Testing and simulation via OpenBTS

[ph0t0n]

Continuous testing of the app could be done via OpenBTS running in legal RF space.

• Software: OpenBTS 5.0+ (GitHub)
• Hardware: bladeRF (GitHub)

Desired testing plan from owners @SecUpwN @E3V3A : ?

[ph0t0n]

USA does not use GSM-900 band, only GSM-850 & GSM-1900.
usually very low power experimentation is done in GSM-900 since ITU region 2 ISM & amateur radio 900 MHz have some overlap with GSM-900 channels. careful control of environment is necessary since it is not a complete overlap.

[SecUpwN]

Thanks for your eager contributions to our project, @ph0t0n. As you can see from section SEEKING, we are currently searching for someone who owns such a device to help us with continuous verification of our app. We are in touch with a few companies who might be able to do so, yet we'd prefer open source enthusiasts like you helping us on this Issue. Hints on who I should get in touch with are appreciated!

[ph0t0n]

i have the bladeRF and can run openBTS at low power. bladeRF is a SDR so it is not our IMSI catcher enemy device, but it can act like any device given enough programming.

I got openBTS 5.0 compiled last night.

you can assign this to me, question is, what would we like to do with a openBTS cell?

[E3V3A]

@ph0t0n Great! One thing you can do is trying to mimic a cell tower next to your home, and try to get your phone to connect to it. At low power this should be easy (and legal) to do. See how the phone reacts.

[ph0t0n]

yep that will be my first test. i am not sure if I'll have immediate success since my phone may try to favor much stronger local 850/1900 2GSM. i will report back when i have something interesting happening.

[SecUpwN]

you can assign this to me, question is, what would we like to do with a openBTS cell?

If possible, please continuously verify the functions that have already been fully implemented in #230.

[He3556]

We log the signal strength already. There should be an extra table with the data, when the phone switches the cell and the received signal strength. As far as i remember that function is working. Would be great to see this data after your test. Thanks for your help! Great news for our project.

[SecUpwN]

Great news for our project.

Fully agree with this! Since we now have found someone, shall I remove this position from SEEKING?

[ph0t0n]

@SecUpwN great, that testing plan is something to work with.

ill report back when i have my phone joining the openBTS cell and functioning in a basic way.

i own the bladeRF so you can consider me a long term contributor to this part.

if there are other RF exploring things (like gsm capture with gr-gsm or airprobe(?) to watch phone & real tower behave) i can also contribute.

[SecUpwN]

i own the bladeRF so you can consider me a long term contributor to this part.

AWESOME! If you would like to be added to our team page, please send me an email with your data. ;-)

[He3556]

When you talk about the testing plan - you mean the detection list?
Only DB_id 2 (LAC/CID Consistency) is fully implemented. You had to change the LAC while the BTS is running.
For the first step, it might be easier to check DB_id 9 (RX signal Strength) as this is a very important point and we need some research there.

@E3V3A what do you think?

[E3V3A]

@He3556 :

We log the signal strength already.

Unfortunately it seem broken, which is why I just filed #462.

[ph0t0n]

@SecUpwN i appreciate the offer, but let me contribute something useful to the project before you add me as team member!

i will report back when i have openbts running and my phone will join the network.

openbts is running and seems to be not reporting errors. i would suspect to see its gsm-900 cell.

however my phone only sees nearby gsm-850 and gsm-1900, not the gsm-900 openbts.

i'm working on testing that the openbts->bladerf is even working. i do not see any errors but i'll look with another SDR.

will update

[SecUpwN]

i appreciate the offer, but let me contribute something useful to the project before you add me as team member!

Fair deal. ;-)

i'm working on testing that the openbts->bladerf is even working.

Great! Take your time, we'll be patient to receive your first results. By the way: Since we filed this as an Issue here, we should probably specify when to close it so that it does not stay open forever..

[ph0t0n]

hi @SecUpwN . i received some GSM low gain 850/900/1800/1900 antennas for my bladeRF. previously i was using my TX antenna slightly out of band and that of course introduces unknown electrical and RF variables.

in addition this frees up my wide-band RX antenna to use with a second SDR so that i can verify openBTS is driving bladeRF with any signal at all, instead of just relying on my personal quad-GSM phone.

i'm also trying to procure a dual band Eurasia GSM phone locally, this is a bit of a challenge in north america. :) it would be convenient if a test phone would ignore strong local gsm-850/1900. i know someone has a weird Nokia sitting around, working on it.

i am fine with whatever time limit you would like to prescribe for this item. 6 months may be a bit short for a a useful test set implementation, just because of real life interruptions. are you ok with 9 months or 1 year? (obviously i am a lot more interested than these numbers say, i am just being realistic.)

[SecUpwN]

i received some GSM low gain 850/900/1800/1900 antennas for my bladeRF...

