What this talk is about

Running your own Internet-style network

Running your own GSM network

Until 2009 the situation looked like this:

Why no cellular FOSS?

Enter Osmocom

In 2008, some people (most present in this room) started to write FOSS for GSM

Classic GSM network architecture

Gsm_structures.svg

GSM Acronyms, Radio Access Network

MS

Mobile Station (your phone)

BTS

Base Transceiver Station, consists of 1..n TRX

TRX

Transceiver for one radio channel, serves 8 TS

TS

Timeslots in the GSM radio interface; each runs a specific combination of logical channels

BSC

Base Station Controller

GSM Acronyms, Core Network

MSC

Mobile Switching Center; Terminates MM + CC Sub-layers

HLR

Home Location Register; Subscriber Database

SMSC

SMS Service Center

GSM Acronyms, Layer 2 + 3

LAPDm

Link Access Protocol, D-Channel. Like LAPD in ISDN

RR

Radio Resource (establish/release dedicated channels)

MM

Mobility Management (registration, location, authentication)

CC

Call Control (voice, circuit switched data, fax)

CM

Connection Management

Osmocom GSM components

osmocom-gsm.svg

Classic GSM network as digraph

running-osmo-gsm__1.png

Simplified OsmoNITB GSM network

running-osmo-gsm__2.png

which further reduces to the following minimal setup:

running-osmo-gsm__3.png

So our minimal setup is a Phone, a BTS and OsmoNITB.

Which BTS to use?

We assume a sysmoBTS in the following tutorial

OsmoBTS Overview

osmo-bts.svg

See separate talk about BTS hardware options later today.

BTS Hardware vs. BTS software

Physical vs. Logical Arch (sysmoBTS)

running-osmo-gsm__4.png
running-osmo-gsm__5.png

Physical vs. Logical Arch (SDR e.g. USRP B2xx)

running-osmo-gsm__6.png
running-osmo-gsm__7.png

IP layer traffic

⇒ Make sure you permit the above communication in your network/firewall config

Configuring Osmocom software

Configuring OsmoBTS

Configuring OsmoBTS

bts 0
 band DCS1800 <1>
 ipa unit-id 1801 0 <2>
 oml remote-ip 192.168.100.11 <3>
  1. the GSM frequency band in which the BTS operates

  2. the unit-id by which this BTS identifies itself to the BSC

  3. the IP address of the BSC (to establish the OML connection towards it)

Note
All other configuration is downloaded by the BSC via OML. So most BTS settings are configured in the BSC/NITB configuration file.

Purpose of Unit ID

running-osmo-gsm__8.png

⇒ BSC identifies BTS on Unit ID, not on Source IP!

Configuring OsmoNITB

Configuring OsmoNITB

network
 network country code 1 <1>
 mobile network code 1 <2>
 short name Osmocom <3>
 long name Osmocom
 auth policy closed <4>
 encryption a5 0 <5>
  1. MCC (Country Code) e.g. 262 for Germany; 1 == Test

  2. MNC (Network Code) e.g. mcc=262, mnc=02 == Vodafone; 1 == Test

  3. Operator name to be sent to the phone after registration

  4. Only accept subscribers (SIM cards) explicitly authorized in HLR

  5. Use A5/0 (== no encryption)

Configuring BTS in OsmoNITB (BTS)

network
 bts 0
  type sysmobts <1>
  band DCS1800 <2>
  ms max power 33 <3>
  periodic location update 6 <4>
  ip.access unit_id 1801 0 <5>
  codec-support fr hr efr amr <6>
  1. type of the BTS that we use (must match BTS)

  2. frequency band of the BTS (must match BTS)

  3. maximum transmit power phones are permitted (33 dBm == 2W)

  4. interval at which phones should send periodic location update (6 minutes)

  5. Unit ID of the BTS (must match BTS)

  6. Voice codecs supported by the BTS

Configuring BTS in OsmoNITB (TRX)

network
 bts 0
  trx 0
   arfcn 871 <1>
   max_power_red 0 <2>
   timeslot 0
    phys_chan_config CCCH+SDCCH4 <3>
   timeslot 1
    phys_chan_config TCH/F <4>
    ...
   timeslot 7
    phys_chan_config PDCH <5>
  1. The RF channel number used by this TRX

  2. The maximum power reduction in dBm. 0 = no reduction

  3. Every BTS needs need one timeslot with a CCCH

  4. We configure TS1 to TS6 as TCH/F for voice

  5. We configure TS6 as PDCH for GPRS

What a GSM phone does after power-up

→ let’s check if we can perform LOCATION UPDATE on our own network

Verifying our network

→ should show LOCATION UPDATE request / reject / accept

Exploring your GSM networks services

Using the VTY

Program

Telnet Port

OsmoPCU

4240

OsmoBTS

4241

OsmoNITB

4242

OsmoSGSN

4245

Using the VTY (continued)

OpenBSC> show subscriber imsi 901700000003804
    ID: 12, Authorized: 1
    Extension: 3804
    LAC: 0/0x0
    IMSI: 901700000003804
    TMSI: F2D4FA0A
    Expiration Time: Mon, 07 Dec 2015 09:45:16 +0100
    Paging: not paging Requests: 0
    Use count: 1

Further Reading

The End