See 'WikiDevi' @ the Internet Archive (MW XML, Files, Images)
upgraded MW to 1.30 - maybe things are slightly less broken
Linksys WRT610N v1
Broadcom.For a list of all currently documented Broadcom chipsets with specifications, see
Simultaneous Dual-N Band Wireless Router
WRT610N v1 serial numbers appear to start with CTG0.
- "3763-04000106R" is silkscreened on the board.
- The default SSIDS may be 'linksys' (2.4GHz) and 'linksys_media' (5GHz).
==Specs== ===Platform=== Serial Num. = CTG0 FCC ID = Q87-WRT610NV1 CPU Type = Broadcom BCM4705GKFBG (BCM4705) MIPS Rev = ? CPU Speed = 300MHz Bus = ? Flash Type = Parallel Flash Chip = EON EN29LV640 Flash Size = 8MB Max Firmware Size = 7995392 bytes RAM Size = 64MB RAM Chip = (2x HY5DU561622FTP) nvram Size = 32kb Switch = Broadcom BCM53115 Port-based vlan = ? 802.1q vlan = ? Ethernet Port Count = 1-10/100/1000 WAN 4-10/100/1000 LAN Wired Standard = IEEE 802.3/3u/3ab boot_wait = ? bootloader = CFE Flash Card Socket/Type = No SD/MMC Mod Support = No MiniPCI slots = No PoE = No Power = 12V/1.5A Color of LEDs = ? Size = 8.9" x 7.1" x 1.4" USB = 1x USB 2.0 Serial Port = Yes JTAG Port = Yes Supported by TJTAG/Version = ? Supported by dd-wrt as of = v24 TNG NEWD2 dd-wrt K2.4 Support = Yes dd-wrt K2.6 Support = Yes Special Features = 1 USB 2.0, Gigabit Switch, Dual Radio Simultaneous Radio (wl0) Wireless Radio = Broadcom BCM4322LKFBG TG0810 P11 E7050 01(BCM4322) WLAN DSP processor = ? Antenna Connector Type = Internal Wireless Standard = IEEE 802.11a/n WiFi Operating Frequency = 5GHz 802.11n Draft = up to 300Mbps 802.11a = 6, 9, 12, 18, 24, 36, 48, 54Mbps Radio cor_rev = 16 Radio Capabilities = ? Radio (wl1) Wireless Radio = Broadcom [BCM4322LKFBG TG0810 P11 E7050 01(BCM4322) WLAN DSP processor = ? Antenna Connector Type = Internal Wireless Standard = IEEE 802.11b/g/n WiFi Operating Frequency = 2.4GHz 802.11n Draft = up to 300Mbps 802.11g = 6, 9, 12, 18, 24, 36, 48, 54Mbps 802.11b = 1, 2, 5.5, 11Mbps Radio cor_rev = 16 Radio Capabilities = ? ===Links of Interest=== WRT610N - Status (read first post) WRT610N Need help to unbrick WRT160N v1.0 - Problem Solved - Quikfix ===Flashing=== NOTE: Do Not flash micro this router. NOTE: During configuration or flashing a device, the only that should :be hooked to the device is the computer and power. ===Hard Reset (30/30/30 method)=== navigate to the firmware update tab in the Linksys or dd-wrt GUI initial flash use the trailed build dd-wrt.v24_mega_wrt610n.bin (610n in the filename) :- subsequent loads don't require the trailed build) wait 5 minutes after flashing power cycle the router hard reset again (30/30/30 method) configure the router ===Upgrading=== If dd-wrt is already on the router follow these instructions. If stock firmware is on the router follow the flashing instructions. Check for recommended builds here first. Set your computer to a static IP of 192.168.1.7. (or to whatever subnet the router is on) Disable all firewalls and security. Disable wireless on your computer and only have the router connected to the flashing computer by the ethernet cable between the two. Hard reset or 30/30/30 (If the router supports it, if not, reset to defults in the GUI) prior to flashing. Wait. Check for password page on re-login and change password. Flash firmware. You can use the webgui except if you have a belkin router. (For belkin use tftp.exe to flash) Wait...at least three minutes. Lights should return to normal. See important2, below. Failing to wait is how most people brick their routers. Do a power cycle of the router. (Unplug the cord, count to 30 and plug it back in.) Wait for the lights to return to normal usually about 2 minutes. Hard reset or 30/30/30 again (If the router supports it, if not, reset to defults in the GUI). Wait. Check for the password page and re-login to change the password. Then you can reconfigure your settings manually. Once configured set your computer back to autoIP and autoDNS. Important1: This Hard reset or 30/30/30 works fine for Asus router, but you do have to power cycle after the reset. Important2: After you flash the firmware, and before you do the hard reset, the router will be building some nvram settings. YOU MUST WAIT FOR THIS TO FINISH PRIOR TO DOING ANYTHING WITH THE ROUTER INCLUDING A HARD RESET. Usually, you can tell when this process is completed by the WAN light coming on, but it does take several minutes. Go have a beer. There are starting to be more and more people who BRICK their routers by not waiting until the nvram is rebuilt, PRIOR to doing a hard reset. YOU