TRENDnet TEW-811DRU

From WikiDevi.Wi-Cat.RU
Jump to navigation Jump to search

TRENDnet TEW-811DRU V1.0R

Manuf (OEM/ODM): U-MEDIA WRT-C40B

FCC approval date: 23 April 2013
(Est.) release date: 11 May 2013
UPC: 710931130133 (UPC DB, On eBay)
Country of manuf.: Taiwan
Series: AC1200

Amazon image

ASIN
B00BKFYLFO (Flag of the United States.svg, On Amazon, On CCC)

Type: wireless router

FCC ID: XU8TEW1200AC
PCB ID: 0500-253411000

Power: 12 VDC, 2 A
Connector type: barrel

CPU1: Broadcom BCM47081A0 (800 MHz)
FLA1: 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (Macronix MX25L6406E)
RAM1: 64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (Winbond W9751G6KB-25)

Expansion IFs: USB 2.0
USB ports: 1
Serial: yes, 4-pin header, unpopulated, 3.3V TTL, (115200,8,N,1)

WI1 chip1: Broadcom BCM4352
WI1 802dot11 protocols: an+ac
WI1 MIMO config: 2x2:2
WI1 antenna connector: U.FL
WI2 chip1: Broadcom BCM43217T
WI2 802dot11 protocols: bgn
WI2 MIMO config: 2x2:2
WI2 antenna connector: U.FL

ETH chip1: Broadcom BCM47081A0
Switch: Broadcom BCM47081A0
LAN speed: 1G
LAN ports: 4
WAN speed: 1G
WAN ports: 1

abgn+ac

Additional chips
5GHz Power Amplifier IC;Skyworks;SE5003L1;5003L1, 246GX, 1246 MY;2;

Stock bootloader: CFE 6.30.163.2005 (r390094)

Stock FW OS: Linux

TPFirmware supported: DD-WRT • (List)

Default SSID: TRENDnet811_2.4GHz_XXXX
, TRENDnet811_5GHz_XXXX
Default IP address: 192.168.10.1
the IP 192.168.10.1 is used by 123 additional devices
of which 45 are TRENDnet devices
Default login user: admin
Default login password: randomly generated
admin:randomly generated credentials used by 29 additional devices
of which 12 are TRENDnet devices

802dot11 OUI: B8:EB:97
Ethernet OUI: B8:EB:97

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

AC1200 Dual Band Wireless Router

Product page  • Support page
  • "WRT-C40B Rev:UC" is silkscreened on the board in the FCC photos.
A Hynix H5PS1G63JFR-S6C (128MB) chip is shown in the photos.

The FCC docs specify that this FCC ID is also used for the TEW-800MB

(AC1200 Dual Band Wireless Media Bridge).

The TEW-800MB is also specified as an additional model in the FCC filing

for the TEW-812DRU (AC1750 Dual Band Wireless Media Bridge).

Reviews

"0500-253411000" is silkscreened on the board.
A label affixed to the switched Ethernet ports casing
indicates the U-MEDIA model of the device is WRT-C40B.
CPU, Flash, RAM, and Wi-Fi IC P/Ns are per SNB.

Third party firmware related

Serial

Pinout

It's the same pinout as is used by the Linksys WAP610N,

another U-MEDIA device.
[3.3] (GND) (TxD) (RxD)

Info derived from

FW 1.0.6.1 boot log

 • boot log 
Decompressing...done
Decompressing...done

CFE version 6.30.163.2005 (r390094) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Tue Mar 19 13:51:33 CST 2013 (aaron.tseng@aarontseng.u-media.com.tw)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 400 MHz
Warning: using legacy sdram_ncdl parameter to set DDR frequency.
Equivalent setting in clkfreq=800,*0* will be ignored.
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.30.163.2005 (r390094)
CPU type 0x0: 800MHz
Tot mem: 65536 KBytes

CFE mem:    0x00F00000 - 0x00FCE5FC (845308)
Data:       0x00F42D6C - 0x00F431A8 (1084)
BSS:        0x00F431B8 - 0x00F685FC (152644)
Heap:       0x00F685FC - 0x00FCC5FC (409600)
Stack:      0x00FCC5FC - 0x00FCE5FC (8192)
Text:       0x00F00000 - 0x00F3AE74 (241268)

