User Tools

Site Tools


Comtrend CT-5621 / CT-5621T

CT-5621 is almost identical to CT-5621T. But the CT-5621 comes with a "Console" rj45 style port wired to the internal serial port at the board.

CT-5621T Front:

CT-5621T Back (with aftermarket serial port and sticky note):

CT-5621 Back

This is an ADSL2+ Modem + 4-port Switch with USB (it can act as a USB network device). It is manufactured by Comtrend who, as best I can determine from their voice prompts for assistance, only sell their equipment to ISP's and Telcos, thus bypassing regular users as customers and therefore recipients of source code.

Hardware Highlights

SoC CPU speed Ram Flash Network USB Client USB Host Serial JTag
Broadcom 6348 256MHz 16MiB 4MiB 4 x 1 Yes Yes* Yes Yes

(*requires hardware modifications)

Note: currently OpenWrt does not support the Broadcom ADSL modem in this device, so it can be used as a router only.



On some models it may be necessary to connect to the internal serial port and use the CFE prompt to change the board ID, or else the OpenWrt kernel will panic shortly after startup due to not recognizing the board. (If this happens and you don't want to wire a serial port, you can still hold Reset during startup to get into CFE - recognizable by red power LED - and upload another firmware via the web interface.)

Flash Layout

Please check out the article Flash.Layout. It contains an example and a couple of explanations.

OEM easy installation

  • Unplug the power cord (or use the on/off switch if one is present).
  • Press the reset button, don't release it yet!
  • Plug the power cord.
  • Wait 10 seconds.
  • Release the reset button.
  • Upload .bin file to router.
  • Upgrade the image.
  • Wait for it to reboot.
  • Telnet to and set a root password, or browse to if LuCI is installed.

OEM installation using the TFTP method

If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.

Upgrading OpenWrt


If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

LuCI Web Upgrade Process

Terminal Upgrade Process

  • Login as root via SSH on
  • Use the following commands to upgrade.

cd /tmp/
sysupgrade /tmp/

  • If sysupgrade does not support this router, use the following commands.

cd /tmp/
mtd write /tmp/ linux && reboot

Basic configuration

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

Specific Configuration


The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi
eth0 LAN ports (1 to 4) None

Switch Ports (for VLANs)

This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 will be the Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on.

Port Switch port Mode
LAN 1 0 lan
LAN 2 1 lan
LAN 3 2 lan
LAN 4 3 Internet (WAN)

# path: /etc/config/network
# port 4 = WAN

config interface loopback
        option ifname   lo
        option proto    static
        option ipaddr
        option netmask

config interface lan
        option type     bridge
        option ifname   eth0.0
        option proto    static
        option ipaddr
        option netmask
        option nat      1

config interface wan
        option ifname 	eth0.1
        option macaddr 	00:11:22:33:44:55
        option proto 	dhcp 
        option defaultroute 1

config switch eth0
	option enable	1
	option reset	1
	option enable_vlan 1

config switch_vlan
	option device 	eth0
	option vlan 	0
	option ports 	"0 1 2 5t"

config switch_vlan
	option device 	eth0
	option vlan 	1
	option ports 	"3 5t"

Failsafe mode


hardware.button on howto use and configure the hardware button(s).

The Comtrend 5621 has one button. It is the Reset.

Reset reset


Stock firmware (2.4.17 kernel)

