How to unbrick the Nighthawk R7000 using OS X and TFTP

[waymer66]

I have followed the instructions to the letter, as outlined in the first post:
Ran a cable from the computer directly to the first LAN port.
Opened System Preferences/Network and keyed in the following:
Configure IPv4: Manually
IP Address: 192.168.1.10
Subnet Mask: 255.255.255.0
Router: (left blank)

I opened up the terminal and commanded it to the desktop. I opened another window in the terminal and entered “ping 192.168.1.1”.
I get the message Request timeout for icmp_seq (number).

What am I doing wrong or is this proof that the router is toast? Thanks.

[antinode]

> What am I doing wrong or is this proof that the router is toast?

   It's evidence that the router is not responding as expected.  But
you've joined a years-old discussion and provided little information
about your own situation.  Starting your own thread for your own problem
might make more sense.

> Model: R7000P|Nighthawk AC2300 Smart WiFi Dual Band Gigabit Router

   Is that your model?  Connected to what?

   LED indicators?  Any other symptoms?  Have you done a settings reset?

[waymer66]

---

@antinode wrote:

> What am I doing wrong or is this proof that the router is toast?

   It's evidence that the router is not responding as expected.  But
you've joined a years-old discussion and provided little information
about your own situation.  Starting your own thread for your own problem
might make more sense.

> Model: R7000P|Nighthawk AC2300 Smart WiFi Dual Band Gigabit Router

   Is that your model?  Connected to what?

   LED indicators?  Any other symptoms?  Have you done a settings reset?

I had a friend who is an engineer walk me through the steps as outlined previously again. It's bricked, so I ordered a mesh system from a company that doesn't encourage it's customers to trash their routers via auotmatic updating.

[antinode]

> I had a friend who is an engineer walk me through the steps as
> outlined previously again. [...]

   Did he tell you how to answer basic questions, too?  Apparently not.

[techtherapy]

thanks so much for the guide @kryptonix, you saved me a lot of time

[seethelight]

Hi guys, fantastic summary. It works perfectly until the very last point. When i type put _ name of the file after few second i receive the message "transfer timed out".

The shell with the ping repietely have the following lines:

Request timeout for icmp_seq 1874

Request timeout for icmp_seq 1875

Request timeout for icmp_seq 1876

64 bytes from 192.168.1.1: icmp_seq=1877 ttl=63 time=1.824 ms

64 bytes from 192.168.1.1: icmp_seq=1878 ttl=63 time=1.571 ms

64 bytes from 192.168.1.1: icmp_seq=1879 ttl=63 time=1.780 ms

Request timeout for icmp_seq 1880

Request timeout for icmp_seq 1881

Request timeout for icmp_seq 1882

Request timeout for icmp_seq 1883

ping: sendto: No route to host

Request timeout for icmp_seq 1884

ping: sendto: Host is down

Request timeout for icmp_seq 1885

ping: sendto: Host is down

Request timeout for icmp_seq 1886

ping: sendto: Host is down

Request timeout for icmp_seq 1887

ping: sendto: Host is down

anyone would be able to advise how i can get the last step done? it seems to me that the router keeps rebooting so that there is no enough time to transfer the new firmware?

[seethelight]

Apologies for the multiple messages, diregard the previous one. 

Some context first:

I have a r8000 which i understand is very similar to r8000 in terms of troubleshooting. I was trying to flash the router with Advance tomato. The firmware seemed to be correctly installed but clearly this was not the case as after the installation was completed the router got stuck in what i believe is a reboot loop. after spending pratically all night trying to resolve it I came across this post. I followed all the steps mentioned and i got until the last one where after i send the command to install the latest version of original netgear firmware i receive the message, like many others above, "request timed out". 

I diligently read the advise that @antinode gave to previous users and therefore see below the copy and paste from the two shells i have used to type the commands.  

