I bricked my Linksys WRT54GS router when trying to change the firmware on it from dd-wrt to open-wrt. In order to unbrick it, I need to be able to do an ftp transfer to it.

The problem is that it isn't using DHCP addressing and I can't just use the default ip address of I have to use the ip address it was set at before it got bricked.

The problem is I forgot what that number was.

Is there some program or script that can find it out?


The dd-wrt.com wiki has a page Obtaining Router IP. It says to use the arp command. From that page:

If you still receive no response, the IP address may have been changed from the default. Disconnect all other machines from the router and run arp in a command window to find out what the IP address is:

arp -a

You should receive a response from the router even if it is on a different subnet than your computer. If you've received a response, the output will give you the IP address of the router. Once you have discovered the IP address of the router, change the IP address of your computer to match the subnet of the router as described above. You should now be able to ping the router and receive a response.

The dd-wrt.com wiki also has a thorough guide that seems to fit your situation. Recover from a bad flash.

The first router it covers is the WRT54G/GL/GS, but before getting into the specifics for your router, it says:
To determine if the router is bricked, carefully follow the steps at note 6 of the peacock thread:
Peacock Thread-FAQ: EVERYTHING you NEED to know! Really!!

I'm going to paste from the Peacock Thread-FAQ into my answer in case the link stops working at a future time, but the whole post has lots of good info. It seems like you should start at this section:

Specifically, here are the steps to see whether you have a brick and need to jtag (or use a serial cable):

It tells you standard IP addresses to ping and how to reset if you aren't successful.

The Peacock Thread-FAQ starts like this:
I called this the peacock thread so it can be searched for easily. It contains a lot of information, so it is up to you to read carefully.
The information in this thread IS up to date, regardless of the post date of the thread. This post is constantly modified.

How to reset is in note 1 of the post, you'll need to look at the post in the forum (I'm checking with the poster to see if it's OK with them to most more than the link here).

Good Luck.

I got the OK from the post's author to copy the info here, so if you confirm that the router is bricked using step 6 at the bottom, you'll need to do the hard reset as described in note 1.

After the hard reset you can continue with the specific instructions for your WRT54GS from the Recover from a bad flash post.

Peacock Thread-FAQ: EVERYTHING you NEED to know! Really!!
Author: Murrkf

This does not mean hitting the reset button and saying you are done. This means doing the 30-30-30 reset. To do a 30-30-30 reset you must push the reset button with your router powered on. Hold it for 30 seconds with the router powered on. STILL holding it, pull the power cord for 30 seconds. Still holding it, plug the power back into your router and continue to hold the reset button for 30 more seconds. You will have held the button for a full 90 seconds without releasing it.


Note: WRT54GS v1.1, GS v2, and GS2.1 models can brick after a hard reset no matter how it is done. See this thread and the solution in Vulcan's post: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=45024

Note: WRT320N has a faulty reset button. See this post about using the WPS button to erase nvram: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=63004

Note2: The Asus RT-N16 reset button puts it into firmware restore mode. See the RT-N16 wiki for how to reset this router.

After you have done this WHEN DD-WRT IS INSTALLED, if you haven't been asked to change your password by the dd-wrt webgui when you try to login to the router at,(presuming you are doing a hard reset on a dd-wrt build newer than 9707, June 14, 2008, when the auto reconfig password was introduced) you haven't done the hard reset properly.

Failing to do a hard reset and failing to wait after flashing are the two most common NOOB errors that lead them to a world of unnecessary dd-wrt pain! This is not a minor optional step. The firmware writes information to the Nvram. This step clears that information. If you don't clear it properly, parts of the old information be present with the new firmware, which can make it not operate properly. Don't cut corners. Doing it before you upgrade can be very important; a hard reset is not just for after upgrades.

Hard resets will not remove dd-wrt from your router!

Now that the router is reset, you can continue with the specific instructions for your WRT54GS from the Recover from a bad flash post.

The LED display at the front of the router is the best way to determine what type of brick you have and its recovery method. You should at least check this to prevent unnecessarily opening the router.

When the web interface is no longer available, switch the router off first ( remove the power jack) and remove all network cables from the equipment. After some seconds you restart the WRT54G. Now take note of the flashing LEDs.

