Testing protocol stack with OsmocomBB (cheap way)
Hi all, going through the documentation, I am trying to figure out what would be the best way to have whole protocol stack communication with OsmocomBB. Now, I understand that osmocon can be used to load layer1 into phones RAM, so that this code turns on Calypso and communicate with DSP with AT commands. Then osmocon gets messages from layer1 via RS232 and can distribute them to the mobile application, which sends them to layer23 for further processing or via GSM tap to Wireshark or outputs them on stdout. What I am most interested in how do we insert pacgaes on the other side of the stack, i.e. via telephone air interface (packets that will traverse through Rita, Iota, Calypso down to stdout of host). From what I understand we need some kind of BTS, and I can see that GNU Radio is used for this purpose. But for this, as I understand USPRP (http://en.wikipedia.org/wiki/Universal_Software_Radio_Peripheral) FPGA motherboard with both RX and TX doughterboards is needed, which can go up to 1k eur (too expensive for a hobbist). I was wondering so, what is the best and the cheapest way to inject packets at the protocol stack on the phone and analyze some packet flow later with Wireshark - i.e. to get some usage of the OsmocomBB and to see how it works. At this point I can only run Hello World application, or "mobile" app without any usage (or I do not know how to use it). What would be the best way to start playing around without spending too much money. Speaking of this, what would be the price of the cheapest existing packet generator that can transmit them via Um (i.e. what is the price of the cheapest BTS)? Is there some open source FPGA that can be used for this purpose? Thanks for your explanations and best regards, Drasko
Hi,
Now, I understand that osmocon can be used to load layer1 into phones RAM, so that this code turns on Calypso and communicate with DSP with AT commands.
... there is no AT commands anywhere ...
What I am most interested in how do we insert pacgaes on the other side of the stack, i.e. via telephone air interface (packets that will traverse through Rita, Iota, Calypso down to stdout of host). From what I understand we need some kind of BTS, and I can see that GNU Radio is used for this purpose. But for this, as I understand USPRP
If you want to inject packet towards a phone, yes you need your own BTS. OpenBTS using a USRP is one possibility.
(http://en.wikipedia.org/wiki/Universal_Software_Radio_Peripheral) FPGA motherboard with both RX and TX doughterboards is needed, which can go up to 1k eur (too expensive for a hobbist).
Depends how motivated the hobbyist is ... I know _plenty_ of people that pay _way_ more for their hobby. HAM radio amateurs have a lot of pricy gear for instance. And it's not just EE. I know guys that like riding motorcycle, how much do you think that cost ? Or recreational shooting ... guns cost a lot and each clip fired is literally 5$ up in smoke. People keep saying the USRP is very expensive ... well, not so much really.
Speaking of this, what would be the price of the cheapest existing packet generator that can transmit them via Um (i.e. what is the price of the cheapest BTS)?
The USRP is the cheapest widely available option. Two notes: - You can sometime find BTS on ebay (ip.access nanoBTS, google for it), but those have been very rare lately AFAICT. (by rare, I mean none at all that I could see) - Several other options are actively being developped, but none will be available in the short term AFAIK.
Is there some open source FPGA that can be used for this purpose?
The USRP and board schematics can be found ... and the sw is all opensource. You're free to build one yourself. Of course it's gonna cost you way more than buying one. There is no cheaper, currently available, SDR platform that can run OpenBTS AFAIK. Cheers, Sylvain
On Mon, May 30, 2011 at 1:22 AM, Sylvain Munaut <246tnt@gmail.com> wrote:
Hi,
Now, I understand that osmocon can be used to load layer1 into phones RAM, so that this code turns on Calypso and communicate with DSP with AT commands.
... there is no AT commands anywhere ... Oh... I thought that firmware on ARM was communicating with DSP via AT messages... How does it control DSP then? I see that data is exchanged via shared memory in SRAM, but how does Calypso call DSP interface to do some processing ?
(http://en.wikipedia.org/wiki/Universal_Software_Radio_Peripheral) FPGA motherboard with both RX and TX doughterboards is needed, which can go up to 1k eur (too expensive for a hobbist).
