- OpenBSC - lists.osmocom.org

Phones jumping ship from commercial networks to test network
by Mychaela Falconia 24 Jan '23

24 Jan '23

Hello GSM community, I have a question for those who operate their own GSM networks (be it for fun or for research or for any other purpose) in places that DO have regular commercial cell service, i.e., NOT ship-at-sea, middle of desert or Rhizomatica-type environments: how do you deal with, and ideally prevent, the highly undesirable situation of other people's phones, not related to your operation, "jumping ship" from being registered to their regular commercial network to trying to register to your test network instead? I live and operate in an area where ONE commercial operator still provides GSM/2G service (although only to "grandfathered" customers, closed to new subscribers), plus there are super-strong 4G and 5G signals from all 3 USA-wide carriers. I also operate my own "pirate" GSM network on a test/experimental basis, meaning not always on, but only turned on for brief intervals when I am playing with it. When I do turn on my test GSM network, I squat on an ARFCN in the middle of a 5 MHz wide "dead" spot (SA shows noise floor over the whole 5 MHz block in question), and most of the time I set my power output to the lowest possible setting: I set max_power_red to the maximum of 20, which should result in 3 dBm output from the sysmoBTS box. I also recently changed my MCC-MNC from 310-222 (an unallocated MNC within MCC 310) to 001-325 (MCC meaning test network, MNC is a feeble attempt to indicate that it's me - I got 00440325 as my test IMEI range in my "other" capacity as ME manuf), but the problematic behaviour of at least some phones erratically "jumping ship" from T-Mobile GSM to the test network still occurs. Here is a concrete example of inexplicable erratic behaviour I am seeing: * Last night I powered up my test network at around 19:41 local time. My wife was with me the whole evening; her primary personal phone is Nokia C3-00 (circa 2011, late in GSM terms, but still 2G-only in terms of RAN support) with service on T-Mobile. * About 3.5 hours later, at around 23:14 local time, my wife noticed that her phone "went into the black hole" (our term for times when phones show "no service" even though T-Mobile GSM signal is there just fine), and she alerted me. I looked at OsmoCNI logs in syslog, and I saw that just a little earlier, at around 22:38 local time, there was an attempt from my wife's phone (her T-Mobile IMSI) to register to our test network. Of course that registration attempt failed - I don't have a roaming agreement with T-Mobile, there is no MAP roaming support in OsmoCNI, I don't have any T-Mobile or other operators' IMSIs in my OsmoHLR, and I am NOT running with "create sub on demand" feature. * At around 23:14 local time, when my wife noticed that her phone went into the black hole, she immediately proceeded to reboot it - such reflexive reboots are now an "autopilot" action for her - and on its next boot cycle, it immediately proceeded to make another attempt to register to our test network instead of T-Mobile, as evidenced by OsmoCNI logs! * At that point I turned off the test network GSM signal, as there did not appear to be any other way to convince my wife's Nokia phone to go back to its rightful network of T-Mobile. Now let me add some noteworthy details: * The ARFCN on which I squat for my test network is NOT listed in the neighbor cell list advertised by the sole and single commercial GSM/2G operator we have around here. * When I mentioned this issue previously in an OsmoDevCall USSE, I was asked if perhaps the ARFCN I squat on might be listed as a 2G neighbor in the neighbor list of some newer-G cell. I don't have any direct way to disprove this idea, but my wife's phone, the one that exhibits this inexplicable behaviour, is a 2G-only model, NOT supporting LTE or even UMTS. And the last 3G/UMTS service in our area was shut down last summer, leaving only LTE+5G for the masses and GSM for the tiny sliver of "grandfathered" users who won't give it up until we die. * In last night's episode, my wife's phone sat quite happily within our dwelling, mere meters from the sysmoBTS antenna putting out its 3 dBm, for almost 3 hours before it made its first attempt to jump ship. During the entirely of this almost-3-hours interval, the signal from our test network as received by the phone was overwhelmingly stronger than the commercial signal (being meters away from the BTS), yet the phone behaved like it should (listened to its serving cell and advertised neighbor cells, no searching around) for almost 3 h. * The location update interval set by T-Mobile's network is 1 hour - thus periodic LU could not have been the trigger that told Nokia's bugger to abandon its serving cell and go into open-ended search of all possible ARFCNs. So what in the world could have been the trigger then, that caused the bugger to misbehave after almost 3 hours of behaving properly and correctly? * Aside from whatever the trigger might be, once that Nokia bugger attempts to register to the test GSM network and fails, why in the bloody hell is it not going back to the weaker (in terms of RSSI) but working T-Mobile network, why does it "park" itself in no-service state instead? I have heard of other people operating test GSM cells/networks in areas where commercial services do exist: I have heard that Neels, of Sysmocom team, operates a test cell under a test license, and when Keith gave an OsmoDevCall presentation on Rhizomatica back in 2021, that presentation was done from an office in some "big" city in Oaxaca, a place where test signals had to coexist peacefully with commercial operators' signals. So how do you guys do it? What additional magic are you doing, which I must be missing, to prevent the situation of phones jumping ship from commercial networks to the test network when the signal from the test network is much stronger due to proximity? Perplexed, Mother Mychaela