  1. The power LED flashes very fast. If it keeps on flashing longer than 2 minutes, without having lit up the other LED's, then a defective bootloader is present. However, if you can ping (your router IP) you can try the TFTP recovery, otherwise you may need to open the router and use the JTAG recovery method below.
  2. The power LED flashes very fast and after some seconds the DMZ LED lights up for approximately 5 seconds. In this case the Bootloader is intact and only the kernel (firmware) is defective. In this case you could possibly still recover with an ethernet cable if you reflash the firmware via TFTP (see TFTP below).
  3. The power LED flashes very fast and after about 20 seconds it lights permanently, but the DMZ LED did not light up. In this case Bootloader and Kernel (firmware) are intact, only a wrong configuration from locked up the router. This can happen if a wrong or corrupt value exists in the NVRAM. Here simply clearing the NVRAM should solve the problem.

Option one: use the JTAG recovery method
Option two: possibly still recover with an Ethernet cable if you reflash the firmware via TFTP
Option three would have been fixed by doing the hard reset.

Option one: Recovering with TFTP

Note that if you already have DD-WRT installed and working, and you are on this page because you want to revert to the router firmware, you need to break DD-WRT first!

telnet into the router, execute:

mtd erase linux (This bricked my Buffalo WHR-HP-GN! Don't do mtd erase linux!) reboot

(Note: only tested on the WNDR3300 with 24preSP2; YMMV)

During startup, the router will pause to accept a temporary firmware upload via tftp. On the Linksys WRT54G routers, you need to flash an image that contains the "W54G" header (Linksys and mini_wrt54g images)

If pinging does not work, check the IP Address of your computer and make sure it is assigned an IP address in the subnet of the router IP. For simplicity sake you can assume "192.168.1.x" is good. If you do not have a good IP, the DHCP Server might not be working. So set your IP manually to something like with as your gateway and then try pinging the router again. Finally, you may want to use a network scanner to scan your network (smaller networks) just to be sure that your router was not assigned another IP.

Power the router on with a continuous ping running in a command window:

ping -t -w 2

The -w 2 parameter forces a lower timeout for the ping answer, this makes easier to get an answer from the bricked router.

You should see at least a few replies from Do this several times to be sure. If it does you have good chance of simple recovery. If you still receive no response, the IP address may be something other than You should attempt to obtain the IP address of the router. Especially if previous firmware set the boot_wait variable to on, the router pauses even longer than normal during bootup to accept a recovery flash. All you need to do is provide a firmware to it via TFTP during this window of time.

Prepare your PC, firmware file and TFTP software and play with the timing of powering it on and starting the TFTP session just after applying power (or as soon as you start to see ping replies). If you try it a number of times (at least 10) you will probably rescue the router with no fuss!

If you see an 'Invalid Password' prompt from the router the bootloader did not accept the TFTP image and the firmware is refusing the TFTP upload. You can force the bootloader to accept the TFTP upload by holding the reset button while powering up the router. You may also improve success rates by ensuring there is a switch or hub between the PC and the router, maintaining link state when the router power cycles.

DrayTek Router Tools - OS X/Windows: This program will run all those pesky TFTP commands with a push of a button. Simply download and install DrayTek router tools from here and follow the instructions: ftp://ftp.draytek.com/tools/Router_Tools/

  1. Run 'Draytek Firmware Upgrade',
  2. Specify your *.bin file.
  3. Plug in your router and hit send, if you get a "can't send" message, hit ok and try sending again. As long as you have a manual IP address on the same subnet as your router, and your router is pingable, it should eventually go through (reboot the router if you can't send for more than a minute).
  4. When the send is successful, you should see a progress bar as the file is sent.
  5. Wait approximately two minutes, and your router should become accessible.

Windows: Microsoft Windows contains a TFTP client. Windows Vista will require that you enable it in Programs and Features. With TFTP, all of the information about the transfer is specified during the initial setup; there is little client/server interaction as compared with standard FTP.

If the router does not respond at a ping, or if the power light is blinking, use first the arp -s command.

