PON Serial Number Change, Linux Shell Access & Flash Command Reference
The Digisol DG-GR6011 is a GPON (Gigabit Passive Optical Network) ONT (Optical Network Terminal) router designed for fiber-to-the-home (FTTH) deployments.
Key Features:
- GPON interface with auto-sensing
- Gigabit Ethernet ports
- VoIP capability
- CATV RF overlay support
- TR-069 remote management
Typical Use Cases:
- ISP fiber broadband connections
- FTTH residential deployments
- Triple-play services (Internet + Voice + TV)
| Component | Specification |
|---|---|
| Device Model | DG-GR6011 |
| Chipset | Realtek RTK9607C |
| CPU | MIPS interAptiv V2.0 (Dual Core) |
| CPU Speed | ~700 MHz (BogoMIPS: 697.95) |
| Architecture | MIPS 32-bit, Big Endian |
| RAM | 128 MB |
| Flash Memory | 16 MB |
| GPON | Class B+/C+ |
| Ethernet Ports | 1x Gigabit LAN + 1x GPON WAN |
| VoIP | 1x FXS ports |
| USB | 1x USB 2.0 (model dependent) |
| Component | Details |
|---|---|
| Operating System | Linux (embedded) |
| Kernel Version | 4.4.140 |
| Build System | gcc 4.8.5 (Realtek MSDK) |
| Shell | BusyBox v1.x |
| Filesystem | SquashFS (root), JFFS2 (config) |
| Web Server | BOA HTTP Server |
| Management | OMCI (ONT Management Control Interface) |
| Remote Mgmt | TR-069 (CWMP) |
MTD Partitions:
┌──────────────┬──────────┬─────────────────┐
│ Partition │ Size │ Purpose │
├──────────────┼──────────┼─────────────────┤
│ boot │ 160 KB │ Bootloader │
│ env │ 8 KB │ Environment 1 │
│ env2 │ 8 KB │ Environment 2 │
│ config │ 848 KB │ Configuration │
│ kernel │ 2560 KB │ Linux Kernel │
│ rootfs │ 6 MB │ Root Filesystem │
│ rootfs2 │ 6 MB │ Backup RootFS │
│ custconf │ 512 KB │ Custom Config │
└──────────────┴──────────┴─────────────────┘
Default Settings:
- LAN IP: 192.168.1.1 (may vary by firmware)
- Subnet Mask: 255.255.255.0
- DHCP Server: Enabled (pool: .2 to .254)
- Default Gateway: Self (LAN interface)
- DNS: Relay mode (forwards to WAN DNS)
Interfaces:
eth0- Physical Ethernet switcheth0.X- VLAN interfacesnas0_X- WAN interfaces (PPPoE/IPoE)br0- Bridge interface (LAN)
# 1. Connect via telnet
telnet <device_ip>
login: <username>
password: <password>
# 2. Enter Linux shell (THE KEY COMMAND!)
> enterlinuxshell
# 3. Set new PON vendor ID
# flash set PON_VENDOR_ID HWTC
# 4. Set new serial number
# flash set GPON_SN HWTC87654321
# 5. Verify changes
# flash get PON_VENDOR_ID
# flash get GPON_SN
# 6. Reboot
# reboot
# 7. Wait 2-3 minutes, reconnect, verify:
> show deviceinfoAccess Requirements:
- Admin username and password
- Telnet client (available on Windows/Mac/Linux)
- Network access to device (LAN connection)
Information to Gather:
- Current PON vendor ID and serial number
- Target PON vendor ID (from new ISP)
- Target serial number (from ISP or old device)
- Optional: PLOAM password (if required by ISP)
Method 1: Physical Label
- Check sticker on bottom/back of device
- Look for "S/N" or "PON SN"
- Format:
ABCD12345678(4 letters + 8 digits)
Method 2: Web Interface
- Open browser:
http://<device_ip> - Login with admin credentials
- Navigate to: Status → Device Info
- Note "PON Serial Number"
Method 3: Telnet CLI
telnet <device_ip>
> show deviceinfo
# Look for "PON serial no." line| Vendor ID | Manufacturer |
|---|---|
HWTC |
Huawei Technologies |
ALCL |
Alcatel-Lucent / Nokia |
ZTEG |
ZTE |
ZYOT |
Zyxel |
GPON |
Generic GPON ONU |
BDCM |
Broadcom |
Via Web Interface:
- Open browser and navigate to router IP
- Login with admin credentials
- Go to: Security → Login Privilege (or Remote Access)
- Enable: Telnet on LAN
- Optional: Set firewall to Low (if flash commands blocked)
- Click Apply / Save
Verify telnet is enabled:
telnet <device_ip>
# Should prompt for login, not "Connection refused"Open terminal/command prompt:
telnet <device_ip>Login:
DG-GR6011 login: <username>
Password: ********
>
Verify connection:
> show deviceinfoThis is the critical command that unlocks everything:
> enterlinuxshellExpected output:
#
You are now in the BusyBox Linux shell with full system access!
