- OpenBSC - lists.osmocom.org

WG: BS-11 runs, but no Network on my Mobile

by Andreas.Eversberg

i forgot in send it to the list -----Ursprüngliche Nachricht----- Von: Andreas.Eversberg Gesendet: Freitag, 3. April 2009 12:27 An: 'Dieter Spaar' Betreff: AW: BS-11 runs, but no Network on my Mobile this is an issue i understand. here is my idea on testing it: i derrive clock from my t-com isdn line. the line clock is provided by a gps receiver and transferred via telekom's access hardware to my isdn line. because i talk to it PTP, it keeps up layer1. (the line provides coninuous clock signal.) i will connect a 4 port isdn card to it, to get the clock. this card is interlinked to the E1 card, so the clock is provided to that card. by default, the hfc-e1 card will use crystal clock if card is in NT-mode and clock master. in slave configuration, the clock is provided from pcm interface. i will use an oscilloscope to verify the signal with the received clock on the 4 port isdn card and on the e1 card. line ---> card 1 ----> e1-card | +-> card 2 on my line are two card: both are 4-port isdn cards. the second card provides one clock signal to the oscilloscope, the e1 card provide the second clock signal. so i can proove if the card 1 actually synchronize to the line clock. so, if this works, i will try to use an hfc-pci single port card (cheap) and provide a document on how to link the E1 card to the single port card. only two clocks are required, a frame clock and a bit clock. with the right settings, both clocks are compatible.

15 years, 1 month

1
0
0 0

Re: BS-11 runs, but no Network on my Mobile

by Dieter Spaar

Hello Marcel, On Thu, 02 Apr 2009 22:33:01 +0200, "Marcel Klein" <marcel(a)koeln.ccc.de> wrote: > > Okay, second try didn't work anymore... so the problem still exists. I > even tried 250mW. I received an important hint that the problem is most certainly related to a clock issue. Some background: The BS-11 synchronizes its internal clock to the clock of the E1 line. Its does not have a high stability clock which is needed for GSM. The official networks use a very stable and exact clock, the requirement for a BTS according to GSM 05.10 is +/-0.05 ppm. (There was a variant of the BS-11 sold which had a versatile interface card which can also work with standard ISDN, this variant had an oven controlled oscillator which can run standalone with the required stability. But we don't have any of this BS-11 variant). The phone itself synchronizes its clock from the network it receives. If the phone searches for networks, the carrier search range is limited to a certain window, it will only find a network if the carrier falls inside this window. Now the problem: If the phone is synchronized to an official network and searches for other networks, it will only find them if they are within the search range. No problem for an official network, they use exact timing. However if the BS-11 network is not within the range, its network is not found. When the phone is powered on and not yet synchronized, the search range window is larger, however the phone starts looking at the ARFCNs first which it received the last time when it was registered to a network. So it normally would find an official network first and miss the BS-11 if its is clock is off too far. To confirm this, I run a test with an HP 8922 GSM tester. It can simulate a network and also has a tuneable reference. If I start with a phone registered to an official network, I can only see the HP 8922 network if the refenrence is with about +/- 1 ppm. The same is true the other way round, if I start beeing registered to the HP 8922 network, I can only see the official networks if the reference is within the above range. I used an older Nokia phone for my tests, the range may depend on the phone. If the BS-11 is locked to the E1 clock, its reference is controlled by the oscillator of the E1 card. ISDN timing requirements are not very strict, +/- 50 ppm is good enough. I don't have the datasheet for the oscillator on the HFC-E1 card, probably the clock can be in the range of +/- 20 ppm. Two ideas to solve this: Start at a place were no other network than the BS-11 network can be received (OK, could be difficult ;-). Or write the information of the BS-11 network to the SIM card so that the phone starts receiving the BS-11 ARFCN when powerted on. Basically this information is the cell allocation information in SYSTEM INFORMATION 2 and have to be written to EF_BCCH on the SIM card (if you want to change the location update information on the SIM card so that the phone is already registered in advance, EF_LOCI has to be modified). One other thing: I did not notice those problems with the BS-11 yet. This ccould have two reasons: Differences in the oscillator drift or because I usually turn off the HFC-E1 card if I don't use OpenBSC. mISND on Linux is constantly running and the E1 clock is on all the time, here in my configuration (Windows) I turn off the HFC-E1 chip after running OpenBSC. According to some documentation it can take up to 30 minutes until the BS-11 synchronizes to the E1 clock. So maybe the BS-11 oscillator is better than the oscillator of the E1 card and so the problem only occurs if the BS-11 is locked to the E1 card ? Just a guess, but I will try to see if I find an easy way to measure the BS-11 clock. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

1
0
0 0

Re: AW: AW: AW: BS-11 runs, but no Network on my Mobile

by Dieter Spaar

Hello Andreas, On Wed, 1 Apr 2009 13:44:52 +0200, "Andreas.Eversberg" <Andreas.Eversberg(a)versatel.de> wrote: > > does BS-11 need to react on telephone messages in order to show the > network to the phone? or does the phone just receive the BS-11 > signalling information in order to display the available network? i > don't know if the receiver works. To just "see" the network, the phone does not have to send anything and the BS-11 does not need to receive anything. This is necessary only when the phone registers to the network (Location Update). However the Abis link has to be up so that the cell information is sent, if the Abis link is down, the transmitter is most certainly still sending (I measured this here, but it was not yet confirmed by others so it might be wrong) but a phone won't see the network (probably no system information is sent in this case). > also i can create BBSIG1 and PA1, but it will not be used by bsc_hack. > what do i need to change in order to use the second transponder? maybe > this one works. I am not sure if OpenBSC already supports the second TRX. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

