Netgear WNDR3400v2

The default SSID patterns appear to be NETGEARXX and NETGEARXX-5G.
 * The USB ID of the on-board BCM43236 is 0a5c:bd17.

Wikis

 * WNDR3400 on the OpenWrt wiki

Forum threads

 * CFE and /proc/kmsg dump on the DD-WRT forums

Third party firmware

 * Tathagata Das's DD-WRT build for WNDR3400v2

Other

 * Some units seem to be using a 84:1B:5E OUI

Bundled power supply
The power supply included with the device is
 * a Leader Electronics MT18-9120150-A1.

Pinout
The pinout is the same as the v1. <--- to BCM5358U J41 (•) (Rx) (•) (•)  (Tx)  (GND)

{{SCollapse|Serial info

Boot log
Decompressing..........done

CFE for WNDR3400v2 version: v1.0.15 Build Date: Tue Jul 5 21:54:28 CST 2011 Init Arena Init Devs. Boot partition size = 262144(0x40000) Found a 8MB ST compatible serial flash et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.127.17 CPU type 0x19749: 530MHz Tot mem: 65536 KBytes

Device eth0: hwaddr 20-4E-7F-26-44-5D, ipaddr 192.168.1.1, mask 255.255.255.0 gateway not set, nameserver not set Linux version 2.6.22 (cliffwang@cliffwang-desktop) (gcc version 4.2.3) #47 Fri Aug 26 18:14:59 CST 2011 CPU revision is: 00019749 Found a 8MB ST compatible serial flash wombo_reset set to gpio 25 Determined physical RAM map: memory: 03fff000 @ 00000000 (usable) Built 1 zonelists. Total pages: 16256 Kernel command line: root=/dev/mtdblock2 console=ttyS0,115200 init=/sbin/preinit Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). PID hash table entries: 256 (order: 8, 1024 bytes)

CPU: BCM5357 rev 2 at 530 MHz Using 265.000 MHz high precision timer. Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 61168k/65532k available (2779k kernel code, 4300k reserved, 556k data, 184k init, 0k highmem) Mount-cache hash table entries: 512 NET: Registered protocol family 16 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb PCI: no core PCI: Fixing up bus 0 Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher fuse init (API version 7.8) io scheduler noop registered (default) Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A loop: module loaded PPP generic driver version 2.4.2 NET: Registered protocol family 24 PPPoL2TP kernel driver, V0.17 sflash: squash filesystem with lzma found at block 1505

