Netgear WNR3500v1

multiple revisions of this device, use caution

bgn (N300)
RangeMax Wireless-N Gigabit Router
Support	Support page
Wikipedia	Netgear
InfoDepot Wiki	Netgear WNR3500 v1.0
WikiDevi.wi-cat.ru	Netgear WNR3500 v1
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Status Unknown
Tomato any flavor	Incompatible
Platform
Brand • Model • Rev	Netgear WNR3500 v1
FCC ID	PY307300074
IC ID	4054A-07300074
Board ID	U12H092T00
Type	wireless router
Series	WNR3500
CPU1	Marvell 88F5180NB1
CPU1 Type	ARMv5TEJ
CPU1 Speed	500 MHz
Flash1 Chip	Macronix MX29LV640DBTC-90G
Flash1 Size	8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
RAM1 Size	32 MiB33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br />
RAM1 Chip	Samsung K4H561638J-LCCC
ETH chip1	Marvell 88F5180NB1
ETH chip2	Marvell 88E1112
ETH chip3	Marvell 88E1112
Switch	Marvell 88E6131
Ethernet Port Count	1-1GbE-WAN 4-1GbE-LAN
Wired Standard	IEEE 802.3/3u/3ab
802dot11 OUI: 00:1F:33 (8 E, 12 W), 00:24:B2 (14 E, 16 W) Ethernet OUI: 00:1F:33 (8 E, 12 W), 00:24:B2 (14 E, 16 W)
Stock bootloader	U-Boot 1.1.1 Marvell
Stock FW OS	Linux 2.4.27 -vrs1
Expansion IF types	none specified
Power	12 VDC, 1.5 A
Connector type	barrel
Serial Port (UART)	yes, 6-pin header, internal, unpopulated, 3.3V TTL, (115200 8N1), JP2
Flags: boot log
Additional chips 2.4GHz Power Amplifier IC;RFMD;RF5125;RF, 5125, H9F8;2;
Other
Default SSID: NETGEAR (43 addl. devices) Default IP address: 192.168.1.1 the IP 192.168.1.1 is used by 1324 additional devices of which 107 are Netgear devices Default login user: admin Default login password: password admin:password credentials used by 425 additional devices of which 306 are Netgear devices
Manuf/OEM/ODM	Foxconn U12H092 T00
Retail
FCC approval date	02 January 2008
Country of manuf	China
Radio 1
Chip1	Marvell 88W8363
Chip2	Marvell 88W8060
Wireless interface OUI	00:1F:33, 00:24:B2
Antenna Connector Type	none specified
MIMO status	2x3:2
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
CPU1 brand Radio1 chip1 brand Radio1 chip2 brand Netgear WNR3500Lv1 Broadcom Broadcom Netgear WNR3500Lv2 Broadcom Broadcom Netgear WNR3500U Broadcom Broadcom Netgear WNR3500v1 Marvell Marvell Marvell Netgear WNR3500v2 Broadcom Broadcom

For a list of all currently documented Marvell chipsets with specifications, see Marvell.

For a list of all currently documented Netgear device with specifications, see Netgear.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class

Overview

Per a dissected US unit..

• "U12H092", "Rev. 2", and "GP" is silkscreened on the board.

All radial capacitors used are CapXon branded.

• The device has 8MB Flash and 32MB RAM.

The specific P/Ns used are in the infobox.

The netgear.com.cn device table also specifies

the device as having 8MB Flash and 32MB RAM.

• The 802.11n radio is using two RFMD RF5125

2.4-2.5GHz Power Amplifier ICs

How To Identify Which Model Router You Have

by benryanau

After spending an hour researching the variants of the Netgear WNR3500 family and their specs prior to a purchase, I realized this would he handy to post up somewhere. So, I thought I'd table it up and share it, since there wasn't a concise guide anywhere on the web already. Hopefully this will help some people out!