2 2

GCR (osmo_store16be/osmo_store32be)
by Keith 19 Jan '23

19 Jan '23

Hi All, I was working a few months back on some LCLS implementation with bts-loop and I got it working, including that the pbx can use SIP Re-INVITES to get in and out of the audio loop during calls. However, I only ever tested it with one call, that is with two phones. When I tested it on alive site, immediately there where problems so I reverted and left it. Looking at it again now, there's a very obvious problem which is that osmo-msc generates the same GCR for (almost) every call. I had noticed this before but for some reason I thought I had seen it generating different GCR for a second simultaneous call, but no. Anyway, the above is extraneous info to the question: Could somebody take a look at this: https://gitea.osmocom.org/cellular-infrastructure/osmo-msc/src/branch/maste… where we have: osmo_store32be(trans->callref, lcls->gcr.cr); osmo_store16be(use_lac ? trans->msc_a->via_cell.lai.lac : trans->msc_a->via_cell.cell_identity, lcls->gcr.cr + 3); Now, If I change the order, such that would seem logical: osmo_store16be(use_lac ? trans->msc_a->via_cell.lai.lac : trans->msc_a->via_cell.cell_identity, lcls->gcr.cr + 3); osmo_store32be(trans->callref, lcls->gcr.cr); Then I get a different GCR, reflecting the trans->callref for each call. But am I then maybe overwriting the LAC/CI ? Would seem to make sense, but I'm just not sure if that is all there is to it, as I don't really grok osmo_store_xxxx for(i = 0; i < n; q[i] = (x >> ((n - 1 - i) * 8)) & 0xFF, i++); Is it just a simple order error, and is everything OK with lcls->gcr.cr + 3 as the pointer *p passed to osmo_store32be_ext() ? given that: struct osmo_lcls *lcls; where: struct osmo_lcls { struct osmo_gcr_parsed gcr; }; struct osmo_gcr_parsed { uint8_t cr[5]; }; I guess I'm still not really 100% on the char/uint8_t thing and advancing pointers. Thanks! k.

2 2

OsmoDevCall on Jan 18, 2023: ice40-usbtrace OSHW USB protocol tracer
by Harald Welte 17 Jan '23

17 Jan '23

Dear Osmocom community, we're happy to announce the next incarnation of OsmoDevCall. when: January 18, 2023 at 20:00 CET where: https://osmocom.org/OsmoDevCall This time, @tnt will be presenting on ice40-usbtrace OSHW USB protocol tracer In case you never heard about ice40-usbtrace before: It's a low-cost full-speed USB protocol tracer built around the iCE40 FPGA. This meeting will have the following schedule: 20:00 meet + greet 20:10 presentation as outlined above 21:00 unstructured supplementary social event [*] Attendance is free of charge and open to anyone with an interest in Osmocom or open source cellular technologies. More information about OsmoDevCall, including the schedule for further upcoming events can be found at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCall Looking forward to meeting you soon! Best regards, Harald [*] this is how we started to call the "unstructured" part of osmocom developer conferences in the past, basically where anyone can talk about anything, no formal schedule or structure. -- - Harald Welte <laforge(a)osmocom.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Distributed GSM
by Keith 17 Jan '23

