1 nmrpflash - Netgear Unbrick Utility
2 ====================================
4 This program uses Netgear's [NMRP protocol]
5 (http://www.chubb.wattle.id.au/PeterChubb/nmrp.html)
6 to flash a new firmware image to a compatible device. This utility has been
7 tested with a Netgear EX2700, but is likely to work on many others as well.
9 Prebuilt binaries for Linux, OS X and Windows are available
10 [here](https://github.com/jclehner/nmrpflash/releases)
11 ([WinPcap](https://www.winpcap.org/install/default.htm) is required on Windows).
14 Usage: nmrpflash [OPTIONS...]
16 Options (-a, -i and -f and/or -c are mandatory):
17 -a <ipaddr> IP address to assign to target device
18 -c <command> Command to run before (or instead of) TFTP upload
19 -f <firmware> Firmware file
20 -F <filename> Remote filename to use during TFTP upload
21 -i <interface> Network interface directly connected to device
22 -m <mac> MAC address of target device (xx:xx:xx:xx:xx:xx)
23 -M <netmask> Subnet mask to assign to target device
24 -t <timeout> Timeout (in milliseconds) for regular messages
25 -T <timeout> Time (seconds) to wait after successfull TFTP upload
26 -p <port> Port to use for TFTP upload
27 -R <region> Set device region (NA, WW, GR, PR, RU, BZ, IN, KO, JP)
29 -V Print version and exit
30 -L List network interfaces
36 Connect your Netgear router to your computer using a network cable.
37 Assign a static IP address to the network adapter that's plugged into
40 For this example, we'll assume that your network interface is `eth0`.
41 First, we have to assign a static IP address to our network interface.
42 In this example, we'll use `192.168.1.2`. All available network interfaces
47 eth0 192.168.1.2 f2:11:a1:02:03:b1
50 Now we can flash the image. The argument for the `-a` option needs
51 to be a *free* IP address from the same subnet as the one used by your
52 network interface; we'll use `192.168.1.254`. Firmware images can usually
53 be downloaded directly from Netgear. For details on how to do this, see
54 [here](#obtaining-firmware-images). Power on your device immediately
55 after starting `nmrpflash`.
58 # nmrpflash -i eth0 -a 192.168.1.254 -f EX2700-V1.0.1.8.img
59 Advertising NMRP server on eth0 ... /
60 Received configuration request from a4:2b:8c:00:00:01.
61 Sending configuration: ip 192.168.1.254, mask 255.255.255.0.
62 Received upload request: filename 'firmware'.
63 Uploading EX2700-V1.0.1.8.img ... OK
64 Waiting for remote to respond.
65 Remote finished. Closing connection.
66 Reboot your device now.
71 In any case, run `nmrpflash` with `-vvv` before filing a bug report.
73 ###### "No suitable network interfaces found."
75 Make sure the network interface is up. Wireless interfaces are not supported. Make sure the network interface
76 is active. On Windows, try rebooting the WinPcap service (commands must
77 be run as administrator):
84 ###### "No response after 60 seconds. Bailing out."
86 The router did not respond. Try rebooting the device and run `nmrpflash` again.
87 You could also try running `nmrpflash` with `-m` and specify your router's
88 MAC address. It's also possible that your device does not support the NMRP protocol.
90 ###### "Timeout while waiting for initial reply."
92 The device did not respond to `nmrpflash`'s TFTP upload request. This could indicate a bug
93 in the TFTP code; try using an external tftp client (busybox in this example), by specifying
94 the `-c` flag instead of the `-f` flag:
96 `# nmrpflash -i eth0 -a 192.168.1.254 -c "busybox tftp -p -l EX2700-V1.0.1.8.img 192.168.1.254"`
99 If the upload still fails, and you're on Windows, try executing the following command before
102 `C:\> netsh interface ip add neighbors <interface> <ip> <mac>`
104 where `<interface>` is the pretty interface name (e.g. "Local Area Connection"; as displayed by
105 `nmrpflash -L`), `<ip>` is the same IP address you'd use for `nmrpflash`'s `-a` flag, and `<mac>`
106 is the target device's mac address.
108 Cheers to [@ntadmin](https://github.com/ntadmin) for this info!
111 ###### "Timeout while waiting for CLOSE_REQ."
113 After a successful file upload, `nmrpflash` waits for up to 120 seconds for an
114 answer from your device. You can increase this by specifying a longer timeout
115 using `-T` switch (argument is in seconds).
117 It's entirely possible that the image was flashed successfully, but the
118 operation took longer than 120 seconds.
120 ###### "Address X/Y cannot be used on interface Z."
122 `nmrpflash` refuses to use an IP address / subnet mask combination that would
123 make the remote device unreachable from the device running `nmrpflash`. For
124 example, if the IP address of your computer is 192.168.0.1/255.255.255.0, assigning
125 192.168.2.1/255.255.255.0 to the router makes no sense, because the TFTP upload will
128 ###### "IP address of X has changed. Please assign a static IP to the interface."
130 This can happen if the network interface in question automatically detects that
131 the network cable has been connected, and your computer tries to reconfigure that
132 interface (NetworkManager on Linux does this for example) - this can usually be
135 An alternative would be to add `-c 'ifconfig <interface> <ip>'` to the command line,
138 `nmrpflash -i eth0 -a 192.168.1.1 -f firmware.bin -c 'ifconfig eth0 192.168.1.2'`
140 This will execute the command specified by `-c` prior to starting the TFTP upload (in
141 this case setting the IP address to 192.168.1.2).
143 ### Building and installing
144 ###### Linux, Mac OS X, BSDs
147 $ make && sudo make install
152 The repository includes a
153 [DevCpp](http://sourceforge.net/projects/orwelldevcpp/)
154 project file (`nmrpflash.dev`). Download the latest
155 [WinPcap Developer Pack](https://www.winpcap.org/devel.htm)
156 and extract it into the root folder of the nmrpflash sources.
158 ### Obtaining firmware images
160 Firmware images can be downloaded directly from Netgear's FTP servers.
161 For the Netgear EX2700 for example, download
162 ftp://updates1.netgear.com/ex2700/ww/fileinfo.txt. At the top there
163 should be an entry like this:
167 file=EX2700-V1.0.1.8.img
171 The download link for the latest firmware image for this device is thus:
172 ftp://updates1.netgear.com/ex2700/ww/EX2700-V1.0.1.8.img. Substitute
173 `ex2700` for your device (`wndr4300`, `wndr3700`, `r6100`, etc.). If
174 neccessary, substitute `ww` (world-wide) for a specific region.