CFE version 1.0.37-5.17 for BCM96348 (32bit,SP,BE) Build Date: Tue, 19 Oct 2004 12:02:54 +0800 (root@junhon_linux) Copyright (C) 2000,2001,2002,2003 Broadcom Corporation. Initializing Arena. Initializing Devices. init 5325E: init mii=0 init 5325E: init success, mii=9f CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz Total memory used by CFE: 0x80401000 - 0x80521DF0 (1183216) Initialized Data: 0x8041C740 - 0x8041E1B0 (6768) BSS Area: 0x8041E1B0 - 0x8041FDF0 (7232) Local Heap: 0x8041FDF0 - 0x8051FDF0 (1048576) Stack Area: 0x8051FDF0 - 0x80521DF0 (8192) Text (code) segment: 0x80401000 - 0x8041C73C (112444) Boot area (physical): 0x00522000 - 0x00562000 Relocation Factor: I:00000000 - D:00000000 Board IP address : Host IP address : Gateway IP address : Run from flash/host (f/h) : f Default host run file name : openwrt-brcm63xx-vmlinux.elf Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 5 Board Id Name : 96348GW-11 Psi size in KB : 24 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:30:da:47:bd:b4 Ethernet PHY Type : External Using Reverse MII with SPI Memory size in MB : 16 *** Press any key to stop auto run (5 seconds) *** Auto run second count down: 5543210 Code Address: 0x80010000, Entry Address: 0x8001046c Decompression OK! Entry at 0x8001046c Closing network. Starting program at 0x8001046c Total Flash size: 4096K with 71 sectors Scratch pad is not used for this flash part. 96348GW-11 prom init CPU revision is: 00029107 Primary instruction cache 16kb, linesize 16 bytes (2 ways) Primary data cache 8kb, linesize 16 bytes (2 ways) Linux version 2.4.17 (root@max-redhat) (gcc version 3.1) #1 ¥| 12¤ë 2 04:34:28 CST 2004 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 zone(0): 4000 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/mtdblock0 ro bcm_console_setup Calibrating delay loop... 255.59 BogoMIPS Memory: 14236k/16000k available (1144k kernel code, 1764k reserved, 80k data, 48k init, 0k highmem) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX mpi: No Card is in the PCMCIA slot PCI: Fixing up bus 0 Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd brcmboard: brcm_board_init entry Module bcm63xx_cons.c v1.1 Dec 2 2004 04:34:57 block: 64 slots per queue, batch=16 PPP generic driver version 2.4.1 NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) Linux IP multicast router 0.06 plus PIM-SM NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. Ebtables v2.0 registeredNET4: Ethernet Bridge 008 for NET4.0 802.1Q VLAN Support v1.6 Ben Greear vlan Initialization complete. VFS: Mounted root (cramfs filesystem) readonly. Freeing unused kernel memory: 48k freed init started: BusyBox v0.60.4 (2004.12.01-20:44+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v0.60.4 (2004.12.01-20:44+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... atmapi: init_module entry 0xc0006060 blaadd: blaa_detect entry adsl: adsl_init entry var 1.0 initialised Broadcom BCM6348A2 Ethernet Network Device v0.1 Dec 2 2004 04:40:06 External Switch Reverse MII (SPI Device 1) eth0: MAC Address: 00:30:DA:47:BD:B4 Broadcom BCM6348A2 USB Network Device v0.3 Dec 2 2004 04:40:08 usb0: MAC Address: 00 30 DA 47 BD B5 usb0: Host MAC Address: 00 30 DA 47 BD B6 insmod: init_module: wl: No such device BcmAdsl_Initialize=0xC0018418, g_pFnNotifyCallback=0xC002CCB0 AdslCoreHwReset: AdslOemDataAddr = 0xA0FE4D5C ==> Bcm963xx Software Version: A101-221CTL-C01_R04.A2pB017f.d15 <== device usb0 entered promiscuous mode br0: port 1(usb0) entering listening state br0: port 1(usb0) entering learning state br0: port 1(usb0) entering forwarding state br0: topology change detected, propagating device eth0 entered promiscuous mode br0: port 2(eth0) entering listening state br0: port 2(eth0) entering learning state br0: port 2(eth0) entering forwarding state br0: topology change detected, propagating pvc2684d: Interface "nas_0_35" created sucessfully atm_connect (TX: cl 1,bw 0-0,sdu 1524; RX: cl 1,bw 0-0,sdu 1524,AAL 5) pvc2684d: Communicating over ATM 0.0.35, encapsulation: LLC device nas_0_35 entered promiscuous mode br0: port 3(nas_0_35) entering listening state br0: port 3(nas_0_35) entering learning state br0: port 3(nas_0_35) entering forwarding state br0: topology change detected, propagating eth0 Link UP. Message from syslogd@router at Jan 23 16:34:40 ... BCM96345 started: BusyBox v0.60.4 (2004.12.01-20:44+0000) sntp: host not found Message from syslogd@router at Jan 23 16:34:41 ... klogd: 802.1Q VLAN Support v1.6 Ben Greear> br0: port 1(usb0) entering disabled state ADSL G.994 training ADSL G.992 started ADSL G.992 channel analysis ADSL G.992 message exchange ADSL link up, interleaved, us=800, ds=6016 PPP: PPP0_35_1 Start to connect ... PPP: PPP0_35_1 Connection Up. Primary DNS server = Secondary DNS server =

kamikaze (2.6.27 kernel)

