WN2000RPTv3 runs OpenWrt Linux for MIPS

Trying to determine if a DHCP server is hidden in the WN2000RPTv3 firmware, I took a look at the current ...v3 update .img file - hoping ASCII stuff like URLs would be in clear text.  The answer is no, but the first few hundred bytes is enlightenting:

00: 64 65 76 69 63 65 3A 77 6E 32 30 30 30 72 70 74 device:wn2000rpt
10: 76 33 0A 76 65 72 73 69 6F 6E 3A 56 31 2E 30 2E v3.version:V1.0.
20: 31 2E 34 0A 72 65 67 69 6F 6E 3A 0A 68 64 5F 69 1.4.region:.hd_i
30: 64 3A 32 39 37 36 33 39 30 34 2B 34 2B 33 32 0A d:29763904+4+32.
40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
80: 32 30 30 34 77 22 3F 2B 56 38 20 38 00 0C 47 B3 2004w"?+V8 8..G.
90: 80 00 20 00 80 1E 6B A0 7A 0E 31 FC 05 05 02 03 .. ...k.z.1.....
A0: 4D 49 50 53 20 4F 70 65 6E 57 72 74 20 4C 69 6E MIPS OpenWrt Lin
B0: 75 78 2D 32 2E 36 2E 33 31 00 00 00 00 00 00 00 ux-2.6.31.......
C0: 6D 00 00 80 00 70 9B 25 00 00 00 00 00 00 04 01 m....p.%........
D0: CF 4E 80 07 40 3C 00 EA 3F F2 E0 C0 CF FC C6 50 .N..@<..?......P

.

.

.

Interesting.  It appears to run MIPS OpenWrt Linux.  (https://openwrt.org/)  Unfortunately, the box does not respond to SSH on :22, though it responds, of course, on :80 with a login page.  I'd be nice to find the file system.

I don't recognize what seem to be loader headers [device:, version:, region:, hd_id:].  Are they familar to anyone?

Tom