1. Linksys WRTP54G

The Linksys WRTP54G and Linksys RTP300 linux-powered units are Voice-over-IP enabled routers based on the TI AR7 chipsets.

WRTP54G WRTP54G

RTP300 RTP300

Base Hardware

1 Ethernet uplink port, 4x 10/100MBps switch ports, 2 phone jacks

1 Ethernet uplink port, 4x 10/100MBps switch ports, 2 phone jacks

Wifi Support:

54MBps 802.11b/g

None

Linksys webpage

Product Page Downloads

Product Page Downloads

CyberTAN equiv model

WGV614 wgv614

BRV614 brv614

Firmware Releases

1.00.37:

Firmware Image Source Code

Firmware Image Source Code

1.00.43:

Firmware Image No Source

1.00.45:

Firmware Image No Source

1.00.52:

No Firmware Image Source Code

No Firmware Image Source Code

1.00.55:

Firmware Image No Source

Firmware Image No Source

1.00.58:

Firmware Image No Source

Firmware Image No Source

1.00.60:

Firmware Image Source Code

Firmware Image Source Code

1.00.62:

Firmware Image No Source

Firmware Image No Source

1.01.07:

Firmware Image No Source

Firmware Image No Source

3.1.14:

Firmware Image No Source

No Firmware Image No Source

3.1.17:

Firmware Image No Source

Firmware Image No Source

3.1.18.ETSI:

Firmware Image No Source

Firmware Image No Source

3.1.22.ETSI:

Firmware Image No Source

Firmware Image No Source

3.1.23.ETSI:

Firmware Image No Source

No Firmware Image No Source

3.1.24:

Firmware Image No Source

Firmware Image No Source

3.1.24.ETSI

Firmware Image No Source

No Firmware Image No Source

3.1.27.ETSI:

Firmware Image No Source

Firmware Image No Source

5.01.04:

Firmware Image No Source

Firmware Image No Source

1.1. Firmware Dumps for Study

1.2. Misc Notes

See also: AR7Port

1.3. Flash Layout

2. Flash Memory layout of RTP300

The initial flash layout is as follows:

PSPBoot Name

Start

End

Size

BOOTLOADER

0xB0000000

0xB0010000

0x010000 (64K)

boot_env

0xB0010000

0xB0020000

0x010000 (64K)

IMAGE_A

0xB0020000

0xB03F0000

0x3D0000

CONFIG_A

0xB03f0000

0xB0400000

0x010000 (64K)

IMAGE_B

0xB0400000

0xB07d0000

0x3D0000

CONFIG_B

0xB07d0000

0xB07e0000

0x010000 (64K)

0xB07e0000

0xB00f0000

0x010000 (64K)

cyt_private

0xb07f0000

0xb0800000

0x010000 (64K)

This layout is reflected in /dev/mtd as follows: 

dev:    size   erasesize  name
mtd0: 00320000 00010000 "root"                           (3MB - 3,276,800 bytes)
mtd1: 00080000 00010000 "RESERVED_PRIMARY_KERNEL"        (512K - 524,288 bytes)
mtd2: 00320000 00010000 "RESERVED_PRIMARY_ROOT_FS"       (3MB - 3,276,800 bytes)
mtd3: 003d0000 00010000 "RESERVED_PRIMARY_IMAGE"         (3.8MB - 3,997,696 bytes)
mtd4: 003d0000 00010000 "RESERVED_SECONDARY_IMAGE"       (3.8MB - 3,997,696 bytes)
mtd5: 00010000 00010000 "RESERVED_PRIMARY_XML_CONFIG"    (64K - 65,536 bytes)
mtd6: 00010000 00010000 "RESERVED_SECONDARY_XML_CONFIG"  (64K - 65,536 bytes)
mtd7: 00010000 00002000 "RESERVED_BOOTLOADER"            (64K - 65,536 bytes)
mtd8: 00010000 00010000 "cyt_private"                    (64K - 65,536 bytes)

3.1.XX firmwares on first boot run the script /etc/fpar_check which changes the flash layout to the following:

PSPBoot Name

Start

End

Size

BOOTLOADER

0xB0000000

0xB0010000

0x010000 (64K)

boot_env

0xB0010000

0xB0020000

0x010000 (64K)

IMAGE_A

0xB0020000

0xB03E0000

0x3C0000

CONFIG_B

0xB03E0000

0xB03F0000

0x010000 (64K)

CONFIG_A

0xB03f0000

0xB0400000

0x010000 (64K)

IMAGE_B

0xB0400000

0xB07c0000

0x3C0000

fpar

0xB07c0000

0xB07f0000

0x010000 (192K)

cyt_private

0xb07f0000

0xb0800000

0x010000 (64K)

A comment in the script says that fpar' is for "storing sipura-sip voice parameters".

