Feature #4882
openHSPA+ Picocell availiable in U.S
0%
Description
The Ericsson RBS6402 WCDMA Picocell can be obtained from ebay recently at a very good price.It runs on Texas Instrument Keystone SoC,and have a good capacity compared to other femtocells
Multi standard: WCDMA, LTE and Wi-Fi (optional) ● Up to 10 bands in three modules available:2-4 LTE/WCDMA bands per module ● 2 3GPP bands operate simultaneously and 1 Wi-Fi module operates in 2 bands ● LTE 2 Carrier Aggregation up to 300/50 Mbps DL/UL ● LTE 2 Carrier and LAA/LTE-U 5GHz unlicensed band LTE: Carrier bandwidth 5,10 and 20 MHz 2x2 MIMO WCDMA: 21/5.76 Mbps DL/UL, HW prepared for Dual Carrier 42 Mbps DL RNC connected, Full mobility Wi-Fi 2.4 GHz 802.11 b/g/n, 3x3 MIMO, 23 dBm (EIRP, 18 dBm per chain) Wi-Fi 5 GHz: 802.11 a/n/ac, 3x3 MIMO, 23 dBm (EIRP, 18 dBm per chain) RF Power 3GPP: Up to 2x250 mW per module (total 4x250 mW) Antenna: Integrated omni-directional antennas for LTE/WCDMA and Wi-Fi Support for external antennas for LTE/WCDMA Typical coverage: 800 - 2 500 m² depending on building type Active users: Up to 64 for WCDMA and up to 128 for LTE TRANSMISSION^ Interfaces: 1 Gbps Electrical Ethernet, Optical as an option SFP and transmission module options Features Internet-grade Backhaul support, TWAMP Security: IPsec for untrusted networks Signed SW and secure O&M access for untrusted locations Synchronization: GPS, NTP, IEEE 1588v MECHANICAL SPECIFICATIONS HxW xD: 280x167x62mm (excluding connector field) Volume: 2.8 liters Weight: 2.5 kg Mounting: Flexible mounting on walls and ceilings INTERFACE SPECIFICATIONS^ Power supply: Power over Ethernet line, Power over Ethernet injector or External AC/DC adapter LED indication: Total 8 LED for 3GPP, Backhaul & Wi-Fi GPS: Support for external GPS (optional) ENVIRONMENTAL SPECIFICATIONS Environment: ETSI 3.1, IP Normal operating temp.: 0 - +50º C with fan, 0 - +40º C with passive cooling OSS support: Integrated to OSS-RC/Ericsson Network Manager
Files
Updated by laforge over 3 years ago
FYI: the RBS6402 for LTE is what was used by Osmocom to operate a LTE network at the CCC Camp 2019 as well as at the CCC Congress 2019 (together with open5gs).
There are two important topics:
- it's relatively difficult to get them into a working/configured scenario. This information is not publicly known or documented.
- the supported feature set hugely depends on the software version installed on the device. All the units that "we" so far have managed to obtain during the last years contain LTE-only software builds, and hence are not an option for HSPA+
Updated by copslock over 3 years ago
laforge wrote:
FYI: the RBS6402 for LTE is what was used by Osmocom to operate a LTE network at the CCC Camp 2019 as well as at the CCC Congress 2019 (together with open5gs).
There are two important topics:
- it's relatively difficult to get them into a working/configured scenario. This information is not publicly known or documented.
- the supported feature set hugely depends on the software version installed on the device. All the units that "we" so far have managed to obtain during the last years contain LTE-only software builds, and hence are not an option for HSPA+
I knew those problem for Ericsson,but the sub-varaint available at this time is different from the one you guys used previously,and FCC showed it supports WCDMA on this variant.Besides,It's worthy to have some fun with just couples of bucks.Anyway the major goal is getting more devices to work with osmocom infrastructure
Updated by lynxis over 3 years ago
I'm working in my free time to get those devices up and running with open5gs.
However I'm unsure if it's possible to get WCDMA out of these, because the correct firwmare with wcdma support might be missing.
Atm I'm looking into the automatic configuration using an AIWS server.
AIWS = Automatic Integration Web Server
The rbs6402 request via dhcp for an AIWS server (dhcp option 72) or try to connect to aiws.ai.ericsson port 2497, which must be an https webserver.
the rbs6402 ignores certificate errors and request "/autobind/<serial>". Serial is shown on top of the rbs6402.
I'ven't yet tested any files, but I hope and expect it has to be a "RBS Auto Integration Summary file (xml)" behind the url.
Updated by copslock over 3 years ago
lynxis wrote:
I'm working in my free time to get those devices up and running with open5gs.
..........
