ZyXEL NBG5715

From WikiDevi.Wi-Cat.RU
Jump to navigation Jump to search

ZyXEL NBG5715

Manuf (OEM/ODM): MitraStar

FCC approval date: 16 September 2011
(Est.) release date: 10 August 2011
UPC: 760559119652 (UPC DB, On eBay)
Country of manuf.: Taiwan

Amazon image

ASIN
B005GRFC82 (Flag of the United States.svg, On Amazon, On CCC)

Type: wireless router

FCC ID: I88NBG5715
PCB ID: 45-402-000341

Power: 12 VDC, 2 A
Connector type: barrel

CPU1: Mindspeed Comcerto 1000 (450 MHz, 2 cores)
CPU2: Ralink RT3883 (500 MHz)
FLA1: 128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (Samsung K9F1G08U0C-PCB0)
RAM1: 128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (Nanya NT5TU32M16CG-25C × 2)
RAM2: 64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (Nanya NT5TU32M16CG-25C)

Expansion IFs: USB 2.0
USB ports: 2

WI1 chip1: Ralink RT3883
WI1 802dot11 protocols: an
WI1 MIMO config: 3x3:3
WI1 antenna connector: U.FL, RP-SMA
WI2 chip1: Ralink RT3593
WI2 802dot11 protocols: bgn
WI2 MIMO config: 3x3:3
WI2 antenna connector: U.FL, RP-SMA

ETH chip1: Mindspeed Comcerto 1000
Switch: Atheros AR8328
LAN speed: 1G
LAN ports: 4
WAN speed: 1G
WAN ports: 1

abgn

Additional chips
5GHz Power Amplifier IC;Skyworks;SE2567L;SiGe, 2567L, 111ES;3;
4-port USB Hub Controller;Genesys Logic;GL850G;;1;

Stock FW OS: Linux 2.6.33.5 OpenWrt-deriv

Default SSID: ZyXEL (19 addl. devices)
Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1304 additional devices
of which 96 are ZyXEL devices
Default login user: blank
Default login password: 1234
blank:1234 credentials used by 48 additional devices
of which 46 are ZyXEL devices

802dot11 OUI: C8:6C:87 (2 E, 2 W)
Ethernet OUI: C8:6C:87 (2 E, 2 W)

For a list of all currently documented Mindspeed SoC's with specifications, see Mindspeed.
For a list of all currently documented Ralink chipsets with specifications, see Ralink.


Simultaneous Dual-Band Wireless N Media Router

Product Page
Datasheet  • Manual
Downloads : FW v.1.00(AAAG.5)C0

The Mindspeed Comcerto 1000 (M83241G-13) CPU is the main SoC for device.

The RT3883 is apparently controlled via an MII interface (it's in iNIC mode).
The RT3593 appears to be controlled via the Comcerto's PCI bus.

The firmware provided by ZyXEL is ~14.5MB.

The stock firmware is an OpenWrt-dervative firmware.
The stock WebUI is a modified LuCI.

"45-402-000341" is silkscreened on the board shown below.

The default SSID for both bands is ZyXEL.

The power adapter included with the device is a

DVE DSA-24CA-12 120200 (12V, 2A).

Additional external links

NBG5715_100AAAG2_open_code.tar.bz2 (04-May-2012 19:44 759M)

Serial

Telnet would seem to be enabled by default.

Credentials of root:1234 for a router w/ default settings worked fine..

cpuinfo

 • cat /proc/cpuinfo
root@NBG5715:~# cat /proc/cpuinfo
Processor       : ARMv6-compatible processor rev 5 (v6l)
BogoMIPS        : 448.92
Features        : swp half thumb fastmult edsp java 
CPU implementer : 0x41
CPU architecture: 6TEJ
CPU variant     : 0x1
CPU part        : 0xb36
CPU revision    : 5

Hardware        : Comcerto 1000 (EVM)
Revision        : 0000
Serial          : 0000000000000000
 • cat /proc/version
root@NBG5715:/proc# cat /proc/version
Linux version 2.6.33.5 (darren@ubuntu) (gcc version 3.4.6 (OpenWrt-2.0)) #1 Tue May 7 12:29:00 CST 2013

dmesg

 • full output
isable mode
tdi_reset: set Streaming disable mode
comcerto-ehci comcerto-ehci.1: comcerto EHCI
comcerto-ehci comcerto-ehci.1: new USB bus registered, assigned bus number 1
comcerto-ehci comcerto-ehci.1: irq 5, io mem 0x0f000000
tdi_reset: set Streaming disable mode
comcerto-ehci comcerto-ehci.1: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: comcerto EHCI
usb usb1: Manufacturer: Linux 2.6.33.5 ehci_hcd
usb usb1: SerialNumber: comcerto-ehci.1
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
SPI core: add driver si3050
si3050_attach_adapter client c726ac00 si3050 c726ac00
SPI core: attach client to adapter comcerto-spi
si3050_device_probe(0xc726ac00)
si3050: resetting device 0
si3050: resetting device 0 value of reg IM 0 Error
si3050_device_probe  client c726ac00, max_pots 0
usb 1-1: new high speed USB device using comcerto-ehci and address 2
usb 1-1: New USB device found, idVendor=05e3, idProduct=0608
usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
usb 1-1: Product: USB2.0 Hub
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
register rt2860
PCI: enabling device 0000:00:00.0 (0140 -> 0142)
PCI: Setting latency timer of device 0000:00:00.0 to 64

