1 nmrpflash - Netgear Unbrick Utility
2 ====================================
4 `nmrpflash` uses Netgear's [NMRP protocol](http://www.chubb.wattle.id.au/PeterChubb/nmrp.html)
5 to flash a new firmware image to a compatible device. It has been successfully used on a Netgear
6 EX2700, EX6120, EX6150v2, DNG3700v2, R6220, R7000, D7000, WNR3500, R6400 and R6800, WNDR3800, but is likely to be compatible
7 with many other Netgear devices.
9 Prebuilt binaries for Linux, ~OS X~ macOS and Windows are available
10 [here](https://github.com/jclehner/nmrpflash/releases)
11 ([Npcap](https://nmap.org/npcap/) is required on Windows).
14 Usage: nmrpflash [OPTIONS...]
16 Options (-i, and -f or -c are mandatory):
17 -a <ipaddr> IP address to assign to target device
18 -A <ipaddr> IP address to assign to selected interface
19 -B Blind mode (don't wait for response packets)
20 -c <command> Command to run before (or instead of) TFTP upload
21 -f <firmware> Firmware file
22 -F <filename> Remote filename to use during TFTP upload
23 -i <interface> Network interface directly connected to device
24 -m <mac> MAC address of target device (xx:xx:xx:xx:xx:xx)
25 -M <netmask> Subnet mask to assign to target device
26 -t <timeout> Timeout (in milliseconds) for NMRP packets
27 -T <timeout> Time (seconds) to wait after successfull TFTP upload
28 -p <port> Port to use for TFTP upload
29 -R <region> Set device region (NA, WW, GR, PR, RU, BZ, IN, KO, JP)
31 -V Print version and exit
32 -L List network interfaces
38 Your Netgear router must be connected to your network using an
39 Ethernet cable. The device running `nmrpflash` must be connected
40 to the same network, using either Wi-Fi or Ethernet.
42 All available network interfaces can be listed using
46 eth0 192.168.1.2 f2:11:a1:02:03:b1
49 Once you've determined the interface to use, we can flash the image. Firmware
50 images can usually be downloaded directly from Netgear. Power on your device
51 immediately after starting `nmrpflash`.
54 # nmrpflash -i eth0 -f EX2700-V1.0.1.8.img
55 Advertising NMRP server on eth0 ... /
56 Received configuration request from a4:2b:8c:00:00:01.
57 Sending configuration: 10.164.183.252/24
58 Received upload request: filename 'firmware'.
59 Uploading EX2700-V1.0.1.8.img ...
61 Waiting for remote to respond.
62 Remote finished. Closing connection.
63 Reboot your device now.
68 In any case, run `nmrpflash` with `-vvv` before filing a bug report. Also,
69 try connecting your Netgear router *directly* to the computer running
72 ###### "Error while loading shared libraries: ..." (Linux)
74 You must install your Linux distribution's `libpcap` and `libnl-3`
75 packages (exact names will vary depending on your distribution).
77 ###### "The program can't start because wpcap.dll is missing" (Windows)
79 Install [Npcap](https://nmap.org/npcap/). For `nmrpflash` versions prior
80 to 0.9.14, install Npcap with "WinPcap Compatibility" enabled.
82 Version 0.9.13 is the last version to support Windows XP.
84 ###### "No suitable network interfaces found."
86 Make sure the network interface is up (wireless interfaces are not supported).
87 On Windows, try restarting the WinPcap service (commands must be run as
95 ###### "No response after 60 seconds. Bailing out."
97 The router did not respond. Always run `nmrpflash` in the following
100 * Turn off the router.
102 * Turn on the router.
104 If that still doesn't work, you can try "blind mode", which can be
105 invoked using `-B`. Note that you also have to specify your router's
106 mac address using `-m xx:xx:xx:xx:xx:xx`. Also beware that in this mode,
107 careful timing between running `nmrpflash` and turning on the router may
110 It's also possible that your device does not support the NMRP protocol.
112 ###### "Timeout while waiting for ACK(0)/OACK."