Note: If enterlinuxshell doesn't work:
- Try:
sh,shell,/bin/sh,bash - Check if "Login Privilege" needs enabling in web GUI
- Your firmware version may not support this
Set PON Vendor ID:
# flash set PON_VENDOR_ID HWTCSet GPON Serial Number:
# flash set GPON_SN HWTC87654321Serial Number Format:
- Total: 12 characters
- First 4: Vendor ID (uppercase letters)
- Last 8: Unique identifier (alphanumeric)
- Example:
HWTC87654321,ALCL12345ABC
Verify changes:
# flash get PON_VENDOR_ID
PON_VENDOR_ID=HWTC
# flash get GPON_SN
GPON_SN=HWTC87654321Reboot device:
# rebootFinal verification after reboot:
telnet <device_ip>
> show deviceinfo
# Look for:
PON vendor id : HWTC
PON serial no. : HWTC87654321The flash command is a utility for managing MIB (Management Information Base) configuration data stored in flash memory.
flash <command> [arguments]
| Command | Description | Example |
|---|---|---|
info |
Show flash offset information | flash info |
list [cs|hs|all] [sorted] |
List MIB parameters (optionally sorted) | flash list cs sorted |
all [cs|hs] |
Dump all flash parameters | flash all cs |
all_def [cs|hs] |
Dump all MIB default values | flash all_def cs |
| Command | Description | Example |
|---|---|---|
get <MIB-NAME> |
Get specific MIB table entry | flash get NTP_ENABLED |
get <MIB-CHAIN>.NUM |
Get MIB chain record count | flash get ATM_VC_TBL.NUM |
get <MIB-CHAIN> |
Get all records from a MIB chain | flash get ATM_VC_TBL |
get <MIB-CHAIN>.<index>.<member> |
Get specific member of chain record | flash get ATM_VC_TBL.0.ifIndex |
get_def <MIB-NAME> |
Get default value of specific MIB | flash get_def NTP_ENABLED |
get_def <MIB-CHAIN> |
Get default value of MIB chain | flash get_def ATM_VC_TBL |
get_def <MIB-CHAIN>.NUM |
Get default record count | flash get_def ATM_VC_TBL.NUM |
get_def <MIB-CHAIN>.<index>.<member> |
Get default value of chain member | flash get_def ATM_VC_TBL.0.ifIndex |
r <OFFSET> |
Read flash from specific offset | flash r 0x1000 |
| Command | Description | Example |
|---|---|---|
set <MIB-NAME> <VALUE> |
Set specific MIB table entry | flash set NTP_ENABLED 0 |
set <MIB-CHAIN>.<index>.<member> <VALUE> |
Set specific member of chain record | flash set ATM_VC_TBL.1.vpi 8 |
add <MIB-CHAIN> |
Add a new MIB chain record | flash add ATM_VC_TBL |
add <MIB-CHAIN>.<count> |
Add multiple MIB chain records | flash add ATM_VC_TBL.2 |
del <MIB-CHAIN> |
Delete the last MIB chain record | flash del ATM_VC_TBL |
del <MIB-CHAIN>.<index> |
Delete specific MIB chain record | flash del ATM_VC_TBL.2 |
w <OFFSET> <VALUE> |
Write value to specific flash offset | flash w 0x1000 0xFF |
| Command | Description | Example |
|---|---|---|
default <cs/hs> |
Write program default values to flash | flash default cs |
clear |
Clear all flash settings | flash clear |
erase <OFFSET> |
Erase flash from specific offset | flash erase 0x1000 |
voip |
VoIP settings management | flash voip |
loop |
Enter infinite loop (debugging) | flash loop |
# PON Vendor ID (4 characters, uppercase)
flash get PON_VENDOR_ID
flash set PON_VENDOR_ID HWTC
# GPON Serial Number (12 characters)
flash get GPON_SN
flash set GPON_SN HWTC87654321
# GPON PLOAM Password (if required by ISP)
flash get GPON_PLOAM_PASSWD
flash set GPON_PLOAM_PASSWD 0123456789AB
# GPON ONU Model identifier
flash get GPON_ONU_MODEL# Hardware version
flash get HW_HWVER
# WAN MAC address
flash get HW_NIC0_ADDR
flash set HW_NIC0_ADDR 00:11:22:33:44:55
# LAN MAC address
flash get HW_NIC1_ADDR
# WLAN MAC address
flash get HW_WLAN_ADDR# LAN IP address
flash get LAN_IP_ADDR