=== pAd = c82f2000, size = 666896 ===

 RTMPAllocTxRxRingMemory, Status=0
 RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xc82e0000, csr_addr=0xc82e0000!
(Reassign Efuse for 3x7x/3x9x/53xx) Size=0x3c [3c0-3fb] 
i2c /dev entries driver
 GPL NetUSB up!
kc   88 : run_telnetDBGDServer start 
kc  225 : init_DebugD end
INFO1428: NetUSB 1.100, 00020621 
INFO142A: AUTH  ISOC IOCTL  
INFO142B:   
usbcore: registered new interface driver KC NetUSB General Driver
INFO1469:  node NetUSB_Access :major 62, minor 0 
INFO0076:  init proc : PAGE_SIZE 4096
INFO139C:  sleep to wait lan to wake up
INFO02BF:  use dev Name lan 
INFO13A5:  sleep to wait lan end.
INFO13BE:  UDP_BROAD 7417 tcpPort:20005 
INFO02BF:  use dev Name lan 
INFO12F5: tcpConnector() started...
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
input: gpio-buttons as /devices/platform/gpio-buttons/input/input0
comcerto_i2c_init: module loaded
i2c:m24_init
Button Hotplug driver version 0.4.1
warning: `dnsmasq' uses 32-bit capabilities (legacy support in use)
INFO11D5: Bind to lan
RX DESC ffc33000  size = 2048
lan: no IPv6 routers present
RTMP_TimerListAdd: add timer obj c835b4f4!
RTMP_TimerListAdd: add timer obj c82fa348!
RTMP_TimerListAdd: add timer obj c82f9f44!
RTMP_TimerListAdd: add timer obj c82fa31c!
RTMP_TimerListAdd: add timer obj c82fa69c!
RTMP_TimerListAdd: add timer obj c82fa400!
RTMP_TimerListAdd: add timer obj c82fa42c!
RTMP_TimerListAdd: add timer obj c82fa5e8!
RTMP_TimerListAdd: add timer obj c82fa614!
RTMP_TimerListAdd: add timer obj c82fa640!
RTMP_TimerListAdd: add timer obj c82fd53c!
RTMP_TimerListAdd: add timer obj c82fd138!
RTMP_TimerListAdd: add timer obj c82fd510!
RTMP_TimerListAdd: add timer obj c82fd890!
RTMP_TimerListAdd: add timer obj c82fd5f4!
RTMP_TimerListAdd: add timer obj c82fd620!
RTMP_TimerListAdd: add timer obj c82fd7dc!
RTMP_TimerListAdd: add timer obj c82fd808!
RTMP_TimerListAdd: add timer obj c82fd834!
RTMP_TimerListAdd: add timer obj c8300730!
RTMP_TimerListAdd: add timer obj c830032c!
RTMP_TimerListAdd: add timer obj c8300704!
RTMP_TimerListAdd: add timer obj c8300a84!
RTMP_TimerListAdd: add timer obj c83007e8!
RTMP_TimerListAdd: add timer obj c8300814!
RTMP_TimerListAdd: add timer obj c83009d0!
RTMP_TimerListAdd: add timer obj c83009fc!
RTMP_TimerListAdd: add timer obj c8300a28!
RTMP_TimerListAdd: add timer obj c8303924!
RTMP_TimerListAdd: add timer obj c8303520!
RTMP_TimerListAdd: add timer obj c83038f8!
RTMP_TimerListAdd: add timer obj c8303c78!
RTMP_TimerListAdd: add timer obj c83039dc!
RTMP_TimerListAdd: add timer obj c8303a08!
RTMP_TimerListAdd: add timer obj c8303bc4!
RTMP_TimerListAdd: add timer obj c8303bf0!
RTMP_TimerListAdd: add timer obj c8303c1c!
RTMP_TimerListAdd: add timer obj c8306b18!
RTMP_TimerListAdd: add timer obj c8306714!
RTMP_TimerListAdd: add timer obj c8306aec!
RTMP_TimerListAdd: add timer obj c8306e6c!
RTMP_TimerListAdd: add timer obj c8306bd0!
RTMP_TimerListAdd: add timer obj c8306bfc!
RTMP_TimerListAdd: add timer obj c8306db8!
RTMP_TimerListAdd: add timer obj c8306de4!
RTMP_TimerListAdd: add timer obj c8306e10!
RTMP_TimerListAdd: add timer obj c8309d0c!
RTMP_TimerListAdd: add timer obj c8309908!
RTMP_TimerListAdd: add timer obj c8309ce0!
RTMP_TimerListAdd: add timer obj c830a060!
RTMP_TimerListAdd: add timer obj c8309dc4!
RTMP_TimerListAdd: add timer obj c8309df0!
RTMP_TimerListAdd: add timer obj c8309fac!
RTMP_TimerListAdd: add timer obj c8309fd8!
RTMP_TimerListAdd: add timer obj c830a004!
RTMP_TimerListAdd: add timer obj c830cf00!
RTMP_TimerListAdd: add timer obj c830cafc!
RTMP_TimerListAdd: add timer obj c830ced4!
RTMP_TimerListAdd: add timer obj c830d254!
RTMP_TimerListAdd: add timer obj c830cfb8!
RTMP_TimerListAdd: add timer obj c830cfe4!
RTMP_TimerListAdd: add timer obj c830d1a0!
RTMP_TimerListAdd: add timer obj c830d1cc!
RTMP_TimerListAdd: add timer obj c830d1f8!
RTMP_TimerListAdd: add timer obj c83100f4!
RTMP_TimerListAdd: add timer obj c830fcf0!
RTMP_TimerListAdd: add timer obj c83100c8!
RTMP_TimerListAdd: add timer obj c8310448!
RTMP_TimerListAdd: add timer obj c83101ac!
RTMP_TimerListAdd: add timer obj c83101d8!
RTMP_TimerListAdd: add timer obj c8310394!
RTMP_TimerListAdd: add timer obj c83103c0!
RTMP_TimerListAdd: add timer obj c83103ec!
RTMP_TimerListAdd: add timer obj c83132e8!
RTMP_TimerListAdd: add timer obj c8312ee4!
RTMP_TimerListAdd: add timer obj c83132bc!
RTMP_TimerListAdd: add timer obj c831363c!
RTMP_TimerListAdd: add timer obj c83133a0!