Shell with commands:

Last login: Tue Nov 24 01:48:43 on ttys001

diego@Dies-Air ~ % ls

Applications

Creative Cloud Files

Desktop

Documents

Downloads

Library

Movies

Music

OneDrive

Pictures

Public

iCloud Drive (Archive)

diego@Dies-Air ~ % cd desktop

diego@Dies-Air desktop % ls

Accounts.xlsx TFTP Client 2.app

DS_Store.txt TFTP Client.app

Documents Transfer_1.3.dmg

FOTO (EXPORT) Worksheet 2019:2020v1.xls

R8000-V1.0.4.62_10.1.74 nmrpflash

R8000-V1.0.4.62_10.1.74.chk nmrpflash-0.9.14-macos.zip

R8000-V1.0.4.62_10.1.74.zip tftp_client_122_intel.zip

diego@Dies-Air desktop % tftp

tftp> connect 192.168.1.1

tftp> status

Connected to 192.168.1.1.

Mode: netascii Verbose: off Tracing: off

Rexmt-interval: 5 seconds, Max-timeout: 25 seconds

tftp> binary

tftp> put R8000-V1.0.4.62_10.1.74.chk

Transfer timed out.

SHELL WITH PING

Last login: Tue Nov 24 01:54:42 on ttys001

diego@Dies-Air desktop % ping 192.168.1.1

PING 192.168.1.1 (192.168.1.1): 56 data bytes

64 bytes from 192.168.1.1: icmp_seq=0 ttl=100 time=25.285 ms

64 bytes from 192.168.1.1: icmp_seq=1 ttl=100 time=2.573 ms

64 bytes from 192.168.1.1: icmp_seq=2 ttl=100 time=2.495 ms

64 bytes from 192.168.1.1: icmp_seq=3 ttl=100 time=2.499 ms

Request timeout for icmp_seq 4

Request timeout for icmp_seq 5

Request timeout for icmp_seq 6

Request timeout for icmp_seq 7

Request timeout for icmp_seq 8

Request timeout for icmp_seq 9

Request timeout for icmp_seq 10

Request timeout for icmp_seq 11

Request timeout for icmp_seq 12

Request timeout for icmp_seq 13

Request timeout for icmp_seq 14

Request timeout for icmp_seq 15

Request timeout for icmp_seq 16

Request timeout for icmp_seq 17

Request timeout for icmp_seq 18

Request timeout for icmp_seq 19

Request timeout for icmp_seq 20

Request timeout for icmp_seq 21

Request timeout for icmp_seq 22

Request timeout for icmp_seq 23

Request timeout for icmp_seq 24

Request timeout for icmp_seq 25

Request timeout for icmp_seq 26

Request timeout for icmp_seq 27

Request timeout for icmp_seq 28

Request timeout for icmp_seq 29

Request timeout for icmp_seq 30

Request timeout for icmp_seq 31

Request timeout for icmp_seq 32

Request timeout for icmp_seq 33

Request timeout for icmp_seq 34

Request timeout for icmp_seq 35

Request timeout for icmp_seq 36

ping: sendto: No route to host

Request timeout for icmp_seq 37

ping: sendto: No route to host

Request timeout for icmp_seq 38

ping: sendto: No route to host

Request timeout for icmp_seq 39

ping: sendto: No route to host

Request timeout for icmp_seq 40

Request timeout for icmp_seq 41

Request timeout for icmp_seq 42

Request timeout for icmp_seq 43

Request timeout for icmp_seq 44

Request timeout for icmp_seq 45

Request timeout for icmp_seq 46

Request timeout for icmp_seq 47

Request timeout for icmp_seq 48

Request timeout for icmp_seq 49

Request timeout for icmp_seq 50

Request timeout for icmp_seq 51

64 bytes from 192.168.1.1: icmp_seq=49 ttl=100 time=3631.749 ms

64 bytes from 192.168.1.1: icmp_seq=50 ttl=100 time=2630.577 ms

64 bytes from 192.168.1.1: icmp_seq=53 ttl=100 time=2.544 ms

64 bytes from 192.168.1.1: icmp_seq=54 ttl=100 time=2.523 ms

64 bytes from 192.168.1.1: icmp_seq=55 ttl=100 time=2.076 ms

64 bytes from 192.168.1.1: icmp_seq=56 ttl=100 time=2.541 ms

Request timeout for icmp_seq 58

Request timeout for icmp_seq 59

Request timeout for icmp_seq 60

Request timeout for icmp_seq 61

Request timeout for icmp_seq 62

Request timeout for icmp_seq 63

Request timeout for icmp_seq 64

Request timeout for icmp_seq 65

Request timeout for icmp_seq 66

Request timeout for icmp_seq 67

Request timeout for icmp_seq 68

Request timeout for icmp_seq 69

Request timeout for icmp_seq 70

Request timeout for icmp_seq 71

Request timeout for icmp_seq 72

Request timeout for icmp_seq 73

Request timeout for icmp_seq 74

Request timeout for icmp_seq 75

Request timeout for icmp_seq 76

Request timeout for icmp_seq 77

Request timeout for icmp_seq 78

Request timeout for icmp_seq 79

Request timeout for icmp_seq 80

Request timeout for icmp_seq 81

Request timeout for icmp_seq 82

Request timeout for icmp_seq 83

Request timeout for icmp_seq 84

Request timeout for icmp_seq 85

ping: sendto: No route to host

Request timeout for icmp_seq 86

ping: sendto: No route to host

Request timeout for icmp_seq 87

ping: sendto: No route to host

Request timeout for icmp_seq 88

Request timeout for icmp_seq 89

Request timeout for icmp_seq 90

Request timeout for icmp_seq 91

Request timeout for icmp_seq 92

Request timeout for icmp_seq 93

Request timeout for icmp_seq 94

Request timeout for icmp_seq 95

ping: sendto: No route to host

Request timeout for icmp_seq 96

ping: sendto: Host is down

Request timeout for icmp_seq 97

ping: sendto: Host is down

Request timeout for icmp_seq 98

ping: sendto: Host is down

Request timeout for icmp_seq 99

ping: sendto: Host is down

Request timeout for icmp_seq 100

ping: sendto: Host is down

Request timeout for icmp_seq 101

ping: sendto: Host is down

Request timeout for icmp_seq 102

ping: sendto: Host is down

Request timeout for icmp_seq 103

Request timeout for icmp_seq 104

64 bytes from 192.168.1.1: icmp_seq=105 ttl=100 time=5.389 ms

64 bytes from 192.168.1.1: icmp_seq=106 ttl=100 time=2.545 ms

64 bytes from 192.168.1.1: icmp_seq=107 ttl=100 time=2.514 ms

64 bytes from 192.168.1.1: icmp_seq=108 ttl=100 time=2.599 ms

Request timeout for icmp_seq 109

it seems to me that there is no enough time to install the firmare as the router keeps re-booting?

@techtherapy @kryptonix @antinode  any guidance much appreciated -

[kryptonix]

Quick reply - when you LS your desktop, the file is not listed. Unpack the zip file with the chk, put the chk on the desktop then try again;)

[antinode]

> it seems to me that there is no enough time to install the firmare as
> the router keeps re-booting?

   That can be a problem.  I'd try fiddling with power-on and Reset
timing, hoping to get lucky.

   If you can't find a time window when it works, then you might need to
bring out the big guns, like opening the box and attaching a serial port
adapter, and using that to interrupt whatever it's doing.  A Web search
for terms like, say:
      netgear serial port
should find more information.

> Quick reply - when you LS your desktop, the file is not listed. [...]

   Try a slower reply?  I see it there.  Did the program complain about
"No such file or directory"?  "ls" and "ls -1" are different.  (So is
"LS".)  File names which include spaces can cause confusion, too.

[vijay_amrit]

Wow, i was trying to unbrick my router and came across this. The other solutions i found needed a client that is not compatible with newer versions of MacOS. This has very clear istructions one can follow. One thing i noticed was that while trying to ping, i only got 'Request timeout' message. However there was no problem in connecting and uploading the firmware. Thanks a lot

[vijay_amrit]

@seethelight just proceed with next step. i got request timout message during ping too. however rest of the steps worked well.