NEED TO WAIT! ===Reverting=== To revert to the original firmware, just download and flash the current Linksys firmware file using DD-WRT GUI following the same steps outlined in the "Steps for flashing" section above. ==JTAG/Serial Info== ===JTAG=== ====JTAG Pinouts==== nTRST 1o o2 GND TDI 3o o4 GND TDO 5o o6 GND TMS 7o o8 GND TCK 9o o10 GND nSRST 11o o12 N/C N/C 13o o14 N/C Marked by a yellow box in the pics below. ====JTAG Recovery==== Fixme This section is in need JTAG Recovery Instructions! Serial Serial Pinouts VCC 1 o TX 2 o RX 3 o N/C 4 o GND 5 o ===Hyper terminal Setup in Windows XP=== In Windows XP, Click Start Button - All Programs - Accessories - Communication - HyperTerminal Enter a name for the connection, Click ok Choose com port you adapter is plugged into, Click ok Set: Bits per second = 115200 Data Bits = 8 Parity = none Stop bits = 1 Flow control = none Click ok Click File - Save As, and select a place to save it to so you don't have to enter the settings again. Putty Setup in Windows XP After installing putty, run it Serial line = The COM port your using for serial (ie. COM3) Speed = 115200 Click on Serial under Connection Serial line to connect to = same as above (Serial line) Speed (baud) = 115200 Data bits = 8 Stop bits = 1 Parity = None Flow control = None Click Session Enter a name for your connection under saved sessions Click Save Click Open Serial Recovery Fixme This section is in need of Serial Recovery Instructions! ===USB Info=== The USB port is where you can connect an external USB hard drive or flash drive. Which can do a multitude of things. You can use in as a NAS, storage for a FTP server, use Optware to run external programs like torrent software, samba for sharing files to your network, share a USB printer with your network... The list of possibilities is long, it just takes a little research. ProFTPd is included in most the newer builds of dd-wrt. Check the features chart to be sure. A ftp server, file sharing, and a media sever is included in TomatoUSB if your device is compatable. ===vlan Info=== VLAN Support balblas wrote: Confirmed WRT610Nv1 works, also for dot1q trunking: 1 2 3 4 | Case labels 1 2 3 4 | NVRAM ports vlan1 and vlan2 use different nvram settings (compared to an E2000). Variable "vlan1ports=1 2 3 4 8*" does not seem to be used. It is reset whenever the router is rebooted, but the actual setting being used is new_vlan1ports, which survives a reboot. See example below (I disabled vlan1 on the switch completely as it's the management vlan on my Cisco routers/switches which gives issues when trunking between DD-WRT routers and Cisco): nvram show | egrep "vlan.ports|vlan.hwname" | sort size: 32203 bytes (565 left) new_vlan1hwname=et0 new_vlan1ports= new_vlan2hwname=et0 new_vlan2ports=0 8 vlan1hwname=et0 vlan1ports=1 2 3 4 8* vlan2hwname=et0 vlan2ports=0 8 vlan3hwname=et0 vlan3ports=4t 3t 8 vlan4hwname=et0 vlan4ports=4t 3t 2 1 8* ==Notes== ===Overview=== The WRT610N is the previous top-of-the-line consumer device from Linksys (replaced with the E3000) with the following features: Dual-radio (two BCM4322) allows to operate 2.4 Ghz B/G/N and 5 Ghz A/N simultaneously 4+1 port Gigabit switch (BCM53115) v1 300 MHz (BCM4705) / v2 533MHz (BCM4718) or 480MHz (BCM4716) USB 2.0 host port 64 MByte RAM, 8 MByte Flash ===CFE Versions=== The CFE is basically the BIOS of the WRT610N. It's responsible for initial hardware configuration and subsequently for booting the actual firmware. There are at least two variants of the WRT610N CFE. To find the CFE versions from within dd-wrt, use: root@ap-ssn:~# nvram show|egrep 'bootnv|pmon' bootnv_ver=6 pmon_ver=CFE 220.127.116.11 either via telnet or from the Web GUI via "Administration->Commands->Run Commands" The versions are bootnv_ver=6, pmon_ver=CFE 18.104.22.168 (subsequently called CFE .12) bootnv_ver=7, pmon_ver=CFE 22.214.171.124 (subsequently called CFE .16) Builds between 12387 and 12424 do not work on CFE .12 models. DD-WRT will start, but immediately reboot, requiring debricking. Your mileage may vary. See http://svn.dd-wrt.com:8000/dd-wrt/ticket/1149' This is fixed in EKO build 12427, available here: http://www.dd-wrt.com/dd-wrtv2/downloads/others/eko/V24_TNG/svn12424/dd-wrt.v24-12427_mega-wrt610n.bin ===Information=== If you are installing DD-WRT for the first time on your WRT610N, you need to use a hardware-specific build. edit: This doesn't seem to be true anymore... information is in dispute. First time flash for v1 use: ftp://dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/03-24-10-r14144/broadcom/dd-wrt.v24_mega_wrt610n.bin