Netgear WNR3500v1

Netgear WNR3500 v1
Availability: now

Manuf (OEM/ODM): Foxconn U12H092 T00

FCC approval date: 02 January 2008
Country of manuf.: China
Series: N300

Type: wireless router

FCC ID: PY307300074
IC ID: 4054A-07300074
PCB ID: U12H092T00

Power: 12 VDC, 1.5 A
Connector type: barrel

CPU1: Marvell 88F5180NB1 (500 MHz)
FLA1: 8 MiB8,388,608 B 65,536 Kib 8,192 KiB 64 Mib 0.00781 GiB  (Macronix MX29LV640DBTC-90G)
RAM1: 32 MiB33,554,432 B 262,144 Kib 32,768 KiB 256 Mib 0.0313 GiB  (Samsung K4H561638J-LCCC)

Expansion IFs: none specified
Serial: yes, 6-pin header, internal, unpopulated, 3.3V TTL, (115200,8,N,1), JP2

WI1 chip1: Marvell 88W8363
WI1 chip2: Marvell 88W8060
WI1 802dot11 protocols: bgn
WI1 MIMO config: 2x3:2
WI1 antenna connector: none

ETH chip1: Marvell 88F5180NB1
ETH chip2: Marvell 88E1112
ETH chip3: Marvell 88E1112
Switch: Marvell 88E6131
LAN speed: 1G
LAN ports: 4
WAN speed: 1G
WAN ports: 1

bgn

Additional chips
2.4GHz Power Amplifier IC;RFMD;RF5125;RF, 5125, H9F8;2;

Stock bootloader: U-Boot 1.1.1 Marvell

Stock FW OS: Linux 2.4.27 -vrs1

Flags: boot log

Default SSID: NETGEAR (44 addl. devices)
Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1304 additional devices
of which 106 are Netgear devices
Default login user: admin
Default login password: password
admin:password credentials used by 423 additional devices
of which 304 are Netgear devices

802dot11 OUI: 00:1F:33 (8 E, 12 W), 00:24:B2 (14 E, 16 W)
Ethernet OUI: 00:1F:33 (8 E, 12 W), 00:24:B2 (14 E, 16 W)

	CPU1 brand	WI1 chip1 brand	WI1 chip2 brand
Netgear WNR3500v1	Marvell	Marvell	Marvell
Netgear WNR3500v2	Broadcom	Broadcom

For a list of all currently documented Marvell chipsets with specifications, see Marvell.

RangeMax Wireless-N Gigabit Router

• Support page

On the OpenWrt Wiki

Netgear WNR3500 v1 on TechInfoDepot

Per a dissected US unit..

"U12H092", "Rev. 2", and "GP" is silkscreened on the board.

All radial capacitors used are CapXon branded.

The device has 8MB Flash and 32MB RAM.

The specific P/Ns used are in the infobox.

The netgear.com.cn device table also specifies

the device as having 8MB Flash and 32MB RAM.

The 802.11n radio is using two RFMD RF5125

2.4-2.5GHz Power Amplifier ICs

Serial

Pinout

(3.3) (RxD) (...) (...) (TxD) (GND)
1               JP2

Info derived from

• Serial info

====version====
# version
Release version : Netgear Wireless Router WNR3500
                  U12H09200/V1.0.36/8.0.36NA
           Time : Jun 11 2009 11:21:42
Boot code version : 1.0.3

====cat /proc/version====
# cat /proc/version
Linux version 2.4.27-vrs1 (weal@svn) (gcc version 3.4.4 (release) 
 (CodeSourcery ARM 2005q3-1)) #1 Thu Jun 4 15:04:37 CST 2009

====cat /proc/cpuinfo====
# cat /proc/cpuinfo
Processor       : ARM926EJ-Sid(wb) rev 0 (v5EJl)
BogoMIPS        : 332.59
Features        : swp half thumb fastmult

Hardware        : MV-88fxx81
Revision        : 0000
Serial          : 0000000000000000

====cat /proc/cmdline====
# cat /proc/cmdline
console=ttyS0,115200 root=/dev/mtdblock2 
mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro

====cat /proc/meminfo====
# cat /proc/meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  14909440 14462976   446464        0  1241088  2596864
Swap:        0        0        0
MemTotal:        14560 kB
MemFree:           436 kB
MemShared:           0 kB
Buffers:          1212 kB
Cached:           2536 kB
SwapCached:          0 kB
Active:           3608 kB
Inactive:         2912 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        14560 kB
LowFree:           436 kB
SwapTotal:           0 kB
SwapFree:            0 kB

====cat /proc/mtd====
# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00800000 00010000 "Physically mapped flash"
mtd1: 00100000 00010000 "kernel"
mtd2: 00630000 00010000 "rootfs"
mtd3: 00010000 00010000 "traffic_meter1"
mtd4: 00010000 00010000 "traffic_meter2"
mtd5: 00010000 00010000 "POT"
mtd6: 00010000 00010000 "board_data"
mtd7: 00010000 00010000 "nvram"
mtd8: 00080000 00010000 "u-boot"
mtd9: 00800000 00010000 "all"

