Netgear WNR3500v1

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
bgn (N300)
RangeMax Wireless-N Gigabit Router
Netgear WNR3500-01.jpg
Support
Wikipedia
InfoDepot Wiki
WikiDevi.wi-cat.ru
3rd Party Firmware
dd-wrt
Status Unknown
OpenWrt
Status Unknown
Tomato any flavor
Incompatible
Platform
BrandModelRev
Netgear WNR3500 v1
FCC ID
IC ID
Board ID
U12H092T00
Type
wireless router
Series
WNR3500
CPU1
Marvell 88F5180NB1
CPU1 Type
ARMv5TEJ
CPU1 Speed
500 MHz
Flash1 Chip
Macronix MX29LV640DBTC-90G
Flash1 Size
8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
RAM1 Size
32 MiB33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br />
RAM1 Chip
Samsung K4H561638J-LCCC
ETH chip1
Marvell 88F5180NB1
ETH chip2
Marvell 88E1112
ETH chip3
Marvell 88E1112
Switch
Marvell 88E6131
Ethernet Port Count
1-1GbE-WAN
4-1GbE-LAN
Wired Standard
IEEE 802.3/3u/3ab

802dot11 OUI: 00:1F:33 (8 E, 12 W), 00:24:B2 (14 E, 16 W)
Ethernet OUI: 00:1F:33 (8 E, 12 W), 00:24:B2 (14 E, 16 W)

Stock bootloader
U-Boot 1.1.1 Marvell
Stock FW OS
Linux 2.4.27 -vrs1
Expansion IF types
none specified
Power
12 VDC, 1.5 A
Connector type
barrel
Serial Port (UART)
yes, 6-pin header, internal, unpopulated, 3.3V TTL, (115200 8N1), JP2
Flags:
boot log

Additional chips
2.4GHz Power Amplifier IC;RFMD;RF5125;RF, 5125, H9F8;2;

Other

Default SSID: NETGEAR (43 addl. devices)
Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1304 additional devices
of which 105 are Netgear devices
Default login user: admin
Default login password: password
admin:password credentials used by 420 additional devices
of which 301 are Netgear devices

Manuf/OEM/ODM
Foxconn U12H092 T00
Retail
FCC approval date 02 January 2008
Country of manuf China
Radio 1
Chip1
Marvell 88W8363
Chip2
Marvell 88W8060
Wireless interface OUI
00:1F:33, 00:24:B2
Antenna Connector Type
none specified
MIMO status
2x3:2
Wireless Standard
IEEE 802.11b/g/n
802.11n
up to 300 Mbps
802.11g
up to 54 Mbps
802.11b
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
Netgear WNR3500Lv1BroadcomBroadcom
Netgear WNR3500Lv2BroadcomBroadcom
Netgear WNR3500UBroadcomBroadcom
Netgear WNR3500v1MarvellMarvellMarvell
Netgear WNR3500v2BroadcomBroadcom

For a list of all currently documented Marvell chipsets with specifications, see Marvell.

For a list of all currently documented Netgear device with specifications, see Netgear.

300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class


Overview

Per a dissected US unit..

  • "U12H092", "Rev. 2", and "GP" is silkscreened on the board.
All radial capacitors used are CapXon branded.
  • The device has 8MB Flash and 32MB RAM.
The specific P/Ns used are in the infobox.
The netgear.com.cn device table also specifies
the device as having 8MB Flash and 32MB RAM.
2.4-2.5GHz Power Amplifier ICs

How To Identify Which Model Router You Have

by benryanau

After spending an hour researching the variants of the Netgear WNR3500 family and their specs prior to a purchase, I realized this would he handy to post up somewhere. So, I thought I'd table it up and share it, since there wasn't a concise guide anywhere on the web already. Hopefully this will help some people out!

Model Flash
/RAM
CPU USB Ant WLAN Eth WAN Notes FCC ID
WNR3500 v1 8/32 Marvell
88F5180NB1
@500 TopDog
No 2 int. N300 4x GbE GigE Blue Antenna LEDs on top PY307300074
WNR3500 v2 4/32 Broadcom
BCM4718A
@480 MIPS74k
No 4 int. N300 4x GbE GbE "V2" marked under orange LAN ports,
smaller housing, no antenna LEDs
PY308400093
WNR3500L V1
WNR3500U
8/64 Broadcom
BCM4718A
@480 MIPS74k
1x
USB 2.0
4 int. N300 4x GbE GbE WNR3500U/WNR3500L Marked
below yellow WAN port
PY308400093
WNR3500L V2 128/128 Broadcom
BCM47186B0
@480 MIPS74k
1x
USB 2.0
2 int. N300 4x GbE GbE Below yellow WAN port WNR3500L v2 PY310400153
Images

