Deal with hopping

multirtl | hackrf-sox & channelize | hopping

tele2grc_.png

Preliminaries

First make sure you’ve got a valid broadcast capture by decoding BCCH

wireshark -k -Y 'gsm_a.dtap.msg_rr_type == 0x3f' -i lo &

grgsm_decode -a $arfcn -m BCCH -t 0 -c CFILE
grgsm_decode -a 673 -m BCCH -t 0 -c tele2hop.hrf/out_673.cfile
#-s $rate --ppm=$ppm

Then check if some frames are passing through without hopping on dedicated control channel, that happens (probably thanks to heavy-duty error correction, as Sylvain M. suggested)

!icmp && !tcp && !mdns

grgsm_decode -a $arfcn -m SDCCH8 -t $slot -c CFILE
grgsm_decode -a 673 -m SDCCH8 -t 1 -c tele2hop.hrf/out_673.cfile

also check the very subchannel you would be targetting according to the IA and add

-u 0

–or– further tune with the wireshark filter

gsmtap.sub_slot == 0

De-hopping SDCCH/8

Grab the GRC template

wget https://github.com/ptrkrysik/examples/raw/master/frequency_hopping/airprobe_rtlsdr_multi.grc
wget https://github.com/ptrkrysik/examples/raw/master/frequency_hopping/grgsm_hopping_example.grc
#https://raw.githubusercontent.com/ptrkrysik/examples/...

gnuradio-companion grgsm_hopping_example.grc

and tune many things

Note: ARFCN order+order or disorder+disorder works here on Tele2

Acceptance

Run while watching the frames live

#gsmtap && !icmp
    !icmp && !tcp && !mdns
    gsmtap.sub_slot == 0 && !icmp

and look more precisely for SI5, SI6, idling frames and Ciphering Mode Command

gsm_a.dtap.msg_rr_type == 0x35 && !icmp
#gsm_a.rr.algorithm_identifier == 0 && !icmp
#gsm_a.rr.SC == 1

tele2cmc.png

Resources

examples/frequency_hopping/ https://github.com/ptrkrysik/examples/tree/master/frequency_hopping

13 Feb 2019 - Frequency hopping https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/gr-gsm/0VgwCrHmb_M/Xe7iznuHCwAJ —> connect C0 if BCCH is part of the ARFCN list —> channelized sample rate needs to be multiple of wide band sample rate –> USRP wideband capture –> channelize –> smaller decoding sample rate e.g. 800e3

28 Aug 2018 - hopping channel https://groups.google.com/forum/#!topic/gr-gsm/ueyCxh3sZUY

Sep 4, 2017 Decrypt SMS on hopping SDCCH8 channel #328 https://github.com/ptrkrysik/gr-gsm/issues/328 –> CM Service Request shows called TMSI

Oct 17 2016 Russian style troubleshooting https://dmyt.ru/forum/viewtopic.php?t=1726

Jul 21, 2015 uplink-decoding #94 https://github.com/ptrkrysik/gr-gsm/issues/94 –> issues with hopping on uplink –> TSEQ

15/06/2017 Immediate Assignment with hopping https://groups.google.com/forum/#!topic/gr-gsm/jDHG6X5gOqA –> no chance with Packet Channel Description

Aug 9, 2015 Channel hopping improvements #105 https://github.com/ptrkrysik/gr-gsm/issues/105

May 18, 2015 - Proposal: channel hopping #51 https://github.com/ptrkrysik/gr-gsm/issues/51 –> sample hopping –> step by step process with grc blocks

GSM receiver with gr-gsm and Wireshark https://sourceforge.isae.fr/projects/ralf/wiki/GSM_receiver_with_gr-gsm_and_Wireshark

specs & TSEQ

Page 19 / Layers https://www.etsi.org/deliver/etsi_gts/05/0501/05.04.00_60/gsmts_0501v050400p.pdf

Page 12 / TSEQ & Page 15 / MAIO https://www.etsi.org/deliver/etsi_gts/05/0502/05.00.00_60/gsmts_0502v050000p.pdf

Training sequence in a GSM frame? https://electronics.stackexchange.com/questions/122257/training-sequence-in-a-gsm-frame

Page 117 Hopping http://www.qtc.jp/3GPP/Specs/34123-3-530.pdf


HOME | GUIDES | BENCHMARKS | html