2.1. Additional Notes About Firmware Blocks

2.2. Boot Loader

The boot loader is PSPBoot. The source code of psp_boot is under WAG54GV2_V1.00.19.tgz along with psp_boot user guide

The PSPBoot loader is stored in the first partition of the flash memory. This partition is 64K long.

3. Boot Loader Environment

The PSPBOOT boot loader contains a set of environment variables, some of which are used by the boot loader itself, while others are used by the firmware after boot.

At the serial console (see Serial Console below to learn how to connect to the serial console) the printenv command displays the whole environment while the setenv, unsetenv, and setpermenv commands modify it.

Note: the setpermenv command will write the environment setting into the flash boot area (pspboot)! This will make the environment setting read only. The only way known to undo this process is to re-flash the boot loader. This can be done by making a dump of the flash block, editing out the "perm" environment variables, and then re-flashing. It's been done from within a running system at the shell prompt.

After boot, the boot environment can be read and written through the pseudo-file /proc/ticfg/env. Reading the file returns the environment, one variable per line, with a tab between name and value. Writing a line in the format "name value changes a variable, as long as it is not read-only.

Here is a sample boot environment from an RTP300 as read from /proc/ticfg/env. HWA_0, HWA_1, and SerialNumber have been anonymized. 

BUILD_OPS 0x541
bootloaderVersion 1.3.3.11.2.6
HWRevision 1.00.03
max_try 4
IMAGE_A 0x90020000,0x903f0000
CONFIG_A 0x903f0000,0x90400000
IMAGE_B 0x90400000,0x907d0000
CONFIG_B 0x907d0000,0x907e0000
BOOTCFG_A m:f:"IMAGE_A"
BOOTCFG_B m:f:"IMAGE_B"
HW_COMPANDING linear
FSX_FSR 16
TELE_IF INTERNAL
BOOTLOADER 0x90000000,0x90010000
save_voice_config yes
DSP_CLK 12288000:10
boot_env 0xb0010000,0xb0020000
cyt_private 0xb07f0000,0xb0800000
TELE_ID VE882XX:AUTO
WIFI_LED_GPIO 13
WIFI_LED_RATE 50
SUBNET_MASK 255.255.255.0
MAC_PORT 0
MEMSZ 0x01000000
FLASHSZ 0x00800000
MODETTY 0115200,n,8,1,hw
CPUFREQ 162500000
SYSFREQ 125000000
PROMPT (psbl)
IPA 192.168.6.15
IPA_GATEWAY 192.168.6.254
ProductID CYLL
CONSOLE_STATE locked
TFTPU_STATE OFF
SerialNumber CJM00E5xxxxx
HASH_DIR 8wA2fClJsg
CRYPT_KEY 47035165D59457E16ACA0EFC747AC05C9985F36DDD60B5641B25E1EC581AEFE3
ADMIN_PWD ABPPRAHK55QVA
HWA_0 00:13:10:AC:02:AB
HWA_1 00:13:10:AC:02:AA
BOOTCFG m:f:"IMAGE_A"

If the environment flash partition (the second one) is erased, a default environment will be created using data in the PSPBoot partition as a basis. The default environment seems adequate to boot Linksys firmwares. The only difference noted is that IPA is set to 169.254.87.1.

3.1. CONSOLE_STATE

Setting this variable to "locked" causes PSPBoot to load the firmware without giving the user an oportunity to go to the PSPBoot prompt by pressing escape. Setting it to "unlocked" restores friendly behavior. See the Serial Console section for a way to unlock the console.

3.2. IPA, IPA_GATEWAY, SUBNET_MASK

These variables define the IP settings used by the tftp command. It makes sense to change IPA to "192.168.15.1" since this is the IP address which the standard firmwares assign to the router.

3.3. ProductID

This is a four character code which identifies the hardware. This variable is read-only which means that one must reflash the boot loader in order to change it. Bytes 0x14-0x17 of the firmware file must match this code or you will not be able to install it using the web interface. If you write it to flash by some other means, PSPboot will refuse to load it.