RTMP_TimerListAdd: add timer obj c83133cc!
RTMP_TimerListAdd: add timer obj c8313588!
RTMP_TimerListAdd: add timer obj c83135b4!
RTMP_TimerListAdd: add timer obj c83135e0!
RTMP_TimerListAdd: add timer obj c83164dc!
RTMP_TimerListAdd: add timer obj c83160d8!
RTMP_TimerListAdd: add timer obj c83164b0!
RTMP_TimerListAdd: add timer obj c8316830!
RTMP_TimerListAdd: add timer obj c8316594!
RTMP_TimerListAdd: add timer obj c83165c0!
RTMP_TimerListAdd: add timer obj c831677c!
RTMP_TimerListAdd: add timer obj c83167a8!
RTMP_TimerListAdd: add timer obj c83167d4!
RTMP_TimerListAdd: add timer obj c83196d0!
RTMP_TimerListAdd: add timer obj c83192cc!
RTMP_TimerListAdd: add timer obj c83196a4!
RTMP_TimerListAdd: add timer obj c8319a24!
RTMP_TimerListAdd: add timer obj c8319788!
RTMP_TimerListAdd: add timer obj c83197b4!
RTMP_TimerListAdd: add timer obj c8319970!
RTMP_TimerListAdd: add timer obj c831999c!
RTMP_TimerListAdd: add timer obj c83199c8!
RTMP_TimerListAdd: add timer obj c831c8c4!
RTMP_TimerListAdd: add timer obj c831c4c0!
RTMP_TimerListAdd: add timer obj c831c898!
RTMP_TimerListAdd: add timer obj c831cc18!
RTMP_TimerListAdd: add timer obj c831c97c!
RTMP_TimerListAdd: add timer obj c831c9a8!
RTMP_TimerListAdd: add timer obj c831cb64!
RTMP_TimerListAdd: add timer obj c831cb90!
RTMP_TimerListAdd: add timer obj c831cbbc!
RTMP_TimerListAdd: add timer obj c831fab8!
RTMP_TimerListAdd: add timer obj c831f6b4!
RTMP_TimerListAdd: add timer obj c831fa8c!
RTMP_TimerListAdd: add timer obj c831fe0c!
RTMP_TimerListAdd: add timer obj c831fb70!
RTMP_TimerListAdd: add timer obj c831fb9c!
RTMP_TimerListAdd: add timer obj c831fd58!
RTMP_TimerListAdd: add timer obj c831fd84!
RTMP_TimerListAdd: add timer obj c831fdb0!
RTMP_TimerListAdd: add timer obj c8322cac!
RTMP_TimerListAdd: add timer obj c83228a8!
RTMP_TimerListAdd: add timer obj c8322c80!
RTMP_TimerListAdd: add timer obj c8323000!
RTMP_TimerListAdd: add timer obj c8322d64!
RTMP_TimerListAdd: add timer obj c8322d90!
RTMP_TimerListAdd: add timer obj c8322f4c!
RTMP_TimerListAdd: add timer obj c8322f78!
RTMP_TimerListAdd: add timer obj c8322fa4!
RTMP_TimerListAdd: add timer obj c8325ea0!
RTMP_TimerListAdd: add timer obj c8325a9c!
RTMP_TimerListAdd: add timer obj c8325e74!
RTMP_TimerListAdd: add timer obj c83261f4!
RTMP_TimerListAdd: add timer obj c8325f58!
RTMP_TimerListAdd: add timer obj c8325f84!
RTMP_TimerListAdd: add timer obj c8326140!
RTMP_TimerListAdd: add timer obj c832616c!
RTMP_TimerListAdd: add timer obj c8326198!
RTMP_TimerListAdd: add timer obj c8329094!
RTMP_TimerListAdd: add timer obj c8328c90!
RTMP_TimerListAdd: add timer obj c8329068!
RTMP_TimerListAdd: add timer obj c83293e8!
RTMP_TimerListAdd: add timer obj c832914c!
RTMP_TimerListAdd: add timer obj c8329178!
RTMP_TimerListAdd: add timer obj c8329334!
RTMP_TimerListAdd: add timer obj c8329360!
RTMP_TimerListAdd: add timer obj c832938c!
RTMP_TimerListAdd: add timer obj c8331e80!
RTMP_TimerListAdd: add timer obj c8331f84!
RTMP_TimerListAdd: add timer obj c8331ea8!
RTMP_TimerListAdd: add timer obj c8329708!
RTMP_TimerListAdd: add timer obj c82f7834!
RTMP_TimerListAdd: add timer obj c82faa28!
RTMP_TimerListAdd: add timer obj c82fdc1c!
RTMP_TimerListAdd: add timer obj c8300e10!
RTMP_TimerListAdd: add timer obj c8304004!
RTMP_TimerListAdd: add timer obj c83071f8!
RTMP_TimerListAdd: add timer obj c830a3ec!
RTMP_TimerListAdd: add timer obj c830d5e0!
RTMP_TimerListAdd: add timer obj c83107d4!
RTMP_TimerListAdd: add timer obj c83139c8!
RTMP_TimerListAdd: add timer obj c8316bbc!
RTMP_TimerListAdd: add timer obj c8319db0!
RTMP_TimerListAdd: add timer obj c831cfa4!
RTMP_TimerListAdd: add timer obj c8320198!
RTMP_TimerListAdd: add timer obj c832338c!
RTMP_TimerListAdd: add timer obj c8326580!
RTMP_TimerListAdd: add timer obj c8329428!
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
EntryLifeCheck=15
1. Phy Mode = 9
2. Phy Mode = 9
NVM is Efuse and its size =3c[3c0-3fb] 
3. Phy Mode = 9
AntCfgInit: primary/secondary ant 0/1
MCS Set = ff ff ff 00 01
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
RTMP_TimerListAdd: add timer obj c83299e4!
Main bssid = ca:6c:87:35:8b:08
== rt28xx_init, Status=0
0x1300 = 00064320
device ra0 entered promiscuous mode
lan: port 2(ra0) entering forwarding state
MTD_open
MTD_ioctl
MTD_ioctl
MTD_read
MTD_close
MTD_open
MTD_ioctl
MTD_ioctl
MTD_read
MTD_close
eth2: no IPv6 routers present
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
MTD_open
MTD_ioctl
MTD_ioctl
MTD_read
MTD_close