First time flash for v2 use: ftp://dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/03-24-10-r14144/broadcom_K26/dd-wrt.v24-14144_NEWD-2_K2.6_mini_wrt610nv2.bin LINUX KERNEL 2.6 BUILDS DD-WRT v24 is currently built under two different branches, one using the 2.4 kernel and the new one having the 2.6 kernel. You can install the K2.4 builds on v1, but not v2. K2.6 supports both v1 and v2. To identify the difference, K2.4 builds aren't usually marked with any special identification, and K2.6 builds are in a different folder with K26 in the folder name and K2.6 will be in the filename. For example: ftp.dd-wrt.com/others/eko/V24_TNG/svn14471/dd-wrt.v24-14471_big-wrt610n.bin and ftp.dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/04-16-10-r14289/broadcom/dd-wrt.v24_mega_wrt610n.bin are 2.4 kernel builds and will only work on v1 routers ftp.dd-wrt.com/others/eko/V24-K26/svn14471/dd-wrt.v24-14471_NEWD-2_K2.6_big.bin and ftp.dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/04-16-10-r14289/broadcom_K26/dd-wrt.v24-14289_NEWD-2_K2.6_big.bin are 2.6 kernel builds and will work on v2 as well as v1. So be careful not to use K2.4 on v2 or you will brick your router!!! ====Latest version==== Keep checking ftp://dd-wrt.com/others/eko/ for updates to either the BrainSlayer or eko builds. Support for the WRT610N is currently only available via SVN builds. You can download such builds either from Eko (normal and MEGA-Builds): from Brainslayer (only MEGA-Builds): (The differences between those builds are described here: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=45891 -- basically, BS' builds contain Asterisk, Eko's don't) Look for the files labeled "WRT610N". Those builds have a special header and can be flashed directly using the stock Linksys firmware's "Update Firmware" option. A factory reset after the flash is recommended. (see steps for flashing below) The WRT610N has two radio modules and thus two wireless devices with distinct configuration in DD-WRT: wl0 is the 2.4 Ghz band radio (supporting 802.11b/g/n) wl1 is the 5 Ghz band radio (supporting 802.11a/n) Note that Draft-N can operate in both the 2.4 and 5 Ghz bands. ===GPIO=== gpio enable 0 result = 01 USB LED Off gpio disable 0 result = 01 USB LED On gpio enable 1 result = 00 Power LED stops flashing gpio disable 1 result = 00 Power LED starts flashing gpio enable 2 result = 01 No activity gpio disable 2 result = 01 No activity gpio enable 3 result = 01 LED on top of the WPS Button turns off gpio disable 3 result = 01 LED on top of the WPS Button turns Amber gpio enable 4 result = 01 No activity gpio disable 4 result = 01 No activity gpio enable 5 result = 01 No activity gpio disable 5 result = 01 No activity gpio enable 6 result = 01 No activity gpio disable 6 result = 01 No activity gpio poll 6 result = 01, 00 at button press = Reset button 01 = No button press 00 = At button press gpio enable 7 result = 01 No activity gpio disable 7 result = 01 No activity gpio enable 8 result = 01 No activity gpio disable 8 result = 01 No activity gpio poll 8 result = 01, 00 at button press = WPS button gpio enable 9 result = 01 LED on top of the WPS Button turns off gpio disable 9 result = 01 LED on top of the WPS Button turns Blue gpio enable 10 result = 01 No activity gpio disable 10 result = 01 No activity gpio enable 11 result = 01 No activity gpio disable 11 result = 01 No activity gpio enable 12 result = 01 No activity gpio disable 12 result = 01 No activity gpio enable 13 result = 01 No activity gpio disable 13 result = 01 No activity gpio enable 14 result = 01 No activity gpio disable 14 result = 01 No activity gpio enable 15 result = 01 No activity gpio disable 15 result = 01 No activity gpio enable 16 result = 00 No activity gpio disable 16 result = 00 No activity gpio enable 17 result = 00 No activity gpio disable 17 result = 00 No activity gpio enable 18 result = 00 No activity gpio disable 18 result = 00 No activity gpio enable 19 result = 00 No activity gpio disable 19 result = 00 No activity gpio enable 20 result = 00 No activity gpio disable 20 result = 00 No activity <repeats> gpio enable 32 result = 01 USB LED Off gpio disable 32 result = 01 USB LED On gpio enable 33 result = 00 Power LED stops flashing gpio disable 33 result = 00 Power LED starts flashing .. <repeats> .. ===Recovery (Unbricking)=== A simple way to recover a bricked device (confirmed to work with both CFE.12 and CFE.16) is: unplug all ethernet ports (Important!) unplug power plug power in wait 