August 2024 - baseband-devel - lists.osmocom.org

SMS not received in mobile - Virtual layer1 (osmo-nitb + osmo-bts + osmocom-bb/mobile)
by Sebastian Stumpf 05 Jun '26

05 Jun '26

Hi, Some of my sent SMS are not received by my mobile and I try to figure out if this is a problem with my virtual layer 1, configuration or something in the layers 2+. I use: osmo-nitb: 1 subscriber in hlr (id 1, ext 017519191919) osmo-bts: virt-phy, arfcn 666, TS0=CCCH+SDCCH4, TS1=SDCCH8 MS layer23 app mobile: is the subscriber from osmo-nitb MS layer1 virt-phy: virtual gsmtap layer between bts and mobile I want: Send a sms to subscriber 017519191919. osmo-nitb VTY: OpenBSC# subscriber id 1 sms sender id 1 send Test I have 2 outcomes, first one is the failure. See https://www.dropbox.com/s/eunpfioq518t09a/mobile--ms-virt--bts-virt--bsc-ni… for the pcap. Do not wonder about the duplicated gsmtap messages from mobile, the ones to ip 225.0.0.1 are over virt-phy layer, the ones to localhost from the gsmtap logging option from mobile. Filter them out via "gsmtap && (ip.dst != 127.0.0.1)". 602-613: RR channel establishment with RA and IA as reaction to paging in 590 627,631: SABM from BTS to establish async balanced mode on SAPI3 (SMS) and the ACK from MS 656,684,699: I-Data frames on SAPI3 containing the sms 660,688,703: ReceiveReady's from MS (That ACK all I-frames before N(R)-1 as far as I understood) For me, that looks good and I really do not understand why the MS will not answer with the CP-ACK/RP-ACK after receiving the SMS Data in 699. The LAPDM link will stay up for some more time and be used by the network for retransmission of the sms (1149), but MS will never react to it on the SMS layer (CP-ACK, RP-ACK). Here is the console log for the mobile (https://www.dropbox.com/s/6gug5cd4up5qv7y/mobile--ms-virt--bts-virt--bsc-ni…) The paging is answered in line 378: Fri Mar 10 10:42:06 2017 DLLAPD <0012> lapd_core.c:793 SABM(E) received in state LAPD_STATE_IDLE Second outcome is a successfully sent sms from network to ms. See https://www.dropbox.com/s/ghdn7pc0j4vifbe/mobile--ms-virt--bts-virt--bsc-ni… for the pcap. What is different here? There is no paging, but the sms is sent within the dedicated channel used for the location update initiated by the phone started up. Why there is another outcome, I don't know. 169-181: RR channel establishment with RA and IA as part of mibiles startup routine to make location update 188,416: Location udpdate procedure on SAPI0 230,234: SABM from BTS to establish async balanced mode on SAPI3 (SMS) and the ACK from MS 396,444: I-Data frames on SAPI3 containing the sms 400,449: RR's from MS 450: CP-ACK for BTS 482,499: RP-ACK I-Frames for Network (osmo-nitb) Again, the console log of the mobile (https://www.dropbox.com/s/cujsn40d43g6wxk/mobile--ms-virt--bts-virt--bsc-ni…) The SABM on SAPI3 on downlink is received in line 206: Fri Mar 10 11:06:13 2017 DLLAPD <0012> lapd_core.c:793 SABM(E) received in state LAPD_STATE_IDLE The signaling looks quite similar in both cases, but one time the mobiles sms handler responds to CP-DATA msg containing the SMS, the other time not. Can someone find an error in the signaling I did not see? Is there a known Bug? To be honest, I last merged my branch with master some time ago (~ Jan 18 2017) and thus did not update osmo-nitb and the libraries since then to avoid compatibility problems. Have there been recent changes that could cause that behavior? Thank you and Kind Regards, Sebastian

4 3

Engagetted !
by Sébastien Lorquet 14 Oct '25

14 Oct '25

http://www.engadget.com/2010/12/29/researchers-eavesdrop-on-encrypted-gsm-c… Congrats!

