Using the rmanager interface
YateBTS inherits Yate’s rmanager interface. It is a module that allows controlling Yate using a simple Telnet client. Users have access to Yate’s rmanager options and also new ones added for MBTS and YBTS. This is the main reason why each configuration command will be called by simply writing mbts before each command name, as seen in the examples below:
mbts power
mbts config
mbts stats
The first step in accessing the rmanager interface, is connecting to YateBTS via the telnet command below:
telnet 0 5038
List of mbts commands
To see the mbts commands when connected, just type “mbts” after connecting and press Tab after it.
Yate will respond with the available mbts commands.
Alarms
This command lists the latest alarms.
Audit
This command goes through the current configuration and reports the issues discovered.
The command provides the following diagnosis information:
- ERROR -- referring to keys with invalid values
- WARNING -- referring to key values that are different from the factory radio calibration values
- WARNING -- referring to interacting values that might lead to errors
- WARNING -- referring to site values that are still default
- INFO -- referring to non-default values
- INFO -- referring to custom/deprecated key/value pairs
Below you can see a WARNING output example:
+_______________________+
| WARNING : Site Values| | Which Are Still |
|Default key current-|value |
|These should be set to| |fit your installation:| |config key value |
+______________________+
GSM.Identity.BSIC.BCC “2”
GSM.Identity.BSIC.NCC “0”
GSM.Identity.CI “10”
GSM.Identity.LAC “1000”
GSM.Identity.MCC “001”
GSM.Identity.ShortName “YateBTS”
Cellid
This command displays the following identity parameters:
- MCC -- Mobile Country Code, formed from three digits
- MNC -- Mobile Network Code, formed from two or three digits
- LAC -- Location Area Code, containing 16 bits, any from 0 to 65520 being valid values (note that values 0xFFxx are reserved)
- CI -- Cell Identity, containing 16 bits, any from 0 to 65535 being valid values
With arguments:
mbts cellid
the command will set the given values and will update the GSM Identity configuration parameters table.
This command will also clear the TMSI Table.
Without arguments, the cellid command will simply display the current values of MCC, MNC, LAC, and CI.
To modify the identity parameters you must do so in the configuration parameters file.
Chans
This command displays the physical channel status for active dedicated channels from the channel table. The generated values are the following:
- TN – the Timeslot Number
- chan type – the type of the dedicated channel
- transaction ID – the key for the corresponding entry in the transaction table that is currently using the channel
- RSSI dB – the uplink RSSI at the basestation with a value expressed in dB according to the full scale
- UPFER pct – the uplink frame erasure rate expressed as a percentage
- TXPWR dBm – the current transmitter power from the mobile station, expressed in dBm
- TXTA sym – thr timing advance in symbol periods
- DNLEV dBM – the downlink RSSI with a value expressed in dBm, measured by the mobile station
- DNBER pct – the downlink bit error rate expressed as percentage
You can see an output example below:
CN TN chan transaction active recyc UPFER RSSI TXPWR TXTA DNLEV DNBER Neighbor Neighbor
CN TN type id pct dB dBm sym dBm pct ARFCN dBm
Config
This command displays and modifies parameters in the configuration table. It is highly useful when operating the mbts interface and is typically used to create, check or modify a value in the configuration table.
mbts config <pattern>
lists all the configuration values containing a particular pattern.
mbts config <key> <value>
– creates or sets the given key-value pair in the configuration table.
Crashme
This command turns off and restarts the MBTS without actually turning off Yate. See the output below:
mbts crashme
Peer pid 32033 vanished
Restart scheduled in 1ms 0x7f758bd26460
Scheduled stop in 0ms
Stopping …
Worker thread terminated 0xf6a520
Stopped 0xf6a520
Worker thread terminated 0xf6a300
Stopped 0xf6a300
Peer pid 32033 terminated
Stopped 0xf6a1a0
Worker thread terminated 0xf69de0
Stopped 0xf69de0
Worker thread terminated 0xf69fc0
Stopped 0xf69fc0
State changed RadioUp -> Idle
State changed Idle -> Starting restart counter 1/10
Started worker thread 0xf69de0
Started 0xf69de0
Started worker thread 0xf69fc0
Started 0xf69fc0
Started 0xf6a1a0
Started worker thread 0xf6a520
Started 0xf6a520
Started worker thread 0xf6a300
Started 0xf6a300
Starting peer ‘/usr/local/lib/yate/server/bts/mbts’ ‘(null)’
Started peer pid=32191
State changed Starting -> WaitHandshake
Restart scheduled in 120000ms 0x7f758bd26460
MBTS connected to YBTS
devconfig
This command allows the configuration of certain parameters that are not commonly meant to be modified in a normal environment. However, when necessary, the devconfig command displays these parameters and allows them to be changed. Among them are the Control, GGSN, GPRS, GSM, SGSN, Log or TRX related parameters.
