Hi!
I've started a page documenting the ip.access A-bis over IP protocol at
https://bs11-abis.gnumonks.org/trac/wiki/nanoBTS
There are no NDA problems with it, since all information was derived from
looking at packet traces. I do not have access to any protocol documentation
from ip.access.
Regards,
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi!
This seems to solve the mystery that zecke and me experienced yesterday
working with the B-Channels on mISDN.
Regards,
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hello Bjoern,
> Can't get logged in to the LMT.
> It asks for a password (cambio menu).
> "L3proc" isn't working...
This is not the LMT COM Port, you have plugged the cable into
the wrong port. Besides the LMT COM port, which is close to the
E1 BNC connectors, there are several other COM ports which are
directly routed to the various microcontrollers. There are some
simple debug menues active during startup, but on the LMT port
you won't get any reply without sending the correct message first.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hi!
I was trying to get the data model right for the TRAU mux/demux handling,
and discovered it is about time to re-do the entire 'input' side, i.e.
the interface towards the actual E1 link.
The main objectives are:
1) ability to deal with multiple BTS on one E1 link
2) ability to easily integrate E1 drivers != mISDN, e.g. zaptel while
still keeping most of the E1 related functionality in common code
3) ability to easily add things like Abis over IP later
So please stay tuned for some potentially quite big committs in that area during
the next couple of days.
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi!
JFYI: Software load through the A-bis / E1 interface is only marginally
faster than through the serisal RS232 line.
The theoretical maximum speed is the 64kbps of the E1 timeslot, which should give quite a bit of improvement over the 19200bps serial line.
However, the BS-11 is throttling down the transver even via A-bis. I have
tried to increase the window size to 20 (LMT has a max of 8. I tried up to 32
but then the transfer fails)
The speed that I'm getting now is somewhere around 1232 bytes per second, which
is about 9656bps. Do they use a 9600bps serial line somewhere inside the
BS-11 to route those software updates through?
I haven't finished an entire transfer, but it seems like the transfer would
take some 36 minutes using this method. Not too far off the 45minutes
that we get with LMT or bs11_config.
I guess "in the field" this doesn't really matter since they can install
the software image while the BTS is still in operation, and then at some
point schedule a reboot which activates the new software.
p.s.: yes, I removed all delays (usleep calls) from misdn.c before testing.
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi!
Just a quick update on bs11_config, the program used for BS-11 configuration
over a serial line.
I have now
* successfully loaded SMU safety and software (SWL) from regular files
in the filesystem (not as easy since BS-11 firmware comes as multiple
files that need to be loaded consecutively)
* created all objects required for minimal config,
including TRX1/PA1 activation
* display the A-bis/T link state, phase/subphase and MBBCU status
from bs11_config
Furthermore, I have added abis_nm functions to
* set the A-bis external time (important for getting correct timestamps
for alarms)
* obtain the BS-11 serial number (as printed on the case).
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hello Holger,
> Couldn't we use a GNU-Radio combined with the GSM-HF-RX? We had a
> student research project which used that with Wireshark. I think I could
> borrow it for a few days and sniff some stuff at our lab. Just tell me
> what sequences you need.
You mean the USRP ? As far as I know its no big problem to save the
raw RF data with it but there is no easy-to-use software yet to get
nice traces from those data (e.g. extract all the different channels
like BCCH, CCCH and so on) which for example could be used to see the
messages between the BTS and the phone. I am not interested in the
traffic (speech or data), just the signaling on the Air-Interface would
be nice to have. But lets see what the future brings, projects like
airprobe.org might fill this gap.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hello Holger,
> If you need some help in the near future (as soon our equipment arrives,
> orders left the building today... or at least they should): we have full
> equipped and licensed GSM-E1-Analyzers. I think we can provide some
> traces if required (I know that Harald has shoot an ELMI-Abis-Analyzer
> at EBay, just for notice).
Good to know that. What about a GSM Analyzer for the Air Interface :-) ?
In the moment ISDN E1 traces are not that important because its under
control of OpenBSC anyway. The traces of the Siemens specific configuration
commands were done on the RS232 interface of the BS-11, the configuration
software under NDA uses RS232 only, at least I don't have any other
BS-11 specific software which uses the ISDN interface.
I anyone has access to a real GSM Abis Interface and can provide traces
of a working network this could be very interesting to have a look at.
And for tracing the GSM air inteface with cheap equipment, well, lets
hope that we can get something for that in the future...
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hello Holger,
The following is what I can say, Harald might add more or correct me:
On Mon, 19 Jan 2009 10:15:17 +0100, "Holger Adams" <holger(a)kernreaktor.org> wrote:
>
> as we all know, the documentation of the BS-11 is under NDA. Harald
> said, the BTS respects 99.9% of the A-bis 3GPP standardization. So my
> questions are:
>
> 1) What's the part of the 0.1% we don't know? Which part differs from
> the specs?
There are Siemens specific commands for configuring the BS-11. They
are not documented and also not included in the NDA documentation.
The important commands are however going to become part of OpenBSC.
Harald is currently working on a tool for configuring the BS-11,
it is based on analyzing what the configuration tool (under NDA)
is sending over the wire. So you will most certainly find all the
required information in OpenBSC soon.
> 2) During the 25c3 talk there was mentioned that the BTS uses ~6 DSPs
> and a bunch of uCs. What kind of DSPs and uCs are used (well Siemens...
> I guess some creepy 8051/C16x/... and Motorola stuff)?
Its nothing from the more common stuff. The microcontrollers are
from the HPC family from National Semiconductor, the DSPs are from
the DSP16 family from Lucent. My guess is that the HPC was mainly used
in the telcommunication area, for the DSP16 there was at least one
more common analog modem around which uses it.
BTW, the information about the microcontrollers and the DSPs is also
not contained in the NDA documentation, so this is no secret what I
am writing here.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