• boot log

Boot code version : 1.0.3

 ** MARVELL BOARD: RD-88F5181L-VOIP-GE LE
U-Boot 1.1.1 (Jan 25 2008 - 09:11:36) Marvell version: 1.10.16

DRAM CS[0] base 0x00000000   size  16MB
DRAM Total size  16MB
[8192kB@ff800000] Flash:  8 MB
Addresses 12M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (12M - 8M): Done
*** Warning - bad CRC, using default environment

Soc: 88F5181 B1
CPU: ARM926 (Rev 0) running @ 500Mhz
Orion 1 streaming disabled
SysClock = 166Mhz , TClock = 166Mhz

USB 0: host mode
PCI 0: PCI Express End Point Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0
Decompressing kernel...
## Booting image at 00400000 ...
   Image Name:   Linux-2.4.27-vrs1
   Created:      2009-06-11   3:22:18 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1428280 Bytes =  1.4 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
Starting kernel ...

ZLinux version 2.4.27-vrs1 (weal@svn) (gcc version 3.4.4 (release) 
 (CodeSourcery ARM 2005q3-1)) #1 Thu Jun 4 15:04:37 CST 2009
CPU: ARM926EJ-Sid(wb) revision 0
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 166666667, Tclk = 166666667
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro
Calibrating delay loop... 332.59 BogoMIPS
Memory: 16MB 0MB 0MB 0MB = 16MB total
Memory: 14492KB available (1231K code, 374K data, 68K init)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
CPU: Testing write buffer: pass
POSIX conformance testing by UNIFIX
init hw started.

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size  16MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e0000000, size 128MB
PEX0_IO ....base f2000000, size   1MB
PCI0_MEM ....base e8000000, size 128MB
PCI0_IO ....base f2100000, size   1MB
INTER_REGS ....base f1000000, size   1MB
DEVICE_CS0 ....no such
DEVICE_CS1 ....no such
DEVICE_CS2 ....no such
DEV_BOOCS ....base f4000000, size  16MB
Flash bankwidth 2, base f4000000, size 1000000
PCI: bus0: Fast back to back transfers enabled
HW already initialized.
PCI: bus1: Fast back to back transfers enabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
WatchDog enabled.

  Marvell Development Board (LSP Version 1.1.3)
  -- RD-88F5181L-VOIP-GE  Soc: 88F5181 B1
 Detected Tclk 166666667 and SysClk 166666667
TWSI: twsiAddr7BitSet ERROR - Addr (7 Bit) int TimeOut.
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut .
TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut .
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xf1012000 (irq = 3) is a 16550A
Marvell Gateway Driver:
Detected RD_88F5181L_VOIP_GE
Wireless atthena LED button turned off
Using VLAN-tag Mode
L3/L4 Checksum offload enabled
Multi queue support ( rxq0=128 rxq1=64 rxq2=64 rxq3=64 txq0=2000 )
Using boot network interface configuration
eth0: mac_addr 00:1f:33:4b:91:07, VID 0x100, port list: port-0
eth1: mac_addr 00:1f:33:4b:91:06, VID 0x200, port list: port-1 port-2 port-3 port-4
init switch layer... done
init MAC layer... done
loading network interfaces: eth0 eth1
PPP generic driver version 2.4.2
physmap flash device: 1000000 at f4000000
 Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Using physmap partition definition

Creating 9 MTD partitions on "Physically mapped flash":
0x00000000-0x00100000 : "kernel"
0x00100000-0x00730000 : "rootfs"
0x00730000-0x00740000 : "traffic_meter1"
0x00740000-0x00750000 : "traffic_meter2"
0x00750000-0x00760000 : "POT"
0x00760000-0x00770000 : "board_data"
0x00770000-0x00780000 : "nvram"
0x00780000-0x00800000 : "u-boot"
0x00000000-0x00800000 : "all"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
Fast Floating Point Emulator V0.94M by Peter Teichmann.
mount_block_root: mtdblock/2
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing init memory: 68K
init started:  BusyBox v1.01 (2009.03.03-08:18+0000) multi-call binary
mv_gateway: starting eth0
mv_gateway: starting eth1
/sbin/syslogd: not found
/proc/sys/net/ipv4/neigh/br0/base_reachable_time: cannot create
Reading board data...
WSC UUID: 0x93130468f8a39c3e3950eacf3d452c23
Using /lib/modules/2.4.27/net/acos_nat.o
Warning: loading acos_nat will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
Using /lib/modules/2.4.27/ap8x/ap8x.o
Warning: loading ap8x will taint the kernel: non-GPL license - Proprietary
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
ap0: Marvell AP-8x 802.11n adapter: mem=0xe8000000, irq=36
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
Waiting for Wireless Events from interfaces...
device eth1 entered promiscuous mode
device ap0 entered promiscuous mode
br0: port 2(ap0) entering learning state
br0: port 1(eth1) entering learning state
ARPING to 255.255.255.255 from 192.168.1.1 via br0
br0: port 2(ap0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth1) entering forwarding state
br0: topology change detected, propagating
Sent 3 probes (3 broadcast(s))
Received 0 reply
info, udhcp server (v0.9.8) started
error, unable to parse 'option wins '
error, unable to parse 'option domain '
Info: No FWPT default policies.
wlanconfigd: No such file or directory
POT integrity check OK.
POT time is up.
Starting WPS module ...
mv_gateway: stopping eth0
mv_gateway: eth0 change mac address to 00:1f:33:4b:91:07
mv_gateway: starting eth0
Start DHCP client daemon

