Osmocom Conferences (OsmoDevCon, OsmoCon, OsmoDevCall): OsmoDevCall #18 - Control/User Plane Separation + PFCP

Added by laforge about 1 year ago

We're happy to announce the 18th incarnation of OsmoDevCall

This time laforge will be presenting on Control/User Plane Separation (CUPS) and PFCP

When: Thursday, November 25, 2021 from 20:00 CET (yes, thursday instead of friday this time due to scheduling conflicts of the speaker)

Time Topic Who
20:00 Meet and Greet everyone
20:10 Control/User Plane Separation (CUPS) and PFCP laforge
21:00 USSE (Unstructured Supplementary Social Event) everyone

Where: (Big Blue Button of

Osmocom Conferences (OsmoDevCon, OsmoCon, OsmoDevCall): OsmoDevCall videos at

Added by laforge about 1 year ago

Thanks to tnt and the c3voc team, we now are publishing all of our OsmoDevCall videos on - specifically at

We strive to continue to push all OsmoDevCall recordings there to reach a wider audience of like-minded hackers (in the sense of people who want to understand technology down to the last bit and play with it) and ensure long-term availability of our video recordings.

(For those who prefer a proprietary service like youtube, there is also a mirror at - but it's harder to filter out the OsmoDevCall specific videos)

Cellular Network Infrastructure: November 2021 Osmocom CNI releases

Added by pespin about 1 year ago

The Osmocom project has released new version 202111 of the CNI (Cellular Network Infrastructure) software, including OsmoTRX, OsmoBTS, OsmoPCU, OsmoBSC, OsmoMGW, OsmoMSC, OsmoHLR, OsmoSGSN, OsmoGGSN, OsmoSTP, OsmoSIPConnector, and others.

Those new tagged/released versions contain 9 months of work since the previous versions released during February 2021.

You can find pre-compiled binary packages of our latest release for a variety of Debian and Ubuntu GNU/Linux versions at Latest_Builds.

List of tagged versions and link to related ChangeLog

Project Version Changelog
libosmocore 1.6.0
libosmo-abis 1.2.0
libosmo-sccp (+ OsmoSTP) 1.5.0
libosmo-ranap (+ OsmoHNBGW) 1.1.0
OsmoTRX 1.4.0
OsmoBTS 1.4.0
OsmoPCU 1.0.0
OsmoBSC 1.8.0
OsmoMSC 1.8.0
OsmoHLR 1.4.0
osmo-mgw 1.9.0
osmo-sip-connector 1.6.0
OsmoSGSN 1.8.0
OpenGGSN 1.8.1
osmo-pcap 0.2.1
osmo-gbproxy 1:0.2.0
osmo-cbc 0.2.3
osmo-smlc 0.2.1
osmo-e1d 0.2.2
osmo-hnodeb 0.0.1
osmo-uecups 0.1.4
osmo-gsm-manuals 1.2.0

Noteworthy Changes

Misc / Common

  • libosmocore: rate_ctr/stat_item groups can now be identified by a unique name string, not only by id number.
  • libosmocore: stat_item groups are now accessible through CTRL interface
  • libosmocore: Important AMR fixes
  • libosmocore: New APIs introduced for base64 encode/decode
  • libosmocore: Osmocom logging system becomes non-blocking by default
  • libosmocrypt: New APIs introduced for key dferivation functions
  • libosmogb: Lots and lots of fixes and improvements in new NS protocol implementation (NS2)
  • libosmo-sigtran: Automatically create routes for routing key when in ASP role
  • libosmo-sigtran: Allow apps set internally proper IPv4/v6 default hosts
  • VAMOS support
  • Support to set socket DSCP and priority values (QoS)
  • New PCUIF over IPA multiplex of OML BTS<->BSC link to communicate transparently osmo-pcu and osmo-bsc
  • Osmocom style dynamic timeslots support now being configured as SDCCH8
  • A5/4 support


  • uhd: Ensure clock source is locked before using it
  • lms: Fix very low output power due to band not probperly set.
  • lms.uhd: Allow changing band between poweroff & poweron


