ankurpandeyvns/V2802RH_CLI.md

VSOL V2802RH ONU – Complete CLI Reference (v5, March 2026)

Comprehensive CLI reference built from real telnet sessions. Covers all command modes, OMCI management, cfgmib operations, and key configuration items.

1 · Access & CLI Modes

Telnet access: telnet <ONU_IP> (default 192.168.1.1, port 23) Default credentials: admin / device-specific password

Prompt	Mode	How to enter	How to exit
`AP#`	Privileged EXEC	Login via telnet	`logout`
`AP(config)#`	Global Configuration	`configuration`	`exit` or `end`
`RTK.0>`	Realtek Diag Shell	`diag`	`exit` (back to AP#)

2 · Top-Level Commands (AP# mode)

Command	Description
`cfgmib`	Configuration MIB operations (get/set/save/all)
`clear`	Clear counters, ARP cache, etc.
`configuration`	Enter global configuration mode
`copy`	Copy from one file to another
`cpuocpy`	Show CPU occupancy
`debug` / `undebug`	Enable/disable protocol debug logging
`diag`	Enter Realtek SDK diagnostic shell
`dsttime`	Set Daylight Saving Time rules
`ethdebug`	SAR RX/TX debug (`0` disable, `1` enable)
`ethmirror`	Mirror TX/RX packets
`ethstatus`	Show ethernet port status
`flash`	Flash configuration (get/set hardware items)
`lansds`	SerDes & MAC toolkit
`led`	LED control
`login` / `logout`	Privilege escalation / end session
`loopback`	Loopback detect settings
`memory`	Memory read/write
`omcicli`	OMCI management commands
`omcidrv`	OMCI driver proc commands
`ping` / `ping6`	ICMP echo test
`pppoe`	PPPoE configuration
`restart`	Warm reboot
`rg` / `rgdump` / `rgshow`	RomeDriver utilities
`rtkbosa`	BOSA optics tuning
`rtl8686gmac`	GMAC debug commands
`sarmirror`	ATM VC packet mirroring
`show`	Show running system information
`tftp`	TFTP file transfers
`trace` / `tracert6`	Traceroute
`vsEncrypt`	Vendor encryption tool
`vsproduct`	Product/licence management

3 · `show` Subcommands

show arp                    Show ARP table
show dos                    Show DoS configuration
show ethernet               Show ethernet MIB counters
show fastpath               Show fastpath table
show icmprt                 Show ICMP route discovery config
show interface              Interface status and configuration
show ip <subcmd>            IP information (see below)
show ip6                    IPv6 information
show lib                    Show library package info
show logging                Show system log table
show mac-address-table      Show forwarding table
show memory                 Show memory usage
show mld                    Show MLD parameters
show ntp                    Show NTP configuration
show ppp                    Show PPP status
show processes              Show running processes
show qos                    Show QoS configuration
show qos_db                 Show QoS statistics
show rtk_tr142 <subcmd>     Show TR142/WAN info (see below)
show status                 Show modem status (MAC address)
show stun                   Show STUN configuration
show system                 Show system info
show tc                     Show traffic shaping config
show tcp                    Show TCP info
show url                    Show URL filter strings
show urlredirect            Show URL redirect state
show version                Show firmware version

`show ip` subcommands

show ip access-list         Show ACLs
show ip arp                 Show ARP entries
show ip circuit             Show IP circuit info
show ip dhcp                Show DHCP info
show ip igmp                Show IGMP downstream interface
show ip ipcircuit           Show global circuit
show ip ipclient            Show IP clients
show ip mark                Show IP mark table
show ip name-server         Show DNS servers
show ip nat                 Show NAT info
show ip openport            Show open port table
show ip pcb                 Show IP PCB
show ip route               Show routing table
show ip viptable            Show virtual IP table

`show rtk_tr142` subcommands

show rtk_tr142 log_module   Show log module
show rtk_tr142 log_level    Show log level
show rtk_tr142 wan_info     Show WAN info (GEM port, TCONT, flow IDs)
show rtk_tr142 queue_map    Show queue mapping

