OpenBSC May 2020

openbsc@lists.osmocom.org

7 participants
11 discussions

Splitting out M3UA and MTP3 out of Open BSC into a separate library
by Arran Cudbard-Bell 20 Nov '25

20 Nov '25

Hi, Developing a module for FreeRADIUS to support EAP-SIM and EAP-AKA authentication against a HLR. The HLR we were targeting only supported a SCTP/M3UA/SCCP/TCAP/MAP stack, so we couldn't use SUA. Ripping the M3UA/MTP3 code out of OpenBSC worked surprisingly well. We ended up running the event loop in a separate thread to work around the threading issues. Unfortunately the HLR implements the ANSI variant of everything, whereas OpenBSC and supporting libraries seem to have been written to be compatible with the ITU standards. ...but the differences are fairly minor at MTP3 and SCCP layers, and i've started work on a patchset for libosmo-sccp. https://gerrit.osmocom.org/#/c/73/ Anyway, trying to gauge interest in splitting those layers out of Open BSC into a separate library, would be happy to take on M2UA as well for consistency. It would almost certainly get more projects using the code. There's very little out there even in Perl land for working with SS7. Thanks, -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

6 6

ip.access nano 3G S8 Configuration
by John Thewlis - Meath Broadband 18 Nov '25

18 Nov '25

We are trying to setup this AP as part of the 3.5G Osmocom project. We have the software stack operational and are now preparing the nano for testing. When we try to login via telnet at port 8090 we are getting a constant refusal to connect:- root@osm/openbsc/openbsc/src/ipaccess# telnet 192.168.192.30 8090 Trying 192.168.192.30... telnet: Unable to connect to remote host: Connection refused The device seems to be locked as indicated by the leds on the front panel. We have tried resetting the nano to see if this would help but to no avail. Any ideas as to how to access the device for initial configuration?. Thanks John

4 4

GPRS - local and foreign TLLIs
by Luca Melette 18 Nov '25

18 Nov '25

Hello everybody, after setting up a nanoBTS with OpenBSC/SGSN/GGSN, I had some troubles trying to connect my smartphone to the GPRS cell. Investigating the BTS-to-SGSN traffic, I saw that the frames sent by the SGSN were all marked with the same N(U) value (at LLC layer), the value was 0. With some debug, I found that the there was a mismatch in the TLLI storage, used to keep the status of attached terminals. The mentioned code is contained in gprs_llc.c, involving LL Entity functions and gprs_llc_tx_ui(). /* look-up or create the LL Entity for this (TLLI, SAPI) tuple */ lle = lle_by_tlli_sapi(msgb_tlli(msg), sapi); if (!lle) { struct gprs_llc_llme *llme; LOGP(DLLC, LOGL_ERROR, "LLC TX: unknown TLLI 0x%08x, " "creating LLME on the fly\n", msgb_tlli(msg)); llme = llme_alloc(msgb_tlli(msg)); lle = &llme->lle[sapi]; } The TX function uses the previously received TLLI to lookup for the LLE. The lle_by_tlli_sapi() performs the search, but preliminary it applies a foreign2local TLLI conversion to ensure to have a local one. Since no valid entry for the searched TLLI is found, a new one is created. And the problem is here. The new entry has the foreign TLLI. Next time the lookup fails again, and a new entry is created. This way, the counter N(U) is always reset, and the mobile do not recognize the message sequence and no attach is possible. My question is about foreign and local TLLIs. I patched the lookup, avoiding the conversion, so that the LLE is found and everything works fine... but... What is the sense of the conversion? Should the TLLI be always stored as a local one? Can this problem be solved with another foreign2local while allocating new entries? Actually, my problem has been solved with that workaround. But I'm curious to know what is the right way. Hope somebody can answer :) Thanks. Cheers, LM

4 5

Need nano3G (S8 - Model 237A)
by Akib Sayyed 18 Nov '25

18 Nov '25

Dear List I am extremely sorry for off the topic question. I am willing to buy nano3G Nodeb. Is anyone in list have spare which can be sold. Please let me know. -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243 <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

