GSM Shop GSM Shop
GSM-Forum  

Welcome to the GSM-Forum forums.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features.
Only registered members may post questions, contact other members or search our database of over 8 million posts.

Registration is fast, simple and absolutely free so please - Click to REGISTER!

If you have any problems with the registration process or your account login, please contact contact us .

Go Back   GSM-Forum > Other Gsm/Mobile Related Forums > GSM Programming & Reverse Engineering

GSM Programming & Reverse Engineering Here you can post all Kind of GSM Programming and Reverse Engineering tools and Secrets.

Reply
 
LinkBack Thread Tools Display Modes
Old 03-05-2003, 14:45   #1 (permalink)
Junior Member
 
Join Date: Oct 2002
Posts: 9
Member: 16687
Status: Offline
Thanks Meter: 2
AT-commands for the Siemens networkmonitor?


Hi,

does anybody know which at-commands e.g. AT^SMONC,
AT+SMONC, AT^MONI, AT+MONI, AT^MONP or AT+MONP on
which Siemens phones are suitable to request the
network monitor informations???

There is a program on www.nobbi.com which can read
this informations from Siemens phones, but I cannot
find any information about these AT-commands for
Siemens GSM-phones.

The only information I found is for Siemens GSM-
data-terminals.

Any hints are welcome.

Regards
Mike
  Reply With Quote
The Following User Says Thank You to Mike.Joohsen For This Useful Post:
Old 03-10-2003, 09:27   #2 (permalink)
Insane Poster
 
Join Date: Feb 2003
Location: Poland
Age: 50
Posts: 76
Member: 22528
Status: Offline
Thanks Meter: 0
Programmes reading information like netmonitor, use following AT command:

AT+CBC Battery charge
AT+CSQ Output signal quality
AT+CPAS Query the telephone status
AT+COPS? and AT+CREG? - cell info

If you need more information about AT commands check this url:
http://www.traud.de/gsm/atex.htm

Best regards
  Reply With Quote
Old 03-10-2003, 11:30   #3 (permalink)
Junior Member
 
Join Date: Oct 2002
Posts: 9
Member: 16687
Status: Offline
Thanks Meter: 2
Thank you for the info! I have tested these
commands. They work fine for Sagems and I
found them also in the Siemens documentation.

But there have to be additional commands
specially for Siemens phones! Nobbi's program
can read the frequencies and field strenghts
of the neighbouring cells!

best regards Mike
  Reply With Quote
Old 03-10-2003, 13:18   #4 (permalink)
Insane Poster
 
Join Date: Feb 2003
Location: Poland
Age: 50
Posts: 76
Member: 22528
Status: Offline
Thanks Meter: 0
Quote:
Originally posted by Mike.Joohsen
Thank you for the info! I have tested these
commands. They work fine for Sagems and I
found them also in the Siemens documentation.

But there have to be additional commands
specially for Siemens phones! Nobbi's program
can read the frequencies and field strenghts
of the neighbouring cells!

best regards Mike
Nobbi's program reads frequencies and field strengts behind help of command I passed You.
For example:
> at+creg?
+CGER: 0,1,"5E25","605F"
Cell ID = 605Fh = 24671
LAI = 5E25

> at+csq
+CSQ: 19,99
level:
19 = -75dBm
error rate:
99 - unknown

>at+cbc
CBC: 0,80

0 - is supplied from battery
80 - 80% charged

--description---
+CSQ: rssi,ber
Parameter:
rssi Reception level:
0 -113 dBm or less
1 -111 dBm
2-30 -109 to -53 dBm -109 + ((n -2)*2)
31 -51 dBm or more
99 Unknown
ber Bit error rate:
0-7 Like RXQUAL values from Table GSM 05.08 in Section 8.2.4
99 Unknown

+CBC: bcs,bcl
Parameter:
bcs 0 ME is supplied from battery
1 ME has battery but is not supplied from there
2 ME has no battery connected
3 Error
bc> 0 Battery is flat, but no more actions possible 1-100 charge in per cent

Last edited by Jester74; 03-10-2003 at 13:25.
  Reply With Quote
Old 03-12-2003, 11:15   #5 (permalink)
Junior Member
 
Join Date: Oct 2002
Posts: 9
Member: 16687
Status: Offline
Thanks Meter: 2
Hi,

maybe I am to stupid. Nobbi's program reads field strength, LAI, Cell-ID and batterie status with the standard AT commands. This works for nearly any phone (Sagem, Siemens, Nokia)

But I cannot see how nobbi's program is reading the additional(!) infos about the neighbouring cells, if (and only! if) you connect a Siemens phone. Any clue?

