Plexus ADSL2+ Wireless Modem Router & 4-port Switch

[thechief]

Anyone seen this: http://www.ebuyer.com/product/132428

Is it any good? Can't find much on it on Google ...

[jimp]

I'm guessing its one of these:
http://tenda.manufacturer.globalsources ... /Modem.htm
or
http://www.tenda.cn/product/show.php?productid-270.html
I didn't notice any specifics on the chipset used, but the above might help a bit with the googling.

[thechief]

Looks like it may be the same (well, at least, from the outside). No information about chipsets though. Still, someone may find it useful.

[Shotokan101]

One menrtions a 200MHZ CPU - nut obviously not the type.....

[thechief]

I think the chipset is Broadcom. I am guessing that, based on stuff I read here:
http://www.sahandrayan.com/Network_equipment.htm

[Neo]

I have split some posts so that the discussion doesn't get mixed up between the two products

[thechief]

Cool

[jimp]

This also seems to confirm the broadcom nature of the beast.
LINK

The translation from Chinese includes the remarkably helpful " This antenna is not demolished"...

It does seem very cheap at £25 for all that functionality, but ebuyer often put things on their site at the cheapest price they can then put it up a few days later - I wouldn't be surprised if it costs more tomorrow.

Edit by Neo: Replaced very long URL

[symicron]

I have one of these and have can confirm they are definitely based on the broadcom chipset BCM96348. the ebuyer product is the tenda Tenda TWL548D. below is the information I have gathered from the unit so far.
If you want to get a shell, login as admin (password admin) on the telnet port and type "sh" at the prompt.

CFE version 1.0.37-8.7 for BCM96348 (32bit,SP,BE)
Build Date: Mon Nov 13 14:49:29 PST 2006 (root@DT-lt-linux)
Copyright (C) 2000-2006 Broadcom Corporation.

Boot Address 0xbf000000

Initializing Arena.
Initializing Devices.
Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB
Auto-negotiation timed-out
10 MB Half-Duplex (assumed)
CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz
Total memory: 16777216 bytes (16MB)

Total memory used by CFE: 0x80401000 - 0x805248C0 (1194176)
Initialized Data: 0x8041C290 - 0x8041E100 (7792)
BSS Area: 0x8041E100 - 0x804228C0 (18368)
Local Heap: 0x804228C0 - 0x805228C0 (1048576)
Stack Area: 0x805228C0 - 0x805248C0 (8192)
Text (code) segment: 0x80401000 - 0x8041C290 (111248)
Boot area (physical): 0x00525000 - 0x00565000
Relocation Factor: I:00000000 - D:00000000

Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-8) : 96348GW-10
Number of MAC Addresses (1-32) : 11
Base MAC Address : 00:b0:0c:00:61:62
PSI Size (1-64) KBytes : 24

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Code Address: 0x80010000, Entry Address: 0x801af018
Decompression OK!
Entry at 0x801af018
Closing network.
Starting program at 0x801af018
Linux version 2.6.8.1 (root@linux-lfvd) (gcc version 3.4.2) #1 Sat Oct 20 10:137
Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB
Total Flash size: 4096K with 71 sectors
96348GW-10 prom init
CPU revision is: 00029107
Determined physical RAM map:
memory: 00fa0000 @ 00000000 (usable)
On node 0 totalpages: 4000
DMA zone: 4000 pages, LIFO batch:1
Normal zone: 0 pages, LIFO batch:1
HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 64 (order 6: 512 bytes)
Using 128.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 13924k/16000k available (1442k kernel code, 2056k reserved, 213k data, )
Calibrating delay loop... 254.77 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction... unavailable.
NET: Registered protocol family 16
Can't analyze prologue code at 80177254
Initializing Cryptographic API
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v1.0
brcmboard: brcm_board_init entry
SES: Button Interrupt 0x3 is enabled
RESET: Button Interrupt 0x4 is enabled
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
Initializing IPsec netlink socket
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 72k freed
init started: BusyBox v1.00 (2007.10.20-02:18+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5


BusyBox v1.00 (2007.10.20-02:18+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.


