LTE Base Station Software | Hacker News Reader

LTE Base Station Software

bellard.org

215 pointsvezycash45 comments

I'm a big fan of Fabrice Bellard, but there are other eNB and UE implementations that are fully open source, like OpenAirInterface[1] and srsLTE[2]

[1] http://www.openairinterface.org

[2] https://github.com/srsLTE/srsLTE

I'd be really interested in seeing a tutorial for how to set this up.

With srsLTE you just need to run the srsenb and srsepc processes with their example configuration files while having a compatible SDR connected. If you want to attach your own phone you need to have the right credentials of course but an srsUE (also with the example config) would happily connect.

I appreciate the comment, but I think I need a much lower-level tutorial! I know practically nothing about SDRs or LTE.

And a few more pure EPC implementations like NextEPC [1] and Pycrate/corenet [2–3]. The srsLTE eNB works pretty well with NextEPC for me :)

[1] https://github.com/acetcom/nextepc

[2] https://github.com/P1sec/pycrate

[3] https://github.com/mitshell/corenet

LTE-U would allow for LTE in unlicensed spectrum. Do any current devices support these bands? I would very much enjoy serving unlicensed LTE around my home. I wonder how much effort it would take to provide VoLTE over a SIP backend.

Just curious, does your handset super wifi calling? My parents live pretty far out in the country and were having reception issues. A few Ubiquiti wireless access points solved the problem

Newly released iPhone XS supports LTE band 46.. anyone try that yet?

Several hardware manufacturers for LTE last mile fixed wireless, WISP equipment, have announced BTS and CPE equipment for LTE in unlicensed 5150-5850 MHz bands. Baicells and Telrad come to mind.

It's not for around your home but as competition for things like the Cambium PMP450 platform and Ubiquiti's Rocket 5AC gen2 AP radios.

You'll need to add RF amplifiers on the transmit and receive paths along with antennas to make this work off the lab bench.

I used this several years ago (five or six, I think? Maybe more) with some of Ettus Research's USRPs. It's quite amazing. We used it for prototyping -- the gear wasn't (or we couldn't get it to be) fast enough to replace "real" LTE gear, but do bear in mind this was many years ago. But at the time, this was basically the best way to experiment with, and develop solutions for LTE, in a price range that was mostly affordable for a small company. I know cheaper options exist today, but I don't know much about them.

And, of course, this warrants a shout out for Ettus Research's equipment. It's pricey but if you can afford it, or if you manage to strike a bargain, you'll love it. The higher-ups at the company I was working for at the time were kind enough to let me spend several evenings there using the equipment for my own hobby projects. I mostly used it with GNU Radio -- it worked without a glitch.

Kind of concerning what other uses this could be put to. Doesn't seem like a big jump from here to a DIY stingray, soaking up all of the data from every cell phone within range.

Of course, vacuuming up everything is probably a great way to get caught quickly. For nefarious purposes it would probably more useful to selectively target individual devices.

Those are definitely already a thing, unfortunately.

https://hackaday.com/tag/cell-site-simulator/

https://www.evilsocket.net/2016/03/31/how-to-build-your-own-...

> I’m not writing this post to help script kiddies breaking the law, my point is that GSM is broken by design and it’s about time vendors do something about it considering how much we’re paying for their services.

Unfortunately they're unlikely to do much about it until the consequences of NOT securing their networks hit them in the wallet, which is maybe where the script kiddies come in.

IIRC, in LTE the devices verify the identity of the towers with a signature check now too.

No, LTE devices will happily connect to any random DIY base station, without any visual indication that this is taking place...

Maybe with GSM, not with LTE.

LTE handsets connect to any base station, at least on physical layer and management protocols. This is required for mutual authentication.

Some attacks abuse error indication prior authentication for location leaks and denial of service.

Once the connection is established, you're good.

How? Which keys do they trust?

LTE uses symmetric crypto with a pre-shared key stored in your SIM-card and in a database of your provider.

Base stations receive a derivated key. If the base station is not connected to your provider's network, you cannot establish a connection due to the lack of a common key.

