Belkin F9K1103 v1

From WikiDevi.Wi-Cat.RU
Jump to navigation Jump to search

Belkin F9K1103 v1
Availability: common

Manuf (OEM/ODM): Arcadyan WG9117 A23-AK

FCC approval date: 06 May 2011
(Est.) release date: 27 May 2011
UPC: 722868817872 (UPC DB, On eBay)
Country of manuf.: China
S/N prefix: 12113

Amazon image

ASIN
B004N625AK (Flag of the United States.svg, On Amazon, On CCC)

Type: wireless router

Power: 12 VDC, 2 A
Connector type: barrel

CPU1: Ralink RT3883F (500 MHz)
FLA1: 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (Macronix MX25L6406EM2I-12G)
RAM1: 64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (EtronTech EM68B16CWPA-25H)

Expansion IFs: USB 2.0
USB ports: 2
Serial: yes, 4-pin header, (57600 8N1), 3.3V TTL, J12

WI1 chip1: Ralink RT3883F
WI1 802dot11 protocols: an
WI1 MIMO config: 3x3:3
WI1 antenna connector: U.FL
WI2 chip1: Ralink RT3092
WI2 802dot11 protocols: bgn
WI2 MIMO config: 2x2:2
WI2 antenna connector: none

ETH chip1: Ralink RT3883F
Switch: Realtek RTL8367R
LAN speed: 1GbE
LAN ports: 4
WAN speed: 1GbE
WAN ports: 1

abgn

Stock bootloader: U-Boot 3.5.2.0 Ralink

Stock FW OS: Linux 2.6.22

TPFirmware supported: Padavan • (List)

Default SSID: belkin.XXX (20 addl. devices)
, belkin.XXX.5GHz (5 addl. devices)
Default IP address: 192.168.2.1
the IP 192.168.2.1 is used by 295 additional devices
of which 97 are Belkin devices
Default login user: admin
Default login password: password
admin:password credentials used by 423 additional devices
of which 0 are Belkin devices

802dot11 OUI: 08:86:3B (10 E, 14 W), 94:44:52 (17 E, 22 W)
Ethernet OUI: 08:86:3B (10 E, 14 W), 94:44:52 (17 E, 22 W)

For a list of all currently documented Ralink chipsets with specifications, see Ralink.


N750 DB Wi-Fi Dual-Band N+ Gigabit Router

 • Support page

"P/N: 141911720003J R01C" is silkscreened on the board.

The default SSID patterns for this model is:

belkin.XXX (where XXX is the last three octets of the wireless interface MAC for this SSID) and
belkin.XXX.5GHz (MAC = 2.4GHz network MAC + 2, same XXX from the 2.4GHz network).

The guest network is (if enabled) belkin.XXX.guests

(MAC = 2.4GHz network MAC + 1, same XXX from the 2.4GHz network).

Reviews

OUI of 08:86:3B and SSID of belkin_2

Forum threads

Third party firmware

Serial

Pinout

^ to RAM
© (GND)
© (RxD)
© (TxD)    --> 5 GHz ant (B)
® [3.3]    NC
J12

Info derived from

 • boot log
ARC Uboot:1.7.4 (May  2 2011 - 17:16:40)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fa0000
spi_wait_nsec: 30
spi device id: c2 20 17 c2 20 (2017c220)
find flash: MX25L6405D
..============================================
Ralink UBoot Version: 3.5.2.0
--------------------------------------------
ASIC 3883_MP (MAC to VITESSE Mode)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: DDR2
DRAM_SIZE: 512 Mbits
DRAM_WIDTH: 16 bits
DRAM_TOTAL_WIDTH: 16 bits
TOTAL_MEMORY_SIZE: 64 MBytes
Flash component: SPI Flash
Date:May  2 2011  Time:17:16:40
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 500 MHZ ####
 estimate memory size =64 Mbytes

Please choose the operation:
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                                                                                                4 initializing CHIP_RTL8367R_VB 1010                                                                                                                       0
initializing CHIP_RTL8367R_VB 1010

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   N750F9K1103VB
   Created:      2012-12-12   3:46:09 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    7398303 Bytes =  7.1 MB
   Load Address: 80000000
   Entry Point:  8033e000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8033e000) ...
## Giving linux memsize in MB, 64

Starting kernel ...
LINUX started...