Device eth0:  hwaddr D8-EB-97-A7-37-F0, ipaddr 192.168.10.1, mask 255.255.255.0
        gateway not set, nameserver not set
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .... 4287424 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000

wl revinfo

 • wl rev info 
root@DD-WRT:~# wl -i eth1 revinfo
vendorid 0x14e4
deviceid 0x43a9
radiorev 0xe2057000
chipnum 0xa8d1
chiprev 0x1
chippackage 0x9
corerev 0x1e
boardid 0xd646
boardvendor 0x14e4
boardrev P100
driverrev 0x6250e56
ucoderev 0x38b006e
bus 0x1
phytype 0x4
phyrev 0x11
anarev 0x0
nvramrev 0
root@DD-WRT:~# wl -i eth2 revinfo
vendorid 0x14e4
deviceid 0x43b3
radiorev 0x42069000
chipnum 0x4352
chiprev 0x3
chippackage 0x1
corerev 0x2a
boardid 0xd646
boardvendor 0x14e4
boardrev P100
driverrev 0x6250e56
ucoderev 0x38b006e
bus 0x1
phytype 0xb
phyrev 0x1
anarev 0x0
nvramrev 0

cat /proc/cpuinfo

 • cpu info 
root@DD-WRT:/proc# cat cpuinfo
model name      : ARMv7 Processor rev 0 (v7l)
BogoMIPS        : 795.44
Features        : swp half thumb fastmult edsp tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x3
CPU part        : 0xc09
CPU revision    : 0

Hardware        : Northstar Prototype
Revision        : 0000
Serial          : 0000000000000000