Model	Flash /RAM	CPU	USB	Ant	WLAN	Eth	WAN	Notes	FCC ID
WNR3500 v1	8/32	Marvell 88F5180NB1 @500 TopDog	No	2 int.	N300	4x GbE	GigE	Blue Antenna LEDs on top	PY307300074
WNR3500 v2	4/32	Broadcom BCM4718A @480 MIPS74k	No	4 int.	N300	4x GbE	GbE	"V2" marked under orange LAN ports, smaller housing, no antenna LEDs	PY308400093
WNR3500L V1 WNR3500U	8/64	Broadcom BCM4718A @480 MIPS74k	1x USB 2.0	4 int.	N300	4x GbE	GbE	WNR3500U/WNR3500L Marked below yellow WAN port	PY308400093
WNR3500L V2	128/128	Broadcom BCM47186B0 @480 MIPS74k	1x USB 2.0	2 int.	N300	4x GbE	GbE	Below yellow WAN port WNR3500L v2	PY310400153

Images

• 

  Picture of the back of WNR3500U/3500L v1

• 

  Picture of the back of WNR3500L v2

• 

  Picture of the back of WNR3500U

• 

  Closeup of label WNR3500U

See also: Netgear WNR3500 Series

JTAG-Serial Info

Serial

Serial Pinouts

(3.3) (RxD) (...) (...) (TxD) (GND)
1               JP2

Info derived from

Serial info

====version==== # version Release version : Netgear Wireless Router WNR3500 U12H09200/V1.0.36/8.0.36NA Time : Jun 11 2009 11:21:42 Boot code version : 1.0.3 ====cat /proc/version==== # cat /proc/version Linux version 2.4.27-vrs1 (weal@svn) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-1)) #1 Thu Jun 4 15:04:37 CST 2009 ====cat /proc/cpuinfo==== # cat /proc/cpuinfo Processor : ARM926EJ-Sid(wb) rev 0 (v5EJl) BogoMIPS : 332.59 Features : swp half thumb fastmult Hardware : MV-88fxx81 Revision : 0000 Serial : 0000000000000000 ====cat /proc/cmdline==== # cat /proc/cmdline console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro ====cat /proc/meminfo==== # cat /proc/meminfo total: used: free: shared: buffers: cached: Mem: 14909440 14462976 446464 0 1241088 2596864 Swap: 0 0 0 MemTotal: 14560 kB MemFree: 436 kB MemShared: 0 kB Buffers: 1212 kB Cached: 2536 kB SwapCached: 0 kB Active: 3608 kB Inactive: 2912 kB HighTotal: 0 kB HighFree: 0 kB LowTotal: 14560 kB LowFree: 436 kB SwapTotal: 0 kB SwapFree: 0 kB ====cat /proc/mtd==== # cat /proc/mtd dev: size erasesize name mtd0: 00800000 00010000 "Physically mapped flash" mtd1: 00100000 00010000 "kernel" mtd2: 00630000 00010000 "rootfs" mtd3: 00010000 00010000 "traffic_meter1" mtd4: 00010000 00010000 "traffic_meter2" mtd5: 00010000 00010000 "POT" mtd6: 00010000 00010000 "board_data" mtd7: 00010000 00010000 "nvram" mtd8: 00080000 00010000 "u-boot" mtd9: 00800000 00010000 "all"

