Linksys WRT610N v1

multiple revisions of this device, use caution

abgn (AN600)
Simultaneous Dual-N Band Wireless Router
Support	Support page
Wikipedia	Linksys routers
InfoDepot Wiki	Linksys WRT610N v1.0
WikiDevi.wi-cat.ru	Linksys WRT610N v1
3rd Party Firmware
dd-wrt	Supported
OpenWrt	Supported
Tomato any flavor	Status Unknown
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	Linksys WRT610N v1
Serial number prefix	CTG0
FCC ID	Q87-WRT610N, Q87-WRT610NV1
IC ID	3839A-WRT610N, 3839A-WT610NV1
Type	wireless router
CPU1	Broadcom BCM4705G
CPU1 Type	MIPS
CPU1 Speed	300 MHz
Flash1 Chip	Eon EN29LV640
Flash1 Size	8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (Parallel)
RAM1 Size	64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br />
RAM1 Chip	SK hynix HY5DU561622FTP-D43 x 2
nvram Size	32K
ETH chip1	Broadcom BCM4705G
Switch	Broadcom BCM53115
Ethernet Port Count	1-1GbE-WAN 4-1GbE-LAN
Wired Standard	IEEE 802.3/3u/3ab
802dot11 OUI: 00:21:29 (9 E, 16 W), 00:22:6B (8 E, 11 W), 00:23:69 (12 E, 19 W) Ethernet OUI: 00:21:29 (9 E, 16 W), 00:22:6B (8 E, 11 W), 00:23:69 (12 E, 19 W)
Stock bootloader	CFE
Expansion IF types	USB 2.0
USB ports	1
USB Hub Compatible	Untested
Power	12 VDC, 1.5 A
Connector type	barrel
Serial Port (UART)	yes
JTAG Port	yes
Flags: 1 USB 2.0, Gigabit Switch, Dual Radio Simultaneous
Other
Default IP address: 192.168.1.1 the IP 192.168.1.1 is used by 1324 additional devices of which 155 are Linksys devices Default login user: blank Default login password: admin blank:admin credentials used by 278 additional devices of which 135 are Linksys devices
Manuf/OEM/ODM	CyberTAN
3rd Party Firmware Support	DD-WRT • (List) , OpenWrt • (List | Dev | DLs)
Retail
Availability	End of Life
FCC approval date	05 June 2008
(Est.) release date	10 June 2008
UPC	745883585205 (UPC DB, On eBay)
ASIN	B001AZ01EO ,  multiple uses
Country of manuf	China
Physical
Dimensions	8.9" x 7.1" x 1.4"
Radio 1 (eth1 (wl0))
Chip1	Broadcom BCM4322
Wireless interface OUI	00:21:29, 00:22:6B, 00:23:69
Antenna Connector Type	U.FL
MIMO status	2x2:2
Wireless Standard	IEEE 802.11a/n
802.11n	up to 300 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz
Radio cor_rev	16
Radio 2 (eth2 (wl1))
Chip1	Broadcom BCM4322
Wireless interface OUI	00:21:29, 00:22:6B, 00:23:69
Antenna Connector Type	U.FL
MIMO status	2x2:2
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio cor_rev	16
CPU1 brand Radio1 chip1 brand Radio2 chip1 brand Linksys WRT610N v1 Broadcom Broadcom Broadcom Linksys WRT610N v2 Broadcom Broadcom Broadcom

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

For a list of all currently documented Linksys device with specifications, see Linksys.

• 300 Mbps - 2SS 5GHz 802.11n (40MHz chan.),

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = AN600 class

Overview

WRT610N v1 serial numbers appear to start with CTG0.

"3763-04000106R" is silkscreened on the board.

Links of Interest

Wikis

• On the OpenWrt wiki
• On the DD-WRT wiki
• Linksys routers on Wikipedia

Forum threads

• Linksys WRT610N on the DD-WRT forums
• Linksys WRT610N - Status on the DD-WRT forums
• Need help to unbrick WRT160N v1.0 - Problem Solved - Quikfix on the DD-WRT forums

Reviews

• Linksys WRT610N Reviewed on SmallNetBuilder

The default SSIDS may be 'linksys' (2.4GHz) and 'linksys_media' (5GHz).