1
0
0 0

BS-11 runs, but no Network on my Mobile

by Andreas.Eversberg

hi, i finally completed the BS-11 setup: - original kernel 2.6.27.4 the mISDN-patch was for - bs11 with software load as described in the wiki - all BS-11 objects created as described - PA test passed - LMT shows no alarms (except cabinet-alarm) - after start of bsc_hack, all 8 channels on the first tansmitter are provisioned. - FM receiver clearly receives transmitter on channel 123, where no other base station is transmitting but i do not get any other network on my mobile. my mobile just finds: e-plus, t-mobile, o2, vodafone any ideas? thanx in advance andreas

15 years, 1 month

2
1
0 0

Re: AW: AW: BS-11 runs, but no Network on my Mobile

by Dieter Spaar

Hello Andreas, On Wed, 1 Apr 2009 12:36:15 +0200, "Andreas.Eversberg" <Andreas.Eversberg(a)versatel.de> wrote: > the load is correct. i get an error pop-up while starting bsc_hack. this > is because the LMT seems not to be 100% compatible with the load. with > an older load i don't get this error pop-up, but it also doesn't work. > also no alarms show on the LMT after syncing database. i will get the > exact error message this weekend. The error message that LMT is not compatible to the firmware version should be no problem, it just complains about unknown attributes. Its strange, because you already know that the transmitter is working, so I wonder why you don't receive something on the phone. Have you tried a different phone, just to be sure ? Maybe also using a different ARFCN might help. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

1
0
0 0

Re: AW: BS-11 runs, but no Network on my Mobile

by Dieter Spaar

Hello Andreas, On Wed, 1 Apr 2009 11:26:18 +0200, "Andreas.Eversberg" <Andreas.Eversberg(a)versatel.de> wrote: > i tried two different loads, many reboots. also i reconfigured the > objects (delete / create). many restarts of the bsc_hack always gave the > same results. transmitter is working fine, but no network indication on > my mobile. (manual search). This is strange. You have LMT, right ? And the correct version of the firmware is loaded into the BS-11 ? HS010876.SWL for "SW Safety Load" and HS011106.SWL for the normal software ? > if it helps, i can provide root access to my test server this weekend. I most certainly cannot help this way, if bsc_hack sends the configuration and LMT shows no alerts than the BS-11 should actually work as configured by bsc_hack. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

1
0
0 0

Re: BS-11 runs, but no Network on my Mobile

by Dieter Spaar

Hello Andreas, On Wed, 1 Apr 2009 10:30:26 +0200, "Andreas.Eversberg" <Andreas.Eversberg(a)versatel.de> wrote: > > but i do not get any other network on my mobile. my mobile just finds: > e-plus, t-mobile, o2, vodafone > > any ideas? Have you already tried to restart OpenBSC ? I sometimes had the impression that the first configuration of the BS-11 after it has been turned on does not work. The second try to configure the BS-11 usually works. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

1
0
0 0

WG: AW: BS-11 runs, but no Network on my Mobile

by Andreas.Eversberg

the load is correct. i get an error pop-up while starting bsc_hack. this is because the LMT seems not to be 100% compatible with the load. with an older load i don't get this error pop-up, but it also doesn't work. also no alarms show on the LMT after syncing database. i will get the exact error message this weekend. -----Ursprüngliche Nachricht----- Von: Dieter Spaar [mailto:spaar@mirider.augusta.de] Gesendet: Mittwoch, 1. April 2009 13:48 An: Andreas.Eversberg Cc: openbsc(a)lists.gnumonks.org Betreff: Re: AW: BS-11 runs, but no Network on my Mobile Hello Andreas, On Wed, 1 Apr 2009 11:26:18 +0200, "Andreas.Eversberg" <Andreas.Eversberg(a)versatel.de> wrote: > i tried two different loads, many reboots. also i reconfigured the > objects (delete / create). many restarts of the bsc_hack always gave the > same results. transmitter is working fine, but no network indication on > my mobile. (manual search). This is strange. You have LMT, right ? And the correct version of the firmware is loaded into the BS-11 ? HS010876.SWL for "SW Safety Load" and HS011106.SWL for the normal software ? > if it helps, i can provide root access to my test server this weekend. I most certainly cannot help this way, if bsc_hack sends the configuration and LMT shows no alerts than the BS-11 should actually work as configured by bsc_hack. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

1
0
0 0

AW: BS-11 runs, but no Network on my Mobile

by Andreas.Eversberg

i tried two different loads, many reboots. also i reconfigured the objects (delete / create). many restarts of the bsc_hack always gave the same results. transmitter is working fine, but no network indication on my mobile. (manual search). if it helps, i can provide root access to my test server this weekend. -----Ursprüngliche Nachricht----- Von: Dieter Spaar [mailto:spaar@mirider.augusta.de] Gesendet: Mittwoch, 1. April 2009 13:13 An: Andreas.Eversberg Cc: openbsc(a)lists.gnumonks.org Betreff: Re: BS-11 runs, but no Network on my Mobile Hello Andreas, On Wed, 1 Apr 2009 10:30:26 +0200, "Andreas.Eversberg" <Andreas.Eversberg(a)versatel.de> wrote: > > but i do not get any other network on my mobile. my mobile just finds: > e-plus, t-mobile, o2, vodafone > > any ideas? Have you already tried to restart OpenBSC ? I sometimes had the impression that the first configuration of the BS-11 after it has been turned on does not work. The second try to configure the BS-11 usually works. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