Example – show rtk_tr142 wan_info:

Realtek TR142 Colleted WAN Info:
WAN[0]:
    wanIdx = 1
    wanType = 2
    gemPortId = 736
    tcontId = 0
    usFlowId = 0 1 2 3 0 0 0 0
    queueSts = 0 1 2 3 0 0 0 0

Example – show interface:

name                            e1  HWAddr           AA:BB:CC:DD:EE:FF
port                             1  circ                             1
IP address            192.168.1.1   Net Mask             255.255.255.0
Proto                            0  primary                          1
AdminiStats                      1  Enabled                          2
NatDir                           1  Napt                             0
MTU                           1500

4 · `cfgmib` – Configuration MIB

The primary tool for reading/writing ONU configuration. Values are stored in XML-like MIB entries.

cfgmib all                  Dump all MIB tables and chains (large output)
cfgmib save                 Save current config to flash
cfgmib set <NAME> <VALUE>   Set a config value (cannot set HW_ items)
cfgmib get <NAME>           Get a specific config value
cfgmib dns_permit           Add DNS lock pool entry
cfgmib dnsv6_permit         Add IPv6 DNS lock pool entry

Examples:

AP# cfgmib get CWMP_FLAG
<Name="CWMP_FLAG" Value="0x0"/>

AP# cfgmib get DUAL_MGMT_MODE
<Name="DUAL_MGMT_MODE" Value="0x1"/>

AP# cfgmib set CWMP_INFORM 0x0
AP# cfgmib save

Note: Hardware config items (prefixed HW_) cannot be set via cfgmib set. Use flash set instead (see below).

5 · `flash` – Hardware Config Items

For setting hardware-level config items that cfgmib set refuses.

flash set <NAME> <VALUE>    Set a hardware config item

Example:

AP# flash set HW_IPHOST_WAN_DISABLE 1
AP# cfgmib get HW_IPHOST_WAN_DISABLE
<Name="HW_IPHOST_WAN_DISABLE" Value="0x1"/>

Important: Always run cfgmib save after flash set to persist changes.

6 · `omcicli` – OMCI Management

6.1 `omcicli get`

omcicli get sn              Get serial number
omcicli get log             Get runtime log level
omcicli get logfile         Get OMCI msg log mode/action mask
omcicli get tables          Get all registered MIB tables
omcicli get devmode         Get OMCI device mode (bridge/router)
omcicli get dmmode          Get dual management mode
omcicli get loid            Get LOID and password
omcicli get loidauth        Get LOID auth status
omcicli get cflag           Get customized flags (BDP/RDP/MC/ME)
omcicli get authuptime      Get auth uptime

Examples:

AP# omcicli get devmode
DevMode: router

AP# omcicli get dmmode
dmMode = wan_queue

AP# omcicli get cflag
BDP: 0x00000080
RDP: 0x00000000
 MC: 0x00000000
 ME: 0x00040000

6.2 `omcicli set`

omcicli set sn              Set serial number
omcicli set log             Set runtime log level
omcicli set logfile         Log OMCI messages to file
omcicli set devmode         Set device mode (bridge/router)
omcicli set dmmode          Set dual management mode
omcicli set loid            Set LOID and password
omcicli set resetlauth      Reset LOID auth number
omcicli set dhcp            Set DHCP info
omcicli set fakeok          Force/enable/disable fake OK responses
omcicli set pm              Set PM running state
omcicli set tm              Set TM running state
omcicli set iotvlancfg      Set IOT VLAN setting
omcicli set cflag           Set customized flags

`omcicli set dmmode` – Dual Management Mode

Controls how the ONU handles OLT-pushed WAN configurations via OMCI.

omcicli set dmmode {mode}

Modes:
  off           OMCI driver doesn't hook any dual mgmt callbacks
  on_wq         Hook data path callbacks only (per-WAN QoS queues)
  on_bc_mc      Hook broadcast/multicast callbacks only
  on_wq_bc_mc   Hook both data path and broadcast/multicast callbacks

Example:
  omcicli set dmmode off

off prevents the OLT from creating/modifying WAN entries via OMCI. on_wq (default) allows OLT to push WAN configs including phantom TR069 entries.