  • Massive refactoring of the shutdown/reconnect logic
  • BSC redundancy: support for multiple OML addresses
  • Keep the process ongoing trying to reconnect on Abis link down
  • Try one reconnect to previously connected BSC before trying next one
  • Support forwarding proto IPAC_PROTO_EXT_PCU BSC<->PCU (PCUIF over IPA multiplex of OML link)
  • SDCCH8 support for the Osmocom style dynamic timeslots
  • MS power control: C/I based power control decision
  • MS Power control: Use P_CON_INTERVAL=2 by default
  • BS power control: EWMA averaging for reported RxQual
  • MS/BS power control: fixed handling of -SUB/-FULL values
  • MS/BS power control: fixed EWMA downscaling bug
  • MS/BS power control: logic and logging improvements
  • Timing Advance control: interval (loop suspension) support
  • Timing Advance control: various fixes and logic improvements
  • Early Immediate Assignment support
  • Interference reporting to BSC and PCU (#1569)
  • Prioritization of CS paging over PS paging
  • Configurable socket priority of RTP sockets
  • Improved handling of the Uplink and Downlink measurements
  • Fixed and improved handling of the Channel Identification IE
  • Fixed a race condition during the activation of dynamic timeslots
  • Fixed sending Load Indications when BTS is not RSL-connected
  • Fixed re-(de)activation of already (de)activated lchans
  • Initial support for static userspace probes via systemtap
  • Various stability and performance improvements and bugfixes
  • New TRXDv2 protocol and burst batching (#4006)
  • Support for different per-timeslot TSC values
  • Initial VAMOS and AQPSK support (#4941)
  • Constrained BS power control on BCCH carrier
  • BCCH carrier power reduction mode
  • PDCH power saving (#4772)
  • Temporary ACCH Overpower
  • Important AMR fixes
  • A5/4 support


  • Heavy refactoring of code, reworked to use osmocom FSMs.
  • Change code to be GSM-clock driven, instead of mostly wall-clock driven. As a result most N3.. and T3... are much more reliable now.
  • Polling capacity improvements through introduction of new PDCH UL Controller class (allow multiple concurrent polls per PDCH, polling for other than N+13 is now supported).
  • Uplink multi-slot TBF allocation support added
  • Transmit empty blocks through PCUIF instead of dummy rlcmac blocks when there is no MS listening on PDCH
  • Implement T3141 (3GPP TS 44.018 sec, contentiuon resolution timeout)
  • PAGING-CS optimizations for known MS (send paging on subset od all PDCHs where MS is listening)
  • Several fixes for CSN.1 decoder
  • Bunch of new counters/stats added
  • Several fixes and improvements in NS code
  • NACC: Support Neighbor Address Resolution over PCUIF IPA multiplex
  • PAGING-PS fixes: Fix paging with TMSI and MS ending with assigned IMSI 000. Avoid repeated paging if T3113 is still running.
  • Lots of fixes in lots of places, and lots of code clean up
  • VTY: new gsmtap related commands available, similar to those in osmo-bts.


  • MGW pooling
  • Call-reestablishment
  • Temporary ACCH Overpower for osmo-bts
  • Support for adding a new BTS at run-time
  • VAMOS PoC (signalling and VTY commands) for osmo-bts
  • BS Power control: BCCH carrier power reduction operation
  • BS Power control: constrained power control on BCCH carrier
  • BS Power control: avoid inheriting bs_power from old lchan
  • MS Power control: initial MS power loop implementation
  • MS Power control: parameters for C/I based power control
  • MS Power control: use P_CON_INTERVAL=2 by default
  • Channel allocator: pick lchans with least interference
  • Support for Location Services and the Lb interface to SMLC
  • Support SDCCH/8 for Osmocom style dynamic timeslots
  • Support Neighbor Address Resolution over PCUIF IPA multiplex
  • Support for A5/4: signalling and VTY parameters
  • Support Channel Mode Modify procedure
  • Handover: support upgrade TCH/H -> TCH/F (without AFS bias)
  • Handover: proper handling of the -FULL/-SUB measurements
  • DSCP and PCP differentiation of Downlink Abis traffic
  • Early Immediate assignment for VSAT backhaul
  • CTRL interface bindings for applying a VTY config file
  • CTRL interface bindings for handover parameters
  • CTRL interface bindings for neighbour cells
  • VTY sets default TEI for 'trx' nodes according to TRX number
  • VTY commands for Ericsson RBS2000: sync and RX diversity
  • VTY command 'assignment' actually triggers Assignment, not HO
  • VTY option to forbid use of TCH for non-voicecall signalling
  • Configurable interference measurement parameters
  • Configurable TA filtering for CHANnel ReQuireD messages
  • Reworked warnings about unknown/non-supported BTS features
  • Frequency hopping: various fixes and improvements
  • BTS type 'sysmobts' is deprecated in favor of 'osmo-bts'
  • Fixed manual channel activation (from the VTY) for nanoBTS
  • ipaccess-config: various fixes and improvements
  • Speedup shutdown using the new osmo_select_shutdown() API
  • Fixed and improved neighbor configuration options
  • Use osmo_clock_gettime everywhere
  • stats: BTS uptime counter
  • stats: transitions from BORKEN state due to LCHAN_EV_TS_ERROR
  • stats: all_allocated:{sdcch,tch} rate counters
  • stats: all_allocated:{static_sdcch,static_tch} rate counters
  • stats: bts.N.cm_serv_rej:<cause> rate counters
  • stats: incoming_intra_bsc_ho:* rate counters


