HTTP web UI

The switch’s own web interface, driven the way a browser drives it: log in, fetch a page, parse it, and post the form the page would have posted. Available on every model in this fleet except the two unverified SNMP-only entries.

Sometimes it is the only reachable interface — through a firewall that permits nothing else — and on Plus switches it is the only route to PoE control, which NSDP has no tag for.

Switches that speak it

Model	Product	Class	Ports	Reached over
m4300-24x	M4300-24X (XSM4324CS)	fully managed	28	HTTP
m4300-16x	M4300-16X (XSM4316)	fully managed	16	HTTP
gsm7252ps	GSM7252PS	fully managed	52	HTTP
gsm7228ps	GSM7228PS (S3300)	smart managed pro	52	HTTP
gs110emx	GS110EMX	plus	10	HTTP
gs305ep	GS305EP	plus	5	HTTP
gs728tpp	GS728TPP	smart managed pro	28	HTTP
gs105pe	GS105PE	plus	5	HTTP

What it can do, per switch

Web UIs vary enormously: a — below means that model’s firmware ships no page carrying the data, which is a real limit of the interface rather than a missing implementation here.

Operation	m4300-24x	m4300-16x	gsm7252ps	gsm7228ps	gs110emx	gs305ep	gs728tpp	gs105pe
get_ports()	✓	✓	✓	✓	✓	✓	✓	✓
get_stats()	✓	✓	✓	✓	✓	✓	— [HTTP-1]	✓
get_vlans()	✓	✓	✓	✓	✓	✓	✓	✓
get_pvids()	✓	✓	✓	✓	✓	✓	✓	✓
get_lldp()	✓	✓	✓	✓	— [HTTP-2]	— [HTTP-3]	✓	— [HTTP-4]
get_macs()	✓	✓	✓	✓	— [HTTP-5]	— [HTTP-6]	✓	— [HTTP-7]
get_poe()	— [HTTP-8]	✓	✓	✓	— [HTTP-9]	✓	✓	— [HTTP-10]
get_sensors()	✓	✓	✓	— [HTTP-11]	— [HTTP-12]	— [HTTP-13]	✓	— [HTTP-14]
get_mgmt_ip()	✓	✓	✓	✓	✓	— [HTTP-15]	✓	✓
get_hostname()	— [HTTP-16]	— [HTTP-17]	— [HTTP-18]	— [HTTP-19]	✓	— [HTTP-20]	✓	✓
get_users()	✓	✓	✓	— [HTTP-21]	— [HTTP-22]	— [HTTP-23]	— [HTTP-24]	— [HTTP-25]
get_services()	✓	✓	✓	— [HTTP-26]	— [HTTP-27]	— [HTTP-28]	— [HTTP-29]	— [HTTP-30]
get_syslog()	✓	✓	✓	✓	— [HTTP-31]	— [HTTP-32]	— [HTTP-33]	— [HTTP-34]
nsdp_device()	— [HTTP-35]	— [HTTP-35]	— [HTTP-35]	— [HTTP-35]	— [HTTP-35]	— [HTTP-35]	— [HTTP-35]	— [HTTP-35]
set_port_enabled()	✓	✓	✓	✓	✓	— [HTTP-36]	✓	— [HTTP-37]
set_poe()	— [HTTP-38]	✓	✓	✓	— [HTTP-39]	✓	✓	— [HTTP-40]
cycle_poe()	— [HTTP-41]	✓	✓	✓	— [HTTP-42]	✓	✓	— [HTTP-43]
clear_poe_fault()	— [HTTP-44]	✓	✓	✓	— [HTTP-45]	✓	✓	— [HTTP-46]
set_port_description()	— [HTTP-47]	— [HTTP-48]	— [HTTP-49]	— [HTTP-50]	— [HTTP-51]	— [HTTP-52]	✓	— [HTTP-53]
set_port_speed()	— [HTTP-54]	— [HTTP-55]	— [HTTP-56]	— [HTTP-57]	— [HTTP-58]	— [HTTP-59]	✓	— [HTTP-60]
set_flow_control()	— [HTTP-61]	— [HTTP-61]	— [HTTP-61]	— [HTTP-61]	— [HTTP-61]	— [HTTP-61]	— [HTTP-61]	— [HTTP-61]
set_pvid()	✓	✓	✓	✓	✓	✓	✓	✓
set_vlan_membership()	✓	✓	✓	✓	✓	✓	✓	✓
create_vlan()	— [HTTP-62]	— [HTTP-63]	— [HTTP-64]	— [HTTP-65]	— [HTTP-66]	✓	✓	✓
delete_vlan()	— [HTTP-67]	— [HTTP-68]	— [HTTP-69]	— [HTTP-70]	— [HTTP-71]	✓	✓	✓
set_mgmt_ip()	✓	✓	✓	✓	— [HTTP-72]	— [HTTP-73]	— [HTTP-74]	— [HTTP-75]
set_hostname()	— [HTTP-76]	— [HTTP-77]	— [HTTP-78]	— [HTTP-79]	✓	— [HTTP-80]	✓	— [HTTP-81]
set_syslog_enabled()	— [HTTP-82]	— [HTTP-82]	— [HTTP-82]	— [HTTP-82]	— [HTTP-82]	— [HTTP-82]	— [HTTP-82]	— [HTTP-82]
add_syslog_collector()	— [HTTP-83]	— [HTTP-83]	— [HTTP-83]	— [HTTP-83]	— [HTTP-83]	— [HTTP-83]	— [HTTP-83]	— [HTTP-83]
remove_syslog_collector()	✓	✓	— [HTTP-84]	— [HTTP-85]	— [HTTP-86]	— [HTTP-87]	— [HTTP-88]	— [HTTP-89]
upload_certificate()	— [HTTP-90]	— [HTTP-90]	— [HTTP-91]	✓	— [HTTP-92]	— [HTTP-93]	✓	— [HTTP-94]
upload_certificate_scp()	— [HTTP-95]	— [HTTP-95]	— [HTTP-95]	— [HTTP-95]	— [HTTP-95]	— [HTTP-95]	— [HTTP-95]	— [HTTP-95]