What you're telling us here is great and we're very curious to receive first test results! ;-)

i am fine with whatever time limit you would like to prescribe for this item.

What I actually meant was not to "limit" the testing (in an ideal case you'd assure continuous testing of the core functions of our app), I actually meant to set some sort of goal for this Issue so that when fixed, we can close it. I am a friend of eliminating our Issues in the Issue Tracker, not piling them forever.

@E3V3A, how about granting @ph0t0n access to edit our wiki and let him use General Overview or even Technical Overview (whichever is better suited for this) to add his test results and close this Issue?

[ph0t0n]

(update)

i am using specific quad band rx/tx antennas now. i have independently verified with another SDR that my openBTS is running on the ARFCN channel i chose. also the openBTS software is showing other signs of working at RF level, for example i can change desired power level or sample input noise dB level and these values are reflected with inspection by secondary SDR on wide rx antenna. so i think that RF wise i am seeing success with openBTS and underlying bladeRF transceiver code.

however my phone won't see the network when i scan manually.

i suspect at this point i am having an openBTS config issue, and will continue investigating.

[E3V3A]

Try with another phone, and make sure you're operating in GSM (2G) mode only. If phone is using defaults, it's probably using UMTS first and GSM last...

[ph0t0n]

@E3V3A yes I am forcing the phone to 2G of course.

quick update:

• i have finally been able to set my test phone to "EURO bands" deep inside the hidden setup menu.
• i think this affects 850/900/1800/1900 search order, but this is just a guess.
• _now i can see my openBTS cell._
• i cannot register to my cell because i have more software to compile, oops.

other:

• i am waiting for a used Nokia dual 900/1800 i purchased for further testing.
• noise and power values that openBTS sees on the bladeRF correspond to what i am seeing with my secondary rtlsdr used for monitoring.

so, this is some good progress. i just have limited personal time.

[E3V3A]

Great thanks for reporting back to us!

[E3V3A]

Any news?

[SecUpwN]

Any news?

I assume that it does not make much sense pushing @ph0t0n. He has added updates by himself here when he had some. @E3V3A, please set a goal for this Issue so that we can close it at a reached point, I do not want to further misuse our Issue tracker like we already do with #230. Also, please answer my question from #459 (comment) if we shall grant him access to our WIKI for publishing his results. Thanks.

[E3V3A]

Why not just craft a PR for a simulation.md file and we can edit it from there?

[SecUpwN]

Why not just craft a PR for a simulation.md file and we can edit it from there?

Because I do want to keep our root directory as clean as possible. We'll be ending up with another number of files in there. it is large enough already. I'd prefer #459 (comment), why don't you?

[ph0t0n]

hi all, i am sorry for the slow progress. i have many other work/personal things going on.

today in the post i received my Nokia 3310. this is a 900/1800 eurasia phone which i will call phone N.

recall my other phone is a modern android with LTE/UMTS/GSM. let's call it phone A from now on. it can be willingly shoved onto 2GSM, but it is not consistently willing (or at least the order of operations of selecting 2G with exposed menu, and using special hidden menu to force EURO band, and returning from the hidden menu), which should force 900/1800 networks only, is not absolutely clear.

that is why i hope i will have an easier time testing with both phone N and A.

regarding the cell, openBTS is working. the cell is visible. phone A tries to join the cell when i manually select it.

but, openBTS needs more software to be compiled which i have not yet done. it is a human time blocking problem.

i am still here and still interested. it is truly just personal time issue. if you like i can report back every friday or something(?)

[ph0t0n]

also i am open to whatever organizational / docs / whatever structure you'd like to have for this issue. if you would like me to edit a .md once i have interesting reports, ok. wiki, whatever. goals, sure, i am open.
thanks!

[SecUpwN]

also i am open to whatever organizational / docs / whatever structure you'd like to have for this issue.

Hey @ph0t0n, listen up: Huge THANKS for taking this Issue seriously! As you can see from our DevCycle, we're releasing an official build every sunday. But in order to enhance our development, it would be better if you run the tests with our Buildozer Builds. Please send me an email so that I can add you there. Once anything changes on our development branch, a fresh build will be created and you may use it to test. I will soon also elevate your edit rights to COLLABORATOR so that you can edit our WIKI when @E3V3A and @He3556 agreed that you may put your results into the page Cell Monitoring. Fair?

[ph0t0n]

@SecUpwN hi guys, sorry again for the delayed response. i've been in the middle of moving house and my bladeRF time was frozen down to zero. once i unpack my workspace i can join back in. i DO remain interested and DO want to work on this.

i am fine with whatever ACLs you wish to attach to me, i will use them carefully and am happy to follow your build / QA process.

[SecUpwN]

@ph0t0n, I have granted COLLABORATOR status to you. Please craft a neat markdown table using the Markdown Table Generator and publish your ongoing results in Cell Monitoring. Thank you for testing!