Project

General

Profile

CalypsoBTS » History » Revision 6

Revision 5 (laforge, 01/15/2017 01:39 PM) → Revision 6/14 (fixeria, 11/23/2017 06:54 AM)


 h1. CalypsoBTS 

 [[CalypsoBTS]] 


 This tutorial describes how to turn cheap Calypso based phone(s) into a GSM BTS. We will consider both [[OsmoBTS:]] and "OpenBTS":http://openbts.org/ projects as GSM network front-ends. Due to some hardware limitations, limitations the CalypsoBTS [[CalypsoBTS]] setup cannot provide normal quality of service and only can only be used to learn how do the base stations work. 

 works. Because Calypso based phone cannot perform BTS functionality itself, in this tutorial we consider how to use it with "OsmoBTS":http://openbsc.osmocom.org/trac/wiki/OsmoBTS and "OpenBTS":http://openbts.org/ front-ends. 


 h2. Requirements 

 


 First of all, all you need have to understand what are you you're doing and any possible consequences. Please note, that you You can only use the frequencies you have a valid license for. In many countries you cannot operate any GSM RF equipment until unless you have obtained a proper license from the regulatory authority is obtained. Running authority. Accomplishing to operate a BTS without having such a license and/or interfering with the commercial networks a public telecommunications network is out of law a crime and may be punished! punishable under applicable law!  

 This tutorial assumes that Also you already need to have a [[Software_Getting_Started|working setup]] "working setup":http://bb.osmocom.org/trac/wiki/Software/GettingStarted of [[OsmocomBB]]. Some And finally some things (package names, etc.) can be different differ in your distribution, so you should be able to resolve solve possible problems yourself. 

 yourself because it's your machine. 


 h2. Transceiver TRX preparation 

 Transceiver is a software that performs some low-level GSM L1 operations, such as burst detection, modulation and demodulation, abstracting a BTS or MS from doing that. There are two [[OsmocomBB]] branches implementing provide the transceiver firmware and host application: 'sylvain/testing' and 'jolly/testing'. The last one is based on the first, but additionally allows to use multiple phones, so application. I advice you to choose it.  

 h3. Dependences 

 Excepting [[libosmocore:]], use the signal processing library [[libosmo-dsp:]] jolly/testing branch because it have multiple phones support. The transceiver app is also required. 

 1. Make sure you have the latest version an external interface of [[libosmocore:]]: 

 If you don't have [[CalypsoBTS]] which abstracts a BTS software from the library: L1 physical layer. It needs libosmo-dsp as a dependency: 

 <pre> 
 $ git clone git://git.osmocom.org/libosmocore <code class="sh"> 
 $ cd libosmocore/ 
 </pre> 

 If you do, but need to update: 

 <pre> 
 $ cd libosmocore/ 
 $ sudo make uninstall 
 $ make distclean 
 $ git pull --rebase 
 </pre> 

 Then: 

 <pre> 
 $ autoreconf -f -i 
 $ ./configure 
 $ make 
 $ sudo make install 
 </pre> 

 2. Install [[libosmo-dsp:]]: 

 <pre> 
 $ git clone git://git.osmocom.org/libosmo-dsp.git 
 $ cd libosmo-dsp/ 
 $ autoreconf -i 
 $ ./configure 
 $ make 
 $ sudo make install 
 </pre> cd .. 
 </code></pre> 

 h3. Firmware Then clone and host software 

 1. Clone compile the 'jolly/testing' jolly/testing branch: 

 <pre> 
 $ <code class="sh"> 
 # Get the sources 	
 git clone git://git.osmocom.org/osmocom-bb.git -b jolly/testing trx 
 $ cd trx/src/ trx/ 
 </pre> git checkout jolly/testing 
 cd src/ 

 2. Enable # It needs TX support in firmware: 

 Uncomment 
 # Just uncomment 'CFLAGS += -DCONFIG_TX_ENABLE' in 'target/firmware/Makefile'. 