Below you can see a part of a possible output:
Below you can see a part of a possible output:
Control.GSMTAP.GPRS no default
Control.GSMTAP.GSM no default
Control.GSMTAP.TargetIP 127.0.0.1 default
Control.LUR.AttachDetach yes default
Control.Reporting.PhysStatusTable (disabled) default
Control.Reporting.StatsTable (disabled) default
Control.SACCHTimeout.BumpDown 1 default
Control.SMSCB.Table (disabled) default
Control.VEA yes default
GGSN.DNS (disabled) default
GGSN.Firewall.Enable 1 default
GGSN.IP.MaxPacketSize 1520 default
GGSN.IP.ReuseTimeout 180 default
GGSN.IP.TossDuplicatePackets no default
GGSN.Logfile.Name ggsn.log
GGSN.MS.IP.Base 192.168.99.1 default
GGSN.MS.IP.MaxCount 254 default
GGSN.MS.IP.Route (disabled) default
freqcorr
This command identifies the radio frequency offset and allows it to be modified. The output typically looks as follows:
mbts freqcorr
current freq. offset is xxx
GPRS
This command enables access to a series of subcommands that control the GPRS radio mode.
The syntax is the following mbts gprs <subcommand> <options…>.
List
mbts gprs list [ms|tbf|ch] [-v] [-x] [-c] [id]
These are the subcommands:
- it lists active objects of a specified type. When the id is specified it refers to an id number of a mobile station or a temporary block flow (TBF).
The listing can:
- -v – be verbose
- -x – include expired rather than active entities
- -c – include MS capabilities
A detailed description of the parameters reported by this command and how to interpret them can be found on the mbts gprs list page.
Stat
mbts gprs stat
- shows GPRS statistics (number of channels, allocated TBF, mobile stations etc.).
Free
mbts gprs free ms|tbf|ch id
- deletes parameters from one entity.
Freex
mbts gprs freex
- deletes expired mobile stations and TBF structs.
Debug
mbts gprs debug [level]
- sets debug level, 0 turns off.
Start
mbts gprs start [step]
- starts GPRS and can optionally start it in a single-step-mode.
Stop
mbts gprs stop [-c]
- stops GPRS threads; it releases channels with the -c option.
Step
mbts gprs step
- performs single step in the MAC service loop and requires a start step.
Set
mbts gprs set [val]
- prints and optionally sets a variable (see the source for names).
Rach
mbts gprs rach
- simulates a RACH that starts the GPRS service.
TestBSN
mbts gprs testbsn
- tests bsnframe number functions.
Console
mbts gprs console [0|1]
- sends messages to console (default=1 for debugging).
Mem
mbts gprs mem
- acts as a memory leak detector and prints the numbers of structs in use.
Help
This command lists all the mbts commands available. help followed by the name of a particular command gives more details about its role and functions.
Load
This command lists the current basestation load of active channels and queue lengths.
mbts load
will generate the following results:
- SDCCH load – the number of active SDCCHs from the total available
- TCH/F load – the number of TCH/Fs from the total available
- AGCH/PCH load – the number of queued messages waiting to be transmitted on the AGCH or PCH
- Paging table sizes – the number of mobile stations being paged
- Transactions/TMSIs – the number of active transactions in the basestation and the size of the TMSI Table
- T3122 – the value of the T3122 hold-off timer expressed in seconds
- current PDCHs – active GPRS channels
- utilization % – the GPRS channel utilization
Noise
This command generates the current level of receive noise in the RSSI dB as seen in the example below:
mbts noise
noise RSSI is -42 dB wrt full scale
MS RSSI target is -40 dB wrt full scale
Notices
This command prints the legal and copyright notices associated to the version of the installed YateBTS, as seen below.
Yate-BTS MBTS Component
Copyright 2008, 2009, 2010 Free Software Foundation, Inc.
Copyright 2010 Kestrel Signal Processing, Inc.
Copyright 2011, 2012, 2013 Range Networks, Inc.
Copyright 2013, 2014 Null Team Impex SRL
Copyright 2014 Legba, Inc.
“OpenBTS” is a registered trademark of Range Networks, Inc.
Contributors:
SC Null Team Impex SRL:
Paul Chitescu
Legba, Inc.