To persist across reboots, also set the MIB value:

flash set DUAL_MGMT_MODE 0x0    # corresponds to dmmode off
cfgmib save

6.3 `omcicli mib`

omcicli mib create          Create a MIB Managed Entity
omcicli mib delete          Delete a MIB Managed Entity
omcicli mib set             Set MIB ME attribute
omcicli mib get <class_id>  Get all MIB entries or a specific ME class
omcicli mib getcurr         Get PM MIB current accumulations
omcicli mib getalm          Get all alarms or a specific ME class
omcicli mib getattr         Get specific attribute for a ME class
omcicli mib reset           Trigger MIB reset
omcicli mib wanreset        Trigger MIB WAN reset

Key OMCI ME class IDs:

Class ID	ME Name	Description
84	VlanTagFilterData	VLAN tag filtering rules
134	IpHostCfgData	IP host configuration (LAN management IP)
171	ExtVlanTagOperCfgData	Extended VLAN tagging operations
277	PriorityQueue	Priority queue configuration
329	VEIP	Virtual Ethernet Interface Point

Example – Get IP Host Config Data:

AP# omcicli mib get 134
IpHostCfgData
=================================
EntityID: 0x0000
IpOptions: 0x02
IpAddress: 0x00000000
Mask: 0x00000000
Gateway: 0x00000000
PrimaryDns: 0x00000000
SecondaryDns: 0x00000000
=================================

Example – Get VLAN Tag Filter:

AP# omcicli mib get 84
VlanTagFilterData
=================================
EntityID: 0x01
FilterTbl[0]: PRI 0,CFI 0, VID 202
FwdOp:  0x10
NumOfEntries: 1
=================================

Example – Get VEIP:

AP# omcicli mib get 329
VEIP
=================================
EntityId: 0x0601
AdminState: 1
OperState: 1
=================================

6.4 `omcicli dump`

omcicli dump avltree        Dump AVL tree
omcicli dump qmap           Dump queue map
omcicli dump conn           Dump OMCI connections (GEM ports, VLAN rules)
omcicli dump srvflow        Dump service flow table
omcicli dump tasks          Dump active tasks
omcicli dump timers         Dump active timers

Example – omcicli dump srvflow:

SERVID 0: Used: 1, (DIR=2, USFID=0, DSFID=1, SERVID=0, UNIMASK=12)
SERVID 1: Used: 1, (DIR=3, USFID=0, DSFID=0, SERVID=1, UNIMASK=12)
SERVID 2: Used: 1, (DIR=2, USFID=0, DSFID=2, SERVID=2, UNIMASK=4)

6.5 `omcicli debug`

omcicli debug loadfile           Replay raw OMCI file
omcicli debug loadpkt            Replay raw OMCI packet
omcicli debug simalm             Simulate an alarm
omcicli debug simavc             Simulate an AVC
omcicli debug detectiotvlan      Detect IOT VLAN info
omcicli debug gendot             Generate dot file at /omci_dot_file
omcicli debug showregmod         Show registered feature modules
omcicli debug showregapi         Show registered feature APIs
omcicli debug showomcimibcfg     Show /omci_mib.cfg contents
omcicli debug showomcicustomcfg  Show /omci_custom_opt.cfg contents
omcicli debug misc               Show/operate debugging
omcicli debug setcfopt           Set custom option in omci_custom_opt.cfg
omcicli debug delcfopt           Delete custom option from omci_custom_opt.cfg

6.6 `omcicli show`

omcicli show logfile        Show OMCI log file

7 · Configuration Mode (`AP(config)#`)

Enter with configuration, exit with exit or end.