Known ProductID values:

One can trick a device into loading a firmware which was not intended for it by changing the ProductID in the firmware and updating the CRC at the end of it. (Refer to the description of the firmware update file format above.) Loading an incompatible firmware may brick your device, so be careful. In particular, loading an WRTP54G firmware on an RTP300 will brick it, but only when you do a factory reset. The reason for this is that /etc/config.xml in the WRTP54G firmware is incompatible with the RTP300. It seems that a system daemon crashes when it attempts to configure the wireless hardware. As long as the configuration created by the RTP300 firmware remains in place, all is well, but a factory reset copies config.xml into the configuration area. If you do this, you will have to use a serial console to regain access.

3.4. IMAGE_A, CONFIG_A, IMAGE_B, CONFIG_B

The router has room for two firmwares and a configuration area for each. Factory defaults can be restored by formatting the configuration area of the currently active firmware. (There are other ways to do this including a screen in the web interface and holding down the reset button for a few seconds once the device has booted.) The command to clear the conifguration area of the first firmware is:

fmt CONFIG_A

Possible ways to write a new firmware to IMAGE_A or IMAGE_B are described elsewhere in this document.

3.5. BOOTCFG_A, BOOTCFG_B, BOOTCFG

The firmware to be booted is defined by BOOTCFG. The variables BOOTCFG_A and BOOTCFG_B are appearently models for setting BOOTCFG. Unfortunately, no way has been found to directly set BOOTCFG.

BOOTCFG format:

<m|d>:<[f][n]>:<a|”bootfile”>

'm' stands for manual configuration. In this case DHCP will not be invoked. All the configuration must be made manually.

‘d’ stands for DHCP configuration. All valid information that DHCP server provides will be taken.

‘f’ stands for execute image stored in Flash

‘n’ stands for boot from network using TFTP

‘a’ stands for auto boot-file configuration ie. Let the DHCP server provide the filename to boot. This option is invalid if ‘m’ is selected. The boot-file provided by DHCP server can be over-ridden by providing an alternate filename in double-quotes. In case of manual configuration, provision of bootimage name is must.

4. Firmware Source Code Supplied by Linksys

5. Related Sites

6. The Firmwares Supplied by Linksys

All of the known firmwares have the following characteristics in common:

6.1. Characteristics of Firmware Version 1.00.XX

As of September 2006, Vonage loads firmware version 1.00.62. This firmware has the following distinguishing characteristics:

If your phone lines will not register with the SIP server or will not stay registered, check these things:

6.2. Characteristics of Firmware Version 3.1.XX

In July and August 2006 Linksys released firmware 3.1.17 for the WRTP54G-NA and RTP300-NA respectively. Previous versions in the 3.1.XX series, such as 3.1.10 which is floating around the Internet have problems registering with some SIP server or connecting to PPPOE servers.

Firmware 3.1.17 has the following distinguishing characteristics:

6.3. Characteristics of Firmware Version 3.1.22

6.4. Characteristics of Firmware Version 3.1.24-NA

After some experiments with a few WRTP54G-ER units bought in April 2007, further information was gathered about the newer firmware, now at 3.1.24-NA (haven't seen an ETSI version yet). Note that these units were fortunately shipped with the console (serial port) unlocked. So much progress was made without having to resort to JTAG. The SIP processing (ggsip) is dramatically different from the 1.0.xx versions. Here's a brief rundown.

6.5. Characteristics of Firmware Version 5.02.04

In late summer of 2007, Vonage began upgrading RTP300's to firmware version 5.02.04. This firmware is currently being studied. Details will be posted shortly.

7. Customized Firmwares

8. User Accounts in the Official Firmwares

In the default configuration, the RTP and WRTP54G have three usernames, one with each of the defined access levels.

8.1. admin

This user has an access level of "ROUTER". This appears to be the level of access required to log into the top page of the router and to change settings related to the router functions. The default password is "admin".

8.2. user

This user has an access level of "USER". Oddly, this access level permits flashing the firmware whereas level "ROUTER" does not. Accounts with access level "USER" cannot be used to log into the router independently. One must first log in as a user with "ROUTER" level access and then present the username and password of an account with "USER" level access when the prompt "Enter username and password supplied by your service provider" appears.

