Belkin F9K1103 v1

Belkin F9K1103 v1
Availability: common

Manuf (OEM/ODM): Arcadyan WG9117 A23-AK

FCC approval date: 06 May 2011
(Est.) release date: 27 May 2011
UPC: 722868817872 (UPC DB, On eBay)
Country of manuf.: China
S/N prefix: 12113

Amazon image

ASIN
B004N625AK (, On Amazon, On CCC)

Type: wireless router

FCC ID: K7SF9K1103V1
IC ID: 3623A-F9K1103V1

Power: 12 VDC, 2 A
Connector type: barrel

CPU1: Ralink RT3883F (500 MHz)
FLA1: 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (Macronix MX25L6406EM2I-12G)
RAM1: 64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (EtronTech EM68B16CWPA-25H)

Expansion IFs: USB 2.0
USB ports: 2
Serial: yes, 4-pin header, (57600 8N1), 3.3V TTL, J12

WI1 chip1: Ralink RT3883F
WI1 802dot11 protocols: an
WI1 MIMO config: 3x3:3
WI1 antenna connector: U.FL
WI2 chip1: Ralink RT3092
WI2 802dot11 protocols: bgn
WI2 MIMO config: 2x2:2
WI2 antenna connector: none

ETH chip1: Ralink RT3883F
Switch: Realtek RTL8367R
LAN speed: 1GbE
LAN ports: 4
WAN speed: 1GbE
WAN ports: 1

abgn

Stock bootloader: U-Boot 3.5.2.0 Ralink

Stock FW OS: Linux 2.6.22

TPFirmware supported: Padavan • (List)

Default SSID: belkin.XXX (20 addl. devices)
, belkin.XXX.5GHz (5 addl. devices)
Default IP address: 192.168.2.1
the IP 192.168.2.1 is used by 296 additional devices
of which 97 are Belkin devices
Default login user: admin
Default login password: password
admin:password credentials used by 423 additional devices
of which 0 are Belkin devices

802dot11 OUI: 08:86:3B (10 E, 14 W), 94:44:52 (17 E, 22 W)
Ethernet OUI: 08:86:3B (10 E, 14 W), 94:44:52 (17 E, 22 W)

For a list of all currently documented Ralink chipsets with specifications, see Ralink.

---

N750 DB Wi-Fi Dual-Band N+ Gigabit Router

 • Support page

"P/N: 141911720003J R01C" is silkscreened on the board.

The default SSID patterns for this model is:

belkin.XXX (where XXX is the last three octets of the wireless interface MAC for this SSID) and

belkin.XXX.5GHz (MAC = 2.4GHz network MAC + 2, same XXX from the 2.4GHz network).

The guest network is (if enabled) belkin.XXX.guests

(MAC = 2.4GHz network MAC + 1, same XXX from the 2.4GHz network).

Reviews

• Reviewed on SmallNetBuilder

OUI of 08:86:3B and SSID of belkin_2

Forum threads

• Support Request - Belkin N 750 DB - F9K1103 v1 (01A) on DD-WRT forums
• Belkin F9K1103 (N750 DB) equivalent and support for openwrt on OpenWRT forums