 THIS IS ASIC
Linux version 2.6.22 (kevinlin@arc-vcs) (gcc version 4.1.2) #4 Wed Dec 12 11:41:34 CST 2012
 cmd line = console=ttyS1,57600n8 root=/dev/mtdblock5  init=/sbin/preinit

 The CPU feqenuce set to 500 MHz
CPU revision is: 0001974c
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 16256
Kernel command lkne: console=ttyS1,57600n8 root=/dev/mtdblock5  init=/sbin/preinit
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
cause = 40808000, status = 11000000
PID hash table entries: 256 (order: 8, 1024 bytes)
calculating r4koff... 001e8480(2000000)
CPU frequency 500.00 MHz
Using 250.000 MHz high precision timer.
console handover: boot [early0] -> real [ttyS1]
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61184k/65536k available (2649k kernel code, 4336k reserved, 666k data, 124k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
RALINK_PCI_PCICFG_ADDR = 0

*************** Ralink PCIe RC mode *************
registering PCI controller with io_map_base unset
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
[junius] pcibios_init
Next Bus No=0 hose= 80307758 Mem=8030778C Io=803077A8
2->[1][0][0][30]=0
5->[1][0][0][30]=fffffffe
2->[1][0][0][30]=0
5->[1][0][0][30]=0
PCI: Bridge: 0000:00:00.0
  IO window: disabled.
  MEM window: 20000000-200fffff
  PREFETCH window: disabled.
BAR0 at slot 0 = 0
bus=0, slot = 0x0
P2P(PCI) 0x00 = 08021814
P2P(PCI) 0x04 = 00100007
P2P(PCI) 0x08 = 06040001
P2P(PCI) 0x0c = 00010000
P2P(PCI) 0x10 = 00000000
P2P(PCI) 0x14 = 20100000
P2P(PCI) 0x18 = 00010100
P2P(PCI) 0x1c = 000000f0
P2P(PCI) 0x20 = 20002000
P2P(PCI) 0x24 = 0000fff0
P2P(PCI) 0x28 = 00000000
P2P(PCI) 0x2c = 00000000
P2P(PCI) 0x30 = 00000000
P2P(PCI) 0x34 = 00000040
P2P(PCI) 0x38 = 00000000
P2P(PCI) 0x3c = 000401ff
res[0]->start = 0
res[0]->end = 1ffffff
res[1]->start = 20100000
res[1]->end = 2010ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=1, slot = 0x0
dev III(PCIe)  0x00 = 30911814
dev III(PCIe)  0x04 = 00100000
dev III(PCIe)  0x08 = 02800000
dev III(PCIe)  0x0c = 00000000
dev III(PCIe)  0x10 = 20000000
dev III(PCIe)  0x14 = 00000000
dev III(PCIe)  0x18 = 00000000
dev III(PCIe)  0x1c = 00000000
dev III(PCIe)  0x20 = 00000000
dev III(PCIe)  0x24 = 00000000
dev III(PCIe)  0x28 = 00000000
dev III(PCIe)  0x2c = 30911814
dev III(PCIe)  0x30 = 00000000
dev III(PCIe)  0x34 = 00000040
dev III(PCIe)  0x38 = 00000000
dev III(PCIe)  0x3c = 000001ff
res[0]->start = 20000000
res[0]->end = 2000ffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
register_mtd_chip_driver for cfi_probe
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
deice id : c2 20 17 c2 20 (2017c220)
MX25L6405D(c2 2017c220) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 8 MTD partitions on "raspi":
0x00000000-0x00800000 : "ALL"
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x0019d3df : "Kernel"
mtd: partition "Kernel" doesn't end on an erase block -- force read-only
0x0019d3df-0x00800000 : "RootFS"
mtd: partition "RootFS" doesn't start on an erase block boundary -- force read-only
0x00050000-0x007f0000 : "Kernel_RootFS"
0x007f0000-0x00800000 : "UserCfg"
RT3xxx EHCI/OHCI init.
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
fuse init (API version 7.8)
io scheduler noop registered (default)
pcie_portdrv_probe->Dev[1814:0802] has invalid IRQ. Check vendor BIOS
assign_interrupt_mode Found MSI capability
Ralink gpio driver initialized
spidrv_major = 217
ARC_KERNEL_OSIX_init() success
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: module loaded
MAC_ADRH -- : 0x00000000
MAC_ADRL -- : 0x00000000
MAC_ADRH -- : 0x00000000
MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.0  256 rx/tx descriptors allocated, mtu = 1500!
MAC_ADRH -- : 0x0000000c
MAC_ADRL -- : 0x4328808e
PROC INIT OK!

