Netgear R6300 v1

multiple revisions of this device, use caution

abgn+ac (AC1750)
AC1750 Dual Band WiFi Smart Gigabit Router
Homepage	Product page
Support	Support page
Wikipedia	Netgear
WikiDevi.wi-cat.ru	Netgear R6300 v1
3rd Party Firmware
dd-wrt	Supported
OpenWrt	Partial Support
Tomato any flavor	Supported
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	Netgear R6300 v1
FCC ID	PY312100188
IC ID	4054A-12100188
Board ID	U12H218T00
Type	wireless router, bridge
CPU1	Broadcom BCM4706
CPU1 Type	MIPS 74Kc
CPU1 Speed	600 MHz 8-bit
Flash1 Chip	Samsung K9F1G08U0D-SCB0
Flash1 Size	128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
Flash2 Chip	Macronix MX25L1606EM2I-12G
Flash2 Size	2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br />
RAM1 Size	128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
RAM1 Chip	Winbond W9751G6KB-25 x 2
ETH chip1	Broadcom BCM4706
Switch	Broadcom BCM53125
Ethernet Port Count	1-1GbE-WAN 4-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab
802dot11 OUI: 84:1B:5E (8 E, 10 W), 9C:D3:6D, 10:0D:7F (1 E, 2 W) Ethernet OUI: 84:1B:5E (8 E, 10 W), 9C:D3:6D, 10:0D:7F (1 E, 2 W)
Stock bootloader	CFE
Stock FW OS	Linux 2.6.22
Expansion IF types	Mini PCIe, USB 2.0
Mini PCIe slots	1
USB ports	2
USB Hub Compatible	Untested
Power	12 VDC, 5 A
Connector type	barrel
Flags: boot log
Additional chips 2.4GHz Power Amplifier IC;Skyworks;SE2605L;SiGe, 2605L, 151AJ;3; 5GHz Power Amplifier IC;Skyworks;SE5003L1;5003L1, 142AU;3; Quad Differential PCIe Clock Source;IDT;ICS557G;ICS, 1226158, 1151,557G-05ALF;1; 4-port USB Hub Controller;SMSC;USB2514B;SMSC, USB2514B, D1204-A2P1G, 8J149413A, ASE-TW;1;
Other
Default SSID: NETGEARXX (37 addl. devices) , NETGEARXX-5G (15 addl. devices) Default IP address: 192.168.1.1 the IP 192.168.1.1 is used by 1326 additional devices of which 107 are Netgear devices Default login user: admin Default login password: password admin:password credentials used by 425 additional devices of which 306 are Netgear devices
Manuf/OEM/ODM	Foxconn U12H218 T00
3rd Party Firmware Support	DD-WRT • (List) , DD-WRT (Kong-AC) • (List) , OpenWrt • (List | Dev | DLs) , Tomato (Shibby) • (List | DLs) , Tomato (Hyzoom) • (Tomato (Shibby) mod)
Retail
FCC approval date	09 May 2012
(Est.) release date	16 May 2012
(Est.) initial retail price (in USD):	$200
UPC	606449084450 (UPC DB, On eBay)
ASIN	B0081H8TRA
Country of manuf	Vietnam
Radio 1
Chip1	Broadcom BCM4331
Wireless interface OUI	84:1B:5E, 9C:D3:6D, 10:0D:7F
Antenna Connector Type	U.FL
MIMO status	3x3:3
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 450 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio cor_rev	29
Radio 2
Radio2 module	Foxconn T77H391
Radio2 module IF	Mini PCIe (oversized)
Chip1	Broadcom BCM4360
Wireless interface OUI	84:1B:5E, 9C:D3:6D, 10:0D:7F
Antenna Connector Type	U.FL
MIMO status	3x3:3
Wireless Standard	IEEE 802.11a/n/ac
802.11ac	up to 1300 Mbps
802.11n	up to 450 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz
Radio cor_rev	40
FCC ID Broadcom BCM94360MC PY312100188 PY312100189 Wistron NeWeb DNXB-C1 PY312100188
CPU1 brand Radio1 chip1 brand Radio2 chip1 brand Netgear R6300 v1 Broadcom Broadcom Broadcom Netgear R6300 v2 Broadcom Broadcom Broadcom

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

For a list of all currently documented Netgear device with specifications, see Netgear.