BusyBox v1.01 (2009.03.03-08:18+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# WPS Version: 14.1, December 11 2008
Wireless atthena LED button turned on
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3
ap0: STA ff:ff:ff:ff:ff:ff IEEE 802.11: deassociated

====cat /proc/bus/pci/devices====
# cat devices
0138    11ab2a0a        24      e8000000        e8010000        00000000        00000000        00000000        00000000        00000000        00010000  00010000 00000000        00000000        00000000        00000000        00000000        ap%d

====lsmod====
# lsmod
Module                  Size  Used by    Tainted: P
ap8x                  798272   1
acos_nat              290340   0 (unused)

====ps aux====
# ps aux
  PID  Uid     VmSize Stat Command
    1 0           428 S   init
    2 0               SW  [keventd]
    3 0               SWN [ksoftirqd_CPU0]
    4 0               SW  [kswapd]
    5 0               SW  [bdflush]
    6 0               SW  [kupdated]
    7 0               SW  [mtdblockd]
  141 0           428 S   /sbin/iwevent
  147 0           456 S   swresetd
  149 0           840 S   upnpd
  151 0           384 S   dnsRedirectReplyd
  153 0           808 S   httpd
  157 0           476 S   udhcpd /tmp/udhcpd.conf
  160 0           508 S   dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u r
  161 0           480 S   ddnsd &
  164 0           352 S   telnetenabled
  166 0           556 S   heartbeat
  174 0           728 S   /usr/sbin/email
  181 0           584 S   lld2d br0
  213 0           588 S   wpsd
  217 0          1228 S   wsccmd /tmp/wsc
  220 0           424 S   udhcpc -i eth0 -p /var/run/udhcpc0.pid -s /tmp/udhcpc
  222 0           496 R   /bin/sh
  225 0          1228 S   wsccmd /tmp/wsc
  226 0          1228 S   wsccmd /tmp/wsc
  227 0          1228 S   wsccmd /tmp/wsc
  228 0          1228 S   wsccmd /tmp/wsc
  229 0          1228 S   wsccmd /tmp/wsc
  230 0          1228 S   wsccmd /tmp/wsc
  231 0          1228 S   wsccmd /tmp/wsc
  232 0          1228 S   wsccmd /tmp/wsc
  233 0           732 S   hostapd -W /tmp/wsc/hostapd.conf
  599 0           552 R   ps aux

Images

internal images
board top
angled above the 88F5180 SoC
Flash
88W8363 MAC/BB
radio section
board top, antenna side
board top, shield removed
88E1112 GbE PHYs
88E6131 GbE Switch
Foxconn label
Foxconn board text
board bottom

How To Identify Which Model Router You Have

by benryanau

After spending an hour researching the variants of the Netgear WNR3500 family and their

specs prior to a purchase, I realized this would he handy to post up somewhere.

So, I thought I'd table it up and share it, since there wasn't a concise guide anywhere

on the web already. Hopefully this will help some people out!

Model	Flash /RAM	CPU	USB	Ant	WLAN	Eth	WAN	Notes	FCC ID
WNR3500 v1	8/32	Marvell 88F5180NB1 @500 TopDog	No	2 int.	N300	4x GbE	GigE	Blue Antenna LEDs on top	PY307300074
WNR3500 v2	4/32	Broadcom BCM4718A @480 MIPS74k	No	4 int.	N300	4x GbE	GbE	"V2" marked under orange LAN ports, smaller housing, no antenna LEDs	PY308400093
WNR3500L V1	8/64	Broadcom BCM4718A @480 MIPS74k	1x USB 2.0	4 int.	N300	4x GbE	GbE	WNR3500U/WNR3500L Marked below yellow WAN port	PY308400093
WNR3500L V2	128/128	Broadcom BCM47186B0 @480 MIPS74k	1x USB 2.0	2 int.	N300	4x GbE	GbE	Below yellow WAN port WNR3500L v2	PY310400153

Images

Picture of the back of WNR3500U/3500L v1
Picture of the back of WNR3500L v2
Picture of the back of WNR3500U
Closeup of label WNR3500U