adduser                     Add user account
arp                         ARP configuration
domain                      Set domain filter string
dos                         Set DoS configuration
enable                      Modify enable password parameters
end                         Jump back to privileged EXEC mode
exit                        Exit configuration mode
hostname                    Set hostname
icmprt                      ICMP route discovery config
igmpsnp                     Configure IGMP snooping
interface                   Select interface to configure
ip                          IP configuration
ip6                         IPv6 configuration
logging                     Configure log settings
mac-address-table           Set forwarding/filter table
mld                         Configure MLD parameters
netlog                      Configure netlog state
no                          Negate a command or set defaults
ntp                         Configure NTP
passwithprio / password     Privilege authentication
portmap                     Configure port mapping
qos                         QoS configuration
rtk_tr142 log_module        Set TR142 log module
rtk_tr142 log_level         Set TR142 log level
service                     Service configuration
stun                        Configure STUN
syslog                      Configure syslog
time                        Set date/time
upnp                        Set UPnP state
url                         Set URL filter string
urlredirect                 Set URL redirect

8 · Realtek Diag Shell (`RTK.0>`)

Enter with diag from AP# prompt. This is the raw Realtek SDK shell for chipset-level diagnostics. Uses Realtek SDK command syntax (not the same as AP# commands).

AP# diag
RTK.0> <command>
RTK.0> exit
AP#

Note: Standard AP# commands like flash, cfgmib, show do NOT work in this shell.

9 · Key Configuration Items Reference

CWMP / TR-069 Settings

MIB Name	Description	Values
`CWMP_FLAG`	Master CWMP enable flag	`0x0`=disabled, `0x1`=enabled
`CWMP_INFORM`	CWMP periodic inform	`0x0`=disabled
`CWMP_INFORM_INTERVAL`	Inform interval (seconds, hex)	Default `0x12c` (300s)
`CWMP_SERVER_URL`	ACS server URL	Empty = no ACS
`CWMP_SERVER_USER`	ACS username
`CWMP_SERVER_PWD`	ACS password
`CWMP_CONREQ_PORT`	Connection request port	`0x0`=disabled
`CWMP_CONREQ_PATH`	Connection request path
`WEB_TR069_EDITABLE`	Allow TR069 editing via web UI	`0x1`=yes

OMCI / OLT Management

MIB Name	Description	Values
`OMCI_ACS_CONFIGURED`	ACS configured via OMCI	`0x0`=no
`OMCI_ACS_URL`	ACS URL from OMCI
`OMCI_TR069_IF_ID`	TR069 interface ID from OMCI	`0xffffffff`=none
`OMCI_FAKE_OK`	Respond OK to OMCI commands	`0x1`=enabled
`OMCI_OLT_MODE`	OLT compatibility mode
`DUAL_MGMT_MODE`	Dual management mode	`0x0`=off, `0x1`=wan_queue
`OMCI_CUSTOM_BDP`	Custom BDP flags
`OMCI_CUSTOM_ME`	Custom ME flags
`OMCI_WAN_QOS_QUEUE_NUM`	WAN QoS queue count	Default `0x4`

WAN / Network

MIB Name	Description	Values
`HW_IPHOST_WAN_DISABLE`	Block OLT IP Host WAN creation	`0x0`=allow, `0x1`=block
`WAN_PHY_TYPE`	WAN physical type	`0x1`=PON
`WAN_ETHPORT`	WAN ethernet port
`MAX_WANNUM`	Maximum WAN connections	Default `0x3`

GPON Identity

MIB Name	Description	Values
`GPON_SN`	GPON serial number	e.g. `RLGMXXXXXXXX`
`GPON_PLOAM_PASSWD`	PLOAM password
`GPON_ONU_MODEL`	ONU model string	e.g. `RH821GWV-DG`
`PON_VENDOR_ID`	Vendor ID (4 chars)	e.g. `RLGM`
`LOID`	Logical ONU ID
`LOID_PASSWD`	LOID password
`PON_MODE`	PON mode	`0x1`=GPON

Telnet / Access

MIB Name	Description	Values
`TELNET_STATE`	Telnet enabled	`0x1`=enabled
`TELNET_PORT`	Telnet port	`0x17`=23
`USER_LAN_TELNET_ENABLE`	Telnet from LAN side	`0x0`=disabled
`USER_WAN_TELNET_ENABLE`	Telnet from WAN side	`0x0`=disabled
`TELNET_USERNAME`	Telnet username (if set)
`TELNET_PASSWORD`	Telnet password (if set)