[HTTP-1]

model ‘gs728tpp’ web UI has no page for get_stats (Per-port octet/packet counters)

[HTTP-2]

model ‘gs110emx’ web UI has no page for get_lldp (LLDP neighbour table)

[HTTP-3]

model ‘gs305ep’ web UI has no page for get_lldp (LLDP neighbour table)

[HTTP-4]

model ‘gs105pe’ web UI has no page for get_lldp (LLDP neighbour table)

[HTTP-5]

model ‘gs110emx’ web UI has no page for get_macs (MAC/FDB forwarding table)

[HTTP-6]

model ‘gs305ep’ web UI has no page for get_macs (MAC/FDB forwarding table)

[HTTP-7]

model ‘gs105pe’ web UI has no page for get_macs (MAC/FDB forwarding table)

[HTTP-8]

model ‘m4300-24x’ web UI has no page for get_poe (Per-port PoE status and power draw)

[HTTP-9]

model ‘gs110emx’ web UI has no page for get_poe (Per-port PoE status and power draw)

[HTTP-10]

model ‘gs105pe’ web UI has no page for get_poe (Per-port PoE status and power draw)

[HTTP-11]

model ‘gsm7228ps’ web UI has no page for get_sensors (Fan/PSU/temperature sensors)

[HTTP-12]

model ‘gs110emx’ web UI has no page for get_sensors (Fan/PSU/temperature sensors)

[HTTP-13]

model ‘gs305ep’ web UI has no page for get_sensors (Fan/PSU/temperature sensors)

[HTTP-14]

model ‘gs105pe’ web UI has no page for get_sensors (Fan/PSU/temperature sensors)

[HTTP-15]

model ‘gs305ep’ web UI has no page for get_mgmt_ip (Management IP configuration)

[HTTP-16]

model ‘m4300-24x’ web UI has no page for get_hostname (The switch’s host name)

[HTTP-17]

model ‘m4300-16x’ web UI has no page for get_hostname (The switch’s host name)

[HTTP-18]

model ‘gsm7252ps’ web UI has no page for get_hostname (The switch’s host name)

[HTTP-19]

model ‘gsm7228ps’ web UI has no page for get_hostname (The switch’s host name)

[HTTP-20]

model ‘gs305ep’ web UI has no page for get_hostname (The switch’s host name)