0x80010000/3644617 0x80389cc9/141127 Entry at 0x80014450 Closing network. Starting program at 0x80014450 Linux version (daniel@brennin) (gcc version 4.1.2) #3 Fri Jan 23 07:01:13 EST 2009 Detected Broadcom 0x6348 CPU revision a2 CPU frequency is 256000000 Hz 16MB of RAM installed board_bcm963xx: CFE version: 1.0.37-5.17 console [early0] enabled CPU revision is: 00029107 (Broadcom BCM6348) board_bcm963xx: board name: 96348GW-11 Determined physical RAM map: memory: 01000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00001000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00001000 Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064 Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200 Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes PID hash table entries: 64 (order: 6, 256 bytes) Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Memory: 12472k/16384k available (1930k kernel code, 3912k reserved, 410k data, 1216k init, 0k highmem) Calibrating delay loop... 255.48 BogoMIPS (lpj=510976) Mount-cache hash table entries: 512 net_namespace: 776 bytes NET: Registered protocol family 16 registering 37 GPIOs registering PCI controller with io_map_base unset bus: 00 index 0 io port: [8000000, 800ffff] bus: 00 index 1 mmio: [30000000, 37ffffff] NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered NET: Registered protocol family 1 audit: initializing netlink socket (disabled) type=2000 audit(1.220:1): initialized squashfs: version 3.0 (2006/03/15) Phillip Lougher Registering mini_fo version $Id$ JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. msgmni has been set to 24 io scheduler noop registered io scheduler cfq registered (default) bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart console handover: boot [early0] -> real [ttyS0] bcm63xx_enet MII bus: probed bcm963xx_flash: 0x00400000 at 0x1fc00000 bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. bcm963xx_flash: Read Signature value of CFE1CFE1 bcm963xx_flash: CFE bootloader detected bcm963xx_flash: CFE boot tag found with version 6 and board type 96348GW-11. bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000 bcm963xx_flash: Partition 1 is kernel offset 22f100 and length 656d3 bcm963xx_flash: Partition 2 is rootfs offset 10100 and length 35f000 bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000 Creating 4 MTD partitions on "bcm963xx": 0x00000000-0x00010000 : "CFE" 0x0022f100-0x002947d3 : "kernel" mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only 0x00010100-0x0036f100 : "rootfs" mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only mtd: partition "rootfs" set to be root filesystem split_squashfs: no squashfs found in "bcm963xx" 0x003f0000-0x00400000 : "nvram" TCP bic registered NET: Registered protocol family 17 Bridge firewalling registered Freeing unused kernel memory: 1216k freed Algorithmics/MIPS FPU Emulator v1.5 [sighandler]: No more events to be processed, quitting. [cleanup]: Waiting for children. [cleanup]: All children terminated. - preinit - Press CTRL-C for failsafe Please press Enter to activate this console. bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)] bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)] eth1: link forced UP - 100/full - flow control off/off device eth1 entered promiscuous mode br-lan: topology change detected, propagating br-lan: port 1(eth1) entering forwarding state PPP generic driver version 2.4.2 ip_tables: (C) 2000-2006 Netfilter Core Team nf_conntrack version 0.5.0 (1024 buckets, 4096 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. br-lan: port 1(eth1) entering disabled state br-lan: topology change detected, propagating br-lan: port 1(eth1) entering forwarding state



Architecture: MIPS
Vendor: Broadcom
Bootloader: CFE
System-On-Chip: BCM6348
CPU/Speed BMIPS3300 V0.7 / 256 MHz
Flash-Chip: Fujitsu MPM29DL32B-70PFTN
Flash size: 4 MiB
RAM: Hynix 409A HY57 283220I-7, 16 MiB
Wireless: No
Ethernet: Broadcom BCM5325 w/ vlan support swconfig
Internet: ADSL2+
USB: slave, host possible with mod
Serial: Yes, ADM202EARN RS-232c

PCB Photos


The CT-5621 board is exactly the same as the CT-536+ without the miniPCI slot but with a serial Console and USB slave ports.


Opening the case

Note: This will void your warranty!

  • Under the rear rubber feet are two screws that need to be removed.
  • The cover is held on by these screws and by plastic clips near the front.
  • The front and rear plates and LED assembly can simply be pulled out once the cover is removed.
  • A few more screws hold the PCB to the bottom of the case.


port.serial general information about the serial port, serial port cable, etc.


CT-5621 version exposes a serial port via Ethernet port style labeled as Console:

RJ45 connector
3: Receive Data
4: Transmit Data
7: Ground
1,2,5,6,8: Not Connected


CT-5621T version hasn't the serial wired externally. Around the middle of the board is 4 pins arranged in a square. The one with a smaller square drawn around it is the Transmit pin. The one directly in front of it (toward the front of the device) is Receive. The one beside it is Ground. The one diagonal to it is Vcc. These pins operate at 3VDC and baud 115200, 8 bits, no parity, 1 stop bit (i.e. 115200,8,N,1). See PCB photos above.

