Linksys WIP300


General Description

No Longer Available through distribution - EOL as Per Linksys

The Linksys WIP300 phone is a 'candybar' style SIP WiFi phone that supports 80211b/g as well as WPA/WPA2 network encryption. There are two ports: a headset port, and a USB port (mini-b style) that acts as a charger port.

Despite being a first generation WiFi-VoIP SIP phone with a slightly cheap appearance, the phone has an impressive array of features, several undocumented. On the other hand, some promised key features (such as wifi roaming) are still unreliable.

Features at a Glance

Feature Support
802.11b WiFi Yes
802.11g WiFi Yes
10/100/1000BaseT physical connection No, only wireless
Cellular/dual-use No, only VoIP
Skype Support No (try the WIP-320)
NAT Traversal Support Yes, stun
Send/Receive Email Yes, but cumbersome
Charge from AC Yes, using provided AC adapter
Charge from USB Yes, but cable not included
USB communication interface No, only for charging (perhaps future comm support?)
Bluetooth Support No
Web Config Interface Yes
Built-in Camera No


Q. Can the phone charge over USB using a regular USB cable connected to a computer, laptop, or powered hub?

A. The phone is chargeable via a USB cable connected to a powered-on desktop or laptop.

Q. How long does the battery last?

A. 50 hours standby or 3 hours talk

Q. Does this phone handle stun? turn/ice?

A. The phone works fine behind NAT using STUN. It does not implement ICE/TURN.

Q. Does this phone support Bluetooth headsets?

A. No

Q. How easily configurable is the phone?

A. The menus are easy to navigate, although using the keypad can be a bit cumbersome. There is a web interface that can make bulk changes easier.


The latest boot firmware version is 1.00.06 dated 10/31/2006 - Dave

The latest software version is 1.00.09 dated 02/26/07. - Dave

Make sure you upload the firmware first, before upgrading the bootloader. Complete instructions here: Upgrade WIP300. - Mark
Is this still true? (I have no idea) - Phil

Firmware download

Detailed fix list here: Firmware Notes

Outstanding Bugs

Bugs here are outstanding with current firmware release. ALL new bugs must be intitially posted as "unconfirmed". If you can validate an unconfirmed bug and you did not create the initial post, please change unconfirmed to "confirmed".

MAJOR bugs are bugs which fall short of documented or described operation and have no workaround. MINOR bugs are like MAJOR, but have a workaround. TWEAK bugs are when the phone operates in a way that is obviously different than one would intuitively expect, but does not hamper the operation. FEATURE REQUESTS are requested new features to improve the phone and are in their own section below.

  • MAJOR (confirmed):(11 Oct 06) Phone does not accept email address or username longer than 15 digits. I cannot check my email because mine is longer than that
    • (Oct 11/06) I am running v. 1.00.07 and am able to connect with a 17 character username and email address. -Dave

  • MAJOR (confirmed): (Jul 2/06) Phone intermittently loses 1-2 packets per second when the phone is in motion which is percieved as a small hiccup in the audio channel. Linksys support confirms this behavior but can make no promise as to a fix. - Stephan
    • (Jul 11/06) The 1.00.07 firmware seems to make a considerable difference in this department though I'm not ready to call this fully resolved. - Stephan

  • MAJOR (confirmed): (Jul 2/06) Phone cannot register with the Linksys SPA-9000 PBX as a shared line, if there is already another subscriber that has the same shared line. The phone remains in "Registering" state even though the PBX lists the device as properly registered. When the WIP300 is the first to register, then everything works out. Linksys support confirms this behavior but there's no fix on the horizon. - Stephan

    • (Jul 5/06) According to RFC3261 section 10.4 the SPA9000s response is proper but the WIP300 cannot handle a proper acknowledgement of the registration if it contains more than one contact element. As such, this could also cause problem when you register with an IPTSP that supports multiple registrations (well, basically that's what the SPA9000 is). - Stephan

    • (Nov 11/06) The problem is still here with the 1.0.8 firmware. - Stephan

  • MAJOR (confirmed): (Jul 2/06) Phone sends incorrect CANCEL messages. If you call someone, then abort the call (without the remote party having picked up), the WIP300 sends a SIP CANCEL message with the SIP address of itself. This violates the rules established in RFC 3261 (section 17.2.3). A CANCEL request must have 6 matching fields, including the request URI.. and the non matching URI is the reason the remote end keeps ringing. A Proxy will properly respond with a 404 not found message and do nothing else, and the WIP300 will not give any indication that the CANCEL message has failed. - Stephan