 3. Compile OsmocomBB target/firmware/Makefile 

 # And make with transceiver support: 

 <pre> support 
 $ make HOST_layer23_CONFARGS=--enable-transceiver 
 </pre> </code></pre> 

 At And at this step your transceiver should be is ready. Let's check how it works! 


 h3. Clock source 

 h4. A bit of theory 


 It is very important to have a good clock synchronization between the BTS and mobile phones. Time-division (TDMA) systems require very accurate counting of the time segments (frames and timeslots) and when they start and stop. Also, multiple base stations within a network must be time-synchronized between themselves to make subscribers able to perform handover operation (switching from one BTS to another). If the towers clocking were out of sync, then communications would falter as each node would be trying to deal with segments that were slightly offset and this would introduce errors. This is why a good clock source is required to operate a base station. 

 The satellite systems, such as GPS and Iridium, do have pretty accurate clock that is being distributed in addition to the prime services (location, calls, etc). They could signals can be used (and often used in commercial networks) for synchronization purposes. This approach would require one to have a corresponding receiver and a direct sky view, but as clock source. But there is a simpler way. We can use more simple way to grab the SCH clock indications from existing base stations, eventually a phone is designed to do that! public mobile networks. 

 So, use Using [[rssibin|RSSI]] or [[cell_log]] applications to cell_log find cells with good signal the strongest cell and remember the it's ARFCN numbers. One of them will be used as a clock source for our own base station. 

 h3. number. 


 h4. Usage 

 1. First, you need to run the transceiver firmware: 

 


 <pre> 
 $ cd trx/src/ 
 $ host/osmocon/osmocon -m c123xor -p /dev/ttyUSB0 -c target/firmware/board/compal_e88/trx.highram.bin 
 </pre> 

 Additionally, if you have two (or more) phones, load the firmware to a second phone (optional): 

 <pre> 
 $ cd trx/src/ 
 $ host/osmocon/osmocon -m c123xor -p /dev/ttyUSB1 -s /tmp/osmocom_l2.2 -c target/firmware/board/compal_e88/trx.highram.bin 
 </pre> 

 2. The host application could be found in 'src/host/layer23/transceiver/': 

 <pre> 
 $ cd trx/src/host/layer23/src/transceiver/ 
 $ ./transceiver -h 
 </pre> 

 <pre> 
 Usage: ./transceiver -a arfcn_sync 
 Some useful options: 
   -h     --help               this text 
   -d     --debug MASK         Enable debugging (e.g. -d DL1C:DTRX) 
   -e     --log-level LOGL     Set log level (1=debug, 3=info, 5=notice) 
   -D     --daemonize          For the process into a background daemon 
   -s     --disable-color      Don't use colors in stderr log output 
   -a     --arfcn-sync ARFCN Set ARFCN to sync to 
   -p     --arfcn-sync-pcs     The ARFCN above is PCS 
   -2     --second-phone       Use second phone for TS 1 
   -r     --realtime PRIO      Set realtime scheduler with given prio 
 </pre> </code></pre> 

 The Where --arfcn-sync or --arfcn-sync-pcs are used to specify indicates the ARFCN *ARFCN of a clock source cell. The high cell*. High priority scheduling is recommended required for low-performance PCs. 

 3. Let's handling bursts (-r 99). Just try to synchronize with a BTS: sync: 

 If you have two (or more phones), add '-2' option. 

 <pre> 
 $ <code class="sh"> 
 # Load the TRX firmware in first terminal 
 cd trx/src/ 
 sudo host/osmocon/osmocon -r 99 -m c123xor -p /dev/ttyUSB0 -c target/firmware/board/compal_e88/trx.highram.bin 

 # In second terminal run the transceiver 
 cd trx/src/host/layer23/src/transceiver/ 
 sudo ./transceiver -a <ARFCN> -r 99 
 </pre> </code></pre> 

 You And you should see something like this: 

 <pre> 
 <0012> l1ctl.c:383 Reset received: Starting sync. 
 <0012> l1ctl.c:338 Sync acquired, setting BTS mode ... 
 <0011> trx.c:194 TRX CLK Indication 1255520 
 <0011> trx.c:194 TRX CLK Indication 1255571 
 <0011> trx.c:194 TRX CLK Indication 1255622 
 <0011> trx.c:194 TRX CLK Indication 1255673 
 <0011> trx.c:194 TRX CLK Indication 1255724 
 <0011> trx.c:194 TRX CLK Indication 1255775 
 <0011> trx.c:194 TRX CLK Indication 1255826 
 <0011> trx.c:194 TRX CLK Indication 1255877 
 <0011> trx.c:194 TRX CLK Indication 1255928 
 <0011> trx.c:194 TRX CLK Indication 1255979 
 <0011> trx.c:194 TRX CLK Indication 1256030 
 <0011> trx.c:194 TRX CLK Indication 1256081 
 ... 
 </pre> </code></pre> 

 If something goes wrong, find another ARFCN and try again. 
 As soon as you get the transceiver synchronized, just keep it running. 