• 1300 Mbps - 3SS 5GHz 802.11ac (80MHz chan.),

• 450 Mbps - 3SS 2.4GHz 802.11n (40MHz chan.) = AC1750 class

Overview

There is a SMSC USB2514B USB 2.0 Hub on-board.

• OEM: Foxconn (Hon Hai) / Ambit U12H218T00

• Wi-Fi Certified : WFA17018 (as of 12/10/2012)

HW Dissection

• Chipworks's dissection (nice images)

Macronix MX25L1606EM2I-12G 16Mbit (2MB) Serial Flash

Samsung K9F1G08U0D 1Gbit (128MB) NAND Flash

Broadcom BCM53125 switch, SMSC USB25148 USB 2.0 Hub

Foxconn P/N T77H391 BCM4360 wireless module (same P/N and

Broadcom ref. design for the BCM4352 module in the Netgear R6200)

silkscreened with "BCM94360MCH5" and the Foxconn P/N "T77H391"

noted the dies for the BCM4360 and BCM4352 as being the same.

Links of Interest

• Manual

Reviews

• First look - Netgear R6300 router on SmallNetBuilder

Default SSIDs of NETGEAR57 and NETGEAR57-5G

• Netgear R6300 review on SmallNetBuilder

indicates the switch chip is a Broadcom BCM53115

(contradicted by the SkyWorks dissection below)

2.4GHz - Broadcom BCM4331 + 3x Skyworks SE2594L

(Dual Band 802.11a/b/g/n Wireless LAN Front End)

5GHz - Broadcom BCM4360 + 3x Skyworks SE5003L

(5GHz, 23dBm Power Amp w/ Power Detector)

• Reviewed on Foxnetwork (w/ photos [internal, external, and UI])

84:1B:5E OUI; NETGEARXX and NETGEARXX-5G SSIDs

Forum threads

• Kong's shot of the board w/ serial header connected on MyOpenRouter
• Shot of the header section on the DD-WRT forums

Other

• Netgear R6200 router and A6200 USB 2.0 adapter on AnandTech

Processor noted as the Broadcom BCM4706

Flashing

Flashing dd-wrt

Support started version: ?
Current supported version: ?

Please insert instructions here

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki
OpenWrt Target: bcm47xx
OpenWrt Subtarget: mips74k
OpenWrt Package architecture: mipsel_74kc
Support started version: 17.01.0
Current supported version: 23.05.5
Unsupported Functions:
WiFi 2.4GHz partly, WiFi 5GHz

Please insert instructions here

Flashing Tomato

Please insert instructions here

JTAG-Serial Info

JTAG

JTAG Pinouts

J251 (presumably JTAG)

Serial

Serial Pinouts

The serial header is J252.

              J252
(3.3) (TxD) (...) (...) (RxD) (GND)
Pin1  Pin2  Pin3  Pin4  Pin5  Pin6
|
v
to J251 (presumably JTAG)

Console dumps

/proc/mtd

#cat /proc/mtd dev: size erasesize name mtd0: 00200000 00010000 "boot" mtd1: 00140000 00010000 "linux" mtd2: 00200000 00010000 "rootfs" mtd3: 00010000 00010000 "ML1" mtd4: 00010000 00010000 "ML2" mtd5: 00010000 00010000 "ML3" mtd6: 00010000 00010000 "ML4" mtd7: 00010000 00010000 "ML5" mtd8: 00010000 00010000 "ML6" mtd9: 00010000 00010000 "ML7" mtd10: 00010000 00010000 "T_Meter1" mtd11: 00010000 00010000 "T_Meter2" mtd12: 00010000 00010000 "POT" mtd13: 00010000 00010000 "board_data" mtd14: 00010000 00010000 "nvram" mtd15: 02000000 00020000 "linux" mtd16: 01ea787c 00020000 "rootfs" mtd17: 02000000 00020000 "trx" mtd18: 05f00000 00020000 "brcmnand" # mount rootfs on / type rootfs (rw) /dev/root on / type squashfs (ro) devfs on /dev type tmpfs (rw) proc on /proc type proc (rw) sysfs on /sys type sysfs (rw) ramfs on /tmp type ramfs (rw) usbdeffs on /proc/bus/usb type usbfs (rw) # free total used free shared buffers Mem: 125552 55868 69684 0 4984 Swap: 0 0 0 Total: 125552 55868 69684