    • (Sept 14/06) I finally spoke to a person from engineering yesterday. He confirmed that they're working on this, and a solution should be available in the coming months. Let's hope that upcoming firmware is a wonder release as it has already taken way too long. Interestingly, upgrading my SPA9000 V1 to firmware 3.3.6 seems to have done something to the WIP phone as now the CANCEL appears to work. I traced messages on the proxy and indeed, the CANCEL now looks okay. - Stephan

  • MAJOR (confirmed): (Jun 26/06) Can't set TOS/DSCP. There is no way to correctly set the TOS/DSCP seting for RTP or SIP packets. The default is wrong (at least RTP should be EF) - firmware 1.00.06. This means QoS on routers/switches don't know the IP packets are voice. - Andrew

    • 1.00.08 sets the DSCP to EF for voice RTP, but you can't change it. -Andrew

  • MAJOR (confirmed): (Feb27/06) No Configuration Backup or Restore. Datasheet says the phone's configuration can be backed up and restored. This does not seem to be the case unless I'm not seeing something. - Phil

    • I opened a case on this with Linksys. Their answer was: we'll remove that feature from the datasheet. Great way to live up to their promises ;) -Stephan

  • MAJOR (confirmed): (Mar23/06) DTMF intermittency. The phone sometimes does not transmit DTMF when connected to a call. - Osabek
    • (May 8/06) Is this still true? I haven't had a problem with DTMF not working. - Phil
    • (May 8/06) I have found that I have an issue with certain systems. I have 2 clients that after connecting to their systems I cannot dial extenstions. One has an Intertel PBX, not sure about the other one. - Dave
    • (May 117/06) This may be a configuration issue? I have Asterisk set to DTMFmode rfc2833, and it has always worked fine. It would be good to nail this bug description down a bit and make it more specific. - Phil
    • (July 20/06) I've experience similar problems. I've tried all possible DTMF settings. I'm continuing to experience them after 07 upgrade. - mickey

  • MINOR (confirmed): (Sep 14/07) Handsfree microphone doesn't work. I'm not sure which handsfree should I use with the device and tried 2.5mm standard handsfree from blackberry phone. I can hear incoming call and other party, however microphone seems not enabled by default. Mic button also doesn't respond and I can't answer on calls. - Anton
    • (Dec 23/10) Same with my Plantronics headset, which works fine in other phones. - Craig

  • MINOR (confirmed): (Jul 11/06) Display turns into pixel sallad when a button is pushed when the display is off. This only happens since the upgrade from 1.00.06 to 1.00.07. It can be reliably reproduced when making a call, letting the display be turned off, then press the navigator downwards - you get about 0.5 seconds worth of complete random pixels before the display switches to what it's supposed to look like. - Stephan
    • (July 15/06) I'm going to make this bug Minor since it really doesn't impact the functionality of the phone in any significant way. Phil
    • (11 Oct 06) Still with FW 7 this is not as bad as Stephan makes it to be. There will be SOME random pixels on the display but the second the backlight is on you can read the screen with no problem, it just takes .5 second to fully recover however

  • MINOR (confirmed): (April19/06) Phone will not reconnect to access point. While testing how far I could go from my access point (Linksys WRT54G) I found that after going far enough to drop the connection it would not reconnect to the access point. Phone still showed an IP address and SIP thought it was still registered. Ping would not work. Had to reboot phone to connect. The phone did the same thing after laying untouched for several hrs. - Dave
    • (May 4/06) I was just able to walk out of range and then back in range and the phone reaquired the network, although it did take a minute or two. - Phil
    • (May 8/06) Hmm, I would have to say that there are times when the phone won't register and I need to shut it off and back on to get it to work. If I don't the battery can run down quickly and be dead in a few hours. - Phil
    • (May 8/06) After several weeks of use now the phone has only lost its connection twice while laying undisturbed. I still have to reboot about 40% ot the time when coming back into range of my normal AP. - Dave
    • (May 10/06) I've had this phone for one day and so far have had to reboot it at lease a half-dozen times because it lost its connection with my network while lying on the table undisturbed for a while. - Japendra
    • (Oct 11/06) I believe this bug has been fixed in v. 1.00.07, for me at least. Can anyone else confirm or deny so that this can be moved to "Fixed". -Dave

  • TWEAK (unconfirmed): (May03/06) Changing web admin password fails, yet takes effect on next reboot It's very confusing trying to set the admin password to something other than the default. It always 'fails'. Yet, a reboot puts the new password into effect. - Phil

  • TWEAK (unconfirmed): (Feb27/06) Low battery alert is too short, and backlight stays on too long When the battery is low, a chime sounds (which annoyingly sounds like a door bell, imho) and the display shows a very brief 'low battery' message that only lasts about 1 second. The backlight however stays on for the usual duration. It would make more sense, and perhaps save battery, to have the 'low battery' message display longer (say 3 seconds) and the backlight to turn off when the message goes away. - Phil

  • TWEAK (unconfirmed): (May17/06) Battery charge indication seems to be overly optimistic during charging After just a few minutes of charging the battery went from very low (< 5%) to 60%, but adjusted back down to about 10% after being taken off the charger for a quick call, and then back up above 70% when put back on the charger. - Phil

Fixed Bugs

(Move bugs above here as they get resolved to help keep things uncluttered. Please note which firmware release fixed the bug.)

