The WRT610N v1.0 is based on the Broadcom 4705 cpu running at 300MHz. It has 8 MB flash and 64 MB SDRAM (2x HY5DU561622FTP).
The WNICs are a dual BCM4322 Chipset, one for 5GHz A and N and one for 2.4GHz B,G and N. The switch is a BCM53115 chip.
The WRT610N runs 802.11 A, B, G, and Draft N wireless protocols. It provides 4 gigabit LAN ports, 1 WAN port and a USB 2.0 port.
| Version/Model || S/N || OpenWrt Version Supported || Model Specific Notes
| WRT610N v0 || ? || same as v1 || same as v1
| WRT610N v1.0 || CTG01 || 10.03.1 (r22840), trunk (added r36099, r36461 tested) || b43 works with 2.4GHz radio, wl with both
| WRT610N v2.0 || CTG11 || trunk (added in r36099, r36342 tested) || same hardware as Linksys E3000
| Ver || CPU || Ram || Flash || Network || Wireless || Antenna || USB || Serial || JTag
| 1 || BCM4705@300MHz || 64MiB || 8MiB || 1+4 x 1000M || 2.4+5Ghz || || Yes (2.0) || Yes || ?
| 2 || BCM4718@480MHz || 64MiB || 8MiB || 1+4 x 1000M || 2.4+5Ghz || Internal, 3 per band || Yes (2.0) || Yes || ?
Obtaining an image
Recovery Web Interface
From dd-wrt Linksys WRT610N documentation
unplug all ethernet ports (Important!)
plug power in
wait 2-2.5 seconds
press the reset button and keep it pressed for 5 seconds, then release it
reconnect ethernet (DHCP shoud give IP address to computer)
You should see a "Management Firmware update" screen. Give it the
openwrt-wrt610n_v2-squashfs.bin file depending on hardware version.
If you have a serial console and the above isn't working you can press ctrl-c while the router is booting to get to a CFE prompt, then either:
nvram set safe_mode_upgrade=on
flash -ctheader -https : flash1.trx
even though CFE says it's doing that last bit, it appears some setup is missing. Running the command manually from a canceled boot and then browsing to the upgrade page shows an immediate "Update Success" and the router reboots (CFE reports that it has run the "reboot" command).
OEM installation using the TFTP method
openwrt-wrt610n_v2-squashfs.bin image with TFTP.
describe actual method
Based on the CFE boot logs, it appears that the router attempts to load something via tftp with a max size of 0x32000 bytes (3.625MiB) into ram. This would limit our image size quite a bit.
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool.
It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
LuCI Web Upgrade Process
Terminal Upgrade Process
mtd write /tmp/openwrt-brcm-2.4-squashfs.trx linux && reboot
| Architecture: || MIPS
| Vendor: || Broadcom
| Bootloader: || CFE
| System-On-Chip: || Broadcom BCM4705
| CPU Speed: || 300 MHz
| Flash-Chip: || EON EN29LV640B-90TIP - 64 Megabit (8M x 8-bit / 4M x 16-bit)
| Flash size: || 8 MiB
| RAM: || 64 MiB
| Wireless: || 2x Broadcom BCM4322 802.11a/b/g/n (integrated)
| Ethernet: || Broadcom BCM53115 Gigabit Switch
| USB: || 1x USB2.0 Host
| Serial: || Yes
| JTAG: || ?
For v2 see E3000
Opening the case
Note: This will void your warranty!
The case parts are hold together by plastic claws, use a screwdriver to release them.
See this form post for details.
PCB (front side):
Insert picture of PCB front side
PCB (back side):
There are 5 solder pads near the rim on the backside of the PCB, see image above.
Serial port settings are 115000@8N1.
The default network configuration is:
| Interface Name || Description || Default configuration
| br-lan || LAN & WiFi || 192.168.1.1/24
| vlan0 (eth0.0) || LAN ports (1 to 4) || Static
| vlan1 (eth0.1) || WAN port || DHCP
| wl0 || WiFi || Disabled
Switch Ports (for VLANs)
Switch port numbers are currently unknown.
If you forgot your password, broke one of the startup scripts, firewalled yourself or corrupted the JFFS2 partition, you can get back in by using OpenWrt's failsafe mode.
Boot into failsafe mode
Unplug the router's power cord.
Connect the router's LAN1 port directly to your PC.
Configure your PC with a static IP address between 192.168.1.2 and 192.168.1.254. E. g. 192.168.1.2 (gateway and DNS
is not required).
Plug the power on and wait for the DMZ LED to light up.
While the DMZ LED is on immediately press any button (Reset and Secure Easy Setup will work) a few times .
If done right the DMZ LED will quickly flash 3 times every second.
You should be able to telnet to the router at 192.168.1.1 now (no username and password)
Available buttons are currently not known.
Connect stuff to the USB port