USB hub – per port power switching – an interim report.

Sometimes it happens, that my ZTE MF831 LTE stick, gets stuck somehow. It’s device id changes to something else, then documented in my other articel on this stick: ZTE MF831 for use with OpenWRT: serial modem instead of cdc_ether.

Usually, when that happens, only a full power cycle or unplugging and replugging helps.

Since none of my routers is capable of completely shutting down an USB port, there are only two possible solutions besides of using a timer clock, just in case.

a) to tinker with a relay or a transitor circuit, that will switch off the usb hub with it’s external power supply, when the usb port is shut down in software, alternatively use GPIO from your router

b) to get a PPPS USB Hub – a per port power switching hub already has builtin transistors for each of its port. If the hub chip supports PPPS, it will shut down a port completely, when software – like uhubctl signals it to do so.

But PPPS Hubs aren’t easy to identify and there is only a small number of products featuring PPPS.

The tool uhubctl supports some of these. Amongst them is the AmazonBasics USB Hub, 3.0 with 7Ports (Europlug and 12V/3A power adapter). Forget about the older D-Link DUB-H7 if, you don’t already possess on of the older silver cased version. The never revisions above 2.0 don’t support PPPS any longer.

You can find a list of uhubctl-compatible hubs here:

At the time I started searching for such a hub in september 2017, the model from Amazon Basics was the only one, that was really shipable. In the meanwhile there is also a model from TP-Link, the TL-UH700, but I haven’t yet analyzed that model. Also there is no hint given in the specification.

I have done some experiments with the Amazon Basics Hub connected to my TP-Link TL-WR1043ND v1 running OpenWRT. Unfortunately, while the switching of the ports worked well, a complete reset of the ZTE MF831 wasn’t possible. It seemed to still get enough current to remain in it’s locked up mode, which I guess, is Fastboot (or a similar) real download mode.

For other USB devices the PPP switching will work well. You can shut down a harddisk after use or switch an USB-LED or USB fan… Sounds like USB fun.

As soon as I find the time, I’ll resume my tests with a TP-LINK TL-WR1043NDv2 or a TP-Link TL-WR1043N v3.

Downgrading UBNT Nanostation M2 Loco (XM): ubnt downgrade code=2, msg=Firmware check failed

I recently tried to downgrade a UBNT Nanostation M2 Loco (XM version) in order to flash LEDE afterwards.

The problem is, that AirOS 6.0.6 needs signed firmwares and even original firmwares seem to miss a valid signature for this purpose.  Hence TFTP is always failing with “ubnt downgrade code=2, msg=Firmware check failed“. (Of course the web interface behaves likewise.

Here is what I did instead:

  1. Get a XM version of AirOS 5.5.11¹
  2. scp XM.v5.5.11.28002.150723.1344.bin ubnt@
    ssh -lubnt
  3. /sbin/fwupdate -m ²

Remark – all the steps in one command: ssh -lubnt ‘curl -o /tmp/fwupdate.bin && /sbin/fwupdate -m’

Update: If /sbin/fwupdate does not work for you, look for /sbin/fwupdate.real. /sbin/fwupdate now seems to be a wrapper script, that’s simply invokes /sbin/fwupdate.real -m after doing some more checks (fwupdate.real -c). Use it at your own risk. Double check to use the right firmware file for your platform.


Now I have AirOS 5.5.11 on the device and can flash my individual LEDE 17.01.2 build from the AirOS webinterface. If I’d wanted to revert, I’d have to flash 5.5.11 or lower again according to OpenWRT’s/LEDE’s documentation.





Huawei E303 in fallback mode, OpenWRT: usb-mode.json explained

How I worked around usb-modeswitch issues with a Huawei E303s-2

If you need to use Huawei HiLink ™ devices on a router running OpenWRT, you most probably will want to use them as a dumb serial modem.

Continue reading Huawei E303 in fallback mode, OpenWRT: usb-mode.json explained

Do you know socat – Multipurpose relay?

Socat, evaluating possibilities

is another swiss army knife of networking. It incorporates an amazingly big set of use cases. There are yet some to be invented.