This command allows to attach an IP address to the unique MAC (or physical address) of the device. The MAC address appears on the label stuck on the bottom of the device, and is a twelve hexadecimal digits long number, looking like aabbccddeeff. This number has to be entered as follows: aa-bb-cc-dd-ee-ff, with dashes separating the pairs of digits.

Note that the size of the firmware to be installed first must be less than 3 MB. Afterward, it is possible to install a bigger firmware, using the WEB interface of the router. However, there are some exceptions; the Linksys default firmware of the WRT54GL is 3.2MB and will work with TFTP.

In the following example, we assume that your router IP address is

Before beginning, do verify that:

  1. There is no computer (or device) on your LAN having the IP address
  2. Your computer has an address on the IP segment 1, ie 192.168.1.xxx.
  3. A network cable is correctly connected to your router.

To flash the router using Microsoft Windows:

  1. Open a command prompt.
  2. Change to the directory containing the original Linksys firmware to use for this boot, or the DD-WRT firmware you want to install, whose size must be less than 3 MB (this example assumes that the firmware file name is code.bin).
  3. Then enter the following commands:

    arp -s aa-bb-cc-dd-ee-ff ping tftp -i PUT code.bin code.bin

A correct response from the ping means that the router is still alive, though the power light blinks.

The tftp program will not give you status updates while uploading, it'll either return "Transfer successful" at the end or a failure message. The transfer may take 15 seconds or more, during which time the LAN status LED will blink at around the same speed as the power LED. Be patient and do not interrupt it until it finishes.

After the firmware has been uploaded, wait approximately three minutes, until the power light stops blinking. At this time, the router should be operational.

OS X: OS X contains a TFTP client, described below, but its success rate varies especially if you receive the "Invalid Password !!!" error. The MacTFTP Client by MacTechnologies worked on the first attempt however. Just be sure to specify the password which is usually the default of "admin" and wait for the transfer to finish.

Linux: Most Linux distros either include a tftp client or have one available in their packages. This example uses atftp.

atftp --option "mode octet" --verbose -p -l code.bin

For OS X and Linux users I suggest opening a terminal window and entering the following commands.

rexmt 1
timeout 60

after all that type (but do not hit enter just yet)

put firmwarefile.bin

plug in router and immediately hit enter.

Now apply power to your router. The tftp client will continuously retry uploading the firmware until the router responds. Hopefully, the router will briefly awaken, allowing the firmware upgrade to be sent. About two minutes later, the router will reset and become operational with the new firmware.

After the PUT is complete the router will stop pinging for 2 or 3 minutes while the firmware is flashed.. Don't panic, this is normal. Once you start receiving pings again, the firmware has been flashed and you should be able to access the router again. You should reset to defaults before configuring the router again.

Linksys WRT54 GL:

Linksys wrt54 GL users please note that if flashing with tftp using dd-wrt firmware gives no results, original Linksys firmware from www.linksys.com is worth trying. If that works, do a hard reset and you can continue to flash with dd-wrt. In order to use the Standard firmware version, a MINI version MUST be used first.


  • The -i specifies binary transfer mode. The transfer will fail if you don't specify this.
  • Start the command and then power up the router. There is no indication of any transfer until it is complete.
  • The uploading via this command is pretty slow ~5.7kB/s if you are using 10Mbps half duplex mode so it will take about 10 minutes to upload ~3 MB image. When you're using 100Mbps full duplex mode, it will go much faster. After the transfer is complete, wait 2-3 minutes for the image to be written to flash.
  • If TFTP does not work, try changing your network adapter to 10 Mbps half duplex.
  • Provided you have followed these steps correctly you should notice that the router will eventually reboot, in some cases it will require a power cycle (however if you power cycle wait at least 10 minutes to be sure the flash writing has occurred before you pull the plug).
  • Enjoy the fact that you did not waste $60 and that your router is now functioning again.

Known TFTP Problems

Time out occurred Connect request failed
Try to ping your router. If you have a ping, reboot the router by removing the power cord and wait at least 10-20 seconds before retrying. If you don' t have a ping, the router is unreachable. Check if you have the correct IP and network configurations. If the problem is not solved by rebooting, and you always get this error, you will need to proceed with the JTAG method.