You have to get into the onboard system,rather than making the Auto Integration works,the parameters nor structure were known for ericsson devices,but seem like you can possiblely find command injection through this?but the filesystem dump is needed to do some analyse ahead,otherwise no way to get inside.About the WCDMA,at least the RF test shows it supports that,but who knows if its related to configuration or not.Refer to the information from here https://osmocom.org/projects/ericsson-rbs-6xxx/wiki/RBS6402_Software
It also seems like the operation mode is controlled by some kind of magic stuff
[ 94.693546] MWA-API: HW: 304 [ 94.698895] MWA-API: POWER1: UCD9090:R1D [ 94.705112] MWA-API: U-BOOT: U-Boot_2013.01_(Nov_08_2018_-_17:33:13) [ 94.710459] MWA-API: OPMODE: LTE_HC [ 94.717913] MWA-API: SW DATE: Thu Nov 16 15:28:11 2017 [ 94.723755] MWA-API: SW TYPE: RND [ 94.732294] MWA-API: SW RELEASE: R1AF01 [ 94.742862] MWA-API: SW R-STATE: R1AF01 [ 94.749749] MWA-API: SW BRANCH: 17Q2 [ 94.756510] MWA-API: SW EOAM: [ 94.764139] MWA-API: SW COM: 37c272b8357352cffb88b9b9e59329dd5dafc137 [ 94.769215] MWA-API: SW BOAM: [ 94.775080] MWA-API: WCDMA: WWPM_1641.4 [ 94.781898] MWA-API: WCDMA L1: 65db0c6 (Wed, 5 Jul 2017 11:51:09 -0400) [ 94.787114] MWA-API: WCDMA L2: 439a61e (Wed, 20 Sep 2017 08:32:38 -0400) [ 94.793286] MWA-API: LTE PHY: LWP_1606_PHY [ 94.802059] MWA-API: LTE STACK: ELG_v1.2 [ 94.807698] grsec: mount of none to /dev/mqueue by /bin/busybox.nosuid[mount:2637] uid/euid:0/0 gid/egid:0/0, parent /usr/bin/eoam_msmm_startup.sh[eoam_msmm_start:2533] uid/euid:0/0 gid/egid:0/0 [ 94.808766] MWA-API: LTE L1: DEV.SC-LTE-PHY-05.01.LWP1606-31-gb85eab7 [ 94.818564] MWA-API: LTE L2: ELG_v1.2-4175-gfcc3f8a [ 94.824518] MWA-API: LTE L3_OAM: ELG_v1.2-2694-ga23242c [ 94.943482] MWA-API: FPGA SW: 3.1 1.67 [ 95.068095] MWA-API: FPGA2 SW: 3.1 1.67 [ 95.075127] MWA-API: SW MCSDK: 03.01.04.07A6 [ 95.079701] MWA-API: SW SYSLIB: 4.00.03.00 0252de4 [ 95.085471] MWA-API: SW AIF2: 1.2.0.00 51c1e7e [ 95.091022] MWA-API: KERNEL: Linux epic2_0 3.10.104-grsec-rt117 #1 SMP PREEMPT RT Thu Nov 16 15:38:48 UTC 2017 armv7l GNU/Linux [ 96.264531] locking fs. [ 96.264554] Filesystem locked.
Updated by lynxis over 2 years ago
copslock i'ven't opened one of them. I need to do it.
Anyhow here is an example file for the autobind service. It's not yet working. But I think the Format revision is still wrong. Next task is to "bruteforce" at least 3 letters and numbers with a remote controlled power supply.
<?xml version="1.0" encoding="UTF-8"?> <RbsSiteInstallationFile> <Format revision="L"/> <InstallationData logicalName="somename" dhcpClientIdentifier="abcdlient" vlanId="123"> <OamIpConfigurationData ipAddress="10.0.11.197" subnetMask="255.255.255.0" defaultRouter0="10.0.11.1" defDomainName="enodeb.example.com"> <DnsServer ipAddress="10.0.11.1"/> </OamIpConfigurationData> <SmrsData userName="foo" password="bar" address="10.23.0.1" summaryFilePath="/FOO/AutoIntegrationRbsSummaryFile.xml" /> </InstallationData> </RbsSiteInstallationFile> <pre> <?xml version="1.0" encoding="UTF-8"?> <RbsSiteInstallationFile> <Format revision="L"/> <InstallationData logicalName="somename" dhcpClientIdentifier="abcdlient" vlanId="123"> <OamIpConfigurationData ipAddress="10.0.11.197" subnetMask="255.255.255.0" defaultRouter0="10.0.11.1" defDomainName="enodeb.example.com"> <DnsServer ipAddress="10.0.11.1"/> </OamIpConfigurationData> <SmrsData userName="foo" password="bar" address="10.23.0.1" summaryFilePath="/FOO/AutoIntegrationRbsSummaryFile.xml" /> </InstallationData> </RbsSiteInstallationFile> </pre>
Updated by Jarobar over 2 years ago
- File RBS6401_top.JPG RBS6401_top.JPG added
- File RBS6401_bot.JPG RBS6401_bot.JPG added
Two images for RBS6401.