4 3

Pysim error: SW match failed
by Martin Nagy 16 Aug '25

16 Aug '25

Hi all, After buying a super Sim Kit (16 in 1) from China, I tried the reader (green PCB inside a blue transparent plastic case with a blue LED) and SIM (identified as a fakesupersim) with pysim tool. However i am getting the following error: /pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z 1234 -j 1 -t auto Insert card now (or CTRL-C to cancel) Autodetected card type fakemagicsim Generated card parameters : > Name : 26C3 > SMSP : e1ffffffffffffffffffffffff058100945555ffffffffffff000000 > ICCID : 8949262427518313026 > MCC/MNC : 262/42 > IMSI : 262422461512085 > Ki : 7b74741a1ee14337ec23f9ab92a13648 > OPC : ccd867d60797d8d45354a51b3ef568ff Programming ... Traceback (most recent call last): File "./pySim-prog.py", line 530, in <module> card.program(cp) File "/home/nadicek/pysim/pysim/pySim/cards.py", line 231, in program self._scc.update_binary('6f30', hplmn + 'ff' * (tl-3)) File "/home/nadicek/pysim/pysim/pySim/commands.py", line 53, in update_binary return self._tp.send_apdu_checksw(pdu) File "/home/nadicek/pysim/pysim/pySim/transport/__init__.py", line 87, in send_apdu_checksw raise RuntimeError("SW match failed ! Expected %s and got %s." % (sw.lower(), rv[1])) RuntimeError: SW match failed ! Expected 9000 and got 9804. I checked mailing lists and haven’t found anybody who had similar problem with pysim. Also I have tried forcing different models of SIM, but nothing is working. Obviously I can remove this check from the script file (__init__.py in /pySim/transport), however somebody had a reason to put such condition there. I would like to ask if it is safe to remove that line of code and the purpose of that line of code. Thanks a lot and best regards Martin

3 3

Re: Help with sccp library
by mosbah abdelkader 07 Jul '25

07 Jul '25

> I don't understand. This callback will be called with data you need to write > to the network. In case of MTP Level3 you will need to wrap that around the > msgb you got. I means: is the interaction with mtp3 layer implemented (is sending sccp data by mtp3 implemented by the library?)? Also, what about the reception of data from mtp3 layer. is that implemented in the sccp lib. I am asking these questions because I see the code of mtp3 in the lib but no significant call is present in the sccp part of the lib. Thank you for your help.

4 3

dynamic traffic channels
by Neels Hofmeyr 20 May '25

20 May '25

On Tue, Jun 28, 2016 at 10:05:28AM +0200, Harald Welte wrote: > [translated from german] > is it certain that we switch a channel to PDCH only when > gprs mode != none? A TS can be GSM_PCHAN_TCH_F_PDCH; those are the only ones for which we send a PDCH ACT message. We send a PDCH ACT message - during init (CHANNEL OML's state changed to enabled -> send PDCH ACT), - and upon channel release ack when pchan == GSM_PCHAN_TCH_F_PDCH. So the question is, when we receive a channel release ack, could that be the PDCH release and we switch PDCH right back on by accident? No, because we only receive a chan rel ack when the *TCH/F* is being released. That is because the PDCH release is initiated "internally" from the PDCH DEACT, and thus this condition in common/rsl.c rsl_tx_rf_rel_ack() catches on, which existed before dyn PDCH: if (lchan->rel_act_kind != LCHAN_REL_ACT_RSL) { LOGP(DRSL, LOGL_NOTICE, "%s not sending REL ACK\n", gsm_lchan_name(lchan)); return 0; } In rsl_rx_rf_chan_rel() the rel_act_kind is set to LCHAN_REL_ACT_RSL, but not in the rsl_rx_dyn_pdch(). This is analogous to the ip.access way -- the ip.access nanobts replies to a PDCH DEACT with a PDCH DEACT ACK and doesn't send a separate channel release ack. Maybe we could set rel_act_kind to some new LCHAN_REL_ACT_IPAC_DYN_PDCH for clarity? (But we shouldn't actually send a release ack, to stay compatible.) Even though it works as-is, we should indeed add another flag check: - We do check the flags that no ACT/DEACT is already pending; - And we do send a PDCH DEACT only if ts->flags & TS_F_PDCH_ACTIVE; - But we would send a PDCH ACT despite ts->flags & TS_F_PDCH_ACTIVE. This should never happen, but it would make sense to ensure that. ~Neels

