18 Jun
2009
18 Jun
'09
11:58 p.m.
On Thu, Jun 18, 2009 at 11:32:55PM +0200, Harald Welte wrote:
If we use the knowledge of the behavior as described
above, we can also deduct:
* the BS-11 is configured to a NM_ATT_RF_MAXPOWR_R of 0, i.e. it will transmit
with the power level that is configured by LMT / ipaccess_config. By default
this is set to 30mW
* the nanoBTS 900 has 20dBm (1800 is 23dBm) TRX output power. bsc_hack is
configured to a NM_ATT_RF_MAXPOWR_R of 12, i.e. 24dB. This means we are
transmitting with a mere -4dBm (398uW) or -1dBm (794uW) which would be _really_
low. So either the nanoBTS are not following specs, or we're really
transmitting something that would barely be possible to receive. Or my
calculations are wrong ;)
I've now also realised that every CHANNEL ACTIVATE message contains a BS power
and MS power IE with 0x0f as value, i.e. another 30dB decrease in initial power
levels. This really makes me suspicious... at levels that low, everything
should never be working. Probably the MS and BTS cannot operate below a
certain level, and thus they choose whatever is the minimum level they support.
But that would again disagree with my 'speaker sound level decreases after
initial burst and settles on a low level' observation.
So I think there is a lot of experimentation to do for somebody with a somewhat
accurate spectrum analyzer or similar equipment.
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)