8.3. Admin

This is the only user represented in /etc/passwd which means that this is the only user that can be used to log in using SSH and on the serial console (the latter when /etc/inittab specifies that /bin/login is to be run on the console rather than /bin/sh). This user has the access level "ADMIN" which also permits flashing the firmware but does not allow independent login.

9. Web Access

The primary way to configure these devices is through a web interface. In the initial configuration the LAN IP address is 192.168.15.1. There is a web server with a management interface running on port 80. The default username is "admin" with a password of "admin". If you find that the web server is not running or the password "admin" is not accepted, you can reset the router to factory defaults by using a paper clip to hold down the reset button while powering the router up. Continue to hold down the reset button for about 50 seconds.

10. SSH Access

Version 1.00.XX firmwares for both the WRTP54G and RTP300 both can run the Dropbear SSH server. This feature must be enable using the web interface. The only username in /etc/passwd is "Admin" (note the upper case A). Reliably setting the password for this account is problematic.

11. Noteworthy Programs and Files in the 3.1.XX Firmware

12. Firmware Update File Format

Here is a partial description of the format of the firmware update file format which is accepted by the web interface and the slightly different format which can be written into flash from the boot loader console (accessible through the serial interface).

Most firmware files intended to be written directly into flash are 3,866,624 (0x03B0000) bytes long. A firmware uploaded through the web interface will be eight bytes longer.

12.1. Working with Firmware Files

Here are programs which you can use for packing and unpacking firmware image files:

extractwrtp extracts the firmware into the following files:

buildwrtp builds the firmware by combining kernel partition and root partition

12.2. Working with the Squashfs

Standard Linux kernels cannot mount the squashfs file system and the standard mksquashfs can not generate it because the compression method is LZMA instead of Zlib. To pack and unpack these squash file systems, you can use the patched copy of Squashfs Tools 1.3r3 linked to below:

unsquashfs-lzma can be used to extract the files from a root partition image (previously extracted from a firmware image file) into a directory

mksquashfs-lzma packs the contexts of a directory into a root partition image which can subsequently be packed into a firmware image file

Better instructions for building the Squashfs tools with LZMA support can be found at http://www.beyondlogic.org/nb5/squashfs_lzma.htm.

13. Configuration File Format

The configuration of the router is stored in a single XML file. This file is stored compressed in a raw flash partition. If when the router boots the flash partition is found to be empty, the configuration is initialized by loading /etc/config.xml from the root partition.

The configuration can be extracted using the web interface (Administration/Management/Backup and Restore). The configuration file produced by the backup function is incomplete. Particularly, it omits the voice configuration. The backup configuration file format is as follows:

14. Serial Console

________________________________________
|                                         |
|                                         led
|                   Pin 1: GND   ---> @   |
|                                         led
|         Pin 2: Not Connected   ---> @   |
|                                         led
|                   Pin 3: RX   ----> @   |                 Front of RTP300 or WRTP54G
|                                         led
|                   Pin 4: TX   ----> @   |
|                                         |
|                   Pin 5: VCC  ----> @   led
|                                         |
|                                         |
|                                         |
 \________________________________________|

Do not connect the router's serial port directly to your computer's RS232 port. The signal voltage levels are not the same and you may damage the router's serial port. This is because your computer's serial port has a line driver which converts the computer's signal voltage levels to RS232 levels while the line driver was left out of the router to save money. So, you will have to attach a line driver to your router and plug your computer into the line driver. If you are handy with a soldering iron you can order a AD233AK 233A kit and assemble it to make a line driver.

The default settings for the serial port are 115200 BPS, 8 bit words, no parity, hardware flow control. These settings may be changable by setting the boot environment variable MODETTY.

The serial port is the boot loader console. If the boot-loader environment variable CONSOLE_STATE is set to "unlocked" (rather than "locked") then you will have three seconds to stop the boot (by pressing ESC) and receive a boot loader prompt. If you manage to get shell, you could try the following to unlock the PSPBoot console with this command: 

# echo "CONSOLE_STATE unlocked" >/proc/ticfg/env

You should try to do this as soon as you can since you may need to use the serial console to recover after flashing a bad firmware. If it is not unlocked, your ownly remaining option is to use a JTAG cable to read the environment block, use a hex editor to change "locked" to "unlocked" (followed by a 0 byte) and write the environment block back to flash.