Access denied Connect request failed
The router is rejecting your connection; the router can be accessed on the network. Try to reboot your router, repairing your network interface or, according to some tutorials, change your IP address to

Error on server code pattern incorrect
Sometimes, uploading the mini DD-WRT image (or other images as well) won't work. If you get this error, the router is unable to recognize your .BIN firmware (make sure you DO have a .BIN firmware). Try TFTPing the latest default Linksys firmware instead. You will then be able to access the Web GUI and flash your router again.

Option two: Recovery by JTAG cable

Please read the jtag wiki here: http://www.dd-wrt.com/wiki/index.php/Category:Jtag

If the router isn't pingable anymore, there is little else you can do, but using a JTAG cable. For a pin-out see OpenWRT wiki. Then download the HairyDairyMaid Debrick Utility. Or...try the updated TJTAG program which includes the Newer Router Models.

  1. solder the JTAG cable following the above linked pin-out.
  2. solder a 12 pin header on the PCB of the router.
  3. to install the giveio.sys copy giveio.sys and loaddrv.exe into {windows}\ system32\drivers (usually C:\windows\system32\drivers)
  4. double click loaddrv.exe in the system32 dir. This is important.
  5. append the filename giveio.sys onto the path in the utility
  6. press the load button and the start button, they should both confirm success. If this does not happen go no further, go back and fix this.
  7. make sure interrupts are enabled on the LPT1 port - go into the device manager>LPT1>Properties>Port Settings and check "Use any interrupt assigned to this port"
  8. from the command prompt cd to your Hairy Dairy directory and run wrt54g.exe to get a list of options
  9. to check your cable, plugin and power up the router and do wrt54g - probeonly
  10. it will then detect the CPU type. If not then check your cable.
  11. finally to erase your NVRAM (the usual cause of the problem) wrt54g
    • erase:nvram
  12. if that didn't work, erase the kernel (firmware): wrt54g -erase:kernel Now reflash the kernel via TFTP.
  13. if you still have no luck, you need to erase your CFE, but make sure you have a working cfe.bin for your router model! wrt54g -erase:cfe After that you have to reflash your CFE: wrt54g -flash:cfe

A partial list can be found here CFE collection project

Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG via this utility. You are better off flashing the CFE & NVRAM files & then using the normal TFTP method to flash the KERNEL via ethernet.

NOTE: If your JTAG writing program is hanging during the flash erase step, check your power supply. The act of writing flash consumes more power than reads, so a marginal power supply may support probes and reads, but will fail at writes. In one case, I had a 32V AC ripple on a 14V DC supply. I presume the marginal power supply called the original flash failure.

If you do not have a CFE.BIN file, you can find a repository of them here. These all have MAC addresses that DO NOT MATCH your hardware. Use the CFE editing tool "IMGTOOL_NVRAM" available from The Bitsum Wiki to set the et0macaddr and il0macaddr before uploading the CFE. et0macaddr is the address printed on the outside; il0macaddr is that same address, plus one. Example: If the printger address is 00:90:4d:83:00:01, then et0macaddr is 00:90:4d:83:00:01 and il0macaddr is 00:90:4d:83:00:02.

Peacock Thread-FAQ: EVERYTHING you NEED to know! Really!!
Author: Murrkf
Note 6: Is your router bricked?

A bricked router is a router that you can no longer communicate with through 
wireless or wired connections. It will give no response. Just because a router 
doesn't seem to be fully working, doesn't mean it is bricked. Most of the time 
when we refer to a bricked router, we mean that it is not responding to a 
wired connection and needs a jtag or serial cable to fix it.

A brick will normally not respond to pings at all. Often, all the lan lights and the 
power light are lit when a router is bricked, even those with no cable in the lan 
port. If you can get your router to respond to pings, there is hope.

When pinging the router:

If reply has TTL of 100, the bootloader (CFE) is responding. This is the best time 
to start the TFTP transfer. In most cases you should be able to flash dd-wrt 
firmware if you are getting any ttl=100 responses, as long as you flash at the 
start of these ping responses. See note 11 about how to flash. Timing can be tricky.

