "board_data"

DD-WRT Serial Recovery

Once you hooked up and getting data in putting/Hyper terminal and have a static ip on you pc of 192.168.1.10,

Power cycle the router. Imediatly start rapid firing CTRL+C until it breaks into the CFE.
  1. Get TFTP ready with the OEM firmware.
  2. Type tftpd, then click upgrade on the TFTP window.
  3. Give it about 5 min to bootup and settle, then goto 192.168.1.1

JTAG

JTAG Pinouts

J14

 nTRST   1o o2	 GND
   TDI   3o o4	 GND
   TDO   5o o6	 GND
   TMS   7o o8	 GND
   TCK   9o o10	 GND
 nSRST  11o o12  N/C

Using Universal JTAG Adapter

  white  1o o2	 black
    red  3o o4	 GND
   blue  5o o6	 GND
  green  7o o8	 GND
 yellow  9o o10  GND
 orange 11o o12  N/C

Using TUMPA

        TUMPA
   N/C  1o o2  N/C
 nTRST  3o o4  GND
   TDI  5o o6  GND
   TMS  7o o8  GND
   TCK  9o o10 GND
   N/C 11o o12 GND
   TDO 13o o14 GND
 nSRST 15o o16 GND
   N/C 17o o18 GND
   N/C 19o o20 GND

 Using the ribbon cable provided
 Black to your choice of pins 2,4,6,8,10 on router and 
 your choice of pins 4,6,8,10,12,14,16,18,20 on TUMPA for GND
 White to pin 1 on router and pin 3 on TUMPA for nTRST
 Grey to pin 3 on router and pin 5 on TUMPA for TDI
 Purple to pin 7 on router and pin 7 on TUMPA for TMS
 Blue to pin 9 0n router and pin 9 on TUMPA for TCK
 Green to pin 5 on router and pin 13 on TUMPA for TDO
 Yellow to pin 11 on router and pin 15 on TUMPA for nSRST

DD-WRT JTAG Recovery for Universal JTAG Adapter

Confirmed Working with North American Unit and Firmware

  1. Power Cycle, tjtag3 -backup:cfe128 /silent /otheroptions
  2. Power Cycle, tjtag3 -backup:nvram /silent /otheroptions
  3. Power Cycle, tjtag3 -backup:wholeflash /silent /otheroptions
  4. Power Cycle, tjtag3 -backup:custom /window:0x1fc00000 /start:0x1c3e0000 /length:0x10000 /silent /otheroptions
  5. The last step will backup the board data to "custom.bin, Using a Hex editer, check to make sure all the data looks similar to board_data.bin or post it to your thread in the dd-wrt forums and somebody can check it for you.
  6. If it is similar, change "U12H127T70_NETGEAR" to "U12H127T00_NETGEAR". The mac address starts at Hex address 40 in the middle pane, make sure it's correct. The Serial number starts at Dec address 76 in the right pane, make sure it's correct. The Security Pin starts at Dec address 108 in the right pane, make sure it's correct. The actual board data starts at Dec address 256 in the right pane, make sure it matches board_data.bin. If it looks all messed up then start fresh with board_data.bin and make all the changes ti it. When done "save as" "custom.bin" without the quotes. Makes sure it's in the same folder as TJTAG.
  7. Now do the same with the cfe128, mac sure mac address match(although not as important with the cfe). Check to see if is similar to cfe128.bin. If not or it's just totally messed up use the reference cfe128.bin. Just edit it to match the information from your router.
  8. Power Cycle, tjtag3 -flash:custom /window:0x1fc00000 /start:0x1ffe0000 /length:0x10000 /swap_endian /byte_mode /silent /otheroptions
  9. Power Cycle, tjtag3 -flash:cfe128 /swap_endian /byte_mode /silent /otheroptions
  10. Have TFTP.exe ready in WindowsXP, with WNR3500v2-V1.2.2.28_25.0.85NA.chk from that zip file.

Configure your computer with a static ip address of 192.168.1.10.

Connect the router to the pc via network cable.

Power on the router when it signals a connection click upgrade.

VLAN Info

DD-WRT VLAN Info

Images

Netgear Images
DarkShadow's Unit
FCCID PY308400093

See also

Models