 Pull high SDA & SCK

 GPIO pin 24 reset to switch
rtl8367_RouterVlanInit() rv=0
IsolateWanPort() rtk_vlan_set(VLAN1) rv=0
IsolateWanPort() rtk_vlan_set(VLAN2) rv=0
IsolateWanPort() rtk_vlan_get(VLAN1) rv=0 mbrmsk=ef untagmsk=f fid=0
IsolateWanPort() rtk_vlan_get(VLAN2) rv=0 mbrmsk=30 untagmsk=10 fid=1
IsolateWanPort() rtk_vlan_portPvid_get(0) rv=0 vid=1 pri=0
IsolateWanPort() rtk_vlan_portPvid_get(1) rv=0 vid=1 pri=0
IsolateWanPort() rtk_vlan_portPvid_get(2) rv=0 vid=1 pri=0
IsolateWanPort() rtk_vlan_portPvid_get(3) rv=0 vid=1 pri=0
IsolateWanPort() rtk_vlan_portPvid_get(4) rv=0 vid=2 pri=0
IsolateWanPort() rtk_vlan_portPvid_get(5) rv=0 vid=1 pri=0
rtl8367b driver initialized
PPP generic driver version 2.4.2
PPP BSD Compression module registered
NET: Registered protocol family 24
block2mtd: version $Revision: 1.1.1.1 $
dev_nvram_init() 827 mtd->name=UserCfg
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (512 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
ip_tables: (C) 2000-2006 Netfilter Core Team
ClusterIP Version 0.8 loaded successfully
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
mcps_module_init() initializing
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 124k freed
Warning: unable to open an initial console.
Algorithmics/MIPS FPU Emulator v1.5
[sighandler]: No more events to be processed, quitting.
[cleanup]: Waiting for children.
[cleanup]: All children terminated.
sysinit() done
use original....
Assume Wi-Fi RadioOn everytime reboot!!
connect: Network is unreachable
rt2860v2_ap: module license 'unspecified' taints kernel.

=== pAd = c000f000, size = 487768 ===
<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0

=== pAd = c0307000, size = 513184 ===
<-- RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xc01a0000, csr_addr=0xc01a0000!
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
NET: Registered protocol family 10
MAC_ADRH -- : 0x00000886
MAC_ADRL -- : 0x3b288f94

