IMPORTANT NOTICE: This page contains information about a legacy version of the Osmocom software. This legacy version is no longer maintained. If you use it, don't be surprised if it doesn't work. It was your choice to ignore man-years worth of developments, improvements and fixes. Please migrate to the active/supported software (Osmocom CNI, consisting of OsmoBSC, OsmoMSC, OsmoHLR, OsmoSTP, OsmoMGW - a NITB style setup is described at Osmocom_Network_In_The_Box).

OpenBSC is the current name for a software project that started with the name bs11-abis.

What is OpenBSC

It started as a BSC (Base Station Controller) side implementation of the A-bis protocol, as implemented in the GSM Technical Specification 08.5x and 12.21. It can run either
  • as OsmoBSC, exposing an A interface towards an external MSC, or
  • as OsmoNITB (Network In The Box), whert implements a minimal subset of the BSC, MSC. SMSC and HLR.
The goal of the project is to
  • provide a basis for experimentation and security research with GSM from the network side
  • provide a zero-cost alternative for hands-on experience with GSM systems in education and training
  • learn more about GSM networks on a lower level, particularly the practical aspects with real-world equipment
  • provide a stable/reliable network-side GSM implementation for small networks that don't need millions of subscribers or 99.99999% availability


While OpenBSC is mainly written in portable C99 code, there are is one non-portable part: The E1 input driver requires a Linux kernel with mISDN support and an E1 interface card compatible with mISDN. You only need this if you have an E1 based BTS!

To operate a GSM network, you not only need OpenBSC but of course also some kind of GSM BTS. The only currently tested configurations are with a

IF you feel geeky, you could also build a BTS yourself, using full-duplex capable SDR (Software Defined Radio) hardware and a usual PC with OsmoTRX and OsmoBTS software. The software installation is described at the network_from_scratch page.

Configurations / Modes

OpenBSC network-in-the-box (NITB) mode

This is very different from a classic GSM network in which the BSC is only one minor element in the distributed network consisting
of many different elements like BSC, MSC, HLR, etc. Nonetheless, it is the classic mode to operate OpenBSC. In this configuration, you only need (at least) one BTS and OpenBSC. There is no need for a MSC, HLR, VLR, AuC or any other traditional GSM network components.

In order to use the NITB mode, you will use the osmo-nitb program.

Interconnecting OpenBSC with an ISDN or SIP PBX

If you want to connect calls outside of your OpenBSC based GSM network, you can have Linux Call Router and OpenBSC
work together to create a setup like this:

OpenBSC in BSC-only mode

If you want to use OpenBSC as a classic GSM BSC, you can do that as well. However, you will need all other parts of the GSM
network and a MSC that can provide an A-over-IP interface using SCCP-lite

In order to use the BSC-only mode, you will use the osmo-bsc program.


Information related to a specific BTS model

Topics related to BTSs with classic E1 interface (non-IP based):

Miscellaneous Information

  • GSM -- Some links for starting to understand GSM
  • LegalNotes -- Important Legal notes on operating GSM base stations
  • FieldTests -- The OpenBSC field tests and their reports


Source code


The OpenBSC project does not publish official releases. Users are recommended to use the latest git master.


You can check out the source code via

git clone git://

or browse it at

Mailing list

There's a developer mailing list called
Subscription is available at "h2. IRC (Internet Relay Chat)

We have an IRC channel where some developers and users hang out. You can find it at:

Project status

Things that work

  • Housekeeping
    • OML Initialization of the BTS
    • Support for frequency hopping channels on BTS equipment that supports it (like BS-11)
    • RSL bringup, channel allocation, Channel required / Immediate Assign
  • Mobility Management
    • Very simplistic HLR implemented as sqlite database
    • Non-secure Authorization using IMEI/IMSI and regular SIM cards.
    • Authentication using COMP128v1 if you have SIM cards with known Ki
    • IMEI/IMSI skimming of all phones that try to register with OpenBSC
    • Transmission of MM INFO packets with operator name and local time / timezone
    • paging of mobiles that are registered to the BTS
    • keeping track of which location area a phone has last performed location updating
    • in-call handover between multiple cells inside one BSC
  • SMS Support
    • SMS reception and SMS sending, including routing between subscribers
    • Sending of SMS from OpenBSC command line
    • Sending and receiving of SMS through SMPP
  • Voice Call Support
    • MO (Mobile Originated) and MT (Mobile Terminated) calls
    • TCH/F support with FR and EFR codec
    • TCH/H support with HR and AMR codec
  • Cell Broadcast Support
  • USSD (only for built-in USSD commands, no external interface)
  • E1 support
    • demultiplex of the four 16k sub-channels with voice data contained in one E1 timeslot
    • support for multiple TRX in one BTS
    • support for multiple BTS connected to the same E1 link (multi-loop configuration)
  • Abis/IP support
    • Abis/IP protocol with IPA multiplex for osmo-bts and nanoBTS
    • RTP gateway to interoperate E1 based BTS and IP based BTS on one BSC and switch calls between them
  • GPRS/EDGE support
    • configuring the OML objects/attributes for GPRS and EDGE
    • setting SYSTEM INFORMATION 13 via RSL
    • configurable RAID/CGI/NSVCI/NSEI/BVCI
    • have the PCU in the BTS interoperate a SGSN with Gb (NS-over-IP) interface
    • beta state OsmoSGSN included along OpenBSC
  • dynamic PDCH / TCH switching
    • Osmocom style "TCH/F_TCH/H_PDCH" pchan types are used as PDCH while no voice call is active,
      implemented on all osmo-bts models and compatible with Ericsson RBS.
    • ip.access style "TCH/F_PDCH" pchan types are compatible with the nanoBTS and also
      implemented on all osmo-bts models.

Things that are implemented but don't work yet or aren't tested yet


Things that are not implemented

  • Any type of transcoding of voice data (we leave this to the external MNCC handler / media gateway)
  • CSD calls
  • emergency call handling (works in osmo-bsc, but not in osmo-nitb)


OpenBSC was mainly developed by Harald Welte and Holger Freyther.

Contributions (in no specific order) by Dieter Spaar, Stefan Schmidt, Daniel Willmann, Jan Luebbe, Thomas Seiler, Andreas Eversberg, Sylvain Munaut, Ciaby, Alexander Chemeris, Neels Hofmeyr, Nico Golde, Pablo Neira.

Special thanks to Dieter Spaar for BS11-Init and tons of feedback and comments, without which we would not have been able to make progress as quickly as we did.

Files (0)

Updated by laforge 4 months ago ยท 45 revisions

Add picture from clipboard (Maximum size: 48.8 MB)