Main chip 2x TMS320TCI6614SXCMS, FPGA Xilinx KINTEX-7 XC7K325T-FBG900ACX1425, flash MT29F16G08ABCBBH1-12IT, DDR MT41K256M16HA-125, ?? Marvell 88e1340s-bam2, switch Marvell 98DX-LKJ1, clock AD9547, 2x AD9523-1, ADC 2x AZ42B49I, VGA 2x AD8376-ACPZ, ?? 2x 43701-1332, DAC DAC3484I, modulator 2x ADRF6703-ACPZ, ?? 4x SKY73209-11, PWR UCD90124A, UCD9246E, etc.
Updated by lynxis over 2 years ago
i've managed to get a 6402 provisioning up to the point it ask s1ap for the lte configuration. i'ven't looked into wcdma configuration yet.
if wcdma is supported by firmware the rbs6402 want's to connect via Iub to a RNC instead of a hnodeb/iuh.
Updated by lynxis over 2 years ago
So it's not usuable as WCDMA nodeb because we don't have a RNC for Iub. But it's usuable as LTE enodeb with open5gs.
I'll write some documentation how to configure it into the wiki in the next week or days.
copslock can we close this ticket or do like to discuss more about the 6402 more in here?
Updated by copslock over 2 years ago
lynxis wrote in #note-8:
So it's not usuable as WCDMA nodeb because we don't have a RNC for Iub. But it's usuable as LTE enodeb with open5gs.
Iub is kinda another topic,I saw some rusky provided a mini-RNC implementation,but dunno if we could get those code.
https://nickvsnetworking.com/my-used-huawei-bbu3900-lte-ran-adventure-part-1-the-impulse-purchase/
In fact,the most difficult part of Iub support is actually the NBAP procedures,the other part of work were already done by the OpenBTS-UMTS,like the RRC/RLC layers,while the lower FP transport layer is the biggest barrier of Iub support.I don't expect anyone to implement this recently in short term,but it's a good target to put some effort on it
I'll write some documentation how to configure it into the wiki in the next week or days.
copslock can we close this ticket or do like to discuss more about the 6402 more in here?
I just use this ticket to give people some directioin in finding proper devices,feel free to talk here.Anyway,wiki is pretty static way to exchange information and not work as good as conversation way.
Updated by Jarobar over 2 years ago
Here are some links to Spaar's blog.
http://www.mirider.com/weblog/2012/02/02/#20120202-running_your_own_node_b
http://www.mirider.com/weblog/2012/04/16/#20120416-3G_user_plane
http://www.mirider.com/weblog/2012/04/24/#20120424-A_bit_of_3G_Layer_1
He seems to have snippets of RNC.
It would be nice to share it with the community.
Updated by copslock over 2 years ago
Jarobar wrote in #note-10:
Here are some links to Spaar's blog.
http://www.mirider.com/weblog/2012/02/02/#20120202-running_your_own_node_b
http://www.mirider.com/weblog/2012/04/16/#20120416-3G_user_plane
http://www.mirider.com/weblog/2012/04/24/#20120424-A_bit_of_3G_Layer_1He seems to have snippets of RNC.
It would be nice to share it with the community.
Even not think about it,its almost 10yrs ago and the author seems not have interest in sharing the code at all.If we want RNC support,we have to build it upon the OpenBTS-UMTS codebase
Updated by paulmataruso almost 2 years ago
copslock wrote in #note-9:
lynxis wrote in #note-8:
So it's not usuable as WCDMA nodeb because we don't have a RNC for Iub. But it's usuable as LTE enodeb with open5gs.
Iub is kinda another topic,I saw some rusky provided a mini-RNC implementation,but dunno if we could get those code.
https://nickvsnetworking.com/my-used-huawei-bbu3900-lte-ran-adventure-part-1-the-impulse-purchase/
In fact,the most difficult part of Iub support is actually the NBAP procedures,the other part of work were already done by the OpenBTS-UMTS,like the RRC/RLC layers,while the lower FP transport layer is the biggest barrier of Iub support.I don't expect anyone to implement this recently in short term,but it's a good target to put some effort on itI'll write some documentation how to configure it into the wiki in the next week or days.
copslock can we close this ticket or do like to discuss more about the 6402 more in here?
I just use this ticket to give people some directioin in finding proper devices,feel free to talk here.Anyway,wiki is pretty static way to exchange information and not work as good as conversation way.
lynxis Would you be willing to share more on how you where able to get the RBS6402 to interface to Open5GS? Been struggling with my unit for a while now.
Updated by laforge 19 days ago
would be great to get all this content converted into a wiki page below Femtocell-specific_information