  • SGs, CSFB / SRVCC improvements and fixes
  • Support for Call Re-establishment
  • Support new MNCCv8 protocol version (with GCR support for LCLS)
  • UMTS UEA encryption is working properly now, and UTRAN encryption algorithms are not VTY configurable

OsmoHLR (and libosmo-gsup-client)

  • VTY: save config format fixes
  • VTY: enable show subscribers filtered by IMEI
  • packaging: Add post-upgrade script for automatic db upgrade
  • New DB schema format: v6.

OsmoMGW (and libosmo-mgcp-client)

  • mgcp-client: Fix dupicated MGCP DLCX being sent sometimes
  • mgcp-client: Add support for MGW pooling
  • mgw: fix RTP patching not taking into account RTP marker (M) bit
  • Support wildcarded MGCP DLCX to allow resetting endpoint on startup
  • Several more counters/stats added
  • Several fixes here and there


  • MNCC v8: GCR support (for LCLS)
  • Several fixes (crash, memleak), improved logging

OsmoSTP (and libosmo-sigtran)

  • Several fixes and improvements for IPA AS/ASP
  • Introduce notion of configurable 'quirks' (compatibility against peers containing deviations from standard)
  • vty: automatically create routes for routing key when in ASP role
  • Minimalistic support for XUDT/XUDTS
  • Introduce rx/tx rate counteres on AS and ASP level


  • Several (G)MM FSM improvements (GERAN, UTRAN)
  • Iu: Timer X3314 has been dropped
  • gtp: Delete ctx upon receive UpdateCtxResp with cause Non-existent
  • Support forwarding RIM messages over GTPCv1 EUTRAN<->GERAN
  • Several logging improvements

OsmoGGSN (and libgtp)

  • ggsn: Reject PDP CTX ACT for static IP addresses (not supported)
  • ggsn: Fix heap-use-after-free during Recovery without associated PDP
  • Several logging improvements
  • Introduce program gtp-echo-responder


  • Change default ports of client, server_
    • osmo-pcap-client 4237 -> 4227
    • osmo-pcap-server 4238 -> 4228


  • Support setting rt-prio and cpu-affinity mask through VTY
  • Add CTRL VTY commands
  • Don't route messages to an SGSN if it is down
  • Forward MS_REGISTR_ENQ/_RESP correctly
  • Improve routing of BSSGP STATUS
  • Improved documentation
  • Lots of fixes and improvements


  • Add VTY command to configure local bind IP of UECUPS socket

Osmocom Conferences (OsmoDevCon, OsmoCon, OsmoDevCall): OsmoDevCall #17 - TDM basics + icE1usb in practice

Added by laforge about 1 year ago

We're happy to announce the 17th incarnation of OsmoDevCall

This time the main presentation by tnt will be presenting on icE1usb in practice

When: Friday, November 12, 2021 from 20:00 CET

Time Topic Who
20:00 Meet and Greet everyone
20:10 Introduction into E1, TDM, PDH, SDH laforge
20:30 icE1usb in practice tnt
later USSE (Unstructured Supplementary Social Event) everyone

Where: (Big Blue Button of

pySim: pySim-shell support for sysmoISIM-SJA2 key data / files

Added by laforge about 1 year ago

Starting from f44256c7dff6d24f1f940d4ca71219abbb0c7e34, pySim-shell now supports the non-standard files of the sysmoISIM-SJA2 SIM cards containing authentication key material for AKA and TS 03.48 OTA.