Third party firmware

• https://yadi.sk/d/6ttXcerpJ2hg3
• https://app.box.com/s/2wxyv4cjdgd52m4a1wzd

Serial

Pinout

^ to RAM
© (GND)
© (RxD)
© (TxD)    --> 5 GHz ant (B)
® [3.3]    NC
J12

Info derived from

Expand • boot log

ARC Uboot:1.7.4 (May 2 2011 - 17:16:40) Board: Ralink APSoC DRAM: 64 MB relocate_code Pointer at: 83fa0000 spi_wait_nsec: 30 spi device id: c2 20 17 c2 20 (2017c220) find flash: MX25L6405D ..============================================ Ralink UBoot Version: 3.5.2.0 -------------------------------------------- ASIC 3883_MP (MAC to VITESSE Mode) DRAM_CONF_FROM: Boot-Strapping DRAM_TYPE: DDR2 DRAM_SIZE: 512 Mbits DRAM_WIDTH: 16 bits DRAM_TOTAL_WIDTH: 16 bits TOTAL_MEMORY_SIZE: 64 MBytes Flash component: SPI Flash Date:May 2 2011 Time:17:16:40 ============================================ icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 500 MHZ #### estimate memory size =64 Mbytes Please choose the operation: 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. 4 initializing CHIP_RTL8367R_VB 1010 0 initializing CHIP_RTL8367R_VB 1010 3: System Boot system code via Flash. ## Booting image at bc050000 ... Image Name: N750F9K1103VB Created: 2012-12-12 3:46:09 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 7398303 Bytes = 7.1 MB Load Address: 80000000 Entry Point: 8033e000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 8033e000) ... ## Giving linux memsize in MB, 64 Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.22 (kevinlin@arc-vcs) (gcc version 4.1.2) #4 Wed Dec 12 11:41:34 CST 2012 cmd line = console=ttyS1,57600n8 root=/dev/mtdblock5 init=/sbin/preinit The CPU feqenuce set to 500 MHz CPU revision is: 0001974c Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Built 1 zonelists. Total pages: 16256 Kernel command lkne: console=ttyS1,57600n8 root=/dev/mtdblock5 init=/sbin/preinit Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). cause = 40808000, status = 11000000 PID hash table entries: 256 (order: 8, 1024 bytes) calculating r4koff... 001e8480(2000000) CPU frequency 500.00 MHz Using 250.000 MHz high precision timer. console handover: boot [early0] -> real [ttyS1] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 61184k/65536k available (2649k kernel code, 4336k reserved, 666k data, 124k init, 0k highmem) Mount-cache hash table entries: 512 NET: Registered protocol family 16 RALINK_PCI_PCICFG_ADDR = 0 *************** Ralink PCIe RC mode ************* registering PCI controller with io_map_base unset SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb [junius] pcibios_init Next Bus No=0 hose= 80307758 Mem=8030778C Io=803077A8 2->[1][0][0][30]=0 5->[1][0][0][30]=fffffffe 2->[1][0][0][30]=0 5->[1][0][0][30]=0 PCI: Bridge: 0000:00:00.0 IO window: disabled. MEM window: 20000000-200fffff PREFETCH window: disabled. BAR0 at slot 0 = 0 bus=0, slot = 0x0 P2P(PCI) 0x00 = 08021814 P2P(PCI) 0x04 = 00100007 P2P(PCI) 0x08 = 06040001 P2P(PCI) 0x0c = 00010000 P2P(PCI) 0x10 = 00000000 P2P(PCI) 0x14 = 20100000 P2P(PCI) 0x18 = 00010100 P2P(PCI) 0x1c = 000000f0 P2P(PCI) 0x20 = 20002000 P2P(PCI) 0x24 = 0000fff0 P2P(PCI) 0x28 = 00000000 P2P(PCI) 0x2c = 00000000 P2P(PCI) 0x30 = 00000000 P2P(PCI) 0x34 = 00000040 P2P(PCI) 0x38 = 00000000 P2P(PCI) 0x3c = 000401ff res[0]->start = 0 res[0]->end = 1ffffff res[1]->start = 20100000 res[1]->end = 2010ffff res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 bus=1, slot = 0x0 dev III(PCIe) 0x00 = 30911814 dev III(PCIe) 0x04 = 00100000 dev III(PCIe) 0x08 = 02800000 dev III(PCIe) 0x0c = 00000000 dev III(PCIe) 0x10 = 20000000 dev III(PCIe) 0x14 = 00000000 dev III(PCIe) 0x18 = 00000000 dev