3 5

Problem while running NIB on Open Cellular Base sation
by Brackley Casinga 31 Jan '24

31 Jan '24

Hi, My name is Brackley Cassinga Form DRC, we run a community network called pamoja net where we offer gsm services using osmocom open source software and OC Base station. Recently I have tried to install another base station as the same installed but I could not find any resource guiding through all the steps to take to run NIB on a base station. I'm currently running Ubuntu and I will appreciate if you could guide me on the installation of BSC,hlr,MSC , in order to run a basic gsm network. Thank you. Regards -- *Ir Brackley heshima Casinga **Pacifique* *CEO and Founder of kwanzatechnologie* KwanzaTechnologies ,GlobalElectronics +243977265291 | +243977265291 | Pcassinga(a)gmail.com/ brackley(a)ensemblepourladifference.org www.kwantechnologies.jimdosite.com <http://www.kwantechnologies.com/> | Skype: Brackley cassinga <https://webapp.wisestamp.com/#> Av Semliki N 43

2 1

Osmo-SIP-Connector Version 6
by Sonny Lafuente 30 May '20

30 May '20

Hi Community, Does anyone here tried to upgrade the your working OSMO environment to its latest version? I have the experience where I upgraded my working osmo to the latest version and I have encountering some problem between the connection of osmo-nitb and osmo-sip-connector. For the latest sip connector update it will communicate the connection going to osmo-msc. Since I don’t use the osmo-msc instead I am using the osmo-nitb for the standalone project. Below is the error I have experiencing right now in the osmo-sip-connector and osmo-nitb. SIP Connector Logs: <0001> mncc.c:845 Incompatible version(5) expected 6 <0001> mncc.c:936 Reconnected to /tmp/msc_mncc <0001> mncc.c:841 Got hello message version 5 <0001> mncc.c:845 Incompatible version(5) expected 6 <0001> mncc.c:936 Reconnected to /tmp/msc_mncc <0001> mncc.c:841 Got hello message version 5 <0001> mncc.c:845 Incompatible version(5) expected 6 OSMO-NITB Logs: Fri May 29 13:13:16 2020 <0006> mncc_sock.c:84 MNCC Socket has LOST connection Fri May 29 13:13:16 2020 <0001> gsm_04_08.c:463 Clearing all currently active transactions!!! Fri May 29 13:13:21 2020 <0006> mncc_sock.c:271 MNCC Socket has connection with external call control application Fri May 29 13:13:21 2020 <0006> mncc_sock.c:84 MNCC Socket has LOST connection Fri May 29 13:13:21 2020 <0001> gsm_04_08.c:463 Clearing all currently active transactions!!! Here are the configuration file of osmo-nitb and osmo-sip-connector and how we run the command. SIP Connector: Command to run: ./osmo-sip-connector -c ~/osmo-sip-connector.cfg Config File: # sip local 192.168.1.166 5062 remote 192.168.1.166 5060 sofia-sip log-level 2 mncc socket-path /tmp/msc_mncc app OSMO NITB: Command to run: ./osmo-nitb -C -c ~/osmo-nitb.cfg -T -P -l /home/hlr.sqlite3 -M /tmp/msc_mncc Config File: line vty no login ! e1_input e1_line 0 driver ipa e1_line 0 port 0 no e1_line 0 keepalive network network country code 94 mobile network code 1 short name 1 long name 1 auth policy accept-all authorized-regexp .