[HTTP-21]

model ‘gsm7228ps’ web UI has no page for get_users (Local login accounts and their access level)

[HTTP-22]

model ‘gs110emx’ web UI has no page for get_users (Local login accounts and their access level)

[HTTP-23]

model ‘gs305ep’ web UI has no page for get_users (Local login accounts and their access level)

[HTTP-24]

model ‘gs728tpp’ web UI has no page for get_users (Local login accounts and their access level)

[HTTP-25]

model ‘gs105pe’ web UI has no page for get_users (Local login accounts and their access level)

[HTTP-26]

model ‘gsm7228ps’ web UI has no page for get_services (Which management services (http/https/telnet/ssh) are enabled)

[HTTP-27]

model ‘gs110emx’ web UI has no page for get_services (Which management services (http/https/telnet/ssh) are enabled)

[HTTP-28]

model ‘gs305ep’ web UI has no page for get_services (Which management services (http/https/telnet/ssh) are enabled)

[HTTP-29]

model ‘gs728tpp’ web UI has no page for get_services (Which management services (http/https/telnet/ssh) are enabled)

[HTTP-30]

model ‘gs105pe’ web UI has no page for get_services (Which management services (http/https/telnet/ssh) are enabled)

[HTTP-31]

model ‘gs110emx’ web UI has no page for get_syslog (Remote-logging configuration and collectors)

[HTTP-32]

model ‘gs305ep’ web UI has no page for get_syslog (Remote-logging configuration and collectors)

[HTTP-33]

model ‘gs728tpp’ web UI has no page for get_syslog (Remote-logging configuration and collectors)

[HTTP-34]

model ‘gs105pe’ web UI has no page for get_syslog (Remote-logging configuration and collectors)

[HTTP-35] (1,2,3,4,5,6,7,8)

nsdp_device is served only over NSDP

[HTTP-36]

model ‘gs305ep’ web UI has no page for set_port_enabled (Bring a port up or down)

[HTTP-37]

model ‘gs105pe’ web UI has no page for set_port_enabled (Bring a port up or down)

[HTTP-38]

model ‘m4300-24x’ web UI has no page for set_poe (Enable or disable PoE on a port)

[HTTP-39]

model ‘gs110emx’ web UI has no page for set_poe (Enable or disable PoE on a port)

[HTTP-40]

model ‘gs105pe’ web UI has no page for set_poe (Enable or disable PoE on a port)

[HTTP-41]

model ‘m4300-24x’ web UI has no page for cycle_poe (Power-cycle a PoE port)

[HTTP-42]

model ‘gs110emx’ web UI has no page for cycle_poe (Power-cycle a PoE port)

[HTTP-43]

model ‘gs105pe’ web UI has no page for cycle_poe (Power-cycle a PoE port)

[HTTP-44]

model ‘m4300-24x’ web UI has no page for clear_poe_fault (Clear a latched PoE fault)

[HTTP-45]

model ‘gs110emx’ web UI has no page for clear_poe_fault (Clear a latched PoE fault)

[HTTP-46]

model ‘gs105pe’ web UI has no page for clear_poe_fault (Clear a latched PoE fault)

[HTTP-47]

model ‘m4300-24x’ web UI has no page for set_port_description (Set or clear a port’s description)

[HTTP-48]

model ‘m4300-16x’ web UI has no page for set_port_description (Set or clear a port’s description)

[HTTP-49]

model ‘gsm7252ps’ web UI has no page for set_port_description (Set or clear a port’s description)

[HTTP-50]

model ‘gsm7228ps’ web UI has no page for set_port_description (Set or clear a port’s description)

[HTTP-51]

model ‘gs110emx’ web UI has no page for set_port_description (Set or clear a port’s description)

[HTTP-52]

model ‘gs305ep’ web UI has no page for set_port_description (Set or clear a port’s description)

[HTTP-53]

model ‘gs105pe’ web UI has no page for set_port_description (Set or clear a port’s description)

[HTTP-54]

model ‘m4300-24x’ web UI has no page for set_port_speed (Force a port’s speed/duplex, or restore auto-negotiation)

[HTTP-55]

model ‘m4300-16x’ web UI has no page for set_port_speed (Force a port’s speed/duplex, or restore auto-negotiation)

