Netgear WNR3500v1

Netgear WNR3500 v1
Availability: now

Manuf (OEM/ODM): Foxconn U12H092 T00

FCC approval date: 02 January 2008
Country of manuf.: China
Series: N300

Type: wireless router

FCC ID: PY307300074
IC ID: 4054A-07300074
PCB ID: U12H092T00

Power: 12 VDC, 1.5 A
Connector type: barrel

CPU1: Marvell 88F5180NB1 (500 MHz)
FLA1: 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (Macronix MX29LV640DBTC-90G)
RAM1: 32 MiB33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br /> (Samsung K4H561638J-LCCC)

Expansion IFs: none specified
Serial: yes, 6-pin header, internal, unpopulated, 3.3V TTL, (115200,8,N,1), JP2

WI1 chip1: Marvell 88W8363
WI1 chip2: Marvell 88W8060
WI1 802dot11 protocols: bgn
WI1 MIMO config: 2x3:2
WI1 antenna connector: none

ETH chip1: Marvell 88F5180NB1
ETH chip2: Marvell 88E1112
ETH chip3: Marvell 88E1112
Switch: Marvell 88E6131
LAN speed: 1G
LAN ports: 4
WAN speed: 1G
WAN ports: 1

bgn

Additional chips
2.4GHz Power Amplifier IC;RFMD;RF5125;RF, 5125, H9F8;2;

Stock bootloader: U-Boot 1.1.1 Marvell

Stock FW OS: Linux 2.4.27 -vrs1

Flags: boot log

Default SSID: NETGEAR (44 addl. devices)
Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1305 additional devices
of which 106 are Netgear devices
Default login user: admin
Default login password: password
admin:password credentials used by 423 additional devices
of which 304 are Netgear devices

802dot11 OUI: 00:1F:33 (8 E, 12 W), 00:24:B2 (14 E, 16 W)
Ethernet OUI: 00:1F:33 (8 E, 12 W), 00:24:B2 (14 E, 16 W)

	CPU1 brand	WI1 chip1 brand	WI1 chip2 brand
Netgear WNR3500v1	Marvell	Marvell	Marvell
Netgear WNR3500v2	Broadcom	Broadcom

For a list of all currently documented Marvell chipsets with specifications, see Marvell.

---

RangeMax Wireless-N Gigabit Router

 • Support page

• On the OpenWrt Wiki

Netgear WNR3500 v1 on TechInfoDepot

Per a dissected US unit..

• "U12H092", "Rev. 2", and "GP" is silkscreened on the board.

All radial capacitors used are CapXon branded.

• The device has 8MB Flash and 32MB RAM.

The specific P/Ns used are in the infobox.

The netgear.com.cn device table also specifies

the device as having 8MB Flash and 32MB RAM.