* location updating reject cause 13 encryption a5 0 neci 1 paging any use tch 0 rrlp mode none mm info 1 handover 0 handover window rxlev averaging 10 handover window rxqual averaging 1 handover window rxlev neighbor averaging 10 handover power budget interval 6 handover power budget hysteresis 3 handover maximum distance 9999 timer t3109 1 timer t3105 1 timer t3113 60 timer t3103 1 timer t3122 10 timer t3101 10 dyn_ts_allow_tch_f 0 subscriber-keep-in-ram 1 bts 0 type sysmobts band GSM900 cell_identity 1 location_area_code 1 base_station_id_code 63 ms max power 0 cell reselection hysteresis 4 rxlev access min 0 periodic location update 30 radio-link-timeout 32 channel allocator descending rach tx integer 9 rach max transmission 7 channel-descrption attach 1 channel-descrption bs-pa-mfrms 5 channel-descrption bs-ag-blks-res 1 early-classmark-sending forbidden ip.access unit_id 1000 0 oml ip.access stream_id 255 line 0 neighbor-list mode automatic codec-support fr hr efr amr amr tch-h modes 0 amr tch-h start-mode auto gprs mode gprs gprs 11bit_rach_support_for_egprs 0 gprs routing area 1 gprs network-control-order nc0 gprs cell bvci 2 gprs cell timer blocking-timer 3 gprs cell timer blocking-retries 3 gprs cell timer unblocking-retries 3 gprs cell timer reset-timer 3 gprs cell timer reset-retries 3 gprs cell timer suspend-timer 10 gprs cell timer suspend-retries 3 gprs cell timer resume-timer 10 gprs cell timer resume-retries 3 gprs cell timer capability-update-timer 10 gprs cell timer capability-update-retries 3 gprs nsei 101 gprs ns timer tns-block 3 gprs ns timer tns-block-retries 3 gprs ns timer tns-reset 3 gprs ns timer tns-reset-retries 3 gprs ns timer tns-test 30 gprs ns timer tns-alive 3 gprs ns timer tns-alive-retries 10 gprs nsvc 0 nsvci 101 gprs nsvc 0 local udp port 23000 gprs nsvc 0 remote udp port 23000 gprs nsvc 0 remote ip 127.0.0.2 gprs nsvc 1 nsvci 0 gprs nsvc 1 local udp port 0 gprs nsvc 1 remote udp port 0 gprs nsvc 1 remote ip 0.0.0.0 no force-combined-si trx 0 rf_locked 0 arfcn 74 nominal power 0 rsl e1 tei 0 timeslot 0 phys_chan_config CCCH+SDCCH4 hopping enabled 0 timeslot 1 phys_chan_config TCH/F hopping enabled 0 timeslot 2 phys_chan_config TCH/F hopping enabled 0 timeslot 3 phys_chan_config TCH/F hopping enabled 0 timeslot 4 phys_chan_config TCH/F hopping enabled 0 timeslot 5 phys_chan_config TCH/F hopping enabled 0 timeslot 6 phys_chan_config TCH/F hopping enabled 0 timeslot 7 phys_chan_config TCH/F hopping enabled 0 trx 1 rf_locked 0 arfcn 65 nominal power 0 rsl e1 tei 0 timeslot 0 phys_chan_config CCCH+SDCCH4 hopping enabled 0 timeslot 1 phys_chan_config TCH/F hopping enabled 0 timeslot 2 phys_chan_config TCH/F hopping enabled 0 timeslot 3 phys_chan_config TCH/F hopping enabled 0 timeslot 4 phys_chan_config TCH/F hopping enabled 0 timeslot 5 phys_chan_config TCH/F hopping enabled 0 timeslot 6 phys_chan_config TCH/F hopping enabled 0 timeslot 7 phys_chan_config TCH/F hopping enabled 0 mncc-int default-codec tch-f fr default-codec tch-h amr nitb subscriber-create-on-demand subscriber-create-on-demand random 100000 199999 no assign-tmsi smpp local-tcp-ip 127.0.0.1 2776 system-id password policy closed smpp-first esme root password password default-route Thank you. Sonny