  • MINOR (confirmed): (Mar08/06) Ping tool does not work with IPs. By default, the Ping tool indicates that it is in IP entry mode. But, IPs always generate errors. Pinging a FQDN does work, though (e.g. "") - Phil UPDATE: (April19/06) Ping now working with software ver. 1.00.06. When entering an IP address usie the asterisk key to enter a period. - Dave

  • MAJOR (confirmed): (Feb27/06) Short Battery Life. Advertised stand-by time is 50 hours. Actual seems to be around 12. - Phil UPDATE: (May 4/06) After leaving the phone unplugged overnight, it was down only 20% on it's charge. It seems that this bug has been fixed either in firmware or hardware. - Phil UPDATE: (May 8/06) The phone will last for the advertised 50 hours when it is on standby, but talking on the phone drastically decreases the battery life. - Mark UPDATE: (June26/06) According to Brian, the trouble seemed to be with the batteries shipped with earlier phones. See the comments history for details. - Phil

  • MINOR (confirmed): (May 17/06) NTP support broken. NTP support seems to have broken. It seemed to work in firmware 1.00.00. Currently observed broken in firmware 1.00.06. - Phil NTP Support seems to be fixed in 1.00.07 - Ethan

Detailed fix list for 1.00.06 here: Firmware Notes

Feature Requests

Please, only reasonable requests.

  • FEATURE REQUEST: (Feb27/06) SSID Wildcards AND/OR More Than 6 Configs. Offices may have multiple networks to cover wide areas with serial names (e.g. "WorkNet1, WorkNet2, etc."). Also, it would especially be great to have a last network profile which would attach to the best open network should nothing else be available - Phil

  • FEATURE REQUEST: (Feb27/06) SSL Support for EMail. Some work environments (like mine) only allow unencrypted (non-SSL) access from within the company's firewall. It would be nice to have SSL support and SMTP authentication support so I can check and send email from outside of my work network. - Phil

  • FEATURE REQUEST: (May10/06) SIP URI dialing. Seems you can only enter phone numbers on the address book and phone. You cannot dial a sip URI directly (e.g. ) - mickey

  • FEATURE REQUEST: (Jul 2/07) Phone cannot handle calling a shared line. (Moved from the bugs section) When calling a shared line (or if your IPTSP offers a "simultaneous ring" option), the proxy will respond to the INVITE request by the phone with a "Multiple Choices" message (status 300) and it will list the SIP urls of each party in the contacts element. The WIP300 picks the first one, sends an INVITE to that party and shows "forwarded" on the display. This is correct as far as the SIP RFC is concerned, but being a part of the Linksys VoIP offering (and advertised as such in brochures handed out to customers at VON Europe 2006) I think the WIP phones should at least be able to act the same way as the SPA devices (meaning sending out an INVITE to all contacts, and then send CANCEL messages for all INVITES but the one that was answered with an ACK. - Stephan

  • FEATURE REQUEST: (Oct 31/07) Phone does not have loud-speaker mode. This feature would be handy in a conference environment. - John Ndirangu

  • FEATURE REQUEST: (Oct 31/07) Auto answer functionality . This feature would facilitate paging or intercom usage. Hopefully, this feature would correspond with the hands free functionality that is still not working with latest firmware (mentioned as a bug above!). - John Ndirangu

Undocumented Features

There are a number of menu options which aren't mentioned in the manual. Barring those (which are easily found and used), here are some hidden or unobvious features.