17 Jan '23

Hi all, I was thinking about how to deal with the so called "evil twins" in the distributed hlr, and also how to have a subscriber-create-on-demand situation at the same time as a having an mslookup client. The problem being that if we have mslookup client + fallback to create-on-demand if no HLR responds for an IMSI, we will eventually create a duplicate because the HLR that owns the IMSI is not contactable at the time of an IMSI ATTACH attempt. Anyway, just in terms of investigating the situation on my HLRs, I added features [1] - so far, an ability to do a gsup.hlr lookup and not exit on the first age:0 - so that I can see all HLRs that respond as having the imsi in local HLR, and also to ask via mDNS for HLRs that have an IMSI, but only if it's active on that HLR, that is, it has nam_cs/nam_ps So this is really asking about what people feel about expanding the D-GSM features in osmo-hlr, as I think it may be the case that rhizomatica/TIC are the only people that use it? [1] https://gitlab.tic-ac.org/rhizomatica/osmo-hlr

2 1

Soapymultisdr
by Lanea Lucy 26 Dec '22

26 Dec '22

Hi, is it possible to use soapyMultiSdr for osmo-trx? I have a hackrf one, which isn't full duplex, so my idea is to use the hackrf for tx, and something else for Rx. With soapymultisdr it is possible to use multiple devices as a single soapysdr device.

2 1

SGSNemu performance
by Sipos Csaba 25 Dec '22

25 Dec '22

Dear Harald, Sorry to spam the openbsc list with this, but if you (or someone) can confirm if the Sgsn-emu part of Osmo-GGSN utilizing the kernel GTP module or not, that would be lovely. FYI, I was not able to pass more than 280Mbit and the sgsn-emu process was maxing out a single core. Based on this I suspect that it does not use the kernel GTP module. I have seen some commits that indicates preparation work for this feature, but it is unclear at least to me, if this was finished or not. In the Osmo-GGSN.cfg example config I can see the config option for kernel GTP, but not in the sgsn-emu.cfg example. Regards, Csaba