7 7

Solid Online Nursing Class Course
by vatemiy934＠meogl.com 10 Oct '25

10 Oct '25

https://acemycourse.net/com-fpx-1250-assessment-4-written-communication-com…

3 2

mobile.cfg
by daniollama＠gmail.com 19 Aug '24

19 Aug '24

I use a mobile configuration but it seems not working. the mobile.cfg shown below ! ! OsmocomBB example configuration for mobile application !! ! line vty no login ! gps device /dev/ttyACM0 gps baudrate default no gps enable ! no hide-default ! ms 1 layer2-socket /tmp/osmocom_l2 sap-socket /tmp/osmocom_sap stick 1 sim none network-selection-mode auto imei 000000000000000 0 imei-fixed no emergency-imsi no sms-service-center no call-waiting no auto-answer no force-rekey no clip no clir tx-power auto no simulated-delay location-updating neighbour-measurement codec full-speed prefer codec half-speed no abbrev support sms a5/1 a5/2 p-gsm e-gsm r-gsm gsm-850 dcs no pcs class-900 4 class-850 4 class-dcs 1 class-pcs 1 channel-capability sdcch+tchf+tchh full-speech-v1 full-speech-v2 half-speech-v1 min-rxlev -110 dsc-max 90 no skip-max-per-band test-sim imsi 001010402698197 ki comp128 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 no barred-access rplmn 001 01 ! io-format ti no shutdown can you give me a config that working. thank you

2 1

how to run osmocom-bb with grgsm in usrp b210 to connect openBTS?
by hellowangfang＠gmail.com 19 Aug '24

19 Aug '24

I used osmocom-bb and grgsm with usrp b210 to connect openBTS, but failed. The command is "./mobile -c /home/oi/wf/osmocom-bb/doc/examples/mobile/default.cfg","./trxcon -p 5075 " ,"grgsm_trx -p 5075" . When i used “./cell_log -A 1 ”， it could find plmn 1-1 with arfcn 1 which is same with openBTS. DSUM INFO cell_log.c:344 Sync ARFCN 1 (rxlev -105, 1 syncs left) DSUM INFO cell_log.c:372 Measure from 1 to 1 DSUM INFO l1ctl.c:1177 start_pm L1CTL_PM_CONF DSUM INFO cell_log.c:400 start_pm S_L1CTL_PM_DONE DSUM INFO cell_log.c:363 Measurement done DSUM INFO cell_log.c:372 Measure from 1 to 1 DSUM INFO l1ctl.c:1177 start_pm L1CTL_PM_CONF DSUM INFO cell_log.c:400 start_pm S_L1CTL_PM_DONE DSUM INFO cell_log.c:363 Measurement done DSUM INFO cell_log.c:372 Measure from 1 to 1 DSUM INFO l1ctl.c:1177 start_pm L1CTL_PM_CONF DSUM INFO cell_log.c:400 start_pm S_L1CTL_PM_DONE DSUM INFO cell_log.c:363 Measurement done DSUM INFO cell_log.c:372 Measure from 1 to 1 DSUM INFO l1ctl.c:1177 start_pm L1CTL_PM_CONF DSUM INFO cell_log.c:400 start_pm S_L1CTL_PM_DONE DSUM INFO cell_log.c:363 Measurement done DSUM INFO cell_log.c:372 Measure from 1 to 1 DSUM INFO l1ctl.c:1177 start_pm L1CTL_PM_CONF DSUM INFO cell_log.c:400 start_pm S_L1CTL_PM_DONE DSUM INFO cell_log.c:363 Measurement done DSUM INFO cell_log.c:344 Sync ARFCN 1 (rxlev -105, 1 syncs left) DSUM INFO cell_log.c:190 Cell: ARFCN=1 MCC-MNC=001-01 (Test, Test) But when test with sim testcard 1, it failed to find the 1-1 cell. Could anyone give any suggestion about this? Thanks a lot! 6.5.0-25-generic #25~22.04.1-Ubuntu osmocom-bb: commit 0d1ab4c8d2cbe0ba72662d5b466fb6c60cb8b45f (HEAD -> master, origin/master, origin/HEAD) grgsm: https://github.com/bkerler/gr-gsm.git origin/maint-3.10_with_multiarfcn

