October 2024 - baseband-devel - lists.osmocom.org

SMS not received in mobile - Virtual layer1 (osmo-nitb + osmo-bts + osmocom-bb/mobile)
by Sebastian Stumpf 05 Jun '26

05 Jun '26

Hi, Some of my sent SMS are not received by my mobile and I try to figure out if this is a problem with my virtual layer 1, configuration or something in the layers 2+. I use: osmo-nitb: 1 subscriber in hlr (id 1, ext 017519191919) osmo-bts: virt-phy, arfcn 666, TS0=CCCH+SDCCH4, TS1=SDCCH8 MS layer23 app mobile: is the subscriber from osmo-nitb MS layer1 virt-phy: virtual gsmtap layer between bts and mobile I want: Send a sms to subscriber 017519191919. osmo-nitb VTY: OpenBSC# subscriber id 1 sms sender id 1 send Test I have 2 outcomes, first one is the failure. See https://www.dropbox.com/s/eunpfioq518t09a/mobile--ms-virt--bts-virt--bsc-ni… for the pcap. Do not wonder about the duplicated gsmtap messages from mobile, the ones to ip 225.0.0.1 are over virt-phy layer, the ones to localhost from the gsmtap logging option from mobile. Filter them out via "gsmtap && (ip.dst != 127.0.0.1)". 602-613: RR channel establishment with RA and IA as reaction to paging in 590 627,631: SABM from BTS to establish async balanced mode on SAPI3 (SMS) and the ACK from MS 656,684,699: I-Data frames on SAPI3 containing the sms 660,688,703: ReceiveReady's from MS (That ACK all I-frames before N(R)-1 as far as I understood) For me, that looks good and I really do not understand why the MS will not answer with the CP-ACK/RP-ACK after receiving the SMS Data in 699. The LAPDM link will stay up for some more time and be used by the network for retransmission of the sms (1149), but MS will never react to it on the SMS layer (CP-ACK, RP-ACK). Here is the console log for the mobile (https://www.dropbox.com/s/6gug5cd4up5qv7y/mobile--ms-virt--bts-virt--bsc-ni…) The paging is answered in line 378: Fri Mar 10 10:42:06 2017 DLLAPD <0012> lapd_core.c:793 SABM(E) received in state LAPD_STATE_IDLE Second outcome is a successfully sent sms from network to ms. See https://www.dropbox.com/s/ghdn7pc0j4vifbe/mobile--ms-virt--bts-virt--bsc-ni… for the pcap. What is different here? There is no paging, but the sms is sent within the dedicated channel used for the location update initiated by the phone started up. Why there is another outcome, I don't know. 169-181: RR channel establishment with RA and IA as part of mibiles startup routine to make location update 188,416: Location udpdate procedure on SAPI0 230,234: SABM from BTS to establish async balanced mode on SAPI3 (SMS) and the ACK from MS 396,444: I-Data frames on SAPI3 containing the sms 400,449: RR's from MS 450: CP-ACK for BTS 482,499: RP-ACK I-Frames for Network (osmo-nitb) Again, the console log of the mobile (https://www.dropbox.com/s/cujsn40d43g6wxk/mobile--ms-virt--bts-virt--bsc-ni…) The SABM on SAPI3 on downlink is received in line 206: Fri Mar 10 11:06:13 2017 DLLAPD <0012> lapd_core.c:793 SABM(E) received in state LAPD_STATE_IDLE The signaling looks quite similar in both cases, but one time the mobiles sms handler responds to CP-DATA msg containing the SMS, the other time not. Can someone find an error in the signaling I did not see? Is there a known Bug? To be honest, I last merged my branch with master some time ago (~ Jan 18 2017) and thus did not update osmo-nitb and the libraries since then to avoid compatibility problems. Have there been recent changes that could cause that behavior? Thank you and Kind Regards, Sebastian

4 3

Engagetted !
by Sébastien Lorquet 14 Oct '25

14 Oct '25

http://www.engadget.com/2010/12/29/researchers-eavesdrop-on-encrypted-gsm-c… Congrats!

7 7

Solid Online Nursing Class Course
by vatemiy934＠meogl.com 10 Oct '25

10 Oct '25

https://acemycourse.net/com-fpx-1250-assessment-4-written-communication-com…

3 2

Osmocom bb mobile station cannot register to YateBTS basestation
by nish079858＠gmail.com 02 Oct '24