 


 h2. CalypsoBTS [[CalypsoBTS]] with [[OsmoNITB:]] [[OsmoBTS:]] 

 [[OsmoBTS:]] is a software implementation of Layer2/3 of a BTS.    It supports a variety of different hardware backends. 

 The simplest way to setup a GSM network test how it works is to use [[OsmoBTS:]] with [[OpenBSC:]] in [[OsmoNITB:]] mode. [[OsmoNITB:]] is a simple core network implementation - network in the box. It emulates basic core elements like MSC, HLR, VLR, etc. [[OsmoBTS:]] is a part of Osmocom GSM core network implementation, 

 h3. Dependences 

 Make sure that supports a variety of different hardware back-ends, including [[TRX Interface]] transceivers like [[OsmoTRX:]]. Unlike "OpenBTS":http://openbts.org/, this software stack is well maintained, so I would recommend you to choose it. have installed [[libosmocore:]] 

 h3. Installation Install/update the following packages in your distribution: 

 <pre> 
 sudo apt-get install sqlite3 libdbi-dev libdbd-sqlite3 libsctp-dev 
 </pre> 

 h4. oRTP 

 This guide package installs the open source RTP protocol required for libosmo-abis. It can be downloaded at "Current [[OsmoBTS:]] source works fine with **0.22.0 oRTP** version only. Otherwise there may be problems with voice support. 

 <pre> 
 <code class="sh"> 
 wget http://download.savannah.gnu.org/releases/linphone/ortp/sources/ortp-0.22.0.tar.gz 
 tar -xvf ortp-0.22.0.tar.gz 
 cd ortp-0.22.0/ 
 ./configure 
 make 
 sudo make install 
 sudo ldconfig 
 cd .. 
 </code></pre> 


 h4. libosmo-abis 

 <pre> 
 git clone git://git.osmocom.org/libosmo-abis.git 
 </pre> 

 Sometimes it is not about building the core network software, so please follow [[openbsc:Building_OpenBSC|Building OpenBSC]]. Feel free necessary to browse point to different pkgconfig path, because your distribution may use other pkgconfig path than the wiki and check out default path of the official documentation http://ftp.osmocom.org/docs/. packages above. Use the following prefix:  

 <pre> 
 PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/ ./configure ..... 
 </pre> 

 You will need <pre> 
 <code class="sh"> 
 cd libosmo-abis 
 autoreconf -i 
 ./configure 
 (sometimes it is necessary to build / point to different .../lib/pkgconfig/ path: PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/ ./configure .....) 
 make 
 sudo make install 
 sudo ldconfig 
 cd .. 
 </code></pre> 


 h4. libosmo-netif 


 This package is dependency of [[OsmoNITB:]]. 

 <pre> 
 <code class="sh"> 
 git clone git://git.osmocom.org/libosmo-netif.git 
 cd libosmo-netif/ 
 autoreconf -i 
 ./configure 
 make 
 sudo make install 
 sudo ldconfig 
 cd .. 
 </code></pre> 


 h3. [[OsmoNITB:]] 


 The latest version can downloaded via git: 

 <pre> 
 git clone git://git.osmocom.org/openbsc.git 
 </pre> 

 Finish the following components: installation: 

 * openbsc (legacy Network in <pre> 
 <code class="sh"> 
 cd openbsc/openbsc/ 
 autoreconf -i 
 ./configure 
 make 
 sudo make install 
 cd ../.. 
 </code></pre> 


 h3. [[OsmoBTS:]] 


 The latest version can downloaded via git: 

 <pre> 
 git clone git://git.osmocom.org/osmo-bts.git 
 </pre> 

 Finish the Box) installation: 

 <pre> 
 * <code class="sh"> 
 cd osmo-bts (with 
 autoreconf -i 
 ./configure --enable-trx flag) 

 
 make 
 sudo make install 
 cd .. 
 </code></pre> 


 h3. Configuration 

 Almost each program has the Basic configuration examples. Just look for 'doc/examples/'. I recommend you 


 Now wee need to customize them as you need configure [[OpenBSC:]] and put the updated files in a separate directory. Let's use the '~/.osmocom/' for such purposes: [[OsmoBTS:]] to work together with [[CalypsoBTS]]. 