Once connected to the serial port you can access three different modes:

  • By holding/mashing a key during power on you can access the CFE prompt and upload a new firmware (such as OpenWrt). This prompt also gives you the ability to download and run a kernel over ethernet without flashing it, which could be used to dump the stock firmware if one were so inclined.
  • By waiting for boot to complete you can access a login prompt, which is the same prompt you get over Telnet. The passwords seem to be the same as for the web interface.
    • The default account names are support, user, apuser, and the passwords are the account names. (However these don't actually work!? TODO figure out why.) support has the most privileges, apuser has the least.
    • User root, password t313com may also work on some devices. (This login also works for the web interface.)
    • This gives you an extremely limited shell (even as root!) with only a handful of commands for configuring the device.
  • By mashing Ctrl+C during boot (after the CFE prompt) you can interrupt boot and access a root shell, though it seems to be jailed or otherwise limited somehow.
    • ls command is not available, but you can list directories using echo /bin/*.
    • Depending on when you interrupt, some directories such as /proc are missing or empty.
    • If you let ADSL start up, you'll be spammed with messages about the link status.
    • Some files aren't readable at all - they'll give "no such file" or "no such device" errors.
    • You can use openssl command to encode/decode base64, allowing to dump binary data. e.g.: openssl enc -e -a -in /dev/mtdblock0 -out /dev/ttyS0
    • This can be combined with ping to easily dump to file on the host:
      ping -c 10; openssl enc -e -a -in /dev/mtdblock0 -out /dev/ttyS0
      The ping gives you a few seconds to detach your terminal emulator and start cat /dev/ttyS0 > data.b64 to capture the output. Once the file stops growing, strip the ping output from the beginning and decode. (But make sure ping works first! Depending when you interrupt, the lo interface might not be up yet.)

SSH is also supported, but using an obsolete algorithm that modern clients can't understand.


port.jtag general information about the JTAG port, JTAG cable, etc.

Located near the front left, beside the CPU. Pin 1 has white box surrounding it and the whole connection area is surrounded by a white border (thin). There is no existing header, if you want one you have to add it (there are only solder pads in the stock configuration).


1 2
3 4
5 6
7 8
9 10
11 12

Meaning and mapping to LPT for an unbuffered cable

Pin 3 - TDI - DATA0  - Pin 2
Pin 5 - TD0 - SELECT - Pin 13
Pin 7 - TMS - DATA2  - Pin 4
Pin 9 - TCK - DATA1  - Pin 3


Bootloader Mods

  1. you could read about bootloader in general

CFE> web info: Waiting for connection on socket 0.
CFE> c
Press:   to use current value
        '-' to go previous parameter
        '.' to clear the current value
        'x' to exit this command
Board IP address                :
Host IP address                 :
Gateway IP address              :
Run from flash/host (f/h)       :  f
Default host run file name      :  vmlinux
Default host flash file name    :  bcm963xx_fs_kernel
Boot delay (0-9 seconds)        :  5
*** command status = 0
CFE> b
Press:   to use current value
        '-' to go previous parameter
        '.' to clear the current value
        'x' to exit this command
Board Id Name (0-5)
96348R           -------- 0
96348LV          -------- 1
96348GW          -------- 2
96348GW-10       -------- 3
96348GW-11       -------- 4
96348SV          -------- 5     :  4
Number of MAC Addresses (1-32)  :  11
Base MAC Address                :  00:40:dd:37:ad:e4

Hardware mods

  1. as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

USB mod

(Note: this is done with a different board than shown in photos above.)

This board only needs 3 x 15 kΩ resistors and one 470μF capacitor, and the USB host (USB A Female) connector, to have a USB host port on the board (i.e. to drive USB mass storage, wireless, etc)

Two of the resistors and the capacitor get voltages right, while the third resistor is used to tie the USB host enabled pin on the BCM63xx to Vcc, so that it is seen as enabled.

There is a schematic from a NetGear that might be helpful. The only components that matter to our board are the 15k resistors.

Now we look at the space on the board that is for the USB host:

The following image shows what needs to be done in order to enable host usb:

And here's what a badly done mod looks like (I had a terrible time soldering):



toh/comtrend/ct5621.txt · Last modified: 2016/02/15 14:21 by danitool