Skip to main content

Powerline Ethernet fun and secrets.

Many 200 Mb/s powerline adapters nowadays are based on the INTELLON 6300 chipset.
Despite what can be thought looking at them, they are all using the same hardware and firmwares.
I heard many people with Netgear XAV101 or Linksys PLK 200 or PLE 200 having problems after firmware updates and many other people with other brands having much more problems because of lack of support or configuration/upgrade utilities.

So let me explain a few things I learnt studying them.

Many of 200 Mb/s powerline ethernet adapters follow the "HomePlug AV" standard. (85 Mb adapters use HomePlug 1.0 standard which is completely different).
This standard uses ethernet broadcast packets using the HomePlug AV protocol.

The interesting thing is that their firmware is made of two different parts:
a .PIB file (Parameter Information Block) and a .NVM file (the code itself).
In the P.I.B. there are many interesting things:
The branding (mac address, device name, etc) and the tone map.

I tested many firmwares and many PIBs and benchmarked them.
The best one so far was you can find here.
You can download the setup and upgrade utility from here.
(no matter what powerline adapter you have if it's INT6300 based)

Something you may not know:
there is no actual difference between the adapter without the security button and the ones that feature it.
Since the have no such button (if you open them you can easily solder one inside it) they tell you they can only be paired as they are sold, but that's a lie.
The button press can also be simulated using the utility, so you can make a big network also with units that don't have the button.

For your information, a total of 15 units can be connected in the same house.

For the braves and people who know what they are doing I finally found the
complete device manager from intellon.
This utility works with firmwares up to 3.0 and can be very useful and very dangerous.

With 'device manager' you can fully customize the powerline adapter and even dump and modify the tonemap!
The tonemap is a list of attenuations, one per carrier, so the adapter can comply with emission rules of any country and can support longer cables, worst conditions, best conditions, etc.

I made a few 'real world' speed tests using wget and a single ftp session on my lan.
Here are the results:

Direct ethernet connection (100 Mb/s): 11.25Mb/s
Connection with 2 adapters on the same wall socket: 4.20 Mb/s - 4.40 Mb/s
Connection with 2 adapters on opposite sides of my house: 3.24 Mb/s

When they say 200 Mb they are meaning RX+TX RAW DATA rate.
During the ftp transfer I was, as a matter of fact, reading these values on the adapter diagnostic interface:

120 / 80 (raw)
90 / 60 (coded)

For the best results, all your powerline adapters in your network
must have the same firmware version and the same PIB.

Testing, I uploaded different tone maps and a few custom ones.
I achieved 5 Mb/s - 5.3 Mb/s with 2 adapters close to each other but the speed
went down to 2.24 Mb/s when they were distant from each other.
The best PIB so far I tested was the "ClassB" one but this may differ in your country or in your house.

With firmwares above version 3.0, the device manager works in a reduced feature set.
Be careful on what you do.
They can anyhow be downgraded if needed to and reupgraded as many times as you want. Don't ever take them off the power outlet for a minute during and after the firmware upgrade or you will brick them in a non recoverable way!

Now some firmwares:

Version   Date      Comment 2007/02/26 2007/05/31 2007/??/?? Found on Pirelli/Onda adapters 2007/08/07 2007/08/16 Fully supported by device manager 2008/06/06 Tested 2008/08/08 Tested 2009/09/03 Untested 2009/10/01 Untested 2009/09/12 Untested 2011/05/04 Untested 2010/03/11 Untested 

Latest firmware is 4.40.05. You can found it on latest Devolo Mini D200 firmware archive.
(available here:
Just unzip the exe, and you'll found a .scm file which his the actual firmware.

Utility for firmware update (Supports all windows versions):

A very interesting document (for very skilled people):

Device manager for 4.x FW:

Linux configuration utility:


  1. We use this Qualcomm PLC utils for realtime HomePlug Monitor. This script is targeted to fill the big hole between dumb end-user utility (supplied by box vendors) and professional (but FW version dependent) AVitar. If someone interested in testing, can found it here:

    All comment are welcome...

  2. Great, so i just bricked my 6400, its cant be detected in _any_ powerlinetool, reset does nothing, has anybody ideas? I even have a linux mint notebook if it helps ;)

  3. I was having a read through here:

    Particularly interested by this:

    As of this date, the most up to date f/w for the 6300 and 6400 chipset products is version 4.4. Note that the enablement of network management features in f/w version after 4.3 requires 16MB SDRAM and 2MB flash

    Does anyone know if the TL-PA201 V2 has 16 MB SD-RAM and 2 MB flash? Or how I can find this stuff out?