If reply has TTL of 64, the operating system firmware 
(i.e. Linux, dd-wrt) is responding.
The good news here is that there IS operating system firmware on your router.

Routers with boot wait enabled will give you a few ping responses of ttl=100, while 
the operating system is loading, prior to changing to ttl=64. This enables you to 
flash firmware at bootup with tftp if you wish to.

If there is no operating system firmware (dd-wrt) on the router (flash of firmware 
did not take for some reason), you will only get ttl=100 from the bootloader.

If you get "destination host unreachable", you likely have your computer on a 
different sub-network than the one you are trying to ping. Check to make sure 
that you have your computer set to the same static IP subnet (eg. 
as the address you are trying to ping.

If you only get "request timeout" responses, and you are pinging properly to the 
correct  IP of the router from the same subnet,this is not good 
(router might be bricked) but we can still try TFTP just in case. Here's what to do:

Try to ping at ALL the IP addresses that your router has ever had. Make sure that 
you set the IP on your computer to the same first three octets of the IP you are 
trying to ping. Usually, you will set the IP of the computer to 
Then, at your command prompt, ping -t Watch and report the results,
if you have a problem.

Be SURE to check your power supply and make sure it is the correct one for your
router. We often see that people have used the wrong power supply and then find
their router doesn't work. Also, power supplies fail, and if the capacitors are weak 
the power supply might seem fine when the router is not under load but often the 
supply won't work right at reboot, right when you need it to function properly.
If you have another power supply, try both.

Specifically, here are the steps to see whether you have a brick and need to jtag (or use a serial cable):

a. Make sure your computer hardware, especially your lan cable are working properly. Make sure your network adapter is working. Check your router power supply.

b. Disable all virus protection and firewalls on the computer. Also, disable any
wireless cards.
c. Connect one computer to the router with a cable. Have no other connections to
the router except one computer and one cable to that computer.
d. Set your computer IP address to (if that is the same subnet as the
router is supposed to be at).
e. Try to ping the router using the command "ping -t" (presuming that is the address your router was set to.) See if there are ANY
responses. (There WILL be A response...you are looking for a ttl= response)
f. If there are no ttl= responses, do a hard reset on your router. Make sure you get
this right. (See note 1.) This should set your router back to dd-wrt defaults. Check
to see what the dd-wrt default is for your router. Usually this is Some
routers are and some are You then need to redo
steps d. and g. using the new ip address. Make sure if the subnet has changed, your
have changed your computer to match the subnet.
h. Start continuous pings to your router again. Note the responses. If they are not
ttl=64, you have a problem. While the pings are continuing, power cycle your
router. (This means unplug it, count to 30, and plug it back in). Watch the lights 
and wait until they come back on or for any changes. This could take a minute. 
Carefully watch for any ttl= responses during this time.
i. If there are no ttl= responses, do a hard reset on your router, while the pings
continue. Again. watch for any ping responses. If you get none, you likely need to
jtag or use one of the recovery methods listed below in this note. Your router is

If you get a few ping responses of ttl=100, or even 1, that is the CFE saying "Send
me a firmware! NOW!" But you have to hit it with a tftp right then, when the ping
responses start. See note 11 (below) and repeat the procedure that got your a
ttl=100 response then try to get the tftp timing right.
Some routers can be bricked even if they do give some ttl=100 responses to pings,
but this is less common. Some routers can be bricked if the lights are not all lit, 
but again, this is not common. However, if the lights are all lit, and you cannot 
get a ping response, the router is definitely bricked. You can try the alternate 
recovery methods below, but if none work and you can't tftp, you must use 
serial recovery or jtag to fix it. 
(See the Links to the Wiki articles on these, below).


