Getting Started with 3G » History » Version 30

« Previous - Version 30/52 (diff) - Next » - Current version
theresa, 04/26/2017 05:39 PM
Fix libosmo-sccp git tag name ("old-sua" --> "old_sua")

Getting Started with 3G

This reflects the state of Osmocom 3G development on 2017-03-04

If you have your 3G femto cell1, this is how to get started:

The physical setup is:

  _____________              _____________
  |           |              |           |
  | femto     |<--Ethernet-->| Laptop/PC |
  |___________|              |___________|

On the protocol layer, the femto cell is the hNodeB and talks to various core
network elements over the ethernet cable, typically all located on your
computer, and talks to the phone (UE) over the air:

                             ,-->| Osmo   |
                            /    | MGCPGW |
                            |    |        |<--MGCP
                            |    +--------+       \
                            /                     |
        +------------+<--RTP     +--------+       `->+----------+
 UE <-->| hNodeB     |           | Osmo   |          | OsmoMSC  |        +------+
 UE <-->|            |<--Iuh---->| HNB-GW |<--IuCS-->|          |        | Osmo |
        |            |           |        |          |     (VLR)|<-GSUP->| HLR  |
        |            |           |        |          +----------+  GSUP->+------+
        +------------+<--GTP-U   |        |                       /
                              \  |        |          +------+<---'       +------+
                              |  |        |<--IuPS-->| Osmo |<--GTP-C--->| Open |
                              |  +--------+          | SGSN |   GTP-U--->| GGSN |
                              |                      +------+  /         +------+

Core Network

To get your 3G core network up and running, you need to manually build specific
branches from various Osmocom projects:

  • libosmocore: master
  • libosmo-abis: master
  • libosmo-netif: master
  • libosmo-sccp: old_sua (tag)
  • libsmpp34: master
  • asn1c: aper-prefix-onto-upstream
  • libasn1c: master
  • osmo-iuh: master
  • openggsn: master
  • openbsc: vlr_3G
  • osmo-hlr: master

The git command to get onto a branch other than 'master' is:

git checkout the_branch_name

See Build from Source on build instructions
(remember to pass --enable-iu for openbsc's ./configure step).

Once the CN stack is built, set up the configuration and launch the core
network components. Find further below example configuration files and a run
script that may help to get you started. Here are some details explained:

Tell the osmo-hnbgw which local IP address to use to listen for Iuh
connections. This needs to be on an interface reachable by the hNodeB. The IuCS
and IuPS links towards the osmo-msc and osmo-sgsn default to and, respectively, i.e. it's easiest to run osmo-msc and osmo-sgsn on
the same machine as the osmo-hnbgw. These will listen on the proper port
(14001) without further configuration.

Also tell the MGCPGW (osmo-bsc_mgcp) which local IP address to bind to, which
has to be reachable both by the hNodeB as well as the osmo-msc process. The
osmo-msc.cfg is then told where to reach the MGCPGW.

A notable detail for 3G data is that the GGSN has to be reachable by the
hNodeB. Since the GTP standard defines fixed port numbers which both SGSN and
GGSN have to use, the SGSN may not bind on the same IP address as the GGSN!

Typically this requires to add another IP address to your ethernet interface.
On linux this is achieved, for example, by:

sudo ip addr add dev eth0

The above adds the address to eth0, which works e.g. when your
machine is in a net and the address is not yet taken by
anyone else. (You probably want to use something like instead.)

Also, IP forwarding and masquerading must be enabled for your GGSN to be able
to connect to your mobile phones to the internet uplink. On linux, that can be
done for eth0 by:

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward" 
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

You may need a different interface, possibly a wildcard like 'eth*'.

The GGSN needs permissions to create a tun device, which sudo will allow.
It may be safer though to allow your user to create tunnels instead of running
the GGSN as root.

If programs complain about missing library .so files, you will probably need
to export LD_LIBRARY_PATH=/usr/local/lib. With sudo that would be sudo
LD_LIBRARY_PATH=/usr/local/lib ggsn ...
, and you may need to add "SETENV" to
your sudoers config -- see the sudo documentation.

Once you have configured the IP addresses, start up your core network: launch
osmo-msc, osmo-bsc_mgcp, osmo-sgsn, ggsn and osmo-hnbgw. You should see log
messages indicating established IuCS and IuPS links (HNBGW, MSC and SGSN).

Core Network Configuration Example

Here is a specific 3G core network configuration example, including a highly
specialized launcher script that configures the network (on a linux system) and
runs all the programs needed for a 3G core network -- but be aware:


  • This was run in a subnet, yours may vary.
  • Your femto cell will get itself an IP address from your DHCP server, which
    will almost certainly differ from this example. You (so far still) need to
    set this address in the mgcp.cfg.
  • The ggsn.conf 'listen' address here is the additional interface (ala 'ip addr
    add' above) and needs to match whichever address you picked there.
  • Make sure all the other IP addresses in the config files match yours.
  • Make sure the MCC and MNC match the ones configured in the femto cell.