1
0
0 0

BS11 configuration problem

by Michael Gernoth

Hi, after receiving an E1 card, I tried (unsuccessfully) to get bsc_hack up and running: http://pbot.rmdir.de/19e2baa94ffedfdb814dce0a9346532e After that, no new network can be found with a mobile phone. bs11_config is reporting: PHASE: 3 Normal MBCCU0: Load MBCCU1: Load Abis-link: Up When bsc_hack is started, the following message appears a huge number of times in the kernel log: Mar 1 17:24:51 faui43g kernel: mISDN_send: error -12 and then sometimes messages like: Mar 1 17:24:52 faui43g kernel: ph_data_indication 0x0 0x3 0x0 The kernel version is 2.6.27.19 (patched), but I also tried the newest git tree from Linus with the same results. I think the configuration of my BS-11 is somehow broken, as both TRX seem to be enabled: BS11 Power Amplifier 0 ATTRIBUTES: TRX Power: 30mW (GSM) BS11 Power Amplifier 1 ATTRIBUTES: TRX Power: 30mW (GSM) But running bs11_config delete-trx1 (or create-trx1) just produces BS11 DELETE OBJECT NACK (respectively BS11 CREATE OBJECT NACK): http://pbot.rmdir.de/53344f67ed0cb86f24c4a79f0af4fe2e Trying to reset the standard configuration by deleting and recreating all objects in create_objects() doesn't work, too: http://pbot.rmdir.de/13e0b928689c0d527b13fa52698b9391 (Patch: http://pbot.rmdir.de/e549a8a52da6d389326e2e2891c2f289) It seems to me, that I have to reset the BS-11 to the factory defaults and recreate the configuration with bs11_config, but I don't know how to do that (and if I need the firmware files for that...). Did I miss something obvious, or is the configuration of my BS11 somehow broken? Thanks & Regards, Michael -- Michael Gernoth Department of Computer Science IV Martensstrasse 1 D-91058 Erlangen Germany University of Erlangen-Nuremberg http://www4.informatik.uni-erlangen.de/~gernoth/

15 years, 1 month

2
4
0 0

RequestForHelp on mISDNUser

by Holger Freyther

Hey guys, some month ago I added basic support to dump the LAPD frame we send and receive. This code was disabled in Haralds restructuring of this layer in order to add support for the IP Access nanoBTS. The question is now should we repair or nuke this feature. Shortly after having finished my implementation prom pointed me to the mISDNuser tool[1]. It looks like this can write pcap files as well and that wireshark should be able to handle them. I would be happy if someone could try this tool and see what files are produced and if we should continue this way or restore the "-p file" functionality. thanks z. PS: Maybe we just need to move the pcap Linux-LAPD header over to this tool... [1] http://git.misdn.org/?p=mISDNuser.git;a=blob;f=debugtool/mISDNdebugtool.c;h…

15 years, 1 month

1
0
0 0

SMS are now stored in SQL table

by Harald Welte

Hi all! Today I've just committed some code that stores incoming SMS in the SQL table as soon as they are received. There is also more error handling right now, i.e. if the SMS is sent to an unknown extension, it is rejected right away. What's still missing is the code to actually deliver the SMS from the SQL table to the destination phone. For this, we need to * decouple paging from voice calls * correctly construct TPDU and RP/CP header from actual SMS payload * trigger SMS delivery of pending messages at LOCATION UPDATING / IMSI ATT * trigger SMS delivery once the MS tells us it has memory (SMMA) * regularly iterate over undelivered SMS and try to send them * decide how to handle SMS while a voice call is ongoing If anyone has a good idea what to do about UCS2 encoded messages, I'm more than happy to hear about it. My plan so far is to translate it to UTF-8 and store it as UTF-8 in the SQL database. This way we have something that most linux systems (and other tools) can deal with. Disadvantage is that we'd end up translating a message back and forth... Also, if somebody is more familiar with the 'regular' SMSC architecture in real GSM networks, it would probably be good to think of a way how we can integrate external SMS delivery both incoming and outgoing. SMS is much easier since it is basically data/signalling only and there's no need to actually route unstructured voice data like it is the case for regular phone calls. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 1 month

2
1
0 0

Problems with bs11_config ('BS11 DELETE OBJECT NACK') and bsc_hack

by Holger Adams

Hello Everybody, my E-1 link now seems to work correctly. at least I can see the LAPD RR-PingPong on my analyzer. First Problem: I'm still having some problems with bs11_config, this happens with create-trx1 and delete-trx1. If I remember right, this already have been reported by somebody else. I first disconnected the BTS from the BSC with 'bs11_config disconnect'. openbsc:/svn/trunk/openbsc/src# ./bs11_config delete-trx1 bs11_config (C) 2009 by Harald Welte and Dieter Spaar This is FREE SOFTWARE with ABSOLUTELY NO WARRANTY LMT LOGON: ACK PHASE: 2 Maintenance MBCCU0: No Load MBCCU1: Load Abis-link: Down Wed Mar 18 15:24:51 2009 <0020> abis_nm.c:689 BS11 DELETE OBJECT NACK Wed Mar 18 15:24:51 2009 <0020> abis_nm.c:689 BS11 DELETE OBJECT NACK LMT LOGOFF: ACK (same for create-trx1). ~ Second problem: openbsc:/svn/trunk/openbsc/src# ./bsc_hack -a -f 123 Allowing everyone? DB: Database initialized. DB: Database prepared. 1 device found id: 0 Dprotocols: 00000018 Bprotocols: 0000000e protocol: 4 nrbchan: 30 name: hfc-e1.1 activate bchan bootstrapping OML Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=0) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=1) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=1) E1=(0,2,1) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=2) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=2) E1=(0,2,2) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=3) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=3) E1=(0,2,3) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=4) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=4) E1=(0,3,0) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=5) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=5) E1=(0,3,1) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=6) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=6) E1=(0,3,2) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=7) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=7) E1=(0,3,3) bootstrapping RSL MCC=1 MNC=1 bootstrapping OML Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=0) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=1) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=1) E1=(0,2,1) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=2) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=2) E1=(0,2,2) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=3) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=3) E1=(0,2,3) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=4) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=4) E1=(0,3,0) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=5) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=5) E1=(0,3,1) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=6) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=6) E1=(0,3,2) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1405 Set Chan Attr (bts=0,trx=0,ts=7) Wed Mar 18 15:23:37 2009 <0020> abis_nm.c:1344 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=7) E1=(0,3,3) (...) 'bsc_hack' hangs here, can't get more - even with verbose settings. Sometimes I get something like a 'Failure Event' (can't remember excact message) and 'RADIO ... DISABLED'. I don't have loggings of these, Sorry. Have I missed something? Best Regards, Holger