4 7

problem on registering osmocombb SDR PHY setup to my virtual bts
by daniollama＠gmail.com 12 Aug '24

12 Aug '24

I want to implement osmocombb SDR PHY project on USRP N210 in Dragon OS. for this purpose i setup Yate BTS with Blade RF in ARFCN 1. i test this bts by making call with two phone in this network. then i ran grgsm_scanner by USRP N210 and the log is >> Found CCCH arfcn: 1 Dont capture immediate assignments, skip extract SDCCH/8 info and scan... ARFCN: 1, Freq: 935.2M, CID: 10, LAC: 1000, MCC: 432, MNC: 35, Pwr: -27 |---- Configuration: 1 CCCH, combined |---- Cell ARFCNs: 0 |---- Neighbour Cells: 1, 2, 4, 6, 9, 10, 12, 14, 17, 18, 20, 22, 25, 33, 34, 35, 36, 38, 44, 46, 47, 48, 49, 50, 57, 58, 61, 63, 66, 69, 70, 71, 72, 75, 77, 78, 80, 82, 84, 90, 91, 92, 96, 97, 98, 99, 100, 101, 106, 107, 113, 115, 116, 118, 119, 121, 122 then i run grgsm_trx, trxcon and mobile with this configuration shown below ! ! OsmocomBB example configuration for mobile application !! ! line vty no login ! gps device /dev/ttyACM0 gps baudrate default no gps enable ! no hide-default ! ms 1 layer2-socket /tmp/osmocom_l2 sap-socket /tmp/osmocom_sap stick 1 sim none network-selection-mode auto imei 000000000000000 0 imei-fixed no emergency-imsi no sms-service-center no call-waiting no auto-answer no force-rekey no clip no clir tx-power auto no simulated-delay location-updating neighbour-measurement codec full-speed prefer codec half-speed no abbrev support sms a5/1 a5/2 p-gsm e-gsm r-gsm gsm-850 dcs no pcs class-900 4 class-850 4 class-dcs 1 class-pcs 1 channel-capability sdcch+tchf+tchh full-speech-v1 full-speech-v2 half-speech-v1 min-rxlev -60 dsc-max 90 no skip-max-per-band test-sim imsi 001010412345678 ki comp128 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 no barred-access rplmn 001 01 ! io-format ti no shutdown I enter commands OsmocomBB> en OsmocomBB# sim t OsmocomBB# sim testcard 1 in telnet. the log for grgsm_trx is Copyright (C) 2016-2018 by Vadim Yanitskiy <axilirator(a)gmail.com> Copyright (C) 2017-2018 by Piotr Krysik <ptrkrysik(a)gmail.com> License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. [i] Init UHD Radio interface (L:0.0.0.0:6702 <-> R:127.0.0.1:6802) [INFO] [UHD] linux; GNU C++ version 11.3.0; Boost_107400; UHD_4.1.0.5-0-unknown [INFO] [USRP2] Opening a USRP2/N-Series device... [INFO] [USRP2] Current recv frame size: 1472 bytes [INFO] [USRP2] Current send frame size: 1472 bytes [i] Init CTRL interface (L:0.0.0.0:6701 <-> R:127.0.0.1:6801) [i] Init complete [i] Recv POWEROFF cmd [i] Resetting transceiver [i] Setting TA value 0 [i] Recv ECHO cmd [i] Recv POWEROFF cmd [i] Resetting transceiver [i] Setting TA value 0 [i] Recv ECHO cmd [i] Recv MEASURE cmd [i] Recv POWEROFF cmd [i] Resetting transceiver [i] Setting TA value 0 [i] Recv ECHO cmd [i] Recv SETSLOT cmd [i] Configure timeslot filter to: tn=0 [i] Recv RXTUNE cmd [i] Recv TXTUNE cmd [i] Recv POWERON CMD [i] Starting transceiver... [i] Recv POWEROFF cmd [i] Stopping transceiver... [i] Recv ECHO cmd [i] Recv SETSLOT cmd [i] Configure timeslot filter to: drop all . . . the log for texcon is 20240812161421520 DL1C NOTICE l1ctl.c:303 FBSB timer fired for ARFCN 1 20240812161421520 DL1C NOTICE l1ctl.c:422 Received reset request (1) 20240812161421520 DSCH NOTICE sched_trx.c:191 Reset scheduler and clock counter 20240812161421520 DSCH NOTICE sched_trx.c:237 Delete TDMA timeslot #0 20240812161421520 DL1C NOTICE l1ctl.c:395 Received power measurement request (GSM900: 1 -> 1) 20240812161421521 DL1C NOTICE l1ctl.c:422 Received reset request (1) 20240812161421521 DSCH NOTICE sched_trx.c:191 Reset scheduler and clock counter 20240812161421521 DL1C NOTICE l1ctl.c:338 Received FBSB request (GSM900 1) 20240812161421521 DSCH NOTICE sched_trx.c:191 Reset scheduler and clock counter 20240812161421521 DSCH NOTICE sched_trx.c:213 