phy_tx_ring = 0x00340000, tx_ring = 0xa0340000
phy_rx_ring0 = 0x00341000, rx_ring0 = 0xa0341000
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = C0710000
eth2.1: dev_set_promiscuity(master, 1)
device eth2 entered promiscuous mode
device eth2.1 entered promiscuous mode
br0: port 1(eth2.1) entering learning state
force port 0 up
force port 1 up
force port 2 up
force port 3 up
rmmod: hw_nat
Starting HotPlug:          /usr/sbin/hotplugd -D -f
Starting jcpd daemon:      /usr/sbin/jcpd
br0: topology change detected, propagating
br0: port 1(eth2.1) entering forwarding state
fw_rule_isolatedlan: br0
fw_rule_isolatedlan: br0
fw_rule_SkipSnatToLans: br0
fw_rule_SkipDnatFromLans: br0
RX DESC a0357000  size = 2048
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 8
2. Phy Mode = 8
3. Phy Mode = 8
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = ff ff ff 00 01
SYNC - BBP R4 to 20MHz.l
Starting Samba:                         /usr/sbin/smbd -D
Main bssid = 08:86:3b:28:8f:96
<==== rt28xx_init, Status=0
0x1300 = 00064380
device ra0 entered promiscuous mode
br0: port 2(ra0) entering learning state
                                        /usr/sbin/nmbd -D
RX DESC a2dff000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = ff ff 00 00 01
SYNC - BBP R4 to 20MHz.l
Starting sxuptpd
USB port mode selector has been enabled
Initializing USB port mode:
 port1 = NAS
 port2 = NAS
usbcore: registered new interface driver sxuptp_driver
Starting usbjcpd
insmod: cannot insert '/lib/modules/2.6.22/kernel/drivers/usb/storage/usb-storage.ko':
 Invalid parameters (17): Invalid argument
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
Main bssid = 08:86:3b:28:8f:94
<==== rt28xx_init, Status=0
0x1300 = 00064380
device rai0 entered promiscuous mode
br0: port 3(rai0) entering learning state
br0: topology change detected, propagating
br0: port 3(rai0) entering forwarding state
do init
wsc MsgQ System Initializationeth2.2: Setting MAC address to !
 08 86 3b 28 8f 95.
<                  rc_wan_start:  640>: ifconfig eth2.2 up
Create netlink socket thread success!
Create ioctl socket(6) success!
Create wscd
udhcpc_main(452): udhcp client (v0.9.8) started
rc_nat_dmz_stop, 256
rc_nat_dmz_action
nat_dmz_rule_flush, 67: wan_index 0
set FW_DMZ_STAT 0 with wan_index 0
ipv6 started 0
CFG_NAT_DMZ_HOST =  2145950120   host =
rc_nat_vts_stop, 336

share memory key=74565 successful id on creating=32769
led_process_init() eco=0
 wpsm_upnp_attach() OK
signalling RUNNING
rc_fw_macflt_stop : 163
start Eco_mode
rc_nat_Masquerade_stop, 182
rc_nat_Masquerade_action
nat_Masquerade_rule_flush