RT3883iNIC: 802.11n WLAN MII driver v2.4.0.6 (Feb. 09, 2011)
Update MAC(0)=ca:6c:87:35:8b:0c

============= Init Thread ===================
RacfgTaskThread pid = 5176
RacfgBacklogThread pid = 5177
Org bridge hook = c02a425c
Change bridge hook = bf32fd88
rai0: Ralink iNIC at 0x0, ca:6c:87:35:8b:0c
MTD_open
MTD_ioctl
MTD_ioctl
MTD_read
MTD_close
iNIC Open rai0
Op mode = 1
BssidNum=4
rlk_inic_mbss_init --->
Register MBSSID IF (rai1)
Register MBSSID IF (rai2)
Register MBSSID IF (rai3)
rlk_inic_mbss_init <---
Wait for boot done...
RACFG_CMD_BOOT_NOTIFY
Open file: /tmp/iNIC_ap.bin
Open file: /tmp/iNIC_ap.dat
RACFG_CMD_BOOT_INITCFG(0)
RACFG_CMD_BOOT_INITCFG(0)
RACFG_CMD_BOOT_INITCFG(1)
RACFG_CMD_BOOT_INITCFG(2)
Send Init Cfg Data Done(3 packets)
RACFG_CMD_BOOT_UPLOAD(0)
RACFG_CMD_BOOT_UPLOAD(1)
RACFG_CMD_BOOT_UPLOAD(2)

CRC:01 08 14 18 72 11 a4 aa 22 32 2e 35 2e 30 2e 34 22 00 00 00
32 30 31 32 31 31 32 32 00 00 00 00 00 00 00 00 a4 6e 08 00 

Send RT3883iNIC Firmware Done
===================================
version: "2.5.0.4"
size:    552612 bytes
date:    20121122
===================================

Send STARTUP to RT3883iNIC
Close Firmware file
RACFG_CMD_BOOT_STARTUP
ra0: no IPv6 routers present
Update MAC(0)=ca:6c:87:35:8b:0c
Update MAC(1)=ca:6c:87:35:8b:0d
Update MAC(2)=ca:6c:87:35:8b:0e
Update MAC(3)=ca:6c:87:35:8b:0f
Warning! MAC addr not equal to MII master =>
set MiiMasterMac=c8:6c:87:35:8b:0f
You've assigned a different MAC.
device rai0 entered promiscuous mode
lan: port 3(rai0) entering forwarding state
MTD_open
MTD_ioctl
MTD_ioctl
MTD_read
MTD_close
MTD_open
MTD_ioctl
MTD_ioctl
MTD_read
MTD_close
ip6t_ah: Unknown symbol ipv6_find_hdr
ip6table_filter: Unknown symbol ip6t_unregister_table
ip6table_filter: Unknown symbol ip6t_register_table
ip6table_filter: Unknown symbol ip6t_do_table
ip6table_mangle: Unknown symbol ip6t_unregister_table
ip6table_mangle: Unknown symbol ip6t_register_table
ip6table_mangle: Unknown symbol ip6t_do_table
ip6table_raw: Unknown symbol ip6t_unregister_table
ip6table_raw: Unknown symbol ip6t_register_table
ip6table_raw: Unknown symbol ip6t_do_table
NET: Registered protocol family 27
ip_tables: (C) 2000-2006 Netfilter Core Team
ip6_tables: (C) 2000-2006 Netfilter Core Team
comcerto_fpp_module_init
comcerto_fpp_probe
fpp fpp: firmware: requesting fpp.axf
FPP is running $Version: fpp_7_00_5_1 $
vwd_init: created vwd device(252, 0)
vwd_driver_init: start
vwd_up: start
vwd_init_buffers: txQ : c0434000:86474000
vwd_init_buffers: expt rxQ : c0434800:86474800
vwd_up: start1
vwd_driver_init: end
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1835 buckets, 7340 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon.Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
ctnetlink v0.93: registering with nfnetlink.
vwd_open :  minor device -> 0
vwd_ioctl: start
vwd_handle_vap function called 0: ra0
vwd_handle_vap:ADD: name:ra0, vapid:0 ifindex:9 mac:c8:6c:87:35:8b:f
vwd_close 
rai0: no IPv6 routers present
c1k_set_fast_path_enable 1
eth0: c1k_eth_close
c1k_eth_open: eth0
Disabling GEM1 delay
comcerto gemac1 software config using RGMII
PHY start: 0:04
c1k_set_fast_path_enable 1
eth2: c1k_eth_close
c1k_eth_open: eth2
Disabling GEM0 delay
comcerto gemac0 software config using RGMII
vwd_proc_write_fast_path: Wifi fast path enabled 
c1k_show_fast_path_enable
comcerto_cap_init
comcerto_cap_driver_init: start
comcerto_cap_register_capdev:
comcerto_cap_register_capdev:

Other

 • lsmod
root@NBG5715:~# lsmod
Module                  Size  Used by    Tainted: P  
comcerto_cap            3969  0 
xt_webstr               2904  0 
xt_string                864  0 
ipt_REJECT              1568  0 
qoscom                 36844  0 
xt_CONNMARK              844  0 
nf_conntrack_netlink    13620  0 
nf_nat                 11272  0 
nf_conntrack_ipv6       8787  0 
nf_conntrack_ipv4       8210  2 nf_nat
nf_conntrack           44963  5 xt_CONNMARK,nf_conntrack_netlink,nf_nat,nf_conntrack_ipv6,nf_conntrack_ipv4
nf_defrag_ipv4           658  1 nf_conntrack_ipv4
nfnetlink               1807  3 nf_conntrack_netlink
comcerto_vwd            9954  0 
fci                     3172  5 
comcerto_fpp            6663  5 comcerto_cap,comcerto_vwd,fci
xt_tcpudp               1840  4 
iptable_filter           852  1 
ip6_tables              9703  0 
ip_tables               9277  1 iptable_filter
csmencaps              15027  0 
ip6t_mh                  704  0 
ip6t_eui64               724  0 
ip6t_REJECT             2016  0 
rt3883_iNIC            55569  0 
xt_MARK                  500  0 
x_tables                9126  11 xt_webstr,xt_string,ipt_REJECT,xt_CONNMARK,xt_tcpudp,
ip6_tables,ip_tables,ip6t_mh,ip6t_eui64,ip6t_REJECT,xt_MARK
cls_fw                  3020  0 
sch_htb                11700  0 
button_hotplug          2600  0 
st_m24_eeprom           2116  0 
i2c_comcerto            5012  0 
gpio_buttons            1940  0 
input_polldev           2080  1 gpio_buttons
usb_storage            33111  0 
NetUSB                159211  0 
GPL_NetUSB              2543  1 NetUSB
i2c_dev                 3896  0 
i2c_core               13218  3 st_m24_eeprom,i2c_comcerto,i2c_dev
rt3593ap             1206647  1 
input_core             17756  4 button_hotplug,gpio_buttons,input_polldev
si3050                  6396  0 
ahci                   27636  0 
ehci_hcd               29161  0 
sd_mod                 22828  0 
pwrmgmt                 2372  0 
tun                     9204  0 
ppp_async               5600  0 
ppp_generic            18093  1 ppp_async
slhc                    4287  1 ppp_generic
vfat                    7524  0 
fat                    41509  1 vfat
ext3                   86606  0 
jbd                    34011  1 ext3
ext2                   47428  0 
nls_iso8859_15          3368  0 
nls_iso8859_1           2856  0 
nls_cp437               4388  0 
libata                117229  1 ahci
scsi_mod               65287  3 usb_storage,sd_mod,libata
mbcache                 4148  1 ext2
crc_ccitt                967  1 ppp_async
m83xxx_elp             76634  0 
cryptosoft             11836  0 
cryptodev              10744  0 
ocf                    20927  3 m83xxx_elp,cryptosoft,cryptodev
ecb                     1204  0
 • ps aux
root@NBG5715:~# ps aux
  PID  Uid     VmSize Stat Command
    1 root        368 S   init       
    2 root            SW  [kthreadd]
    3 root            SW  [ksoftirqd/0]
    4 root            SW  [watchdog/0]
    5 root            SW  [events/0]
    6 root            SW  [cpuset]
    7 root            SW  [khelper]
   10 root            SW  [async/mgr]
   89 root            SW  [sync_supers]
   91 root            SW  [bdi-default]
   93 root            SW  [kblockd/0]
   98 root            SW  [ksuspend_usbd]
  103 root            SW  [khubd]
  119 root            SW  [rpciod/0]
  128 root            SW  [khungtaskd]
  129 root            SW  [kswapd0]
  130 root            SW  [aio/0]
  131 root            SW  [nfsiod]
  132 root            SW  [crypto/0]
  209 root            SW  [mtdblockd]
  259 root            SW  [kondemand/0]
  260 root            SW  [kconservative/0]
  276 root            SWN [jffs2_gcd_mtd6]
  596 root            SWN [jffs2_gcd_mtd2]
  674 root        384 S   logger -s -p 6 -t  
  675 root        220 S   init       
  827 root        288 S   klogd -c1 
  931 root        232 S   /sbin/hotplug2 --persistent --max-children 1 
 1623 root        404 S   udhcpc -t 0 -i eth0 -H NBG5715 -b -p /var/run/eth0.pi
 2816 root            SW  [crypto]
 2817 root            SW  [crypto_ret]
 3164 root            SW  [ata/0]
 3194 root            SW  [ata_aux]
 3577 root            SW  [ telnetDBGD ]
 3584 root            SW  [ acktelnetDBGD ]
 3586 root            DW  [NU INITSOCK]
 3588 root            SW  [NU UDP]
 3590 root            SW  [NU TCP]
 3620 root            SW  [ipolldevd]
 3631 root        352 S   syslogd -C128 
 3652 root        288 S   klogd 
 3760 nobody      356 S   dnsmasq -z -i lan -K -F 192.168.1.33,192.168.1.64,255
 3925 root        336 S   watch -tn 1 wps_conf_24G 
 4047 root        336 S   watch -tn 1 wps_conf_5G 
 4382 root            SW  [RtmpCmdQTask]
 4385 root            SW  [RtmpWscTask]
 4403 root        296 S   /usr/sbin/miniupnpd -f /tmp/miniupnpd.conf 
 5176 root            SW  [RaCfg Task]
 5177 root            SW  [RaCfg Backlog]
 6205 root        312 S   /usr/sbin/dropbear -p 22 
 6213 root        276 S   /sbin/lld2d lan 
 6322 root        264 S   telnetd -l /bin/login -p 23 
 6458 root        368 S   /usr/sbin/uhttpd -f -h /www -r NBG5715 -x /cgi-bin -t
 6625 root            SW  [vwd_rx]
 6664 root       1396 S   /usr/bin/cmm -f /etc/config/fastforward 
 6669 root       1396 S   /usr/bin/cmm -f /etc/config/fastforward 
 6670 root       1396 S   /usr/bin/cmm -f /etc/config/fastforward 
 6671 root       1396 S   /usr/bin/cmm -f /etc/config/fastforward 
 6672 root       1396 S   /usr/bin/cmm -f /etc/config/fastforward 
 7075 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7077 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7078 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7079 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7080 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7081 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7083 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7084 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7085 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7086 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7087 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7091 root        560 S   wscd -a 192.168.1.1 -i ra0 -m 1 -D 
 7148 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7152 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7153 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7154 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7155 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7156 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7157 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7158 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7160 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7162 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7165 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 7169 root        560 S   wscd -a 192.168.1.1 -i rai0 -m 1 -D 
 8345 root        328 S   crond -c /etc/crontabs 
 9995 root            SW  [pcap_rx]
10302 root        336 S   watch -tn 2 /bin/link_monitor 
13710 root        432 S   -ash 
19454 root        368 R   ps aux
 • netstat -l
root@NBG5715:~# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 *:49152                 *:*                     LISTEN      
tcp        0      0 *:33344                 *:*                     LISTEN      
tcp        0      0 *:49153                 *:*                     LISTEN      
tcp        0      0 *:20005                 *:*                     LISTEN      
tcp        0      0 *:5000                  *:*                     LISTEN      
tcp        0      0 *:80                    *:*                     LISTEN      
tcp        0      0 localhost:53            *:*                     LISTEN      
tcp        0      0 myrouter:53             *:*                     LISTEN      
tcp        0      0 *:2103                  *:*                     LISTEN      
tcp        0      0 *:80                    *:*                     LISTEN      
tcp        0      0 ::1:53                  *:*                     LISTEN      
tcp        0      0 fe80::ca6c:87ff:fe35:53 *:*                     LISTEN      
tcp        0      0 *:22                    *:*                     LISTEN      
tcp        0      0 *:23                    *:*                     LISTEN      
udp        0      0 *:35381                 *:*                                 
udp        0      0 localhost:53            *:*                                 
udp        0      0 myrouter:53             *:*                                 
udp        0      0 *:67                    *:*                                 
udp        0      0 *:1900                  *:*                                 
udp        0      0 *:1900                  *:*                                 
udp        0      0 *:1900                  *:*                                 
udp        0      0 localhost:39546         *:*                                 
udp        0      0 localhost:37856         *:*                                 
udp        0      0 myrouter:5351           *:*                                 
udp        0      0 myrouter:60415          *:*                                 
udp        0      0 ::1:53                  *:*                                 
udp        0      0 fe80::ca6c:87ff:fe35:53 *:*                                 
raw        0      0 *:255                   *:*                     0           
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path
 • iwconfig
root@NBG5715:~# iwconfig
lo        no wireless extensions.