• Inside Story: Linksys WRT610N vs. WRT600N on SmallNetBuilder

Flashing

Flashing dd-wrt

Support started version: v24 TNG NEWD2
Current supported version: ?

Hard Reset (30/30/30 method)

navigate to the firmware update tab in the Linksys or dd-wrt GUI initial flash use the trailed build dd-wrt.v24_mega_wrt610n.bin (610n in the filename)

- subsequent loads don't require the trailed build)

wait 5 minutes after flashing power cycle the router hard reset again (30/30/30 method) configure the router

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki
On the OpenWrt Forum
OpenWrt Target: bcm47xx
OpenWrt Subtarget: generic
OpenWrt Package architecture: mipsel_mips32
Support started version: 10.03.1
Current supported version: 23.05.5

Please insert instructions here

Upgrading

Upgrading dd-wrt

If dd-wrt is already on the router follow these instructions. If stock firmware is on the router follow the flashing instructions.

Check for recommended builds here first. Set your computer to a static IP of 192.168.1.7. (or to whatever subnet the router is on) Disable all firewalls and security. Disable wireless on your computer and only have the router connected to the flashing computer by the ethernet cable between the two. Hard reset or 30/30/30 (If the router supports it, if not, reset to defults in the GUI) prior to flashing. Wait. Check for password page on re-login and change password. Flash firmware. You can use the webgui except if you have a belkin router. (For belkin use tftp.exe to flash) Wait...at least three minutes. Lights should return to normal. See important2, below. Failing to wait is how most people brick their routers. Do a power cycle of the router. (Unplug the cord, count to 30 and plug it back in.) Wait for the lights to return to normal usually about 2 minutes. Hard reset or 30/30/30 again (If the router supports it, if not, reset to defults in the GUI). Wait. Check for the password page and re-login to change the password. Then you can reconfigure your settings manually. Once configured set your computer back to autoIP and autoDNS.

Important1: This Hard reset or 30/30/30 works fine for Asus router, but you do have to power cycle after the reset.

Important2: After you flash the firmware, and before you do the hard reset, the router will be building some nvram settings. YOU MUST WAIT FOR THIS TO FINISH PRIOR TO DOING ANYTHING WITH THE ROUTER INCLUDING A HARD RESET. Usually, you can tell when this process is completed by the WAN light coming on, but it does take several minutes. Go have a beer. There are starting to be more and more people who BRICK their routers by not waiting until the nvram is rebuilt, PRIOR to doing a hard reset. YOU NEED TO WAIT!

Reverting

Reverting from dd-wrt

To revert to the original firmware, just download and flash the current Linksys firmware file using DD-WRT GUI following the same steps outlined in the "Steps for flashing" section above.

JTAG-Serial Info

JTAG Pinouts

nTRST   1o o2	GND
  TDI   3o o4	GND
  TDO   5o o6	GND
  TMS   7o o8	GND
  TCK   9o o10	GND
nSRST  11o o12  N/C
  N/C  13o o14  N/C

Marked by a yellow box in the pics below.

Serial

Serial Pinouts

VCC  1 o
 TX  2 o
 RX  3 o
N/C  4 o
GND  5 o

• Linksys WRT-610N Serial Recovery on VectorMM

USB Info

The USB port is where you can connect an external USB hard drive or flash drive. Which can do a multitude of things. You can use in as a NAS, storage for a FTP server, use Optware to run external programs like torrent software, samba for sharing files to your network, share a USB printer with your network... The list of possibilities is long, it just takes a little research.

ProFTPd is included in most the newer builds of dd-wrt. Check the features chart to be sure.