David Burgess
Range Networks, Inc.:
David Burgess, Harvind Samra, Donald Kirker, Doug Brown,
Pat Thompson, Kurtis Heimerl
Kestrel Signal Processing, Inc.:
David Burgess, Harvind Samra, Raffi Sevlian, Roshan Baliga
GNU Radio:
Johnathan Corgan
Others:
Anne Kwong, Jacob Appelbaum, Joshua Lackey, Alon Levy
Alexander Chemeris, Alberto Escudero-Pascual
Incorporated L/GPL libraries and components:
libusb, LGPL 2.1, various copyright holders, http://www.libusb.org
Incorporated BSD/MIT-style libraries and components:
A5/1 Pedagogical Implementation, Simplified BSD License,
Copyright 1998-1999 Marc Briceno, Ian Goldberg, and David Wagner
Incorporated public domain libraries and components:
sqlite3, released to public domain 15 Sept 2001, http://www.sqlite.org
This program comes with ABSOLUTELY NO WARRANTY.
Use of this software may be subject to other legal restrictions,
including patent licensing and radio spectrum licensing.
All users of this software are expected to comply with applicable
regulations and laws. See the LEGAL file in the source code formore information.
Power
This command allows viewing or modifying the downlink power parameters. With arguments:
mbts power
The command changes the power control limits. Without arguments, the command simply displays the current power settings and limits.
Rawconfig
This command is similar to the config command, but has more features than the latter. It can be used to define and modify custom key-value pairs in the configuration table. Additionally, it allows experimental values to be added for existing configuration keys. The rawconfig command is typically used to set custom log levels for system components in troubleshooting cases.
mbts rawconfig
Control.GSMTAP.GPRS no
Control.GSMTAP.GSM yes
Control.GSMTAP.TargetIP 192.168.168.120
Control.GSMTAP.TargetPort (disabled)
Control.LUR.AttachDetach yes
Control.Reporting.PhysStatusTable (disabled)
Control.Reporting.StatsTable (disabled)
Control.SMSCB.Table (disabled)
Control.VEA yes
Regperiod
This command prints or sets the registration timer GSM T3212 and SIP registration period. To change these two parameters, type:
mbts regperiod [GSM] [SIP]
The GSM stands for the value of GSM T3212 expressed in minutes and SIP is the value of the SIP registration period is also expressed in minutes. The value has to be a factor of 6 and needs to be smaller than the value of the GSM. If it is set to \0″, the periodic registration is disabled.
Below you can find an example:
mbts regperiod
T3212 is 24 minutes
Reload
This command reloads the configuration table. Some parameters can by modified with this command, while others can be modified only after restarting the configuration. Use this command if the parameter you wish to change accepts being reloaded.
Otherwise, restart the configuration. See an example below:
GSMConfig.cpp:80:regenerateBeacon: regenerating system information messages, changemark 2
Rmconfig
This command followed by a key will revert the parameter to its default value. If what follows after the command is a custom key, then the configuration parameter will be removed from the configuration table.
mbts rmconfig
Below is an example for reverting the GSM.Timer.T3212 to its default value:
mbts rmconfig GSM.Timer.T3212
GSM.Timer.T3212 set back to its default value
Rxgain
This command displays or sets the receiver gain. If it is used without parameters, the command displays the current Rx gain, expressed in dB, stored in the GSM.Radio.RxGain parameter.
mbts rxgain
current RX gain is 48 dB
This command can modify the Rx gain in real time.
Scan
This command performs an uplink interference scan in the current configured band. These are the subcommands:
- start - Start the scan, which suspends normal operation.
- stop - Stop the scan and resume normal operation.
- report - Report the best (low-interference) ARFCNs found in the scan.
- list - List interference levels for all ARFCNs and plot noise levels, similar to a spectrum analyzer.
The scan takes up to a minute to produce its first results, depending on the band. The longer the scan is allowed to run, the more accurate the results will be.
The reported value in the scan results is a “noise figure”, which indicates in dB how high the interference level is above the natural noise floor for that channel.
An interference-free channel has a noise figure of 0 dB.
Here is an example of use:
bts scan start
Uplink interference scan started in 900 band.
NOTE: Normal GSM/GPRS operation is suspended during scanning.
To stop the scan, use ‘mbts scan stop’.
mbts scan report
Scan not yet ready. Try again in 12 seconds.
mbts scan report
Uplink scan report for 900 band…
Average noise figure 31.3547 dB.
