TL-WA7510N "inside"

Here are some words from PcWorld,s review, by Juha Saarinen:
http://pcworld.co.nz/pcworld/pcw.nsf/reviews/tp-link-tl-wa7510n

TP-Link’s TL-WA7510N is a flexible access point with multiple operating modes and a long reach. It uses 802.11a/n Wi-Fi in the 5GHz band, for increased performance and less susceptibility to interference – the usual 2.4GHz band is very busy these days.
Housed in a sturdy, light-grey weatherproof case suitable for outdoors deployment with power over Ethernet, 4kV lightning protection with grounding, and external aerial connector, the TL-WA7510N features a 15dBi dual-polarised antenna and 500mW transmission power. This, TP-Link says, is enough to maintain a stable wireless signal “ranging multiple kilometres”.

The OpenWrt "home page" of this devices is here:
http://wiki.openwrt.org/toh/tp-link/tl-wa7510n
On this page you can find list with identified the most hardware components, here is a short summary:

Atheros AR7240 CPU, 32MB RAM, 4MB Flash,  Network connector 1 (PoE) Serial connection: Yes

I dont repeat it here.
There is a good picture about the component side of the PCB,
http://wiki.openwrt.org/_detail/toh/tp-link/wa7510n_back.jpg


Notes about the serial port pins, functions of the leds, how can stop the boot process, if you access it on serial line.
It need to insert in the terminal the "tpl" string in the appropriate second on the boot. It need good reflexes to make it, my collegue, Michale, proposed for me a more simple method: put you in the mouse buffer this string, and insert it with the mouse clikk in the boot stepp, where is displays this text:
 "Autobooting in 1 seconds", if you want too break the boot, type here "tpl"
He wrote me this:
"...in fact to reach the console and type "tpl" is really really a hard task: To get access to that type of devices I did it maybe 100 times (=3hours) until I could reach the right timeslot. I used finally the RS232 feature of Putty and I marked the text "tpl" with the mouse and did copy/paste just by pressing the mouse button".
Now you are in the RedBoot environment.

----

You can find the boot log, recorded on the serial line terminal, on the OpenWrt wiki page too.
The end of the boot process you will see some small messages, and if you push here the Enter, you can see the system promt:

OPERMODE:5****                                                                 
br0: port 2(ath0) entering disabled state                                      
Country ie is FR                                                               
br0: port 2(ath0) entering learning state                                      
br0: topology change detected, propagating                                     
br0: port 2(ath0) entering forwarding state                                    
                                                                               
 TL-WA7510N mips #5 Wed Nov 30 15:23:58 CST 2011 (none)                        
TL-WA7510N login:

=======
My story start here: how can login, and if you are inside, what you can see there.
No welcome message, only some info about the built in busybox:

BusyBox v1.01 (2011.08.04-17:15+0000) Built-in shell (msh)                     
Enter 'help' for a list of built-in commands.                                  
                                                                               
$        

About the username/passwd problem.


Here you canot use the username/passwd pairs, publicly available for the deafult athentication on the web interface.
It seems, you dont find usefull username/passwd on the internet for this device to enter to the system running on it.
But there are informations, the running system is a small, open source linux, and the TP-Link company make it accessible the sources. It is, with some other company products here:

http://www.tp-link.com/en/support/gpl/
the file for TL-WA7510N has this name and access path:
http://www.tplink.com/resources/gpl/7510GPL.tar

To download this file isnot so simple. Here is my experience:
When I first started the download, it wrote, this will need 3 hours and xx minutes. When I started, a little later it sent, it need 7 hours, later: it need 9 hours. After some times, it downloaded approx. 90 Meg, and stopped.  At this point I decided, to break this download with the browser, and use the wget util, because it has more confortable options, if the process will stop.
It started, and finished with this speed: 100-120 K/s sometimes more, and it spent to download more than 3 hours for the 1.3 Gbyte file.


When I decopressed the downloaded 7510GPL.tar file, I found this dir structure:
/7510_gpl
/toolchain
-------------------
in the 7510_gpl dir:
./kernel_modules
./fileystem
./toolchain
In the kernel_modules there are the sources of 2 modules:
ppol2tp-kmod-0.17 and pptp_driver-0.9.3, no more.
In the ./filesstem dir is another subdir: ./ap91fus
but inside only the ./etc dir of the system, not a full filesystem. The files and subdirs, as can wait, contains some standard configs, default, but, finally there are the passwd and the shadow file too. From this you can see, there are two users, the root and the Admin, have passwd (in ecrypted form here), but it seems, there are some users, withot passwd. The most powerfull, it seems, the ap71 user, offer root access to the system. I tryed it immediatly on the serial console, and its working! (**)

Here follows some result of my first explorations.