2-2.5 seconds press the reset button and keep it pressed for 5 seconds, then release it reconnect ethernet (DHCP shoud give IP address to computer) point your browser at 192.168.1.1. You should see a "Management Firmware update" screen where you can flash the original firmware or dd-wrt directly (even mega builds). Alternative Method 1: manually assign 192.168.1.10 to your computer unplug power plug power in wait 0.5-1.0 seconds press the reset button and keep it pressed for 1 second, then release it point your browser at 192.168.1.1. Alternative Method 2: manually assign 192.168.1.10 to your computer unplug power plug power in wait for all lights blink press the reset button and keep it pressed for 1 second or 3/4 flashes of the power-light, then release it point your browser at 192.168.1.1. The alternative methods are reported to work well on the wrt-610Nv1 CTGxxxx series (mostly works at the first attempt); these series are using CFE .16 The management mode can also be activated from the serial console using nvram set safe_mode_upgrade=on nvram commit reboot ===Known Issues=== Random reboots/WLAN lockups As of build 12427, the router will randomly reboot, sometimes after minutes, sometimes after hours. Using only the 2.4 Ghz radio seems to make the problem occur less often. Developers are aware of the problem and are working on it. A possible workaround seems to be disabling the interference mitigation mode using wl -i eth0 interference 0 wl -i eth1 interference 0 either from telnet or from Administration->Commands. See here (signature) for real world uptimes of 3 different WRT610N devices, including their respective configurations. ====Fixed Wireless MAC==== Until build 12360, the 2.4 Ghz wireless radio MAC is always 00:90:4C:4E:00:2A. This causes weird client behavior if you have more than one WRT610N in one network. As a workaround, you can manually set the mac address using the shell commands nvram set "pci/1/1/macaddr"=00:90:4C:D6:02:2a nvram commit This is fixed in 12427 for CFE.16 devices. For CFE.12 devices, the situation is now reversed: The 5 Ghz MAC always has 00:90:4C:4E:00:2A, and the 2.4 Ghz MAC is fine. ===VLAN support=== See vlan Info There currently is no kernel driver for the broadcom switch in the device. This makes all of the VLAN settings dysfunctional. There is no workaround. Basic switch operation (i.e., similiar to the Linksys firmware) works fine, though. Note that due to the default configuration of the broadcom chip, the switch will strip all forwarded packets of their VLAN tags. The option "Assign WAN Port to Switch", which actually works at the kernel IP level by adding the Internet "vlan2" device to the main bridge, works. ====5 GHz specific issues==== For certain builds the 5 GHz radio (wl1) may only work when the wireless mode is set to NA-Mixed. Later builds e.g. 13972-mega  do not exhibit this behaviour. Neither Site Survey nor Wizviz Survey currently work for the 5 GHz band. No TFTP recovery (not really an issue anymore) Due to a problem in the CFE, it is not possible to recover a bricked device using the commonly recommended boot-wait TFTP process (i.e. by waiting for the device to react to pings to 192.168.1.1 and TFTP a firmware file to it). TFTP transfers to the device which are larger than 3.8MB (i.e., the stock firmware) will fail, other TFTP transfers will seemingly succeed, but the CFE will not flash them. See above for a much simpler way to unbrick using management mode. Debricking via serial port is also possible. Note that the serial port is externally accessible inside the "Internet" ethernet jack. Instructions for serial recovery are available here: http://www.dd-wrt.com/phpBB2/viewtopic.php?p=209668#209668 ===Other notes=== USB USB support works, including Hubs, for all kind of devices, even when Linksys only advertises this as a "Storage Link". Note that there are known Linux USB issues with USB 2.0, Hubs and Full/Low speed devices, notably the often used FTDI serial converters. Use USB 1.1 only as a workaround. 5 GHz channels Not specific to the WRT610N, but with the 5 Ghz band, the channel limitations per regulatory domain are much broader than with 2.4 Ghz channels. Since dd-wrt doesn't limit the 5 Ghz channel selection, you run a much higher chance of setting the router to a channel which your client device (which does honor regulatory limits) doesn't support. See http://en.wikipedia.org/wiki/List_of_WLAN_channels#5.C2.A0Ghz_.28802.11a.2Fh.2Fj.2Fdraft-n.29 for a list of available 5 Ghz band channels. ===Hardware Modification===