Most if not all firmwares allow login on the serial port once they are booted. Some run /bin/login whereas others simply run /bin/sh. The 3.1.10 firmware which is floating around the internet, though said to be unstable, does have the advantage that it accepts "Admin" as a username with a blank password. Once you have logged into a running firmware you can change CONSOLE_STATE with the command:

15. JTAG

JTAG is a standard way to gain access to the system bus of an embedded device. It can be used to reprogram the flash even if the boot loader has been damaged. The AR7 implements ejtag version 2.6.

15.1. WRTP54G JTAG Pinout

__________________________________________
|                     J3                  |
|                                         led
| Pin 1: TRST  ----> @   @ <-- Pin 2:GND  |
|                                         led
| Pin 3: TDI   ----> @   @ <-- Pin 4:GND  |
|                                         led
| Pin 5: TDO   ----> @   @ <-- Pin 6:GND  |
|                                         led
| Pin 7: TMS   ----> @   @ <-- Pin 8:GND  |   Front of WRTP54G
|                                         |
| Pin 9: TCK   ----> @   @ <-- Pin 10:GND led
|                                         |
| Pin 11:RST   ----> @   @ <-- Pin 12:NC  |
|                                         |
| Pin 13:DINT  ----> @   @ <-- Pin 14:VIO*|
 \________________________________________|
    *voltage reference @ 3.3 volts

This ejtag layout should apply to all ar7 based boards with a 14 pin jtag pinout. The same cable as used for the wrt54g (based on the xilinx III/dlc-5) as described by HairyDairyMaid can be used with the RTP300. Debug INT pin 13 is optional. A 100 Ohm resister should be connected between pins 1 and 14.

A patched version of the JTAG utility written by HairyDairyMaid for the WRT54G can be used to reprogram the flash. A link to it and instructions will be posted here shortly.

Writing to flash using JTAG and a passive cable is slow. Writing a firmware would take hours. For this reason it is generally use only to repair the boot loader. Once the boot loader is working again, the TFTP client in the boot loader can be used to flash a new firmware much more quickly.

16. Firmware Flashing

There are several proven ways to write a new firmware into flash:

It is presumably possible to write a firmware using JTAG, but it would be very slow, at least if one uses a passive cable connected to a computer's parallel port.

The PSPBoot page suggests that there is a one second window during PSPBoot startup during which a TFTP server is ready to accept a new firmware named upgrade_code.bin, but this feature does not seem to be included in the build of PSPBoot installed on the RTP300.

16.1. Using the Web Interface

This method ranges from very easy to somewhat tricky depending on what firmware is currently installed. The basic procedure is as follows:

  1. Connect a computer to one of the yellow ports of the router
  2. Set the computer to gets its IP address by DHCP and make sure it does so before proceeding

  3. Connect to http://192.168.15.1 using a web browser. If it does not respond, hold down the router's reset button for at least five seconds. When it reboots, try again.

  4. Log in using the default username and password of "admin" and "admin"
  5. Click on the "Administration" tab

  6. Click on the "Firmware Update" tab. If there is no "Firmware Update" tab, enter http://192.168.15.1/update.html in your browser's location bar.

  7. Log in as a user who is permitted to update the firmware. For NA firmwares the username should be "Admin" with a blank password or "user" with a password of "user". For routers with version 3.1.14 Earthlink firmware, the username is "Admin" with a password of "sP0dfub2" (exact capitalization matters). If your router was last used with Vonage, you can set a username of "user" and a password of "tivonpw" by following this procedure:
    1. Plug the router into the Internet if it is not plugged in already.
    2. Got to Administration tab and choose Factory Defaults. Choose "Restore Router Defaults" and "Restore Voice Defaults"
    3. Enter a username of "user" and a password of "tivonpw"
    4. Give the router a minute to reboot and then return to step three.

  8. Click on Browse and choose a firmware image. (If you get an error page instead of the firmware upgrade page, enter http://192.168.15.1/update.html into your browser's location bar. Some firmwares have a broken link.)

  9. If the Internet cable is connected to the router, disconnect it.
  10. Click on Update. A progress bar will move accross the screen. When the bar reaches about 10% the product ID will be checked. After it reaches 100%, the CRC will be checked. If both of these hurdles are passed, a screen will appear announcing that the device is rebooting.

  11. If your router was last used with Vonage, log in again and go to Administration->Factory Defaults and reset both router and voice defaults again. The router has two configuration areas, and the old settings may not be cleared out of active configuration area. If they are not, the router may download and install a firmware that you do not want.