 <pre> 
 $ mkdir ~/.osmocom/ <code class="sh"> 
 </pre> 

 You can use # Create the following configuration examples: folder if it isn't exist yet 
 mkdir ~/.osmocom 

 * [[OsmoNITB:]]: 'doc/examples/osmo-nitb/sysmobts/openbsc.cfg' cd ~/.osmocom 
 * [[OsmoBTS:]]: 'doc/examples/trx/osmo-bts.cfg' touch ~/.osmocom/open-bsc.cfg 
 touch ~/.osmocom/osmo-bts.cfg 
 </code></pre> 

 There are some important things you need to pay attention. Then init default configuration: 

 h4. Network identification (OsmoNITB): 

 <pre> 
 network country code 901 <code class="sh"> 
 mobile network code 70 # Run [[OpenBSC]] 
 short name OpenBSC osmo-nitb -c ~/.osmocom/open-bsc.cfg -l ~/.osmocom/hlr.sqlite3 -P -C --debug=DRLL:DCC:DMM:DRR:DRSL:DNM 

 # In another terminal 
 long name OpenBSC telnet localhost 4242 
 </pre> en 
 write file 
 exit 

 h4. Network access / encryption (OsmoNITB): # Kill [[OpenBSC]] 
 Ctrl + C 
 </code></pre> 

 Configure [[OsmoBTS]] manually: 

 <pre> 
 auth policy (closed | accept-all | regexp | token) 
 encryption a5 (0 | bts 0 
  band DCS1800 
  ipa unit-id 1801 0 
  oml remote-ip 127.0.0.1 
  rtp jitter-buffer 0 
  paging queue-size 200 
  paging lifetime 0 
  fn-advance 30 
  ms-power-loop -60 
  timing-advance-loop 
  settsc 
  setbsic 
  trx 0 
   rxgain 0 
   power 0 
   slotmask 1 | 2 | 3) 0 0 0 0 0 0 0 
 </pre> </code></pre> 

 Warning! Setting **NOTE: "ms-power-loop" at osmo-bts.cfg should be set to -65, in order to prevent saturating the access policy to 'accept-all' may input. Also if the phone is only one or few meters away, "ms max power" should be dangerous. It's recommended set to use the 'closed' policy, adding your 0. In case of long distance test subscriber(s) info it can be set to the HLR database. 30 (DCS) or 33 (GSM 900).** 

 To In case of one phone as TRX only one timeslot will be able to use any encryption algorithm, available for [[OsmoBTS]]. This is enough for basic network functionality including Location Update, SMS and USSD support. For the voice calls support you need to know the Ki one more phone serving a TCH channel. In case of subscribers. So, it's recommended not to use any encryption (A5/0) for testing. two phones change slotmask to: 

 h4. Channel configuration (OsmoNITB): <pre> 
 slotmask 1 1 0 0 0 0 0 0 
 </pre> 

 Set a proper ARFCN for running BTS (don't confuse with a clock source). Also, set a corresponding band name. Now find and change following initial config parameters of [[OpenBSC]]: 

 <pre> 
 * band (GSM900 | DCS1800) # In network section 
 * network country code <MNC (for test use 001)> 
 mobile network code <MCC (for test use 01)> 
 short name <NAME> 
 long name <NAME> 

 # In trx[0":http://download.savannah.gnu.org/releases/linphone/ortp/sources/]. section 
 arfcn <your BTS ARFCN (see note)> 
 </pre> </code></pre> 

 h4. Logical channel mapping (OsmoNITB): *Warning:* Only use an ARFCN you have a *valid license* for. 

