Netgear WNR3500 v2

From TechInfoDepot
(Redirected from Netgear WNR3500 v2.0)
Jump to: Navigation, search
Netgear WNR3500-01.jpg
RangeMax™ Wireless-N Gigabit Router
3rd Party Firmware
Not Supported
Not Supported
Status Unknown
Not Supported
Brand Model Rev
Netgear WNR3500 v2.0
Serial Num. Prefix
wireless router
Broadcom BCM4718A1
CPU1 Speed
Flash1 Type
Flash1 Chip
Macronix MX X100136 25L3205DMI-126 SC803100
Flash1 Size
4 MiB
4,194,304 B
32,768 Kib
4,096 KiB
32 Mib
Flash1 Max Firmware Size
3735552 bytes
RAM1 Size
32 MiB
33,554,432 B
262,144 Kib
32,768 KiB
256 Mib
RAM1 Chip
Samsung 001 K4T51163QG-HCE6 CJL123PXN
nvram Size
32 MiB
33,554,432 B
262,144 Kib
32,768 KiB
256 Mib
ETH chip1
Broadcom BCM4718A1
Broadcom BCM53115
Port-based vlan
Ethernet Port Count
Wired Standard
IEEE 802.3/3u/3ab
Ethernet interface OUI
CFE (128k)
Expansion IF types
none specified
12 VDC, 1 A
Connector type
Serial Port
x 1 (?,?,?,?,?)
x 1
Supported by TJTAG/Version Yes/3.02-final
Default IP address
Default login user
Default login password
3rd Party Firmware Support
FCC approval date 23 January 2009
Country of manuf China
Yellow, Green, Blue
Dimensions (L x W x H)
6.89×5.12×1.38 inches (175×130×35 mm)
Broadcom BCM4718A1
Wireless interface OUI
Antenna Connector Type
none, Internal Antenna
MIMO status
Wireless Standard
IEEE 802.11b/g/n
up to 300 Mbps
up to 54 Mbps
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz
Radio cor_rev
Radio Capabilities
ap sta wet led wme pio 802.11d 802.11h rm cqa mbss16 afterburner ampdu amsdurx amsdutx acktiming rxchain_pwrsave radio_pwrsave bcm_dcs
Netgear WNR3500 v2 VCPY308400093
Netgear WNR3500L v1PY308400093
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
Netgear WNR3500 v1MarvellMarvellMarvell
Netgear WNR3500 v2BroadcomBroadcom
Netgear WNR3500 v2 VCBroadcomBroadcom
For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

Wikidevi Notes[edit]

Manuf. by Foxconn / Hon Hai / Ambit

How To Identify Which Model Router You Have

Links of Interest[edit]


Flashing DD-WRT[edit]


  1. Hard Reset/30-30-30
  2. Configurge PC for a static ip of
  3. Make sure nothing else but power and PC is hooked to router
  4. Load dd-wrt.v24-18946_NEWD-2_K2.6_mini-WNR3500v2.chk
  5. Wait 5 Minutes
  6. Browse to, make sure you get the change password page
  7. Hard Reset/30-30-30
  8. Browse to, change name and password, configure.

Flashing TomatoUSB[edit]

Support Chart at Bottom


Updating DD-WRT

If dd-wrt is already on the router follow these instructions. If stock firmware is on the router follow the flashing instructions.

  1. Check for recommended builds here first.
  2. Set your computer to a static IP of (or to whatever subnet the router is on) Disable all firewalls and security. Disable wireless on your computer and only have the router connected to the flashing computer by the ethernet cable between the two.
  3. Hard reset or 30/30/30 (If the router supports it, if not, reset to defults in the GUI) prior to flashing. Wait. Check for password page on re-login and change password.
  4. Flash firmware. You can use the webgui except if you have a belkin router. (For belkin use tftp.exe to flash)
  5. least three minutes. Lights should return to normal. See important2, below. Failing to wait is how most people brick their routers.
  6. Do a power cycle of the router. (Unplug the cord, count to 30 and plug it back in.)
  7. Wait for the lights to return to normal usually about 2 minutes.
  8. Hard reset or 30/30/30 again (If the router supports it, if not, reset to defults in the GUI). Wait. Check for the password page and re-login to change the password. Then you can reconfigure your settings manually.
  9. Once configured set your computer back to autoIP and autoDNS.