eth2      no wireless extensions.

eth0      no wireless extensions.

tunl0     no wireless extensions.

sit0      no wireless extensions.

ip6tnl0   no wireless extensions.

ethipip6tnl0  no wireless extensions.

lan       no wireless extensions.

ra0       RTWIFI SoftAP  ESSID:"ZyXEL"  
          Mode:Managed  Channel=11  Access Point: CA:6C:87:35:8B:08   
          Bit Rate=450 Mb/s   
          
ra1       RTWIFI SoftAP  ESSID:"RT3593AP2"  
          Mode:Managed  Channel=11  Access Point: CA:6C:87:35:8B:09   
          Bit Rate=450 Mb/s   
          
ra2       RTWIFI SoftAP  ESSID:"RT3593AP3"  
          Mode:Managed  Channel=11  Access Point: CA:6C:87:35:8B:0A   
          Bit Rate=450 Mb/s   
          
ra3       RTWIFI SoftAP  ESSID:"RT3593AP4"  
          Mode:Managed  Channel=11  Access Point: CA:6C:87:35:8B:0B   
          Bit Rate=450 Mb/s   
          
rai0      iNIC AP  ESSID:"ZyXEL"  Nickname:""
          Mode:Master  Frequency:5.18 GHz  Access Point: CA:6C:87:35:8B:0C   
          Bit Rate=450 Mb/s   
          
rai1      iNIC AP  ESSID:"RT3883_5G2"  Nickname:""
          Mode:Master  Frequency:5.18 GHz  Access Point: CA:6C:87:35:8B:0D   
          Bit Rate=450 Mb/s   
          
rai2      iNIC AP  ESSID:"RT3883_5G3"  Nickname:""
          Mode:Master  Frequency:5.18 GHz  Access Point: CA:6C:87:35:8B:0E   
          Bit Rate=450 Mb/s   
          
rai3      iNIC AP  ESSID:"RT3883_5G4"  Nickname:""
          Mode:Master  Frequency:5.18 GHz  Access Point: CA:6C:87:35:8B:0F   
          Bit Rate=450 Mb/s   
          
cap_wan   no wireless extensions.