15 years, 1 month

3
4
0 0

Re: Problems with bs11_config ('BS11 DELETE OBJECT NACK') and bsc_hack

by Dieter Spaar

Hello Harald, On Mon, 23 Mar 2009 15:05:09 -0300, "Harald Welte" <laforge(a)gnumonks.org> wrote: > > yes, DELETE OBJECT is currently not working in bs11_config. I or somebody else > with LMT (Dieter?) need to look at a LMT when deleting an object and compare > the binary data with what bs11_config generates in order to check for differences > and fix them. I think the DELETE OBJECT message is fine, the problem is that an object has to be locked before it can be deleted. This is how locking/unlocking looks in LMT (its basically the CHG_ADM_STATE message): ; Lock BBSIG 1 Tx 69A50200010401 Rx 61A5020001040124010701071C0100 Rx 6AA50200010401 ; Lock PA 1 Tx 69A50900010401 Rx 61A5090001040124010701071C0100 Rx 6AA50900010401 ; Unlock PA 1 Tx 69A50900010402 Rx 61A5090001040224010701071C0100 Rx 6AA50900010402 ; Unlock BBSIG 1 Tx 69A50200010402 Rx 61A5020001040224010701071C0100 Rx 6AA50200010402 After the object is locked, it can be deleted: ; Delete BBSIG 1 Tx ACA5020001 Rx ADA5020001 Please note that locking for deleting is enough, unlocking the deleted object is of course not needed. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

2
1
0 0

BTS connections

by Eric Cathelinaud

Hello everybody, I would like to know whether it would be possible to obtain some information about the cable connection. It is written on the website that the Y03 and Y04 PCM are left open, but I can see on the photo http://bs11-abis.gnumonks.org/trac/attachment/wiki/BS11_Configuration/bs11_… that there is a twinax cable between them. Am I wrong? If not, I would like to know what's the use of this connection. Thanks a lot Eric

15 years, 1 month

2
1
0 0

Re: Problems with bs11_config ('BS11 DELETE OBJECT NACK') and bsc_hack

by Dieter Spaar

Hello Holger, On Thu, 19 Mar 2009 17:25:15 +0100, "Holger Adams" <holger(a)kernreaktor.org> wrote: > > I remember that one TRX wasn't ('No Load') loaded. Phase 3 was reached. If this is the first one, it won't work because this is the one OpenBSC uses in the moment. If it is not loaded you should switch off and on the BS-11 and check if it works afterwards. On my BS-11 there seems to be a temperature related problem which sometimes requires quite a few restarts to get the first TRX loaded. Additionally it could be that an attached RS232 cable disturbs the startup process. All of the above is not 100% sure because its difficult to reproduce, but maybe it helps to load the first TRX (if the second TRX is not loaded this should be no problem to get OpenBSC running). Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

3
3
0 0

Re: Problems with bs11_config ('BS11 DELETE OBJECT NACK') and bsc_hack

by Dieter Spaar

Hello Holger, On Mon, 23 Mar 2009 09:13:00 +0100 (CET), "Holger Adams" <holger(a)kernreaktor.org> wrote: > > There are still some problems of getting the TRX started (sorry for keep > bugging, but it doesn't make real fun to start developing without a > working fundament). I don't see a problem with the traces, what you receive is the "Channel Load" Indication from the BS-11, OpenBSC advices the BS-11 to send this report. > I except of beeing 'DoSed' by various mobilephones lying around here, but > nothing happens. I also can't see the 'OpenBSC-Test' provider on my > mobilephones (manual network select). A phone normally won't register to the test network as long as it reaches the network stored on the SIM. You should see the network "001-01" if you manually search for a network (it could also be "Test01" or similar), but not the name 'OpenBSC-Test'. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

1
0
0 0

Re: Problems with bs11_config ('BS11 DELETE OBJECT NACK') and bsc_hack

by Dieter Spaar

Hello Holger, On Thu, 19 Mar 2009 14:32:48 +0100 (CET), "Holger Adams" <holger(a)kernreaktor.org> wrote: > > The programm stucks at 'TX TEI(1): 10 1a 1e 06 0b 00 0b 06 1e 00 01 00 f1 > 10 00 01 28 ff' but continues playing LAPD-RR-Pingpong. Should I try to > reflash the firmware? I also tried restarting 'openbsc' a few times. > Does bs11_config show that both TRX are loaded and that the BS-11 is in Phase 3 ? Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

2
1
0 0

Re: Problems with bs11_config ('BS11 DELETE OBJECT NACK') and bsc_hack

by Dieter Spaar

Hello Holger, On Thu, 19 Mar 2009 11:02:05 +0100 (CET), "Holger Adams" <holger(a)kernreaktor.org> wrote: > > Sniffed Abis-Link (with K1103): > http://www.kernreaktor.org/stuff/bs11-e1.txt I am not familiar with the K1103. But if I don't misunderstand the traces, everything should be fine. After the database has been sent to the BS-11, you won't see any additional traffic on the E1 interface as long as there is no phone registering to the BS-11 or you advice OpenBSC to send something to the BS-11. You should now be able to see the network with a phone. If you want to generate some E1 traffic without a phone, you can press (or release) the instrusion switch, this should result in a report sent from the BS-11. However I don't know how long the delay is between actually changing the switch state and the resulting report. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 1 month