3 3

Re: OpenBSC Digest, Vol 98, Issue 9
by Sipos Csaba 25 Dec '22

25 Dec '22

Hi Pau and Harald, > So sgsnemu is passing use_kernel=false, which makes the lib skip gtp-kernel functions That is nice, I can play with that part quite nicely and take a look how the GGSN handles the switch between kernel and non-kernel GTP. Thanks for that! @Harald: In gtpnl.h there is int gtp_dev_create() and int gtp_dev_create_sgsn() So it seems there is a different dev create for the SGSN mode. And in the later one the role is set to "GTP_ROLE_SGSN" int gtp_dev_create(int dest_ns, const char *gtp_ifname, int fd0, int fd1) { return _gtp_dev_create(dest_ns, gtp_ifname, fd0, fd1, GTP_ROLE_GGSN); } EXPORT_SYMBOL(gtp_dev_create); int gtp_dev_create_sgsn(int dest_ns, const char *gtp_ifname, int fd0, int fd1) { return _gtp_dev_create(dest_ns, gtp_ifname, fd0, fd1, GTP_ROLE_SGSN); } EXPORT_SYMBOL(gtp_dev_create_sgsn); I just need to find the relevant part is sgsn-emu to see where these parts are invoked so I can make the modifications. Regards, Csaba <openbsc-request(a)lists.osmocom.org> ezt írta (időpont: 2022. dec. 24., Szo, 13:00): > > Send OpenBSC mailing list submissions to > openbsc(a)lists.osmocom.org > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > openbsc-request(a)lists.osmocom.org > > You can reach the person managing the list at > openbsc-owner(a)lists.osmocom.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of OpenBSC digest..." > > Today's Topics: > > 1. Re: SGSNemu performance (Pau Espin Pedrol) > 2. Re: SGSNemu performance (Harald Welte) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 23 Dec 2022 18:38:55 +0100 > From: Pau Espin Pedrol <pespin(a)sysmocom.de> > Subject: Re: SGSNemu performance > To: Sipos Csaba <dchardware(a)gmail.com>, > "openbsc-request(a)lists.osmocom.org" <openbsc(a)lists.osmocom.org>, > laforge(a)osmocom.org > Message-ID: <782d5c68-0393-e63a-ddbd-a78ca04256e0(a)sysmocom.de> > Content-Type: text/plain; charset=UTF-8; format=flowed > > Hi Csaba, > > > > On 12/22/22 15:00, Sipos Csaba wrote: > > Dear Harald, > > > > Sorry to spam the openbsc list with this, but if you (or someone) can > > confirm if the Sgsn-emu part of Osmo-GGSN utilizing the kernel GTP > > module or not, that would be lovely. > > sgsnemu is not using the kernel module, only osmo-ggsn has support for > it so far. > > See osmo-ggsn.git/./sgsnemu/sgsnemu.c line 1905 calling: > """ > if (tun_new((struct tun_t **)&tun, options.tun_dev_name, false, -1, -1)) > """ > > See tun_new() function used by both osmo-ggsn and sgsnemu: > """ > int tun_new(struct tun_t **tun, const char *dev_name, bool use_kernel, > int fd0, int fd1u) { > """ > > So sgsnemu is passing use_kernel=false, which makes the lib skip > gtp-kernel functions like gtp_kernel_create(). > > > > > FYI, I was not able to pass more than 280Mbit and the sgsn-emu process > > was maxing out a single core. Based on this I suspect that it does not > > use the kernel GTP module. I have seen some commits that indicates > > preparation work for this feature, but it is unclear at least to me, > > if this was finished or not. In the Osmo-GGSN.cfg example config I can > > see the config option for kernel GTP, but not in the sgsn-emu.cfg > > example. > > > > You could try passing use_kernel=true to tun_new(), and see how far you > can get. Patches welcome. > > Regards, > Pau > > > -- > - Pau Espin Pedrol <pespin(a)sysmocom.de> http://www.sysmocom.de/ > ======================================================================= > * sysmocom - systems for mobile communications GmbH > * Alt-Moabit 93 > * 10559 Berlin, Germany > * Sitz / Registered office: Berlin, HRB 134158 B > * Geschaeftsfuehrer / Managing Director: Harald Welte > > ------------------------------ > > Message: 2 > Date: Fri, 23 Dec 2022 18:47:57 +0100 > From: Harald Welte <laforge(a)gnumonks.org> > Subject: Re: SGSNemu performance > To: Pau Espin Pedrol <pespin(a)sysmocom.de> > Cc: Sipos Csaba <dchardware(a)gmail.com>, > "openbsc-request(a)lists.osmocom.org" <openbsc(a)lists.osmocom.org> > Message-ID: <Y6XpzZoYYdVxYKdb@nataraja> > Content-Type: text/plain; charset=us-ascii > > Hi Csaba and Pau, > > On Fri, Dec 23, 2022 at 06:38:55PM +0100, Pau Espin Pedrol wrote: > > You could try passing use_kernel=true to tun_new(), and see how far you can > > get. Patches welcome. > > The GTP kernel module needs to be told if it operates in SGSN or GGSN mode. > > grep for GTP_ROLE_SGSN in libgtpnl. I don't know all of the related functions > off my head, but on the SGSN side you need to make sure to initialize the kernel > GTP with GTP_ROLE_SGSN instead of GTP_ROLE_GGSN. > > -- > - Harald Welte <laforge(a)gnumonks.org> https://laforge.gnumonks.org/ > ============================================================================ > "Privacy in residential applications is a desirable marketing option." > (ETSI EN 300 175-7 Ch. A6) > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > OpenBSC mailing list -- openbsc(a)lists.osmocom.org > To unsubscribe send an email to openbsc-leave(a)lists.osmocom.org > > > ------------------------------ > > End of OpenBSC Digest, Vol 98, Issue 9 > **************************************

