Project

General

Profile

FakeTRX » History » Version 15

msuraev, 10/23/2018 12:38 PM

1 1 fixeria
h1. FakeTRX (Virtual Um-interface)
2 1 fixeria
3 8 fixeria
FakeTRX is a virtual Um-interface implementation written in Python, which allows you to connect [[OsmocomBB:]] and [[OsmoBTS:]] without actual RF hardware. The main purpose of this software is to facilitate and simplify the development and testing process. In other words, you don't need to physically run your GSM network nor use any kind of special hardware - just run a few scripts and do anything you want / need in your virtual GSM network!
4 1 fixeria
5 1 fixeria
h2. FAQ
6 1 fixeria
7 3 fixeria
h3. What is the difference from [[cellular-infrastructure:Virtual_Um|VIRT-PHY]]?
8 1 fixeria
9 3 fixeria
The main difference is that FakeTRX actually works on GSM L1, while [[cellular-infrastructure:Virtual_Um|VIRT-PHY]] works on higher levels, using GSMTAP and multicast sockets to exchange the data. It means that FakeTRX provides the [[TRX Interface]] for both [[OsmocomBB:]] and [[OsmoBTS:]], and forwards GSM bursts between both sides. So, no need to do any modifications in the [[OsmoBTS:]] source code, just use osmo-bts-trx.
10 1 fixeria
11 1 fixeria
h3. Python?
12 1 fixeria
13 1 fixeria
Of course, Python is slower than C, for example. But it's more than enough for exchanging UDP messages between [[OsmocomBB:]] and [[OsmoBTS:]], and vice versa. Moreover, it can be easily reimplemented in C, if someone interested in better performance.
14 1 fixeria
15 5 fixeria
h3. What about RSSI and ToA (Timing of Arrival)?
16 1 fixeria
17 5 fixeria
Since we are talking about the virtual interface, it's possible to emulate any values for both RSSI and ToA.
18 1 fixeria
19 1 fixeria
h3. Can I run multiple BTS and / or multiple MS instances?
20 1 fixeria
21 1 fixeria
Not yet.
22 1 fixeria
23 1 fixeria
h2. Running
24 1 fixeria
25 1 fixeria
This guide assumes that you already have the Osmocom GSM [[cellular-infrastructure:|network side stack]] compiled and installed. If not, the simplest way is to use the [[osmonitb:|Network in the Box]].
26 1 fixeria
27 13 msuraev
{{graphviz_link()
28 13 msuraev
digraph G {
29 13 msuraev
    rankdir = LR;
30 13 msuraev
    subgraph cluster_M {
31 13 msuraev
        mobile1 [label="Mobile"];
32 13 msuraev
        mobile2 [label="Mobile"];
33 13 msuraev
        TRXcon1 [label="TRXcon"];
34 13 msuraev
        TRXcon2 [label="TRXcon"];
35 13 msuraev
        label = "Mobile side";
36 13 msuraev
    }
37 13 msuraev
    subgraph cluster_N {
38 13 msuraev
        OsmoBSC;
39 13 msuraev
        OsmoBTS1 [label="osmo-bts-trx"];
40 13 msuraev
        OsmoBTS2 [label="osmo-bts-trx"];
41 13 msuraev
        FakeTRX1 [label="FakeTRX"];
42 13 msuraev
        FakeTRX2 [label="FakeTRX"];
43 13 msuraev
        label = "Network side";
44 13 msuraev
    }
45 15 msuraev
    FakeTRX1 -> OsmoBTS1 [label="TRX Interface"];
46 15 msuraev
    FakeTRX2 -> OsmoBTS2 [label="TRX Interface"];
47 13 msuraev
    OsmoBTS1 -> OsmoBSC;
48 13 msuraev
    OsmoBTS2 -> OsmoBSC;
49 14 msuraev
    mobile1 -> TRXcon1 [label="L1CTL"];
50 14 msuraev
    mobile2 -> TRXcon2 [label="L1CTL"];
51 13 msuraev
    TRXcon1 -> FakeTRX1 [label="TRX Interface"];
52 13 msuraev
    TRXcon2 -> FakeTRX2 [label="TRX Interface"];
53 13 msuraev
    }
54 13 msuraev
}
55 13 msuraev
}}
56 13 msuraev
57 6 fixeria
Since [[OsmocomBB:]] was extended with [[TRX Interface]] support, follow the corresponding instructions and compile OsmocomBB with [[TRX Interface#The-trxcon-application|trxcon]] application. After that, you may find the FakeTRX toolkit located in 'src/target/trx_toolkit/'. See README for more details.
58 1 fixeria
59 1 fixeria
_Tip: feel free to use tmux or screen to avoid a mess with multiple windows_