114 The device did not respond to `nmrpflash`'s TFTP upload request. By default,
115 `nmrpflash` will assign `10.164.183.252` to the target device, while adding `10.164.183.253`
116 to the network interface specified by the `-i` flag. You can use `-a` to change the IP
117 address assigned to the target (e.g. if your network is `192.168.1.0/24`, specify a *free*
118 IP address, such as `-a 192.168.1.252`), and `-A` to change the IP address used for the
121 This error message could also indicate a bug in the TFTP code; try using an external tftp
122 client (busybox in this example), by specifying the `-c` flag instead of the `-f` flag:
124 `# nmrpflash -i eth0 -c 'busybox tftp -p -l EX2700-V1.0.1.8.img $IP'`
126 The environment variable `IP` is set by `nmrpflash` (other environment variables
127 are: `MAC`, `PORT`, `NETMASK`).
129 ###### "Timeout while waiting for CLOSE_REQ."
131 After a successful file upload, `nmrpflash` waits for up to 5 minutes for an
132 answer from your device. You can increase this by specifying a longer timeout
133 using `-T` switch (argument is in seconds).
135 It's entirely possible that the image was flashed successfully, but the
136 operation took longer than 5 minutes.
138 ###### "Address X/Y cannot be used on interface Z."
140 `nmrpflash` refuses to use an IP address / subnet mask combination that would
141 make the remote device unreachable from the device running `nmrpflash`. For
142 example, if the IP address of your computer is 192.168.0.1/255.255.255.0, assigning
143 192.168.2.1/255.255.255.0 to the router makes no sense, because the TFTP upload will
146 ###### "IP address of X has changed. Please assign a static IP to the interface."
148 This can happen if the network interface in question automatically detects that
149 the network cable has been connected, and your computer tries to reconfigure that
150 interface (NetworkManager on Linux does this for example) - this can usually be
153 An alternative would be to add `-c 'ifconfig <interface> <ip>'` to the command line,
156 `# nmrpflash -i eth0 -a 192.168.1.1 -f firmware.bin -c 'ifconfig eth0 192.168.1.2'`
158 This will execute the command specified by `-c` prior to starting the TFTP upload (in
159 this case setting the IP address to 192.168.1.2).
161 ###### "Received keep-alive request."
163 This usually means that flashing is in progress. On some devices, you may get a few
164 hundred keep-alive requests before it eventually finishes!
166 ###### "TFTP block rollover. Upload might fail!"
168 By default, file transfers using TFTP are limited to `65535 * 512` bytes
169 (almost 32 MiB). Uploading files exceeding this limit might fail, depending
172 ###### "Ignoring extra upload request."
174 Extraneous upload requests are usually sent by the device if the image validation
175 failed. Some possible causes are:
177 * If you downloaded a firmware that's contained in an archive (a `.zip` for
178 example), you must extract this file, and then use the contained firmware file
179 as the argument to the `-f` parameter. Some examples for file extensions used
180 for firmware: `.chk`, `.bin`, `.trx`, `.img`.
182 * Some devices prevent you from downgrading the firmware. See if it works with
183 the latest version available for your device. If you're already using the latest
184 version, it might be possible to patch the version info of the firmware file. A
185 future version of `nmrpflash` might incorporate an auto-patch feature for these
188 * Your device might expect a different image format for `nmrpflash` than when
189 flashing via the web interface.
191 ### Building and installing
192 ###### Linux, Mac OS X, BSDs
195 $ make && sudo make install
200 The repository includes a
201 [DevCpp](http://sourceforge.net/projects/orwelldevcpp/)
202 project file (`nmrpflash.dev`). Download the latest
203 [Npcap SDK](https://nmap.org/npcap/)
204 and extract it into the root folder of the `nmrpflash` sources.
209 You can [buy me a coffee](https://www.buymeacoffee.com/jclehner) if you want, but please consider
210 donating the money for charity instead - [Médecins Sans Frontiers](https://www.msf.org/donate) comes to mind,
211 but any other organization, local or international, that you think deserves support will do. Thank you!