I understand why you might be concerned but really, you should not. All technology can be used by the bad guys.

Did you know that simply owning a _typewriter_ was illegal without reporting it to communist authorities in east Europe?

Just to have a clear note here. Ham radio is regulated and there is certain traffic that you can run on free bands. That won't stop bad actors from ignoring these regulations.

Wow check out the prices for the hardware. By "wow" I mean I can't afford this. Clearly not the Amarisoft stuff where it doesn't even list the price, preferring that people contact them apparently knowing that I can't afford it.

Are there any sub-US$500 hardware platforms for LTE play?

Ettus makes very high quality hardware but you pay for it.

Looks like Lime Micro is a partner of Amerisoft, they have an SDR for $300 - https://www.crowdsupply.com/lime-micro/limesdr

The likelihood that it's going to work without substantial tinkering is pretty low.

Thank you very much for the link. Tinkering is precisely what I'd like to do with it, on the 70cm ham band if LTE is a bridge too far.

Heads up, seems folks aren't having great luck with the Lime SDR for ham applications. Some comments in here - https://news.ycombinator.com/item?id=15301982 and here explaining why - https://www.reddit.com/r/LimeSDR/comments/71q2qk/thread_on_h...

A counterpoint in the comments here - https://www.youtube.com/watch?v=u2KK49sJ3L0

caveat emptor i guess, good luck!

HackRF comes to mind. You can occasionally find good deals on Ettus gear on eBay/forums/etc.

HackRF is only half-duplex, and the turnaround time isn't fast enough to fake it. You'd need two.

It's going to be cheaper and easier to just buy a radio that can do full duplex -- the LimeSDR costs about the same as a HackRF, and is nominally supported by OpenAirInterface.

HackRF clones cost much less, and there is no LimedSDR clones AFAIK.

Haven't tried it myself but srsLTE's README [1] says they've tested their eNB with BladeRF and even LimeSDR frontends.

[1] https://github.com/srsLTE/srsLTE

The new xtrx is fresh, cool, and modular, but software might be not stable yet.

https://www.crowdsupply.com/fairwaves/xtrx/

To actually use something like this for transmission, would I need to obtain a license for use of the LTE radio bands?

Or just set up Faraday cage in your basement.

Femtocells operate legally, might be worth looking into what bands it uses.

Femtocells are probably legal because they're owned/controlled by the carriers and thus they can use the carriers' spectrum.

And have specific FCC reporting obligations - your address must be reported up for e911, GPS tracking (to ensure the carrier owns spectrum there), etc.

I usually love Fabrice Bellards stuff, but I have to admit that I don't really understand the how and why of this project.

> I usually love Fabrice Bellards stuff, but I have to admit that I don't really understand the how and why of this project.

The "why" should be clear here: make money (see Amarisoft's website: https://www.amarisoft.com/ ).

I see, but what has Fabrice Bellard to do with this? His association with Amarisoft is unclear to me. Has he actually made something, or is this just a 'hey, this is cool'?

He's the co-founder and CTO of Amarisoft.

I like this at concept level though am not qualified to dig into the internals. A use case could be eith CBRS (soon open in USA)? Add a neutral SAS and you have an IIoT solution with LTE type bandwidth, sans the monoploly telcos?

Is the code available for this ? This has been out from bellard's site for some time.

Source isn't available; software has been commercialized: https://www.amarisoft.com/products-lte-ue-ots-sdr-pcie/#netw...

What I'd like to see is an open baseband implementation, including calling out to more efficient DSP hardware, and some more substantial hardware frontend. There is surely a patent minefield involved in using something like that, but it'd be nice to have something in the open which you could at least license those patents to integrate into a product, and provide a greater degree of certainty as to what's inside to your customers.

The Osmocom folks have a GSM baseband project. They are also looking into reverse engineering the Quectel LTE modems that run Linux.

https://osmocom.org/projects/baseband/ https://osmocom.org/projects/quectel-modems/

Reply on news.ycombinator.com