60 1 fixeria
61 1 fixeria
1. Run the network side stack you have. In this example we will use the [[osmonitb:|Network in the Box]]:
62 1 fixeria
63 1 fixeria
<pre>
64 1 fixeria
$ osmo-nitb -c ./openbsc.cfg -l ./hlr.sqlite3 -P -C --debug=DRLL:DCC:DMM:DRR:DRSL:DNM
65 1 fixeria
</pre>
66 1 fixeria
67 1 fixeria
2. Run the fake transceiver:
68 1 fixeria
69 1 fixeria
<pre>
70 6 fixeria
$ cd osmocom-bb/src/target/trx_toolkit/
71 1 fixeria
$ python ./fake_trx.py
72 1 fixeria
</pre>
73 1 fixeria
74 11 osmith
3. Start [[OsmoBTS:]] (in case you want to [[cellular-infrastructure:build from source]], enable the TRX backend with @./configure --enable-trx=yes@).
75 1 fixeria
76 1 fixeria
<pre>
77 1 fixeria
$ osmo-bts-trx -c ./osmo-bts.cfg
78 1 fixeria
</pre>
79 1 fixeria
80 1 fixeria
Congratulations! Now you have a virtual GSM network running. As you can see, the virtual transceiver emulates the clock source, as this is required for [[OsmoBTS:]]. Also, it handles only a few important commands, such as RXTUNE and TXTUNE, but ignores other irrelevant ones.
81 1 fixeria
82 1 fixeria
4. In order to make [[OsmocomBB:]] applications able to work with FakeTRX, you need to run [[TRX Interface#The-trxcon-application|trxcon]]:
83 1 fixeria
84 1 fixeria
<pre>
85 1 fixeria
$ cd osmocom-bb/src/host/trxcon/
86 4 fixeria
$ ./trxcon
87 1 fixeria
</pre>
88 1 fixeria
89 1 fixeria
5. Finally, run any L2&3 application, e.g. ccch_scan:
90 1 fixeria
91 1 fixeria
<pre>
92 1 fixeria
$ cd osmocom-bb/src/host/layer23/src/misc/
93 1 fixeria
$ ./ccch_scan -a ARFCN -i 127.0.0.1
94 1 fixeria
</pre>
95 1 fixeria
96 1 fixeria
Please note that ARFCN value should match the one your BTS configured to.
97 1 fixeria
98 1 fixeria
Since this step, you should see the broadcast messages coming from the virtual network, like in case of a real one. You can use Wireshark to analyze them.
99 1 fixeria
100 1 fixeria
h2. Running [[mobile]] application
101 1 fixeria
102 12 osmith
As you should already know, [[mobile]] applications implements a simple mobile phone with SMS, USSD and voice calls. In the virtual network we can benefit from using a virtual SIM card. Just configure one according to your network configuration, see the example below. If you are starting with the default config from the source tree (@osmocom-bb/doc/examples/mobile/default.cfg@), make sure to change @sim reader@ to @sim test@ in the @ms 1@ section.
103 1 fixeria
104 1 fixeria
<pre>
105 1 fixeria
test-sim
106 1 fixeria
  imsi 901700000000000
107 1 fixeria
  no barred-access
108 1 fixeria
  rplmn 901 70
109 1 fixeria
</pre>
110 1 fixeria
111 1 fixeria
Make sure you have the virtual network running, then run mobile the same way as in case of a Calypso based phone:
112 1 fixeria
113 1 fixeria
<pre>
114 1 fixeria
$ cd osmocom-bb/src/host/layer23/src/mobile/
115 1 fixeria
$ ./mobile -i 127.0.0.1
116 1 fixeria
</pre>
117 1 fixeria
118 1 fixeria
Now you can use mobile's telnet interface to manage your virtual phone:
119 1 fixeria
120 1 fixeria
<pre>
121 1 fixeria
$ telnet localhost 4247
122 1 fixeria
$ ...
123 1 fixeria
</pre>
124 1 fixeria
125 1 fixeria
h2. Demo
126 1 fixeria
127 1 fixeria
https://www.youtube.com/watch?v=Uxdaui8EkjY
128 1 fixeria
129 1 fixeria
h2. Project status
130 1 fixeria
131 10 fixeria
Supported:
132 10 fixeria
133 10 fixeria
* Simulation and randomization of both RSSI and ToA
134 10 fixeria
* Burst capture to file (see data_dump.py)
135 10 fixeria
* Injection of bursts and commands
136 10 fixeria
137 1 fixeria
Further plans:
138 1 fixeria
139 2 fixeria
* Allow multiple BTS to work with multiple BB instances
140 2 fixeria
* Distinguish debug messages (BTS / MS, ID)
Add picture from clipboard (Maximum size: 48.8 MB)