[BertoldVdb]

Many modern Realtek chips still support RRCP. You just need to enable it. For example for RTL8370N: Register 0x18d6 configures the 16-bit key, 0x18d4 selects which ports can use it (0xFF for all, normally only the cpu port), 0x18d3=0x1 enables it.

You can write these registers via the management interface or via the EEPROM. It will not respond to discovery packets, but get and set packets work fine.

This chip also has a 8051 core that can access the internal bus and can tx/rx network packets. To use it you either attach external SPI flash (large program) or write the program into the internal RAM in the chip (small program).

All documented stuff, no secret details.

[127361]

Thanks for that, I wonder how many switches out there have it enabled inadvertently, because of a mistake by the manufacturer?

By the way, Some of the Broadcom chips have an integrated 8051, with on-chip ROM firmware. There are leaked datasheets floating around somewhere as well. If someone has the time to dump the on-chip ROM, it would be interesting to see what's in there. Note, some of the pins marked NC in the datasheet are in fact the 8051 UART TX/RX lines.