Important1: This Hard reset or 30/30/30 works fine for Asus router, but you do have to power cycle after the reset.

Important2: After you flash the firmware, and before you do the hard reset, the router will be building some nvram settings. YOU MUST WAIT FOR THIS TO FINISH PRIOR TO DOING ANYTHING WITH THE ROUTER INCLUDING A HARD RESET. Usually, you can tell when this process is completed by the WAN light coming on, but it does take several minutes. Go have a beer. There are starting to be more and more people who BRICK their routers by not waiting until the nvram is rebuilt, PRIOR to doing a hard reset. YOU NEED TO WAIT!


Reverting to OEM Firmware from DD-WRT[edit]

No GUI Revert yet, see serial recovery for reversion.

JTAG-Serial Info[edit]


JTAG Pinouts[edit]


 nTRST   1o o2	 GND
   TDI   3o o4	 GND
   TDO   5o o6	 GND
   TMS   7o o8	 GND
   TCK   9o o10	 GND
 nSRST  11o o12  N/C

Using Universal JTAG Adapter

  white  1o o2	 black
    red  3o o4	 GND
   blue  5o o6	 GND
  green  7o o8	 GND
 yellow  9o o10  GND
 orange 11o o12  N/C


   N/C  1o o2  N/C
 nTRST  3o o4  GND
   TDI  5o o6  GND
   TMS  7o o8  GND
   TCK  9o o10 GND
   N/C 11o o12 GND
   TDO 13o o14 GND
 nSRST 15o o16 GND
   N/C 17o o18 GND
   N/C 19o o20 GND

 Using the ribbon cable provided
 Black to your choice of pins 2,4,6,8,10 on router and 
 your choice of pins 4,6,8,10,12,14,16,18,20 on TUMPA for GND
 White to pin 1 on router and pin 3 on TUMPA for nTRST
 Grey to pin 3 on router and pin 5 on TUMPA for TDI
 Purple to pin 7 on router and pin 7 on TUMPA for TMS
 Blue to pin 9 0n router and pin 9 on TUMPA for TCK
 Green to pin 5 on router and pin 13 on TUMPA for TDO
 Yellow to pin 11 on router and pin 15 on TUMPA for nSRST

DD-WRT JTAG Recovery for Universal JTAG Adapter[edit]

Confirmed Working with North American Unit and Firmware

  1. Power Cycle, tjtag3 -backup:cfe128 /silent /otheroptions
  2. Power Cycle, tjtag3 -backup:nvram /silent /otheroptions
  3. Power Cycle, tjtag3 -backup:wholeflash /silent /otheroptions
  4. Power Cycle, tjtag3 -backup:custom /window:0x1fc00000 /start:0x1c3e0000 /length:0x10000 /silent /otheroptions
  5. The last step will backup the board data to "custom.bin, Using a Hex editer, check to make sure all the data looks similar to board_data.bin or post it to your thread in the dd-wrt forums and somebody can check it for you.
  6. If it is similar, change "U12H127T70_NETGEAR" to "U12H127T00_NETGEAR". The mac address starts at Hex address 40 in the middle pane, make sure it's correct. The Serial number starts at Dec address 76 in the right pane, make sure it's correct. The Security Pin starts at Dec address 108 in the right pane, make sure it's correct. The actual board data starts at Dec address 256 in the right pane, make sure it matches board_data.bin. If it looks all messed up then start fresh with board_data.bin and make all the changes ti it. When done "save as" "custom.bin" without the quotes. Makes sure it's in the same folder as TJTAG.
  7. Now do the same with the cfe128, mac sure mac address match(although not as important with the cfe). Check to see if is similar to cfe128.bin. If not or it's just totally messed up use the reference cfe128.bin. Just edit it to match the information from your router.
  8. Power Cycle, tjtag3 -flash:custom /window:0x1fc00000 /start:0x1ffe0000 /length:0x10000 /swap_endian /byte_mode /silent /otheroptions
  9. Power Cycle, tjtag3 -flash:cfe128 /swap_endian /byte_mode /silent /otheroptions
  10. Have TFTP.exe ready in WindowsXP, with WNR3500v2-V1.2.2.28_25.0.85NA.chk from that zip file. Configure your computer with a static ip address of Connect the router to the pc via network cable. Power on the router when it signals a connection click upgrade.