2
1
0 0

Wanted: A-bis and/or Um protocol traces for GPRS

by Harald Welte

Hi! As one of our following steps in OpenBSC will be work on GPRS support, I would be interested in any GPRS related protocol traces of the A-bis interface or the Um interface. Particularly interesting obviosuly is the registration and session setup/teardown. So if anyone has such traces for GPRS, please don't hesitate to contact me. The traces will not be publicized but just used as a reference and example for the further development of OpenBSC. Thanks in advance! (yes, I'm still on holidays, but rather wrote that email immediately than to put it on a TODO list and loose time and/or forget about it) -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 2 months

1
0
0 0

E1 interface, layer 2

by Klaus-Peter Junghanns

Hi, i am staring at the sources right now, figuring out how openbsc uses which part of misdn to send/receive frames over the e1 link. I think it's doing something like this (please correct me if i am wrong: - use timeslot 1 in hdlc mode for the signalling link - use misdns layer 2 to handle the TEI assignment, etc What i am wondering about is: - which ETSI standard describs layer 2 for GSM abis? Thanks a lot in advance for your feedback. :-) Mit freundlichen Grüßen -- best regards Klaus-Peter Junghanns -- Junghanns.NET Gesellschaft fuer Internet-Services & Software-Development mbH Breite Str. 13a 12167 Berlin Germany Geschaeftsfuehrer : Klaus-Peter Junghanns Eingetragen beim Amtsgericht Charlottenburg, HRB 79169 Finanzamt fuer Koerperschaften III, Steuernummer 29/409/8978 Umsatzsteuernummer : DE 217621658 WEEE-Reg.-Nr. DE 86102730

15 years, 2 months

2
2
0 0

Re: E1 interface, layer 2

by Dieter Spaar

Hello, On Tue, 10 Mar 2009 15:24:00 +0100, "Klaus-Peter Junghanns" <kpj(a)junghanns.net> wrote: > > What i am wondering about is: > - which ETSI standard describs layer 2 for GSM abis? As far as I am aware, its LAPD as specified by ITU Q.920 and Q.921 (very similar if not equal to what is used in the "D"-channel of ISDN). Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 2 months

1
0
0 0

Racal 6103 ?

by Dieter Spaar

Hello, does anyone has access to a Racal 6103 ? I have bought a used one and have some questions. Please drop me a note, private email is fine. Thank you very much. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 2 months

2
1
0 0

BS-11, bs11_config

by Klaus-Peter Junghanns

Hello everybody, finally i found some time to unwrap my precious BS-11 and started playing. Unfortuantely i did not get to far... I managed to build the power cable, install the antenna, hook up the serial cable to a debian box and install the openbsc software. I followed the steps in the wiki, e.g. run "bs11_config -p /dev/ttyS0" and then turn on the BS-11. The green power LED on the BS-11 is solid green. But i do not get any output from the bs11_config (e.g. no booting messages, etc). :-( Sometimes bs11_config segfaults when i switch on the power to the BS-11: bs11_config -p /dev/ttyS0 bs11_config (C) 2009 by Harald Welte and Dieter Spaar This is FREE SOFTWARE with ABSOLUTELY NO WARRANTY Invalid length in hdr: 0 Segmentation fault The serial cable is connected to the serial port (1 of 4) which is closest to the antenna connectors (like i have seen it on the photo). What did i do wrong? Thanks in advance for your help. :-) Mit freundlichen Grüßen -- best regards Klaus-Peter Junghanns -- Junghanns.NET Gesellschaft fuer Internet-Services & Software-Development mbH Breite Str. 13a 12167 Berlin Germany Geschaeftsfuehrer : Klaus-Peter Junghanns Eingetragen beim Amtsgericht Charlottenburg, HRB 79169 Finanzamt fuer Koerperschaften III, Steuernummer 29/409/8978 Umsatzsteuernummer : DE 217621658 WEEE-Reg.-Nr. DE 86102730

15 years, 2 months

4
6
0 0

Re: Jumper settings for 120 Ohm connection

by Dieter Spaar

Hello Holger, On Sat, 28 Feb 2009 11:53:23 +0100, "Holger Adams" <holger(a)kernreaktor.org> wrote: > > Maybe its important to mention: > - Both LEDs of the E-1 card are blinking red > - Used cables for the RJ45 plug (CAT5): orange/blue I can't help with Linux (I use Windows), however I noticed this in mISDN (hfc_multi.c) a while ago: case 1: /* HFC-E1 OEM */ /* 2 red blinking: NT mode deactivate * 2 red steady: TE mode deactivate * left green: L1 active * left red: frame sync, but no L1 * right green: L2 active */ So I would guess that there is a synchronisation problem which is not related to the TEI setting. Maybe there is something wrong with the wire connection. If you can see the signal sent from the E1 card at the BS-11 and there is also a signal sent from the BS-11, than probably the signal from the BS-11 is not received by the E1 card so it could not synchronize on it. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 2 months

3
2
0 0

Jumper settings for 120 Ohm connection

by Holger Adams

Hello Everybody, I'm just trying to connect the E-1 host card to the BS-11, but I can't get it work. The serial connection works fine, I'm also seeing the "Abis-link: Restoring" message. My hardware configuration: 1) I removed the green jumpers TB01 - TB04 2) Jumper settings below the Twinax-board: 1-4 ON, 5-8 OFF 3) HFC-E1: NT Mode, Config A (all jumpers on the left side to the left) 4) 'hfcmulti' modprobed with 'dslot=1' 5) Forced the BS-11 to use correct TEI and E1 slot by using 'bs11_config' Have I missed something? I put a scope upon the rx/tx pins - traffic flows into both directions, so I think there's no collision (tx->tx, rx->rx) Thanks, Holger