---

it seems to me that there is no enough time to install the firmare as the router keeps re-booting?

@techtherapy @kryptonix @antinode  any guidance much appreciated -

---

[brunomartorella]

I have an R6700 and this is the closest thread I've found to mirror my issue. After getting to the last page, I notice I'm having the same exact problem as @seethelight . My router keeps rebooting constantly and, via the ping command, I notice that it's only on for 4 seconds, and then restarts again, running through the restart loop for 93 seconds, at which point it's connected again for 4 seconds and back to restart.

Seems like this is not enough time to execute the TFTP command.. Wondering if anyone found a solution to this? I tried using a different power adapter and problem persists, so the power source is not the issue. Tried hard resets but also doesn't help.

PS: this happened after I set the router to repeater mode.

PS2: not sure if I should open a new thread?

Here's the file in my desktop, using an old one because it was the one that ran more stable before this mess:

Last login: Sun Jan 10 11:04:46 on ttys000

Brunos-MacBook-Air-2:~ bruno$ cd desktop

Brunos-MacBook-Air-2:desktop bruno$ ls

R6700-V1.0.1.20_10.0.32.chk

Brunos-MacBook-Air-2:desktop bruno$

Here is the reboot pattern. I leave the router on and it does this forever:

Last login: Sun Jan 10 11:06:38 on ttys001

Brunos-MacBook-Air-2:~ bruno$ ping 192.168.1.1

PING 192.168.1.1 (192.168.1.1): 56 data bytes

Request timeout for icmp_seq 0

Request timeout for icmp_seq 1

Request timeout for icmp_seq 2

Request timeout for icmp_seq 3

Request timeout for icmp_seq 4

Request timeout for icmp_seq 5

Request timeout for icmp_seq 6

Request timeout for icmp_seq 7

Request timeout for icmp_seq 8

Request timeout for icmp_seq 9

Request timeout for icmp_seq 10

Request timeout for icmp_seq 11

ping: sendto: No route to host

Request timeout for icmp_seq 12

ping: sendto: Host is down

Request timeout for icmp_seq 13

Request timeout for icmp_seq 14

64 bytes from 192.168.1.1: icmp_seq=15 ttl=100 time=3.081 ms

64 bytes from 192.168.1.1: icmp_seq=16 ttl=100 time=1.577 ms

64 bytes from 192.168.1.1: icmp_seq=17 ttl=100 time=1.630 ms

64 bytes from 192.168.1.1: icmp_seq=18 ttl=100 time=1.417 ms

Request timeout for icmp_seq 19

Request timeout for icmp_seq 20

Request timeout for icmp_seq 21

Request timeout for icmp_seq 22

Request timeout for icmp_seq 23

Request timeout for icmp_seq 24

Request timeout for icmp_seq 25

Request timeout for icmp_seq 26

And here is the TFTP command I'm running. I'm doing the put exactly when I get the first ttl=100 response from the separate terminal window where I'm pinging the router:

Last login: Sun Jan 10 11:07:33 on ttys001

Brunos-MacBook-Air-2:~ bruno$ cd desktop

Brunos-MacBook-Air-2:desktop bruno$ ls

R6700-V1.0.1.20_10.0.32.chk

Brunos-MacBook-Air-2:desktop bruno$ tftp

tftp> connect 192.168.1.1

tftp> status

Connected to 192.168.1.1.

Mode: netascii Verbose: off Tracing: off

Rexmt-interval: 5 seconds, Max-timeout: 25 seconds

tftp> binary

tftp> status

Connected to 192.168.1.1.

Mode: octet Verbose: off Tracing: off

Rexmt-interval: 5 seconds, Max-timeout: 25 seconds

tftp> put R6700-V1.0.1.20_10.0.32.chk

Transfer timed out.

tftp>

[seethelight]

unfortunately i wasnt able to resolve it. Still hoping that someone pops up here with a solution. I also tried with the 4 pins cable but to no avail. If someone could post here all the steps to follow with the 4 pins and mac would be great but to date i have no solution to offer. 