LAN / SerDes

MIB Name	Description	Values
`LAN_SDS_MODE`	SerDes mode	`0x5`
`LAN_TYPE`	LAN type	`0x3`
`LAN_VLAN_ID1`	LAN VLAN ID 1
`LAN_PORT_MASK1`	LAN port mask

Hardware

MIB Name	Description	Values
`ELAN_MAC_ADDR`	Device MAC address
`HW_SERIAL_NO`	Hardware serial number
`HW_PRODUCT_CLASS`	Product class	e.g. `RH821GWV-DG`
`HW_HWVER`	Hardware version	e.g. `V2.1`
`HW_MODEL_NAME`	Model description	e.g. `XPON+2.5GE+1GE`
`SW_VERSION`	Software version
`OMCI_SW_VER1` / `OMCI_SW_VER2`	OMCI software versions

10 · Phantom TR069 WAN Entry – Root Cause & Fix

Problem

ISP's OLT pushes a phantom WAN config to the ONU via OMCI (GPON management protocol), not TR-069. This creates a ghost TR069 WAN entry visible in the web UI even when all CWMP/TR-069 is disabled. The OMCI channel is always open as part of the GPON standard.

How it happens

OLT sends OMCI Create/Set commands for GEM Port CTP, Extended VLAN Tagging, IP Host Config Data
ONU's dual management module (DUAL_MGMT_MODE=0x1 / dmmode=wan_queue) accepts and applies them
Firmware translates OMCI-provisioned WAN into a local WAN entry shown in web UI

Fix

Block OLT from creating IP Host-based WAN entries:

AP# flash set HW_IPHOST_WAN_DISABLE 1
AP# cfgmib save
AP# restart

Verify after reboot:

AP# cfgmib get HW_IPHOST_WAN_DISABLE
<Name="HW_IPHOST_WAN_DISABLE" Value="0x1"/>

Alternative (more aggressive)

Disable dual management entirely:

AP# omcicli set dmmode off
AP# flash set DUAL_MGMT_MODE 0x0
AP# cfgmib save

Warning: dmmode off may require the data VLAN/GEM port to be manually configured since the OLT can no longer provision it.

Verification commands

cfgmib get CWMP_FLAG              # should be 0x0
cfgmib get CWMP_INFORM            # should be 0x0
cfgmib get OMCI_ACS_CONFIGURED    # should be 0x0
cfgmib get OMCI_TR069_IF_ID       # should be 0xffffffff
cfgmib get HW_IPHOST_WAN_DISABLE  # should be 0x1
omcicli get dmmode                # wan_queue or off

11 · Quick Reference

# Check ONU status
show status
show interface
ethstatus
lansds show config
cpuocpy

# GPON / OMCI status
omcicli get devmode
omcicli get dmmode
omcicli get sn
omcicli get loid
omcicli get loidauth
omcicli dump conn
omcicli dump srvflow
show rtk_tr142 wan_info

# Read configuration
cfgmib get <NAME>
cfgmib all                    # full dump

# Modify configuration
cfgmib set <NAME> <VALUE>     # regular items
flash set <NAME> <VALUE>      # HW_ items
cfgmib save                   # persist to flash

# Network diagnostics
ping 8.8.8.8
trace 8.8.8.8
show ip route
show ip arp
show ppp

# Reboot
restart

Last updated: March 2026. Built from live telnet sessions on VSOL V2802RH.

vitorioluiz-create · 2025-09-30T14:22:54Z

Hello ankurpandeyvns,

I hope you are doing well. I found your post on GitHub about the Realtek RTL960x platform and the V-SOL devices, and it was very helpful. I am currently trying to recover a V-SOL V2802RH ONT that is stuck and no longer boots correctly.

Here’s what I have done so far:

I managed to obtain the official firmware from V-SOL (V2802RH_V1.1.8_241206_S1006.img).