JTAG-Serial Info

Serial

Serial Pinouts

(3.3) (RxD) (...) (...) (TxD) (GND)
1               JP2


Info derived from

Serial info
====version====
# version
Release version : Netgear Wireless Router WNR3500
                  U12H09200/V1.0.36/8.0.36NA
           Time : Jun 11 2009 11:21:42
Boot code version : 1.0.3

====cat /proc/version====
# cat /proc/version
Linux version 2.4.27-vrs1 (weal@svn) (gcc version 3.4.4 (release) 
 (CodeSourcery ARM 2005q3-1)) #1 Thu Jun 4 15:04:37 CST 2009

====cat /proc/cpuinfo====
# cat /proc/cpuinfo
Processor       : ARM926EJ-Sid(wb) rev 0 (v5EJl)
BogoMIPS        : 332.59
Features        : swp half thumb fastmult

Hardware        : MV-88fxx81
Revision        : 0000
Serial          : 0000000000000000

====cat /proc/cmdline====
# cat /proc/cmdline
console=ttyS0,115200 root=/dev/mtdblock2 
mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro

====cat /proc/meminfo====
# cat /proc/meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  14909440 14462976   446464        0  1241088  2596864
Swap:        0        0        0
MemTotal:        14560 kB
MemFree:           436 kB
MemShared:           0 kB
Buffers:          1212 kB
Cached:           2536 kB
SwapCached:          0 kB
Active:           3608 kB
Inactive:         2912 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        14560 kB
LowFree:           436 kB
SwapTotal:           0 kB
SwapFree:            0 kB

====cat /proc/mtd====
# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00800000 00010000 "Physically mapped flash"
mtd1: 00100000 00010000 "kernel"
mtd2: 00630000 00010000 "rootfs"
mtd3: 00010000 00010000 "traffic_meter1"
mtd4: 00010000 00010000 "traffic_meter2"
mtd5: 00010000 00010000 "POT"
mtd6: 00010000 00010000 "board_data"
mtd7: 00010000 00010000 "nvram"
mtd8: 00080000 00010000 "u-boot"
mtd9: 00800000 00010000 "all"
boot log
Boot code version : 1.0.3

 ** MARVELL BOARD: RD-88F5181L-VOIP-GE LE
U-Boot 1.1.1 (Jan 25 2008 - 09:11:36) Marvell version: 1.10.16

DRAM CS[0] base 0x00000000   size  16MB
DRAM Total size  16MB
[8192kB@ff800000] Flash:  8 MB
Addresses 12M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (12M - 8M): Done
*** Warning - bad CRC, using default environment

Soc: 88F5181 B1
CPU: ARM926 (Rev 0) running @ 500Mhz
Orion 1 streaming disabled
SysClock = 166Mhz , TClock = 166Mhz

USB 0: host mode
PCI 0: PCI Express End Point Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0
Decompressing kernel...
## Booting image at 00400000 ...
   Image Name:   Linux-2.4.27-vrs1
   Created:      2009-06-11   3:22:18 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1428280 Bytes =  1.4 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
Starting kernel ...

ZLinux version 2.4.27-vrs1 (weal@svn) (gcc version 3.4.4 (release) 
 (CodeSourcery ARM 2005q3-1)) #1 Thu Jun 4 15:04:37 CST 2009
CPU: ARM926EJ-Sid(wb) revision 0
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 166666667, Tclk = 166666667
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro
Calibrating delay loop... 332.59 BogoMIPS
Memory: 16MB 0MB 0MB 0MB = 16MB total
Memory: 14492KB available (1231K code, 374K data, 68K init)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
CPU: Testing write buffer: pass
POSIX conformance testing by UNIFIX
init hw started.

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size  16MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e0000000, size 128MB
PEX0_IO ....base f2000000, size   1MB
PCI0_MEM ....base e8000000, size 128MB
PCI0_IO ....base f2100000, size   1MB
INTER_REGS ....base f1000000, size   1MB
DEVICE_CS0 ....no such
DEVICE_CS1 ....no such
DEVICE_CS2 ....no such
DEV_BOOCS ....base f4000000, size  16MB
Flash bankwidth 2, base f4000000, size 1000000
PCI: bus0: Fast back to back transfers enabled
HW already initialized.
PCI: bus1: Fast back to back transfers enabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
WatchDog enabled.

  Marvell Development Board (LSP Version 1.1.3)
  -- RD-88F5181L-VOIP-GE  Soc: 88F5181 B1
 Detected Tclk 166666667 and SysClk 166666667
TWSI: twsiAddr7BitSet ERROR - Addr (7 Bit) int TimeOut.
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xf1012000 (irq = 3) is a 16550A
Marvell Gateway Driver:
Detected RD_88F5181L_VOIP_GE
Wireless atthena LED button turned off
Using VLAN-tag Mode
L3/L4 Checksum offload enabled
Multi queue support ( rxq0=128 rxq1=64 rxq2=64 rxq3=64 txq0=2000 )
Using boot network interface configuration
eth0: mac_addr 00:1f:33:4b:91:07, VID 0x100, port list: port-0
eth1: mac_addr 00:1f:33:4b:91:06, VID 0x200, port list: port-1 port-2 port-3 port-4
init switch layer... done
init MAC layer... done
loading network interfaces: eth0 eth1
PPP generic driver version 2.4.2
physmap flash device: 1000000 at f4000000
 Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Using physmap partition definition