I cannot see any infos about the neighbouring cells in the given example. Right?

The AT^Mxxx commands for the Siemens-GSM data terminals seem not to work for Siemens phones.
(I tested for S45).

Maybe nobbi uses some special (not "AT"?) commands?

Best regards
Mike
  Reply With Quote
Old 03-12-2003, 15:01   #6 (permalink)
Insane Poster
 
Join Date: Feb 2003
Location: Poland
Age: 50
Posts: 76
Member: 22528
Status: Offline
Thanks Meter: 0
Sorry, you have right.

I have only non registered version Nobbi's NetMonitor aplication, which does no have function of monitoring neighbouring cells. Is possible that software used BFB protocol (begun by AT^SBFB command). I can find this commands, but I need registered version of Nobbi's software.
Best Regards
  Reply With Quote
Old 03-13-2003, 09:15   #7 (permalink)
nrg
Freak Poster
 
Join Date: Dec 2001
Location: Poland
Posts: 154
Member: 7764
Status: Offline
Thanks Meter: 1
It is simple to know what commands nobbi is using by some logging program comelite or advenced serial port monitor, just log the transmission and you'll know... I also don't have registrated version of this program so I can't do it myself
  Reply With Quote
Old 03-13-2003, 11:58   #8 (permalink)
Junior Member
 
Join Date: Oct 2002
Posts: 9
Member: 16687
Status: Offline
Thanks Meter: 2
Hi,

if somebody have the registered version and a Siemens phone he could use portmon to log the RS232 commands. Or he could use nobbi's mconfig program and set AT-Logging under Options1 (or write "debug=10000000000000011" in the monitor.ini File.) Nobbi's program will write a debug file.

I got a tip via email saying the program is using the sim toolkit command AT^SSTK to request the neighbouring cell infos form the phone. But I have no details yet.

Best regards
Mike
  Reply With Quote
Old 03-13-2003, 15:12   #9 (permalink)
Junior Member
 
Join Date: Oct 2002
Posts: 9
Member: 16687
Status: Offline
Thanks Meter: 2
Hi,

AT^SSTK (a Siemens command to use the SIM toolkit) seems the right way ;-) I looked at GSM TS 11.4. There is a SIM toolkit-command "PROVIDE LOCAL INFORMATION" which can request the network measurement results (besides LAI etc.). The coding description of the result is in TS 04.08.

But the coding of the request is totally cumbersome and the coding of the result is really "packed" :-(

best regards
Mike
  Reply With Quote
Old 03-14-2003, 09:57   #10 (permalink)
Insane Poster
 
Join Date: Feb 2003
Location: Poland
Age: 50
Posts: 76
Member: 22528
Status: Offline
Thanks Meter: 0
@Mike.Joohsen

You know syntaxes this command (PROVIDE LOCAL INFORMATION)?
I a bit experimented and I received such result:
- request:
AT^SSTK=50,0
>50524F56494445204C4F43414C20494E464F524D41
54494F4E(^Z) - this is string "PROVIDE LOCAL INFORMATION [ctrl-Z]" in hex format.
- response:
AT ^SSTK: 810300000082028281830136
OK

In Netmonitr in option SAT command are error messages:
1) ILLEGAL CMD
END OF SESION
SW: 90 00
2)
END OF SESSION
ILLEGAL CMD 30
Qual: 52
Resp: 36 00

I know that Proper response should be in format:
A B C D E
where:
A - Location Information tag (1 byte)
B - Length (X) of bytes following (1 byte)
C Mobile Country & Network Codes (MCC & MNC) (3 bytes)
D Location Area Code (LAC) (2 bytes)
E Cell Identity Value (Cell ID) (2 bytes)

You have some ideas?
It can you have description (with examples) command SAT?
Best regards
  Reply With Quote
Old 03-14-2003, 16:43   #11 (permalink)
Junior Member
 
Join Date: Oct 2002
Posts: 9
Member: 16687
Status: Offline
Thanks Meter: 2
I think the correct command description is in the GSM
standard TS 11.4. You can download the document for free
at www.etsi.org. (For decoding the network management
results you will also need the GSM standard TS 04.08,
chapter 10.5.2.20. It is also at www.etsi.org).