Boot log

reboot Decompressing...done CFE for R6300 version: v1.0.4 Build Date: Tue Jun 26 16:05:40 CST 2012 Init Arena Init Devs. Boot partition size = 262144(0x40000) Found an ST compatible serial flash with 32 64KB blocks; total size 2MB Found a Samsung NAND flash with 2048B pages or 128KB blocks; total size 128MB et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.100.138 CPU type 0x19749: 600MHz Tot mem: 131072 KBytes Device eth0: hwaddr 10-0D-7F-80-89-45, ipaddr 192.168.1.1, mask 255.255.255.0 gateway not set, nameserver not set Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null) Loading: ....... 4153478 bytes read Entry at 0x80001000 Closing network. Starting program at 0x80001000 Linux version 2.6.22 (lawrence@localhost.localdomain) (gcc version 4.2.3) #1 PREEMPT Tue Mar 19 13:40:40 CST 2013 CPU revision is: 00019749 Found an ST compatible serial flash with 32 64KB blocks; total size 2MB Determined physical RAM map: memory: 07fff000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0 -> 32767 HighMem 32767 -> 32767 early_node_map[1] active PFN ranges 0: 0 -> 32767 Built 1 zonelists. Total pages: 32767 Kernel command line: root=/dev/mtdblock16 console=ttyS0,115200 init=/sbin/preinit Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). PID hash table entries: 512 (order: 9, 2048 bytes) CPU: BCM5300 rev 1 at 600 MHz Using 300.000 MHz high precision timer. Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 125168k/131068k available (3177k kernel code, 5748k reserved, 646k data, 232k init, 0k highmem) Mount-cache hash table entries: 512 NET: Registered protocol family 16 SCSI subsystem initialized PCI: Initializing host PCI: Reset RC PCI: Initializing host PCI: Reset RC PCI: Fixing up bus 0 PCI/PCIe coreunit 0 is set to bus 1. PCI: Fixing up bridge PCI: Fixing up bridge PCI: Enabling device 0000:01:00.1 (0004 -> 0006) PCI: Fixing up bus 1 PCI/PCIe coreunit 1 is set to bus 2. PCI: Fixing up bridge PCI: Fixing up bridge PCI: Enabling device 0000:02:00.1 (0004 -> 0006) PCI: Fixing up bus 2 NET: Registered protocol family 2 Time: MIPS clocksource has been installed. IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc. fuse init (API version 7.8) io scheduler noop registered (default) Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A serial8250: ttyS1 at MMIO 0x0 (irq = 8) is a 16550A RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize loop: module loaded PPP generic driver version 2.4.2 NET: Registered protocol family 24 PPPoL2TP kernel driver, V0.17 pflash: found no supported devices sflash: Couldn't find valid ROM disk image Creating 15 MTD partitions on "sflash": 0x00000000-0x00200000 : "boot" 0x00000000-0x00140000 : "linux" 0x00000000-0x00200000 : "rootfs" 0x00140000-0x00150000 : "ML1" 0x00150000-0x00160000 : "ML2" 0x00160000-0x00170000 : "ML3" 0x00170000-0x00180000 : "ML4" 0x00180000-0x00190000 : "ML5" 0x00190000-0x001a0000 : "ML6" 0x001a0000-0x001b0000 : "ML7" 0x001b0000-0x001c0000 : "T_Meter1" 0x001c0000-0x001d0000 : "T_Meter2" 0x001d0000-0x001e0000 : "POT" 0x001e0000-0x001f0000 : "board_data" 0x001f0000-0x00200000 : "nvram" Found a Samsung NAND flash with 2048B pages or 128KB blocks; total size 128MB lookup_nflash_rootfs_offset: offset = 0x0 arch/mips/brcm-boards/bcm947xx/../../../../../../shared/ nflash.c:nflash_read 643 unrecovable error. by pass all nflash: squash filesystem with lzma found at block 10 Creating 2 MTD partitions on "nflash": 0x00000000-0x02000000 : "linux" 0x00158784-0x02000000 : "rootfs" NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit) Creating 2 MTD partitions on "brcmnand": 0x00000000-0x02000000 : "trx" 0x02000000-0x07f00000 : "brcmnand" u32 classifier TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 10 6WIND/LSIIT IPv6 multicast forwarding 0.1 plus PIM-SM/SSM with *BSD API lo: Disabled Privacy Extensions IPv6 over IPv4 tunneling driver sit0: Disabled Privacy Extensions NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 232k freed Warning: unable to open an initial console. Failed to execute /init [sighandler]: No more events to be processed, quitting. [cleanup]: Waiting for children. [cleanup]: All children terminated. Reading board data... WSC UUID: 0xf3f02a167d67a04f3803cc8438dbecc6 NTP synchronized date/time: Mon Jul 8 01:49:30 2013 MAC address of 1st STA connected: C4-85-08-81-01-FA wl: wl driver adapter not found wl: wl driver adapter not found wl: wl driver adapter not found wl: wl driver adapter not found invalid RF magic! No RF parameters! Use default. ### main:1176 Set Normal Power! Initialise conn table 2048 entries insmod: dpsta.ko: no module by that name found insmod: wl_high.ko: no module by that name found eth3: cmd=14: No such device wl1 not up in 3 sec Hit enter to continue...killall: upnp: no process killed upnp: No such file or directory WARNING: console log level set to 1 killall: wps_monitor: no process killed killall: wps_ap: no process killed killall: wps_enr: no process killed ### wps_wfi_init(): <wl0_wfi_enable=(null)><wl1_wfi_enable=(null)>WFI is not enabled ### acsd: scan in progress ... acsd: selected channel spec: 0x100b Reading board data... WSC UUID: 0xf3f02a167d67a04f3803cc8438dbecc6 acsd: scan in progress ... info, udhcp server (v0.9.8) started error, unable to parse 'option wins ' error, unable to parse 'option domain ' mevent start... opened loopback socket 4 acsd: scan in progress ... acsd: scan in progress ... POT integrity check OK. POT time is up. result = 21 g_record_info1->numofrcd1 = 21 acsd: scan in progress ... result = 271 g_record_info1->numofrcd2 = 271 result = 21 g_record_info2->numofrcd1 = 21 result = 271 g_record_info2->numofrcd2 = 271 acsd: scan in progress ... shm ID: 32769 Get a correct Segment_ID: 32769 and semaphore ID:32769 acsd: scan in progress ... Can't find handler for ASP command: eco_get_redirect_link(); Can't find handler for ASP command: devices_cgi_get_acl_device_table("DEV_control"); Can't find handler for ASP command: devices_cgi_get_acl_white_table(); Can't find handler for ASP command: devices_cgi_get_acl_black_table(); Can't find handler for ASP command: devices_cgi_get_show_access_ctrl_settings(); Can't find handler for ASP command: devices_cgi_get_acl_device_table("DEV_device", "wired"); Can't find handler for ASP command: devices_cgi_get_acl_device_table("DEV_device", "wireless"); acsd: scan in progress ... Can't find handler for ASP command: usb_cgi_get_register_state(); Can't find handler for ASP command: usb_cgi_get_invite_state(); Can't find handler for ASP command: cdl_cgi_set_hijack(0); Can't find handler for ASP command: cdl_cgi_set_hijack(1); acsd: scan in progress ... acsd: selected channel spec: 0x100b insmod: cannot insert '/lib/modules/2.6.22/kernel/drivers/usb/core/usbcore.ko': Success (17) insmod: cannot insert '/lib/modules/2.6.22/kernel/drivers/usb/host/ehci-hcd.ko': Success (17) Info: No FWPT default policies. agnat QOS disable! rmmod: l7_filter /tmp/samba/private/smb.conf: no files! killall: bftpd: no process killed add active user:192.168.5.100 httpd: socket bound in 0.0.0.0:80. httpd: socket bound in 0.0.0.0:443. bftpd: segment_id:32769 shared memory reattached at address 0x5000000 bftpd: socket bound in 0.0.0.0:21 mount: mounting none on /proc/bus/usb failed: Device or resource busy IOCTL_AG_REGION_SET: English Unable to create /dev/ptys0: File exists Unable to create /dev/ttys0: File exists ACOSNAT: Set BCMCTF to off ACOSNAT: Set NAT for LAN domain only to on killall: timesync: no process killed NAT Enabled pppd executed successfully. (0) minidlan :scan files route: ioctl 0x890c failed: No such process killall: dhcp6c: no process killed killall: IPv6-relay: no process killed killall: pppdv6: no process killed killall: rtsol: no process killed killall: dhcp6s: no process killed killall: radvd: no process killed route: ioctl 0x890c failed: No such process killall: dhcp6s: no process killed killall: radvd: no process killed Hit enter to continue...Hit enter to continue... BusyBox v1.7.2 (2013-03-19 13:45:51 CST) built-in shell (ash) Enter 'help' for a list of built-in commands.