Depends how motivated the hobbyist is ... I know _plenty_ of people that pay _way_ more for their hobby.
I agree with you, but imagine someone who is looking around from the distance at one very interesting project. Fistly, I am not network stack engineer, but more attracted by the platform and system. But I'd like to get my feet wet, and not ready to throw 1k eur on the equipment I do not know at all. I'd rather try things around, get a feel and then, as I get involved, collect some material. You might disagree with me, but I think that for open source projects related to HW price is very important - keeping the price very low helps more people get involved in the project in the first place. Here, I ended up with telephone that can not do practicaly anything - can not receive nor transmit packets. Or am I wrong ? Can I use some data from public network, just to see some packets flow, so I can at least get some feel ?
Or recreational shooting ... guns cost a lot and each clip fired is literally 5$ up in smoke. This does not surprise me much, world is full of morons. On the other side of the planet someone is litteraly dying for this $5.
People keep saying the USRP is very expensive ... well, not so much really. I can agree on this, it is not so expensive. But I explained position, so at this moment I am reconsidering solutions.
Is there some open source FPGA that can be used for this purpose?
The USRP and board schematics can be found ... and the sw is all opensource. When you say SW, I guess you mean some host applications ?
What I was talking about is available HDL code that I can flash into my (eventually modified) FPGA board.
You're free to build one yourself. Of course it's gonna cost you way more than buying one.
I would more opt for idea of open source VHDL or Verilog code that can be flashed into non-expensive FPGA development boards (some Spartan or Altera or something) and open source schematics for additional hardware that can be soldered around to have signals coming. At this point I am not interested at full-blown BTS, but some minimal stuff that can send something via radio link that would be captured by the phone and transmitted via stack towards Wireshark on the host. Just the basic test. I do not need it for GSM protocol reserach, rather something that can give feel and usability to the OsmocomBB project, before someone has enough informations and idea to buy USRP. BR, Drasko
On Mon, May 30, 2011 at 2:02 AM, <246tnt@gmail.com> wrote:
This does not surprise me much, world is full of morons.
Guess what, I'm one of them ... I think I'll let someone else answer your questions.
There is no need to take this personally, it was not my intention to sound too rude. It was more ironic social-awareness critic then an insult. Sorry if that offended you. In any case, I'd like to keep this interesting discussion strictly technical from now on, as I am sure that many people might benefit from it. Taken in a count that majority of engineers who are willing to contribute their time and knowledge to this project have probably mid-level expertise, with few real experts orbiting around and sharing the knowledge and support, paving the way for the newcomers. That's why I think that discussion I started makes sense and can be beneficial to all who have some general embedded engineering experience (in which I count myself) and are looking for a best way to contribute it to OsmocomBB and the community. I hope that you will share your valuable experience in this effort. I am aware of your work and I know that it is highly appreciated in the community. Thank you for your help and support. Best regards, Drasko
Quoting "Drasko DRASKOVIC" <drasko.draskovic@gmail.com>:
On Mon, May 30, 2011 at 1:22 AM, Sylvain Munaut <246tnt@gmail.com> wrote:
Hi,
Now, I understand that osmocon can be used to load layer1 into phones RAM, so that this code turns on Calypso and communicate with DSP with AT commands.
... there is no AT commands anywhere ... Oh... I thought that firmware on ARM was communicating with DSP via AT messages... How does it control DSP then? I see that data is exchanged via shared memory in SRAM, but how does Calypso call DSP interface to do some processing ?
(http://en.wikipedia.org/wiki/Universal_Software_Radio_Peripheral) FPGA motherboard with both RX and TX doughterboards is needed, which can go up to 1k eur (too expensive for a hobbist).
Depends how motivated the hobbyist is ... I know _plenty_ of people that pay _way_ more for their hobby.