[HTTP-56]

model ‘gsm7252ps’ web UI has no page for set_port_speed (Force a port’s speed/duplex, or restore auto-negotiation)

[HTTP-57]

model ‘gsm7228ps’ web UI has no page for set_port_speed (Force a port’s speed/duplex, or restore auto-negotiation)

[HTTP-58]

model ‘gs110emx’ web UI has no page for set_port_speed (Force a port’s speed/duplex, or restore auto-negotiation)

[HTTP-59]

model ‘gs305ep’ web UI has no page for set_port_speed (Force a port’s speed/duplex, or restore auto-negotiation)

[HTTP-60]

model ‘gs105pe’ web UI has no page for set_port_speed (Force a port’s speed/duplex, or restore auto-negotiation)

[HTTP-61] (1,2,3,4,5,6,7,8)

set_flow_control is served only over CONSOLE, SSH, TELNET

[HTTP-62]

model ‘m4300-24x’ web UI carries no CSRF ‘hash’ token, which the HTTP create_vlan writer requires

[HTTP-63]

model ‘m4300-16x’ web UI carries no CSRF ‘hash’ token, which the HTTP create_vlan writer requires

[HTTP-64]

model ‘gsm7252ps’ web UI carries no CSRF ‘hash’ token, which the HTTP create_vlan writer requires

[HTTP-65]

model ‘gsm7228ps’ web UI carries no CSRF ‘hash’ token, which the HTTP create_vlan writer requires

[HTTP-66]

model ‘gs110emx’ web UI carries no CSRF ‘hash’ token, which the HTTP create_vlan writer requires

[HTTP-67]

model ‘m4300-24x’ web UI carries no CSRF ‘hash’ token, which the HTTP delete_vlan writer requires

[HTTP-68]

model ‘m4300-16x’ web UI carries no CSRF ‘hash’ token, which the HTTP delete_vlan writer requires

[HTTP-69]

model ‘gsm7252ps’ web UI carries no CSRF ‘hash’ token, which the HTTP delete_vlan writer requires

[HTTP-70]

model ‘gsm7228ps’ web UI carries no CSRF ‘hash’ token, which the HTTP delete_vlan writer requires

[HTTP-71]

model ‘gs110emx’ web UI carries no CSRF ‘hash’ token, which the HTTP delete_vlan writer requires

[HTTP-72]

model ‘gs110emx’ web UI has no page for set_mgmt_ip (Set the management IP/mask/gateway)

[HTTP-73]

model ‘gs305ep’ web UI has no page for set_mgmt_ip (Set the management IP/mask/gateway)

[HTTP-74]

model ‘gs728tpp’ web UI has no page for set_mgmt_ip (Set the management IP/mask/gateway)

[HTTP-75]

model ‘gs105pe’ web UI has no page for set_mgmt_ip (Set the management IP/mask/gateway)

[HTTP-76]

model ‘m4300-24x’ web UI has no page for set_hostname (Set the switch’s host name)

[HTTP-77]

model ‘m4300-16x’ web UI has no page for set_hostname (Set the switch’s host name)

[HTTP-78]

model ‘gsm7252ps’ web UI has no page for set_hostname (Set the switch’s host name)

[HTTP-79]

model ‘gsm7228ps’ web UI has no page for set_hostname (Set the switch’s host name)

[HTTP-80]

model ‘gs305ep’ web UI has no page for set_hostname (Set the switch’s host name)

[HTTP-81]

model ‘gs105pe’ web UI has no page for set_hostname (Set the switch’s host name)

[HTTP-82] (1,2,3,4,5,6,7,8)

set_syslog_enabled is served only over CONSOLE, SNMP, SSH, TELNET

[HTTP-83] (1,2,3,4,5,6,7,8)

add_syslog_collector is served only over CONSOLE, SSH, TELNET

[HTTP-84]

model ‘gsm7252ps’ web UI has no page for remove_syslog_collector (Remove a remote syslog collector)

[HTTP-85]

model ‘gsm7228ps’ web UI has no page for remove_syslog_collector (Remove a remote syslog collector)

[HTTP-86]

model ‘gs110emx’ web UI has no page for remove_syslog_collector (Remove a remote syslog collector)

[HTTP-87]

model ‘gs305ep’ web UI has no page for remove_syslog_collector (Remove a remote syslog collector)