TL-WA7510N login: ap71                                                         
                                                                               
                                                                        
BusyBox v1.01 (2011.08.04-17:15+0000) Built-in shell (msh)                     
Enter 'help' for a list of built-in commands.                                  
$ help                                                                         
                                                                               
Built-in commands:                                                             
-------------------                                                            
     : break cd continue eval exec exit export help login newgrp          
  read readonly set shift times trap umask wait                                    

the used/mounted devices:

$ mount                                                                        
/dev/mtdblock2 on / type squashfs (ro)                                         
/proc on /proc type proc (rw,nodiratime)                                       
devpts on /dev/pts type devpts (rw)                                            
none on /tmp type ramfs (rw)                                                   
none on /var type ramfs (rw) 

Are there any free space on the flash? No!
$ df                                                                           
Filesystem           1k-blocks      Used Available Use% Mounted on             
/dev/mtdblock2            2304      2304         0 100% /                      

The system resources in the ./proc filesystem:
$ cd /proc                                                                     
$ ls                                                                           
1              446            9              interrupts     net                
10             5              ath_pktlog     iomem          partitions         
11             57             buddyinfo      ioports        self               
2              6              bus            irq            simple_config      
202            60             cmdline        kallsyms       slabinfo           
3              61             cpuinfo        kmsg           stat               
3024           62             crypto         loadavg        sys                
4              63             devices        locks          sysvipc            
426            7              diskstats      meminfo        tty                
437            70             driver         misc           uptime             
438            73             execdomains    modules        version            
439            74             filesystems    mounts         vmstat             
442            8              fs             mtd            zoneinfo           
 
Available filesystem types:
 
                                                            
$ cat filesystems                                                              
nodev   sysfs                                                                  
nodev   rootfs                                                                 
nodev   bdev                                                                   
nodev   proc                                                                   
nodev   sockfs                                                                 
nodev   pipefs                                                                 
nodev   futexfs                                                                
nodev   tmpfs                                                                  
nodev   devpts                                                                 
        squashfs                                                               
nodev   ramfs                                                                  
$ cat devices                                                                  
Character devices:                                                             
  1 mem                                                                        
  4 ttyS                                                                       
  5 /dev/tty                                                                   
  5 /dev/console                                                               
  5 /dev/ptmx                                                                  
 10 misc                                                                       
 77 AR7240_GPIOC                                                               
 90 mtd                                                                        
108 ppp                                                                        
128 ptm                                                                        
136 pts                                                                        
238 ar7240_gpio_chrdev                                                         
239 ar7240_flash_chrdev                                                        
                                                                               
Block devices:                                                                 
  1 ramdisk                                                                    
 31 mtdblock       
=============
About the filesystem, the top level dirs:
$ ls                                                                           
bin      etc      linuxrc  proc     sbin     usr      web                      
dev      lib      mnt      root     tmp      var    

List of the bin:
all are symbolic links to the busybox:

$ cd bin                                                                       
$ ls                                                                           
busybox  date     false    ls       ping     sh                                
cat      df       kill     mount    ps       true                              
chmod    echo     login    msh      rm       umount                            
$ ls -l                                                                        
-rwxr-xr-x    1 0        0          287924 Nov 30  2011 busybox                
lrwxrwxrwx    1 0        0               7 Nov 30  2011 cat -> busybox         
lrwxrwxrwx    1 0        0               7 Nov 30  2011 chmod -> busybox       
lrwxrwxrwx    1 0        0               7 Nov 30  2011 date -> busybox        
lrwxrwxrwx    1 0        0               7 Nov 30  2011 df -> busybox          
lrwxrwxrwx    1 0        0               7 Nov 30  2011 echo -> busybox        
lrwxrwxrwx    1 0        0               7 Nov 30  2011 false -> busybox       
lrwxrwxrwx    1 0        0               7 Nov 30  2011 kill -> busybox        
lrwxrwxrwx    1 0        0               7 Nov 30  2011 login -> busybox       
lrwxrwxrwx    1 0        0               7 Nov 30  2011 ls -> busybox          
lrwxrwxrwx    1 0        0               7 Nov 30  2011 mount -> busybox       
lrwxrwxrwx    1 0        0               7 Nov 30  2011 msh -> busybox         
lrwxrwxrwx    1 0        0               7 Nov 30  2011 ping -> busybox        
lrwxrwxrwx    1 0        0               7 Nov 30  2011 ps -> busybox          
lrwxrwxrwx    1 0        0               7 Nov 30  2011 rm -> busybox          
lrwxrwxrwx    1 0        0               7 Nov 30  2011 sh -> busybox          
lrwxrwxrwx    1 0        0               7 Nov 30  2011 true -> busybox        
lrwxrwxrwx    1 0        0               7 Nov 30  2011 umount -> busybox

And there are more such links:

$ cd usr                                                                       
$ ls                                                                           
arp        bin        net_ioctl  sbin                                          
$ cd bin                                                                       
$ ls                                                                           
[        arping   httpd    lld2d    logger   test     tftp     wlanreg         
$ ls -l                                                                        
lrwxrwxrwx    1 0        0              17 Nov 30  2011 [ -> ../../bin/busybox 
lrwxrwxrwx    1 0        0              17 Nov 30  2011 arping -> ../../bin/busx
-rwxr-xr-x    1 0        0         1528480 Nov 30  2011 httpd                  
-rwxr-xr-x    1 0        0          145552 Nov 30  2011 lld2d                  
lrwxrwxrwx    1 0        0              17 Nov 30  2011 logger -> ../../bin/busx
lrwxrwxrwx    1 0        0              17 Nov 30  2011 test -> ../../bin/busybx
lrwxrwxrwx    1 0        0              17 Nov 30  2011 tftp -> ../../bin/busybx
-rwxr-xr-x    1 0        0           10132 Nov 30  2011 wlanreg        
In the /usr/sbin
$ cd sbin                                                                      
$ ls                                                                           
bpalogin  pppd      snmpd     telnetd   udhcpd    xl2tpd                       
$ ls -l                                                                        
-rwxr-xr-x    1 0        0           32420 Nov 30  2011 bpalogin               
-rwxr-xr-x    1 0        0          374624 Nov 30  2011 pppd                   
-rwxr-xr-x    1 0        0          643292 Nov 30  2011 snmpd                  
lrwxrwxrwx    1 0        0              17 Nov 30  2011 telnetd -> ../../bin/bux
lrwxrwxrwx    1 0        0              17 Nov 30  2011 udhcpd -> ../../bin/busx
-rwxr-xr-x    1 0        0          134064 Nov 30  2011 xl2tpd             

The previously created devices in the /dev

$ cd /dev                                                                      
$ ls                                                                           
ar7100_flash_chrdev  ram0                 ttyS1                                
ar7100_gpio_chrdev   random               ttyS2                                
caldata              tty                  ttyUSB0                              
console              tty0                 ttyUSB1                              
dk0                  tty1                 ttyUSB10                             
kmem                 tty2                 ttyUSB11                             
mem                  ttyACM0              ttyUSB12                             
mtd0                 ttyACM1              ttyUSB13                             
mtdblock0            ttyACM10             ttyUSB14                             
mtdblock1            ttyACM11             ttyUSB15                             
mtdblock2            ttyACM12             ttyUSB2                              
mtdblock3            ttyACM13             ttyUSB3                              
mtdblock4            ttyACM14             ttyUSB4                              
mtdblock5            ttyACM15             ttyUSB5                              
mtdblock6            ttyACM2              ttyUSB6                              
mtdr0                ttyACM3              ttyUSB7                              
null                 ttyACM4              ttyUSB8                              
ppp                  ttyACM5              ttyUSB9                              
ptmx                 ttyACM6              ttyp0                                
pts                  ttyACM7              ttyp1                                
ptyp0                ttyACM8              ttyp2                                
ptyp1                ttyACM9              urandom                              
ptyp2                ttyS0                zero          

What are the running processes?

$ ps x                                                                         
  PID  Uid     VmSize Stat Command                                             
    1 root        368 S   init                                                 
    2 root            SWN [ksoftirqd/0]                                        
    3 root            SW< [events/0]                                           
    4 root            SW< [khelper]                                            
    5 root            SW< [kthread]                                            
    6 root            SW< [kblockd/0]                                          
    7 root            SW  [pdflush]                                            
    8 root            SW  [pdflush]                                            
   10 root            SW< [aio/0]                                              
    9 root            SW  [kswapd0]                                            
   11 root            SW  [mtdblockd]                                          
   57 root       2196 S   /usr/bin/httpd                                       
   60 ap71        420 S   -sh                                                  
   61 root       2196 S   /usr/bin/httpd                                       
   62 root       2196 S   /usr/bin/httpd                                       
   63 root        352 S   /usr/bin/httpd                                       
   70 root        296 S   syslogd -C -l 7                                      
   73 root        264 S   klogd                                                
   74 root       2196 S   /usr/bin/httpd                                       
  202 root        324 S   /usr/sbin/udhcpd /tmp/wr841n/udhcpd.conf             
  426 root        564 S   hostapd /tmp/topology.conf                           
  437 root       2196 S   /usr/bin/httpd                                       
  438 root       2196 S   /usr/bin/httpd                                       
  439 root       2196 S   /usr/bin/httpd                                       
  442 root       2196 S   /usr/bin/httpd                                       
  446 root        280 S   /usr/bin/lld2d br0 ath0                              
 2895 ap71        364 R   ps x
                     