boot log

Boot code version : 1.0.3 ** MARVELL BOARD: RD-88F5181L-VOIP-GE LE U-Boot 1.1.1 (Jan 25 2008 - 09:11:36) Marvell version: 1.10.16 DRAM CS[0] base 0x00000000 size 16MB DRAM Total size 16MB [8192kB@ff800000] Flash: 8 MB Addresses 12M - 0M are saved for the U-Boot usage. Mem malloc Initialization (12M - 8M): Done *** Warning - bad CRC, using default environment Soc: 88F5181 B1 CPU: ARM926 (Rev 0) running @ 500Mhz Orion 1 streaming disabled SysClock = 166Mhz , TClock = 166Mhz USB 0: host mode PCI 0: PCI Express End Point Interface PCI 1: Conventional PCI, speed = 33000000 Net: egiga0 [PRIME] Hit any key to stop autoboot: 0 Decompressing kernel... ## Booting image at 00400000 ... Image Name: Linux-2.4.27-vrs1 Created: 2009-06-11 3:22:18 UTC Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1428280 Bytes = 1.4 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK Starting kernel ... ZLinux version 2.4.27-vrs1 (weal@svn) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-1)) #1 Thu Jun 4 15:04:37 CST 2009 CPU: ARM926EJ-Sid(wb) revision 0 Machine: MV-88fxx81 Using UBoot passing parameters structure Sys Clk = 166666667, Tclk = 166666667 On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro Calibrating delay loop... 332.59 BogoMIPS Memory: 16MB 0MB 0MB 0MB = 16MB total Memory: 14492KB available (1231K code, 374K data, 68K init) Dentry cache hash table entries: 2048 (order: 2, 16384 bytes) Inode cache hash table entries: 1024 (order: 1, 8192 bytes) Mount cache hash table entries: 512 (order: 0, 4096 bytes) Buffer cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) CPU: Testing write buffer: pass POSIX conformance testing by UNIFIX init hw started. CPU Interface ------------- SDRAM_CS0 ....base 00000000, size 16MB SDRAM_CS1 ....disable SDRAM_CS2 ....disable SDRAM_CS3 ....disable PEX0_MEM ....base e0000000, size 128MB PEX0_IO ....base f2000000, size 1MB PCI0_MEM ....base e8000000, size 128MB PCI0_IO ....base f2100000, size 1MB INTER_REGS ....base f1000000, size 1MB DEVICE_CS0 ....no such DEVICE_CS1 ....no such DEVICE_CS2 ....no such DEV_BOOCS ....base f4000000, size 16MB Flash bankwidth 2, base f4000000, size 1000000 PCI: bus0: Fast back to back transfers enabled HW already initialized. PCI: bus1: Fast back to back transfers enabled Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket WatchDog enabled. Marvell Development Board (LSP Version 1.1.3) -- RD-88F5181L-VOIP-GE Soc: 88F5181 B1 Detected Tclk 166666667 and SysClk 166666667 TWSI: twsiAddr7BitSet ERROR - Addr (7 Bit) int TimeOut. TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . Starting kswapd devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled ttyS00 at 0xf1012000 (irq = 3) is a 16550A Marvell Gateway Driver: Detected RD_88F5181L_VOIP_GE Wireless atthena LED button turned off Using VLAN-tag Mode L3/L4 Checksum offload enabled Multi queue support ( rxq0=128 rxq1=64 rxq2=64 rxq3=64 txq0=2000 ) Using boot network interface configuration eth0: mac_addr 00:1f:33:4b:91:07, VID 0x100, port list: port-0 eth1: mac_addr 00:1f:33:4b:91:06, VID 0x200, port list: port-1 port-2 port-3 port-4 init switch layer... done init MAC layer... done loading network interfaces: eth0 eth1 PPP generic driver version 2.4.2 physmap flash device: 1000000 at f4000000 Amd/Fujitsu Extended Query Table v1.1 at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling fast programming due to code brokenness. Using physmap partition definition Creating 9 MTD partitions on "Physically mapped flash": 0x00000000-0x00100000 : "kernel" 0x00100000-0x00730000 : "rootfs" 0x00730000-0x00740000 : "traffic_meter1" 0x00740000-0x00750000 : "traffic_meter2" 0x00750000-0x00760000 : "POT" 0x00760000-0x00770000 : "board_data" 0x00770000-0x00780000 : "nvram" 0x00780000-0x00800000 : "u-boot" 