III(PCIe) 0x1c = 00000000 dev III(PCIe) 0x20 = 00000000 dev III(PCIe) 0x24 = 00000000 dev III(PCIe) 0x28 = 00000000 dev III(PCIe) 0x2c = 30911814 dev III(PCIe) 0x30 = 00000000 dev III(PCIe) 0x34 = 00000040 dev III(PCIe) 0x38 = 00000000 dev III(PCIe) 0x3c = 000001ff res[0]->start = 20000000 res[0]->end = 2000ffff res[1]->start = 0 res[1]->end = 0 res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 register_mtd_chip_driver for cfi_probe Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered deice id : c2 20 17 c2 20 (2017c220) MX25L6405D(c2 2017c220) (8192 Kbytes) mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 8 MTD partitions on "raspi": 0x00000000-0x00800000 : "ALL" 0x00000000-0x00030000 : "Bootloader" 0x00030000-0x00040000 : "Config" 0x00040000-0x00050000 : "Factory" 0x00050000-0x0019d3df : "Kernel" mtd: partition "Kernel" doesn't end on an erase block -- force read-only 0x0019d3df-0x00800000 : "RootFS" mtd: partition "RootFS" doesn't start on an erase block boundary -- force read-only 0x00050000-0x007f0000 : "Kernel_RootFS" 0x007f0000-0x00800000 : "UserCfg" RT3xxx EHCI/OHCI init. VFS: Disk quotas dquot_6.5.1 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher fuse init (API version 7.8) io scheduler noop registered (default) pcie_portdrv_probe->Dev[1814:0802] has invalid IRQ. Check vendor BIOS assign_interrupt_mode Found MSI capability Ralink gpio driver initialized spidrv_major = 217 ARC_KERNEL_OSIX_init() success HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096 N_HDLC line discipline registered. Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A loop: module loaded MAC_ADRH -- : 0x00000000 MAC_ADRL -- : 0x00000000 MAC_ADRH -- : 0x00000000 MAC_ADRL -- : 0x00000000 Ralink APSoC Ethernet Driver Initilization. v2.0 256 rx/tx descriptors allocated, mtu = 1500! MAC_ADRH -- : 0x0000000c MAC_ADRL -- : 0x4328808e PROC INIT OK! Pull high SDA & SCK GPIO pin 24 reset to switch rtl8367_RouterVlanInit() rv=0 IsolateWanPort() rtk_vlan_set(VLAN1) rv=0 IsolateWanPort() rtk_vlan_set(VLAN2) rv=0 IsolateWanPort() rtk_vlan_get(VLAN1) rv=0 mbrmsk=ef untagmsk=f fid=0 IsolateWanPort() rtk_vlan_get(VLAN2) rv=0 mbrmsk=30 untagmsk=10 fid=1 IsolateWanPort() rtk_vlan_portPvid_get(0) rv=0 vid=1 pri=0 IsolateWanPort() rtk_vlan_portPvid_get(1) rv=0 vid=1 pri=0 IsolateWanPort() rtk_vlan_portPvid_get(2) rv=0 vid=1 pri=0 IsolateWanPort() rtk_vlan_portPvid_get(3) rv=0 vid=1 pri=0 IsolateWanPort() rtk_vlan_portPvid_get(4) rv=0 vid=2 pri=0 IsolateWanPort() rtk_vlan_portPvid_get(5) rv=0 vid=1 pri=0 rtl8367b driver initialized PPP generic driver version 2.4.2 PPP BSD Compression module registered NET: Registered protocol family 24 block2mtd: version $Revision: 1.1.1.1 $ dev_nvram_init() 827 mtd->name=UserCfg rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1 rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000 rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2 rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (512 buckets, 4096 max) ctnetlink v0.93: registering with nfnetlink. ip_tables: (C) 2000-2006 Netfilter Core Team ClusterIP Version 0.8 loaded successfully arp_tables: (C) 2002 David S. Miller TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 17 mcps_module_init() initializing Ebtables v2.0 registered 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 124k freed Warning: unable to open an initial console. Algorithmics/MIPS FPU Emulator v1.5 [sighandler]: No more events to be processed, quitting. [cleanup]: Waiting for children. [cleanup]: All children terminated. sysinit() done use original.... Assume Wi-Fi RadioOn everytime reboot!! connect: Network is unreachable rt2860v2_ap: module license 'unspecified' taints kernel. === pAd = c000f000, size = 487768 === <-- RTMPAllocTxRxRingMemory, Status=0 <-- RTMPAllocAdapterBlock, Status=0 === pAd = c0307000, size = 513184 === <-- RTMPAllocAdapterBlock, Status=0 pAd->CSRBaseAddress =0xc01a0000, csr_addr=0xc01a0000! Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. NET: Registered protocol family 10 MAC_ADRH -- : 0x00000886 MAC_ADRL -- : 0x3b288f94 phy_tx_ring = 0x00340000, tx_ring = 0xa0340000 phy_rx_ring0 = 0x00341000, rx_ring0 = 0xa0341000 CDMA_CSG_CFG = 81000007 GDMA1_FWD_CFG = C0710000 eth2.1: dev_set_promiscuity(master, 1) device eth2 entered promiscuous mode device eth2.1 entered promiscuous mode br0: port 1(eth2.1) entering learning state force port 0 up force port 1 up force port 2 up force port 3 up rmmod: hw_nat Starting HotPlug: /usr/sbin/hotplugd -D -f Starting jcpd daemon: /usr/sbin/jcpd br0: topology change detected, propagating br0: port 1(eth2.1) entering forwarding state fw_rule_isolatedlan: br0 fw_rule_isolatedlan: br0 fw_rule_SkipSnatToLans: br0 fw_rule_SkipDnatFromLans: br0 RX DESC a0357000 size = 2048 Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 8 2. Phy Mode = 8 3. Phy Mode = 8 RTMPSetPhyMode: channel is out of range, use first channel=0 MCS Set = ff ff ff 00 01 SYNC - BBP R4 to 20MHz.l Starting Samba: /usr/sbin/smbd -D Main bssid = 08:86:3b:28:8f:96 <==== rt28xx_init, Status=0 0x1300 = 00064380 device ra0 entered promiscuous mode br0: port 2(ra0) entering learning state /usr/sbin/nmbd -D RX DESC a2dff000 size = 2048 <-- RTMPAllocTxRxRingMemory, Status=0 br0: topology change detected, propagating br0: port 2(ra0) entering forwarding state Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 9 2. Phy Mode = 9 3. Phy Mode = 9 RTMPSetPhyMode: channel is out of range, use first channel=0 MCS Set = ff ff 00 00 01 SYNC - BBP R4 to 20MHz.l Starting sxuptpd USB port mode selector has been enabled Initializing USB port mode: port1 = NAS port2 = NAS usbcore: registered new interface driver sxuptp_driver Starting usbjcpd insmod: cannot insert '/lib/modules/2.6.22/kernel/drivers/usb/storage/usb-storage.ko': Invalid parameters (17): Invalid argument SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l Main bssid = 08:86:3b:28:8f:94 <==== rt28xx_init, Status=0 0x1300 = 00064380 device rai0 entered promiscuous mode br0: port 3(rai0) entering learning state br0: topology change detected, propagating br0: port 3(rai0) entering forwarding state do init wsc MsgQ System Initializationeth2.2: Setting MAC address to ! 08 86 3b 28 8f 95. < rc_wan_start: 640>: ifconfig eth2.2 up Create netlink socket thread success! Create ioctl socket(6) success! Create wscd udhcpc_main(452): udhcp client (v0.9.8) started rc_nat_dmz_stop, 256 rc_nat_dmz_action nat_dmz_rule_flush, 67: wan_index 0 set FW_DMZ_STAT 0 with wan_index 0 ipv6 started 0 CFG_NAT_DMZ_HOST = 2145950120 host = rc_nat_vts_stop, 336 share memory key=74565 successful id on creating=32769 led_process_init() eco=0 wpsm_upnp_attach() OK signalling RUNNING rc_fw_macflt_stop : 163 start Eco_mode rc_nat_Masquerade_stop, 182 rc_nat_Masquerade_action nat_Masquerade_rule_flush ***** g_wl_interface = rai0 ****** lld2d: listening on interface br0 start belkin_wan_cfg udhcpc_main(737): Received SIGTERM belkin_wan_cfg running on 102a8c0 UPnP daemon is ready to run ctrl_flags=0x38 rc_twonky_start: 1166 rc_all_start 112 mcps: mcps_netlink_rcv() nlh->nlmsg_len=528mcps: mcps_process_registration() mcps_pid=954 mcps: mcps_process_registration() set control flag 0x38 /bin/mknod /dev/ARCOSIX_DEV c 253 0