 I recommend For other configuration parameters description, see "OpenBSC VTY reference":http://openbsc.osmocom.org/trac/wiki/osmo-nitb_VTY. 


 h3. Voice calls support 

 By default [[NiTB]] has built-in voice call routing support. In this case you need at least one timeslot serving TCH/H or TCH/F. If you do a call from one phone to use the combined another, you will need one channel configuration (CCCH+SDCCH4) for TS0, because CalypsoBTS each phone. However, it is possible to allow two traffic channels on a single timeslot. To do this configure second timeslot (TS1) as TCH/H at the moment cannot serve all timeslots. open-bsc.cnf: 

 <pre> 
 ... 
 trx 0 
    rf_locked 0 
    arfcn <ARFCN> 
    nominal power 23 
    max_power_red 0 
    rsl e1 tei 0 
    timeslot 0 
   
     phys_chan_config CCCH+SDCCH4 
     hopping enabled 0 
    timeslot 1 
     phys_chan_config TCH/H 
     hopping enabled 0 
     ... 

 mncc-int 
  default-codec tch-f amr 
  default-codec tch-h amr 
 </pre> ... 
 </code></pre> 


 h3. LCR (optional) 

 If you have two or more Calypso based phones, it's also possible want to serve manage/route calls outside of [[OsmoNITB:]], you can replace internal call control by  
 "Linux Call Router": http://isdn.eversberg.eu/ 


 h4. opencore-amr 

 This package installs GSM adaptive multirate codecs and the second timeslot (TS1). For example, 'TCH/H' channel could EFR codec. The Full-Rate and Half-Rate codecs are included in LCR's repository. 

 It can be used downloaded at http://sourceforge.net/projects/opencore-amr/files/opencore-amr/ 

 <pre> 
 <code class="sh"> 
 tar xvzf opencore-amr-x.x.x.tar.gz 
 cd opencore-amr-x.x.x 
 ./configure 
 make 
 sudo make install 
 sudo ldconfig 
 cd .. 
 </code></pre> 


 h4. Sip-Sofia 


 This package installs the open source SIP stack of Nokia Research Center. 

 It can downloaded at http://sourceforge.net/projects/sofia-sip/files/sofia-sip/ 

 <pre> 
 <code class="sh"> 
 tar xvzf sofia-sip-x.xx.xx.tar.gz 
 cd sofia-sip-x.xx.xx 
 ./configure 
 make 
 sudo make install 
 sudo ldconfig 
 cd .. 
 </code></pre> 


 h4. LCR 


 This package installs the open source PBX software to serve one voice call between two subscribers. bridge ISDN (DSS1) / SIP / GSM (MNCC protocol). 

 The latest version can downloaded via git: 
 <pre> 
 timeslot 1 
   phys_chan_config TCH/H git clone git://git.misdn.eu/lcr.git 
 </pre> 

 h4. OsmoBTS configuration: Now configure, as described here: 

 The band value should match <pre> 
 <code class="sh"> 
 cd lcr 
 autoreconf -i 
 ./configure --with-sip --with-gsm-bs --with-gsm-ms 
 </code></pre> 

 Please note, that Half-Rate codec (--enable-gsmhr) codec is so slow, that only one in the [[OsmoNITB:]] configuration. or two calls may occupy CPU completely. So avoid it's usage except for testing. 

 * band (GSM900 | DCS1800) 

 In Sometimes it is necessary to point to different pkgconfig path, because your distribution may use other pkgconfig path than the most cases both [[OsmoNITB:]] and [[OsmoBTS:]] are working on default path of the same host. So, packages above. Use the loopback address should be used for 'remote-ip'. following prefix: 

 <pre> 
 PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/ ./configure ..... 
 </pre> 

 The 'unit-id' configure result should be include: 

 <pre> 
 configure: Compiled with GSM network side support  
 configure: Compiled with GSM mobile side support 
 configure: Compiled with GSM AMR codec support 
 configure: Compiled with SIP support 
 </code></pre> 

 Finish the same as in the [[OsmoNITB:]] configuration. installation: 

 * ipa unit-id 1801 0 <pre> 
 * oml remote-ip 127.0.0.1 <code class="sh"> 
 make 
 sudo make install 
 sudo ldconfig 
 cd .. 
 </code></pre> 


 h3. Running LCR configuration (optional) 


 h4. options.conf 

 _Tip: feel free <pre> 
 edit /usr/local/etc/lcr/options.conf 
 </pre> 

 Add a line to use tmux show logging to the console: 

 <pre> 
 debug 0x100000 
 </pre> 


 h4. interface.conf 


 The simplest configuration uses only the GSM interface. It allows LCR to forward calls from GSM to GSM or screen from GSM to avoid a mess with multiple windows_ call test feature.  