I used binwalk, dd, and unblob to extract possible kernel and rootfs partitions.

I found JFFS2 and EXT4 signatures inside the image, but extracting a usable rootfs has been extremely difficult (pieces are fragmented, and some parts decompress into HTML/login pages instead of a filesystem).

I also confirmed the U-Boot environment via UART, and I can access the bootloader. The commands upk and upr are available to flash kernel and rootfs via TFTP.

The problem:
I cannot find a way to split the .img file into proper uImage (kernel) and rootfs files that the bootloader expects. V-SOL support only provided me with .img files, not .tar, and they stopped replying to my emails.

My question:
👉 Do you know how to properly extract the uImage and rootfs from this .img so I can load them into the device via UART/TFTP?
👉 Or is there already a method to use the .img directly with U-Boot that I am missing?

I would really appreciate any guidance you could provide. I have been trying for weeks, and your experience seems to be exactly what I need to finally move forward.

Thank you very much in advance for your time and help.

ankurpandeyvns/V2802RH_CLI.md

Select an option

No results found

Select an option

No results found

VSOL V2802RH ONU – Complete CLI Reference (v5, March 2026)

1 · Access & CLI Modes

2 · Top-Level Commands (AP# mode)

3 · `show` Subcommands

`show ip` subcommands

`show rtk_tr142` subcommands

4 · `cfgmib` – Configuration MIB

5 · `flash` – Hardware Config Items

6 · `omcicli` – OMCI Management

6.1 `omcicli get`

6.2 `omcicli set`

`omcicli set dmmode` – Dual Management Mode

6.3 `omcicli mib`

6.4 `omcicli dump`

6.5 `omcicli debug`

6.6 `omcicli show`

7 · Configuration Mode (`AP(config)#`)

8 · Realtek Diag Shell (`RTK.0>`)

9 · Key Configuration Items Reference

CWMP / TR-069 Settings

OMCI / OLT Management

WAN / Network

GPON Identity

Telnet / Access

LAN / SerDes

Hardware

10 · Phantom TR069 WAN Entry – Root Cause & Fix

Problem

How it happens

Fix

Alternative (more aggressive)

Verification commands

11 · Quick Reference

vitorioluiz-create commented Sep 30, 2025

Uh oh!

ankurpandeyvns/V2802RH_CLI.md

VSOL V2802RH ONU – Complete CLI Reference (v5, March 2026)

1 · Access & CLI Modes

2 · Top-Level Commands (AP# mode)

3 · show Subcommands

show ip subcommands

show rtk_tr142 subcommands

4 · cfgmib – Configuration MIB

5 · flash – Hardware Config Items

6 · omcicli – OMCI Management

6.1 omcicli get

6.2 omcicli set

omcicli set dmmode – Dual Management Mode

6.3 omcicli mib

6.4 omcicli dump

6.5 omcicli debug

6.6 omcicli show

7 · Configuration Mode (AP(config)#)

8 · Realtek Diag Shell (RTK.0>)

9 · Key Configuration Items Reference

CWMP / TR-069 Settings

OMCI / OLT Management

WAN / Network

GPON Identity

Telnet / Access

LAN / SerDes

Hardware

10 · Phantom TR069 WAN Entry – Root Cause & Fix

Problem

How it happens

Fix

Alternative (more aggressive)

Verification commands

11 · Quick Reference

vitorioluiz-create commented Sep 30, 2025

Uh oh!

3 · `show` Subcommands

`show ip` subcommands

`show rtk_tr142` subcommands

4 · `cfgmib` – Configuration MIB

5 · `flash` – Hardware Config Items

6 · `omcicli` – OMCI Management

6.1 `omcicli get`

6.2 `omcicli set`

`omcicli set dmmode` – Dual Management Mode

6.3 `omcicli mib`

6.4 `omcicli dump`

6.5 `omcicli debug`

6.6 `omcicli show`

7 · Configuration Mode (`AP(config)#`)

8 · Realtek Diag Shell (`RTK.0>`)