September 2021 - baseband-devel

SMS not received in mobile - Virtual layer1 (osmo-nitb + osmo-bts + osmocom-bb/mobile)
by Sebastian Stumpf 05 Jun '26

05 Jun '26

Hi, Some of my sent SMS are not received by my mobile and I try to figure out if this is a problem with my virtual layer 1, configuration or something in the layers 2+. I use: osmo-nitb: 1 subscriber in hlr (id 1, ext 017519191919) osmo-bts: virt-phy, arfcn 666, TS0=CCCH+SDCCH4, TS1=SDCCH8 MS layer23 app mobile: is the subscriber from osmo-nitb MS layer1 virt-phy: virtual gsmtap layer between bts and mobile I want: Send a sms to subscriber 017519191919. osmo-nitb VTY: OpenBSC# subscriber id 1 sms sender id 1 send Test I have 2 outcomes, first one is the failure. See https://www.dropbox.com/s/eunpfioq518t09a/mobile--ms-virt--bts-virt--bsc-ni… for the pcap. Do not wonder about the duplicated gsmtap messages from mobile, the ones to ip 225.0.0.1 are over virt-phy layer, the ones to localhost from the gsmtap logging option from mobile. Filter them out via "gsmtap && (ip.dst != 127.0.0.1)". 602-613: RR channel establishment with RA and IA as reaction to paging in 590 627,631: SABM from BTS to establish async balanced mode on SAPI3 (SMS) and the ACK from MS 656,684,699: I-Data frames on SAPI3 containing the sms 660,688,703: ReceiveReady's from MS (That ACK all I-frames before N(R)-1 as far as I understood) For me, that looks good and I really do not understand why the MS will not answer with the CP-ACK/RP-ACK after receiving the SMS Data in 699. The LAPDM link will stay up for some more time and be used by the network for retransmission of the sms (1149), but MS will never react to it on the SMS layer (CP-ACK, RP-ACK). Here is the console log for the mobile (https://www.dropbox.com/s/6gug5cd4up5qv7y/mobile--ms-virt--bts-virt--bsc-ni…) The paging is answered in line 378: Fri Mar 10 10:42:06 2017 DLLAPD <0012> lapd_core.c:793 SABM(E) received in state LAPD_STATE_IDLE Second outcome is a successfully sent sms from network to ms. See https://www.dropbox.com/s/ghdn7pc0j4vifbe/mobile--ms-virt--bts-virt--bsc-ni… for the pcap. What is different here? There is no paging, but the sms is sent within the dedicated channel used for the location update initiated by the phone started up. Why there is another outcome, I don't know. 169-181: RR channel establishment with RA and IA as part of mibiles startup routine to make location update 188,416: Location udpdate procedure on SAPI0 230,234: SABM from BTS to establish async balanced mode on SAPI3 (SMS) and the ACK from MS 396,444: I-Data frames on SAPI3 containing the sms 400,449: RR's from MS 450: CP-ACK for BTS 482,499: RP-ACK I-Frames for Network (osmo-nitb) Again, the console log of the mobile (https://www.dropbox.com/s/cujsn40d43g6wxk/mobile--ms-virt--bts-virt--bsc-ni…) The SABM on SAPI3 on downlink is received in line 206: Fri Mar 10 11:06:13 2017 DLLAPD <0012> lapd_core.c:793 SABM(E) received in state LAPD_STATE_IDLE The signaling looks quite similar in both cases, but one time the mobiles sms handler responds to CP-DATA msg containing the SMS, the other time not. Can someone find an error in the signaling I did not see? Is there a known Bug? To be honest, I last merged my branch with master some time ago (~ Jan 18 2017) and thus did not update osmo-nitb and the libraries since then to avoid compatibility problems. Have there been recent changes that could cause that behavior? Thank you and Kind Regards, Sebastian

4 3

Engagetted !
by Sébastien Lorquet 14 Oct '25

14 Oct '25

http://www.engadget.com/2010/12/29/researchers-eavesdrop-on-encrypted-gsm-c… Congrats!

