Category: security

Your router is running low on free NVRAM

Update: A one line script, found on the Internet of course, makes clearing unused entries in the NVRAM easy:

for line in `nvram show | grep ^[^=]*=$ `; do var=${line%*=}; nvram unset $var; done; nvram commit

I have been running an Asus wireless router running Asuswrt-Merlin firmware. There have been some recent security and bug fix changes that I wanted to pick up so updated the router to newer firmware.

Now I am getting a flashing warning icon on the router’s dashboard that says:

Your router is running low on free NVRAM, which might affect its stability.
Review long parameter lists (like DHCP reservations), or consider doing a factory default reset and reconfiguring.

I vaguely recall having run into to this a long while ago but can’t find any notes on what I did at that time. So this is a “note to myself”.

NVRAM

The Asuswrt-Merlin firmware stores a lot, maybe all, of its configuration parameters as key=value pairs in non-volatile RAM (NVRAM). And it has 65536 bytes of NVRAM.

Apparently when there is a major version update for the firmware the keys can change. But old ones are not removed.

You can ssh into the router and issue a nvram show command to see what is in there. In my case over 500 keys which had no value and were listed in the form of a_parameter=. These were eating up over 8K bytes of scarce NVRAM.

Freeing up NVRAM

I guess I should go look at the source code for the NVRAM handling in the router, but I strongly suspect that it should handle missing keys. It certainly would if I had written it back when I was working as a software engineer.

In any case, I use the working assumption that I can unset any keys that have empty values. In which case the fix is:

  • Copy output of nvram show to a text editor.
  • Remove any lines that have a value after the ‘=’ character.
  • Globally change the remaining lines from a_parameter= to nvram unset a_parameter.
  • Copy the resultant commands from the text editor to the ssh terminal session on the router.
  • Issue a nvram commit command to copy the in RAM working copy to the NVRAM.