It has no tools to check the loaded kernel modules, (*) but there is a list of available modules in the /lib/modules/2.6.15 dir
And you can check in the boot process which modules will be loaded.
The kernel modules:

cd kernel                                                                    
$ ls                                                                           
br_MultiSsidVlan_InputForward.ko    ipt_TRIGGER.ko                             
br_MultiSsidVlan_PassUpToRouter.ko  ipt_comment.ko                             
br_filter.ko                        ipt_conntrack.ko                           
cls_basic.ko                        ipt_iprange.ko                             
cls_fw.ko                           ipt_mac.ko                                 
ip_conntrack.ko                     ipt_multiport.ko                           
ip_conntrack_ftp.ko                 ipt_multiurl.ko                            
ip_conntrack_h323.ko                ipt_state.ko                               
ip_conntrack_pptp.ko                ipt_string.ko                              
ip_conntrack_rtsp.ko                ipt_time.ko                                
ip_conntrack_tftp.ko                iptable_filter.ko                          
ip_nat.ko                           iptable_nat.ko                             
ip_nat_ftp.ko                       pppol2tp.ko                                
ip_nat_h323.ko                      pptp.ko                                    
ip_nat_pptp.ko                      sch_htb.ko                                 
ip_nat_rtsp.ko                      sch_prio.ko                                
ip_nat_tftp.ko                      sch_sfq.ko                                 
ip_tables.ko                        statistics.ko                              
ipt_MARK.ko                         tp_domain.ko                               
ipt_MASQUERADE.ko                   ts_kmp.ko                                  
ipt_TCPMSS.ko                       wlan_warn.ko    

The net modules:
$ cd net                                                                       
$ ls -l                                                                        
-rw-r--r--    1 0        0           59018 Nov 30  2011 ag7240_mod.ko          
-rw-r--r--    1 0        0          182388 Nov 30  2011 ath_dev.ko             
-rw-r--r--    1 0        0          385916 Nov 30  2011 ath_hal.ko             
-rw-r--r--    1 0        0           84980 Nov 30  2011 ath_pci.ko             
-rw-r--r--    1 0        0           22148 Nov 30  2011 ath_pktlog.ko          
-rw-r--r--    1 0        0           56563 Nov 30  2011 ath_rate_atheros.ko    
-rw-r--r--    1 0        0          383248 Nov 30  2011 wlan.ko                
-rw-r--r--    1 0        0            7567 Nov 30  2011 wlan_acl.ko            
-rw-r--r--    1 0        0           13101 Nov 30  2011 wlan_ccmp.ko           
-rw-r--r--    1 0        0           14948 Nov 30  2011 wlan_me.ko             
-rw-r--r--    1 0        0           15601 Nov 30  2011 wlan_scan_ap.ko        
-rw-r--r--    1 0        0           21372 Nov 30  2011 wlan_scan_sta.ko       
-rw-r--r--    1 0        0           17227 Nov 30  2011 wlan_tkip.ko           
-rw-r--r--    1 0        0            8819 Nov 30  2011 wlan_wep.ko            
-rw-r--r--    1 0        0            2891 Nov 30  2011 wlan_xauth.ko         

The loaded modules list in default:

$ cat rc.modules                                                               
#!/bin/sh                                                                      
                                                                               
test -d /lib/modules/2.6.31                                                    
                                                                               
kver_is_2615=$?                                                                
                                                                               
if [ $kver_is_2615 -eq 1 ]                                                     
then                                                                           
echo "This board use 2.6.15"                                                   
                                                                               
insmod /lib/modules/2.6.15/kernel/ip_tables.ko                                 
insmod /lib/modules/2.6.15/kernel/ip_conntrack.ko                              
insmod /lib/modules/2.6.15/kernel/ip_nat.ko                                    
insmod /lib/modules/2.6.15/kernel/ipt_MASQUERADE.ko                            
insmod /lib/modules/2.6.15/kernel/ipt_comment.ko                               
insmod /lib/modules/2.6.15/kernel/ipt_conntrack.ko                             
insmod /lib/modules/2.6.15/kernel/ipt_iprange.ko                               
insmod /lib/modules/2.6.15/kernel/ipt_mac.ko                                   
insmod /lib/modules/2.6.15/kernel/ipt_multiport.ko                             
insmod /lib/modules/2.6.15/kernel/ipt_state.ko                                 
insmod /lib/modules/2.6.15/kernel/ipt_string.ko                                
insmod /lib/modules/2.6.15/kernel/iptable_nat.ko                               
insmod /lib/modules/2.6.15/kernel/iptable_filter.ko                            
insmod /lib/modules/2.6.15/kernel/ipt_time.ko                                  
insmod /lib/modules/2.6.15/kernel/ipt_TRIGGER.ko                               
insmod /lib/modules/2.6.15/kernel/ip_conntrack_pptp.ko                         
insmod /lib/modules/2.6.15/kernel/ipt_TCPMSS.ko                                
insmod /lib/modules/2.6.15/kernel/statistics.ko                                
insmod /lib/modules/2.6.15/kernel/ipt_multiurl.ko                              
insmod /lib/modules/2.6.15/kernel/ip_conntrack_h323.ko                         
                                                                               