Add a new TDMA timeslot #0 20240812161421521 DSCH NOTICE sched_trx.c:288 (Re)configure TDMA timeslot #0 as BCCH+CCCH 20240812161421521 DSCH NOTICE sched_trx.c:445 Activating lchan=SCH on ts=0 20240812161421521 DSCH NOTICE sched_trx.c:445 Activating lchan=BCCH on ts=0 20240812161421521 DSCH NOTICE sched_trx.c:445 Activating lchan=RACH on ts=0 20240812161421521 DSCH NOTICE sched_trx.c:445 Activating lchan=CCCH on ts=0 20240812161421606 DSCHD ERROR sched_lchan_xcch.c:99 Received bad BCCH frame (rc=-1, ber=62/456) at fn=369446 20240812161421611 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369435 on CCCH 20240812161421611 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369436 on CCCH 20240812161421611 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369437 on CCCH 20240812161421611 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369438 on CCCH 20240812161421611 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=456/456) at fn=369435 20240812161421611 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369439 on CCCH 20240812161421611 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369440 on CCCH 20240812161421611 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369441 on CCCH 20240812161421611 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369442 on CCCH 20240812161421611 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=456/456) at fn=369439 20240812161421624 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=59/456) at fn=369450 20240812161421684 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369456 on CCCH 20240812161421684 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369457 on CCCH 20240812161421684 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369458 on CCCH 20240812161421684 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369459 on CCCH 20240812161421684 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=456/456) at fn=369456 20240812161421684 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369460 on CCCH 20240812161421684 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369461 on CCCH 20240812161421684 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369462 on CCCH 20240812161421684 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369463 on CCCH 20240812161421684 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=456/456) at fn=369460 20240812161421698 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=61/456) at fn=369466 20240812161421717 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=65/456) at fn=369470 20240812161421777 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369476 on CCCH 20240812161421777 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369477 on CCCH 20240812161421777 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369478 on CCCH 20240812161421777 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369479 on CCCH 20240812161421777 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=456/456) at fn=369476 20240812161421777 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369480 on CCCH 20240812161421777 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369481 on CCCH 20240812161421777 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369482 on CCCH 20240812161421777 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369483 on CCCH 20240812161421777 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=456/456) at fn=369480 20240812161421790 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=56/456) at fn=369486 20240812161421809 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=58/456) at fn=369490 20240812161421874 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369501 on CCCH 20240812161421874 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369502 on CCCH 20240812161421874 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369503 