Add custom bands to netgear nighthawk m1 - tutorial

Guide is based on
SKU: MR1100-100EUS
TESTED WITH SOFT: NTG9X50C_12.06.03.00 + NTG9X50C_12.04.02.00
As you probably noticed that your Nighthawk M1 has only 3 cellular “Band Region” options:

1. Auto
2. WCDMA all
3. LTE all

With this guide I will show you the way of how to add new options there. Thanks to this you will be able to control the way of how your nighthawk connects to BTS (Base Transceiver Station). In effect you will be able to select one from options:

• 0 -Auto
• 1 - WCDMA all
• 2 - LTE all
• 3 - LTE B20 800
• 4 - LTE B3 1800
• 5 - LTE B1 2100
• 6 - LTE B7 2600
• 7 - LTE 800+2600+2100
• 8 - LTE 800+1800+2600+2100
• 9 - LTE 800+1800+2600

Why these bands?
I am located in europe and 800, 1800, 2100, 2600 are most popular LTE bands here.
You can create own bands based on this tutorial, details are decribed in the guide.

Nighthawk M1 should support up to 20 options there, but unfortunately it allows to use only 9 options. Why? There is a bug in firmware NTG9X50C_12.06.03.00 that do not allow to use more than 9 bands – if you will add more your device will hang during reboot. I contacted with support but they do not care about this bug in firmware :(

freezed device will show purple background only:

but do not worry, if you will have this kind of problem - it can be solved. Details at the end of the guide.

Ok, let’s start with tutorial ;-)
Firstly connect your device to your PC via USB port. It is important! Otherwise you will not have possibility to follow next steps. To add new region bands we will use Telnet feature that is available in windows by default.  Open windows command prompt: https://i.imgur.com/1aMTghi.gifv

1. Press win+s
2. Search for “cmd”
3. Hit enter to open command console
4. Type telnet 192.168.1.1 5510 and hit enter
5. Once you will connect, you will see black screen. If you will see message that ‘telnet’ does not exist, you need to activate it: https://www.technipages.com/windows-10-enable-telnet and then - go back to point 1 and repeat process J
6. If you are connected to your device via telnet – you can use AirCad commands now

Important!
If you have branded nighthawk your AirCad console is probably secured with password. Unfortunately i do not know this password, you need to search it over the internet because it is unique for each telecom. Some nice people shared these passwords on forums, also here ;)

Before you can use any password-protected AT commands, you must enter the password correctly using !ENTERCND command.
just type AT!ENTERCND="password" (password must be entered with quotation marks, but if it will not work - try without quotation marks as well).

If your nighthawk is not protected with password, or if you entered password properly it is start to add new bands with !BAND command

AT!BAND command
To add new bands we will use AT!BAND command. It allows to configure the modem to operate on a set of frequency bands, look up available sets, create new sets, or return the current selection. The structure of command is:
AT!BAND=<Index>,”<Name>”,<GWmask>[,<Lmask>,<Lmask2>]

Where:
<Index>
Index of a band set. Use the Query List command to display all supported sets

Valid range: 0–13 (Hexadecimal. There are 20 possible values.)

<Name>
Name of the band set

ASCII string—Up to 30 characters

<GWmask>
GSM/WCDMA bands included in the set
Format: 32-bit bitmask
Valid values:
• 0000000000000001—BC0-A
• 0000000000000002—BC0-B
• 0000000000000003—BC0 (BC0-A and BC0-B)
• 0000000000000004—BC1
• 0000000000000080—G1800
• 0000000000000300—G900 (EGSM/GSM)
• 0000000000000400—BC6
• 0000000000004000—BC10 (800)
• 0000000000080000—G850
• 0000000000200000—G1900
• 0000000000400000—W2100
• 0000000000800000—W1900
• 0000000002000000—W1700
• 0000000004000000—W850
• 0000000008000000—W800
• 0000000080000000—BC15
• 0002000000000000—W900
• 1000000000000000—B19 (850)

<Lmask>
LTE bands included in the set
Valid values:
• 0000010000000000 - B41
• 0000008000000000 - B40
• 0000002000000000 - B38
• 0000000008000000 - B28
• 0000000000080000 - B20
• 0000000000000080 - B8
• 0000000000000040 - B7
• 0000000000000004 - B3
• 0000000000000001 - B1


So, just type: AT!BAND=03,"LTE B20 800",0,80000 and hit enter. You will see confirmation "OK". Follow the same process for each new band: (each band must be added separately and confirmed with "enter" button). As you probably noticed we are starting from index "03". It is because our device has 3 default bands:
0 - ALL
1 - WCDMA ALL
2 - LTE ALL
We do not want to overwrite these settings, so we start new bands creation process from "03" index.

List of bands:
AT!BAND=03,"LTE B20 800",0,80000
AT!BAND=04,"LTE B3 1800",0,4
AT!BAND=05,"LTE B1 2100",0,1
AT!BAND=06,"LTE B7 2600",0,40
AT!BAND=07,"LTE 800+2600+2100",0,80041
AT!BAND=08,"LTE 800+1800+2600+2100",0,80045
AT!BAND=09,"LTE 800+1800+2600",0,80044
You can try to create 10,11,12,...,20 bands. But as i already noticed there is a bug in firmware that does not allow to use more than 9 bands.

When you define LTE aggregation Bands, the number - let's say: 80044 is a hexadecimal sum of B20+B3+B7 values:
+ 0000000000080000
+ 0000000000000004
+ 0000000000000040
= 0000000000080044

Once you will add all bands listed above, type AT!reset - you will reboot your device. If your device will hang during reboot - do not worry. You have 2 possibilities to make it work again:

1. You can reset device to factory default settings by pressing "reset" tiny button (with paper clip or sth else) located inside the device. you need to press it for several seconds (10sec as far as i remember)
   
   
2. When your device is freezed you can still connect it to USB and use TELNET commands :)
   Thanks to this you can remove band that causing the issue with AT command for exmaple:
   - AT!BAND=09,"",0,0
   - AT!BAND=05,"",0,0
   - AT!BAND=11,"",0,0
   After this AT!reset your device. It will start to work again!

Hope that everything is clear. If you will have some questions - feel free to write :-)