flash set LAN_IP_ADDR 192.168.1.1
# LAN subnet mask
flash get LAN_SUBNET
# DHCP server enable/disable
flash get LAN_DHCP
# DNS servers
flash get DNS1
flash get DNS2
flash get DNS3Configuration parameters that can be modified by the user:
- Network settings (IP addresses, DHCP, DNS)
- Security settings (firewall, ACL)
- Service configurations (NTP, CWMP/TR-069)
- WLAN settings
Hardware-specific parameters typically set at factory:
- MAC addresses
- TX power settings
- RF calibration data
- Serial numbers
- Country codes
| ID | Name | Description |
|---|---|---|
| 1 | LAN_IP_ADDR | LAN interface IP address |
| 2 | LAN_SUBNET | LAN subnet mask |
| 5 | LAN_DHCP | DHCP server enable/disable |
| 20 | DNS_MODE | DNS mode configuration |
| 21-23 | DNS1, DNS2, DNS3 | DNS server addresses |
| 49 | DMZ_ENABLE | DMZ feature enable |
| 50 | DMZ_IP | DMZ host IP address |
| 126 | NTP_ENABLED | NTP client enable |
| 140 | UPNP | UPnP enable/disable |
| 142 | ENABLE_QOS | QoS enable/disable |
| 159 | SYSLOG | Syslog enable/disable |
| 337 | LOID | Logical ONU ID |
| 462 | MIB_TELNET_ENABLE | Telnet service enable |
| ID | Name | Description |
|---|---|---|
| 3001 | IP_PORT_FILTER_TBL | IP port filtering rules |
| 3002 | MAC_FILTER_TBL | MAC address filtering rules |
| 3003 | PORT_FW_TBL | Port forwarding rules |
| 3004 | ATM_VC_TBL | ATM Virtual Circuit configuration |
| 3007 | IP_ROUTE_TBL | Static IP routing table |
| 3008 | ACL_IP_TBL | Access Control List IP entries |
| 3011 | ACC_TBL | Account/user table |
| 3014 | IP_QOS_TBL | QoS configuration table |
| 3029 | URL_FQDN_TBL | URL filtering by FQDN |
| 3063 | PORT_BINDING_TBL | Port binding configuration |
| 3105 | VOIP_TBL | VoIP configuration |
| ID | Name | Description |
|---|---|---|
| 2002 | ELAN_MAC_ADDR | Ethernet LAN MAC address |
| 2003 | WLAN_MAC_ADDR | Wireless LAN MAC address |
| 2025 | HW_SERIAL_NO | Hardware serial number |
| 2027 | HW_CTEI_NO | CTEI number |
| 2028 | HW_CMEI_NO | CMEI number |
| 2099-2100 | HW_WLANx_COUNTRYCODE | WLAN country code |
| 2033-2051 | HW_WLANx_TX_POWER_* | TX power calibration |
| ID | Name | Description |
|---|---|---|
| 4002 | CWMP_ACS_URL | ACS server URL |
| 4004 | CWMP_ACS_USERNAME | ACS authentication username |
| 4005 | CWMP_ACS_PASSWORD | ACS authentication password |
| 4006 | CWMP_INFORM_ENABLE | Enable periodic inform |
| 4009 | CWMP_INFORM_INTERVAL | Inform interval (seconds) |
| 4011 | CWMP_CONREQ_USERNAME | Connection request username |
| 4012 | CWMP_CONREQ_PASSWORD | Connection request password |
| 4019 | CWMP_CONREQ_PORT | Connection request port |
| 4021 | CWMP_WAN_INTERFACE | WAN interface for CWMP |
| ID | Name | Description |
|---|---|---|
| 44 | IPF_OUT_ACTION | IP filter outbound default action |
| 45 | IPF_IN_ACTION | IP filter inbound default action |
| 46 | MACF_OUT_ACTION | MAC filter outbound default action |
| 47 | MACF_IN_ACTION | MAC filter inbound default action |
| 96 | SPC_ENABLED | SPC (Service Protection Control) enable |
| 98 | ACL_CAPABILITY | ACL capability enable |
| 179 | DOS_ENABLED | DoS protection enable |
| 425 | FW_ENABLE | Firewall enable |
| 426 | FW_GRADE | Firewall security level |
| ID | Name | Description |
|---|---|---|
| 142 | ENABLE_QOS | Enable QoS |
| 144 | QOS_UPRATE | Upstream QoS rate |
| 145 | QOS_POLICY | QoS policy type |
| 146 | TOTAL_BANDWIDTH | Total bandwidth limit |
| 148 | QOS_MODE | QoS mode |
| 152 | IP_QOS_QUEUE_NUM | Number of QoS queues |
After entering enterlinuxshell, you have access to a complete BusyBox Linux environment.