dmesg

 • DD-WRT FW dmesg 
Booting Linux on physical CPU 0x0
Linux version 3.10.34 (root@dd-wrt.buildserver) (gcc version 4.8.3
(OpenWrt/Linaro GCC 4.8-2014.01 r39555) ) #2076 Thu Mar 27 05:47:59 CET 2014
CPU: ARMv7 Processor [413fc090] revision 0 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: Northstar Prototype
Ignoring unrecognised tag 0x00000000
Memory policy: ECC disabled, Data cache writeback
map io
MPCORE found at 19020000 (VIRT d9020000) 18000000 d8000000
On node 0 totalpages: 16384
free_area_init_node: node 0, pgdat c032fa08, node_mem_map c03b5000
  Normal zone: 128 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 16384 pages, LIFO batch:3
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 panic=10 root=/dev/mtdblock3 rootfstype=squashfs,jffs2 noinitrd init=/bin/sh
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 61124k/61124k available, 4412k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xc4800000 - 0xff000000   ( 936 MB)
    lowmem  : 0xc0000000 - 0xc4000000   (  64 MB)
    pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
    modules : 0xbf000000 - 0xbfe00000   (  14 MB)
      .text : 0xc0008000 - 0xc02eeda4   (2972 kB)
      .init : 0xc02ef000 - 0xc031e3d4   ( 189 kB)
      .data : 0xc0320000 - 0xc035736c   ( 221 kB)
       .bss : 0xc035736c - 0xc03b453c   ( 373 kB)
NR_IRQS:256
MPCORE GIC init
External imprecise Data abort at addr=0x0, fsr=0x1c06 ignored.
MPCORE Global Timer Clock 400000000Hz on IRQ 27
sched_clock: 32 bits at 400MHz, resolution 2ns, wraps every 10737ms
Calibrating delay loop... 795.44 BogoMIPS (lpj=3977216)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0xc0010dd0 - 0xc0010e04
L310: cache controller enabled 16 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x7a130000
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Found a ST compatible (Marconix) serial flash with 256 64KB blocks; total size 16MB
found cfe nvram on sflash
CCA UART Clock Config: Sel=1 Ovr=1 Div=48
CCA UART Clock rate 100000000Hz
bio: create slab <bio-0> at 0
Switching to clocksource mpcore_gtimer
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
PCI: CLS 0 bytes, default 64
init gpio code
PCI: no core
PCI: no core
PCI: scanning bus 0
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [io  0x0000-0xffffffff]
pci_bus 0000:00: root bus resource [mem 0x00000000-0xffffffff]
pci_bus 0000:00: root bus resource [bus 00-ff]
pci 0000:00:00.0: [14e4:0800] type 00 class 0x050100
pci 0000:00:00.0: reg 10: [mem 0x18000000-0x18000fff]
pci 0000:00:00.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:01.0: [14e4:050b] type 00 class 0xffffff
pci 0000:00:01.0: reg 10: [mem 0x18001000-0x18001fff]
pci 0000:00:01.0: reg 14: [mem 0x18002000-0x18002fff]
pci 0000:00:01.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:02.0: [14e4:0502] type 00 class 0xffffff
pci 0000:00:02.0: reg 10: [mem 0x1802c000-0x1802cfff]
pci 0000:00:02.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:03.0: [14e4:4715] type 00 class 0x020000
pci 0000:00:03.0: reg 10: [mem 0x18024000-0x18024fff]
pci 0000:00:03.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:04.0: [14e4:4715] type 00 class 0x020000
pci 0000:00:04.0: reg 10: [mem 0x18025000-0x18025fff]
pci 0000:00:04.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:05.0: [14e4:4715] type 00 class 0x020000
pci 0000:00:05.0: reg 10: [mem 0x18026000-0x18026fff]
pci 0000:00:05.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:06.0: [14e4:4715] type 00 class 0x020000
pci 0000:00:06.0: reg 10: [mem 0x18027000-0x18027fff]
pci 0000:00:06.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:07.0: [14e4:0501] type 00 class 0xffffff
pci 0000:00:07.0: reg 10: [mem 0x18012000-0x18012fff]
pci 0000:00:07.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:08.0: [14e4:0501] type 00 class 0xffffff
pci 0000:00:08.0: reg 10: [mem 0x18013000-0x18013fff]
pci 0000:00:08.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:09.0: [14e4:0510] type 00 class 0xffffff
pci 0000:00:09.0: reg 10: [mem 0x1800b000-0x1800bfff]
pci 0000:00:09.0: reg 14: [mem 0x1800c000-0x1800cfff]
pci 0000:00:09.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:0a.0: [14e4:471a] type 00 class 0x0c0310
pci 0000:00:0a.0: reg 10: [mem 0x18022000-0x18022fff]
pci 0000:00:0a.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:0a.1: [14e4:471a] type 00 class 0x0c0320
pci 0000:00:0a.1: reg 10: [mem 0x18021000-0x18021fff]
pci 0000:00:0a.1: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:0b.0: [14e4:472a] type 00 class 0x0c0330
pci 0000:00:0b.0: reg 10: [mem 0x18023000-0x18023fff]
pci 0000:00:0b.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:0c.0: [14e4:0503] type 00 class 0xffffff
pci 0000:00:0c.0: reg 10: [mem 0x18020000-0x18020fff]
pci 0000:00:0c.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:0d.0: [14e4:0506] type 00 class 0xffffff
pci 0000:00:0d.0: reg 10: [mem 0x18210000-0x1821ffff]
pci 0000:00:0d.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:0e.0: [14e4:0507] type 00 class 0xffffff
pci 0000:00:0e.0: reg 10: [mem 0x18010000-0x18010fff]
pci 0000:00:0e.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:0f.0: [14e4:0508] type 00 class 0xffffff
pci 0000:00:0f.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:10.0: [14e4:0509] type 00 class 0xffffff
pci 0000:00:10.0: reg 10: [mem 0x18028000-0x18028fff]
pci 0000:00:10.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:11.0: [14e4:050a] type 00 class 0xffffff
pci 0000:00:11.0: reg 10: [mem 0x18029000-0x18029fff]
pci 0000:00:11.0: reg 30: [mem 0x00000000-0x000007ff pref]