I agree with you, but imagine someone who is looking around from the distance at one very interesting project. Fistly, I am not network stack engineer, but more attracted by the platform and system. But I'd like to get my feet wet, and not ready to throw 1k eur on the equipment I do not know at all. I'd rather try things around, get a feel and then, as I get involved, collect some material. You might disagree with me, but I think that for open source projects related to HW price is very important - keeping the price very low helps more people get involved in the project in the first place.
Here, I ended up with telephone that can not do practicaly anything - can not receive nor transmit packets. Or am I wrong ? Can I use some data from public network, just to see some packets flow, so I can at least get some feel ?
Or recreational shooting ... guns cost a lot and each clip fired is literally 5$ up in smoke. This does not surprise me much, world is full of morons. On the other side of the planet someone is litteraly dying for this $5.
People keep saying the USRP is very expensive ... well, not so much really. I can agree on this, it is not so expensive. But I explained position, so at this moment I am reconsidering solutions.
Is there some open source FPGA that can be used for this purpose?
The USRP and board schematics can be found ... and the sw is all opensource. When you say SW, I guess you mean some host applications ?
What I was talking about is available HDL code that I can flash into my (eventually modified) FPGA board.
You're free to build one yourself. Of course it's gonna cost you way more than buying one.
I would more opt for idea of open source VHDL or Verilog code that can be flashed into non-expensive FPGA development boards (some Spartan or Altera or something) and open source schematics for additional hardware that can be soldered around to have signals coming.
At this point I am not interested at full-blown BTS, but some minimal stuff that can send something via radio link that would be captured by the phone and transmitted via stack towards Wireshark on the host.
As this is all you want just use the signal from any commercial BTS in your area. OsmocomBB is able to capture System Information Messages and Paging Requests and forward the content to Wireshark.
Just the basic test. I do not need it for GSM protocol reserach, rather something that can give feel and usability to the OsmocomBB project, before someone has enough informations and idea to buy USRP.
BR, Drasko
On Mon, May 30, 2011 at 8:56 AM, <weberbe@ee.ethz.ch> wrote:
Quoting "Drasko DRASKOVIC" <drasko.draskovic@gmail.com>:
As this is all you want just use the signal from any commercial BTS in your area. OsmocomBB is able to capture System Information Messages and Paging Requests and forward the content to Wireshark.
Yes, I think it would be a great start ! How this can be done ? Can somebody kindly explain the procedure to do this in a few words, and point out things to observe ? I think this kind of instructions/tutorial can be very useful for all the people who want to start quickly with OsmocomBB and have something useful that does communication and traverse packets through the stack. This employs all the tools from the project and gives perfect overview how they work together. Thanks and best regards, Drasko
On Mon, 2011-05-30 at 10:11 +0200, Drasko DRASKOVIC wrote:
On Mon, May 30, 2011 at 8:56 AM, <weberbe@ee.ethz.ch> wrote:
Quoting "Drasko DRASKOVIC" <drasko.draskovic@gmail.com>:
As this is all you want just use the signal from any commercial BTS in your area. OsmocomBB is able to capture System Information Messages and Paging Requests and forward the content to Wireshark.
Yes, I think it would be a great start ! How this can be done ?
Can somebody kindly explain the procedure to do this in a few words, and point out things to observe ? I think this kind of instructions/tutorial can be very useful for all the people who want to start quickly with OsmocomBB and have something useful that does communication and traverse packets through the stack. This employs all the tools from the project and gives perfect overview how they work together.
You can find exactly this tutorial on the wiki. Gianni
On Mon, May 30, 2011 at 6:46 PM, Gianni Tedesco <gianni@scaramanga.co.uk> wrote:
You can find exactly this tutorial on the wiki.