Expand • ps w

# ps w PID Uid VSZ Stat Command 1 root 2552 S /sbin/preinit 2 root SW< [kthreadd] 3 root SWN [ksoftirqd/0] 4 root SW< [watchdog/0] 5 root SW< [events/0] 6 root SW< [khelper] 36 root SW< [kblockd/0] 39 root SW< [khubd] 57 root SW [pdflush] 58 root SW [pdflush] 59 root SW< [kswapd0] 60 root SW< [aio/0] 100 root SW< [mtdblockd] 308 root 2548 S /sbin/preinit 309 root 2548 S /sbin/preinit 429 root 1516 S /usr/sbin/hotplugd -D -f 430 root 1516 S /usr/sbin/hotplugd -D -f 450 root 1516 S /usr/sbin/hotplugd -D -f 452 root 1540 S /usr/sbin/jcpd 717 root SW [RtmpCmdQTask] 718 root SW [RtmpWscTask] 723 root 6404 S /usr/sbin/smbd -D 735 root SW [RtmpCmdQTask] 736 root 6028 S /usr/sbin/nmbd -D 737 root 6404 S /usr/sbin/smbd -D 738 root SW [RtmpWscTask] 745 root SW< [sxuptp-wq] 746 root SW [sxuptp-ka] 758 root SW [jcpcore] 777 root 1848 S httpd 783 root 1352 S /usr/sbin/dnsmasq -n -i br0 -i rai1 -r /tmp/resolv.conf -x /var/run/dnsmasq.pid -u root 785 root 2140 S udhcpd /tmp/udhcpd0.conf 789 root 2140 S udhcpd /tmp/udhcpd1.conf 793 root 2708 S upnp -D 812 root 3024 S wps_monitor 815 root 3024 S wps_monitor 819 root 2336 S /usr/sbin/phychkd 820 root 3024 S wps_monitor 826 root 3024 S wps_monitor 843 root 2608 S /usr/sbin/ledd 844 root 2088 S /usr/sbin/ipv6_mon 0 0 847 root 2560 S reset_button 849 root 1864 S syslogd -C 854 root 2068 S /sbin/ulogd -d 863 root 2324 S /usr/sbin/wanstatus 868 root 2600 S /usr/sbin/self_health 899 root 2604 S Eco_mode 917 root 1284 S lld2d br0 rai0 930 root 10712 S /usr/bin/belkin_wan_cfg 934 root 2016 S /usr/sbin/usb_led_daemon 936 root 1672 S /usr/sbin/mcpsd 38 994 root 1240 S /usr/sbin/radvd-1.4 -C /tmp/radvd.conf_br0 -p /tmp/radvd.pid0 1387 root 1852 S /bin/sh 1414 root 1852 R ps w