***** g_wl_interface = rai0 ******
lld2d: listening on interface br0
start belkin_wan_cfg
udhcpc_main(737): Received SIGTERM
belkin_wan_cfg running on 102a8c0
UPnP daemon is ready to run
ctrl_flags=0x38
rc_twonky_start: 1166
rc_all_start 112
mcps: mcps_netlink_rcv() nlh->nlmsg_len=528mcps: mcps_process_registration() mcps_pid=954
mcps: mcps_process_registration() set control flag 0x38
/bin/mknod  /dev/ARCOSIX_DEV c 253 0
 • ps w
# ps w
  PID  Uid        VSZ Stat Command
    1 root       2552 S   /sbin/preinit
    2 root            SW< [kthreadd]
    3 root            SWN [ksoftirqd/0]
    4 root            SW< [watchdog/0]
    5 root            SW< [events/0]
    6 root            SW< [khelper]
   36 root            SW< [kblockd/0]
   39 root            SW< [khubd]
   57 root            SW  [pdflush]
   58 root            SW  [pdflush]
   59 root            SW< [kswapd0]
   60 root            SW< [aio/0]
  100 root            SW< [mtdblockd]
  308 root       2548 S   /sbin/preinit
  309 root       2548 S   /sbin/preinit
  429 root       1516 S   /usr/sbin/hotplugd -D -f
  430 root       1516 S   /usr/sbin/hotplugd -D -f
  450 root       1516 S   /usr/sbin/hotplugd -D -f
  452 root       1540 S   /usr/sbin/jcpd
  717 root            SW  [RtmpCmdQTask]
  718 root            SW  [RtmpWscTask]
  723 root       6404 S   /usr/sbin/smbd -D
  735 root            SW  [RtmpCmdQTask]
  736 root       6028 S   /usr/sbin/nmbd -D
  737 root       6404 S   /usr/sbin/smbd -D
  738 root            SW  [RtmpWscTask]
  745 root            SW< [sxuptp-wq]
  746 root            SW  [sxuptp-ka]
  758 root            SW  [jcpcore]
  777 root       1848 S   httpd
  783 root       1352 S   /usr/sbin/dnsmasq -n -i br0 -i rai1 -r /tmp/resolv.conf -x /var/run/dnsmasq.pid -u root
  785 root       2140 S   udhcpd /tmp/udhcpd0.conf
  789 root       2140 S   udhcpd /tmp/udhcpd1.conf
  793 root       2708 S   upnp -D
  812 root       3024 S   wps_monitor
  815 root       3024 S   wps_monitor
  819 root       2336 S   /usr/sbin/phychkd
  820 root       3024 S   wps_monitor
  826 root       3024 S   wps_monitor
  843 root       2608 S   /usr/sbin/ledd
  844 root       2088 S   /usr/sbin/ipv6_mon 0 0
  847 root       2560 S   reset_button
  849 root       1864 S   syslogd -C
  854 root       2068 S   /sbin/ulogd -d
  863 root       2324 S   /usr/sbin/wanstatus
  868 root       2600 S   /usr/sbin/self_health
  899 root       2604 S   Eco_mode
  917 root       1284 S   lld2d br0 rai0
  930 root      10712 S   /usr/bin/belkin_wan_cfg
  934 root       2016 S   /usr/sbin/usb_led_daemon
  936 root       1672 S   /usr/sbin/mcpsd 38
  994 root       1240 S   /usr/sbin/radvd-1.4 -C /tmp/radvd.conf_br0 -p /tmp/radvd.pid0
 1387 root       1852 S   /bin/sh
 1414 root       1852 R   ps w
 • netstat -l
# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:netbios-ssn     0.0.0.0:*               LISTEN
tcp        0      0 router.Belkin:http      0.0.0.0:*               LISTEN
tcp        0      0 router.Belkin:1780      0.0.0.0:*               LISTEN
tcp        0      0 router.Belkin:10101     0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:domain          0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:microsoft-ds    0.0.0.0:*               LISTEN
tcp        0      0 :::domain               :::*                    LISTEN
udp        0      0 router.Belkin:netbios-ns 0.0.0.0:*
udp        0      0 0.0.0.0:netbios-ns      0.0.0.0:*
udp        0      0 router.Belkin:netbios-dgm 0.0.0.0:*
udp        0      0 0.0.0.0:netbios-dgm     0.0.0.0:*
udp        0      0 localhost.localdomain:40100 0.0.0.0:*
udp        0      0 0.0.0.0:domain          0.0.0.0:*
udp        0      0 localhost.localdomain:40000 0.0.0.0:*
udp        0      0 localhost.localdomain:40002 0.0.0.0:*
udp        0      0 0.0.0.0:bootps          0.0.0.0:*
udp        0      0 0.0.0.0:bootps          0.0.0.0:*
udp        0      0 0.0.0.0:49235           0.0.0.0:*
udp        0      0 0.0.0.0:19540           0.0.0.0:*
udp        0      0 0.0.0.0:19541           0.0.0.0:*
udp        0      0 localhost.localdomain:40040 0.0.0.0:*
udp        0      0 localhost.localdomain:40042 0.0.0.0:*
udp        0      0 0.0.0.0:1900            0.0.0.0:*
udp        0      0 :::domain               :::*
raw        0      0 :::58                   :::*                    7
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path
 • cat /proc/bus/pci/devices
# cat devices
0000    18140802        0                      0                20100000                       0                       0                       0                       0                  0                 2000000                   10000                       0                       0                       0                 0                0        pcieport-driver
0100    18143091        10              20000000                       0                       0                       0                       0                       0                  0                   10000                       0                       0                       0                       0                 0                0        rt2860
 • lsmod
# lsmod
Module                  Size  Used by    Tainted: P
jcp_cmd                 6240  0
jcp                    10048  1 jcp_cmd
sxuptp_driver           3552  0
sxuptp_usbmode          3952  0
sxuptp                 44880  3 jcp_cmd,sxuptp_driver,sxuptp_usbmode
nf_nat_h323             7488  0
nf_conntrack_h323      49600  1 nf_nat_h323
ipv6                  316416  15 nf_conntrack_h323
usb_storage            38064  0
RT3090_ap_net          34592  1
RT3090_ap             948752  1 RT3090_ap_net
RT3090_ap_util         24576  2 RT3090_ap_net,RT3090_ap
rt2860v2_ap          1315792  1
xt_TCPMSS               4000  0
 • cat /proc/mtd
# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 0014d3df 00010000 "Kernel"
mtd5: 00662c21 00010000 "RootFS"
mtd6: 007a0000 00010000 "Kernel_RootFS"
mtd7: 00010000 00010000 "UserCfg"