 <pre> 
 edit /usr/local/etc/lcr/interface.conf 
 </pre> 

 0. You can remove (or comment out) everything and just add this interface: 

 <pre> 
 [gsm] 
 gsm-bs 
 tones yes 
 earlyb no 
 extern 
 </code></pre> 


 h4. routing.conf 


 <pre> 
 edit /usr/local/etc/lcr/routing.conf 
 </pre> 

 You can remove (or comment out) everything and just add these rulesets: 

 <pre> 
 # All calls from interface 'gsm' are forwarded to rule set 'gsm'. 
 [main] 
 interface=gsm                             : goto ruleset=gsm 
                                         : disconnect cause=31 

 # All calls that dial '99' prefix, will be test calls. All other calls will be forwarded back to 'gsm' interface. 
 [gsm] 
 dialing=99                                : test 
                                         : extern interfaces=gsm 
 </code></pre> 


 h2. Running 


 I suggest to have one shell for every process to run, rather than stating all processes as daemon from one shell. Not starting as daemon allows to easily see the debugging output. 


 h4. 1. Transceiver 


 First load the TRX firmware. In case of one phone: 

 <pre> 
 <code class="sh"> 
 # Shell #1424 
 cd trx/src/ 
 sudo host/osmocon/osmocon -m c123xor -p /dev/ttyUSB0 -c target/firmware/board/compal_e88/trx.highram.bin -r 99 

 # Shell #1425 
 cd trx/src/host/layer23/src/transceiver/ 
 sudo ./transceiver -a <ARFCN to sync> -r 99 
 </code></pre> 

 In case of two phones you should run two osmocon applications: 

 <pre> 
 <code class="sh"> 
 # Shell #1424 
 cd trx/src/ 
 sudo host/osmocon/osmocon -m c123xor -p /dev/ttyUSB0 -s /tmp/osmocom_l2 -c target/firmware/board/compal_e88/trx.highram.bin -r 99 

 # Shell #1425 
 cd trx/src/ 
 sudo host/osmocon/osmocon -m c123xor -p /dev/ttyUSB1 -s /tmp/osmocom_l2.2 -c target/firmware/board/compal_e88/trx.highram.bin -r 99 

 # Shell #1426 
 cd trx/src/host/layer23/src/transceiver/ 
 sudo ./transceiver -a <ARFCN> -2 -r 99 
 </code></pre> 

 Make sure your that transceiver is still runing... successfully synchronized to the clock source BTS. 


 h4. 2. [[OpenBSC]] 


 Open another shell and start [[OpenBSC]]: 

 1. Start [[OsmoNITB:]]: 

 <pre> 
 $ osmo-nitb -c ~/.osmocom/openbsc.cfg ~/.osmocom/open-bsc.cfg -l ~/.osmocom/hlr.sqlite3 -P -C --debug=DRLL:DCC:DMM:DRR:DRSL:DNM 
 </pre> 

 2. Start [[OsmoBTS:]]: [[OpenBSC]] runs as a stand-alone network with given config file and data base. In order to use LCR, add '-m' option. In this case the LCR replaces the built-in call control. 

 <pre> 
 $ osmo-bts-trx osmo-nitb -c ~/.osmocom/osmo-bts.cfg ~/.osmocom/open-bsc.cfg -l ~/.osmocom/hlr.sqlite3 -P -m -C --debug=DRLL:DCC:DMM:DRR:DRSL:DNM 
 </pre> 

 Congratulations! Now Very important is the option '-C'. On certain machines, osmo-nitb will halt from time to time while writing counters to database. This Without this option, audio might interrupt several seconds from time to time. 

 The debugging is useful for early tests, because you should get the will quickly see what happens if a mobile requests something. 