The request look like this:

Byte# Value (Hex) Description
1 D0 Proactive SIM command tag
2 09 length
3 81 command details tag
4 03 length
5 01 command number
6 26 Command: provide local info
7 00 '00' = Loc Info (MCC, MNC, LAC and Cell Id)
'01' = IMEI of the ME
'02' = Network Measurement results
'03' = Date, time and time zone
'04' = Language setting
'05' = Timing Advance
8 82 Device identities tag
9 02 length
10 81 source: 81=SIM,
1X = Add Card Reader X (0..7),
2Y = Channel Y (1..7)
11 82 destination: 82=ME, 02=Display, 03=Earpice

Example: (not sure, if the lenght in the "AT^SSTK=len,count" is
correct because my S45 seems to ignore this parameter :-)

Request Network, LAI and Cell ID:

AT^SSTK=22,0
> D009810301260082028182 [Ctrl-Z]

AT^SSTK
810301260082028281830100930762F210081C0005

1 81 command details tag
4 03 length
5 01 command number
6 26 Command: provide local info
7 00 '00' = Loc Info (MCC, MNC, LAC, Cell Id)
8 82 Device identities tag
9 02 length
10 82 source = ME
11 81 dest = SIM
12 83 result tag
13 01 length
14 00 00 = success
15 93 Locinfo Tag
16 07 Length
17-19 62F210 MCC2|MCC1|1111|MCC3|NMC2|NMC1| -> 262 01
20-21 081C LAC (where I am? :-)
22-23 0005 Cell ID


Request IMEI:

AT^SSTK=22,0
> D009810301260182028182 [Ctrl-Z]

AT^SSTK
81030126018202828183010094083A057150xxxxxxxx

... everything the same ...

15 94 IMEI Tag
16 08 Length
17-24 3A057150xxxxxxxx IMEI


Request Network Measurement Info:

AT^SSTK=22,0
> D009810301260282028182 [Ctrl-Z]

AT^SSTK
81030126028202828183010096101A1A01564BC70DD282C928 6C93BC0000
9D0D088270A852154571645C184640

... everything the same ...

15 96 Network Measurement Results tag
16 10 Length
17-32 1A1A01564BC70DD282C9286C93BC0000 Results (see TS04.08)
33 9D BCCH channel list tag
34 0D Length
35-47 088270A852154571645C184640 BCCH channel list

Results (see TS04.08):
1| | A |1| | A |0| |1 | 5 | 6 |4 B| C | 7 0|
0|0|011010|0|0|011010|0|000|000|101|010110|01001|0 11110|001110|

D | D |2 8 | 2 | C 9| 2 | 8 |6 C |
00011|011101|001010|00001|011001|001001|01000|0110 11|

9 |3 B| C | 0 0| 0 | 0
001001|00111|011110|000000|00000|000000

1-Bit-BA-Used 0 0
1-Bit-DTX-Used 0 0
6-Bit-RXLEV-FULL-SERVING-CELL 011010 26
1-Bit-Spare 0 0
1-Bit-Measurement-Valid-Bit 0 0
6-Bit-RXLEV-SUB-SERVING-CELL 011010 26
1-Bit-Spare 0 0
3-Bit-RXQUAL-FULL-SERVING-CELL 000 0
3-Bit-RXQUAL-SUB-SERVING-CELL 000 0
3-Bit-NO-NCELL 101 5
6-Bit-RXLEV-NCELL 1 010110 21
5-Bit-BCCH-FREQ-NCELL 1 01001 9
6-Bit-BSIC-NCELL 1 011110 30
6-Bit-RXLEV-NCELL 2 001110 14
5-Bit-BCCH-FREQ-NCELL 2 00011 3
6-Bit-BSIC-NCELL 2 011101 29
6-Bit-RXLEV-NCELL 3 001010 10
5-Bit-BCCH-FREQ-NCELL 3 00001 1
6-Bit-BSIC-NCELL 3 011001 25
6-Bit-RXLEV-NCELL 4 001001 9
5-Bit-BCCH-FREQ-NCELL 4 01000 8
6-Bit-BSIC-NCELL 4 011011 27
6-Bit-RXLEV-NCELL 5 001001 9
5-Bit-BCCH-FREQ-NCELL 5 00111 7
6-Bit-BSIC-NCELL 5 011110 30
6-Bit-RXLEV-NCELL 6 000000 0
5-Bit-BCCH-FREQ-NCELL 6 00000 0
6-Bit-BSIC-NCELL 6 000000 0


