2. OpenBTS (demo)
David A. Burgess, Kestrel Signal Processing, Inc.

3. What You are About to See
• Hybrid GSM/SIP wireless access point.
• AP looks like a GSM network to GSM handsets.
• AP looks like Asterisk to IP network.
• Handsets treated as SIP endpoints.
• Bigger picture? Other aspects?
• http://www.kestrelsp.com/OpenBTS
• http://openbts.blogspot.com
• http://gnuradio.org/trac/wiki/OpenBTS
• Find us at the conference:
• David A. Burgess
• Harvind S. Samra

4. “Phase 2” GSM Core Network
(GSM 03.02 version 7.1.0 Release 1998) 18 ETSI TS 100 522 V7.1.0 (2000-02)
• From GSM 03.01.
• The key pieces:
• MS - Mobile station.
• BTS - Base transceiver
subsystem (Um L1/L2).
• BSC - Basestation
controller (L3 RR)
• MSC - Mobile switching
center (L3 CC).
• HLR/VLR - Location
registers (L3 MM).
• Must have all 5!

5. OpenBTS Core Network
• Peer-to-peer APs.
PSTN
SS7
• No BSCs, no MSCs,
gateway
VoIP
Carrier
no hair-pinning.
SIP
• Network interface is
Provisioning
mostly Asterisk.
SQL
packet-switced network Database
(distributed)
• Network can be as
SIP
SIP
small as a single
SQL
SIP
SQL
SQL
node, but with a
OpenBTS OpenBTS
AP AP
range of 35 km.
Hybrid
OpenBTS
GSM/SIP
AP
Access Point
air interface, Um
MS
Any GSM
Handset

6. Advantages of Peering
• Core network is commodity IP switching equipment.
• Minimum viable network is a single AP.
• Low cost of entry for a small operator.
• “Bare dirt” infrastructure.
• Low power; solar/wind.
• Any IP backhaul; low bit rates with GSM codecs.
• Very robust.
• Every AP or collection of APs is service area.
• “Islands” continue to function locally.
• “Islands” continue to function globally if they can route enough
packets to the public internet.

7. Proposed Applications
• Big vision: “Base of the Pyramid”.
• Rural WLL at the lowest possible cost.
• Our target is US$1/mo with US$5 handset.
• Near-term markets to fund the work.
• Isolated facilities (oil rigs, cruise ships, airliners, etc.)
• Disaster relief (rapid deployment, scant infrastructure)
• Test equipment (network simulation, handset testing)
• Femtocells
• GPL alternative to Vanu
• Can replace hybrid L3 with A-over-IP interface.
• Avoid vendor lock with open source.

8. OpenBTS AP Architecture
• Local RR.
• Map MM
GSM
GSM
Handset
GSM
Handset
GSM
and CC in
Handset
quot;Umquot;, Handsets
Analog the GSM
RF
USRP
RF Gear Air Interface
L3.
• Handsets
time-tagged
USB pckets
are SIP
Software
GMSK
endpoints.
Radiomodem
• 10k lines
SQL
time-tagged
SQL
GSM bursts Private
of C++ in
or Public
IP Network
SIP,
highlighted
IAX,
etc.
Hybrid GSM/SIP
soft
GSM Stack
box.
SIP
Control Layer
Abis
(L1, L2)
(L3)

9. Demo particulars.
• Operating in GSM900 band to avoid contention.
• MCC=901, MNC=55
• ARFCN 29 (940.8 MHz down, 895.8 MHz up)
• No BTS tx antenna, just leakage, <30 mW.
• Did your quad-band phone get a text? Well, that’s your fault.
• Handsets are unmodified refurbs.
• Mostly old Nokias with AT&T SIMs.
• Some have real DID E.164’s in Solano County, California and
Amsterdam.
• Volunteers?
• Thanks to Lee Dryburgh, John Gilmore, GNU Radio.

10. The Perfect Test Site
• Black Rock
City, the 5th
largest city in
Nevada, has
no cellular
coverage.
• But 50,000
people bring
their phones.

11. Camp WD9XKN @ 3:15 & G, BRC
• What it looks Preamps
Uplink
like when you Duplexer
Filter Power
Amp
PAP2 Adapter and
build a BTS Test Equipment
Host Laptop
Wired Phone for
on Ice Pack
Testing
USRP
from eBay
and Home
Depot.
• Going again in
2009 with
better SW,
better HW
and SMS.