 <pre> 
 <0005> bsc_init.c:423  
 WARNING: You are running an 'accept-all' network running. You can use telnet interface on a BTS that is not barred. This configuration is 
 likely to control both [[OsmoNITB:]] interfere with production GSM networks and [[OsmoBTS:]]: should only be used in a RF shielded environment  
 such as a faraday cage! 

 <pre> <001a> input/ipaccess.c:831 enabling ipaccess BSC mode 
 # OsmoNITB telnet interface DB: Database initialized. 
 $ telnet localhost 4242 DB: Database prepared. 
 </code></pre> 


 h4. 2.1 LCR (optional) 


 Start the LCR: 

 # OsmoBTS telnet interface <pre> 
 $ telnet localhost 4241 <code class="sh"> 
 </pre> sudo lcr start 
 </code></pre> 

 You should hopefully see following output: 

 <pre> 
 ** LCR    Version 1.14 

 000000 DEBUG (in sip.cpp/sip_init() line 1997): SIP globals initialized 
 LCR 1.14 started, waiting for calls... 
 000000 TRACE 05.02.16 00:05:03.444 --: LCR 1.14 started, waiting for calls... 
 </code></pre> 

 And following message at [[OpenBSC]] log: 

 <pre> 
 <0006> mncc_sock.c:273 MNCC Socket has connection with external call control application 
 </code></pre> 


 h4. 3. [[OsmoBTS:]] 


 And finally start the BTS by performing [[OsmoBTS:]] instance: 

 <pre> 

 <pre> 
 ((*)) 
   | 
  / \ [[OsmoBTS]] 
 Using MAC address of eth0: 'xx:xx:xx:xx:xx:xx' 
 ... 
 <000a> trx_if.c:176 No response from tranceiver 
 <000a> trx_if.c:176 No response from tranceiver 
 <000a> trx_if.c:176 No response from tranceiver 
 </code></pre> 


 h2. Test 



 h3. Location Updating 


 Switch on the phone. 

 If you have a SIM card for your network MCC/MNC, you can use it and do automatic network search. If not, do a manual network search and select this network. You should see debugging output on [[OpenBSC]] like this: 

 <pre> 
 ... 
  <0002> gsm_04_08.c:424 -> LOCATION UPDATE ACCEPT 
 ... 
 </code></pre> 


 h3. USSD 

 Request @*#100#@ to know which phone number is associated with your phone. Monitor IMSI. 


 h3. Call the output music (LCR required) 

 Now enter phone number 995 to select the test function 5 of osmocon LCR. This test function just plays the hold music. 


 h3. Echo and BFI test (LCR required) 

 Enter phone number 993 to select the transceiver test function 3 of LCR. This test function echoes back everything that is received. Note that it will re-transcode the speech data, so the audio from your voice is compressed and decompressed twice until you can hear a fraction of a second later. 

 You may experience short beeps. These beeps represent all bad frames that could not be decoded or got lost over the air. (Without this test, the missing frames will be extrapolated from previous frame, so some loss rate will not be recognized by the remote end.) 


 h2. VTY control interface 

 It is possible (of course) to see control your working setup manually. Connect the [[OpenBSC]] VTY telnet interface (port 4242 by default): 

 <pre> 
 telnet localhost 4242 
 en 

 # Type 'list' for help 
 # Go to 'configure terminal' if all goes well. If anything should fail, reboot you want to change some configuration params 

 [[OpenBSC]]# 
   help          Description of the phone interactive help system 
   list          Print command list 
   write         Write running configuration to memory, network, or terminal 
   show          Show running system information 
   exit          Exit current mode and start over. down to previous mode 
   disable       Turn off privileged mode command 
   configure     Configuration from vty interface 
   copy          Copy configuration 
   terminal      Set terminal line parameters 
   who           Display who is on vty 
   logging       Configure log message to this terminal 
   drop          Debug/Simulation command to drop Abis/IP BTS 
   bts           BTS related commands 
   sms           SMS related comamnds 
   subscriber    Operations on a Subscriber 
   sms-queue     SMS Queue 
   meas-feed     Measurement export related 

 h2. CalypsoBTS # Example: sending an SMS 
 subscriber imsi <IMSI> sms sender imsi <IMSI2> send Hello, world! 
 </code></pre> 