ps

# ps PID Uid VSZ Stat Command 1 0 2660 S /sbin/preinit 2 0 SW< [kthreadd] 3 0 SW< [ksoftirqd/0] 4 0 SW< [events/0] 5 0 SW< [khelper] 16 0 SW< [kblockd/0] 47 0 SW [pdflush] 48 0 SW [pdflush] 49 0 SW< [kswapd0] 50 0 SW< [aio/0] 600 0 SW< [mtdblockd] 1996 0 SW< [ksuspend_usbd] 1999 0 SW< [khubd] 2148 0 1540 S /bin/eapd 2151 0 2140 S nas 2155 0 3176 S /bin/wps_monitor 2174 0 1648 S /usr/sbin/acsd 2214 0 1756 S swresetd 2216 0 1600 S dnsRedirectReplyd 2218 0 1896 S dlnad 2223 0 824 S dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u r 2226 0 844 S udhcpd /tmp/udhcpd.conf 2229 0 2252 S mevent 2232 0 1600 S ddnsd & 2235 0 1608 S telnetenabled 2238 0 2256 S heartbeat 2245 0 1528 S wlanconfigd 2251 0 2020 S tfmeter run 2255 0 1600 S scheact 2258 0 2648 S upnpd 2261 0 1996 S /usr/sbin/email 2264 0 1668 S lld2d br0 2266 0 2252 S /usr/sbin/acl_logd 2273 0 1996 S check_fw 2275 0 8328 S httpd -S -E /usr/sbin/ca.pem /usr/sbin/httpsd.pem 2362 0 1588 S /usr/sbin/bftpd -D -c /tmp/bftpd.conf 2364 0 9912 S minidlna.exe -a 192.168.5.1/24 -f /tmp/minidlna.conf 2368 0 SW [ telnetDBGD ] 2369 0 SW [ acktelnetDBGD ] 2370 0 SW [checkSBusTimeou] 2372 0 DW [NU INITSOCK] 2375 0 SW [NU UDP] 2376 0 SW [NU TCP] 2387 0 1948 S pppd file /tmp/ppp/options 2401 0 1596 S /usr/sbin/timesync /sbin/ntpclient 2402 0 9912 S minidlna.exe -a 192.168.5.1/24 -f /tmp/minidlna.conf 2407 0 9912 S minidlna.exe -a 192.168.5.1/24 -f /tmp/minidlna.conf 2438 0 1588 S wpsd 2440 0 1928 S /bin/sh 2443 0 1920 R ps

Pictures

Retail Images

• 
• 
• 

Notes

GPIO

Pin	Function	enable	disable
15	WAN LED (Internet)	orange	green
14	unknown
13	unknown
12	unknown
11	Wireless LED (WiFi 5GHz)	off	on
10	unknown
9	Right LOGO LED (WiFi 2.4GHz)	off	on
8	USB LED	off	on
7	unknown
6	unknown
5	unknown
4	unknown
3	Power LED (amber)	green	orange
2	Power LED (green)	off	on
1	Left LOGO LED	off	on
0	unknown

Use the following dd-wrt console startup script to turn off the NETGEAR logo.

gpio enable 9
gpio enable 1