Loading drivers and kernel modules...

atmapi: module license 'Proprietary' taints kernel.
adsl: adsl_init entry
blaadd: blaa_detect entry
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6348B0 Ethernet Network Device v0.3 Oct 20 2007 10:11:23
Config Internal PHY Through MDIO
Start mii_soft_reset
BCM63xx_ENET: Auto-negotiation timed-out
BCM63xx_ENET: 10 MB Half-Duplex (assumed)
eth0: MAC Address: 00:B0:0C:00:61:62
Broadcom BCM6348B0 Ethernet Network Device v0.3 Oct 20 2007 10:11:23
Config Ethernet Switch Through MDIO Pseudo PHY Interface
Start mii_soft_reset
Start mii_soft_reset
Start mii_soft_reset
Start mii_soft_reset
Start mii_soft_reset
dgasp: kerSysRegisterDyingGaspHandler: eth1 registered
eth1: MAC Address: 00:B0:0C:00:61:63
Broadcom BCM6348B0 USB Network Device v0.4 Oct 20 2007 10:11:25
usb0: MAC Address: 00 B0 0C 00 61 64
usb0: Host MAC Address: 00 B0 0C 00 61 65
PCI: Setting latency timer of device 0000:00:01.0 to 64
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
wl: srom not detected, using main memory mapped srom info (wombo board)
wl0: wlc_attach: use mac addr from the system pool by id: 0x776c0000
wl0: MAC Address: 00:B0:0C:00:61:66
wl0: Broadcom BCM4318 802.11 Wireless Controller 3.131.35.6.cpe2.0
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
BcmAdsl_Initialize=0xC00653F8, g_pFnNotifyCallback=0xC007D5F4
pSdramPHY=0xA0FFFFF8, 0xF2C1 0xDEADBEEF
AdslCoreHwReset: AdslOemDataAddr = 0xA0FFD274
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
ATM proc init !!!

==> Bcm963xx Software Version: 3.08L.01.A2pB022c.d19g <==

device usb0 entered promiscuous mode
device eth0 entered promiscuous mode
br0: port 2(eth0) entering learning state
br0: port 1(usb0) entering learning state
br0: topology change detected, propagating
br0: port 2(eth0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(usb0) entering forwarding state
device eth1 entered promiscuous mode
br0: port 3(eth1) entering learning state
br0: topology change detected, propagating
br0: port 3(eth1) entering forwarding state
Setting SSID "Default"
Setting SSID "Guest"
Setting country code using abbreviation: "GB"
wl0: current channel 6
device wl0 entered promiscuous mode
br0: port 4(wl0) entering learning state
br0: topology change detected, propagating
br0: port 4(wl0) entering forwarding state
device wl0.1 entered promiscuous mode
br0: port 5(wl0.1) entering learning state
br0: topology change detected, propagating
br0: port 5(wl0.1) entering forwarding state
device usb0 left promiscuous mode
br0: port 1(usb0) entering disabled state
device usb0 entered promiscuous mode
br0: port 1(usb0) entering learning state
br0: topology change detected, propagating
br0: port 1(usb0) entering forwarding state
device eth0 left promiscuous mode
br0: port 2(eth0) entering disabled state
device eth0 entered promiscuous mode
br0: port 2(eth0) entering learning state
br0: topology change detected, propagating
br0: port 2(eth0) entering forwarding state
device eth1 left promiscuous mode
br0: port 3(eth1) entering disabled state
device eth1 entered promiscuous mode
br0: port 3(eth1) entering learning state
br0: topology change detected, propagating
br0: port 3(eth1) entering forwarding state
device wl0 left promiscuous mode
br0: port 4(wl0) entering disabled state
device wl0 entered promiscuous mode
br0: port 4(wl0) entering learning state
br0: topology change detected, propagating
br0: port 4(wl0) entering forwarding state
device wl0.1 left promiscuous mode
br0: port 5(wl0.1) entering disabled state
device wl0.1 entered promiscuous mode
br0: port 5(wl0.1) entering learning state
br0: topology change detected, propagating
br0: port 5(wl0.1) entering forwarding state
BcmSntp_serverRestart -> cmd [sntp -s clock.fmt.he.net -t "Casablanca, Monrovia]
BcmSntp_serverRestart -> return 1
BcmSntp_serverRestart -> return 0

******************
Welcome , Tenda TWL548D Httpd Loading ...
***********************

******************
Welcome , Tenda TWL548D Httpd Loading ...
***********************
sntp: host not found
br0: port 2(eth0) entering disabled state
br0: port 3(eth1) entering disabled state
br0: port 1(usb0) entering disabled state