Hi Gianni, I did not saw it last night when I was srtawling through the wiki (or more possible did not understand that I was looking at it). Can you please post the link for the future reference ? BR, Drasko
Hi Gianni, after few hours of searching through the wiki pages, I have not been able to find the document you were mentioning that would explain attaching to cell and have some packet transfered through protocol stack up to the Wireshark. Are you sure that this document still exist and not have been removed/replaced ? All I have found that can resemble is this : http://bb.osmocom.org/trac/wiki/layer23 but I guess that this is not what you are talking about, as it gives no detailed instructions for the things I want to obtain (i.e. which applications to start, in which order, what are things to observe, etc...). I tried some basic test by watching OsocomBB video presentations, as these are closest instructions and recepies on tools usage I have found to get one up and running, and I described troubles I have been facing in previous mail - I tried to guess what can be the right scenario as I find no docs, but I am still not able to synchronize to any cell, nor have some packets coming... BR, Drasko On Mon, May 30, 2011 at 7:13 PM, Drasko DRASKOVIC <drasko.draskovic@gmail.com> wrote:
On Mon, May 30, 2011 at 6:46 PM, Gianni Tedesco <gianni@scaramanga.co.uk> wrote:
You can find exactly this tutorial on the wiki.
Hi Gianni, I did not saw it last night when I was srtawling through the wiki (or more possible did not understand that I was looking at it).
Can you please post the link for the future reference ?
BR, Drasko
On Tue, 2011-05-31 at 00:05 +0200, Drasko DRASKOVIC wrote:
Hi Gianni, after few hours of searching through the wiki pages, I have not been able to find the document you were mentioning that would explain attaching to cell and have some packet transfered through protocol stack up to the Wireshark.
Are you sure that this document still exist and not have been removed/replaced ?
All I have found that can resemble is this : http://bb.osmocom.org/trac/wiki/layer23 but I guess that this is not what you are talking about, as it gives no detailed instructions for the things I want to obtain (i.e. which applications to start, in which order, what are things to observe, etc...).
Pretty much, but also look at the page for your specific phone model and http://bb.osmocom.org/trac/wiki/osmocon Basically you just need to use osmocon to load the layer1 firmware, power the phone up and then if 'mobile' (or whatever app you want) is running, it should be "all systems go". You can run mobile/cell_log/whatever before or after booting the phone and it'll be fine.
I tried some basic test by watching OsocomBB video presentations, as these are closest instructions and recepies on tools usage I have found to get one up and running, and I described troubles I have been facing in previous mail - I tried to guess what can be the right scenario as I find no docs, but I am still not able to synchronize to any cell, nor have some packets coming...
It's not a complicated scenario and is well explained on the wiki: We have a firmware for the phone that we compiled on the PC We have a data cable between phone and PC The firmware does low level things Other apps running on the PC do high level things (eg. mobile phone) We use a loader program (osmocon) to load the firmware from the PC on to the phone via the cable. After the firmware is running on the phone, we can run high level apps on the PC (mobile, cell_log, etc). The high level apps communicate to the phone via the communication channel setup by the loader. Most (all?) of the high level apps have a command line switch which tells them to transmit GSMTAP logs to a specific IP address. You can use tcpdump to capture the GSMTAP info and view it in wireshark. Gianni
On Tue, May 31, 2011 at 12:18 AM, Gianni Tedesco <gianni@scaramanga.co.uk> wrote:
On Tue, 2011-05-31 at 00:05 +0200, Drasko DRASKOVIC wrote:
Hi Gianni, after few hours of searching through the wiki pages, I have not been able to find the document you were mentioning that would explain attaching to cell and have some packet transfered through protocol stack up to the Wireshark.
Are you sure that this document still exist and not have been removed/replaced ?
All I have found that can resemble is this : http://bb.osmocom.org/trac/wiki/layer23 but I guess that this is not what you are talking about, as it gives no detailed instructions for the things I want to obtain (i.e. which applications to start, in which order, what are things to observe, etc...).
Pretty much, but also look at the page for your specific phone model and http://bb.osmocom.org/trac/wiki/osmocon
Basically you just need to use osmocon to load the layer1 firmware, power the phone up and then if 'mobile' (or whatever app you want) is running, it should be "all systems go". You can run mobile/cell_log/whatever before or after booting the phone and it'll be fine.
I tried some basic test by watching OsocomBB video presentations, as these are closest instructions and recepies on tools usage I have found to get one up and running, and I described troubles I have been facing in previous mail - I tried to guess what can be the right scenario as I find no docs, but I am still not able to synchronize to any cell, nor have some packets coming...