Socat’s README explains it function as follows:

socat is a relay for bidirectional data transfer between two independent data
channels. Each of these data channels may be a file, pipe, device (serial line
etc. or a pseudo terminal), a socket (UNIX, IP4, IP6 - raw, UDP, TCP), an
SSL socket, proxy CONNECT connection, a file descriptor (stdin etc.), the GNU
line editor (readline), a program, or a combination of two of these. 
These modes include generation of "listening" sockets, named pipes, and pseudo

So what do with socat?

Continue reading Do you know socat – Multipurpose relay?

ZTE MF831 for use with OpenWRT: serial modem instead of cdc_ether

How to turn a ZTE MF831 into a dumb serial modem

Update and warning:

This article was written for the austrian version of the ZTE MF 831 back in October 2015. It is probably outdated by now. Most of the information contained herein and in the comments stems from my own and other user’s findings,,, archlinux and various other sources. I still own two ZTE MF831, which I regularly use. I used to have them in modem mode and are now using both in CDC mode. I can affirm, that switching modes -back and forth- works for these two models (Sw. WEB_HOFAUTMF831V1.0.0B02, Fw. BD_HOFATMF831V1.0.0B02, Hw. MF831-1.0.0).

Nevertheless, if you are not experienced in Android ADB, Linux, networking principles, terminal commands (AT/Hayes), you better restrain from reading on. You should really should be an expert in all that, if you decide to continue at your own risk.

Why that warning?

In the recent years I received some comments from people, some posts contained constructive feedback and experiences for which I am grateful. Comments of all that kind correspond to the way, a community works and are highly appreciated in order to improve a ‘howto’ like this.

Today (June, 9th 2019) I received quite the opposite: A posting, that contained mere hate speech, and menace against my family and me, blaming me for advising to send back a device, that up to my experience, was a defective in the first place.

I’d therefore like to repeat, that the mode switching commands are implemented by the manufacturer, ZTE himself. (The device’s OS is Android; mode switching by sending a HTTP request, simply invokes an AT command server and disables networking capabilities on USB; likewise, corresponding AT commands revert that). These command lists can be found at several places on the net, and they even work on various other ZTE models, but with variations, that you need to do research on. The commands used here partially even had been previously published by ZTE Australia and were republished in 2012 and relinked e.g. at, but after several website redesigns at ZTE, the manual is no longer available at the referenced link. Check they wayback archive at your convenience: At no point in the main article did I describe any alteration of the firmware, unless for naming the possibility of firmware recovery, which relies on firmware, that the manufacturer published  officially through it’s distributor back in the year 2014.

Until today, I received one report of one completely unresponsive MF831, which is most probably caused by a defective flash chip – and another similar experience, where a modeswitch never even has been tried:

A brand new MF831 my employer had used at home, got defective after two weeks in service in combination with an original TP-Link MR3240. The replacement LTE stick -also a MF831- is in service until today.

I also had two other defective MF831, but the problem I encountered with both, was a mere mechanical defect: A ‘triple sim card’ (nano, micro, mini) got loose somehow and it’s adapting frame and got entangled with pin 5 when I tried to exchange the sim card. That resulted -and that’s at no surprise either- in an ‘unavailabe network’ message.

What I have published then, back in 2014, was to the best of my  knowledge and belief and represents the steps I did, that worked for me  repeatedly.

I, personally, think the modeswitch, that is undocumented in the users manual, but well known among router programmers, is safe to use on the devices I’ve tested. A risk still remains – you have been warned.

Your alternatives are:

a. OpenWRT nowadays works like a charm with USB cdc devices. So, if you don’t have a contract with a public IP and you don’t need port forwarding – simply use the stick in it’s  default mode and stop reading.

b. Get a professional LTE routing equipment, that costs far more than the MF831’s lousy 25 Euros , if it’s still in stock. It’s successor, the MF833V will be sold for as low as 29,99 Euros starting next week…

c. Get another device, that is configured/flashed to use serial mode by default.

So, dear readers – you, once more, have been warned not to read on.

If you decided otherwise, here is the original article:

Background story:
Recently the austrian discounter Hofer started to sell equipment capable of LTE and bundled it with SIM cards of it’s MNVO HoT (Hofer Telekom).

Among those items is a relatively cheap LTE class 4 modem – the ZTE MF831.
Optically it is unbranded, but it seems to contain a firmware optimized for HoT.

Continue reading ZTE MF831 for use with OpenWRT: serial modem instead of cdc_ether