1 0

Testing voice calls in OsmoCNI
by Vadim Yanitskiy 10 Dec '22

10 Dec '22

Hi all! Recently in the IRC I brought up a topic of testing voice calls in OsmoCNI, which then turned into a discussion. The problem is I wanted to highlight is that there is currently no *easy* way to test voice calls, especially when running a virtual OsmoRAN setup (fake_trx.py + trxcon or virtphy). == A bit of history == Back in the openbsc/osmo-nitb days I used to run jolly's LCR (Linux Call Router) [1], which was configured to play some hold melody when calling 995, and echo voice frames back when calling 999. Nowadays openbsc/osmo-nitb is obsolete and completely suppressed by the new and shiny OsmoRAN/OsmoCNI stack. The LCR is not actively maintained anymore and does not support the MNCCv8, so it cannot talk to osmo-msc. BTW, I forked it, fixed some compilation errors, created a package, and tried to implement MNCCv8 support (no luck, calls still don't work): https://gitea.osmocom.org/vyanitskiy/lcr/commits/branch/fixeria/fixes https://gitea.osmocom.org/vyanitskiy/lcr/commits/branch/fixeria/mncc https://aur.archlinux.org/packages/lcr-git Looks like it does not support late TCH assignment? [1] http://www.linux-call-router.de/ == Current situation == Currently with the new post-NITB stack I see the following options: a) run a virtual BTS, attach two mobiles, and setup a call between them; b) run a real BTS, attach two phones, and setup a call between them; c) run some PBX, talking to osmo-msc via osmo-sip-connector. Personally I find neither of these options convenient because: a) requires running two instances of the mobile app (from osmocom-bb.git). I know one can run two and even more MS instances in one mobile process, but this is still not handy. b) requires running a real BTS and interacting with real phones. This is what I usually do, but it takes more time than running everything virtually. c) requires setting up a PBX (e.g. Freeswitch, Asterisk), which in its turn requires digging into the new world of configuration files. I do have a repository with a know-to-work Freeswitch configuration [2], but installing it (even from packages) is not trivial. [2] https://people.osmocom.org/fixeria/freeswitch.cfg.zip == What do I want == It would be great to have an easy-to-use echo service, be it attached to osmo-msc via the MNCC socket, or be it built-in part of osmo-msc itself. This would be usable for both real and virtual setups. == Conclusion == I would like to know how do you guys test voice, and what do/would you consider an easy approach. I actually found out that it's possible to use osmo-msc's silent-call feature and play the Uplink RTP stream with osmo-gapk. I'll share more details in a follow up mail. In the IRC @whytek proposed to use sipp [3] and later came up with a wiki page [4] describing how to achieve this with SEMS (SIP Express Media Server). This is definitely easier than setting up Freeswitch or Asterisk, but still feels like an overkill (sorry). [3] https://sipp.sourceforge.net/doc/reference.html#RTP+echo [4] https://osmocom.org/projects/cellular-infrastructure/wiki/Simple_Echo_Server Best regards, Vadim. -- - Vadim Yanitskiy <vyanitskiy at sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschaeftsfuehrer / Managing Director: Harald Welte

4 21

Re: java applet loading on sysmo-isim-sja2
by Johannes Waigel 07 Dec '22

07 Dec '22

I'm also just trying to figure out how it works with global platform. The problem you have with Global Platform is that you have not specified an installation parameter. I tried it for example with "-default -params 80120100140600000000000000000000810600040200000400820600040200000400" and the applet was installed and also made selectable. You can find a discussion about that parameters here: https://github.com/martinpaljak/GlobalPlatformPro/issues/293 I'm looking now why I can't open the menu e.g. from the iPhone. Probably any access rules / directories access still need to be updated here?

1 0

Representing BFI in an RTP stream in FR & EFR modes
by Mychaela Falconia 28 Nov '22