• The 802.11n radio is using two RFMD RF5125

2.4-2.5GHz Power Amplifier ICs

Serial

Pinout

(3.3) (RxD) (...) (...) (TxD) (GND)
1               JP2

Info derived from

• Serial info

====version==== # version Release version : Netgear Wireless Router WNR3500 U12H09200/V1.0.36/8.0.36NA Time : Jun 11 2009 11:21:42 Boot code version : 1.0.3 ====cat /proc/version==== # cat /proc/version Linux version 2.4.27-vrs1 (weal@svn) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-1)) #1 Thu Jun 4 15:04:37 CST 2009 ====cat /proc/cpuinfo==== # cat /proc/cpuinfo Processor : ARM926EJ-Sid(wb) rev 0 (v5EJl) BogoMIPS : 332.59 Features : swp half thumb fastmult Hardware : MV-88fxx81 Revision : 0000 Serial : 0000000000000000 ====cat /proc/cmdline==== # cat /proc/cmdline console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro ====cat /proc/meminfo==== # cat /proc/meminfo total: used: free: shared: buffers: cached: Mem: 14909440 14462976 446464 0 1241088 2596864 Swap: 0 0 0 MemTotal: 14560 kB MemFree: 436 kB MemShared: 0 kB Buffers: 1212 kB Cached: 2536 kB SwapCached: 0 kB Active: 3608 kB Inactive: 2912 kB HighTotal: 0 kB HighFree: 0 kB LowTotal: 14560 kB LowFree: 436 kB SwapTotal: 0 kB SwapFree: 0 kB ====cat /proc/mtd==== # cat /proc/mtd dev: size erasesize name mtd0: 00800000 00010000 "Physically mapped flash" mtd1: 00100000 00010000 "kernel" mtd2: 00630000 00010000 "rootfs" mtd3: 00010000 00010000 "traffic_meter1" mtd4: 00010000 00010000 "traffic_meter2" mtd5: 00010000 00010000 "POT" mtd6: 00010000 00010000 "board_data" mtd7: 00010000 00010000 "nvram" mtd8: 00080000 00010000 "u-boot" mtd9: 00800000 00010000 "all"

• boot log

Boot code version : 1.0.3 ** MARVELL BOARD: RD-88F5181L-VOIP-GE LE U-Boot 1.1.1 (Jan 25 2008 - 09:11:36) Marvell version: 1.10.16 DRAM CS[0] base 0x00000000 size 16MB DRAM Total size 16MB [8192kB@ff800000] Flash: 8 MB Addresses 12M - 0M are saved for the U-Boot usage. Mem malloc Initialization (12M - 8M): Done *** Warning - bad CRC, using default environment Soc: 88F5181 B1 CPU: ARM926 (Rev 0) running @ 500Mhz Orion 1 streaming disabled SysClock = 166Mhz , TClock = 166Mhz USB 0: host mode PCI 0: PCI Express End Point Interface PCI 1: Conventional PCI, speed = 33000000 Net: egiga0 [PRIME] Hit any key to stop autoboot: 0 Decompressing kernel... ## Booting image at 00400000 ... Image Name: Linux-2.4.27-vrs1 Created: 2009-06-11 3:22:18 UTC Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1428280 Bytes = 1.4 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK Starting kernel ... ZLinux version 2.4.27-vrs1 (weal@svn) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-1)) #1 Thu Jun 4 15:04:37 CST 2009 CPU: ARM926EJ-Sid(wb) revision 0 Machine: MV-88fxx81 Using UBoot passing parameters structure Sys Clk = 166666667, Tclk = 166666667 On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 mtdparts=phys_mapped_flash:1m(kernel),2m@1m(rootfs),1m@3m(uboot)ro Calibrating delay loop... 332.59 BogoMIPS Memory: 16MB 0MB 0MB 0MB = 16MB total Memory: 14492KB available (1231K code, 374K data, 68K init) Dentry cache hash table entries: 2048 (order: 2, 16384 bytes) Inode cache hash table entries: 1024 (order: 1, 8192 bytes) Mount cache hash table entries: 512 (order: 0, 4096 bytes) Buffer cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) CPU: Testing write buffer: pass POSIX conformance testing by UNIFIX init hw started. CPU Interface ------------- SDRAM_CS0 ....base 00000000, size 16MB SDRAM_CS1 ....disable SDRAM_CS2 ....disable SDRAM_CS3 ....disable PEX0_MEM ....base e0000000, size 128MB PEX0_IO ....base f2000000, size 1MB PCI0_MEM ....base e8000000, size 128MB PCI0_IO ....base f2100000, size 1MB INTER_REGS ....base f1000000, size 1MB DEVICE_CS0 ....no such DEVICE_CS1 ....no such DEVICE_CS2 ....no such DEV_BOOCS ....base f4000000, size 16MB Flash bankwidth 2, base f4000000, size 1000000 PCI: bus0: Fast back to back transfers enabled HW already initialized. PCI: bus1: Fast back to back transfers enabled Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket WatchDog enabled. Marvell Development Board (LSP Version 1.1.3) -- RD-88F5181L-VOIP-GE Soc: 88F5181 B1 Detected Tclk 166666667 and SysClk 166666667 TWSI: twsiAddr7BitSet ERROR - Addr (7 Bit) int TimeOut. TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . TWSI: mvTwsiStartBitSet ERROR - Start Clear bit TimeOut . TWSI: mvTwsiStopBitSet ERROR - Stop bit TimeOut . Starting kswapd devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled ttyS00 at 0xf1012000 (irq = 3) is a 16550A Marvell Gateway Driver: Detected RD_88F5181L_VOIP_GE Wireless atthena LED button turned off Using VLAN-tag Mode L3/L4 Checksum offload enabled Multi queue support ( rxq0=128 rxq1=64 rxq2=64 rxq3=64 txq0=2000 ) Using boot network interface configuration eth0: mac_addr 00:1f:33:4b:91:07, VID 0x100, port list: port-0 eth1: mac_addr 00:1f:33:4b:91:06, VID 0x200, port list: port-1 port-2 port-3 port-4 init switch layer... done init MAC layer... done loading network interfaces: eth0 eth1 PPP generic driver version 2.4.2 physmap flash device: 1000000 at f4000000 Amd/Fujitsu Extended Query Table v1.1 at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling fast programming due to code brokenness. Using physmap partition definition Creating 9 MTD partitions on "Physically mapped flash": 0x00000000-0x00100000 : "kernel" 0x00100000-0x00730000 : "rootfs" 0x00730000-0x00740000 : "traffic_meter1" 0x00740000-0x00750000 : "traffic_meter2" 0x00750000-0x00760000 : "POT" 0x00760000-0x00770000 : "board_data" 0x00770000-0x00780000 : "nvram" 0x00780000-0x00800000 : "u-boot" 0x00000000-0x00800000 : "all" Initializing Cryptographic API NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 2048) NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 Fast Floating Point Emulator V0.94M by Peter Teichmann. mount_block_root: mtdblock/2 VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing init memory: 68K init started: BusyBox v1.01 (2009.03.03-08:18+0000) multi-call binary mv_gateway: starting eth0 mv_gateway: starting eth1 /sbin/syslogd: not found /proc/sys/net/ipv4/neigh/br0/base_reachable_time: cannot create Reading board data... WSC UUID: 0x93130468f8a39c3e3950eacf3d452c23 Using /lib/modules/2.4.27/net/acos_nat.o Warning: loading acos_nat will taint the kernel: no license See http://www.tux.org/lkml/#export-tainted for information about tainted modules Using /lib/modules/2.4.27/ap8x/ap8x.o Warning: loading ap8x will taint the kernel: non-GPL license - Proprietary See http://www.tux.org/lkml/#export-tainted for information about tainted modules ap0: Marvell AP-8x 802.11n adapter: mem=0xe8000000, irq=36 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 Waiting for Wireless Events from interfaces... device eth1 entered promiscuous mode device ap0 entered promiscuous mode br0: port 2(ap0) entering learning state br0: port 1(eth1) entering learning state ARPING to 255.255.255.255 from 192.168.1.1 via br0 br0: port 2(ap0) entering forwarding state br0: topology change detected, propagating br0: port 1(eth1) entering forwarding state br0: topology change detected, propagating Sent 3 probes (3 broadcast(s)) Received 0 reply info, udhcp server (v0.9.8) started error, unable to parse 'option wins ' error, unable to parse 'option domain ' Info: No FWPT default policies. wlanconfigd: No such file or directory POT integrity check OK. POT time is up. Starting WPS module ... mv_gateway: stopping eth0 mv_gateway: eth0 change mac address to 00:1f:33:4b:91:07 mv_gateway: starting eth0 Start DHCP client daemon BusyBox v1.01 (2009.03.03-08:18+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. # WPS Version: 14.1, December 11 2008 Wireless atthena LED button turned on WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 WLAN: MLME - Disconnecting (deauth) wireless client: ffffffffffff Reason 3 ap0: STA ff:ff:ff:ff:ff:ff IEEE 802.11: deassociated ====cat /proc/bus/pci/devices==== # cat devices 0138 11ab2a0a 24 e8000000 e8010000 00000000 00000000 00000000 00000000 00000000 00010000 00010000 00000000 00000000 00000000 00000000 00000000 ap%d ====lsmod==== # lsmod Module Size Used by Tainted: P ap8x 798272 1 acos_nat 290340 0 (unused) ====ps aux==== # ps aux PID Uid VmSize Stat Command 1 0 428 S init 2 0 SW [keventd] 3 0 SWN [ksoftirqd_CPU0] 4 0 SW [kswapd] 5 0 SW [bdflush] 6 0 SW [kupdated] 7 0 SW [mtdblockd] 141 0 428 S /sbin/iwevent 147 0 456 S swresetd 149 0 840 S upnpd 151 0 384 S dnsRedirectReplyd 153 0 808 S httpd 157 0 476 S udhcpd /tmp/udhcpd.conf 160 0 508 S dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u r 161 0 480 S ddnsd & 164 0 352 S telnetenabled 166 0 556 S heartbeat 174 0 728 S /usr/sbin/email 181 0 584 S lld2d br0 213 0 588 S wpsd 217 0 1228 S wsccmd /tmp/wsc 220 0 424 S udhcpc -i eth0 -p /var/run/udhcpc0.pid -s /tmp/udhcpc 222 0 496 R /bin/sh 225 0 1228 S wsccmd /tmp/wsc 226 0 1228 S wsccmd /tmp/wsc 227 0 1228 S wsccmd /tmp/wsc 228 0 1228 S wsccmd /tmp/wsc 229 0 1228 S wsccmd /tmp/wsc 230 0 1228 S wsccmd /tmp/wsc 231 0 1228 S wsccmd /tmp/wsc 232 0 1228 S wsccmd /tmp/wsc 233 0 732 S hostapd -W /tmp/wsc/hostapd.conf 599 0 552 R ps aux

Images

• internal images
• 

  board top

• 

  angled above the 88F5180 SoC

• 

  Flash

• 

  88W8363 MAC/BB

• 

  radio section

• 

  board top, antenna side

• 

  board top, shield removed

• 

  88E1112 GbE PHYs

• 

  88E6131 GbE Switch

• 

  Foxconn label

• 

  Foxconn board text

• 

  board bottom

How To Identify Which Model Router You Have

by benryanau

After spending an hour researching the variants of the Netgear WNR3500 family and their

specs prior to a purchase, I realized this would he handy to post up somewhere.

So, I thought I'd table it up and share it, since there wasn't a concise guide anywhere

on the web already. Hopefully this will help some people out!

Model	Flash /RAM	CPU	USB	Ant	WLAN	Eth	WAN	Notes	FCC ID
WNR3500 v1	8/32	Marvell 88F5180NB1 @500 TopDog	No	2 int.	N300	4x GbE	GigE	Blue Antenna LEDs on top	PY307300074
WNR3500 v2	4/32	Broadcom BCM4718A @480 MIPS74k	No	4 int.	N300	4x GbE	GbE	"V2" marked under orange LAN ports, smaller housing, no antenna LEDs	PY308400093
WNR3500L V1	8/64	Broadcom BCM4718A @480 MIPS74k	1x USB 2.0	4 int.	N300	4x GbE	GbE	WNR3500U/WNR3500L Marked below yellow WAN port	PY308400093
WNR3500L V2	128/128	Broadcom BCM47186B0 @480 MIPS74k	1x USB 2.0	2 int.	N300	4x GbE	GbE	Below yellow WAN port WNR3500L v2	PY310400153

Images

• 

  Picture of the back of WNR3500U/3500L v1

• 

  Picture of the back of WNR3500L v2

• 

  Picture of the back of WNR3500U

• 

  Closeup of label WNR3500U