cap_lan   no wireless extensions.
 • ipkg list
root@NBG5715:/proc# ipkg list
asterisk - 1.2.7.1-1 - 
asterisk-addons - 1.2.5-1 - 
asterisk-voicemail - 1.2.7.1-1 - 
base-files-comcerto1000 - 14-r843 - 
bridge - 1.4-1 - 
busybox - 1.4.2-1 - 
chksum-tool - 0.1-1 - 
cmm - 7.00-5 - 
comcerto-mdio - 0.1-1 - 
cyclesoak - none-1 - 
dnsmasq - 2.38-1 - 
dropbear - 0.49-1 - 
ethtool - 3-0 - 
firmware-info - 0.1-1 - 
firmware-upgrade - 0.1-1 - 
fpp-firmware - 2.6.33.5+3.00.1-comcerto1000-1 - 
gw6c - 5.0-1 - 
haserl - 0.8.0-1 - 
hotplug2 - 0.9-1 - 
htp-tool - 0.1-1 - 
igmpproxy - 0.1-2 - 
ip - 2.6.35-3 - 
ip6tables - 1.4.7-1 - 
ipsec-tools - 0.6.6-1 - 
iptables - 1.4.7-1 - 
iptables-mod-conntrack - 1.4.7-1 - 
iptables-mod-conntrack-extra - 1.4.7-1 - 
iptables-mod-extra - 1.4.7-1 - 
iptables-mod-filter - 1.4.7-1 - 
iptables-mod-ipopt - 1.4.7-1 - 
iptables-mod-ipsec - 1.4.7-1 - 
iptables-mod-nat - 1.4.7-1 - 
iptables-mod-nat-extra - 1.4.7-1 - 
iptables-mod-porttrigger - 1.4.7-1 - 
iptables-mod-webstr - 1.4.7-1 - 
isakmpd - 20041012-1 - 
kernel - 2.6.33.5-comcerto1000-1 - 
keynote - 2.3-1 - 
kmod-accel-pptp - 2.6.33.5+0.8.5-comcerto1000-3 - 
kmod-ata-ahci - 2.6.33.5-comcerto1000-1 - 
kmod-ata-core - 2.6.33.5-comcerto1000-1 - 
kmod-button-hotplug - 2.6.33.5-comcerto1000-3 - 
kmod-crc-ccitt - 2.6.33.5-comcerto1000-1 - 
kmod-crypto-core - 2.6.33.5-comcerto1000-1 - 
kmod-crypto-ocf - 2.6.33.5-comcerto1000-1 - 
kmod-csme - 2.6.33.5+2.14.0-comcerto1000- - 
kmod-elp1800-ocf - 2.6.33.5+2.00-comcerto1000-1 - 
kmod-fci - 2.6.33.5+7.00-comcerto1000-1 - 
kmod-fpp-csme - 2.6.33.5+2.14.0-comcerto1000- - 
kmod-fpp-driver - 2.6.33.5-comcerto1000-1 - 
kmod-fpp_pcap-driver - 2.6.33.5-comcerto1000-1 - 
kmod-fs-ext2 - 2.6.33.5-comcerto1000-1 - 
kmod-fs-ext3 - 2.6.33.5-comcerto1000-1 - 
kmod-fs-mbcache - 2.6.33.5-comcerto1000-1 - 
kmod-fs-vfat - 2.6.33.5-comcerto1000-1 - 
kmod-i2c-comcerto - 2.6.33.5-comcerto1000-1 - 
kmod-i2c-core - 2.6.33.5-comcerto1000-1 - 
kmod-input-core - 2.6.33.5-comcerto1000-1 - 
kmod-input-gpio-buttons - 2.6.33.5-comcerto1000-1 - 
kmod-input-polldev - 2.6.33.5-comcerto1000-1 - 
kmod-ip6tables - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-conntrack - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-conntrack-extra - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-core - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-extra - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-filter - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-ipopt - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-ipsec - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-nat - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-nat-extra - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-nathelper - 2.6.33.5-comcerto1000-1 - 
kmod-ipt-nathelper-extra - 2.6.33.5-comcerto1000-1 - 
kmod-matisse - 1.00-0 - 
kmod-mppe - 2.6.33.5-comcerto1000-1 - 
kmod-nf-conntrack-netlink - 2.6.33.5-comcerto1000-1 - 
kmod-nfnetlink - 2.6.33.5-comcerto1000-1 - 
kmod-nfnetlink-queue - 2.6.33.5-comcerto1000-1 - 
kmod-nls-cp437 - 2.6.33.5-comcerto1000-1 - 
kmod-nls-iso8859-1 - 2.6.33.5-comcerto1000-1 - 
kmod-nls-iso8859-15 - 2.6.33.5-comcerto1000-1 - 
kmod-ppp - 2.6.33.5-comcerto1000-1 - 
kmod-pppoe - 2.6.33.5-comcerto1000-1 - 
kmod-pwrmgmt-api - 2.6.33.5+1.00-comcerto1000-1 - 
kmod-qoscom - 2.6.33.5+1.02-comcerto1000-18 - 
kmod-rt3593ap - 2.6.33.5+2.6.0.0-0.00.2-comcerto1000-2 - 