Creating 15 MTD partitions on "sflash": 0x00000000-0x00040000 : "boot" 0x00040000-0x00740000 : "linux" 0x00178544-0x00740000 : "rootfs" 0x00740000-0x00750000 : "ML1" 0x00750000-0x00760000 : "ML2" 0x00760000-0x00770000 : "ML3" 0x00770000-0x00780000 : "ML4" 0x00780000-0x00790000 : "ML5" 0x00790000-0x007a0000 : "ML6" 0x007a0000-0x007b0000 : "ML7" 0x007b0000-0x007c0000 : "T_Meter1" 0x007c0000-0x007d0000 : "T_Meter2" 0x007d0000-0x007e0000 : "POT" 0x007e0000-0x007f0000 : "board_data" 0x007f0000-0x00800000 : "nvram" ehci_hcd 0000:00:04.1: EHCI Host Controller ehci_hcd 0000:00:04.1: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:04.1: EHCI Fastpath: New EHCI driver starting ehci_hcd 0000:00:04.1: irq 5, io mem 0x18004000 ehci_hcd 0000:00:04.1: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ohci_hcd 0000:00:04.0: OHCI Host Controller ohci_hcd 0000:00:04.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:04.0: irq 5, io mem 0x18009000 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected Initializing USB Mass Storage driver... usb 1-2: new high speed USB device using ehci_hcd and address 2 usb 1-2: configuration #1 chosen from 1 choice usbcore: registered new interface driver usb-storage USB Mass Storage support registered. u32 classifier TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 10 6WIND/LSIIT IPv6 multicast forwarding 0.1 plus PIM-SM/SSM with *BSD API lo: Disabled Privacy Extensions IPv6 over IPv4 tunneling driver sit0: Disabled Privacy Extensions NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear  All bugs added by David S. Miller  VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 184k freed Warning: unable to open an initial console. Failed to execute /init [sighandler]: No more events to be processed, quitting. [cleanup]: Waiting for children. [cleanup]: All children terminated. Reading board data... WSC UUID: 0xd1153b28a4d0ada236def27b751bbd4c NTP synchronized date/time: Sun Feb 26 20:24:44 2012 MAC address of 1st STA connected: 60-D8-19-C3-E4-88 wl: wl driver adapter not found wl: wl driver adapter not found wl: wl driver adapter not found wl: wl driver adapter not found Initialise conn table 2048 entries insmod: usbcore.ko: no module by that name found insmod: ehci-hcd.ko: no module by that name found wl1 is up in 0 sec Hit enter to continue...wlconf: PHYTYPE: 4 wlconf: PHYTYPE: 4 wlconf: PHYTYPE: 4 wlconf: PHYTYPE: 4 killall: upnp: no process killed upnp: No such file or directory WARNING: console log level set to 1 killall: wps_monitor: no process killed killall: wps_ap: no process killed killall: wps_enr: no process killed Reading board data... WSC UUID: 0xd1153b28a4d0ada236def27b751bbd4c shm ID: 0 Get a correct Segment_ID: 0 and semaphore ID:32769 Can't find handler for ASP command: upnp_media_cgi_get_param("appendStr"); Can't find handler for ASP command: upnp_media_cgi_get_param("media_name"); info, udhcp server (v0.9.8) started error, unable to parse 'option wins ' error, unable to parse 'option domain ' POT integrity check OK. POT time is up. [FIXME] count: 1, don't restart system Info: No FWPT default policies. /tmp/samba/private/smb.conf: no files! killall: bftpd: no process killed httpd: socket bound in 0.0.0.0:80. insmod: usbcore.ko: no module by that name found insmod: ehci-hcd.ko: no module by that name found insmod: ohci-hcd.ko: no module by that name found insmod: usb-storage.ko: no module by that name found mount: mounting none on /proc/bus/usb failed: Device or resource busy IOCTL_AG_REGION_SET: English Start DHCP client daemon info, udhcp client (v0.9.8) started vlan2: No such process route: ioctl 0x890c failed: No such process killall: dhcp6c: no process killed killall: IPv6-relay: no process killed killall: pppdv6: no process killed killall: rtsol: no process killed killall: dhcp6s: no process killed killall: radvd: no process killed ifconfig: invalid number '' ifconfig: invalid number '' route: ioctl 0x890c failed: No such process killall: dhcp6s: no process killed killall: radvd: no process killed killall: pptp: no process killed Hit enter to continue...Hit enter to continue...

cat /proc/cmdline
root=/dev/mtdblock2 console=ttyS0,115200 init=/sbin/preinit
 * 1) cat /proc/cmdline

cat /proc/mtd
dev:   size   erasesize  name mtd0: 00040000 00010000 "boot" mtd1: 00700000 00010000 "linux" mtd2: 005c7abc 00010000 "rootfs" mtd3: 00010000 00010000 "ML1" mtd4: 00010000 00010000 "ML2" mtd5: 00010000 00010000 "ML3" mtd6: 00010000 00010000 "ML4" mtd7: 00010000 00010000 "ML5" mtd8: 00010000 00010000 "ML6" mtd9: 00010000 00010000 "ML7" mtd10: 00010000 00010000 "T_Meter1" mtd11: 00010000 00010000 "T_Meter2" mtd12: 00010000 00010000 "POT" mtd13: 00010000 00010000 "board_data" mtd14: 00010000 00010000 "nvram"
 * 1) cat /proc/mtd

cat /proc/cpuinfo
system type            : Broadcom BCM5357 chip rev 2 processor              : 0 cpu model              : MIPS 74K V4.9 BogoMIPS               : 264.60 wait instruction       : no microsecond timers      : yes tlb_entries            : 64 extra interrupt vector : no hardware watchpoint     : yes ASEs implemented       : mips16 dsp VCED exceptions        : not available VCEI exceptions        : not available
 * 1) cat /proc/cpuinfo

unaligned_instructions : 372 dcache hits            : 2147483648 dcache misses          : 2127330515 icache hits            : 2147483648 icache misses          : 4106158009 instructions           : 2147483648