This way you can now interactively inspect and/or modify aspects such as

UMTS AKA key material and configuration

pySIM-shell (MF/ADF.USIM/EF.USIM_AUTH_KEY)> read_binary_decoded
    "cfg": {
        "only_4bytes_res_in_3g": 0,
        "use_sres_deriv_func_2_in_3g": 0,
        "use_opc_instead_of_op": 1,
        "algorithm": "milenage" 
    "key": "07583fd7518b42752fea8b7063faa756",
    "op": null,
    "opc": "440aac831e58941abe17a5db76470776" 
pySIM-shell (MF/ADF.USIM/EF.USIM_SQN)> read_binary_decoded 
    "flag1": {
        "skip_next_sqn_check": 0,
        "delta_max_check": 1,
        "age_limit_check": 0,
        "sqn_check": 0,
        "ind_len": 5
    "flag2": {
        "rfu": 0,
        "dont_clear_amf_for_macs": 0,
        "aus_concealed": 1,
        "autn_concealed": 1
    "delta_max": 8589934592,
    "age_limit": 8589934592,
    "freshness": [ 32, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ]

Milenage configuration (constants)

pySIM-shell (MF/DF.SYSTEM/EF.MILENAGE_CFG)> read_binary_decoded
    "r1": 64,
    "r2": 0,
    "r3": 32,
    "r4": 64,
    "r5": 96,
    "c1": "00000000000000000000000000000000",
    "c2": "00000000000000000000000000000001",
    "c3": "00000000000000000000000000000002",
    "c4": "00000000000000000000000000000004",
    "c5": "00000000000000000000000000000008" 

OTA key material

pySIM-shell (MF/DF.SYSTEM/EF.0348_KEY)> read_record_decoded 1
    "sec_domain": 0,
    "key_set_version": 112,
    "key_type": "kic",
    "key_length": 16,
    "algorithm": "des",
    "mac_length": 8,
    "key": "c039ed58f7b81446105e79ebfd" 

pySim: pySim-prog critical fix against corruption of key material

Added by laforge about 1 year ago

In 80901d6d39fd05b923c48145147c47f0ad5252ca we fixed a critical bug regarding the writing of key material when using the classic pySim-prog utility. All versions since 2e6dc03f345150353ecc796f18614c02256bd2df on July 31st are affected.

This means if you are using any of the affected versions in the range above, writing keys will write an erroneous key to your card, where the first byte of the user-specified key is dropped, the remaining 15 bytes are written from offset 0, and the last byte of the key will not be updated on the card.

Programming key material by sysmo-{isim,usim}-tool was not affected by this.

Users are requeste to update to current master or any version including 80901d6d39fd05b923c48145147c47f0ad5252ca

We apologize for any inconvenience.

Osmocom Conferences (OsmoDevCon, OsmoCon, OsmoDevCall): OsmoDevCall #15 - VoLTE/IMS pcap deep-dive

Added by laforge about 1 year ago

We're happy to announce the 15th incarnation of OsmoDevCall

This time laforge will be presenting a VoLTE / IMS pcap file deep dive.

When: Friday, October 8th, 2021 from 20:00 CEST

Where: (Big Blue Button of

UPDATE: Location moved to due to server problems at

Cellular Network Infrastructure: Osmocom package feeds for Debian 11 + Ubuntu 21.04

Added by laforge about 1 year ago

Osmocom is happy to announce releasing binary package feeds for the latest tagged versions and nightly builds for both Debian 11 and Ubuntu 21.04.

At the same time, we have retired the support for Debian 8 and Ubuntu 19.10.

The full list of distributions and architectures we provide binary packages for can be seen at Latest_Builds and Nightly_Builds - including links to the package feeds and instructions how to use them.


Also available in: Atom

Add picture from clipboard (Maximum size: 48.8 MB)