15 years, 2 months

2
3
0 0

Re: Jumper settings for 120 Ohm connection

by Dieter Spaar

Hello Holger, On Sat, 28 Feb 2009 12:55:04 +0100, "Holger Adams" <holger(a)kernreaktor.org> wrote: > > OK, I think I know where the problem is - there must be a cableing > problem with the Twinax connectors. > > So there is my next question: > Which pin of Y01 is TX+ and TX-? > Which pin of Y02 is RX+ and RX-? The polarity does not care, you can exchange TX+ with TX- and RX+ with RX-. A simple test for just the correct wire without connection the BS-11: - On the cable which goes to Y01 you should be able to see a signal with an oscilloscop between TX+ and TX-. - If you connect the two TX lines with the two RX lines (loopback, polarity does not care), the card should synchronise and the LEDs should not longer blink. Attention: I have tested this on Windows only, with a loopback, I can see that the card synchronises, however I don't know what mISDN does, but I guess it will also synchronise. If this works, you know that the cable is OK. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 2 months

1
0
0 0

Harald on holidays

by Harald Welte

Hi All! I'll be on holidays pretty much throughout the time from March 4th through March 25th. I will check my email only in very irregular intervals, particularly not after March 11. I will try to get back to any inquiries after I have returned. Meanwhile, the list (particularly subscribers like zecke, dieter spaar, nibbler and others) will hopefully be able to adress all issues you might have. Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 2 months

1
0
0 0

Initial Config BS-11

by Rene Stegmaier

Hi Folks, yesterday i´ve tried to do the initial config of my BS-11. But i have a problem after warmup while querying the BS-11: rene@nb-stegmaier:~/data/development/bs-11/svn/trunk/openbsc/src $ ./bs11_config -p /dev/ttyUSB0 query bs11_config (C) 2009 by Harald Welte and Dieter Spaar This is FREE SOFTWARE with ABSOLUTELY NO WARRANTY LMT LOGON: ACK PHASE: 1 Software required Abis-link: Down No valid Safety Load file "BTSBMC76.SWI" PHASE: 1 Software required Abis-link: Down No valid Safety Load file "BTSBMC76.SWI" Whatis going wrong? I read in the wiki that the projekt doesn't provide any firmware images, but how can i get the BS-11 working? Is there any way to generate this "Safety Load file" and upload it to the BS-11? cheers, René -- Rene Stegmaier <rene(a)rr47.de> LAN-TEX Schuberstr. 14 38518 Gifhorn Mobil: 01703183653

15 years, 2 months

1
0
0 0

Tektronix K1103 pinout of the E-1 interface

by Holger Adams

Hello Everybody, we have several Tektronix K1103 protocol analyzers standing around here and it was quite complicated to get the pinout of the SUB-D 9 connectors. Monitor A: Pin Purpose 9 RX+B 4 RX-B 6 RX+A 1 RX-A 2,3,4 GND A = E-1-Linecard -> BTS B = BTS -> E-1-Linecard Monitor C: 9 RX+D 5 RX-D 6 RX+C 1 RX-C 2,3,4 GND Telephone socket: 1 mic input (-) 2 hearer output (+) 3 hearer output (-) 4 mic input (+) Factsheet of this analyzer: http://www2.tek.com/cmswpt/psdetails.lotr?ct=PS&lc=EN&ci=14411&cs=psu Holger

15 years, 2 months

1
0
0 0

BS11 getting started instructions

by Harald Welte

hi! I've put together a new page at http://bs11-abis.gnumonks.org/trac/wiki/BS11_Getting_Started which explains the individual steps from unpacking the BTS, verifying its configuration using bs11_config up to connecting and getting it up and running with a HFC-E1 Eval Board and the bsc_hack program. Once again, feel free to add information to the wiki, I will happily provide accounts to every user! Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 2 months

1
0
0 0

OpenBSC mailing list / installation questions

by Harald Welte

Hi! I'm sending this mail to all recent buyers of a BS-11. I would like to ask you to raise any questions you might have regarding setup/configuration/installation of the BS-11 unit or OpenBSC at the openbsc(a)lists.gnumonks.org mailing list. You can subscribe to the list online at https://lists.gnumonks.org/mailman/listinfo/openbsc The benefit of asking your question at this list is that other BS-11 / OpenBSC users and developers will see your questions and learn from the answers or at some point even provide the respective answers themselves. I would also want to invite you to contribute to our wiki at http://bs11-abis.gnumonks.org/. We do not allow public editing, so if you want an account, just email me privately and I will send you username and password. I hope we can now finally start to build a community around the project, with some 30 BS-11 distributed to various GSM enthusiasts all over the world. Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 2 months

1
0
0 0

HLR Database

by Abdul Hakeem

Hello, Does anyone has a sample database to test the hlrstat.pl script against ? I am specifically after the subscriber database. Best regards, Abdul Hakeem

15 years, 2 months

1
0
0 0

bs11_config doesn't build right now

by Harald Welte

Hi! Some of you have already received their BS-11 and built the power cord for it. Next step is to obviously try bs11_config on the serial port. Unfortunately it doesn't build right now since I restructured some shared code. I'll work on this tonight, should be fixed soon. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 2 months