lsmod
Module                 Size  Used by    Tainted: P MultiSsidCntl 3712 0 - Live 0xc0017000 (P) acos_nat 458240 0 - Live 0xc0357000 (P) wl_high 1131648 0 - Live 0xc007c000 (P) wl 1099968 0 - Live 0xc01ca000 (P) et 72144 0 - Live 0xc0069000 (P) ipv6_spi 43520 0 - Live 0xc0022000 (P) igs 20112 1 wl, Live 0xc0011000 (P) emf 22400 2 wl,igs, Live 0xc000a000 (P)
 * 1) lsmod

ps
PID Uid        VSZ Stat Command 1 0         2648 S   /sbin/preinit 2 0              SW< [kthreadd] 3 0              SWN [ksoftirqd/0] 4 0              SW< [events/0] 5 0              SW< [khelper] 18 0              SW< [kblockd/0] 19 0              SW< [ksuspend_usbd] 22 0              SW< [khubd] 45 0              SW  [pdflush] 46 0              SW  [pdflush] 47 0              SW< [kswapd0] 48 0              SW< [aio/0] 582 0              SW< [mtdblockd] 2030 0         1528 S   /bin/eapd 2033 0         2028 S   nas 2037 0         2988 S   /bin/wps_monitor 2092 0         1744 S   swresetd 2094 0         1616 S   dnsRedirectReplyd 2097 0         5640 S   httpd 2100 0          824 S   dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -u r 2105 0           844 S   udhcpd /tmp/udhcpd.conf 2108 0         1616 S   ddnsd & 2111 0         1624 S   telnetenabled 2116 0         2224 S   heartbeat 2119 0         1544 S   wlanconfigd 2134 0         1640 S   scheact 2137 0         2592 S   upnpd 2141 0         1980 S   /usr/sbin/email 2144 0         1684 S   lld2d br0 2147 0         2272 S   /usr/sbin/acl_logd 2157 0         1904 S   check_fw 2227 0          820 S   udhcpc -i vlan2 -p /var/run/udhcpc0.pid -s /tmp/udhcp 2262 0         1608 S   wpsd 2267 0         1104 S   /bin/sh 2277 0         1100 R   ps
 * ps

cat /proc/meminfo
MemTotal:       61416 kB MemFree:         35216 kB Buffers:          2560 kB Cached:           8596 kB SwapCached:          0 kB Active:           6892 kB Inactive:         8504 kB SwapTotal:           0 kB SwapFree:            0 kB Dirty:               0 kB Writeback:           0 kB AnonPages:        4252 kB Mapped:           1656 kB Slab:             6836 kB SReclaimable:     1668 kB SUnreclaim:       5168 kB PageTables:        348 kB NFS_Unstable:        0 kB Bounce:              0 kB CommitLimit:     30708 kB Committed_AS:     7680 kB VmallocTotal:   786388 kB VmallocUsed:      3412 kB VmallocChunk:   782516 kB
 * 1) cat /proc/meminfo

cat /proc/bus/usb/devices

 * 1) cat devices

T: Bus=02 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 2 B: Alloc=  0/900 us ( 0%), #Int=  0, #Iso=  0 D: Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1 P: Vendor=0000 ProdID=0000 Rev= 2.06 S: Manufacturer=Linux 2.6.22 ohci_hcd S: Product=OHCI Host Controller S: SerialNumber=0000:00:04.0 C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr= 0mA I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub E: Ad=81(I) Atr=03(Int.) MxPS=   2 Ivl=255ms

T: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480 MxCh= 2 B: Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0 D: Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=01 MxPS=64 #Cfgs=  1 P: Vendor=0000 ProdID=0000 Rev= 2.06 S: Manufacturer=Linux 2.6.22 ehci_hcd S: Product=EHCI Host Controller S: SerialNumber=0000:00:04.1 C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr= 0mA I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub E: Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms

T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#=  2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=00 Prot=00 MxPS=64 #Cfgs=  1 P: Vendor=0a5c ProdID=bd17 Rev= 0.01 S: Manufacturer=Broadcom S: Product=Remote Download Wireless Adapter S: SerialNumber=000000000001 C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=200mA I:* If#= 0 Alt= 0 #EPs= 4 Cls=ff(vend.) Sub=02 Prot=ff Driver=dbus_usbdev E: Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=125us }}

nvram show
Netgear WNDR3400v2/nvram

CFE

 * CFE is available here (files/CFE/NETGEAR/WNDR3400v2/cfe.bin)