insmod /lib/modules/2.6.15/kernel/ipt_MARK.ko                                  
insmod /lib/modules/2.6.15/kernel/sch_htb.ko                                   
insmod /lib/modules/2.6.15/kernel/sch_prio.ko                                  
insmod /lib/modules/2.6.15/kernel/sch_sfq.ko                                   
insmod /lib/modules/2.6.15/kernel/cls_basic.ko                                 
insmod /lib/modules/2.6.15/kernel/cls_fw.ko                                    
                                                                               
insmod /lib/modules/2.6.15/kernel/ts_kmp.ko                                    
insmod /lib/modules/2.6.15/kernel/flashid.ko                                   
insmod /lib/modules/2.6.15/kernel/br_filter.ko                                 
                                                                               
insmod /lib/modules/2.6.15/kernel/pppol2tp.ko                                  
insmod /lib/modules/2.6.15/kernel/pptp.ko                                      
insmod /lib/modules/2.6.15/kernel/wlan_warn.ko                                 
                                                                               
insmod /lib/modules/2.6.15/kernel/harmony.ko                                   
                                                                               
insmod /lib/modules/2.6.15/kernel/cdc-acm.ko                                   
                                                                               
else                                                                           
echo "This Board use 2.6.31"                                                   
                                                                               
# netfilter                                                                    
insmod /lib/modules/2.6.31/kernel/x_tables.ko                                  
insmod /lib/modules/2.6.31/kernel/xt_tcpudp.ko                                 
insmod /lib/modules/2.6.31/kernel/xt_MARK.ko                                   
insmod /lib/modules/2.6.31/kernel/xt_TCPMSS.ko                                 
insmod /lib/modules/2.6.31/kernel/xt_comment.ko                                
insmod /lib/modules/2.6.31/kernel/xt_iprange.ko                                
insmod /lib/modules/2.6.31/kernel/xt_mac.ko                                    
insmod /lib/modules/2.6.31/kernel/xt_multiport.ko                              
insmod /lib/modules/2.6.31/kernel/xt_string.ko                                 
insmod /lib/modules/2.6.31/kernel/xt_time.ko                                   
insmod /lib/modules/2.6.31/kernel/ipt_multiurl.ko                              
                                                                               
insmod /lib/modules/2.6.31/kernel/nf_conntrack.ko                              
insmod /lib/modules/2.6.31/kernel/nf_conntrack_proto_gre.ko                    
insmod /lib/modules/2.6.31/kernel/nf_conntrack_h323.ko                         
                                                                               
insmod /lib/modules/2.6.31/kernel/xt_conntrack.ko                              
insmod /lib/modules/2.6.31/kernel/xt_state.ko                                  
                                                                               
# kernel dir: net/ipv4/netfilter/                                              
                                                                               
insmod /lib/modules/2.6.31/kernel/nf_defrag_ipv4.ko                            
insmod /lib/modules/2.6.31/kernel/nf_conntrack_ipv4.ko                         
                                                                               
insmod /lib/modules/2.6.31/kernel/nf_nat.ko                                    
insmod /lib/modules/2.6.31/kernel/nf_nat_proto_gre.ko                          
                                                                               
insmod /lib/modules/2.6.31/kernel/ip_tables.ko                                 
insmod /lib/modules/2.6.31/kernel/iptable_filter.ko                            
insmod /lib/modules/2.6.31/kernel/iptable_nat.ko                               
insmod /lib/modules/2.6.31/kernel/iptable_raw.ko                               
insmod /lib/modules/2.6.31/kernel/ipt_MASQUERADE.ko                            
insmod /lib/modules/2.6.31/kernel/ipt_REDIRECT.ko                              
insmod /lib/modules/2.6.31/kernel/ipt_REJECT.ko                                
insmod /lib/modules/2.6.31/kernel/ipt_TRIGGER.ko                               
                                                                               
# qos                                                                          
insmod /lib/modules/2.6.31/kernel/sch_htb.ko                                   
insmod /lib/modules/2.6.31/kernel/sch_prio.ko                                  
insmod /lib/modules/2.6.31/kernel/sch_sfq.ko                                   
insmod /lib/modules/2.6.31/kernel/cls_basic.ko                                 
insmod /lib/modules/2.6.31/kernel/cls_fw.ko                                    
                                                                               
insmod /lib/modules/2.6.31/kernel/ts_kmp.ko                                    
insmod /lib/modules/2.6.31/kernel/flashid.ko                                   
insmod /lib/modules/2.6.31/kernel/br_filter.ko                                 
                                                                               
#ppp                                                                           
insmod /lib/modules/2.6.31/kernel/pppol2tp.ko                                  
insmod /lib/modules/2.6.31/kernel/pptp.ko                                      
                                                                               
insmod /lib/modules/2.6.31/kernel/harmony.ko                                   
insmod /lib/modules/2.6.31/kernel/wlan_warn.ko                                 
                                                                               
#statistics                                                                    
insmod /lib/modules/2.6.31/kernel/statistics.ko                                
fi  
 (more or less, all!)