PCI: Fixing up bus 0
PCIE1 link=1
PCIE1 switching to GEN2
PCIE1 link=1
PCI host bridge to bus 0001:00
pci_bus 0001:00: root bus resource [mem 0x08000000-0x0fffffff]
pci_bus 0001:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0001:00:00.0: [14e4:8011] type 01 class 0x060400
pci 0001:00:00.0: PME# supported from D0 D3hot D3cold
PCI: Fixing up bus 0
PCI: bus0: Fast back to back transfers disabled
pci 0001:01:00.0: [14e4:a8db] type 00 class 0x028000
pci 0001:01:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit]
pci 0001:01:00.0: supports D1 D2
PCI: Fixing up bus 1
PCI: bus1: Fast back to back transfers disabled
pci_bus 0001:01: busn_res: [bus 01-ff] end is updated to 01
pci_bus 0001:00: busn_res: [bus 00-ff] end is updated to 01
pci 0001:00:00.0: BAR 8: assigned [mem 0x08000000-0x080fffff]
pci 0001:01:00.0: BAR 0: assigned [mem 0x08000000-0x08007fff 64bit]
pci 0001:00:00.0: PCI bridge to [bus 01]
pci 0001:00:00.0:   bridge window [mem 0x08000000-0x080fffff]
PCIE2 link=1
PCIE2 switching to GEN2
PCIE2 link=1
PCI host bridge to bus 0002:00
pci_bus 0002:00: root bus resource [mem 0x40000000-0x47ffffff]
pci_bus 0002:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0002:00:00.0: [14e4:8011] type 01 class 0x060400
pci 0002:00:00.0: PME# supported from D0 D3hot D3cold
PCI: Fixing up bus 0
PCI: bus0: Fast back to back transfers disabled
pci 0002:02:00.0: [14e4:4360] type 00 class 0x028000
pci 0002:02:00.0: reg 10: [mem 0x40000000-0x40007fff 64bit]
pci 0002:02:00.0: supports D1 D2
PCI: Fixing up bus 2
PCI: bus2: Fast back to back transfers disabled
pci_bus 0002:02: busn_res: [bus 02-ff] end is updated to 02
pci_bus 0002:00: busn_res: [bus 00-ff] end is updated to 02
pci 0002:00:00.0: BAR 8: assigned [mem 0x40000000-0x400fffff]
pci 0002:02:00.0: BAR 0: assigned [mem 0x40000000-0x40007fff 64bit]
pci 0002:00:00.0: PCI bridge to [bus 02]
pci 0002:00:00.0:   bridge window [mem 0x40000000-0x400fffff]
PCIE3 link=0
Error creating gpio class
squashfs: version 3.0 (2006/03/15) Phillip Lougher
msgmni has been set to 119
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x18000300 (irq = 117) is a 16550
console [ttyS0] enabled
serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
brd: module loaded
loop: module loaded
bcmsflash: squash filesystem found at block 24
Creating 6 MTD partitions on "bcmsflash":
0x000000000000-0x000000040000 : "boot"
0x000000040000-0x0000007f0000 : "linux"
0x000000180000-0x000000790000 : "rootfs"
0x000000790000-0x0000007f0000 : "ddwrt"
0x0000007f0000-0x000000800000 : "nvram_cfe"
0x0000007e0000-0x0000007f0000 : "nvram"
nflash: found no supported devices
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
GACT probability NOT on
Mirror/redirect action on
Failed to load ipt action
Simple TC action Loaded
netem: version 1.3
u32 classifier
    Performance counters on
    input device check on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (955 buckets, 3820 max)
nf_conntrack_rtsp v0.6.21 loading
xt_time: kernel timezone is -0000
ip_set: protocol 6
gre: GRE over IPv4 demultiplexor driver
nf_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: bic registered
TCP: cubic registered
TCP: westwood registered
TCP: highspeed registered
TCP: hybla registered
TCP: htcp registered
TCP: vegas registered
TCP: veno registered
TCP: scalable registered
TCP: lp registered
TCP: yeah registered
TCP: illinois registered
NET: Registered protocol family 17
Bridge firewalling registered
8021q: 802.1Q VLAN Support v1.8
found cfe nvram
check if nvram copy is required CFE Size is 65536
nvram copy magic is FFFFFFFF
copy cfe nvram to base nvram
remap nvram 17284
Key type encrypted registered
Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012
brcmnand: found no supported devices
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 188K (c02ef000 - c031e000)
softdog: Software Watchdog Timer: 0.08 initialized.
soft_noboot=0 soft_margin=60 sec soft_panic=0 (nowayout=1)
et: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
et_module_init: passivemode set to 0x0
et_module_init: txworkq set to 0x0
et_module_init: et_txq_thresh set to 0x400
et0: online cpus 1
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.86 (r456083)
roboswitch: Probing device 'eth0'
roboswitch: trying a 53011! at eth0
roboswitch: found a 53011! at eth0
PCI: Enabling device 0001:01:00.0 (0140 -> 0142)
eth0: mixed HW and IP checksum settings.
device br0 entered promiscuous mode
device vlan1 entered promiscuous mode
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
device eth2 entered promiscuous mode
br0: port 3(eth2) entered forwarding state
br0: port 3(eth2) entered forwarding state
br0: port 2(eth1) entered forwarding state
br0: port 2(eth1) entered forwarding state
br0: port 1(vlan1) entered forwarding state
br0: port 1(vlan1) entered forwarding state
device br0 left promiscuous mode
device br0 entered promiscuous mode
device br0 left promiscuous mode
device vlan2 entered promiscuous mode
device vlan2 left promiscuous mode
br0: port 3(eth2) entered forwarding state
br0: port 2(eth1) entered forwarding state
br0: port 1(vlan1) entered forwarding state

Everything else

nmap scan

nmap 192.168.10.1 -p 1-65535

Starting Nmap 6.40 ( http://nmap.org ) at 2014-09-18 23:12 EDT
Nmap scan report for 192.168.10.1
Host is up (0.0025s latency).
Not shown: 65530 closed ports
PORT      STATE SERVICE
53/tcp    open  domain
1980/tcp  open  unknown
1990/tcp  open  stun-p1
20005/tcp open  btx
33344/tcp open  unknown


Retrieved from "https://wikidevi.wi-cat.ru/index.php?title=TRENDnet_TEW-811DRU&oldid=297967"