Skip to main content

Add custom bands to netgear nighthawk m1 - tutorial


Guide is based on
SKU: MR1100-100EUS
TESTED WITH SOFT: NTG9X50C_12.06.03.00 + NTG9X50C_12.04.02.00
As you probably noticed that your Nighthawk M1 has only 3 cellular “Band Region” options:
  1. Auto
  2. WCDMA all
  3. LTE all
With this guide I will show you the way of how to add new options there. Thanks to this you will be able to control the way of how your nighthawk connects to BTS (Base Transceiver Station). In effect you will be able to select one from options:
  • 0 -Auto
  • 1 - WCDMA all
  • 2 - LTE all
  • 3 - LTE B20 800
  • 4 - LTE B3 1800
  • 5 - LTE B1 2100
  • 6 - LTE B7 2600
  • 7 - LTE 800+2600+2100
  • 8 - LTE 800+1800+2600+2100
  • 9 - LTE 800+1800+2600
Why these bands?
I am located in europe and 800, 1800, 2100, 2600 are most popular LTE bands here.
You can create own bands based on this tutorial, details are decribed in the guide.


Nighthawk M1 should support up to 20 options there, but unfortunately it allows to use only 9 options. Why? There is a bug in firmware NTG9X50C_12.06.03.00 that do not allow to use more than 9 bands – if you will add more your device will hang during reboot. I contacted with support but they do not care about this bug in firmware :(


freezed device will show purple background only:



but do not worry, if you will have this kind of problem - it can be solved. Details at the end of the guide.


Ok, let’s start with tutorial ;-)
Firstly connect your device to your PC via USB port. It is important! Otherwise you will not have possibility to follow next steps. To add new region bands we will use Telnet feature that is available in windows by default.  Open windows command prompt: https://i.imgur.com/1aMTghi.gifv
  1. Press win+s
  2. Search for “cmd”
  3. Hit enter to open command console
  4. Type telnet 192.168.1.1 5510 and hit enter
  5. Once you will connect, you will see black screen. If you will see message that ‘telnet’ does not exist, you need to activate it: https://www.technipages.com/windows-10-enable-telnet and then - go back to point 1 and repeat process J
  6. If you are connected to your device via telnet – you can use AirCad commands now
Important!
If you have branded nighthawk your AirCad console is probably secured with password. Unfortunately i do not know this password, you need to search it over the internet because it is unique for each telecom. Some nice people shared these passwords on forums, also here ;)

Before you can use any password-protected AT commands, you must enter the password correctly using !ENTERCND command.
just type AT!ENTERCND="password" (password must be entered with quotation marks, but if it will not work - try without quotation marks as well).
If your nighthawk is not protected with password, or if you entered password properly it is start to add new bands with !BAND command

AT!BAND command
To add new bands we will use AT!BAND command. It allows to configure the modem to operate on a set of frequency bands, look up available sets, create new sets, or return the current selection. The structure of command is:
AT!BAND=<Index>,”<Name>”,<GWmask>[,<Lmask>,<Lmask2>]

Where:
<Index>
Index of a band set. Use the Query List command to display all supported sets
Valid range: 0–13 (Hexadecimal. There are 20 possible values.)
<Name>
Name of the band set
ASCII string—Up to 30 characters
<GWmask>
GSM/WCDMA bands included in the set
Format: 32-bit bitmask
Valid values:
• 0000000000000001—BC0-A
• 0000000000000002—BC0-B
• 0000000000000003—BC0 (BC0-A and BC0-B)
• 0000000000000004—BC1
• 0000000000000080—G1800
• 0000000000000300—G900 (EGSM/GSM)
• 0000000000000400—BC6
• 0000000000004000—BC10 (800)
• 0000000000080000—G850
• 0000000000200000—G1900
• 0000000000400000—W2100
• 0000000000800000—W1900
• 0000000002000000—W1700
• 0000000004000000—W850
• 0000000008000000—W800
• 0000000080000000—BC15
• 0002000000000000—W900
• 1000000000000000—B19 (850)

<Lmask>
LTE bands included in the set
Valid values:
• 0000010000000000 - B41
• 0000008000000000 - B40
• 0000002000000000 - B38
• 0000000008000000 - B28
• 0000000000080000 - B20
• 0000000000000080 - B8
• 0000000000000040 - B7
• 0000000000000004 - B3
• 0000000000000001 - B1



So, just type: AT!BAND=03,"LTE B20 800",0,80000 and hit enter. You will see confirmation "OK". Follow the same process for each new band: (each band must be added separately and confirmed with "enter" button). As you probably noticed we are starting from index "03". It is because our device has 3 default bands:
0 - ALL
1 - WCDMA ALL
2 - LTE ALL
We do not want to overwrite these settings, so we start new bands creation process from "03" index.