02 Oct '24

I am having trouble connecting my osmocom bb setup to a conventional basestation setup using the mobile application, and would really appreciate any help in this matter. My basestation is a YateBTS setup setup on radio band DCS1800 with ARFCN 555, and PLMN 001 01 (test network). I am using sysmocom SIMs with PLMN 999 70. I have verified operation of YateBTS by connecting two other phones and am able to get service on them and even do phone calls. For my osmocom bb setup, I have a motorola c115 device in which I load the e88 layer1.highram.bin firmware. The firmware loads correctly and am able to detect the basestation when I run cell_log application. However when I run the mobile application, I seem to be stuck in RR connection pending. Mobile application does see the cell connection and MM connection seems to be active, and is able to read the SIM card correctly also, just doesn't seem to complete the registration. Here are the logs, and config file I used. Really appreciate any help with this. Thanks in advance!! ---------------------------------------osmocon logs------------------------------------------ Synchronize_TDMA =>FB @ FNR 378464 fn_offset=189241 qbits=4920 LOST 1907! L1CTL_NEIGH_PM_REQ new list with 0 entries BAT-ADC: 621 5 0 0 1023 440 0 0 Charger at 43 mV. Battery at 4245 mV. Charging at 0 mA. Battery capacity is 100%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 bat_compal_e88_chg_state=0 BAT-ADC: 622 5 0 0 1023 440 0 0 Charger at 43 mV. Battery at 4252 mV. Charging at 0 mA. Battery capacity is 100%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 bat_compal_e88_chg_state=0 BAT-ADC: 622 5 0 0 1023 453 0 0 Charger at 43 mV. Battery at 4252 mV. Charging at 0 mA. Battery capacity is 100%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 bat_compal_e88_chg_state=0 TOA AVG is not 16 qbits, correcting (got 13) L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=555, flags=0x7) Starting FCCH RecognitionFB0 (192454:2): TOA= 1296, Power= -53dBm, Angle=19720Hz FB0 (192464:8): TOA= 8784, Power= -51dBm, Angle= -598Hz FB1 (192475:9): TOA=10007, Power= -51dBm, Angle= 47Hz fn_offset=192473 (fn=192475 + attempt=9 + ntdma = 7) delay=8 (fn_offset=192473 + 11 - fn=192475 - 1 scheduling next FB/SB detection task with delay 8 =>FB @ FNR 192473 fn_offset=192473 qbits=4844 Synchronize_TDMA LOST 3720! SB1 (384952:1): TOA= 24, Power= -50dBm, Angle= 114Hz => SB 0x019c4808: BSIC=2 fn=192485(145/ 7/11) qbits=4 Synchronize_TDMA =>FB @ FNR 384951 fn_offset=192485 qbits=4912 LOST 1904! L1CTL_PARAM_REQ (ta=0, tx_power=0) L1CTL_RACH_REQ (ra=0x0a, offset=26, combined=1, uic=0xff) L1CTL_PARAM_REQ (ta=0, tx_power=0) L1CTL_RACH_REQ (ra=0x07, offset=143, combined=1, uic=0xff) L1CTL_PARAM_REQ (ta=0, tx_power=0) L1CTL_RACH_REQ (ra=0x0d, offset=118, combined=1, uic=0xff) BAT-ADC: 622 5 0 0 1023 440 0 0 Charger at 43 mV. Battery at 4252 mV. Charging at 0 mA. Battery capacity is 100%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 bat_compal_e88_chg_state=0 TOA AVG is not 16 qbits, correcting (got 17) L1CTL_DM_REL_REQL1CTL_RESET_REQ: FULL!L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=555, flags=0x7) Starting FCCH RecognitionFB0 (194158:8): TOA= 8784, Power= -52dBm, Angle=19720Hz FB0 (194168:8): TOA= 8784, Power= -50dBm, Angle= -530Hz FB1 (194178:8): TOA= 8755, Power= -50dBm, Angle= 6Hz fn_offset=194176 (fn=194178 + attempt=8 + ntdma = 6) delay=8 (fn_offset=194176 + 11 - fn=194178 - 1 scheduling next FB/SB detection task with delay 8 =>FB @ FNR 194176 fn_offset=194176 qbits=4836 Synchronize_TDMA LOST 3716! SB1 (388359:1): TOA= 26, Power= -50dBm, Angle= 77Hz => SB 0x01514908: BSIC=2 fn=194188(146/20/31) qbits=12 Synchronize_TDMA =>FB @ FNR 388358 fn_offset=194188 qbits=4920 LOST 1908! L1CTL_NEIGH_PM_REQ new list with 0 entries ---------------------------------------mobile application logs------------------------------------------ Copyright (C) 2010-2015 Andreas Eversberg, Sylvain Munaut, Holger Freyther, Harald Welte Contributions by Alex Badea, Pablo Neira, Steve Markgraf and others License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. <0013> app_mobile.c:305 Mobile '1' initialized, please start phone now! <001d> telnet_interface.c:88 Available via telnet 127.0.0.1 4247 <0011> sim.c:1091 selected file (len 10) <0011> sim.c:1091 selected file (len 9) <0011> sim.c:1091 selected file (len 11) <0011> sim.c:1091 selected file (len 14) <0011> sim.c:1091 selected file (len 9) <0011> sim.c:1091 selected file (len 60) <0011> sim.c:1091 selected file (len 1) <0011> sim.c:1091 selected file (len 17) <0005> subscriber.c:1194 SIM reading failed, file invalid <0011> sim.c:1091 selected file (len 2) <0011> sim.c:1091 selected file (len 12) <0011> sim.c:1086 selected record (len 34 structure 1) <0011> sim.c:1086 selected record (len 52 structure 1) <0001> gsm48_rr.c:2796 Changing CCCH_MODE