========
The device has web interface to configure and manage it. The list of the web working dir:

$ cd web                                                                       
$ ls                                                                           
dynaform     help         localiztion  userRpm                                 
frames       images       oem                                                  
$ ls -l                                                                        
drwxr-xr-x    2 0        0              95 Nov 30  2011 dynaform               
drwxr-xr-x    2 0        0              24 Nov 30  2011 frames                 
drwxr-xr-x    2 0        0            2265 Nov 30  2011 help                   
drwxr-xr-x    2 0        0             181 Nov 30  2011 images                 
drwxr-xr-x    2 0        0              59 Nov 30  2011 localiztion            
drwxr-xr-x    2 0        0              27 Nov 30  2011 oem                    
drwxr-xr-x    2 0        0            2525 Nov 30  2011 userRpm 

In the ./dynaform there are some js scripts, in the ./userRpm dir there are the html files. This is along list

AccessCtrlAccessRulesAdvRpm.htm    SnmpRpm.htm                                 
AccessCtrlAccessRulesRpm.htm       SoftwareUpgradeRpm.htm                      
AccessCtrlAccessTargetsAdvRpm.htm  SpecialAppAdvRpm.htm                        
AccessCtrlAccessTargetsRpm.htm     SpecialAppRpm.htm                           
AccessCtrlHostsListsAdvRpm.htm     SpeedTestRpm.htm                            
AccessCtrlHostsListsRpm.htm        StaticRouteTableAdvRpm.htm                  
AccessCtrlTimeSchedAdvRpm.htm      StaticRouteTableRpm.htm                     
AccessCtrlTimeSchedRpm.htm         StatusRpm.htm                               
AccessDenied.htm                   SysRebootRpm.htm                            
AdvScrRpm.htm                      SystemLogRpm.htm                            
AssignedIpAddrListRpm.htm          SystemStatisticRpm.htm                      
AutoEmailRpm.htm                   UpdateTemp.htm                              
BPACfgRpm.htm                      UpnpCfgRpm.htm                              
BakNRestoreRpm.htm                 VirtualServerAdvRpm.htm                     
BasicSecurityRpm.htm               VirtualServerRpm.htm                        
ChangeLoginPwdRpm.htm              WanDynamicIpCfgRpm.htm                      
CmxDdnsRpm.htm                     WanStaticIpCfgRpm.htm                       
DMZRpm.htm                         WlanAdvRpm.htm                              
DateTimeCfgRpm.htm                 WlanAntennaIframe.htm                       
DebugResult.htm                    WlanAntennaRpm.htm                          
DiagnosticRpm.htm                  WlanDistanceSetRpm.htm                      
DynDdnsRpm.htm                     WlanMacFilterRpm.htm                        
FixMapCfgAdvRpm.htm                WlanMacFilterRpmAdv.htm                     
FixMapCfgRpm.htm                   WlanNetworkRpm.htm                          
GetGMTRpm.htm                      WlanNetworkRpm_AP.htm                       
HttpDebugRpm.htm                   WlanNetworkRpm_APC.htm                      
Index.htm                          WlanSecurityRpm.htm                         
L2TPCfgRpm.htm                     WlanStationRpm.htm                          
LanArpBindingAdvRpm.htm            WlanThroughputIframe.htm                    
LanArpBindingFindRpm.htm           WlanThroughputRpm.htm                       
LanArpBindingListRpm.htm           WlanWpsChkModeRpm.htm                       
LanArpBindingRpm.htm               WlanWpsRpm.htm                              
LanDhcpServerRpm.htm               WorkingModeRpm.htm                          
LocalManageControlRpm.htm          WzdEndRpm.htm                               
MacCloneCfgRpm.htm                 WzdPPPoERpm.htm                             
MailResultRpm.htm                  WzdStartRpm.htm                             
ManageControlRpm.htm               WzdStaticIpRpm.htm                          
MenuRpm.htm                        WzdWanAutoTypeRpm.htm                       
MiscShowRpm.htm                    WzdWanDisconnRpm.htm                        
NetworkCfgRpm.htm                  WzdWanTypeRpm.htm                           
NetworkCfgRpm_AP.htm               WzdWanTypeRpm_APC.htm                       
NoipDdnsRpm.htm                    WzdWkModeRpm.htm                            
PPPoECfgAdvRpm.htm                 WzdWlanAPSiteSurveyRpm.htm                  
PPPoECfgRpm.htm                    WzdWlanApRpm.htm                            
PPTPCfgRpm.htm                     WzdWlanApcRpm.htm                           
ParentCtrlAdvRpm.htm               WzdWlanRpm.htm                              
ParentCtrlRpm.htm                  WzdWlanSiteSurveyRpm.htm                    
PingIframeRpm.htm                  confUploadErrorRpm.htm                      
PingWatchDogRpm.htm                errorPage.htm                               
QoSCfgRpm.htm                      popupSiteSurveyRpm.htm                      
QoSRuleCfgRpm.htm                  popupSiteSurveyRpm_AP.htm                   
QoSRuleListRpm.htm                 restart.htm                                 
RestoreDefaultCfgRpm.htm    

I tried to dowload this files with this command:
wget -R --user=admin --password=admin  http://192.168.1.254/userRpm/
but I wasnot really successfull, only part of it were downloadable in this method. (but on the serial consol can cat it, and save/read as you want.
Here is my picture on the built in antenna surface.


tlwa7510npach.jpg
The antenna switches on the PCB:
ID: 5202-0623

The Rx/Tx swich:
ID: 018-6659 (RFMD?)