1
0
0 0

Re: First successful voice calls

by Harald Welte

Hi David, hope you don't mind me Cc'in the list, as other people might find this information useful. On Tue, Feb 17, 2009 at 08:31:53PM -0800, David A. Burgess wrote: > Congratulations!! thanks! > So if you need the channel mode modify, does that mean you're doing very > early assignment? yes, it is the most simple option. commit the TCH early and you don't have to do conflict resolval in the middle of the call setup if you first only have a SDCCH and then want to switch to a TCH but don't have a free one. > It took me a few days to figure that out when I decided to try very early > assignment. I was pretty clear that I have to do CHANNEL MODE MODIFY on GSM 04.08 to tell the MS to switch to voice mode. However, what is a bit weird is that in addition you have to send a MODE MODIFY REQUEST (08.58) packet to the BTS. Plus, the actual channel mode values for EFR are different on 04.08 and 08.58 ;) Why is it weird? Because typically in a case like this, you would send one 08.58 packet to the BTS, with the payload for the 04.08 packet. The BTS would then do the local state change, and send the 04.08 packet over the air to cause the MS state change. This is how it works with many other operations, you almost never have to explicitly talk to both sides separately. > For early or late assignment, started call setup on the SDCCH, I didn't > need that channel mode modify step. I was aware of that, but then you need another channel assignment and a more complex resource management, at least that's what I think. So I went for very early assingment for now. > Are you transcoding, or just copying raw vocoder frames from TCH to TCH? No, I'm not transcoding. But in order to route TRAU frames from one TCH to the other, you already need to do quite a bit of parsing and re-encoding. It's just how they stuff the bits in the TRAU frames, not actually touching any of the voice processing. I think what is useful is to 'outsource' this TRAU frame processing into a separate process. Apart from simple commands like 'map this sub-channel to another sub-channel' it doesn't need much interaction with the actual signalling part. In fact, the relatively high data rates clog the debug log and make it hard to strace OpenBSC for further work on the signalling side. On the ip.access nanoBTS it's even easier. You can directly feed the RTP streams over the loopback device on the BTS, so the voice data naver even has to go to the BTS (unless you want to route between multiple BTS, which I haven't done yet but is very easy with nanoBTS too, in fact the code _should_ already work. What will be interesting is to figure out the actual RTP payload of the ip.access. I've already seen they use RTP payload type 127 and the size of the packets looks like it is one 40-byte TRAU frame per RTP packet. If that is true, I would probably work on E1-to-RTP interworking to route calls between traditional E1-based BTS and IP-based ones. Cheers, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 2 months

1
0
0 0

build-fix for bs11_config

by Michael Gernoth

Hi, it seems that the last few commits (starting with SVN revision 308) broke the compilation of bs11_config. As I wanted to take a look at the boot process of my newly delivered BS11, I've just fixed bs11_config to build again and it even seems to work. Find attached my (ugly) patch to fix the build problems. Regards, Michael -- Michael Gernoth Department of Computer Science IV Martensstrasse 1 D-91058 Erlangen Germany University of Erlangen-Nuremberg http://www4.informatik.uni-erlangen.de/~gernoth/

15 years, 2 months

1
0
0 0

First successful voice calls

by Harald Welte

Hi all! Like I just wrot in my blog, I have managed to get the first voice calls between two MS on one BTS working. The Q.931 like call control never really was the problem, and paging as well as RR/MM seems to work very stable all the time. Bigger problems were related to the CHANNEL MODIFY that has to be done on the 04.08 level (for the MS side) as well as the 08.58 side for the BTS side - plus many classic programming mistakes in what used to be so-far untested/unused code. In any case, I have succesfully had voice calls through both the BS-11 as well as the ip.access nanoBTS. There are still lots of things left to be done (e.g. the E1 subslot assignments are still static, there is a big yet-to-be-explained lag on E1 based calls, Motorola phones seem to have compatibility issues, you can call yourself and make your own phone ring, etc). But at least the foundation is working. Regards, [... and it's not even two months too late for the originally planned call demo at 25C3] -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 2 months

1
0
0 0

Re: ip.access protocol reverse engineering

by Harald Welte

Hi Philippe! On Fri, Feb 13, 2009 at 03:31:08PM +0100, Philippe Langlois wrote: > Can you also upload there some raw packet traces of this ip.access > abis-over-ip ? I'm working on a wireshark plugin, and I'll release traces + the plugin soon. The traces will then be traces of OpenBSC talking to the nanoBTS. The traces I currently have are from a test network, but contain things like IMSI/IMEI numbers which I consider confidential information. By the way: There is currently no wireshark plugin for GSM 12.21 (OML) yet, as far as I can tell. Only 08.58 is there. Anyone interested in working on this? Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 3 months

3
4
0 0

ip.access protocol reverse engineering

by Philip Lansink

Hallo, How can i login ? Regards, Philip.

15 years, 3 months

4
3
0 0

ip.access protocol reverse engineering

by Harald Welte

Hi! I've started a page documenting the ip.access A-bis over IP protocol at https://bs11-abis.gnumonks.org/trac/wiki/nanoBTS There are no NDA problems with it, since all information was derived from looking at packet traces. I do not have access to any protocol documentation from ip.access. Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 3 months

1
0
0 0

mISDN/socket API, B channels and select()

by Harald Welte

Hi! This seems to solve the mystery that zecke and me experienced yesterday working with the B-Channels on mISDN. Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 3 months

1
0
0 0

Re: L3proc login password

by Dieter Spaar

Hello Bjoern, > Can't get logged in to the LMT. > It asks for a password (cambio menu). > "L3proc" isn't working... This is not the LMT COM Port, you have plugged the cable into the wrong port. Besides the LMT COM port, which is close to the E1 BNC connectors, there are several other COM ports which are directly routed to the various microcontrollers. There are some simple debug menues active during startup, but on the LMT port you won't get any reply without sending the correct message first. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 3 months

1
0
0 0

L3proc login password

by Bjoern Heller

Hi, Can't get logged in to the LMT. It asks for a password (cambio menu). “L3proc” isn't working... tec - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Björn Heller Jabber: tec(a)jabber.hellercom.de

15 years, 3 months

1
0
0 0

major rework on the misdn / input plugin side

by Harald Welte

Hi! I was trying to get the data model right for the TRAU mux/demux handling, and discovered it is about time to re-do the entire 'input' side, i.e. the interface towards the actual E1 link. The main objectives are: 1) ability to deal with multiple BTS on one E1 link 2) ability to easily integrate E1 drivers != mISDN, e.g. zaptel while still keeping most of the E1 related functionality in common code 3) ability to easily add things like Abis over IP later So please stay tuned for some potentially quite big committs in that area during the next couple of days. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 3 months