It's not a complicated scenario and is well explained on the wiki:
We have a firmware for the phone that we compiled on the PC
We have a data cable between phone and PC
The firmware does low level things
Other apps running on the PC do high level things (eg. mobile phone)
We use a loader program (osmocon) to load the firmware from the PC on to the phone via the cable.
After the firmware is running on the phone, we can run high level apps on the PC (mobile, cell_log, etc).
The high level apps communicate to the phone via the communication channel setup by the loader.
Most (all?) of the high level apps have a command line switch which tells them to transmit GSMTAP logs to a specific IP address.
You can use tcpdump to capture the GSMTAP info and view it in wireshark.
Yes, thanks. I gotten that. What I meant is more like some instructions how to get the system running, this what I am trying to achieve. Now, as you can see there is a lot of information spread all around and I have hard time to get them together in a meaningful picture. What troubles me the most is these kind of information that are missing, for example : - start this application first, then this one - LOST message is OK - there is no SIM simulated, and you can not do anything without SIM, which is not supported on the master - connect this to this to get logs in Wireshark - etc... Some kind of a tutorial that would prevent every starter to get stuck. Thanks for your help, things are beginning to be clearer. BR, Drasko
On Tue, 2011-05-31 at 00:31 +0200, Drasko DRASKOVIC wrote:
On Tue, May 31, 2011 at 12:18 AM, Gianni Tedesco <gianni@scaramanga.co.uk> wrote:
On Tue, 2011-05-31 at 00:05 +0200, Drasko DRASKOVIC wrote:
Hi Gianni, after few hours of searching through the wiki pages, I have not been able to find the document you were mentioning that would explain attaching to cell and have some packet transfered through protocol stack up to the Wireshark.
Are you sure that this document still exist and not have been removed/replaced ?
All I have found that can resemble is this : http://bb.osmocom.org/trac/wiki/layer23 but I guess that this is not what you are talking about, as it gives no detailed instructions for the things I want to obtain (i.e. which applications to start, in which order, what are things to observe, etc...).
Pretty much, but also look at the page for your specific phone model and http://bb.osmocom.org/trac/wiki/osmocon
Basically you just need to use osmocon to load the layer1 firmware, power the phone up and then if 'mobile' (or whatever app you want) is running, it should be "all systems go". You can run mobile/cell_log/whatever before or after booting the phone and it'll be fine.
I tried some basic test by watching OsocomBB video presentations, as these are closest instructions and recepies on tools usage I have found to get one up and running, and I described troubles I have been facing in previous mail - I tried to guess what can be the right scenario as I find no docs, but I am still not able to synchronize to any cell, nor have some packets coming...
It's not a complicated scenario and is well explained on the wiki:
We have a firmware for the phone that we compiled on the PC
We have a data cable between phone and PC
The firmware does low level things
Other apps running on the PC do high level things (eg. mobile phone)
We use a loader program (osmocon) to load the firmware from the PC on to the phone via the cable.
After the firmware is running on the phone, we can run high level apps on the PC (mobile, cell_log, etc).
The high level apps communicate to the phone via the communication channel setup by the loader.
Most (all?) of the high level apps have a command line switch which tells them to transmit GSMTAP logs to a specific IP address.
You can use tcpdump to capture the GSMTAP info and view it in wireshark.
Yes, thanks. I gotten that. What I meant is more like some instructions how to get the system running, this what I am trying to achieve. Now, as you can see there is a lot of information spread all around and I have hard time to get them together in a meaningful picture.
What troubles me the most is these kind of information that are missing, for example : - start this application first, then this one - LOST message is OK - there is no SIM simulated, and you can not do anything without SIM, which is not supported on the master - connect this to this to get logs in Wireshark - etc...
Some kind of a tutorial that would prevent every starter to get stuck.
