• Table of contents
• ccch_scan
  • • Usage

ccch_scan¶

The ccch_scan program (formerly layer23) is the playground we use for developing the GSM Protocol layers 2 and 3 (GSM TS 04.05, 04.06, 04.08)

Using the ccch_scan program, you can:

• Connect to /tmp/osmocom_l2 socket created by osmocon to exchange data from L1A_L23_Interface.
• Receive GSM Layer1 frames.
  • Dump received GSM Layer1 frames and print some analysis.
  • Send the Layer1 frames as GSMTAP packets to wireshark (see WiresharkIntegration)
  • forward the Layer1 frames to the Layer2 / LAPDm implementation inside ccch_scan
  • forward them from Layer2 into Layer3 code inside ccch_scan.
• receive outgoing frames from Layer3
  • process them through layer2
  • send them as uplink frames to GSMTAP
  • send them to the Layer1 on the phone

The ccch_scan program is used in combination with the layer1bin firmware.

Usage¶

./ccch_scan -a 871 -i 127.0.0.1

to which the [[GSMTAP]] messages are to be sent.

This will connect to the [[osmocon]] application and will receive GSM Layer1 frames. 
The receiving is done in the src/main.c and the frames will be passed to src/l1ctl.c,
from there into src/lapdm.c and finally into src/layer3.c

The output of the ccch_scan application is currently looking like this:
<pre>
Found CCCH burst(s): TDMA: (0003/08/39) tc:3 49 06 1b 3b 80 62 f2 20 01 3a c8 07 0a 15 65 04 b9 00 00 80 00 02 1b  si: 0x1b
        SI3 on wrong TC
Found sync burst: SNR: 16384 TDMA: (0003/15/46) bsic: 49
Found sync burst: SNR: 16384 TDMA: (0003/25/05) bsic: 49
Found sync burst: SNR: 16384 TDMA: (0003/09/15) bsic: 49
Found sync burst: SNR: 16384 TDMA: (0003/19/25) bsic: 49
Found CCCH burst(s): TDMA: (0003/07/39) tc:4 31 06 1c 62 f2 20 01 3a 65 04 b9 00 00 80 00 53 2b 2b 2b 2b 2b 2b 2b  si: 0x1c
        SI4 on wrong TC
Found sync burst: SNR: 16384 TDMA: (0003/14/46) bsic: 49
Found sync burst: SNR: 16384 TDMA: (0003/24/05) bsic: 49
Found sync burst: SNR: 16384 TDMA: (0003/08/15) bsic: 49
Found sync burst: SNR: 16384 TDMA: (0003/18/25) bsic: 49
Found CCCH burst(s): TDMA: (0003/06/39) tc:5 01 06 00 b0 00 58 47 eb 4a 92 53 40 62 84 eb 2b 2b 2b 2b 2b 2b 2b 2b  si: 0x0
        SI13 on wrong TC
</pre>