 See "VTY reference":http://openbsc.osmocom.org/trac/wiki/osmo-nitb_VTY for details. 


 h1. [[CalypsoBTS]] with "OpenBTS":http://openbts.org/ 

 "OpenBTS":http://openbts.org/ OpenBTS 


 OpenBTS is another open source software project aimed to replace legacy telecommunication protocols and traditionally complex, proprietary hardware systems by IP a flexible software architecture. It implements the BTS side protocol stack and also some important core network elements. 

 elements like [[OpenBSC:]] in [[OsmoNITB:]] mode. 


 h3. Installation and configuration 

 


 Follow this "howto":https://github.com/RangeNetworks/dev/wiki in the project wiki. Once you have OpenBTS up and running, you need to change the following configuration parameters in the database (/etc/OpenBTS/OpenBTS.db): 

 By default, the stock transceiver is used by "OpenBTS":http://openbts.org/. It's designed <pre> 
 Control.GSMTAP.TargetIP = 127.0.0.1 
 GSM.Radio.NeedBSIC = 1 
 GSM.Radio.Band = 1800 
 GSM.CellSelection.Neighbors =     (set to work on SDR based hardware (like USRP), but empty string) 
 GSM.RACH.MaxRetrans = 3 
 GSM.RACH.TxInteger = 8 
 GSM.Radio.C0 = <your ARFCN> 
 Control.LUR.OpenRegistration = ^26242.*$ (see note) 
 </code></pre> 

 **Note:** in this is not our case. So, we need example only IMSIs with MCC 262 and the MNC 42 will be allowed to replace it by OsmocomBB transceiver. 

 1. Replace register to the stock transceiver network, change that accordingly. 


 h3. TRX executable 

 Make sure that "OpenBTS":http://openbts.org/ OpenBTS in not running. In the folder where the "OpenBTS":http://openbts.org/ OpenBTS executable resides, create a script with the filename 'transceiver' with the following content: 

 <pre> 
 #!/bin/bash 
 exec <your path to osmocom-bb>/src/host/layer23/src/transceiver/transceiver -a <ARFCN> -r 99 
 </pre> </code></pre> 

 Where ARFCN is the channel of clock source cell. If you have two (or more phones), add '-2' option. 

 2. 
 And make it executable: 

 <pre> 
 <code class="sh"> 
 sudo chmod +x ./transceiver transceiver 
 </pre> 

 h3. </code></pre> 


 h2. Running 

 


 Run the TRX firmware application on the phone as described above. No need 

 You now can start up OpenBTS and should hopefully see the BTS by performing a manual network search with your phone. Monitor the output of osmocon and the transceiver/OpenBTS to see if all goes well. If anything should fail, reboot the phone and start transceiver, the OsmoBTS will run it automatically. 

 over.  

 The "OpenBTS":http://openbts.org/ OpenBTS CLI allows you to monitor system status and change many operating parameters of "OpenBTS":http://openbts.org/ OpenBTS and the Transceiver in real time. 


 h2. Demo 

 https://www.youtube.com/watch?v=Aj1A6F-FAGU 
 https://www.youtube.com/watch?v=FifvFov3RsI 
 https://www.youtube.com/watch?v=PZ4-UCH2ED8 

 h2. References 

 https://www.youtube.com/watch?v=xFjVcxMpA6c 
 https://events.ccc.de/congress/2012/Fahrplan/attachments/2244_29c3_further_hacks_on_the_calypso_platform 


 h2. Known limitations and issues 

 * Two timeslots limitation. Due to some DSP limitations and the non-BTS nature of CalypsoBTS, one phone can serve only one timeslot. Moreover, despite the current transceiver code was extended to support multiple phones ('jolly/testing' branch), this feature Its executable is still incomplete. So, for now, up to two phones could be used to serve up to two physical timeslots. located at /OpenBTS/OpenBTSCLI. 

 * Non-continuous C0 transmission. According to the GSM specifications, Have a C0 base station should keep transmission on all timeslots even if there is nothing to transmit. This makes the mobile stations able to detect them and measure the power levels. Again, a phone isn't BTS. It takes some time to tune between DL and UL frequencies. 
 fun!
Add picture from clipboard (Maximum size: 48.8 MB)