Vedr: TRX CLK-indication and failing sync

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at

Erich Dachleger edachleger at
Thu Mar 14 09:58:51 UTC 2013


Hi, when I use wireshark I see mostly "GSMTAP header ARFCN(525),Downlink TS0,channel BCCH0, which probably is normal since the phones do not register or see the network.Manual search is done with phones after removing and reinserting batteries. Shouldn't there be seen sip invite messages  also.?Sipauthserve starts normally as well as smqueue.

When watching the 29c3 video,after finishing configuring transceiver file, before launching openbts, it looks like a command related to an ARFCN is given from inside the directory where the transceiver is residing, which command is that?

My OpenBTS.db config is supplied below


CLI.SocketPath|/var/run/command|0|0|Path for Unix domain datagram socket used for the OpenBTS console interface.
Control.Reporting.PhysStatusTable|/var/run/OpenBTSChannelTable.db|1|0|File path for channel status reporting
 database.  Static.
Control.Reporting.TransactionTable|/var/run/TransactionTable.db|1|0|File path for transaction table database.  Static.
Control.Reporting.TMSITable|/var/run/OpenBTSTMSITable.db|1|0|File path for TMSITable database.  Static.
Control.Call.QueryRRLP.Early||0|1|If not NULL, query every MS for its location via RRLP during the setup of a call.
Control.Call.QueryRRLP.Late||0|1|If not NULL, query every MS for its location via RRLP during the teardown of a call.
Control.GSMTAP.TargetIP||0|1|Target IP address for GSMTAP packets; the IP address of Wireshark, if you use it for GSM.
 flag.  Set to 1 to use attach/detach procedure, 0 otherwise.  This will
 make initial LUR more prompt.  It will also cause an un-regstration if 
the handset powers off and really heavy LUR loads in areas with spotty 
 handset is not provisioned for this network. |0|1|If defined, send this
 text message, followed by the IMSI, to unprovisioned handsets that are 
denied  registration.
 return address for the failed registration message.  If the message is 
defined, this must also be defined.
 defined, send this text message, followed by the IMSI, to provisioned 
handsets when they attach on Um.
 return address for the normal registration message.  If the message is 
defined, this must also be defined.
Control.LUR.OpenRegistration|.*|0|1|If not NULL, allow unprovisioned handsets to attach in Um.
 to the GSM test network.  Your IMSI is |0|1|If defined, send this text 
message, followed by the IMSI, to unprovisioned handsets when they 
attach on Um due
 to open registration.
 return address for the open registration message.  If the message is 
defined, this must also be defined.
Control.LUR.QueryClassmark||0|1|If not NULL, query every MS for classmark during LUR.
Control.LUR.QueryIMEI||0|1|If not NULL, query every MS for IMSI during LUR.
Control.LUR.QueryRRLP||0|1|If not NULL, query every MS for its location via RRLP during LUR.
Control.LUR.SendTMSIs||0|1|If not NULL, send new TMSI assignments to handsets that are allowed to attach.
 cause for location updating failures for unprovisioned phones.  Reject 
causes come from GSM 04.08  Reject cause 0x04, IMSI not in 
VLR, is usually the right one.
Control.NumSQLTries|3|0|0|Number of times to retry SQL queries before declaring a database access failure.
Control.SMS.QueryRRLP||0|1|If not NULL, query every MS for
 its location via RRLP during an SMS.
Control.TMSITable.MaxAge|72|0|0|Maximum allowed age for a TMSI in hours.
Control.TMSITable.MaxSize|100000|0|0|Maximum size of TMSI table before oldest TMSIs are discarded.
 not NULL, user very early assignment for speech call establishment.  
See GSM 04.08 Section 7.3.2 for a detailed explanation of assignment 
types. If VEA is selected, GSM.CellSelection.NECI should be set to 1.  
See GSM 04.08 Sections 9.1.8 and for an explanation of the NECI
GSM.CCCH.AGCH.QMax|5|0|0|Maximum number of access grants to be queued for transmission on AGCH before declaring congrestion.
 configuration type.  See GSM for encoding.  Value of 1 means 
we are using a C-V beacon.  Any other value selects a C-IV beacon.
GSM.Channels.SDCCHReserve|0|0|0|Number of SDCCHs to reserve for non-LUR operations. This can be used to force LUR
 transactions into a lower priority.
 Reselection Hysteresis.  See GSM 04.08, Table 10.5.23 for 
encoding.  Encoding is $2N$ dB, values of $N$ are 0...7 for 0...14 dB.
GSM.CellSelection.MS-TXPWR-MAX-CCH|0|0|0|Cell selection parameters.  See GSM 04.08
 Permitted.  An 8-bit mask of allowed NCCs.  Unless you are coordinating
 with another carrier, this should probably just select your own NCC.
 New Establishment Causes.  This must be set to "1" if you want to 
support very early assignment (VEA).  It can be set to "1" even if you 
do not use VEA, so you might as well leave it as "1".  See GSM 04.08, Table 10.5.23 and 04.08 9.1.8, Table 9.9 and the Control.VEA 
GSM.CellSelection.Neighbors|NULL|0|0|ARFCNs of neighboring
GSM.CellSelection.RXLEV-ACCESS-MIN|0|0|0|Cell selection parameters.  See GSM 04.08
 not NULL, allocate C-I slots first, starting at C0T1.  Otherwise, 
allocate C-VII slots first.  Static.
 of Combination-I timeslots to configure.  The C-I slot carries a single
 full-rate TCH, used for speech calling.  Static.
 of Combination-VII timeslots to configure.  The C-VII slot carries 8 
SDCCHs, useful to handle high registration loads or SMS.  If C0T0 is 
C-IV, you must have at least one C-VII also.  Static.
GSM.Control.GPRSMaxIgnore|5|0|1|The maximum number of suspension requests to ignore before aborting a transaction.
 basestation color code; lower 3 bits of the BSIC.  BCC values in a 
multi-BTS network should be assigned so that BTS units with overlapping
 coverage do not share a BCC.  This value will also select the training 
sequence used for all slots on this unit.
 network color code; upper 3 bits of the BSIC.  Assigned by your 
national regulator.  Must be distinct from NCCs of other GSM operators 
in your area.
GSM.Identity.CI|10|0|0|Cell ID, 16 bits.  Should be unique.
 area code, 16 bits, values 0xFFxx are reserved.  For multi-BTS 
networks, assign a unique LAC to each BTS unit.  (That is not the normal
 procedure in conventional GSM networks, but is the correct procedure in
 OpenBTS networks.)
GSM.Identity.MCC|001|0|0|Mobile country code, 2 or 3 digits.  Defined in ITU-T E.212.
GSM.Identity.MNC|01|0|0|Mobile network code; Must be 3 dgits.  Assigned by your national regulator.
GSM.Identity.ShortName|OpenBTS|0|1|Network short name, displayed on some phones.  Optional but must be
 defined if you also want the network to send time-of-day.
GSM.Identity.ShowCountry|1|0|0|If not NULL, tell the phone to show the country name based on the MCC.
GSM.MS.Power.Damping|50|0|0|Damping value for MS power control loop.
GSM.MS.Power.Max|33|0|0|Maximum commanded MS power level in dBm.
GSM.MS.Power.Min|5|0|0|Minimum commanded MS power level in dBm.
GSM.MS.TA.Damping|50|0|0|Damping value for timing advance control loop.
 allowed timing advance in symbol periods.  Ignore RACH bursts with 
delays greater than this.  Can be used to limit service range.
 allowed speech buffering latency, in 20 ms frames.  If the jitter is 
larger than this delay, frames will be lost.
 class flags.  This is the raw parameter sent on the BCCH.  See GSM 
04.08 for encoding.  Set to 0 to allow full access.  If you do
 have proper PSAP integration, set to 0x0400 to indicate no support for 
emergency calls.
GSM.RACH.MaxRetrans|3|0|0|Maximum RACH 
retransmission attempts.  This is the raw parameter sent on the BCCH.  
See GSM 04.08 for encoding.
 to spread RACH busts over time.  This is the raw parameter sent on the 
BCCH.  See GSM 04.08 for encoding.
GSM.Radio.ARFCNs|1 |1|0|The number of ARFCNs to use.  The ARFCN set will be C0, C0+2, C0+4, etc.  Static.
 L1 radio link timeout.  This is the raw parameter sent on the BCCH; see
 GSM for encoding. Should be coordinated with T3109.
GSM.RRLP.ACCURACY|40|0|0|Requested accuracy of location request. K in 10(1.1**K-1). See 3GPP 03.32, sect 6.2
GSM.RRLP.ALMANAC.REFRESH.TIME|24.0|0|0|How often the almanac is refreshed, in
GSM.RRLP.ALMANAC.URL||0|0|URL of almanac source.
GSM.RRLP.EPHEMERIS.REFRESH.TIME|1.0|0|0|How often the ephemeris is refreshed, in hours.
GSM.RRLP.EPHEMERIS.URL||0|0|URL of ephemeris source.
 timeout. (OpenBTS timeout is 130 sec = max response time + 2.) N in 
2**N. See 3GPP 04.31 sect A.2.2.1
GSM.RRLP.SEED.ALTITUDE|0|0|0|Seed altitude in meters wrt geoidal surface.
GSM.RRLP.SEED.LATITUDE|37.8720708|0|0|Seed latitude in degrees.  -90 (south pole) .. +90 (north pole)
GSM.RRLP.SEED.LONGITUDE|-122.2578337|0|0|Seed longitude in degrees.  -180 (west of greenwich) .. 180 (east)
GSM.RRLP.SERVER.URL|http://localhost/cgi-bin/rrlpserver.cgi|0|0|URL of RRLP server.
GSM.RRLP.ALMANAC.ASSIST.PRESENT|0|0|0|1=send almanac info to mobile; 0=do
GSM.RRLP.EPHEMERIS.ASSIST.COUNT|9|0|0|number of satellites to include in navigation model
 GSM operating band.  Valid values are 850 (GSM850), 900 (PGSM900), 1800
 (DCS1800) and 1900 (PCS1900).  For most Range models, this value is 
dictated by the hardware and should not be changed.  Static.
GSM.Radio.C0|525|1|0|The C0 ARFCN.  Also the base ARFCN for a multi-ARFCN configuration.  Static.
GSM.Radio.MaxExpectedDelaySpread|1 |0|0|Expected worst-case delay spread in symbol periods, roughly 3.7 us or 1.1 km per unit.
 transmitter attenuation level, in dB wrt full scale on the D/A output. 
 This sets the minimum power output level in the output power control 
GSM.Radio.PowerManager.MinAttenDB|0|0|0|Minimum transmitter 
attenuation level, in dB wrt full scale on the D/A output.  This sets 
the maximum power output level in the
 output power control loop.
GSM.Radio.PowerManager.NumSamples|10|0|0|Number of samples averaged by the output power control loop.
GSM.Radio.PowerManager.SamplePeriod|2000|0|0|Sample period for the output power control loop.
 value for T3122, the random access hold-off timer, for the power 
control loop.
GSM.Radio.RSSITarget|-50|0|0|Target uplink RSSI for MS 
power control loop, in dB wrt to A/D full scale.  Should be 6-10 dB 
above the noise floor.
GSM.Radio.NeedBSIC|1|0|0|Does the Radio type require the full BSIC
 timer T3113 in ms.  This is the timeout for a handset to respond to a 
paging request.  This should usually be the same as SIP.Timer.B in your 
VoIP network.
GSM.Timer.T3122Max|255000|0|0|Maximum allowed value for T3122, the RACH holdoff timer, in
GSM.Timer.T3122Min|2000|0|0|Minimum allowed value for T3122, the RACH holdoff timer, in milliseconds.
 timer T3212 period in minutes.  Should be a factor of 6.  Set to 0 to 
disable periodic registration.  Should be smaller than SIP registration 
Log.Alarms.Max|20|0|0|Maximum number of alarms to remember inside the application.
Log.Level.CallControl.cpp|INFO|0|1|Default configuration logs a trace at L3.
Log.Level.MobilityManagement.cpp|INFO|0|1|Default configuration logs a trace at L3.
Log.Level.RadioResource.cpp|INFO|0|1|Default configuration logs a trace at L3.
Log.Level.SMSControl.cpp|INFO|0|1|Default configuration logs a trace at L3.
 server(s) for time-of-day clock syncing.  For multiple servers, use a 
space-delimited list.  If left undefined, NTP will not be used, but it 
is strongly
RTP.Range|98|1|0|Range of RTP port pool.  Pool is RTP.Start to RTP.Range-1.  Static.
RTP.Start|16484|1|0|Base of RTP port pool.  Pool is RTP.Start to RTP.Range-1.  Static.
 NULL or 0, send 100 Trying response to SIP MESSAGE, even though that 
violates RFC-3428. In other words, to actually comply with the RFC, set 
this to something other than NULL or 0
SIP.DTMF.RFC2833|1|0|1|If not NULL, use RFC-2833 (RTP event signalling) for in-call DTMF.
 type to use for RFC-2833 telephone event packets.  If SIP.DTMF.2833 is 
defined, this must also be defined.
SIP.DTMF.RFC2967||0|1|If not NULL, use RFC-2967 (SIP INFO method) for in-call DTMF.
 address of the OpenBTS machine as seen by its proxies.  If these are 
all local, this can be localhost.  Static.
SIP.Local.Port|5062|1|0|IP port that OpenBTS
 uses for its SIP interface.  Static.
SIP.MaxForwards|5|0|0|Maximum allowed number of referrals.
 IP host and port of the proxy to be used for registration and 
authentication.  This should normally be the subscriber registry SIP 
interface, not Asterisk.
SIP.Proxy.SMS||0|0|The IP host and port of the proxy to be used for text messaging.  This is smqueue, for example.
 IP host and port of the proxy to be used for normal speech calls.  This
 is Asterisk, for example.
SIP.RegistrationPeriod|90|0|0|Registration period in minutes for MS SIP users.  Should be longer than GSM T3212.
 SMSC handler in smqueue.  This is the entity that handles full 3GPP 
MIME-encapsulted TPDUs.  If not defined, use direct numeric addressing. 
 Normally the value is NULL if SMS.MIMIEType is "text/plain" or
 "smsc" if SMS.MIMEType is "application/vnd.3gpp".
SIP.Timer.A|500|0|0|INVITE retransmit period in ms.
SIP.Timer.B|10000|0|0|INVITE transaction timeout in ms.  This value should usually match GSM.Timer.T3113.
SIP.Timer.E|500|0|0|Non-INVITE initial request retransmit period in ms.
SIP.Timer.F|5000|0|0|Non-INVITE initial request timeout in ms.
SIP.Timer.J|500|0|0|Non-INVITE non-initial request retransmit period in ms.
SIP.Timer.H|5000|0|0|ACK timeout period in ms.
SIP.Timer.I|500|0|0|ACK retransmit period in ms.
SMS.DefaultDestSMSC|0000|0|0|Use this to fill in L4 SMSC address in SMS submission.
SMS.FakeSrcSMSC|0000|0|0|Use this to fill in L4 SMSC address in SMS delivery.
 is the MIME Type that OpenBTS will use for RFC-3428 SIP MESSAGE 
payloads.  Valid values are "application/vnd.3gpp.sms" and "text/plain".
SubscriberRegistry.Manager.Title|Subscriber Registry|0|0|Title
 of subscriber registry database manager web page.
SubscriberRegistry.Manager.Url||0|0|URL of the subscriber registry database manager.
 username type context host|0|0|Field names in subscriber registry 
visible in the database manager.
 location of the sqlite3 database holding the subscriber registry.
 used by the SIP Authentication Server. NOTE: In some older releases 
(pre-2.8.1) this is called SIP.myPort.
TRX.IP||1|0|IP address of the transceiver application.  Static.
TRX.Port|5700|1|0|IP port of the transceiver application.  Static.
 adjustment for the transceiver master clock.  Roughly 170 Hz/step.  Set
 at the factory.  Do not adjust without proper calibration. 
TRX.Timeout.Clock|10|0|1|How long to wait during a read operation from the transceiver before giving up.
TRX.Timeout.Start|2|0|1|How long to wait during system startup before checking to see if the transceiver can be reached.
 gain adjustment for transmitter, matched to the power amplifier, 
expessed as an attenuationi in dB.  Set at the factory.  Do not adjust 
without proper calibration.  Static.
root at bt:~# 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the baseband-devel mailing list