4 5

How to 'POWERON' the osmo-trx
by cruise 11 May '20

11 May '20

hello: I installed the osmo-NITB on ubuntu18.04, including osmo-trx,osmo-bts,and openbsc. The following is the print messages when these three applications start up. *1.osmo-trx* $ sudo osmo-trx-uhd -C osmo-trx-usrp_b200.cfg Info: SSE3 support compiled in and supported by CPU Info: SSE4.1 support compiled in and supported by CPU Tue May 5 12:36:27 2020 DLGLOBAL <0007> telnet_interface.c:104 Available via telnet 127.0.0.1 4237 Tue May 5 12:36:27 2020 DLCTRL <000e> control_if.c:911 CTRL at 127.0.0.1 4236 Tue May 5 12:36:27 2020 DMAIN <0000> osmo-trx.cpp:484 [tid=139758118945664] Config Settings Log Level............... 0 Device args............. TRX Base Port........... 5700 TRX Address............. 127.0.0.1 GSM BTS Address......... 127.0.0.1 Channels................ 1 Tx Samples-per-Symbol... 4 Rx Samples-per-Symbol... 4 EDGE support............ 0 Extended RACH support... 0 Reference............... 1 Filler Burst Type....... Empty bursts Filler Burst TSC........ 0 Filler Burst RACH Delay. 0 Multi-Carrier........... 0 Tuning offset........... 0 RSSI to dBm offset...... 28 Swap channels........... 0 Tx Antennas............. '<default>' Rx Antennas............. '<default>' Tue May 5 12:36:27 2020 DMAIN <0000> osmo-trx.cpp:438 [tid=139758118945664] Setting SCHED_RR priority 18 Tue May 5 12:36:27 2020 DDEVDRV <0006> log.cpp:460 [tid=139758008424192] [UHD] linux; GNU C++ version 7.4.0; Boost_106501; UHD_3.14.0.HEAD-0-g6875d061 Tue May 5 12:36:27 2020 DDEV <0005> UHDDevice.cpp:470 [tid=139758118945664] Using discovered UHD device type=b200,name=Lab_B210,serial=86680AA,product=B210 Tue May 5 12:36:28 2020 DDEVDRV <0006> b200_impl.cpp:386 [tid=139758008424192] [B200] Detected Device: B210 Tue May 5 12:36:29 2020 DDEVDRV <0006> b200_iface.cpp:441 [tid=139758008424192] [B200] Loading FPGA image: /home/cruise/openBSC/osmo-trx/usrp_b210_fpga.bin... Tue May 5 12:36:45 2020 DDEVDRV <0006> b200_impl.cpp:433 [tid=139758008424192] [B200] Operating over USB 3. Tue May 5 12:36:45 2020 DDEVDRV <0006> b200_impl.cpp:484 [tid=139758008424192] [B200] Detecting internal GPSDO.... Tue May 5 12:36:46 2020 DDEVDRV <0006> gps_ctrl.cpp:253 [tid=139758008424192] [GPS] No GPSDO found Tue May 5 12:36:46 2020 DDEVDRV <0006> b200_impl.cpp:587 [tid=139758008424192] [B200] Initialize CODEC control... Tue May 5 12:36:46 2020 DDEVDRV <0006> b200_impl.cpp:650 [tid=139758008424192] [B200] Initialize Radio control... Tue May 5 12:36:46 2020 DDEVDRV <0006> b200_impl.cpp:957 [tid=139758008424192] [B200] Performing register loopback test... Tue May 5 12:36:46 2020 DDEVDRV <0006> b200_impl.cpp:966 [tid=139758008424192] [B200] Register loopback test passed Tue May 5 12:36:46 2020 DDEVDRV <0006> b200_impl.cpp:957 [tid=139758008424192] [B200] Performing register loopback test... Tue May 5 12:36:46 2020 DDEVDRV <0006> b200_impl.cpp:966 [tid=139758008424192] [B200] Register loopback test passed Tue May 5 12:36:46 2020 DDEVDRV <0006> b200_impl.cpp:758 [tid=139758008424192] [B200] Setting master clock rate selection to 'automatic'. Tue May 5 12:36:46 2020 DDEVDRV <0006> b200_impl.cpp:1013 [tid=139758008424192] [B200] Asking for clock rate 16.000000 MHz... Tue May 5 12:36:46 