28 Nov '22

Hello GSM community, As I keep working on my project seeking to build a new GSM network that will be no worse in every aspect than the one which T-Mobile USA are itching to shut down, I need a way to ferry the uplink voice stream from the BTS to my "soft TRAU" in RTP transport, but do it in a way that is semantically no-worse than what happens in the traditional T1/E1-based architecture. As part of this no-worse-than-TDM desire or requirement, I need explicit BFI markers - in other words, any time there is a 20 ms window in which there is no good traffic frame to be sent because the uplink is in DTX, because that frame was lost to bad radio conditions or because that frame was stolen for FACCH, I want my BTS to send an explicit BFI frame instead of gapping/pausing the RTP stream. But this "simple and innocent" desire which I just expressed then turns into a perplexing question: just how would one represent an explicit BFI marker in an RTP stream? In the case of AMR codec there is a straightforward solution already provided for in the specs: simply send a NO_DATA frame. But what about FR and EFR codecs? For my own Themyscira Wireless deployment, I currently run with my own non-standard extension to RTP transport format for FR & EFR, documented here: https://www.freecalypso.org/hg/themwi-system-sw/file/tip/doc/RTP-BFI-extens… My solution works great for my purposes, and I am very happy with it. However, in the spirit of seeking at least some unity and at least some chance of patches being merged, I am making a due-diligence attempt to understand how others have addressed similar problems, and what competing solutions may already exist out in the wild. Here is my specific question to the community, mostly the narrower Osmocom community but perhaps also the wider GSM community: where did the idea of an all-zeros frame representing BFI come from? In the current osmo-bts-trx implementation (although not in any other osmo-bts variants that I can see from the code) there is code that sends an FR codec frame of 260 zero bits or an EFR codec frame of 244 zero bits, both intended to signal BFI, under the following conditions: 1) The BFI condition exists for some reason other than the uplink being in DTX, i.e., because the frame was stolen for FACCH or was lost to radio errors, but the last frame was not a SID; and 2) There is no ECU on the channel, or the ECU failed to provide a substitute frame. Irrespective of specific conditions though, the key point is that someone, somewhere, at some point in time had the idea that an FR or EFR codec frame of all zeros (260 or 244 zero bits, respectively) should mean BFI. There is also a patch to gapk by Vadim, adding an FR codec EFU function, that detects a frame of all-zeros and treats it as BFI - but I am not able to tell if the very idea of such BFI representation comes from Vadim, or if Vadim simply added the code to gapk to work with what osmo-bts-trx puts out under certain conditions. To put the question differently: does there exist any spec from ETSI or from 3GPP or from any other non-Osmocom standards body that defines an FR codec frame of 260 all-zero bits and/or an EFR frame of 244 all-zero bits to mean BFI, or is this idea a pure Osmocom invention? The only official specs I could find for coded speech transport within RAN, between a BTS and a separate transcoder, deal with the traditional T1/E1 environment, as in GSM 08.60 and friends. In those specs BFI is signaled out of band: in GSM 08.60 TRAU frames there is a control bit carrying BFI, and another control bit carrying TAF (important for traditional Rx DTX handlers for FR & EFR), both outside of 260 data bits, and there is NO special bit pattern (all zeros or otherwise) within data frame bits themselves that would also signal BFI. Therefore, based on what I see in GSM 08.60 and other specs for T1/E1 world, I get the idea that BFI is meant to be an out-of-band signal, not in-band, and that an in-band bit pattern that signals BFI seems to go against the spirit of ETSI and 3GPP. But maybe the problem is that I was only looking at older specs, maybe there is some newer spec from 3GPP or some other standards body written for the newer world of IP transport that officially repurposes in-band all-zeros FR and EFR codec frames to mean BFI - is there any such spec? Moving from the realm of rhetorical questions to the realm of tangible code, here is my latest creation in the realm of GSM codecs: https://www.freecalypso.org/hg/gsm-codec-lib/ I will make another announcement when this code reaches the level of completeness I am after, but as a short summary, I am making a librified (turned into a library) version of the official EFR codec implementation from ETSI (libgsmefr), and I have also written another library of my own (libgsmfrp) that implements Rx DTX handler functions for GSM FR, to be run as a pre-processor before passing frames to a GSM 06.10 decoder, which is typically gsm_decode() from libgsm. libgsmfrp is already integrated into my "soft TRAU" implementation in themwi-mgw, and libgsmefr will likewise be integrated when it is complete. (Right now only the decoder works in libgsmefr, the encoder remains to be finished.) Both libgsmefr and libgsmfrp have BFI handling functions which the "soft TRAU" application needs to call when it receives a BFI marker instead of a good traffic frame, but the question of how these BFI markers should be represented in an RTP stream is outside the scope of the library - instead my themwi-mgw application currently implements ThemWi RTP-BFI-extension and calls the respective library functions. I may be open to the possibility that I should not be inventing my own RTP-BFI-extension and should instead use in-band frames of all-zeros to represent BFI in FR & EFR, *if* there is some official spec from 3GPP etc saying so - but if that idea is an Osmocom invention rather than 3GPP, then I am going to argue for my invented alternative RTP representation instead. So which is it? With devotion to GSM Forever, (Hasta la Victoria, Siempre,) Mother Mychaela

2 2