Best ARFCNs and their noise figures in dB:
ARFCN 11 28 dB, 892.2 MHz
ARFCN 14 28 dB, 892.8 MHz
ARFCN 19 28 dB, 893.8 MHz
ARFCN 22 28 dB, 894.4 MHz
ARFCN 25 28 dB, 895 MHz
ARFCN 29 28 dB, 895.8 MHz
ARFCN 34 28 dB, 896.8 MHz
ARFCN 35 28 dB, 897 MHz
ARFCN 37 28 dB, 897.4 MHz
ARFCN 53 28 dB, 900.6 MHz
ARFCN 56 28 dB, 901.2 MHz
ARFCN 65 28 dB, 903 MHz
ARFCN 70 28 dB, 904 MHz
ARFCN 105 28 dB, 911 MHz
ARFCN 111 28 dB, 912.2 MHz
mbts scan list
Uplink scan dump of all channels scanned in 900 band:
ARFCN 0 29 dB *****************************
ARFCN 1 30 dB ******************************
ARFCN 2 35 dB ***********************************
ARFCN 3 29 dB *****************************
ARFCN 4 30 dB ******************************
ARFCN 5 29 dB *****************************
ARFCN 6 29 dB *****************************
ARFCN 7 31 dB *******************************
ARFCN 8 30 dB ******************************
ARFCN 9 29 dB *****************************
ARFCN 10 30 dB ******************************
ARFCN 11 28 dB ****************************
ARFCN 12 31 dB *******************************
…
mbts scan stop
Scanning stopped. Returning to normal GSM/GPRS operation.
SGSN
This command allows access to control the SGSN/GGSN sub-commands. The syntax is the following mbts sgsn <subcommand> <options…>. These are the subcommands:
- free (imsitlli) id
- help – displays help options
- list (imsitlli) id – displays a list of current GPRS sessions tracked by the SGSN
Shutdown
This command shuts down the YateBTS processes immediately. When arguments are provided, the command will wait for a short amount of time to end in-progress calls and transactions before shutting down YateBTS. During this time no other calls or transactions will be started.
Stats
This command displays performance counters. If a pattern is added, the command will display only the counters matching the pattern. With the “clear” argument, all counters will be cleared.
mbts stats [patt] | clear
Sysinfo
This command displays the current system information messages. You can see an output example below:
RR System Information Type 1 cellChannelDescription=() RACHControlParameters=(maxRetrans=1 txInteger=14 cellBarAccess=0 RE=1 AC=0x400)
RR System Information Type 2 BCCHFrequencyList=(EXT-IND=0 BA-IND=0 ARFCNs=(576 )) NCCPermitted=(0x1) RACHControlParameters=(maxRetrans=1 txInteger=14 cellBarAccess=0 RE=1 AC=0x400)
RR System Information Type 3 LAI=(MCC=001 MNC=02 LAC=0x3e8) CI=10 controlChannelDescription=(ATT=1 BS_AG_BLKS_RES=2 CCCH_CONF=1 BS_PA_MFRMS=0 T3212=4) cellOptions=(PWRC=0 DTX=2 RADIO_LINK_TIMEOUT=15) cellSelectionParameters=(CELL-RESELECT-HYSTERESIS=3 MS-TXPWR-MAX-CCH=0 ACS=0 NECI=1 RXLEV-ACCESS-MIN=0) RACHControlParameters=(maxRetrans=1 txInteger=14 cellBarAccess=0 RE=1 AC=0x400) SI3RO=( RA_COLOUR=0)
RR System Information Type 4 LAI=(MCC=001 MNC=02 LAC=0x3e8) cellSelectionParameters=(CELL-RESELECT-HYSTERESIS=3 MS-TXPWR-MAX-CCH=0 ACS=0 NECI=1 RXLEV-ACCESS-MIN=0) RACHControlParameters=(maxRetrans=1 txInteger=14 cellBarAccess=0 RE=1 AC=0x400)GPRS enabled; RA_COLOUR=(0)
RR System Information Type 5 BCCHFrequencyList=(EXT-IND=0 BA-IND=0 ARFCNs=(576 ))
RR System Information Type 6 CI=10 LAI=(MCC=001 MNC=02 LAC=0x3e8) cellOptions=(PWRC=0 DTX=2 RADIO_LINK_TIMEOUT=15) NCCPermitted=(0x1)
TRXfactory
This command displays the following information stored in the radio, in the factory:
- SDR Serial Number
- GSM.Radio.Band
- TRX.RadioFrequencyOffset
- GSM.Radio.RxGain
- TRX.TxAttenOffset
- RF Serial Number
txatten
This command displays the transmitter attenuation, expressed in dB, when used without parameters.
When used with parameters, the command will set the attenuation to the corresponding value.
mbts txatten
current TX attenuation is 1 dB
unconfig
This command sets the value associated with the key given to an empty string in the configuration table, resulting in disabling it.
mbts unconfig
– removes the associated key values from the configuration table.
uptime
This command displays the basestation uptime and the frame number. Please see an example below:
Unix time 1415708851, Tue Nov 11 14:27:31 2014
uptime 2 minutes, frame 0:1309004
version
This command prints the information about the the version of the installed YateBTS.
For example:
release 4.0.1 built Aug 29 2014 rev