------------------------


*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
web info: Waiting for connection on socket 0.
CFE>
CFE>
CFE>
CFE>
CFE>
CFE>
CFE> help
Available commands:

w Write the whole image start from beginning of the flash
e Erase [n]vram or [a]ll flash except bootrom
r Run program from flash image or from host depend on [f/h] fg
p Print boot line and board parameter info
c Change booline parameters
f Write image to the flash
i Erase persistent storage data
b Change board parameters
reset Reset the board
flashimage Flashes a compressed image after the bootloader.
help Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0
CFE> p
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-8) : 96348GW-10
Number of MAC Addresses (1-32) : 11
Base MAC Address : 00:b0:0c:00:61:62
PSI Size (1-64) KBytes : 24

*** command status = 0
CFE>

---------------------------------


CONSOLED launched

Login: admin
Password: admin

Note: If you have problem with Backspace key, please make sure you configure yo.


Main Menu

1. ADSL Link State
2. LAN
3. WAN
4. DNS Server
5. Route Setup
6. NAT
7. Firewall
8. Quality Of Service
9. Management
10. Passwords
11. Diag
12. Reset to Default
13. Save and Reboot
14. Exit
-> sh


BusyBox v1.00 (2007.10.20-02:18+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

#
# ps
PID Uid VmSize Stat Command
1 admin 280 S init
2 admin SWN [ksoftirqd/0]
3 admin SW< [events/0]
4 admin SW< [khelper]
5 admin SW< [kblockd/0]
17 admin SW [pdflush]
18 admin SW [pdflush]
19 admin SW [kswapd0]
20 admin SW< [aio/0]
25 admin SW [mtdblockd]
34 admin 320 S -sh
72 admin 1096 S cfm
104 admin 168 S pvc2684d
362 admin 264 S dhcpd
450 admin 312 S syslogd -C -R 192.168.0.136:514 -r 7 -l 7
455 admin 196 S sntp -s clock.fmt.he.net -t Casablanca, Monrovia
456 admin 252 S klogd
463 admin 1216 S httpd
504 admin 1168 S consoled
505 admin 284 S sh -c sh
506 admin 308 S sh
507 admin 264 R ps
# help

Built-in commands:
-------------------
. : break cd continue eval exec exit export help login newgrp
read readonly set shift times trap umask wait [ busybox cat chmod
date df dmesg echo expr false ftpget ifconfig init insmod kill
klogd linuxrc ln logger logread ls lsmod mkdir mount msh ping
ps pwd reboot rm rmmod route sendarp sh sysinfo syslogd test
tftp tftpd top true tty vconfig vi

# sysinfo
Number of processes: 22
12:09am up 9 min,
load average: 1 min:0.00, 5 min:0.00, 15 min:0.00
total used free shared buffers
Mem: 14016 11324 2692 0 1200
Swap: 0 0 0
Total: 14016 11324 2692
# passwd
passwd: not found
# ls /
bin etc linuxrc proc usr webs
dev lib mnt sbin var
# ls /proc/version
/proc/version
# cat /proc/version
Linux version 2.6.8.1 (root@linux-lfvd) (gcc version 3.4.2) #1 Sat Oct 20 10:13:02 CST 2007
# ls /proc
1 362 516 execdomains locks stat
104 4 72 filesystems meminfo sys
17 450 buddyinfo fs misc sysvipc
18 455 bus interrupts modules tty
19 456 cmdline iomem mounts uptime
2 463 cpuinfo ioports mtd var
20 5 crypto irq net version
25 504 devices kcore partitions vmstat
3 505 diskstats kmsg self
34 506 driver loadavg slabinfo
# df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/mtdblock0 2560 2560 0 100% /
tmpfs 320 104 216 33% /var
# cat /etc/fstab
proc /proc proc defaults 0 0
tmpfs /var tmpfs size=320k 0 0
/dev/sda1 /mnt vfat noauto 0 0
# ls /etc
adsl group ppp snmp
certs inetd.conf pppmsg sysmsg
default.cfg init.d profile udhcpd.conf
dhcp inittab psk.txt udhcpd.leases
ethertypes ipsec.conf racoon.conf voice
fstab modules_install resolv.conf wlan
gateway.conf passwd services
#
# ls /proc
1 362 527 execdomains locks stat
104 4 72 filesystems meminfo sys
17 450 buddyinfo fs misc sysvipc
18 455 bus interrupts modules tty
19 456 cmdline iomem mounts uptime
2 463 cpuinfo ioports mtd var
20 5 crypto irq net version
25 524 devices kcore partitions vmstat
3 525 diskstats kmsg self
34 526 driver loadavg slabinfo
# cat /proc/cpuinfo
system type : 96348GW-10
processor : 0
cpu model : BCM6348 V0.7
BogoMIPS : 254.77
wait instruction : no
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : yes
hardware watchpoint : no
VCED exceptions : not available
VCEI exceptions : not available
# cat /proc/devices
Character devices:
1 mem
2 pty
3 ttyp
4 ttyS
5 /dev/tty
5 /dev/console
10 misc
108 ppp
205 atmapi
206 bcrmboard
208 adsl
212 bcm