2020 DDEVDRV <0006> b200_impl.cpp:1024 [tid=139758008424192] [B200] Actually got clock rate 16.000000 MHz. Tue May 5 12:36:47 2020 DMAIN <0000> UHDDevice.cpp:211 [tid=139758118945664] Antennas configured successfully Tue May 5 12:36:47 2020 DDEVDRV <0006> multi_usrp.cpp:502 [tid=139758008424192] [MULTI_USRP] Setting master clock rate selection to 'manual'. Tue May 5 12:36:47 2020 DDEVDRV <0006> b200_impl.cpp:1013 [tid=139758008424192] [B200] Asking for clock rate 26.000000 MHz... Tue May 5 12:36:47 2020 DDEVDRV <0006> b200_impl.cpp:1024 [tid=139758008424192] [B200] Actually got clock rate 26.000000 MHz. Tue May 5 12:36:47 2020 DDEV <0005> UHDDevice.cpp:275 [tid=139758118945664] Rates configured for B210 4 SPS Tue May 5 12:36:47 2020 DDEV <0005> UHDDevice.cpp:235 [tid=139758118945664] Supported Tx gain range [0; 89.75] Tue May 5 12:36:47 2020 DDEV <0005> UHDDevice.cpp:240 [tid=139758118945664] Supported Rx gain range [0; 76] Tue May 5 12:36:47 2020 DDEV <0005> UHDDevice.cpp:244 [tid=139758118945664] Default setting Tx gain for channel 0 to 44.875 Tue May 5 12:36:47 2020 DDEV <0005> UHDDevice.cpp:251 [tid=139758118945664] Default setting Rx gain for channel 0 to 38 Tue May 5 12:36:47 2020 DDEV <0005> UHDDevice.cpp:569 [tid=139758118945664] Device configuration: Single USRP: Device: B-Series Device Mboard 0: B210 RX Channel: 0 RX DSP: 0 RX Dboard: A RX Subdev: FE-RX2 TX Channel: 0 TX DSP: 0 TX Dboard: A TX Subdev: FE-TX2 Tue May 5 12:36:47 2020 DMAIN <0000> osmo-trx.cpp:532 [tid=139758118945664] -- Transceiver active with 1 channel(s) *_/when the osmo-bts-trx launched later, the following messages will arise, shows that the osmo-trx received the 'POWEROFF' command and feed back the 'RESPONSE' to osmo-bts-trx./_* Tue May 5 12:42:44 2020 DTRXCTRL <0002> Transceiver.cpp:832 [tid=139758118945664][chan=0] command is 'POWEROFF' Tue May 5 12:42:44 2020 DTRXCTRL <0002> Transceiver.cpp:977 [tid=139758118945664][chan=0] response is 'RSP POWEROFF 0' ** *_/POWERON command was not launched. and the USRP TX/RX LED was not lighted./_* *2.osmo-bts-trx* $ sudo osmo-bts-trx ((*)) | / \ OsmoBTS <0017> control_if.c:911 CTRL at 127.0.0.1 4238 <0010> telnet_interface.c:104 Available via telnet 127.0.0.1 4241 <0012> input/ipaccess.c:1024 enabling ipaccess BTS mode, OML connecting to 192.168.122.1:3002 <000b> trx_if.c:1174 phy0.0: Open transceiver ** *_/About one minutes later, the osmo-bts-trx will exit automatically, and the following messages was printed./_* <0012> e1_input.c:243 abis_sendmsg: msg->dst == NULL: 0c 12 01 90 0f 00 c8 <0012> e1_input.c:243 abis_sendmsg: msg->dst == NULL: 0c 12 01 88 12 06 00 00 00 00 00 00 <000d> abis.c:143 Signalling link down <0001> bts.c:293 Shutting down BTS 0, Reason Abis close Shutdown timer expired *3. osmo-nitb* $ sudo osmo-nitb -c osmo-nitb-ipa.cfg <001e> telnet_interface.c:104 Available via telnet 127.0.0.1 4242 <0020> input/ipaccess.c:985 enabling ipaccess BSC mode on 0.0.0.0 with OML 3002 and RSL 3003 TCP ports <0025> control_if.c:911 CTRL at 127.0.0.1 4249 DB: Database initialized. DB: Database prepared. In a word, the hardware USRP TX/RX LED has not been lighted, it seems not work. How to poweron it?

4 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC May 2020