[jparkerBBIT]

same here mate.  Netgear is garbage 

[Jatayu]

Hi ,

Followed the commands and unable to transfer the file.

Receiving - Transfer timed out

[itsmevgupta]

Hi 

Thanks for the detailed steps. I have tried your method.

1. I get ping from the router only for few seconds and then it keeps getting timed out

2. When I use the Put command to transfer the firmware, I keep getting "Transfer timed out". I'm guessing that is because of step 1. 

I am also noticing that my router is in a constant restart cycle on its own. Pressing the RESET button is not doing anything either. Please let me know if you have any suggestions?

[itsmevgupta]

Did you find any resolution to this? I am running into the same issue and my router is in a constant restart loop. 

[brunomartorella]

Did not. At this point I’m just gonna toss it in the trash can

[seethelight]

That’s exactly what I did. Tossed it out

[itsmevgupta]

I finally managed to fix mine. Used the other method nmpr flash method. 
https://github.com/jclehner/nmrpflash

[brunomartorella]

Super silly question coming from someone who is not well versed with terminal (or any coding)... how do I actually install nmrpflash? I downloaded it for Mac OS, navigated to the directory where it's at in Terminal, but then typing "nmrpflash -L" gives me nothing...

-->xxxxxx:~/Downloads$ nmrpflash -L

-bash: nmrpflash: command not found

[itsmevgupta]

There is no silly question @brunomartorella . Infact, I was running into this exact same issue earlier. The key is to copy the downloaded files onto the desktop. and then execute the steps below:

1. Download the latest firmware from the Netgear website and extract it to your desktop. I had the .chk file on my desktop.

2. Follow the instructions here to set a static IP. FWIW, I left my Router entry blank. 

3. Use an ethernet cord to connect to the router (one of the LAN ports, not the internet port). 

4. Download macOS file here: https://github.com/jclehner/nmrpflash/releases

5. Extract the zip file to your desktop as well

5. Open terminal, type 

cd desktop

6. Then, I followed the instructions in the github page. These are the commands I used specifically:

./nmrpflash -L

to pull up the list of connections and find the name of my ethernet port connected to the router (Find the one with IP 192.168.1.10)

7. Then you turn OFF the router.

8. For the rest of this example, let's assume that your router is connected to eth2, and that you want to flash a firmware image named R7000-V1.0.11.128_10.2.112.chk.

sudo ./nmrpflash -i eth2 -f R7000-V1.0.11.128_10.2.112.chk

Enter your mac password if you are asked for it.

Then I got the response 

Waiting for physical connection

9. And then I turned on my router. I did have the reset button pushed in while turning it on. Release the button after about 10 seconds.

After that, it should do its thing. You will see some messages in terminal but sometimes there will be a minute or two with no updates, just wait. It took about 5 minutes, I just had to wait. Once nmrpflash tells you to reboot your device, do so and it should work now. 

10. The last step I had to do was to reconfigure my router as I am using it as a repeater. 

Hope this helps. Let me know if there are any questions.

[brunomartorella]

Gahhh I was missing the ./ oops

Anyway, tried it and it doesn't work. Both with and without the reset button. I think the router and its very short reboot cycle don't allow it to transfer the file, which is the same problem as I had with tftp. It's funny because I execute it in verbose mode and it seems like it's transferring data out "<< DATA (n)" where n changes every few seconds to n+1. But then it keeps on doing that even after I power the router down, which means it's really not doing anything.

[brunomartorella · Accepted solution]

HOLY COW IT WORKED!!!

nmrpflash worked!!! Switching to a Static IP address and turning my Wifi off did the trick!!

Also, recommend using -vvv to double check when it works. Took me two tries to nail the timing because the router has to finish restarting for the packet transfer to begin before the command times out.

[itsmevgupta]

@brunomartorella  Great job!! Glad we were able to motivate each other