0x00000000-0x00800000 : "all" Initializing Cryptographic API NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 2048) NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 Fast Floating Point Emulator V0.94M by Peter Teichmann. mount_block_root: mtdblock/2 VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing init memory: 68K init started: BusyBox v1.01 (2009.03.03-08:18+0000) multi-call binary mv_gateway: starting eth0 mv_gateway: starting eth1 /sbin/syslogd: not found /proc/sys/net/ipv4/neigh/br0/base_reachable_time: cannot create Reading board data... WSC UUID: 0x93130468f8a39c3e3950eacf3d452c23 Using /lib/modules/2.4.27/net/acos_nat.o Warning: loading acos_nat will taint the kernel: no license See http://www.tux.org/lkml/#export-tainted for information about tainted modules Using /lib/modules/2.4.27/ap8x/ap8x.o Warning: loading ap8x will taint the kernel: non-GPL license - Proprietary See http://www.tux.org/lkml/#export-tainted for information about tainted modules ap0: Marvell AP-8x 802.11n adapter: mem=0xe8000000, irq=36 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 Waiting for Wireless Events from interfaces... device eth1 entered promiscuous mode device ap0 entered promiscuous mode br0: port 2(ap0) entering learning state br0: port 1(eth1) entering learning state ARPING to 255.255.255.255 from 192.168.1.1 via br0 br0: port 2(ap0) entering forwarding state br0: topology change detected, propagating br0: port 1(eth1) entering forwarding state br0: topology change detected, propagating Sent 3 probes (3 broadcast(s)) Received 0 reply info, udhcp server (v0.9.8) started error, unable to parse 'option wins ' error, unable to parse 'option domain ' Info: No FWPT default policies. wlanconfigd: No such file or directory POT integrity check OK. POT time is up. Starting WPS module ... mv_gateway: stopping eth0 mv_gateway: eth0 change mac address to 00:1f:33:4b:91:07 mv_gateway: starting eth0 Start DHCP client daemon BusyBox v1.01 (2009.03.03-08:18+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. # WPS Version: 14.1, December 11 2008 Wireless atthena LED button turned on WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 ap0: STA ff:ff:ff:ff:ff:ff IEEE 802.11: deassociated ====cat /proc/bus/pci/devices==== # cat devices 0138 11ab2a0a 24 e8000000 e8010000 00000000 00000000 00000000 00000000 00000000 00010000 00010000 00000000 00000000 00000000 00000000 00000000 ap%d ====lsmod==== # lsmod Module Size Used by Tainted: P ap8x 798272 1 acos_nat 290340 0 (unused) ====ps aux==== # ps aux PID Uid VmSize Stat Command 1 0 428 S init 2 0 SW [keventd] 3 0 SWN [ksoftirqd_CPU0] 4 0 SW [kswapd] 5 0 SW [bdflush] 6 0 SW [kupdated] 7 0 SW [mtdblockd] 141 0 428 S /sbin/iwevent 147 0 456 S swresetd 149 0 840 S upnpd 151 0 384 S dnsRedirectReplyd 153 0 808 S httpd 157 0 476 S udhcpd /tmp/udhcpd.conf 160 0 508 S dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u r 161 0 480 S ddnsd & 164 0 352 S telnetenabled 166 0 556 S heartbeat 174 0 728 S /usr/sbin/email 181 0 584 S lld2d br0 213 0 588 S wpsd 217 0 1228 S wsccmd /tmp/wsc 220 0 424 S udhcpc -i eth0 -p /var/run/udhcpc0.pid -s /tmp/udhcpc 222 0 496 R /bin/sh 225 0 1228 S wsccmd /tmp/wsc 226 0 1228 S wsccmd /tmp/wsc 227 0 1228 S wsccmd /tmp/wsc 228 0 1228 S wsccmd /tmp/wsc 229 0 1228 S wsccmd /tmp/wsc 230 0 1228 S wsccmd /tmp/wsc 231 0 1228 S wsccmd /tmp/wsc 232 0 1228 S wsccmd /tmp/wsc 233 0 732 S hostapd -W /tmp/wsc/hostapd.conf 599 0 552 R ps aux

Pictures

User Images

• internal images
• 

  board top

• 

  angled above the 88F5180 SoC

• 

  Flash

• 

  88W8363 MAC/BB

• 

  radio section

• 

  board top, antenna side

• 

  board top, shield removed

• 

  88E1112 GbE PHYs

• 

  88E6131 GbE Switch

• 

  Foxconn label

• 

  Foxconn board text

• 

  board bottom