kmod-rt3883 - 2.6.33.5+2.4.0.6-0.00.2-comcerto1000-2 - 
kmod-sched - 2.6.33.5-comcerto1000-1 - 
kmod-scsi-core - 2.6.33.5-comcerto1000-1 - 
kmod-si3050 - 2.6.33.5+1.05-comcerto1000-1 - 
kmod-st-m24-eeprom - 2.6.33.5-comcerto1000-1 - 
kmod-tun - 2.6.33.5-comcerto1000-1 - 
kmod-usb-storage - 2.6.33.5-comcerto1000-1 - 
kmod-usb2 - 2.6.33.5-comcerto1000-1 - 
kmod-vwd-rtbr-driver - 2.6.33.5-comcerto1000-1 - 
libc - 0.9.28-14 - 
libcli - 1.9.3-1 - 
libgcc - 3.4.6-14 - 
libgdbm - 1.8.3-0 - 
libgmp - 4.2.1-1 - 
libiptc - 1.4.7-1 - 
liblua - 5.1.4-6 - 
liblzo - 2.04-1 - 
libncurses - 5.2-8 - 
libnetfilter-queue - 1.0.0-1 - 
libnfconntrack - 0.0.100 - 
libnfnetlink - 1.0.0 - 
libopenssl - 0.9.8q-1 - 
libpcap - 1.1.1-2 - 
libpthread - 0.9.28-14 - 
librt - 0.9.28-14 - 
libstdcpp - 3.4.6-14 - 
libuci - 12012009.6-2 - 
libuci-lua - 12012009.6-2 - 
libuuid - 1.39-1 - 
libxtables - 1.4.7-1 - 
lldt - 0.1-1 - 
lua - 5.1.4-6 - 
luci - 0.9+svn6252-1 - 
luci-admin-core - 0.9+svn6252-1 - 
luci-admin-easy - 0.9+svn6252-1 - 
luci-admin-expert - 0.9+svn6252-1 - 
luci-app-initmgr - 0.9+svn6252-1 - 
luci-cbi - 0.9+svn6252-1 - 
luci-core - 0.9+svn6252-1 - 
luci-http - 0.9+svn6252-1 - 
luci-i18n-chinese_traditional - 0.9+svn6252-1 - 
luci-i18n-english - 0.9+svn6252-1 - 
luci-i18n-french - 0.9+svn6252-1 - 
luci-i18n-german - 0.9+svn6252-1 - 
luci-i18n-italian - 0.9+svn6252-1 - 
luci-i18n-spanish - 0.9+svn6252-1 - 
luci-ipkg - 0.9+svn6252-1 - 
luci-lmo - 0.9+svn6252-1 - 
luci-nixio - 0.9+svn6252-1 - 
luci-sgi-cgi - 0.9+svn6252-1 - 
luci-sys - 0.9+svn6252-1 - 
luci-theme-base - 0.9+svn6252-1 - 
luci-theme-zyxel - 0.9+svn6252-1 - 
luci-uci - 0.9+svn6252-1 - 
luci-uvl - 0.9+svn6252-1 - 
luci-web - 0.9+svn6252-1 - 
miniupnpd - 1.6.20110730-4 - 
mldproxy - 20041012-1 - 
mmiotool - 1.00-1 - 
msp-firmware - 2.6.33.5+3.00.11-comcerto1000-1 - 
msp-io-app - 2.6.33.5+1.00.0-comcerto1000-1 - 
mtd - 5 - 
mtd-utils - 20090227-1 - 
multiboot-client - 1.0.0-1 - 
net-tools-arp - 1.60-1 - 
ntpclient - 2007_365-4 - 
portTrigger - 2-17 - 
ppp - 2.4.3-7 - 
ppp-mod-pppoe - 2.4.3-7 - 
ppp-mod-pptp - 0.8.5-3 - 
qos-scripts - 1.1.1-1 - 
qosapp - 1.02-12 - 
radvd - 1.6-1 - 
rp-pppoe-relay - 3.8-1 - 
rtATE - 1.4.0.0-1 - 
tc - 2.6.35-3 - 
uboot-envtools - 20081215-2 - 
uci - 12012009.6-2 - 
uclibcxx - 0.2.1-1 - 
udevtrigger - 106-1 - 
uhttpd - 31 - 
uhttpd-mod-lua - 31 - 
updatedd - 2.6-7 - 
updatedd-mod-dyndns - 2.6-7 - 
updatedd-mod-eurodyndns - 2.6-7 - 
updatedd-mod-noip - 2.6-7 - 
updatedd-mod-regfish - 2.6-7 - 
usbtest - 20101222-2 - 
vapi - 2.14.0 - 
wide-dhcpv6-client - 20080615-6 - 
wide-dhcpv6-control - 20080615-6 - 
wide-dhcpv6-relay - 20080615-6 - 
wide-dhcpv6-server - 20080615-6 - 
wifi_list - 0.1-1 - 
wireless-tools - 29-1 - 
wlan-api - 0.1-1 - 
wlan-gen-psk - 0.1-1 - 
wlan-show-summary - 0.1-1 - 
wol - 0.7.1-2 - 
wps-api - 0.1-1 - 
zlib - 1.2.3-3 - 
Done.
 • nmap output
nmTOR src # nmap 192.168.1.1

Starting Nmap 6.00 ( http://nmap.org ) at 2014-01-07 23:55 EST
Nmap scan report for 192.168.1.1
Host is up (0.0088s latency).
Not shown: 991 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
23/tcp    open  telnet
53/tcp    open  domain
80/tcp    open  http
2103/tcp  open  zephyr-clt
5000/tcp  open  upnp
20005/tcp open  btx
49152/tcp open  unknown
49153/tcp open  unknown
MAC Address: C8:6C:87:35:8B:0F (Zyxel Communications)

Nmap done: 1 IP address (1 host up) scanned in 11.30 seconds

Images