bootloader stuff

 • help
N750 # ?
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
cpuloop   - RT3883 CPU loopback test
crc32   - checksum calculation
erase   - erase SPI FLASH memory
go      - start application at address 'addr'
help    - print online help
httpd   - start webserveriminfo  - print header information for application image
loadb   - load binary file over serial line (kermit mode)
loop    - infinite loop on address range
loopback   - Ralink eth loopback test !!
md      - memory display
mdio   - Ralink PHY register R/W command !!
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
pseloop   - RT3883 PSE loopback test
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
resetenv - reset environment variables (in RAM) to Unoot default
           you must issue 'saveenv' command to take effect
rf      - read/write rf register
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
spicmd  - read/write data from/to eeprom or vtss
tftpboot- boot image via network using TFTP protocol
version - print monitor version
 • env. vars
N750 # printenv
bootargs=NoArg
bootcmd=tftp
bootdelay=5
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=10.10.10.123
serverip=10.10.10.3
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramfisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
HW_BOOT_VER=1.7.4
HW_BOOT_DATE=May  2 2011 - 17:16:47
HW_WIFI_HIPOWER=0
ethact=Eth0 (10/100-M)
HW_LAN_MAC=08:86:3B:28:8F:94
HW_WAN_MAC=08:86:3B:28:8F:95
HW_WIFI_MAC=08:86:3B:28:8F:96
HW_WIFI_PIN=22255181
HW_SN=121119GG106750
HW_VER=01A
HW_SKU_ID=1
stdin=serial
stdout=serial
stderr=serial

Environment size: 1005/4092 bytes
 • board info
N750 # bdinfo
boot_params = 0x83F3EFB0
memstart    = 0x80000000
memsize     = 0x04000000
flashstart  = 0x00000000
flashsize   = 0x00800000
flashoffset = 0x00000000
ethaddr     = 08:86:3B:28:8F:94
ip_addr     = 10.10.10.123
baudrate    = 57600 bps


GPIO

I've gathered some of GPIO functions:

Tested by telnet:

 • GPIO
gpio disable 5 #internet blue on
gpio enable 6 #internet orange off
gpio disable 6 #internet orange on
gpio enable 5 #internet blue off
gpio disable 8 #modem orange on
gpio enable 8 #modem orange off
gpio disable 11 #modem blue on
gpio enable 11 #modem blue off
gpio disable 9 #router blue on
gpio enable 9 #router blue off

#Long press resset button
gpio pool 10
pressed = 00
unpressed = 01
gpio disable 10 #factory reset

gpio enable 12 #security orange off
gpio disable 12 #security orange on
gpio enable 13 #security blue off
gpio disable 13 #security blue on
gpio enable 22 #storage orange off
gpio disable 22 #storage orange on
gpio enable 23 #storage blue off
gpio disable 23 #storage blue on

#wps button
gpio pool 0
pressed = 00
unpressed = 01

Gathered from OpenWrt:

  • wired/wireless leds are controlled via bit shift register sitting on gpio pins 14 (ctl) and 4 (clk)
  • speed leds are controlled via bit shift register sitting on pins 17 (ctl) and 18 (clk)

Some notes:

  • restore config function doesn't work properly, the router get stucked.
  • PPPoE doesn't work with preselected want port, bridge port must be selected for wan, br0
  • current firmware level is more to instable to use it for a long period of time,
if there will be any new releases and if the time permits I'll test them.

Images

Belkin Images
DarkShadow's Unit
internal
FCCID K7SF9K1103V1