(**)
It seems, it is an old convention at TP-Link to use this username/passwd pairs.
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=58195  (pwd=5up)

User name: "root"
Password: "5up"
User name: "Admin"
Password: "5up"
User name: "ap71"
Password: not needed



t.janos , hg5apz at gmail
Sat Jan 19 20:32:57 CET 2013

(*) There are system tools in /sbin dir, but this dir isnot in the PATH, at least not for the actual user. It can start this programs locally, or with full path.

$ cd /sbin                                                                     
$ ls                                                                           
brctl           iptables        lsmod           udhcpc                         
getty           iwconfig        reboot          vconfig                        
hostapd         iwlist          rmmod           wlanconfig                     
ifconfig        iwpriv          route           wpa_supplicant                 
init            klogd           syslogd                                        
insmod          logread         tc                                 

$ ./ifconfig                                                                   
ath0      Link encap:Ethernet  HWaddr F8:D1:11:B1:4F:34                        
          UP BROADCAST RUNNING MULTICAST  MTU:2290  Metric:1                   
          RX packets:80 errors:0 dropped:0 overruns:0 frame:0                  
          TX packets:81 errors:0 dropped:1 overruns:0 carrier:0                
          collisions:0 txqueuelen:1000                                         
          RX bytes:27538 (26.8 KiB)  TX bytes:27598 (26.9 KiB)                 
                                                                               
br0       Link encap:Ethernet  HWaddr F8:D1:11:B1:4F:34                        
          inet addr:192.168.1.254  Bcast:192.168.1.255  Mask:255.255.255.0     
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1                   
          RX packets:81 errors:0 dropped:0 overruns:0 frame:0                  
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0                 
          collisions:0 txqueuelen:0                                            
          RX bytes:26464 (25.8 KiB)  TX bytes:0 (0.0 B)                        
                                                                               
eth0      Link encap:Ethernet  HWaddr F8:D1:11:B1:4F:33                        
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1                   
          RX packets:1 errors:0 dropped:0 overruns:0 frame:0                   
          TX packets:78 errors:0 dropped:0 overruns:0 carrier:0                
          collisions:0 txqueuelen:1000                                         
          RX bytes:60 (60.0 B)  TX bytes:27432 (26.7 KiB)                      
                                                                               
lo        Link encap:Local Loopback                                            
          inet addr:127.0.0.1  Mask:255.0.0.0                                  
          UP LOOPBACK RUNNING  MTU:16436  Metric:1                             
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0                   
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0                 
          collisions:0 txqueuelen:0                                            
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)                               
                                                                               
wifi0     Link encap:Ethernet  HWaddr F8:D1:11:B1:4F:34                        
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1                   
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0                   
          TX packets:83 errors:0 dropped:0 overruns:0 carrier:0                
          collisions:0 txqueuelen:1000                                         
          RX bytes:0 (0.0 B)  TX bytes:29175 (28.4 KiB)                        
          Interrupt:48 Memory:b0000000-b0010000                                
                                                                             