A ftp server, file sharing, and a media sever is included in TomatoUSB if your device is compatable.

vlan Info

See vlan Info

There currently is no kernel driver for the broadcom switch in the device. This makes all of the VLAN settings dysfunctional. There is no workaround. Basic switch operation (i.e., similiar to the Linksys firmware) works fine, though. Note that due to the default configuration of the broadcom chip, the switch will strip all forwarded packets of their VLAN tags. The option "Assign WAN Port to Switch", which actually works at the kernel IP level by adding the Internet "vlan2" device to the main bridge, works.

VLAN Support balblas wrote: Confirmed WRT610Nv1 works, also for dot1q trunking:

1 2 3 4 | Case labels 1 2 3 4 | NVRAM ports

vlan1 and vlan2 use different nvram settings (compared to an E2000). Variable "vlan1ports=1 2 3 4 8*" does not seem to be used. It is reset whenever the router is rebooted, but the actual setting being used is new_vlan1ports, which survives a reboot. See example below (I disabled vlan1 on the switch completely as it's the management vlan on my Cisco routers/switches which gives issues when trunking between DD-WRT routers and Cisco):

nvram show | egrep "vlan.ports|vlan.hwname" | sort size: 32203 bytes (565 left) new_vlan1hwname=et0 new_vlan1ports= new_vlan2hwname=et0 new_vlan2ports=0 8 vlan1hwname=et0 vlan1ports=1 2 3 4 8* vlan2hwname=et0 vlan2ports=0 8 vlan3hwname=et0 vlan3ports=4t 3t 8 vlan4hwname=et0 vlan4ports=4t 3t 2 1 8*

Pictures

Retail Images

• 
• 

User Images

• 
• 
• 
• 
• 

FCCID Q87-WRT610NV1

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

Notes

Overview

The WRT610N is the previous top-of-the-line consumer device from Linksys (replaced with the E3000) with the following features:

Dual-radio (two BCM4322) allows to operate 2.4 Ghz B/G/N and 5 Ghz A/N simultaneously 4+1 port Gigabit switch (BCM53115) v1 300 MHz (BCM4705) / v2 533MHz (BCM4718) or 480MHz (BCM4716) USB 2.0 host port 64 MByte RAM, 8 MByte Flash

CFE Versions

The CFE is basically the BIOS of the WRT610N. It's responsible for initial hardware configuration and subsequently for booting the actual firmware. There are at least two variants of the WRT610N CFE. To find the CFE versions from within dd-wrt, use:

root@ap-ssn:~# nvram show|egrep 'bootnv|pmon' bootnv_ver=6 pmon_ver=CFE 4.175.64.12 either via telnet or from the Web GUI via "Administration->Commands->Run Commands"

The versions are bootnv_ver=6, pmon_ver=CFE 4.175.64.12 (subsequently called CFE .12) bootnv_ver=7, pmon_ver=CFE 4.175.64.16 (subsequently called CFE .16)

Builds between 12387 and 12424 do not work on CFE .12 models. DD-WRT will start, but immediately reboot, requiring debricking. Your mileage may vary. See http://svn.dd-wrt.com:8000/dd-wrt/ticket/1149'

This is fixed in EKO build 12427, available here: http://www.dd-wrt.com/dd-wrtv2/downloads/others/eko/V24_TNG/svn12424/dd-wrt.v24-12427_mega-wrt610n.bin

Information

If you are installing DD-WRT for the first time on your WRT610N, you need to use a hardware-specific build.

edit: This doesn't seem to be true anymore... information is in dispute.

First time flash for v1 use: ftp://dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/03-24-10-r14144/broadcom/dd-wrt.v24_mega_wrt610n.bin First time flash for v2 use: ftp://dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/03-24-10-r14144/broadcom_K26/dd-wrt.v24-14144_NEWD-2_K2.6_mini_wrt610nv2.bin

LINUX KERNEL 2.6 BUILDS DD-WRT v24 is currently built under two different branches, one using the 2.4 kernel and the new one having the 2.6 kernel. You can install the K2.4 builds on v1, but not v2. K2.6 supports both v1 and v2. To identify the difference, K2.4 builds aren't usually marked with any special identification, and K2.6 builds are in a different folder with K26 in the folder name and K2.6 will be in the filename.