Sure. Although it is a goal of the project to bring awareness, knowledge, access to GSM to a wider audience, osmocom is still highly experimental software and that means that to do anything useful with it you are going to need to be very comfortable with figuring out these sorts of issues anyway. I mean, at this stage it's still very much for hackers who are ready to roll their sleeves up and get stuck in. I must say, I didn't even know of sylvains driver (non obvious branch name) or cell_log and had to write my own SIM access code to get going - it was a fun night :) Gianni
On Tue, May 31, 2011 at 12:42 AM, Gianni Tedesco <gianni@scaramanga.co.uk> wrote:
What troubles me the most is these kind of information that are missing, for example : - start this application first, then this one - LOST message is OK - there is no SIM simulated, and you can not do anything without SIM, which is not supported on the master - connect this to this to get logs in Wireshark - etc...
Some kind of a tutorial that would prevent every starter to get stuck.
Sure. Although it is a goal of the project to bring awareness, knowledge, access to GSM to a wider audience, osmocom is still highly experimental software and that means that to do anything useful with it you are going to need to be very comfortable with figuring out these sorts of issues anyway. I mean, at this stage it's still very much for hackers who are ready to roll their sleeves up and get stuck in. Yes, this is basically my intention. But every beginning is hard ;).
I must say, I didn't even know of sylvains driver (non obvious branch name) or cell_log and had to write my own SIM access code to get going - it was a fun night :)
What do you consider by this, i.e. what was exactly that you did ? Worked on the SIM controller driver or something else ? Can I reuse this approach to get things moving ? BR, Drasko
On Thu, 2011-06-02 at 01:22 +0200, Drasko DRASKOVIC wrote:
On Tue, May 31, 2011 at 12:42 AM, Gianni Tedesco <gianni@scaramanga.co.uk> wrote:
What troubles me the most is these kind of information that are missing, for example : - start this application first, then this one - LOST message is OK - there is no SIM simulated, and you can not do anything without SIM, which is not supported on the master - connect this to this to get logs in Wireshark - etc...
Some kind of a tutorial that would prevent every starter to get stuck.
Sure. Although it is a goal of the project to bring awareness, knowledge, access to GSM to a wider audience, osmocom is still highly experimental software and that means that to do anything useful with it you are going to need to be very comfortable with figuring out these sorts of issues anyway. I mean, at this stage it's still very much for hackers who are ready to roll their sleeves up and get stuck in. Yes, this is basically my intention. But every beginning is hard ;).
I must say, I didn't even know of sylvains driver (non obvious branch name) or cell_log and had to write my own SIM access code to get going - it was a fun night :)
What do you consider by this, i.e. what was exactly that you did ? Worked on the SIM controller driver or something else ? Can I reuse this approach to get things moving ?
It's all on the mailing list and recent. Although I think Nico Golde's SAP driver is the way this is going to go. So if you need SIM and don't want to use the phone SIM, try that. Gianni
On Tue, 2011-05-31 at 00:31 +0200, Drasko DRASKOVIC wrote:
On Tue, May 31, 2011 at 12:18 AM, Gianni Tedesco <gianni@scaramanga.co.uk> wrote:
On Tue, 2011-05-31 at 00:05 +0200, Drasko DRASKOVIC wrote:
Hi Gianni, after few hours of searching through the wiki pages, I have not been able to find the document you were mentioning that would explain attaching to cell and have some packet transfered through protocol stack up to the Wireshark.
Are you sure that this document still exist and not have been removed/replaced ?
All I have found that can resemble is this : http://bb.osmocom.org/trac/wiki/layer23 but I guess that this is not what you are talking about, as it gives no detailed instructions for the things I want to obtain (i.e. which applications to start, in which order, what are things to observe, etc...).
Pretty much, but also look at the page for your specific phone model and http://bb.osmocom.org/trac/wiki/osmocon
Basically you just need to use osmocon to load the layer1 firmware, power the phone up and then if 'mobile' (or whatever app you want) is running, it should be "all systems go". You can run mobile/cell_log/whatever before or after booting the phone and it'll be fine.
I tried some basic test by watching OsocomBB video presentations, as these are closest instructions and recepies on tools usage I have found to get one up and running, and I described troubles I have been facing in previous mail - I tried to guess what can be the right scenario as I find no docs, but I am still not able to synchronize to any cell, nor have some packets coming...
