On Thu, Jun 18, 2009 at 11:32:55PM +0200, Harald Welte wrote:
If we use the knowledge of the behavior as described above, we can also deduct:
the BS-11 is configured to a NM_ATT_RF_MAXPOWR_R of 0, i.e. it will transmit with the power level that is configured by LMT / ipaccess_config. By default this is set to 30mW
the nanoBTS 900 has 20dBm (1800 is 23dBm) TRX output power. bsc_hack is configured to a NM_ATT_RF_MAXPOWR_R of 12, i.e. 24dB. This means we are transmitting with a mere -4dBm (398uW) or -1dBm (794uW) which would be _really_ low. So either the nanoBTS are not following specs, or we're really transmitting something that would barely be possible to receive. Or my calculations are wrong ;)
I've now also realised that every CHANNEL ACTIVATE message contains a BS power and MS power IE with 0x0f as value, i.e. another 30dB decrease in initial power levels. This really makes me suspicious... at levels that low, everything should never be working. Probably the MS and BTS cannot operate below a certain level, and thus they choose whatever is the minimum level they support.
But that would again disagree with my 'speaker sound level decreases after initial burst and settles on a low level' observation.
So I think there is a lot of experimentation to do for somebody with a somewhat accurate spectrum analyzer or similar equipment.