Open BTS

Welcome to OpenBTS! AGPLv3 openbts.sf.net Your IMSI is ". " SMS message with just such a text would welcome your cell phone for "free" (and encrypted) mobile network OpenBTS - Open Base Transceiver Station. Configuration, which was loaned to us, we attempt to transfer the amount. In RFX 900 module (s) you have several options to create your own GSM Base Station. Specifics and 95% of all responses, see the OpenBTS for dummies , along with a patch for various modules and 52 MHz oscillator.But what kind of stability and versatility is concerned, there are not many opportunities for experimentation. The following is a summary of the findings of the "tuning" OpenBTS with the original 64 MHz oscillator ( 64 MHz internal clock ). Let us but gradually ...

Assuming you have a single module RFX 900 ( 750 - 1050 MHz ) can be used Single daughterboard patch . But it is questionable whether it is even possible for the initial hours, respectively. if you can find a mobile phone capable of registering ... The second, more acceptable solution is 2x RFX 900 (2x 275USD):

Again, not the ideal situation, but the connection "works". In this configuration has been successfully registered, for example. Sony Ericson K530i . The ability to use other mobile phones OpenBTS is limited oscillator.

Test Call

So we have a pair of RFX 900 , solve settings configuration files, run OpenBTS andAsterisk . Selecting the setting " GSM network only " , to remove the battery from the mobile phone to erase the original TMSI - Temporary Mobile Subscriber Identity . Putprogrammable SIM card, we may hope that the card supplied operator is not blocked.After switching ideally receive a message about successful registration, or manually select the GSM network search. This part is the 64 MHz oscillator "random" - the phone is registered or not. Ideally, cell phone intercepts network identification under the previous setup, registration takes place correctly and the phone display shows " OpenBTS ".

Welcome SMS:

After successful registration will be verified TMSI and IMSI in OpenBTS CLI command tmsis . Asterisk on startup " verbose "( asterisk-vvvgc ) indicate the registration and displays IMSI. Btw IMSI has been generated by a script, and any resemblance to the real potential is purely coincidental.

OpenBTS 2.6 Mamou & Asterisk & X-Lite @ BackTrack 4 R2 USRP test shot

Summary of the phone is registered and after dialing the assigned number is ringing. The call quality is acceptable, SMS messages sent fromOpenBTS CLI is delivered ...

In the screenshot you can see us, a modified version of the popular operating system originating from the BackTrack Linux ( Offensive Security ) charged arsenal for analysis of GSM networks, respectively. create your own. This is not a breakthrough solution, but distribution has cleverly solved "few" trinkets that owners USRP can appreciate. More about this version of the operating system BackTrack 4 in one of the following articles ...