Expand • netstat -l

# netstat -l Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:netbios-ssn 0.0.0.0:* LISTEN tcp 0 0 router.Belkin:http 0.0.0.0:* LISTEN tcp 0 0 router.Belkin:1780 0.0.0.0:* LISTEN tcp 0 0 router.Belkin:10101 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:domain 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:microsoft-ds 0.0.0.0:* LISTEN tcp 0 0 :::domain :::* LISTEN udp 0 0 router.Belkin:netbios-ns 0.0.0.0:* udp 0 0 0.0.0.0:netbios-ns 0.0.0.0:* udp 0 0 router.Belkin:netbios-dgm 0.0.0.0:* udp 0 0 0.0.0.0:netbios-dgm 0.0.0.0:* udp 0 0 localhost.localdomain:40100 0.0.0.0:* udp 0 0 0.0.0.0:domain 0.0.0.0:* udp 0 0 localhost.localdomain:40000 0.0.0.0:* udp 0 0 localhost.localdomain:40002 0.0.0.0:* udp 0 0 0.0.0.0:bootps 0.0.0.0:* udp 0 0 0.0.0.0:bootps 0.0.0.0:* udp 0 0 0.0.0.0:49235 0.0.0.0:* udp 0 0 0.0.0.0:19540 0.0.0.0:* udp 0 0 0.0.0.0:19541 0.0.0.0:* udp 0 0 localhost.localdomain:40040 0.0.0.0:* udp 0 0 localhost.localdomain:40042 0.0.0.0:* udp 0 0 0.0.0.0:1900 0.0.0.0:* udp 0 0 :::domain :::* raw 0 0 :::58 :::* 7 Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path

Expand • cat /proc/bus/pci/devices
# cat devices 0000 18140802 0 0 20100000 0 0 0 0 0 2000000 10000 0 0 0 0 0 pcieport-driver 0100 18143091 10 20000000 0 0 0 0 0 0 10000 0 0 0 0 0 0 rt2860

Expand • lsmod

# lsmod Module Size Used by Tainted: P jcp_cmd 6240 0 jcp 10048 1 jcp_cmd sxuptp_driver 3552 0 sxuptp_usbmode 3952 0 sxuptp 44880 3 jcp_cmd,sxuptp_driver,sxuptp_usbmode nf_nat_h323 7488 0 nf_conntrack_h323 49600 1 nf_nat_h323 ipv6 316416 15 nf_conntrack_h323 usb_storage 38064 0 RT3090_ap_net 34592 1 RT3090_ap 948752 1 RT3090_ap_net RT3090_ap_util 24576 2 RT3090_ap_net,RT3090_ap rt2860v2_ap 1315792 1 xt_TCPMSS 4000 0

Expand • cat /proc/mtd
# cat /proc/mtd dev: size erasesize name mtd0: 00800000 00010000 "ALL" mtd1: 00030000 00010000 "Bootloader" mtd2: 00010000 00010000 "Config" mtd3: 00010000 00010000 "Factory" mtd4: 0014d3df 00010000 "Kernel" mtd5: 00662c21 00010000 "RootFS" mtd6: 007a0000 00010000 "Kernel_RootFS" mtd7: 00010000 00010000 "UserCfg"

bootloader stuff

Expand • help

N750 # ? ? - alias for 'help' base - print or set address offset bdinfo - print Board Info structure bootm - boot application image from memory bootp - boot image via network using BootP/TFTP protocol cmp - memory compare coninfo - print console devices and information cp - memory copy cpuloop - RT3883 CPU loopback test crc32 - checksum calculation erase - erase SPI FLASH memory go - start application at address 'addr' help - print online help httpd - start webserveriminfo - print header information for application image loadb - load binary file over serial line (kermit mode) loop - infinite loop on address range loopback - Ralink eth loopback test !! md - memory display mdio - Ralink PHY register R/W command !! mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nm - memory modify (constant address) printenv- print environment variables pseloop - RT3883 PSE loopback test rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU resetenv - reset environment variables (in RAM) to Unoot default you must issue 'saveenv' command to take effect rf - read/write rf register saveenv - save environment variables to persistent storage setenv - set environment variables sleep - delay execution for some time spicmd - read/write data from/to eeprom or vtss tftpboot- boot image via network using TFTP protocol version - print monitor version