on CCCH 20240812161421874 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369504 on CCCH 20240812161421874 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=456/456) at fn=369501 20240812161421887 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=62/456) at fn=369507 20240812161421906 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=57/456) at fn=369511 20240812161421966 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369517 on CCCH 20240812161421966 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369518 on CCCH 20240812161421966 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369519 on CCCH 20240812161421966 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369520 on CCCH 20240812161421966 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=456/456) at fn=369517 20240812161421966 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369521 on CCCH 20240812161421966 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369522 on CCCH 20240812161421966 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369523 on CCCH 20240812161421966 DSCHD NOTICE sched_trx.c:695 Substituting lost TDMA frame 369524 on CCCH 20240812161421966 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=456/456) at fn=369521 20240812161421980 DSCHD ERROR sched_lchan_xcch.c:99 Received bad CCCH frame (rc=-1, ber=62/456) at fn=369527 and the log for mobile is <0003> gsm322.c:2919 Found signal (ARFCN 1 rxlev <=-110 (0)) <0003> gsm322.c:2933 Done with power scanning range. <0003> gsm322.c:2793 Scanning power for sticked cell. <0003> gsm322.c:2845 Found 1 frequencies. <0003> gsm322.c:2260 Scanning frequency 1 (rxlev <=-110). <0003> gsm322.c:479 Sync to ARFCN=1 rxlev=<=-110 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2280 30 frequencies left in band 955..124 <000c> l1ctl.c:301 Dropping frame with 200 bit errors <000c> l1ctl.c:301 Dropping frame with 61 bit errors <000c> l1ctl.c:301 Dropping frame with 60 bit errors <000c> l1ctl.c:301 Dropping frame with 200 bit errors <000c> l1ctl.c:301 Dropping frame with 200 bit errors <000c> l1ctl.c:301 Dropping frame with 63 bit errors <000c> l1ctl.c:301 Dropping frame with 59 bit errors <000c> l1ctl.c:301 Dropping frame with 61 bit errors <000c> l1ctl.c:301 Dropping frame with 200 bit errors <000c> l1ctl.c:301 Dropping frame with 200 bit errors <000c> l1ctl.c:301 Dropping frame with 62 bit errors <000c> l1ctl.c:301 Dropping frame with 200 bit errors <000c> l1ctl.c:301 Dropping frame with 200 bit errors <000c> l1ctl.c:301 Dropping frame with 62 bit errors <000c> l1ctl.c:301 Dropping frame with 65 bit errors <000c> l1ctl.c:301 Dropping frame with 200 bit errors <000c> l1ctl.c:301 Dropping frame with 200 bit errors <000c> l1ctl.c:169 FBSB RESP: result=255 <0003> gsm322.c:3014 Channel sync error. <0003> gsm322.c:3019 free sysinfo ARFCN=1 <0003> gsm322.c:2748 Cell selection failed, sync timeout. <0003> gsm322.c:532 ARFCN |MCC |MNC |LAC |cell ID|forb.LA|prio |min-db |max-pwr|rx-lev <0003> gsm322.c:532 -------+-------+-------+-------+-------+-------+-------+-------+-------+------- <0003> gsm322.c:532 <0003> gsm322.c:2136 Cell search finished without result. <0003> gsm322.c:834 new state 'C6 any cell selection' -> 'C0 null' <0002> gsm322.c:3831 (ms 1) Event 'EVENT_NO_CELL_FOUND' for automatic PLMN selection in state 'A4 wait for PLMN to appear' <0003> gsm322.c:4062 (ms 1) Event 'EVENT_NO_CELL_FOUND' for Cell selection in state 'C0 null' <0003> gsm322.c:834 new state 'C0 null' -> 'C6 any cell selection' <0003> gsm322.c:2793 Scanning power for sticked cell. <0003> gsm322.c:2870 Scanning frequencies. (1..1) <0005> gsm48_mm.c:4308 (ms 1) Received 'MM_EVENT_NO_CELL_FOUND' event in state MM IDLE, no cell available <0005> gsm48_mm.c:4321 Message unhandled at this state. what should i do to connect mobile to my virtual bts? thanks.

1 0