to 2 <0001> sysinfo.c:848 Now updating previously received SYSTEM INFORMATION 4 ---------------------------------------``VTY interface``------------------------------------------ Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Welcome to the OsmocomBB(mobile) VTY interface OsmocomBB(mobile)> % (MS 1) % Trying to register with network Test, Test... OsmocomBB(mobile)> show ms 1 MS '1' is up, MM connection active IMEI: 355609009915009 IMEISV: 3556090099150090 IMEI generation: fixed automatic network selection state: A1 trying RPLMN MCC=001 MNC=01 (Test, Test) cell selection state: connected mode 1 ARFCN=555(DCS) CGI=001-01-1000-10 (Test, Test) radio resource layer state: connection pending mobility management layer state: wait for RR connection (location updating) OsmocomBB(mobile)> % (MS 1) % Trying to register with network Test, Test... OsmocomBB(mobile)> show subs 1 Mobile Subscriber of MS '1': IMSI: 999700000085749 ICCID: 8988211000000857493 SMS Service Center Address: 3548900076 Status: U1_UPDATED IMSI detached TMSI 0x007b0009 LAI: 001-01-1000 (Test, Test) GPRS Status: GU2_NOT_UPDATED IMSI detached PTMSI-sig 0xffffff RAI: invalid Registered PLMN: MCC-MNC 001-01 (Test, Test) Access barred cells: no Access classes: C9 List of preferred PLMNs: MCC |MNC -------+------- 000 |00 (Marshall Islands, 00) OsmocomBB(mobile)> % (MS 1) % Trying to register with network Test, Test... OsmocomBB(mobile)> show cell 1 ARFCN |MCC |MNC |LAC |cell ID|forb.LA|prio |min-db |max-pwr|rx-lev -------+-------+-------+-------+-------+-------+-------+-------+-------+------- 555DCS|001 |01 |0x03e8 |0x000a |no |normal |-110 | 0 |-54 OsmocomBB(mobile)> % (MS 1) % Trying to register with network Test, Test... % (MS 1) % Trying to register with network Test, Test... % (MS 1) % Trying to register with network Test, Test... % (MS 1) % Trying to register with network Test, Test... ---------------------------------------``config file``------------------------------------------ ! ! OsmocomBB(mobile) (0.0.0) configuration saved from vty !! ! log stderr blocking-io logging filter all 1 logging color 1 logging print category-hex 1 logging print category 0 logging print thread-id 0 logging timestamp 0 logging print file 1 logging level rsl notice logging level rr notice logging level plmn notice logging level cs notice logging level nb notice logging level mm notice logging level cc notice logging level gcc notice logging level bcc notice logging level ss notice logging level sms notice logging level mncc notice logging level meas notice logging level pag notice logging level l1c notice logging level sap notice logging level sum notice logging level sim notice logging level gps notice logging level mob notice logging level prim notice logging level lua debug logging level gapk debug logging level tun notice logging level rlcmac notice logging level llc notice logging level sndcp notice logging level gmm notice logging level sm notice logging level lglobal notice logging level llapd notice logging level linp notice logging level lmux notice logging level lmi notice logging level lmib notice logging level lsms notice logging level lctrl notice logging level lgtp notice logging level lstats notice logging level lgsup notice logging level loap notice logging level lss7 notice logging level lsccp notice logging level lsua notice logging level lm3ua notice logging level lmgcp notice logging level ljibuf notice logging level lrspro notice logging level lns notice logging level lbssgp notice logging level lnsdata notice logging level lnssignal notice logging level liuup notice logging level lpfcp notice logging level lcsn1 notice logging level lio notice ! stats interval 5 ! line vty no login ! gps device /dev/ttyACM0 gps baudrate default no gps enable ! no hide-default ! ms 1 layer2-socket /tmp/osmocom_l2 imei 355609009915009 0 imei-fixed sim reader test-sim imsi 999700000085749 ki comp128 12 34 56 78 9a bc de f0 12 34 56 78 9a bc de f0 no barred-access no rplmn hplmn-search foreign-country no locigprs sap-socket /tmp/osmocom_sap mncc-socket /tmp/ms_mncc_1 mncc-handler internal network-selection-mode auto no emergency-imsi no sms-service-center no call-waiting no auto-answer no force-rekey no clip no clir tx-power auto no simulated-delay no stick location-updating neighbour-measurement codec full-speed prefer codec half-speed no abbrev support sms a5/1 a5/2 p-gsm e-gsm r-gsm gsm-850 dcs no pcs class-900 4 class-850 4 class-dcs 1 class-pcs 1 channel-capability sdcch+tchf+tchh full-speech-v1 full-speech-v2 half-speech-v1 full-data-14400 full-data-9600 full-data-4800 half-data-4800 full-data-2400 half-data-2400 min-rxlev -106 dsc-max 90 no skip-max-per-band vgcs vbs c7-any-timeout 30 uplink-release-local no asci-allow-any tch-voice io-handler none tch-data io-handler none io-tch-format osmo no shutdown ! gsmtap no remote-host no local-host

1 0