BCCH channel list: 10Bit packed for every ARFCN:

0 8 8 | 2 7 |0 A 8 | 5 2 |1 5 4 | 5 7 |
0000100010|0000100111|0000101010|0001010010|000101 0101|0001010111|

1 6 4 | 5 C |1 8 4 | 6 4 |0
0001011001|0001011100|0001100001|0001100100|0000

0000100010 = 34 = ARFCN Absolut Radio Frequency Channel Number
0000100111 = 39
0000101010 = 42
0001010010 = 82
0001010101 = 85
0001010111 = 87
0001011001 = 89
0001011100 = 92
0001100001 = 97
0001100100 = 100


They are crazy!

best regards Mike
  Reply With Quote
The Following User Says Thank You to Mike.Joohsen For This Useful Post:
Old 03-17-2003, 11:57   #12 (permalink)
Insane Poster
 
Join Date: Feb 2003
Location: Poland
Age: 50
Posts: 76
Member: 22528
Status: Offline
Thanks Meter: 0
Thanks a lot.
In fact, very difficult protocol (much comiled)
I will try implement netmonitor function based on Sim Toolkit in future version of gammu.
Best Regards
  Reply With Quote
Old 07-07-2003, 17:41   #13 (permalink)
Junior Member
 
Join Date: Jul 2003
Posts: 2
Member: 33623
Status: Offline
Thanks Meter: 0
Hi,
I'm searching for an at-command to identify current cell from neighbouring cells. I 'm searching for a common information element for current and neighbour cells, which can be read from a mobile via at-commands. I can't find a command that fits. I can receive the LAC and CI of the current cell, but only BCCH of the ncells.
If the current cell changes, I have no information which new neighbour cell is my old current cell.
Any idea?
Is it possible with the BCCH channel list? Ii the current cell included in the list of Absolut Radio Frequency Channel Numbers?
  Reply With Quote
Old 07-08-2003, 08:19   #14 (permalink)
Insane Poster
 
Join Date: Feb 2003
Location: Poland
Age: 50
Posts: 76
Member: 22528
Status: Offline
Thanks Meter: 0
I am afraid , that you can read only channel number, reception level, NCC and BCC afterwards from neighbouring cells. To read LAC and CI cell has to be in use (It was been possible to read only from current cell).
BTW:
Do you use different model siemens mobile than c35i?
If so, you can check result of option
--siemensnetmonitor from current version of gammu?

Last edited by Jester74; 07-09-2003 at 06:57.
  Reply With Quote
Old 07-08-2003, 14:21   #15 (permalink)
Junior Member
 
Join Date: Jul 2003
Posts: 2
Member: 33623
Status: Offline
Thanks Meter: 0
I tried using gammu,
but it seems to have a problem decoding
'PROVIDE LOCAL INFORMATION' with command details 'Network Measurement results'.
I receive a correct reply from my mobile (Siemens ME45). But gammu exits with an error message:
[ERROR 16: Function not supported by phone.]
Nevertheless, this message does not contain any kind of cell identifiers in common with current and neighbouring cells.
Is it possible to get the BCCH-FREQ of the current cell?
In my application I store some data for every cell. I need this info for every ncell and my current cell.
When I read the information out of the database, I need an index or identifier of the cells, which is unique and available for current and neighbouring cells.
What can be used as an index?
  Reply With Quote
Reply

Bookmarks


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
thread Thread Starter Forum Replies Last Post
AT commands for initiate 3G call & send AT commands to GPRS modem from computer need codec_romania GSM Programming & Reverse Engineering 0 08-26-2006 07:53
AT commands for Siemens S55 timmi GSM Programming & Reverse Engineering 0 10-14-2003 08:35
AT Command for Siemens MC35 Fonetrack GSM Programming & Reverse Engineering 0 08-26-2003 12:36
AT Commands for siemens on this site jonwillow x1x to x45/x50 0 11-25-2001 09:46
AT commands for x35 SpE x1x to x45/x50 1 06-25-2001 11:50

 



All times are GMT +1. The time now is 20:14.



Powered by Searchlight © 2024 Axivo Inc.
vBulletin Optimisation provided by vB Optimise (Pro) - vBulletin Mods & Addons Copyright © 2024 DragonByte Technologies Ltd.
- GSM Hosting Ltd. - 1999-2023 -
Page generated in 0.27870 seconds with 9 queries

SEO by vBSEO