It can cause harm that cannot be fixed. A bricked router can almost always be
fixed with serial or jtag if there is a jtag terminal in the router. However a router
with hardware damage cannot be recovered. Pin shorting often causes hardware

If someone has sent you to note 6 of the peacock thread, it is because they are
asking you to post the exact message you get from your initial ping attempt, the
message you get during and after a power cycle, and the message you get when
pinging during and after a hard reset. Be sure to post this information in your
thread. You will ALWAYS get a message/response when you try to ping;(see the
first paragraph for note 6, above) be sure to post exactly what those responses
are. Also post what each light in the front of the router is doing, and whether
something is plugged into any LAN port. We also need to know what you did to
brick your router - wrong build? Failed to wait? What? Finally we will need to know
what operating system you are using on your computer to assess the message

Here is a link on how to put your router in management mode, that has saved
some people who thought that their router is bricked:

EKO has posted this for the Linksys 610N (Not sure if it works for other Linksys
routers too?)

As an alternative to serial or jtag, some recent version routers can be fixed by this
method. It is worth a try before you solder:

If you need to jtag, here is a link to the wiki article on jtag:

You can do some router recovery with a serial adapter IF you have a working CFE
on the router. This is the preferred method if you flashed the wrong firmware but
have not deleted the cfe with a jtag cable. See this wiki article on serial recovery:

Scan your local network with nmap.

  • 2
    Could you elaborate? Which nmap command? Do you need to know the network address prefix/subnet to be able to scan? – Adam Butler Nov 18 '13 at 1:50

Scan network with http://www.angryip.org/w/Home


Not sure if that can help with firmware problems but did you try to reset it to factory defaults (pressing reset button for 30 seconds or something like that) so the IP come back to default one?

  • 1
    You mean a hard 30/30/30? – Synetech Jul 9 '12 at 5:19
  • yes (thanks for the link). I would try it before going to more drastic (and dangerous) options. – laurent Jul 9 '12 at 19:19

Another way to test this without any special commands, and provided you have access to the network, is to visit http://whatsmyrouterip.com/ which will try to probe the network for the router. Not sure how well it'll work with a bricked router tho as it might not response at all to pings/requests...


This will work for Linux users. I don't know how you would do it with Windows:

First, get your current IP address:

$ ifconfig | grep inet
inet addr:  Mask:
inet6 addr: ::1/128 Scope:Host
inet addr:  Bcast:  Mask:
inet6 addr: fe80::9eb7:dff:fef1:3565/64 Scope:Link

So it's So the router IP is probably in 192.168.1 - 255.

Then you could try nmap:

$ nmap

Starting Nmap 6.40 ( http://nmap.org ) at 2014-06-12 04:00 CEST
Nmap scan report for
Host is up (0.012s latency).
Not shown: 994 closed ports
23/tcp    open  telnet
53/tcp    open  domain
80/tcp    open  http
5000/tcp  open  upnp
8200/tcp  open  trivnet1
20005/tcp open  btx

Nmap scan report for
Host is up (0.0056s latency).
Not shown: 999 closed ports
27355/tcp filtered unknown

Nmap scan report for
Host is up (0.00019s latency).
Not shown: 997 closed ports
80/tcp  open  http
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

Nmap scan report for
Host is up (0.012s latency).
All 1000 scanned ports on are closed

Nmap scan report for
Host is up (0.0047s latency).
Not shown: 976 closed ports
22/tcp    open     ssh
42/tcp    filtered nameserver
49/tcp    filtered tacacs
106/tcp   filtered pop3pw
843/tcp   filtered unknown
901/tcp   filtered samba-swat
903/tcp   filtered iss-console-mgr
1066/tcp  filtered fpo-fns
1067/tcp  filtered instl_boots
1169/tcp  filtered tripwire
2009/tcp  filtered news
4005/tcp  filtered pxc-pin
4242/tcp  open     vrml-multi-use
6007/tcp  filtered X11:7
7002/tcp  filtered afs3-prserver
8873/tcp  filtered dxspider
10629/tcp filtered unknown
19101/tcp filtered unknown
19842/tcp filtered unknown
27356/tcp filtered unknown
45100/tcp filtered unknown
50002/tcp filtered iiimsf
50006/tcp filtered unknown
62078/tcp open     iphone-sync

Nmap scan report for
Host is up (0.072s latency).
Not shown: 999 closed ports
62078/tcp open  iphone-sync

Nmap done: 154 IP addresses (6 hosts up) scanned in 164.14 seconds

In this case, is the router.

Not the answer you're looking for? Browse other questions tagged or ask your own question.