SkyPilot SkyExtender Dual Band

In August 2009, we received some SkyPilot SkyExtender DualBand devices from the City of Portland to evaluate for possible re-use. One of them was dismantled and an investigation ensued. Over the next few months, 11 more SkyExtenders were received from the City of Portland, for a total of 12. More recently, we've been working on getting access to a SkyPilot SkyGateway. A gateway device is required in order to try to use the stock SkyPilot firmware.

Last Spring, SkyPilot was acquired by another company, Trilliant. Since August, the websites were integrated and the SkyPilot forum was taken offline.


We received the SkyExtenders with PowerOverEthernet injectors, Street Light Power Tap cords and mounting hardware intact.

DualBand Exterior Disassembly

From memory, please FIXME next time we have the opportunity to disassemble one.

Disassembed Exterior Components

DualBand Interior Disassembly

Disassembly of the main body proceeds as follows (with approximate times):

Other panhead screws removed:

Disassembled Interior Components


SkyPilot Custom Board

Serial Console

There are two RJ45 connectors accessible under the access plate, connecting to the SkyPilot custom board. One is for the PowerOverEthernet, and the other (pointing perpendicular to the plane of the bezel) is a connector for the serial console. The serial parameters are 38400 bps, 8 data bits, no parity, one stop bit, no flow control. The pinout is as follows (source: Installation Guide page 50):

  1. Not connected (white/orange)
  2. Not connected (orange)
  3. TxD (white/green)
  4. GND (blue)
  5. Not connected (white/blue)
  6. RxD (green)
  7. Not connected (white/brown)
  8. Not connected (brown)

Once restored to factory defaults (see "Password Recovery"), the password should be "public".

Password Recovery

All of the device we have received are from the defunct network abandoned by MetroFi. MetroFi left behind the devices without informing anyone of passwords necessary to access them for administration. According to a helpful person (username: salad) on the SkyPilot forums, the SkyPilot devices can be reset to factory default settings by logging in over the serial console with the password "!!!skypilotfactory!!!" or "!!!skypilotreset!!!" or something similar (when a working one is confirmed, please FIXME, thanks!).

All but one of the five skypilots that have been dismantled so far have been the v2.5 version. The other, labelled v3.1, includes two ethernet connectors and a somewhat different layout. This description is for v2.5. The board is based on the Micrel/Kendin KS8695PI chip (the "I" stands for Industrial, supporting a wider temperature range of operation). It has an ethernet port, a mini-PCI slot, 16 megabytes of Flash storage (on two 8 meg chips) and 32 megabytes of SDRAM.