1
0
0 0

software load via A-bis

by Harald Welte

Hi! JFYI: Software load through the A-bis / E1 interface is only marginally faster than through the serisal RS232 line. The theoretical maximum speed is the 64kbps of the E1 timeslot, which should give quite a bit of improvement over the 19200bps serial line. However, the BS-11 is throttling down the transver even via A-bis. I have tried to increase the window size to 20 (LMT has a max of 8. I tried up to 32 but then the transfer fails) The speed that I'm getting now is somewhere around 1232 bytes per second, which is about 9656bps. Do they use a 9600bps serial line somewhere inside the BS-11 to route those software updates through? I haven't finished an entire transfer, but it seems like the transfer would take some 36 minutes using this method. Not too far off the 45minutes that we get with LMT or bs11_config. I guess "in the field" this doesn't really matter since they can install the software image while the BTS is still in operation, and then at some point schedule a reboot which activates the new software. p.s.: yes, I removed all delays (usleep calls) from misdn.c before testing. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 3 months

1
0
0 0

bs11_config update

by Harald Welte

Hi! Just a quick update on bs11_config, the program used for BS-11 configuration over a serial line. I have now * successfully loaded SMU safety and software (SWL) from regular files in the filesystem (not as easy since BS-11 firmware comes as multiple files that need to be loaded consecutively) * created all objects required for minimal config, including TRX1/PA1 activation * display the A-bis/T link state, phase/subphase and MBBCU status from bs11_config Furthermore, I have added abis_nm functions to * set the A-bis external time (important for getting correct timestamps for alarms) * obtain the BS-11 serial number (as printed on the case). -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 3 months

1
0
0 0

Re: Documentation of the BS-11 - what do we know?

by Dieter Spaar

Hello Holger, > Couldn't we use a GNU-Radio combined with the GSM-HF-RX? We had a > student research project which used that with Wireshark. I think I could > borrow it for a few days and sniff some stuff at our lab. Just tell me > what sequences you need. You mean the USRP ? As far as I know its no big problem to save the raw RF data with it but there is no easy-to-use software yet to get nice traces from those data (e.g. extract all the different channels like BCCH, CCCH and so on) which for example could be used to see the messages between the BTS and the phone. I am not interested in the traffic (speech or data), just the signaling on the Air-Interface would be nice to have. But lets see what the future brings, projects like airprobe.org might fill this gap. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 3 months

2
1
0 0

Re: Documentation of the BS-11 - what do we know?

by Dieter Spaar

Hello Holger, > If you need some help in the near future (as soon our equipment arrives, > orders left the building today... or at least they should): we have full > equipped and licensed GSM-E1-Analyzers. I think we can provide some > traces if required (I know that Harald has shoot an ELMI-Abis-Analyzer > at EBay, just for notice). Good to know that. What about a GSM Analyzer for the Air Interface :-) ? In the moment ISDN E1 traces are not that important because its under control of OpenBSC anyway. The traces of the Siemens specific configuration commands were done on the RS232 interface of the BS-11, the configuration software under NDA uses RS232 only, at least I don't have any other BS-11 specific software which uses the ISDN interface. I anyone has access to a real GSM Abis Interface and can provide traces of a working network this could be very interesting to have a look at. And for tracing the GSM air inteface with cheap equipment, well, lets hope that we can get something for that in the future... Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 3 months

2
1
0 0

Re: Documentation of the BS-11 - what do we know?

by Dieter Spaar

Hello Holger, The following is what I can say, Harald might add more or correct me: On Mon, 19 Jan 2009 10:15:17 +0100, "Holger Adams" <holger(a)kernreaktor.org> wrote: > > as we all know, the documentation of the BS-11 is under NDA. Harald > said, the BTS respects 99.9% of the A-bis 3GPP standardization. So my > questions are: > > 1) What's the part of the 0.1% we don't know? Which part differs from > the specs? There are Siemens specific commands for configuring the BS-11. They are not documented and also not included in the NDA documentation. The important commands are however going to become part of OpenBSC. Harald is currently working on a tool for configuring the BS-11, it is based on analyzing what the configuration tool (under NDA) is sending over the wire. So you will most certainly find all the required information in OpenBSC soon. > 2) During the 25c3 talk there was mentioned that the BTS uses ~6 DSPs > and a bunch of uCs. What kind of DSPs and uCs are used (well Siemens... > I guess some creepy 8051/C16x/... and Motorola stuff)? Its nothing from the more common stuff. The microcontrollers are from the HPC family from National Semiconductor, the DSPs are from the DSP16 family from Lucent. My guess is that the HPC was mainly used in the telcommunication area, for the DSP16 there was at least one more common analog modem around which uses it. BTW, the information about the microcontrollers and the DSPs is also not contained in the NDA documentation, so this is no secret what I am writing here. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

15 years, 3 months

3
2
0 0

Documentation of the BS-11 - what do we know?

by Holger Adams

Hello Everybody, as we all know, the documentation of the BS-11 is under NDA. Harald said, the BTS respects 99.9% of the A-bis 3GPP standardization. So my questions are: 1) What's the part of the 0.1% we don't know? Which part differs from the specs? 2) During the 25c3 talk there was mentioned that the BTS uses ~6 DSPs and a bunch of uCs. What kind of DSPs and uCs are used (well Siemens... I guess some creepy 8051/C16x/... and Motorola stuff)? Regards, Holger -- () Holger Adams, <holger(a)kernreaktor.org> /\ WWW: http://www.kernreaktor.org

15 years, 3 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC