Project

General

Profile

Actions

FakeTRX » History » Revision 25

« Previous | Revision 25/44 (diff) | Next »
fixeria, 01/17/2019 01:58 PM


FakeTRX (Virtual Um-interface)

FakeTRX is a virtual Um-interface implementation written in Python, which allows you to connect OsmocomBB and OsmoBTS without actual RF hardware. The main purpose of this software is to facilitate and simplify the development and testing process. In other words, you don't need to physically run your GSM network nor use any kind of special hardware - just run a few scripts and do anything you want / need in your virtual GSM network!

Normally trxcon TRX Interface would be used for GR-GSM to implement client (mobile) side of the transceiver. The OsmoTRX implements server (BTS) side of transceiver and is used by osmo-bts-trx. FakeTRX acts as a bridge between them altering Uplink/Downlink headers as necessary which removes the need for actual hardware.

FAQ

What is the difference from VIRT-PHY?

The main difference is that FakeTRX actually works on GSM L1, while VIRT-PHY works on higher levels, using GSMTAP and multicast sockets to exchange the data. It means that FakeTRX provides the TRX Interface for both OsmocomBB and OsmoBTS, and forwards GSM bursts between both sides. So, no need to do any modifications in the OsmoBTS source code, just use osmo-bts-trx.

Interoperability with VIRT-PHY

TBD.

Python?

Of course, Python is slower than C, for example. But it's more than enough for exchanging UDP messages between OsmocomBB and OsmoBTS, and vice versa. Moreover, it can be easily reimplemented in C, if someone interested in better performance.

Once multiple instances are supported, we can benchmark to see what's the preformance bottleneck.

What about RSSI and ToA (Timing of Arrival)?

Since we are talking about the virtual interface, it's possible to emulate any values for both RSSI and ToA.

Can I run multiple BTS and / or multiple MS instances?

Not yet. Related tickets: https://osmocom.org/issues/3666 https://osmocom.org/issues/3667

Running

This guide assumes that you already have the Osmocom GSM network side stack compiled and installed. If not, the simplest way is to use the Network in the Box.

Since OsmocomBB was extended with TRX Interface support, follow the corresponding instructions and compile OsmocomBB with trxcon application. After that, you may find the FakeTRX toolkit located in 'src/target/trx_toolkit/'. See README for more details.

Tip: feel free to use tmux or screen to avoid a mess with multiple windows

1. Run the network side stack you have. In this example we will use the Network in the Box:

$ osmo-nitb -c ./openbsc.cfg -l ./hlr.sqlite3 -P -C --debug=DRLL:DCC:DMM:DRR:DRSL:DNM

2. Run the fake transceiver:

$ cd osmocom-bb/src/target/trx_toolkit/
$ python ./fake_trx.py -R 127.0.0.3 -r 127.0.0.23 -b 127.0.0.13

Here we assume that osmo-bts-trx is available on 127.0.0.3, osmocom-bb (mobile or other program) is available on 127.0.0.23 and we use 127.0.0.13 as our own address. This allow us to run multiple transceivers (and mobiles) in parallel. In simple setups with only single fake_trx all IP-related parameters can be omitted.

3. Start OsmoBTS (in case you want to build from source, enable the TRX backend with ./configure --enable-trx=yes).

$ osmo-bts-trx -c ./osmo-bts.cfg

If using explicit IP addresses as specified above, your osmo-bts.cfg should have following options set:

phy 0
 osmotrx ip local 127.0.0.3
 osmotrx ip remote 127.0.0.13

Congratulations! Now you have a virtual GSM network running. As you can see, the virtual transceiver emulates the clock source, as this is required for OsmoBTS. Also, it handles only a few important commands, such as RXTUNE and TXTUNE, but ignores other irrelevant ones.

4. In order to make OsmocomBB applications able to work with FakeTRX, you need to run trxcon:

$ cd osmocom-bb/src/host/trxcon/
$ ./trxcon --trx-remote 127.0.0.13 --trx-bind 127.0.0.23

Here we assume that trxcon is available on 127.0.0.13 and we use 127.0.0.23 as our own address. This allow us to run multiple transceivers (and mobiles) in parallel. In simple setups with only single fake_trx/trxcon all IP-related parameters can be omitted.

5. Finally, run any L2&3 application, e.g. ccch_scan:

$ cd osmocom-bb/src/host/layer23/src/misc/
$ ./ccch_scan -a ARFCN -i 127.0.0.1

Please note that ARFCN value should match the one your BTS configured to.

Since this step, you should see the broadcast messages coming from the virtual network, like in case of a real one. You can use Wireshark to analyze them.

Running mobile application

As you should already know, mobile applications implements a simple mobile phone with SMS, USSD and voice calls. In the virtual network we can benefit from using a virtual SIM card. Just configure one according to your network configuration, see the example below. If you are starting with the default config from the source tree (osmocom-bb/doc/examples/mobile/default.cfg), make sure to change sim reader to sim test in the ms 1 section.

test-sim
  imsi 901700000000000
  no barred-access
  rplmn 901 70

Make sure you have the virtual network running, then run mobile the same way as in case of a Calypso based phone:

$ cd osmocom-bb/src/host/layer23/src/mobile/
$ ./mobile -i 127.0.0.1

Now you can use mobile's telnet interface to manage your virtual phone:

$ telnet localhost 4247
$ ...

Demo

https://www.youtube.com/watch?v=Uxdaui8EkjY

Project status

Supported:

  • Simulation and randomization of both RSSI and ToA
  • Burst capture to file (see data_dump.py)
  • Injection of bursts and commands

Further plans:

Files (0)

Updated by fixeria about 5 years ago · 25 revisions

Add picture from clipboard (Maximum size: 48.8 MB)