    Also does anyone know what these network management features are?

  4. Surfing internet I locate this great article!
    I'm a ham radio operator, and I see how PLC disturb HF band.

    I think tonemaps are responsible for the system uses a frequency or another. I have been looking at the whole spectrum of HF and have huge noise from 8MHz to 28MHz, except for amateur radio frequencies.
    One of the frequencies that have noise, however, is 27MHz, which corresponds to the citizen band.
    You know how that could turn off the transmission in this band?
    I tried .PIB files, but are not easy to understand.

    From Catalonia, Jordi Vidal

  5. Any chance to work it out with Broadcom chipsets?

    My Cisco-Linksys only works with Windows software :-(

  6. Hey Zibri,

    I know this is an old page but thanks to this I've just managed to flash 3 very old Zyxel PLA-401 v1 adopters to I'd bought a new wifi extender to use with them but it couldn't see the existing homeplug network. I was on the verge of buying a whole new set of adapters before I came across this post!

  7. I'm happy to hear this post helped so many people.

  8. Hi all,
    did anyone have a problem where adapters with INT6400 (three of them, two actually brand new) could not talk to other INT6400 anymore, neither with newer adapters using 7420 et al ?
    I tried increased the power using the prescalers, but no avail.
    They do see each other (more or less) when no other adapter of the same network code is present.

    Any help greatly appreciated. Maybe there is some debugging feature hidden in the open-plc-tools?


  9. @Michael: Make sure they're not configured with different encryption passwords. Other than that, being on the same firmware version may help.

  10. I am using AV chipset INT6400, Flash M25P80-VMN3PB, SDRAM MT48LC4M16A2 and 5 Port 10/100 Ethernet Integrated Switch IP175D with 128 PQFP. I have configuration data issue and in order to fix it I have to reload the config in the Flash again. Any idea what is the root cause.

  11. This comment has been removed by the author.

  12. Wish I had found all this years ago.
    Any chance A very interesting document (for very skilled people):

    Device manager for 4.x FW:
    can be made accessible again please?

  13. I have a boxful of Devolo 200 N wifi units which all, appear to have non wifi unit firmware. I should be most grateful please if the non working links/downloads could be restored. Anyone sorted these units? Most helpful work Zibri. BIG THANKS.

  14. Hi Gary,

    In case Zibri does not notice your message (although I'm sure he probably will), I may have one or two of the old files somewhere. I get notifications for this blog, so you can just ping another message on here and I should pick it up.


  15. They were external links. If anyone have these files I will be glad to link them.

  16. Please create an account on MEGA and put the files there.

  17. It's lucky that I am such a ridiculously obsessive data hoarder, and have this stuff on a RAID array that *seriously* needs to be backed up, because it's probably about to fail any time soon! Here we go:

    AVitar setup!wcJi1SLL!DSqx51yOeCP1UhWq6O2GAAlA6KjIsdeMvFOsMgTX-Z0

    AVitar manual!ZBxkQLgD!kIUyMJjYjyc2qqCjOhlP1y9iShCJm0STYrJkF-zZ14Q

    INT6400 technical specification!BJZiALRC!FHlpRX-n1x-oe5UpGgI0_F3E308e-IZVokou_f_TbBU


    Enjoy! :)

  18. Hey there!

    Latest firmware is 4.40.05. You can found it on latest Devolo Mini D200 firmware archive.
    (available here:
    Just unzip the exe, and you'll found a .scm file which his the actual firmware.
    Successfully updated a pair of old powerline adapter. Starting at 85Mbps, I got know 190Mpbs! Amazing :)

  19. Can we operate on PGA amplifier to cover more distances? Have you tried to do its?


Post a Comment

Popular posts from this blog

TP-LINK Configuration file encrypt and decrypt.

Here we go! TP-Link is another company that thinks that security by obscurity could ever work. If you "backup" the configuration from most TP-Link routers, you will get a .BIN file which is "encrypted". Use this utility below, to decrypt it (so you can edit it) and encrypt it again. Have fun. Drop files here or

Obfuscation will never work.

ml> Hello again, sweet readers ! OpenRG is an embedded OS for routers. It's based on Linux and it's inside many ISP routers out there. Inside OpenRG configuration file, passwords appear in a way that can seem to be crypted, but it's just obfuscated. For example: (username(admin)) (password(&b7;X&5c;&b9;&a2;)) Above you can see a simple deobfuscator. Enjoy! You can try it with: &ad;Y&5b;&b3;&a3;&17;T&8b;&c4;&b9;#&96;&04;c&ea;&1d;$%&5d;&16;&08;B3&c0; :) Zibri.