Creating 9 MTD partitions on "Physically mapped flash":
0x00000000-0x00100000 : "kernel"
0x00100000-0x00730000 : "rootfs"
0x00730000-0x00740000 : "traffic_meter1"
0x00740000-0x00750000 : "traffic_meter2"
0x00750000-0x00760000 : "POT"
0x00760000-0x00770000 : "board_data"
0x00770000-0x00780000 : "nvram"
0x00780000-0x00800000 : "u-boot"
0x00000000-0x00800000 : "all"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
Fast Floating Point Emulator V0.94M by Peter Teichmann.
mount_block_root: mtdblock/2
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing init memory: 68K
init started:  BusyBox v1.01 (2009.03.03-08:18+0000) multi-call binary
mv_gateway: starting eth0
mv_gateway: starting eth1
/sbin/syslogd: not found
/proc/sys/net/ipv4/neigh/br0/base_reachable_time: cannot create
Reading board data...
WSC UUID: 0x93130468f8a39c3e3950eacf3d452c23
Using /lib/modules/2.4.27/net/acos_nat.o
Warning: loading acos_nat will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
Using /lib/modules/2.4.27/ap8x/ap8x.o
Warning: loading ap8x will taint the kernel: non-GPL license - Proprietary
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
ap0: Marvell AP-8x 802.11n adapter: mem=0xe8000000, irq=36
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
Waiting for Wireless Events from interfaces...
device eth1 entered promiscuous mode
device ap0 entered promiscuous mode
br0: port 2(ap0) entering learning state
br0: port 1(eth1) entering learning state
ARPING to 255.255.255.255 from 192.168.1.1 via br0
br0: port 2(ap0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth1) entering forwarding state
br0: topology change detected, propagating
Sent 3 probes (3 broadcast(s))
Received 0 reply
info, udhcp server (v0.9.8) started
error, unable to parse 'option wins '
error, unable to parse 'option domain '
Info: No FWPT default policies.
wlanconfigd: No such file or directory
POT integrity check OK.
POT time is up.
Starting WPS module ...
mv_gateway: stopping eth0
mv_gateway: eth0 change mac address to 00:1f:33:4b:91:07
mv_gateway: starting eth0
Start DHCP client daemon

BusyBox v1.01 (2009.03.03-08:18+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# WPS Version: 14.1, December 11 2008
Wireless atthena LED button turned on
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
ap0: STA ff:ff:ff:ff:ff:ff IEEE 802.11: deassociated

====cat /proc/bus/pci/devices====
# cat devices
0138    11ab2a0a        24      e8000000        e8010000        00000000        00000000        00000000        00000000        00000000        00010000  00010000 00000000        00000000        00000000        00000000        00000000        ap%d

====lsmod====
# lsmod
Module                  Size  Used by    Tainted: P
ap8x                  798272   1
acos_nat              290340   0 (unused)

====ps aux====
# ps aux
  PID  Uid     VmSize Stat Command
    1 0           428 S   init
    2 0               SW  [keventd]
    3 0               SWN [ksoftirqd_CPU0]
    4 0               SW  [kswapd]
    5 0               SW  [bdflush]
    6 0               SW  [kupdated]
    7 0               SW  [mtdblockd]
  141 0           428 S   /sbin/iwevent
  147 0           456 S   swresetd
  149 0           840 S   upnpd
  151 0           384 S   dnsRedirectReplyd
  153 0           808 S   httpd
  157 0           476 S   udhcpd /tmp/udhcpd.conf
  160 0           508 S   dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u r
  161 0           480 S   ddnsd &
  164 0           352 S   telnetenabled
  166 0           556 S   heartbeat
  174 0           728 S   /usr/sbin/email
  181 0           584 S   lld2d br0
  213 0           588 S   wpsd
  217 0          1228 S   wsccmd /tmp/wsc
  220 0           424 S   udhcpc -i eth0 -p /var/run/udhcpc0.pid -s /tmp/udhcpc
  222 0           496 R   /bin/sh
  225 0          1228 S   wsccmd /tmp/wsc
  226 0          1228 S   wsccmd /tmp/wsc
  227 0          1228 S   wsccmd /tmp/wsc
  228 0          1228 S   wsccmd /tmp/wsc
  229 0          1228 S   wsccmd /tmp/wsc
  230 0          1228 S   wsccmd /tmp/wsc
  231 0          1228 S   wsccmd /tmp/wsc
  232 0          1228 S   wsccmd /tmp/wsc
  233 0           732 S   hostapd -W /tmp/wsc/hostapd.conf
  599 0           552 R   ps aux


Pictures

User Images