Project

General

Profile

FakeTRX » History » Revision 3

Revision 2 (fixeria, 11/20/2017 05:18 PM) → Revision 3/44 (fixeria, 11/23/2017 07:07 AM)

h1. FakeTRX (Virtual Um-interface) 

 FakeTRX is a virtual Um-interface implementation written in Python, which allows you to connect [[OsmocomBB:]] and [[OsmoBTS:]] without actual RF hardware. The main purpose of this software is to facilitate and simplify the development and testing process. In other words, you don't need to physically run your GSM network and use Calypso based hardware - just run a few scripts and do anything you want / need in your virtual GSM network! 

 h2. FAQ 

 h3. What is the difference from [[cellular-infrastructure:Virtual_Um|VIRT-PHY]]? [[VIRT-PHY]]? 

 The main difference is that FakeTRX actually works on GSM L1, while [[cellular-infrastructure:Virtual_Um|VIRT-PHY]] [[VIRT-PHY]] works on higher levels, using GSMTAP and multicast sockets to exchange the data. It means that FakeTRX provides the [[TRX Interface]] for both [[OsmocomBB:]] and [[OsmoBTS:]], and forwards GSM bursts between both sides. So, no need to do any modifications in the [[OsmoBTS:]] source code, just use osmo-bts-trx. 

 h3. Python? 

 Of course, Python is slower than C, for example. But it's more than enough for exchanging UDP messages between [[OsmocomBB:]] and [[OsmoBTS:]], and vice versa. Moreover, it can be easily reimplemented in C, if someone interested in better performance. 

 h3. What about RSSI? 

 Since we are talking about the virtual interface, it's possible to emulate any values for both RSSI and ToA (Time of Arrival). Moreover, it's possible to implement some bit corruption for the forwarded bursts. It's up to an end user. For now, FakeTRX performs simple RSSI value randomization and nothing more. 

 h3. Can I run multiple BTS and / or multiple MS instances? 

 Not yet. 


 h2. Running 

 This guide assumes that you already have the Osmocom GSM [[cellular-infrastructure:|network side stack]] compiled and installed. If not, the simplest way is to use the [[osmonitb:|Network in the Box]]. 

 Since [[OsmocomBB:]] was extended with [[TRX Interface]] support, follow the corresponding instructions and compile OsmocomBB with [[TRX Interface#The-trxcon-application|trxcon]] application. After that, you may find the FakeTRX toolkit located in 'src/target/fake_trx/'. See README for more details. 

 _Tip: feel free to use tmux or screen to avoid a mess with multiple windows_ 

 1. Run the network side stack you have. In this example we will use the [[osmonitb:|Network in the Box]]: 

 <pre> 
 $ osmo-nitb -c ./openbsc.cfg -l ./hlr.sqlite3 -P -C --debug=DRLL:DCC:DMM:DRR:DRSL:DNM 
 </pre> 

 2. Run the fake transceiver: 

 <pre> 
 $ cd osmocom-bb/src/target/fake_trx/ 
 $ python ./fake_trx.py 
 </pre> 

 3. Start [[OsmoBTS:]]: 

 <pre> 
 $ osmo-bts-trx -c ./osmo-bts.cfg 
 </pre> 

 Congratulations! Now you have a virtual GSM network running. As you can see, the virtual transceiver emulates the clock source, as this is required for [[OsmoBTS:]]. Also, it handles only a few important commands, such as RXTUNE and TXTUNE, but ignores other irrelevant ones. 

 4. In order to make [[OsmocomBB:]] applications able to work with FakeTRX, you need to run [[TRX Interface#The-trxcon-application|trxcon]]: 

 <pre> 
 $ cd osmocom-bb/src/host/trxcon/ 
 $ ./trxcon --trx-port 5703 
 </pre> 

 5. Finally, run any L2&3 application, e.g. ccch_scan: 

 <pre> 
 $ cd osmocom-bb/src/host/layer23/src/misc/ 
 $ ./ccch_scan -a ARFCN -i 127.0.0.1 
 </pre> 

 Please note that ARFCN value should match the one your BTS configured to. 

 Since this step, you should see the broadcast messages coming from the virtual network, like in case of a real one. You can use Wireshark to analyze them. 

 h2. Running [[mobile]] application 

 As you should already know, [[mobile]] applications implements a simple mobile phone with SMS, USSD and voice calls. In the virtual network we can benefit from using a virtual SIM card. Just configure one according to your network configuration, for example: 

 <pre> 
 test-sim 
   imsi 901700000000000 
   no barred-access 
   rplmn 901 70 
 </pre> 

 Make sure you have the virtual network running, then run mobile the same way as in case of a Calypso based phone: 

 <pre> 
 $ cd osmocom-bb/src/host/layer23/src/mobile/ 
 $ ./mobile -i 127.0.0.1 
 </pre> 

 Now you can use mobile's telnet interface to manage your virtual phone: 

 <pre> 
 $ telnet localhost 4247 
 $ ... 
 </pre> 

 h2. Demo 

 https://www.youtube.com/watch?v=Uxdaui8EkjY 

 h2. Project status 

 Further plans: 

 * Allow multiple BTS to work with multiple BB instances 
 * Distinguish debug messages (BTS / MS, ID) 
 * Randomize RSSI for forwarded bursts 
 * Burst capture to file 
 * Burst injection 
Add picture from clipboard (Maximum size: 48.8 MB)