List of bands:
AT!BAND=03,"LTE B20 800",0,80000
AT!BAND=04,"LTE B3 1800",0,4
AT!BAND=05,"LTE B1 2100",0,1
AT!BAND=06,"LTE B7 2600",0,40
AT!BAND=07,"LTE 800+2600+2100",0,80041
AT!BAND=08,"LTE 800+1800+2600+2100",0,80045
AT!BAND=09,"LTE 800+1800+2600",0,80044
You can try to create 10,11,12,...,20 bands. But as i already noticed there is a bug in firmware that does not allow to use more than 9 bands.


When you define LTE aggregation Bands, the number - let's say: 80044 is a hexadecimal sum of B20+B3+B7 values:
+ 0000000000080000
+ 0000000000000004
+ 0000000000000040
= 0000000000080044
Once you will add all bands listed above, type AT!reset - you will reboot your device. If your device will hang during reboot - do not worry. You have 2 possibilities to make it work again:


  1. You can reset device to factory default settings by pressing "reset" tiny button (with paper clip or sth else) located inside the device. you need to press it for several seconds (10sec as far as i remember)

  2. When your device is freezed you can still connect it to USB and use TELNET commands :)
    Thanks to this you can remove band that causing the issue with AT command for exmaple:
    - AT!BAND=09,"",0,0
    - AT!BAND=05,"",0,0
    - AT!BAND=11,"",0,0
    After this AT!reset your device.
    It will start to work again!
Hope that everything is clear. If you will have some questions - feel free to write :-)


Comments

  1. Hey. I'm in the US and I'm trying to isolate band 12. How did you get the values for the bands? I guess what I'm asking is how does 'B20' become '80000'? Is there a listing of values for all bands somewhere?

    ReplyDelete
    Replies
    1. You can obtain the list by AT!BAND=? command, similar list as below -

      Index, Name, GW Band Mask L Band Mask L ext Band Mask
      00, Auto, 0002000004C00000 000001A0080800C5 0000000000000000
      01, WCDMA All, 0002000004C00000 0000000000000000 0000000000000000
      02, LTE All, 0000000000000000 000001A0080800C5 0000000000000000

      0000010000000000 - B41
      0000008000000000 - B40
      0000002000000000 - B38
      0000000008000000 - B28
      0000000000080000 - B20
      0000000000000080 - B8
      0000000000000040 - B7
      0000000000000004 - B3
      0000000000000001 - B1
      0002000000000000 - B8 (900)
      0000000004000000 - B5 (850)
      0000000000800000 - B2 (1900)
      0000000000400000 - B1 (2100)

      B20 can be set as the value of 80000, from L Bank Mask column, based on above list, hope this helps.

      Delete
  2. Hello I have the M1 and M2, I connect to the Mac from the usb type c on the M1/M2 to the USB port in my mac and proceed with the telnet step with the port provided but keeps giving me connection refused. Any idea?

    ReplyDelete
    Replies
    1. I am able to connect now but I need the ntercnd password as it seems the AT commands are locked.

      Any idea? Password for Nighthawk MR2100? Or MR1100

      Delete
  3. Thank you for sharing this. I was able to quickly set up my MR1100 with custom channels and keep it from switching to higher power but lower throughput channels

    ReplyDelete
  4. Hi. Can you please help me how combine B1 + B3 + B28 please. thank you.

    ReplyDelete
  5. Any news on the pass to be able to make these changes? thaanks

    ReplyDelete
  6. I guess no dice here as i do not know pass. Any can share? thank you

    ReplyDelete
  7. Can anyone share the pass to be able to change this. THanks

    ReplyDelete
  8. Nod ice. but here are some that people have had success:
    AT!ENTERCND="sunflower"
    AT!ENTERCND="whistler"
    AT!ENTERCND="seymour"
    AT!ENTERCND="grouse"
    AT!ENTERCND="lavender"
    AT!ENTERCND="fallow"
    AT!ENTERCND="granville"
    " cypress "
    AT!ENTERCND="cypress"


    AT!ENTERCND="grouse"
    AT!ENTERCND="A710"
    AT!ENTERCND="Whistler"
    AT!ENTERCND="Whistler"
    AT!ENTERCND="whistler"
    AT!ENTERCND="!Whistler"
    AT!ENTERCND="810"
    AT!ENTERCND="A810"
    AT!ENTERCND="AC810"
    AT!ENTERCND="seymour"
    AT!ENTERCND="Lavender"
    AT!ENTERCND="bluebell"

    ATENTERCND="lindeman"!

    ReplyDelete
  9. Does this work for US Version? Telnet is not recognized as an internal or external comand is the error message I'm getting

    ReplyDelete
  10. Does anyone have the Lmask for Band 17 AT&T? Thanks

    ReplyDelete
  11. This comment has been removed by the author.

    ReplyDelete
  12. This comment has been removed by the author.

    ReplyDelete
  13. Sorry for asking a stupid question. But does this guide give me the abilitiy to buy a cheaper telstra-branded Nighthawk M1 on Aliexpress and unlock the LTE Bands for the use in Europe (e.g. LTE Band 20)? Given that I find a working password. Thanks a lot for your answer!

    ReplyDelete

Post a Comment