  • Holding down # will lock the keypad
  • Holding down * will go to the ring-mode screen
  • Holding down a digit will dial that speed dial
  • Both uppercase and lowercase alphabet can be entered, key 1 cycles ABCabc.
  • The phone can charge from a regular powered USB port if you purchase the appropriate cable
  • The phone has a web interface. Default username and password are both "admin". There is also a second account "sadmin" with the password "sadmin". Changing the password of the "sadmin" account seems to disable the account, but the "admin" account continues to work.
  • Under Settings you can set SIP or DTMF hold-transfer. This works by being on a call, putting the call on hold, and dialing a new number. If it works, you get two new soft-key options: 'swap' or 'transfer'.
  • The firmware and chipset seem to have some support for a camera, eventhough this model has no camera. Try logging into the web interface and then going to "/html/webcam.html" It doesn't work, of course, but it is interesting to note.
  • You can enter test/debug mode by doing the following: press and hold '1', power on, and then press and hold the right soft-key (while still pressing '1'). This is a self-automated test. Manual testing is the same, but while pressing '2' instead of 1. '3' seems to be some weird wifi broadcast test mode?
  • Some *## codes appear to work with the phone. Specifically:
    • You can turn call-forward-busy on and off with *90 and *91, respectively.
    • Call-forward-no-answer with *92 and *93
    • Call-forward-all with *72 and *73
    • Anonymous call block with *77 and *87 (called "Refuse Private" in the menu)

The White Screen of DEATH!

Some users have experienced the phones freezing. This could be limited to firmware 1.00.00. I've experienced the phone freezing while on a call, while charging, and after short walks between wifi spots.

Often the phone will appear to be off. Pressing power gives a white screen, sometimes with subtle lines or other display artifacts. The only fix seems to be to remove the battery.

Settings can get corrupted, particularly is seems SIP settings. I've had the phone try and try to register after a crash and fail. When entering the profile screen, it shows no sip configurations. Going back to the main screen then changes to 'no SIP settings' or something like that.

Thus far, there doesn't seem to be a common thread as to which phones have this problem and which don't. For reference, my serial number is 6LV005C00024 and my MAC is 0014BFFE6217. If you have this problem too, post your serial and MAC (which is printed in the battery compartment). Maybe there was a run of phones which had bad memory or something.

Building Your Own Firmware

Humm, looks like the open-source release is more current than the 1.00.07 OEM, imho. Mostly it is binary files that differ and they are slightly larger in most/all cases.

Steps I took:

Under Linux Fedora Core 3, I did this: (probably works in many other Linux distros)

  • untared the package
  • untarred the toochain tar in pub
  • in pub, do a 'make config'
  • do a 'make install' in the same place (no, this doesn't install anything on your system. Do it as a user, just to be safe.)

Now, there should be a firmware and boot image present in that directory. Rename to SRPC1_FW_1.00.07.bin and upload in the usual fashion (at your own risk, of course!).

There are three accounts on the phone: user, admin, root. The only account that doesn't use the same password as the name of the account is root. The password for that is "keroro".

To enable telnet, you need to add one line and uncomment three others in etc/rcS: (sorry, I'm too lazy to make a patch :')

around line 67:
if [ ! -f $NVETC_ROOT/passwd ]; then cp -f /etc/passwd $NVETC_ROOT/passwd; fi

then, down below uncomment the telnetd related lines:

# Start the telnet daemon
if [ -f /usr/sbin/telnetd ]; then

This will copy passwd to your phone config directory (if you don't already have one) and fire up the telnet service. Then you can telnet to the phone and log in as, say, 'admin' with pass 'admin'.


Most hacks assume telnet access

  • Create your own web site on the phone. In /nvdata create a directory (say 'web') and put your files in there. Now fire up httpd, e.g. "httpd -p 8080 -h /nvdata/web/" and view in a browser (notice the example has the port set to :8080)

  • Make your own wall paper and ringtones. In short, you can examine the wallpapers (JPEG's) and ringtones (WAV files) and replace the files in the fireware distro and burn your new firmware to the phone. Be careful to try to make your files as identical in spec as those you are replacing (for example, I don't think 44.1k 16bit stereo WAVs will work ;')

Additional Information

Replacement Batteries. Linksys replacement batteries for the WIP300.

Official Linksys WIP300 Downloads page

FCC Filing - Including pictures of internal circuitry

uCLinux - The OS which makes the phone work

Broadcom Mobile VOIP Breif(PDF) - Primer by Broadcom for hardware very much like the WIP-300 - Linksys open source GPL'ed code for the WIP-300

Wistron NeWeb Corp. VoIP Phones - The SRP-81, ODM of the WIP300.

D-LinkDPH-540 - D-Link's flip phone which appears to have the same/similar chipset and firmware.

iPhone - Linksys has released the "iPhone" brand. Amoung the offerings are Skype capable phones. The WIP-300 is now called the "iPhone Wireless-G IP Phone - WIP300"

(This page has been viewed 246248 times)
Created by: edelbrp, Last modification: Thu 23 of Dec, 2010 (09:30 UTC) by craigarno
Please update this page with new information, just login and click on the "Edit" or "Discussion" tab. Get a free login here: Register Thanks! - Find us on Google+