[HTTP-88]

model ‘gs728tpp’ web UI has no page for remove_syslog_collector (Remove a remote syslog collector)

[HTTP-89]

model ‘gs105pe’ web UI has no page for remove_syslog_collector (Remove a remote syslog collector)

[HTTP-90] (1,2)

this model takes a certificate by SCP file-copy to the switch (FastpathScpUpdater), not over the web UI – use upload_certificate_scp

[HTTP-91]

this model takes a certificate by SCP file-copy to the switch (copy scp://), not over the web UI – use upload_certificate_scp

[HTTP-92]

model ‘gs110emx’ web UI has no page for upload_certificate (Upload an HTTPS certificate over the web UI)

[HTTP-93]

model ‘gs305ep’ web UI has no page for upload_certificate (Upload an HTTPS certificate over the web UI)

[HTTP-94]

model ‘gs105pe’ web UI has no page for upload_certificate (Upload an HTTPS certificate over the web UI)

[HTTP-95] (1,2,3,4,5,6,7,8)

upload_certificate_scp is served only over CONSOLE, SSH, TELNET

Five web-UI protocols, not one

Netgear has no single web UI. Five distinct login schemes run across this fleet, each paired with its own HTML dialect, and they share a transport and almost nothing else — different credential handling, different session mechanics, different page sets. Each gets its own page:

Login scheme	Switches	HTML dialect	Reached over
MERGE_HASH_CGI	gs305ep, gs105pe	GS105PE, STANDARD	HTTP
GAMBIT	gs110emx	GS110EMX	HTTP
CHEETAH_FORM	gsm7228ps, gsm7252ps	S3300, XE_FASTPATH	HTTP
CHEETAH_V1	m4300-24x, m4300-16x	M4300	HTTP
XML_API	gs728tpp	GOAHEAD_XML	HTTP

• MERGE_HASH_CGI — the Plus web UI
• GAMBIT — merge-hash with a token
• CHEETAH_FORM — the Cheetah login form
• CHEETAH_V1 — the M4300 /v1 UI
• XML_API — the GoAhead wcd interface

Everything below this point holds for all five.

Endpoint specs

Every model’s page set is one HttpModelSpec record: the login path and field names, and a path per operation — dashboard, statistics, PoE status and config, VLAN config and membership, PVIDs, MAC table, LLDP, system info, management IP, port config, certificate upload, reboot, logout.

A None path means this firmware ships no such page, and the reader raises rather than inventing data. That is precisely what the Support matrix gaps table reports. A page that exists but has not been found yet looks identical from here — which is why those entries are treated as work rather than as facts about the hardware.

Non-standard transport details are in the spec too: the M4300-16X’s web UI is on HTTPS port 49152, and its spec carries both.

Reads are gated on verification

HttpModelSpec.reads_verified records whether a model’s web reads have been cross-verified against live hardware. While it is False the facade refuses to dispatch HTTP for reads and writes: output nobody has checked is worse than no output. Certificate upload is the one deliberate exception — a grounded write flow that does not depend on read verification.

Gotchas

The switch answers with a login page instead of the page you asked for. HttpUnexpectedPageError almost always means the session went away.

Logins start failing under frequent polling. Where a spec has no logout_path, sessions are left to expire on their own, and a switch with a small session table can refuse new logins until they do.

Errors arrive with HTTP 200. On the FASTPATH XUI dialects a failed write reports itself in hidden err_flag / err_msg fields while the response code stays 200, so a write that “succeeded” by status code may not have — see CHEETAH_FORM — the Cheetah login form.

A write is refused in a way that looks like a device limitation. Web-UI writes replay the whole form, including hidden and list-navigation fields, and the firmware rejects an incomplete one — which is all “the GSM7252PS refuses PoE writes” ever was: one absent list-unit field.

API

• netgear_switch.http_read — HttpReader, AsyncHttpReader.

• netgear_switch.http_write — HttpWriter, AsyncHttpWriter, and the certificate-upload flows.

• netgear_switch.protocols.http.endpoints — every model’s spec, with the capture that grounds it named in comments.

• netgear_switch.protocols.http.parse — the per-dialect parsers.

• netgear_switch.protocols.http.forms — form scraping and replay.

• netgear_switch.protocols.http.crypt — the login hash transforms.