$ ./lsmod                                                                      
Module                  Size  Used by                                          
wlan_scan_ap 11040 0 - Live 0xc0127000                                         
wlan_scan_sta 15216 0 - Live 0xc0138000                                        
wlan_acl 4576 1 - Live 0xc012e000                                              
wlan_wep 6112 0 - Live 0xc012b000                                              
wlan_tkip 13504 0 - Live 0xc0119000                                            
wlan_ccmp 9408 0 - Live 0xc0123000                                             
wlan_xauth 1344 0 - Live 0xc0117000                                            
ath_pktlog 15488 0 - Live 0xc011e000                                           
wlan_me 10336 0 - Live 0xc00d7000                                              
ath_pci 59936 0 - Live 0xc00ee000                                              
ath_dev 138064 2 ath_pktlog,ath_pci, Live 0xc0145000                           
ath_rate_atheros 50064 2 ath_pktlog,ath_dev, Live 0xc0109000                   
wlan 286128 12 wlan_scan_ap,wlan_scan_sta,wlan_acl,wlan_wep,wlan_tkip,wlan_ccmp0
ath_hal 321120 4 ath_pktlog,ath_pci,ath_dev, Live 0xc0169000                   
ag7240_mod 39984 0 - Live 0xc00fe000                                           
wlan_warn 3040 0 - Live 0xc00d5000                                             
pptp 12688 0 - Live 0xc00db000                                                 
pppol2tp 27184 0 - Live 0xc00e0000                                             
br_filter 1376 0 - Live 0xc00c0000                                             
ts_kmp 1984 1 - Live 0xc009a000                                                
cls_fw 4224 0 - Live 0xc00d2000                                                
cls_basic 4320 0 - Live 0xc00cf000                                             
sch_sfq 5312 0 - Live 0xc00b6000                                               
sch_prio 4800 0 - Live 0xc00b3000                                              
sch_htb 16992 0 - Live 0xc00ba000                                              
ipt_MARK 1728 0 - Live 0xc0098000                                              
ip_conntrack_h323 48304 0 - Live 0xc00c2000                                    
ipt_multiurl 2016 0 - Live 0xc0091000                                          
statistics 87120 0 - Live 0xc009c000                                           
ipt_TCPMSS 3680 0 - Live 0xc008f000                                            
ip_conntrack_pptp 8880 0 - Live 0xc0094000                                     
ipt_TRIGGER 3456 0 - Live 0xc008d000                                           
ipt_time 2528 0 - Live 0xc008b000                                              
iptable_filter 2272 1 - Live 0xc0086000                                        
iptable_nat 7440 1 - Live 0xc0055000                                           
ipt_string 1952 0 - Live 0xc0072000                                            
ipt_state 1472 1 - Live 0xc0070000                                             
ipt_multiport 2240 0 - Live 0xc006e000                                         
ipt_mac 1664 0 - Live 0xc006c000                                               
ipt_iprange 1568 0 - Live 0xc006a000                                           
ipt_conntrack 2208 0 - Live 0xc0068000                                         
ipt_comment 1312 2 - Live 0xc005a000                                           
ipt_MASQUERADE 2656 2 - Live 0xc0058000                                        
ip_nat 15904 3 ipt_TRIGGER,iptable_nat,ipt_MASQUERADE, Live 0xc0063000         
ip_conntrack 47728 7 ip_conntrack_h323,ip_conntrack_pptp,iptable_nat,ipt_state,0
ip_tables 22208 16 wlan_warn,ipt_MARK,ipt_multiurl,ipt_TCPMSS,ipt_TRIGGER,ipt_t0

$ ./iwconfig ath0                                                              
ath0      IEEE 802.11na  ESSID:"HG5APZ-254"                                    
          Mode:Master  Frequency:5.18 GHz  Access Point: F8:D1:11:B1:4F:34     
          Bit Rate:6 kb/s   Tx-Power:20 dBm   Sensitivity=1/3                  
          Retry:off   RTS thr=2346 B   Fragment thr:off                        
          Power Management:off                                                 
          Link Quality=94/94  Signal level=-1 dBm  Noise level=-95 dBm         
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0             
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0          

$ ./tc                                                                         
Usage: tc [ OPTIONS ] OBJECT { COMMAND | help }                                
       tc [-force] -batch file                                                 
where  OBJECT := { qdisc | class | filter | action }                           
       OPTIONS := { -s[tatistics] | -d[etails] | -r[aw] | -b[atch] [file] }

"tc  is  used  to configure Traffic Control in the Linux kernel."

It has support to make VPN connection with lld2d and xl2tpd:
$ cd usr/bin                                                                   
$ ls                                                                           
[        arping   httpd    lld2d    logger   test     tftp     wlanreg     

$ cd /usr/sbin                                                                 
$ ls                                                                           
bpalogin  pppd      snmpd     telnetd   udhcpd    xl2tpd      


Available frequencies:

$ ./iwlist ath0 frequency                                                      
ath0      56 channels in total; available frequencies :                        
          Channel 36 : 5.18 GHz                                                
          Channel 40 : 5.2 GHz                                                 
          Channel 44 : 5.22 GHz                                                
          Channel 48 : 5.24 GHz                                                
          Channel 52 : 5.26 GHz                                                
          Channel 56 : 5.28 GHz                                                
          Channel 60 : 5.3 GHz                                                 
          Channel 64 : 5.32 GHz                                                
          Channel 100 : 5.5 GHz                                                
          Channel 104 : 5.52 GHz                                               
          Channel 108 : 5.54 GHz                                               
          Channel 112 : 5.56 GHz                                               
          Channel 116 : 5.58 GHz                                               
          Channel 120 : 5.6 GHz                                                
          Channel 124 : 5.62 GHz                                               
          Channel 128 : 5.64 GHz                                               
          Channel 132 : 5.66 GHz                                               
          Channel 136 : 5.68 GHz                                               
          Channel 140 : 5.7 GHz                                                
          Current Frequency=5.18 GHz (Channel 36)         


Throughput Monitor between two TL-WA7510N AP

On the one end is the IP: 192.168.1.250


At the other end is  192.168.1.254