OpenBSC

openbsc@lists.osmocom.org

1 participants
4319 discussions

ip.access protocol reverse engineering
by Harald Welte 13 Feb '09

13 Feb '09

Hi! I've started a page documenting the ip.access A-bis over IP protocol at https://bs11-abis.gnumonks.org/trac/wiki/nanoBTS There are no NDA problems with it, since all information was derived from looking at packet traces. I do not have access to any protocol documentation from ip.access. Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

mISDN/socket API, B channels and select()
by Harald Welte 10 Feb '09

10 Feb '09

Hi! This seems to solve the mystery that zecke and me experienced yesterday working with the B-Channels on mISDN. Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Re: L3proc login password
by Dieter Spaar 06 Feb '09

06 Feb '09

Hello Bjoern, > Can't get logged in to the LMT. > It asks for a password (cambio menu). > "L3proc" isn't working... This is not the LMT COM Port, you have plugged the cable into the wrong port. Besides the LMT COM port, which is close to the E1 BNC connectors, there are several other COM ports which are directly routed to the various microcontrollers. There are some simple debug menues active during startup, but on the LMT port you won't get any reply without sending the correct message first. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

1 0

L3proc login password
by Bjoern Heller 06 Feb '09

06 Feb '09

Hi, Can't get logged in to the LMT. It asks for a password (cambio menu). “L3proc” isn't working... tec - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Björn Heller Jabber: tec(a)jabber.hellercom.de

1 0

major rework on the misdn / input plugin side
by Harald Welte 03 Feb '09

03 Feb '09

Hi! I was trying to get the data model right for the TRAU mux/demux handling, and discovered it is about time to re-do the entire 'input' side, i.e. the interface towards the actual E1 link. The main objectives are: 1) ability to deal with multiple BTS on one E1 link 2) ability to easily integrate E1 drivers != mISDN, e.g. zaptel while still keeping most of the E1 related functionality in common code 3) ability to easily add things like Abis over IP later So please stay tuned for some potentially quite big committs in that area during the next couple of days. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

software load via A-bis
by Harald Welte 02 Feb '09

02 Feb '09

Hi! JFYI: Software load through the A-bis / E1 interface is only marginally faster than through the serisal RS232 line. The theoretical maximum speed is the 64kbps of the E1 timeslot, which should give quite a bit of improvement over the 19200bps serial line. However, the BS-11 is throttling down the transver even via A-bis. I have tried to increase the window size to 20 (LMT has a max of 8. I tried up to 32 but then the transfer fails) The speed that I'm getting now is somewhere around 1232 bytes per second, which is about 9656bps. Do they use a 9600bps serial line somewhere inside the BS-11 to route those software updates through? I haven't finished an entire transfer, but it seems like the transfer would take some 36 minutes using this method. Not too far off the 45minutes that we get with LMT or bs11_config. I guess "in the field" this doesn't really matter since they can install the software image while the BTS is still in operation, and then at some point schedule a reboot which activates the new software. p.s.: yes, I removed all delays (usleep calls) from misdn.c before testing. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

bs11_config update
by Harald Welte 01 Feb '09

01 Feb '09

Hi! Just a quick update on bs11_config, the program used for BS-11 configuration over a serial line. I have now * successfully loaded SMU safety and software (SWL) from regular files in the filesystem (not as easy since BS-11 firmware comes as multiple files that need to be loaded consecutively) * created all objects required for minimal config, including TRX1/PA1 activation * display the A-bis/T link state, phase/subphase and MBBCU status from bs11_config Furthermore, I have added abis_nm functions to * set the A-bis external time (important for getting correct timestamps for alarms) * obtain the BS-11 serial number (as printed on the case). -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Re: Documentation of the BS-11 - what do we know?
by Dieter Spaar 21 Jan '09

21 Jan '09

Hello Holger, > Couldn't we use a GNU-Radio combined with the GSM-HF-RX? We had a > student research project which used that with Wireshark. I think I could > borrow it for a few days and sniff some stuff at our lab. Just tell me > what sequences you need. You mean the USRP ? As far as I know its no big problem to save the raw RF data with it but there is no easy-to-use software yet to get nice traces from those data (e.g. extract all the different channels like BCCH, CCCH and so on) which for example could be used to see the messages between the BTS and the phone. I am not interested in the traffic (speech or data), just the signaling on the Air-Interface would be nice to have. But lets see what the future brings, projects like airprobe.org might fill this gap. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

2 1

Re: Documentation of the BS-11 - what do we know?
by Dieter Spaar 19 Jan '09

19 Jan '09

Hello Holger, > If you need some help in the near future (as soon our equipment arrives, > orders left the building today... or at least they should): we have full > equipped and licensed GSM-E1-Analyzers. I think we can provide some > traces if required (I know that Harald has shoot an ELMI-Abis-Analyzer > at EBay, just for notice). Good to know that. What about a GSM Analyzer for the Air Interface :-) ? In the moment ISDN E1 traces are not that important because its under control of OpenBSC anyway. The traces of the Siemens specific configuration commands were done on the RS232 interface of the BS-11, the configuration software under NDA uses RS232 only, at least I don't have any other BS-11 specific software which uses the ISDN interface. I anyone has access to a real GSM Abis Interface and can provide traces of a working network this could be very interesting to have a look at. And for tracing the GSM air inteface with cheap equipment, well, lets hope that we can get something for that in the future... Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

2 1

Re: Documentation of the BS-11 - what do we know?
by Dieter Spaar 19 Jan '09

19 Jan '09

Hello Holger, The following is what I can say, Harald might add more or correct me: On Mon, 19 Jan 2009 10:15:17 +0100, "Holger Adams" <holger(a)kernreaktor.org> wrote: > > as we all know, the documentation of the BS-11 is under NDA. Harald > said, the BTS respects 99.9% of the A-bis 3GPP standardization. So my > questions are: > > 1) What's the part of the 0.1% we don't know? Which part differs from > the specs? There are Siemens specific commands for configuring the BS-11. They are not documented and also not included in the NDA documentation. The important commands are however going to become part of OpenBSC. Harald is currently working on a tool for configuring the BS-11, it is based on analyzing what the configuration tool (under NDA) is sending over the wire. So you will most certainly find all the required information in OpenBSC soon. > 2) During the 25c3 talk there was mentioned that the BTS uses ~6 DSPs > and a bunch of uCs. What kind of DSPs and uCs are used (well Siemens... > I guess some creepy 8051/C16x/... and Motorola stuff)? Its nothing from the more common stuff. The microcontrollers are from the HPC family from National Semiconductor, the DSPs are from the DSP16 family from Lucent. My guess is that the HPC was mainly used in the telcommunication area, for the DSP16 there was at least one more common analog modem around which uses it. BTW, the information about the microcontrollers and the DSPs is also not contained in the NDA documentation, so this is no secret what I am writing here. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC