Re: [Openbts-discuss] Cell-reselection - automatic handover

[Ralph A. S. d. <ra...@sc...>]

Have a look here:

 

http://de.slideshare.net/shirazthegreat/gsm-cell-selection-and-reselction 

 

The C1 value should matter, and its formula is explained in this document,
or in many other places on the web. 

 

I do not sit in front of my installation, but you may have some spare dB
when adjusting rxlevam and ms_txpwr accordingly. This also is a trick out of
the old days, when coverage was bad, to pretend coverage where in fact the
signal was near to nothing :)

 

Otherwise tx power can only be replaced by more tx power, so use an
amplifier. Blasting away with 1 or 2 watts of downlink power should do the
job. 

 

Ralph.

 

 

 

From: Simen Steig [mailto:sim...@ho...] 
Sent: Thursday, February 25, 2016 3:25 PM
To: ope...@li...
Subject: [Openbts-discuss] Cell-reselection - automatic handover

 

Hello everyone!

I am currently working on a project where I am looking into the detection of
IMSI Catchers. 
I have set up a USRPB200 (with GPSDO) running openbts, smqueue and
sipauthserve. I am currently trying to configure the OpenBTS such that an MS
will automatically perform a handover to my fake base station. 

The problem I am having is that the nearby "valid" base stations sends out
an RSSI equally strong (21 - recorded with AIMSICD) to that of my fake base
station, and it will therefore calculate a reselection value C2 too weak to
perform a handover. 

I have set the ARFCN to one that exists in the BCCH frequency list (but not
in use) and have set the MCC and MNC to spoof the real network. (I am aware
of the legal implications and are running in a lab). I have also set a
different LAC so to force an interaction between the MS and the OpenBTS. 

Is there any way I can manipulate any configuration value (or by other
means) so that it will perform a automatic handover?

Thank you in advance!