Expand • env. vars

N750 # printenv bootargs=NoArg bootcmd=tftp bootdelay=5 baudrate=57600 ethaddr="00:AA:BB:CC:DD:10" ipaddr=10.10.10.123 serverip=10.10.10.3 ramargs=setenv bootargs root=/dev/ram rw addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1 flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramfisk_addr) kernel_addr=BFC40000 u-boot=u-boot.bin load=tftp 8A100000 $(u-boot) u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize) loadfs=tftp 8A100000 root.cramfs u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize) test_tftp=tftp 8A100000 root.cramfs;run test_tftp HW_BOOT_VER=1.7.4 HW_BOOT_DATE=May 2 2011 - 17:16:47 HW_WIFI_HIPOWER=0 ethact=Eth0 (10/100-M) HW_LAN_MAC=08:86:3B:28:8F:94 HW_WAN_MAC=08:86:3B:28:8F:95 HW_WIFI_MAC=08:86:3B:28:8F:96 HW_WIFI_PIN=22255181 HW_SN=121119GG106750 HW_VER=01A HW_SKU_ID=1 stdin=serial stdout=serial stderr=serial Environment size: 1005/4092 bytes

Expand • board info
N750 # bdinfo boot_params = 0x83F3EFB0 memstart = 0x80000000 memsize = 0x04000000 flashstart = 0x00000000 flashsize = 0x00800000 flashoffset = 0x00000000 ethaddr = 08:86:3B:28:8F:94 ip_addr = 10.10.10.123 baudrate = 57600 bps

GPIO

• Source

I've gathered some of GPIO functions:

Tested by telnet:

Expand • GPIO

gpio disable 5 #internet blue on gpio enable 6 #internet orange off gpio disable 6 #internet orange on gpio enable 5 #internet blue off gpio disable 8 #modem orange on gpio enable 8 #modem orange off gpio disable 11 #modem blue on gpio enable 11 #modem blue off gpio disable 9 #router blue on gpio enable 9 #router blue off #Long press resset button gpio pool 10 pressed = 00 unpressed = 01 gpio disable 10 #factory reset gpio enable 12 #security orange off gpio disable 12 #security orange on gpio enable 13 #security blue off gpio disable 13 #security blue on gpio enable 22 #storage orange off gpio disable 22 #storage orange on gpio enable 23 #storage blue off gpio disable 23 #storage blue on #wps button gpio pool 0 pressed = 00 unpressed = 01

Gathered from OpenWrt:

• wired/wireless leds are controlled via bit shift register sitting on gpio pins 14 (ctl) and 4 (clk)
• speed leds are controlled via bit shift register sitting on pins 17 (ctl) and 18 (clk)

Some notes:

• restore config function doesn't work properly, the router get stucked.
• PPPoE doesn't work with preselected want port, bridge port must be selected for wan, br0
• current firmware level is more to instable to use it for a long period of time,

if there will be any new releases and if the time permits I'll test them.

Images

Belkin Images

• 

  Display

• 

  Display

DarkShadow's Unit

• 

  DarkShadow's Unit

• 

  DarkShadow's Unit

internal

• 

  board top

• 

  RT3883

• 

  Flash

• 

  EtronTech RAM

• 

  RT3092

• 

  RTL8367R GbE Switch

• 

  board top, shields off

• 

  2.4GHz RF section

• 

  5GHz RF section

• 

  board top, front, facing caps

• 

  board top, front-left, facing caps

• 

  board top, front-right, facing caps

• 

  board top, left, facing caps

• 

  board top, right, facing caps

• 

  board top, over caps + power section

• 

  5GHz RF

• 

  Arcadyan P/N

• 

  board MAC+PIN+etc label

FCCID K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1

• 

  K7SF9K1103V1