7 7

Announcement of "OsmoDevCall" on September 24, 2021
by Harald Welte 23 Sep '21

23 Sep '21

Dear Osmocom community, It's my pleasure to announce the next OsmoDevCall at September 24, 2021 at 20:00 CEST at https://meeting4.franken.de/b/har-xbc-bsx-wvs This meeting will have the following schedule: 20:00 meet + greet 20:15 presentation on "ISO 7816 smart card interface FPGA softcore" by tnt 21:00 USSE: unstructured supplementary social event [*] 22:00 close of call Attendance is free of charge and open to anyone with an interest in Osmocom. More information about OsmoDevCall, including the schedule for further upcoming events can be found at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCall Looking forward to meeting you on Friday. Best regards, Harald [*] this is how we started to call the "unstructured" part of osmocom developer conferences in the past, basically where anyone can talk about anything, no formal schedule or structure. -- - Harald Welte <laforge(a)osmocom.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Catching Frequency correction burst
by Mario Lucas 15 Sep '21

15 Sep '21

Dear Forum members i am not sure this question directly relates to Osmocom, but I don’t know where I can post it else …. If you know some active / alive technical forum which relates to GSM side (frequencies, modulations, GMSK etc etc) it would be very great if you could advise me ….. Meanwhile I ll continue with my question…. 51 TDMA multiframe starts with a FCCH which carries frequency correction burst on TS0. Due to nature of GMSK modulation and initial zeros of frequency correction burst the aired signal (signal that GSM modulator emits into air) as I understand is nothing but sine wave of an approximately 67Khz on top of the carrier frequency. Once mobile finds the frequency correction burst on some frequency it subtracts 67 Khz and precisely gets / sits on beacon frequency. So when it is said that upon switching the mobile phone on - it is looking for frequency correction bursts means in different words that it is looking for sine wave in GSM frequency interval it can work. Let’s say if my phone can work only in E-GSM900 interval (925 - 960 Mhz) it is looking for sine wave (frequency correction burst) and once finds it will subtract 67 Khz and it will be precisely the carrier frequency of beacon channel ? So if I use my rtl-sdr and software that analyzes RF spectrum (something like only oscilloscope) in 925 960 Mhz interval and I notice sine waves with periodic occurrence - as many times as FCCH appears in 51 multiframe - can I say that got frequency correction burst and subtracting 67 Khz I got beacon frequency ? -- Mario Lucas

1 0

osmo-bsc default config file time-slot TS0 configuration CCCH+SDCCH4 understanding
by Mario Lucas 11 Sep '21

11 Sep '21

Dear All, Could you please advise me based on what logic (how) can i decompose logical channel configuration CCCH+SDCCH4 which is mapped on TS0… ? So my understanding is as follows: There are 51 TDMA frames in multiframe, therefore i am having 51 consecutive TS0 slots. So CCCH+SDCCH4 should be redistributed in these 51 slots. SDCCH4 means that there are 4 SDCCH blocks, each block is having 4 bursts or 4 timeslots in another words (as i understand to transmit SDCCH «unit data» it is needed 4 burts), so 16 slots are occupied by SDCCH. Does it mean 51-16 = 35 slots to be occupied by CCCH ? If i use following notation CCCH=C, SDCCH1=S1, SDCCH2=S2, SDCCH3=S3 and SDCCH4=S4 does the decomposition looks like: CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC S1S1S1S1 S2S2S2S2 S3S3S3S3 S4S4S4S4 If so should not there be an idle slots … ? Thank you so much. -- Mario Lucas

2 1

PCU socket has LOST connection
by Mario Lucas 05 Sep '21

05 Sep '21

Dear All, I try to run a virtual BTS: systemctl start osmo-stp systemctl start osmo-hlr systemctl start osmo-msc systemctl start osmo-bsc and finally i run osmo-bts-virtual…. but i am getting following outcome: DOML <0001> oml.c:91 OC=GPRS-CELL INST=(00,ff,ff): Sending PCU version report to BSC: PCU socket has LOST connection DPCU <0009> pcu_sock.c:1084 PCU socket connected to external PCU DPCU <0009> pcu_sock.c:967 Received 212 bytes on PCU Socket, but primitive size is 1006, discarding DPCU <0009> pcu_sock.c:895 PCU socket has LOST connection I tried to run osmo-pcu (I thought may be this will resole above issue) but it keeps saying: <000b> gprs_ns.c:322 NSVCI=65534 Creating NS-VC with Signal weight 1, Data weight 1 <000e> telnet_interface.c:104 Available via telnet 127.0.0.1 4240 <0001> osmobts_sock.cpp:224 Opening OsmoPCU L1 interface to OsmoBTS <0001> osmobts_sock.cpp:248 osmo-bts PCU socket /tmp/pcu_bts has been connected <0001> pcu_l1_if.cpp:114 Sending 0.8.0 TXT as PCU_VERSION to BTS PCU interface version number of BTS (10) is different (9). Please re-compile! I have OsmoPCU version 0.8.0 OsmoBTS version 1.2.0.307-6e27 Would you kindly advise whats going on please…. As i understand osmo-pcu is to implement GPRS into my GSM network… ok but if i dont want GPRS implemented thus i dont need PCU …. can i run virtual bts without this PCU things ? pls help ….. -- Mario Lucas

2 1