# Kernel and system info
uname -a
cat /proc/version
cat /proc/cpuinfo
# Memory information
cat /proc/meminfo
free
# Mounted filesystems
mount
# Disk usage
df
# List all processes
ps
ps aux
# View system log
dmesg
logread# Network interfaces
ifconfig
ifconfig -a
# Routing table
route -n
# ARP table
arp -a
# Network statistics
netstat -an
netstat -tulpn
# Firewall rules
iptables -L -n
# Bridge status
brctl show
# Ping
ping <ip># List files
ls -la
# View file contents
cat <file>
# Search in files
grep "pattern" <file>
grep -r "pattern" /path/
# Find files
find / -name "filename"Before entering enterlinuxshell, the device has a restricted CLI with specific commands.
# Device information (includes PON serial)
show deviceinfo
# System status
show status
# Network interfaces
show interface
# DHCP settings and clients
show dhcp
# Routing table
show route
# ARP table
show arp
# Bridge settings
show bridge
# Firewall rules
show ipportfilter
show macfilter
# Port forwarding
show portforward
# Remote access settings
show remoteaccess
# WAN configuration
show wan
# LAN configuration
show lan
# TR-069 settings
show tr069# Save configuration to flash
config save
# Factory reset
config reset
# DHCP configuration
config dhcp mode {none|relay|server}
config dhcp server poolstart <ip> poolend <ip>
# LAN configuration
config lan ip <ip> mask <netmask>
# Firewall
config ipportfilter default incoming {allow|deny} outgoing {allow|deny}
# Port forwarding
config portforward add protocol <tcp|udp|both> localip <ip> localport <port>
# Remote access
config remoteaccess telnet lan {allow|deny} wan {allow|deny}
config remoteaccess http lan {allow|deny} wan {allow|deny}# Reboot device
reboot
# Backup configuration via TFTP
backup tftp <server_ip> <filename>
# Restore configuration via TFTP
restore tftp <server_ip> <filename>
# Display help
help
# Exit telnet session
exitflash get LAN_IP_ADDR
flash get LAN_SUBNET
flash get LAN_DHCP# Enable NTP
flash set NTP_ENABLED 1
# Disable Telnet
flash set MIB_TELNET_ENABLE 0
# Enable UPNP
flash set UPNP 1# Read from old device:
# flash get PON_VENDOR_ID
# flash get GPON_SN
# Write to new device:
# flash set PON_VENDOR_ID ALCL
# flash set GPON_SN ALCL12345678
# reboot# Check current WAN MAC
# flash get HW_NIC0_ADDR
# Set new MAC
# flash set HW_NIC0_ADDR 00:11:22:33:44:55
# Reboot for changes to take effect
# reboot# Save all variables to file
# flash all cs > /tmp/flash_backup.txt# Reset current settings to default
flash default cs
# Reset hardware settings to default
flash default hsMIB chains are arrays of configuration records using this addressing format:
<CHAIN_NAME>.<INDEX>.<MEMBER>
- CHAIN_NAME: Name of the MIB chain (e.g., ATM_VC_TBL)
- INDEX: Zero-based record index
- MEMBER: Field name within the record
Example: ATM_VC_TBL.0.vpi refers to the VPI field of the first ATM VC entry.
Symptoms:
> enterlinuxshell
command error!
Solutions:
-
Try alternative commands:
> sh > shell > /bin/sh
-
Enable in web GUI:
- Go to: Security → Login Privilege
- Enable: "Advanced" or "Engineer" mode
- Save and reconnect
-
Check firmware version:
- Older firmware may not support this
- Update to latest firmware
-
Firewall blocking:
- Security → Firewall → Set to Low
- Security → Remote Access → Enable Telnet LAN
Solutions:
-
Ensure you're in shell:
- Prompt should be
#or$, not> - Run
enterlinuxshellfirst
- Prompt should be
-
Check variable name:
- Variable names are case-sensitive
- Try:
flash all | grep -i gpon
Solutions:
-
Verify flash write before reboot:
# flash get GPON_SN -
Ensure proper reboot:
# reboot- Don't power off abruptly
-
Try explicit save:
# sync # reboot
Checklist:
- Serial format correct? (12 characters:
XXXX12345678) - Vendor ID matches ISP's OLT?