Serial Pinouts[edit]


 VCC 1 o
  RX 2 o
 N/C 3 o
 N/C 4 o
  TX 5 o
 GND 6 o
Hyper terminal Setup in Windows XP
In Windows XP, Click Start Button - All Programs - Accessories - 
   Communication - HyperTerminal
Enter a name for the connection, Click ok
Choose com port you adapter is plugged into, Click ok
 Bits per second = 115200
 Data Bits = 8
 Parity = none
 Stop bits = 1
 Flow control = none
Click ok
Click File - Save As, and select a place to save it to so you 
             don't have to enter the settings again.
Putty Setup in Windows XP
After installing putty, run it
 Serial line = The COM port your using for serial (ie. COM3)
 Speed = 115200
Click on Serial under Connection
 Serial line to connect to = same as above (Serial line)
 Speed (baud) = 115200
 Data bits = 8
 Stop bits = 1
 Parity = none
 Flow control = none
Click Session
 Enter a name for your connection under saved sessions
Click Save
Click Open

DD-WRT Serial Recovery[edit]

  1. Once you hooked up and getting data in putting/Hyper terminal and have a static ip on you pc of, Power cycle the router. Imediatly start rapid firing CTRL+C until it breaks into the CFE.
  2. Get TFTP ready with the OEM firmware.
  3. Type tftpd, then click upgrade on the TFTP window.
  4. Give it about 5 min to bootup and settle, then goto

USB Info[edit]


vlan Info[edit]

DD-WRT vlan Info[edit]


Netgear Images
DarkShadow's Unit
FCCID PY308400093


How To Identify Which Model Router You Have[edit]

by benryanau

After spending an hour researching the variants of the Netgear WNR3500 family and their specs prior to a purchase, I realised this would he handy to post up somewhere. So, I thought I'd table it up and share it, since there wasn't a concise guide anywhere on the web already. Hopefully this will help some people out!

Model Flash/RAM CPU USB Ant Radios Eth WAN Notes FCC ID
WNR3500 v1 8/32 Marvell TopDog 88*Series No 2 Int 1 (88W8060) 4xGigE GigE Blue Antenna LEDs on top PY307300074
WNR3500 v2 4/32 BCM4718A @480MIPS 74k No 8 Int 1 4xGigE GigE "V2" marked under orange LAN ports, smaller housing, no antenna LEDs PY308400093
WNR3500L V1 (N300) 8/64 BCM4718A @480MIPS 74k 1xUSB 2.0 8 Int 1 4xGigE GigE WNR3500U/WNR3500L Marked below yellow WAN port PY308400093
WNR3500L V2 128/128 BCM5357 @480MIPS 74k 1xUSB 2.0 2 Int 1 4xGigE GigE Below yellow WAN port WNR3500L v2 PY310400153

Flash partitions[edit]

 dev:  size     erasesize name
 mtd0: 00040000 00010000 "pmon"
 mtd1: 00750000 00010000 "linux"
 mtd2: 005dc000 00010000 "rootfs"
 mtd3: 00080000 00010000 "jffs2"
 mtd4: 00010000 00010000 "nvram"
 mtd5: 00010000 00010000 "board_data"

Hardware Modification[edit]

See Also[edit]