  12. Reconnect the router to the Internet.

If the web server does not respond in step three, or the default password does not work in step four, make sure the router has been powered up for at least 50 seconds and then hold down the reset button for at least five seconds. The router will restore its factory defaults and reboot. Return to step three.

16.2. Seting a Firmware Update URL on the Provisioning Page

VOIP providers can configure these routers to periodically download a VOIP configuration file. This file contains VOIP settings and login credentials for the provider's SIP server. This process is called "provisioning". The "provisioning" file can also instruct the router to download and install a new firmware. The Provisioning page in the web interface can also be used to initiate this process. This may be helpful if you loose access the firmware upgrade page but still have access to the Provisioning page. Here is the procedure for the 3.1.XX series firmware:

The firmware should be in the same format as for upgrading through the web interface.

16.3. From a Firmware Shell Prompt (the hard way)

You can use this procedure only if you have access to a shell running on the router. Access is generally obtained either by connecting to the route's serial port or to its SSH server.

Using this procedure, you can write a firmware into one of the two firmware partitions. Note that while you can overwrite the running firmware and reboot, it may not be a safe practice. One can presumably overwrite the inactive firmware, but it is unclear how to then make it the active firmware. This procedure describes how to overwrite the inactive firmware.

Unfortunately, setting BOOTCFG does not seem to work. The only known way to set it is to delete the active firmware (after writing a new one).

One could simply overwriting the active firmware (using /dev/mtd/3) but it is not recommended since it could crash if something needs to be paged in. At the very least you should have a serial console and set CONSOLE_STATE to "unlocked" (and verify it works) before doing this.

16.4. From a Firmware Prompt (the easy way)

A much easier way to flash a new firmware from the router shell prompt has recently been discovered.

You can use this procedure only if you have access to a shell running on the router. Access is generally obtained either by connecting to the route's serial port or to its SSH server. 

# cd /var
# wget http://myhost/dir/flash_erase
# chmod 755 erase
# wget http://myhost/dir/rtp300-XXXXX.bin
# dd if=rtp300-XXXXX.bin of=/var/tmp/fw.bin

If the new firmware is accepted, it will be written to the inactive flash partition, the active configuration partition will be copied to the inactive one, BOOTCFG will be set to boot from the new firmware (exactly how is unclear), and the router will reset and the new firmware will be bootstrapped.

16.5. From the PSPBoot prompt

In order to use this method you must obtain or make a voltage converterting cable for your router's serial port and hook it up as described in the section Serial Port. You must also change the value of CONSOLE_STATE as described in the same section. Since you need shell access to the router in order to change CONSOLE_STATE, you will not be able to use this method unless the existing firmware allows shell access or you set CONSOLE_STATE when you last had access.

The PSPBoot boot loader has predefined environment variables called IMAGE_A and IMAGE_B which contain the start and stop addresses of the mtd3 and mtd4 flash partitions. A new firmware can be loaded into one of the spaces by formatting the space and copying in a properly formated firmware file using TFTP. For example, if you have a firmware called new_firmware.bin on a TFTP server on a computer attached to one of the yellow ports with an IP address of 192.168.15.100, the commands are like this: 

(psbl) setenv IPA 192.168.15.1
(psbl) fmt IMAGE_A
FlashEraseBlock(b0020000,b03dffff);
............................................................
(psbl) tftp -i 192.168.15.100 new_firmware.bin IMAGE_A
......................................................

Flashing the firmware in this way is much slower than flashing it through the web interface, but much faster than through JTAG.

If your TFTP server is not in the same subnet or the subnet mask is not 255.255.255.0 you will have to set additional environment variables as described under Boot Loader Environment.

16.6. Locked Out

It is fairly easy to lock yourself out of the router by setting a bad password or installing a bad firmware. Please add tips for regaining access to this section.

16.6.1. Unlocking Tools

The CYT Device Unlock tools were written in order to gain access to routers previously used with Vonage. This tool resets the password for the Admin account and the user account so that you can have access to the firmware upgrade screens and the SIP settings. Note that this tool clears all settings, not just the passwords. This is the current URL location for the tool:

http://www.bargainshare.com/index.php?showtopic=87504

16.6.2. Ping Hack

[To be written.]

OpenWrtDocs/Hardware/Linksys/WRTP54G (last edited 2008-06-18 17:43:48 by DavidChappell)

Almost all of these pages are editable, create an account and click the edit (Edit) button at the top of the page.