For example: ftp.dd-wrt.com/others/eko/V24_TNG/svn14471/dd-wrt.v24-14471_big-wrt610n.bin and ftp.dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/04-16-10-r14289/broadcom/dd-wrt.v24_mega_wrt610n.bin are 2.4 kernel builds and will only work on v1 routers

ftp.dd-wrt.com/others/eko/V24-K26/svn14471/dd-wrt.v24-14471_NEWD-2_K2.6_big.bin and ftp.dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/04-16-10-r14289/broadcom_K26/dd-wrt.v24-14289_NEWD-2_K2.6_big.bin are 2.6 kernel builds and will work on v2 as well as v1.

So be careful not to use K2.4 on v2 or you will brick your router!!!

Latest version

Keep checking ftp://dd-wrt.com/others/eko/ for updates to either the BrainSlayer or eko builds.

Support for the WRT610N is currently only available via SVN builds. You can download such builds either

from Eko (normal and MEGA-Builds): from Brainslayer (only MEGA-Builds): (The differences between those builds are described here: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=45891 -- basically, BS' builds contain Asterisk, Eko's don't)

Look for the files labeled "WRT610N". Those builds have a special header and can be flashed directly using the stock Linksys firmware's "Update Firmware" option. A factory reset after the flash is recommended. (see steps for flashing below)

The WRT610N has two radio modules and thus two wireless devices with distinct configuration in DD-WRT:

wl0 is the 2.4 Ghz band radio (supporting 802.11b/g/n) wl1 is the 5 Ghz band radio (supporting 802.11a/n) Note that Draft-N can operate in both the 2.4 and 5 Ghz bands.

GPIO

gpio enable 0 result = 01 USB LED Off gpio disable 0 result = 01 USB LED On

gpio enable 1 result = 00 Power LED stops flashing gpio disable 1 result = 00 Power LED starts flashing

gpio enable 2 result = 01 No activity gpio disable 2 result = 01 No activity

gpio enable 3 result = 01 LED on top of the WPS Button turns off gpio disable 3 result = 01 LED on top of the WPS Button turns Amber

gpio enable 4 result = 01 No activity gpio disable 4 result = 01 No activity

gpio enable 5 result = 01 No activity gpio disable 5 result = 01 No activity

gpio enable 6 result = 01 No activity gpio disable 6 result = 01 No activity gpio poll 6 result = 01, 00 at button press = Reset button

                   01 = No button press
                   00 = At button press

gpio enable 7 result = 01 No activity gpio disable 7 result = 01 No activity

gpio enable 8 result = 01 No activity gpio disable 8 result = 01 No activity gpio poll 8 result = 01, 00 at button press = WPS button

gpio enable 9 result = 01 LED on top of the WPS Button turns off gpio disable 9 result = 01 LED on top of the WPS Button turns Blue

gpio enable 10 result = 01 No activity gpio disable 10 result = 01 No activity

gpio enable 11 result = 01 No activity gpio disable 11 result = 01 No activity

gpio enable 12 result = 01 No activity gpio disable 12 result = 01 No activity

gpio enable 13 result = 01 No activity gpio disable 13 result = 01 No activity

gpio enable 14 result = 01 No activity gpio disable 14 result = 01 No activity

gpio enable 15 result = 01 No activity gpio disable 15 result = 01 No activity

gpio enable 16 result = 00 No activity gpio disable 16 result = 00 No activity

gpio enable 17 result = 00 No activity gpio disable 17 result = 00 No activity

gpio enable 18 result = 00 No activity gpio disable 18 result = 00 No activity

gpio enable 19 result = 00 No activity gpio disable 19 result = 00 No activity

gpio enable 20 result = 00 No activity gpio disable 20 result = 00 No activity

<repeats>

gpio enable 32 result = 01 USB LED Off gpio disable 32 result = 01 USB LED On

gpio enable 33 result = 00 Power LED stops flashing gpio disable 33 result = 00 Power LED starts flashing .. <repeats> ..