- PLOAM password required?
- MAC address needs changing?
- VLAN configuration correct?
- Serial already registered with ISP?
Contact your ISP and ask for:
- PON Vendor ID (4 characters)
- Required serial number format
- Any additional authentication (PLOAM password)
- Whether serial needs pre-registration
No. The serial must:
- Match your ISP's OLT configuration
- Be unique on the PON network
- Follow proper format (vendor ID + identifier)
- May need ISP pre-registration
- PON_VENDOR_ID: Just the 4-letter code (e.g.,
HWTC) - GPON_SN: Full serial including vendor (e.g.,
HWTC87654321)
Set both to be safe.
Depends on ISP:
- Most ISPs: Serial number only
- Some ISPs: Serial + MAC address
- Ask your ISP if MAC binding is used
Yes! Just repeat the process with original values.
Always note down original values before changing:
> show deviceinfoVery low risk if you:
- Only change PON serial variables
- Don't modify other flash variables
- Verify changes before rebooting
- Keep record of original values
Recovery: Factory reset button (10-30 seconds) if needed.
-
Caution: Modifying flash settings directly can render the device inoperable. Always backup settings before making changes.
-
Persistence: Changes made with
flash setare written directly to flash memory and persist across reboots. -
Service Restart: Some settings require a service restart or device reboot to take effect.
-
Raw Access: The
r,w, anderasecommands provide raw flash access and should only be used by advanced users. -
Factory Reset: Use
flash default csto reset user configuration while preserving hardware calibration data.
The enterlinuxshell command provides root-level access!
Implications:
- Full read/write filesystem access
- Can modify any configuration
- Can view all system files
- Can monitor network traffic
Protect your device:
-
Use strong admin password
-
Disable WAN telnet:
> config remoteaccess telnet lan allow wan deny > config save
-
Enable firewall
-
Monitor access regularly
Always backup before modifications:
# Via telnet CLI
> show deviceinfo
> backup tftp <server_ip> backup.cfg
# Via shell
# flash all cs > /tmp/flash_backup.txtThis guide is provided for educational and legitimate network administration purposes only.
You MAY use this guide to:
- Migrate your service to a new ISP
- Replace a failed ONT with a backup unit
- Configure your own equipment on your own network
- Learn about GPON technology and Linux systems
- Perform authorized network testing
You MUST NOT:
- Clone serial numbers to steal broadband service
- Access ISP networks without authorization
- Bypass ISP equipment restrictions without permission
- Modify serial numbers for fraudulent purposes
Unauthorized network access and service theft are crimes in most jurisdictions and may result in:
- Criminal prosecution
- Civil liability
- Service termination
- Financial penalties
Before making changes:
- Read your ISP's terms of service
- Contact ISP for authorization if unsure
- Document any permissions received
This information is provided "AS IS" without warranty of any kind.
You accept full responsibility for:
- Verifying information accuracy
- Understanding procedures before executing
- Backing up configurations
- Ensuring legal compliance
- Consequences of any changes made
Modifying device configuration may:
- Void manufacturer warranty
- Void ISP service agreement
- Prevent official support
System Configuration:
/etc/config/config.xml - Main configuration
/etc/config/config_bak.xml - Backup configuration
/etc/config/config_hs.xml - Hardware settings
/var/config/ - Runtime configuration
OMCI Configuration:
/etc/config/omci_mib.cfg - OMCI MIB database
/etc/config/omci_custom_opt.conf - OMCI custom options
System Files:
/etc/passwd - User accounts
/proc/cmdline - Kernel boot parameters
/proc/cpuinfo - CPU information
/proc/meminfo - Memory information
File Management:
ls, cd, pwd, mkdir, rmdir, rm, cp, mv, cat, more, head, tail, find, grep, awk, sed, sort, uniq, wc, cut
System Tools:
ps, top, kill, killall, free, df, mount, umount, sync, dmesg, date, reboot
Network Tools:
ifconfig, route, arp, ping, traceroute, netstat, telnet, tftp, wget
Archive Tools:
tar, gzip, gunzip
This document combines device-specific flash command reference with general GPON ONT configuration guidance.