  • It assumes the Osmocom libs and programs to be installed in /usr/local/*.
  • It launches each component in a separate X terminal.
  • It uses rxvt-unicode, you may want to change the urxvt call to your favorite xterm instead.
  • Make sure the ethernet interface makes sense.
  • Make sure the IP address makes sense.
  • Run it in a directory where it will find the various configuration files.
  • It runs most of the processes in a gdb for easier debugging.
  • Once you hit Enter in the original terminal where you started, all the other
    terminals will be torn down in one fell swoop (hopefully).

Now that you've taken notice of the points above, here are the config and
script: attachment:3G-config-example-v3.tar

Femto Config

With your CN up and running, configure the hNodeB to contact osmo-hnbgw via
Iuh. Also make sure the PLMN ID matches the MCC and MNC in the osmo-msc.cfg --
otherwise the hNodeB may reject all attach requests.

Depending on your femto cell, the steps to configure it will be radically

Subscriber Configuration

For your phone loaded with your USIM to be able to subscribe to your network, the IMSI needs to be authorized to enter and the authentication keys need to be added to the HLR.

Configure your femto cell to authorize your IMSIs, refer to your specific model's configuration documentation.

Once off, the HLR database needs to be created using the file osmo-hlr/sql/hlr.sql:

sqlite3 hlr.db < osmo-hlr/sql/hlr.sql

This hlr.db needs to be found by the osmo-hlr binary -- either place it in the current working directory when launching osmo-hlr, or use the osmo-hlr -l my/hlr.db commandline option to pass a specific path.

Update the HLR database to add your IMSIs
$ sqlite3 hlr.db 
sqlite> insert into subscriber (imsi, msisdn) values ('901700000099999', '999');
sqlite> select id, imsi from subscriber;
sqlite> insert into auc_3g values (2342,5, '0102030405060708090a0b0c0d0e0f00',NULL,'f0e0d0c0b0a090807060504030201000',32);

The numbers (except '5') are freely chosen and will all differ for you:
  • 901700000099999: IMSI of your USIM.
  • 999: MSISDN, i.e. the subscriber's telephone number. Your choice.
  • 2342: the automatically created subscriber id, probably 1 for you.
  • 5: use Milenage. see enum osmo_auth_algo in libosmocore's crypt/auth.h
  • '0102030405060708090a0b0c0d0e0f00': KI, you got it with your USIM
  • 'f0e0d0c0b0a090807060504030201000': OPC, you got it with your USIM
  • 32: first SQN used for authentication

NOTE: sysmoUSIM-SJS1 will work only from SQN=32 onwards.
(see #1965-13)
To set all SQN to >= 32 in your hlr.db:

$ sqlite3 hlr.db
sqlite3> update auc_3g set sqn = 32 where sqn < 32;

(Also remember to set sqn = 32 for any new subscriber you add to your db.)
As soon as we resolved #1968 and #1969, this will work automatically,
but so far you need to set sqn = 32 manually to get started.

APN for Data Service

For the 3G data service to work, phones generally need an APN added to their
configuration, or they will not even attempt to establish a data connection.
For the Osmocom 3G CN, any arbitrary APN name will do.

The APN configuration steps are usually similar to:

  • Navigate to APN settings:
    • 'Settings'
    • 'Wireless & Networks'
    • 'Mobile networks'
    • 'Access Point Names'
  • You should see the list of APNs (possibly empty)
  • Press the Menu button
  • Choose 'New APN'
  • Enter values for 'Name' as well as 'APN'
    • For both, any nonempty value is sufficient, e.g. "test".
  • Again press the Menu button
  • Choose 'Save'
  • The APN should now appear in the list of APNs.
  • Possibly tap the bullet icon to select the APN as default.

Further Links

The "3G Voice Works" blog post from 2016 has some explanations:

With almost any question, you can go back to the 3GPP specs. Here is a list of which is for what:

Tips and Facts

Analyzing RTP streams in wireshark

IuCS actually uses UP over RTP. See 3GPP TS 25.414, and 25.415 6.6.2.
(an interesting insight is )

In the wireshark preferences, go to protocol IuUP, enable it and enter the dynamic protocol
number that you see in the RTP frames (e.g. 96).


If you experience problems you may ask for assistance on our
mailing list.

1 For details on obtaining suitable 3G hardware, you can ask at
or on our mailing list.

Add picture from clipboard (Maximum size: 48.8 MB)