It's not a complicated scenario and is well explained on the wiki:
We have a firmware for the phone that we compiled on the PC
We have a data cable between phone and PC
The firmware does low level things
Other apps running on the PC do high level things (eg. mobile phone)
We use a loader program (osmocon) to load the firmware from the PC on to the phone via the cable.
After the firmware is running on the phone, we can run high level apps on the PC (mobile, cell_log, etc).
The high level apps communicate to the phone via the communication channel setup by the loader.
Most (all?) of the high level apps have a command line switch which tells them to transmit GSMTAP logs to a specific IP address.
You can use tcpdump to capture the GSMTAP info and view it in wireshark.
Yes, thanks. I gotten that. What I meant is more like some instructions how to get the system running, this what I am trying to achieve. Now, as you can see there is a lot of information spread all around and I have hard time to get them together in a meaningful picture.
What troubles me the most is these kind of information that are missing, for example : - start this application first, then this one
Actually, either way round should be fine.
- LOST message is OK
Hmm, maybe this one is scary but there's a LOT of different messages.
- there is no SIM simulated, and you can not do anything without SIM, which is not supported on the master
True
- connect this to this to get logs in Wireshark
Well OK, but if you've used tcpdump, wireshark etc. this is no big deal
- etc...
I think we've covered it tbh
Some kind of a tutorial that would prevent every starter to get stuck.
Ask Harald for wiki access and go for it.
Thanks for your help, things are beginning to be clearer.
nps Gianni
On Mon, May 30, 2011 at 8:56 AM, <weberbe@ee.ethz.ch> wrote:
As this is all you want just use the signal from any commercial BTS in your area. OsmocomBB is able to capture System Information Messages and Paging Requests and forward the content to Wireshark.
Hi weberbe, can you explain in some more details how this can be done ? So far I did not succeed to attach to any cell, not to get some packets from it. At which moment can we observe the packets which are coming : 1) During the initial measurements or 2) Only after we attach to a cell What should be set up, what applications run and in which order to obtain some packet logging in Wireshark. I am running master branch - so, no SIM working. Best regards, Drasko
Hi Drasko I am not so sure why you are not succeeding in recording anything in wireshark. From what I have seen from your other posts you are doing it the right way. Well, here is what should happen anyway: 1) The phone measures the receive power of all the channels it can handle unless you specified to stick to a specific channel in the mobile application. 2) The channels with the highest receive power are most likely to be beacon carriers. So the phone will try to synchronize in frequency and time to such a carrier. The synchronization in time will retrieve the current frame number und the BSIC of the base station. 3) If the synchronization is successfull, the phone will monitor various logical channels on the beacon carrier: The broadcast control channel (BCCH), common control channel (CCCH) and the paging channel (PCH) (and maybe some more, I am not so sure). The packets received on these channels will be dumped on wireshark or whatever you are using. As soon as all system information (SI) messages from BCCH are decoded, the phone can camp on this cell. In order to achieve this you need osmocon, mobile and wireshark to be running. Hope this helps Ben Quoting "Drasko DRASKOVIC" <drasko.draskovic@gmail.com>:
On Mon, May 30, 2011 at 8:56 AM, <weberbe@ee.ethz.ch> wrote:
As this is all you want just use the signal from any commercial BTS in your area. OsmocomBB is able to capture System Information Messages and Paging Requests and forward the content to Wireshark.
Hi weberbe, can you explain in some more details how this can be done ?
So far I did not succeed to attach to any cell, not to get some packets from it.
At which moment can we observe the packets which are coming : 1) During the initial measurements or 2) Only after we attach to a cell
What should be set up, what applications run and in which order to obtain some packet logging in Wireshark.
I am running master branch - so, no SIM working.
Best regards, Drasko
participants (5)
-
246tnt＠gmail.com -
Drasko DRASKOVIC -
Gianni Tedesco -
Sylvain Munaut
-
weberbe＠ee.ethz.ch