Block devices:
31 mtdblock
# cat /proc/interrupts
CPU0
4: 0 MIPS brcm_4
6: 0 MIPS brcm_6
7: 11058515 MIPS timer
10: 1823 MIPS brcm_10
12: 140416 MIPS brcm_12
13: 0 MIPS brcm_13
14: 0 MIPS brcm_14
17: 0 MIPS brcm_17
22: 0 MIPS brcm_22
24: 0 MIPS brcm_24
28: 0 MIPS brcm_28
30: 0 MIPS brcm_30
32: 2196803 MIPS brcm_32
33: 0 MIPS brcm_33

ERR: 0
# cat /proc/ioports
12000000-1200ffff : bcm63xx pci IO space
# cat /proc/meminfo
MemTotal: 14016 kB
MemFree: 2664 kB
Buffers: 1200 kB
Cached: 5172 kB
SwapCached: 0 kB
Active: 3400 kB
Inactive: 3816 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 14016 kB
LowFree: 2664 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
Mapped: 2160 kB
Slab: 2744 kB
Committed_AS: 2884 kB
PageTables: 220 kB
VmallocTotal: 1048560 kB
VmallocUsed: 936 kB
VmallocChunk: 1046820 kB
# cat /proc/filesystems
nodev sysfs
nodev rootfs
nodev bdev
nodev proc
nodev sockfs
nodev tmpfs
nodev pipefs
squashfs
nodev ramfs
# cat /proc/partitions
major minor #blocks name

31 0 2544 mtdblock0
# cat /proc/iomem
00000000-00f9ffff : System RAM
00010000-00178a03 : Kernel code
00178a04-001ae0bf : Kernel data
10000000-10ffffff : bcm63xx pci memory space
10000000-1000ffff : 0000:00:01.0
# cat /etc/fstab
proc /proc proc defaults 0 0
tmpfs /var tmpfs size=320k 0 0
/dev/sda1 /mnt vfat noauto 0 0
# ls /proc/fs
nfsd
# cat /proc/mounts
rootfs / rootfs rw 0 0
/dev/root / squashfs ro 0 0
/proc /proc proc rw,nodiratime 0 0
tmpfs /var tmpfs rw 0 0
#
# lsmod
Module Size Used by
wl 522928 0 - Live 0xc0132000
bcm_usb 15952 0 - Live 0xc000c000
bcm_enet 23376 0 - Live 0xc0045000
bcmprocfs 12320 0 - Live 0xc0014000
br2684 62272 0 - Live 0xc0034000
blaa_dd 6880 0 - Live 0xc0011000
adsldd 138416 0 - Live 0xc0064000
atmapi 56160 3 br2684,blaa_dd,adsldd, Live 0xc0025000
#
# cat /proc/mtd
dev: size erasesize name
mtd0: 0027c000 00004000 "Physically mapped flash"
#

Some of the documentation is a bit sparse, ie the port mapping !!, however the shell based wl utility is very good.
Any one know of any firmware that will run on this unit, or the format of the flash blocks.

[NoreGister]

Does anyone know how to permanently change the MTU values on this router. Is it stored in a config file that is editable?

I can do it via ifconfig but these get lost when I power cycle the router.

[AMD79]

Can this router be use with routertech firmware? Just asking cause got one unit lying around.

[Shotokan101]

Can this router be use with routertech firmware? Just asking cause got one unit lying around.

Have you tried running the RUC utility ?

viewtopic.php?f=19&t=1062

JIm