Recovery (Unbricking)

A simple way to recover a bricked device (confirmed to work with both CFE.12 and CFE.16) is:

unplug all ethernet ports (Important!) unplug power plug power in wait 2-2.5 seconds press the reset button and keep it pressed for 5 seconds, then release it reconnect ethernet (DHCP shoud give IP address to computer) point your browser at 192.168.1.1. You should see a "Management Firmware update" screen where you can flash the original firmware or dd-wrt directly (even mega builds).

Alternative Method 1:

manually assign 192.168.1.10 to your computer unplug power plug power in wait 0.5-1.0 seconds press the reset button and keep it pressed for 1 second, then release it point your browser at 192.168.1.1.

Alternative Method 2:

manually assign 192.168.1.10 to your computer unplug power plug power in wait for all lights blink press the reset button and keep it pressed for 1 second or 3/4 flashes of the power-light, then release it point your browser at 192.168.1.1. The alternative methods are reported to work well on the wrt-610Nv1 CTGxxxx series (mostly works at the first attempt); these series are using CFE .16

The management mode can also be activated from the serial console using

nvram set safe_mode_upgrade=on nvram commit reboot

Known Issues

Random reboots/WLAN lockups As of build 12427, the router will randomly reboot, sometimes after minutes, sometimes after hours. Using only the 2.4 Ghz radio seems to make the problem occur less often. Developers are aware of the problem and are working on it.

A possible workaround seems to be disabling the interference mitigation mode using

wl -i eth0 interference 0 wl -i eth1 interference 0

either from telnet or from Administration->Commands.

See here (signature) for real world uptimes of 3 different WRT610N devices, including their respective configurations.

Fixed Wireless MAC

Until build 12360, the 2.4 Ghz wireless radio MAC is always 00:90:4C:4E:00:2A. This causes weird client behavior if you have more than one WRT610N in one network. As a workaround, you can manually set the mac address using the shell commands

nvram set "pci/1/1/macaddr"=00:90:4C:D6:02:2a nvram commit

This is fixed in 12427 for CFE.16 devices. For CFE.12 devices, the situation is now reversed: The 5 Ghz MAC always has 00:90:4C:4E:00:2A, and the 2.4 Ghz MAC is fine.

5 GHz specific issues

For certain builds the 5 GHz radio (wl1) may only work when the wireless mode is set to NA-Mixed. Later builds e.g. 13972-mega [1] do not exhibit this behaviour. Neither Site Survey nor Wizviz Survey currently work for the 5 GHz band.

No TFTP recovery (not really an issue anymore) Due to a problem in the CFE, it is not possible to recover a bricked device using the commonly recommended boot-wait TFTP process (i.e. by waiting for the device to react to pings to 192.168.1.1 and TFTP a firmware file to it). TFTP transfers to the device which are larger than 3.8MB (i.e., the stock firmware) will fail, other TFTP transfers will seemingly succeed, but the CFE will not flash them. See above for a much simpler way to unbrick using management mode. Debricking via serial port is also possible. Note that the serial port is externally accessible inside the "Internet" ethernet jack. Instructions for serial recovery are available here: http://www.dd-wrt.com/phpBB2/viewtopic.php?p=209668#209668

Other notes

USB USB support works, including Hubs, for all kind of devices, even when Linksys only advertises this as a "Storage Link". Note that there are known Linux USB issues with USB 2.0, Hubs and Full/Low speed devices, notably the often used FTDI serial converters. Use USB 1.1 only as a workaround.

5 GHz channels Not specific to the WRT610N, but with the 5 Ghz band, the channel limitations per regulatory domain are much broader than with 2.4 Ghz channels. Since dd-wrt doesn't limit the 5 Ghz channel selection, you run a much higher chance of setting the router to a channel which your client device (which does honor regulatory limits) doesn't support. See http://en.wikipedia.org/wiki/List_of_WLAN_channels#5.C2.A0Ghz_.28802.11a.2Fh.2Fj.2Fdraft-n.29 for a list of available 5 Ghz band channels.