On Wed, Jun 08, 2011 at 11:06:50PM +0200, Bthomas wrote: I think even for somebody with detailed protocol knowledge, it would be a multi-man-month development effort to get it working. You are talking about WCDMA femtocells, while we have only worked with GSM BTSs. first of all, this is 3G not 2G. This means a different system, with different procedures and different protocols (IuB/IuH, RANAP, etc.) Only the higher layers like CC and SMS are identical to 2G. Secondly, the existing femtocells speak mostly proprietary protocols between the femtocell and the femtocell-gateway inside the operator. So the first thing I would be looking for is protocol traces of the femtocells in action, i.e. when they talk to their normal femto-gw. Based on that, you can start to reverse engineer the protocol. It can be done, we have done it for several other femtocell protocols of other vendors before. But even after that, we didn't have any time (or funding) for writing actual code implementing it. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)