|
Welcome to the GSM-Forum forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. Only registered members may post questions, contact other members or search our database of over 8 million posts. Registration is fast, simple and absolutely free so please - Click to REGISTER! If you have any problems with the registration process or your account login, please contact contact us . |
|
Register | FAQ | Donate | Forum Rules | Root any Device | ★iPhone Unlock★ | ★ Direct Codes ★ | Direct Unlock Source | Today's Posts | Search |
GSM Programming & Reverse Engineering Here you can post all Kind of GSM Programming and Reverse Engineering tools and Secrets. |
| LinkBack | Thread Tools | Display Modes |
03-05-2003, 14:45 | #1 (permalink) |
Junior Member Join Date: Oct 2002
Posts: 9
Member: 16687 Status: Offline Thanks Meter: 2 | AT-commands for the Siemens networkmonitor? does anybody know which at-commands e.g. AT^SMONC, AT+SMONC, AT^MONI, AT+MONI, AT^MONP or AT+MONP on which Siemens phones are suitable to request the network monitor informations??? There is a program on www.nobbi.com which can read this informations from Siemens phones, but I cannot find any information about these AT-commands for Siemens GSM-phones. The only information I found is for Siemens GSM- data-terminals. Any hints are welcome. Regards Mike |
The Following User Says Thank You to Mike.Joohsen For This Useful Post: |
03-10-2003, 09:27 | #2 (permalink) |
Insane Poster Join Date: Feb 2003 Location: Poland Age: 50
Posts: 76
Member: 22528 Status: Offline Thanks Meter: 0 | Programmes reading information like netmonitor, use following AT command: AT+CBC Battery charge AT+CSQ Output signal quality AT+CPAS Query the telephone status AT+COPS? and AT+CREG? - cell info If you need more information about AT commands check this url: http://www.traud.de/gsm/atex.htm Best regards |
03-10-2003, 11:30 | #3 (permalink) |
Junior Member Join Date: Oct 2002
Posts: 9
Member: 16687 Status: Offline Thanks Meter: 2 | Thank you for the info! I have tested these commands. They work fine for Sagems and I found them also in the Siemens documentation. But there have to be additional commands specially for Siemens phones! Nobbi's program can read the frequencies and field strenghts of the neighbouring cells! best regards Mike |
03-10-2003, 13:18 | #4 (permalink) | |
Insane Poster Join Date: Feb 2003 Location: Poland Age: 50
Posts: 76
Member: 22528 Status: Offline Thanks Meter: 0 | Quote:
For example: > at+creg? +CGER: 0,1,"5E25","605F" Cell ID = 605Fh = 24671 LAI = 5E25 > at+csq +CSQ: 19,99 level: 19 = -75dBm error rate: 99 - unknown >at+cbc CBC: 0,80 0 - is supplied from battery 80 - 80% charged --description--- +CSQ: rssi,ber Parameter: rssi Reception level: 0 -113 dBm or less 1 -111 dBm 2-30 -109 to -53 dBm -109 + ((n -2)*2) 31 -51 dBm or more 99 Unknown ber Bit error rate: 0-7 Like RXQUAL values from Table GSM 05.08 in Section 8.2.4 99 Unknown +CBC: bcs,bcl Parameter: bcs 0 ME is supplied from battery 1 ME has battery but is not supplied from there 2 ME has no battery connected 3 Error bc> 0 Battery is flat, but no more actions possible 1-100 charge in per cent Last edited by Jester74; 03-10-2003 at 13:25. | |
03-12-2003, 11:15 | #5 (permalink) |
Junior Member Join Date: Oct 2002
Posts: 9
Member: 16687 Status: Offline Thanks Meter: 2 | Hi, maybe I am to stupid. Nobbi's program reads field strength, LAI, Cell-ID and batterie status with the standard AT commands. This works for nearly any phone (Sagem, Siemens, Nokia) But I cannot see how nobbi's program is reading the additional(!) infos about the neighbouring cells, if (and only! if) you connect a Siemens phone. Any clue? I cannot see any infos about the neighbouring cells in the given example. Right? The AT^Mxxx commands for the Siemens-GSM data terminals seem not to work for Siemens phones. (I tested for S45). Maybe nobbi uses some special (not "AT"?) commands? Best regards Mike |
03-12-2003, 15:01 | #6 (permalink) |
Insane Poster Join Date: Feb 2003 Location: Poland Age: 50
Posts: 76
Member: 22528 Status: Offline Thanks Meter: 0 | Sorry, you have right. I have only non registered version Nobbi's NetMonitor aplication, which does no have function of monitoring neighbouring cells. Is possible that software used BFB protocol (begun by AT^SBFB command). I can find this commands, but I need registered version of Nobbi's software. Best Regards |
03-13-2003, 09:15 | #7 (permalink) |
Freak Poster Join Date: Dec 2001 Location: Poland
Posts: 154
Member: 7764 Status: Offline Thanks Meter: 1 | It is simple to know what commands nobbi is using by some logging program comelite or advenced serial port monitor, just log the transmission and you'll know... I also don't have registrated version of this program so I can't do it myself |
03-13-2003, 11:58 | #8 (permalink) |
Junior Member Join Date: Oct 2002
Posts: 9
Member: 16687 Status: Offline Thanks Meter: 2 | Hi, if somebody have the registered version and a Siemens phone he could use portmon to log the RS232 commands. Or he could use nobbi's mconfig program and set AT-Logging under Options1 (or write "debug=10000000000000011" in the monitor.ini File.) Nobbi's program will write a debug file. I got a tip via email saying the program is using the sim toolkit command AT^SSTK to request the neighbouring cell infos form the phone. But I have no details yet. Best regards Mike |
03-13-2003, 15:12 | #9 (permalink) |
Junior Member Join Date: Oct 2002
Posts: 9
Member: 16687 Status: Offline Thanks Meter: 2 | Hi, AT^SSTK (a Siemens command to use the SIM toolkit) seems the right way ;-) I looked at GSM TS 11.4. There is a SIM toolkit-command "PROVIDE LOCAL INFORMATION" which can request the network measurement results (besides LAI etc.). The coding description of the result is in TS 04.08. But the coding of the request is totally cumbersome and the coding of the result is really "packed" :-( best regards Mike |
03-14-2003, 09:57 | #10 (permalink) |
Insane Poster Join Date: Feb 2003 Location: Poland Age: 50
Posts: 76
Member: 22528 Status: Offline Thanks Meter: 0 | @Mike.Joohsen You know syntaxes this command (PROVIDE LOCAL INFORMATION)? I a bit experimented and I received such result: - request: AT^SSTK=50,0 >50524F56494445204C4F43414C20494E464F524D41 54494F4E(^Z) - this is string "PROVIDE LOCAL INFORMATION [ctrl-Z]" in hex format. - response: AT ^SSTK: 810300000082028281830136 OK In Netmonitr in option SAT command are error messages: 1) ILLEGAL CMD END OF SESION SW: 90 00 2) END OF SESSION ILLEGAL CMD 30 Qual: 52 Resp: 36 00 I know that Proper response should be in format: A B C D E where: A - Location Information tag (1 byte) B - Length (X) of bytes following (1 byte) C Mobile Country & Network Codes (MCC & MNC) (3 bytes) D Location Area Code (LAC) (2 bytes) E Cell Identity Value (Cell ID) (2 bytes) You have some ideas? It can you have description (with examples) command SAT? Best regards |
03-14-2003, 16:43 | #11 (permalink) |
Junior Member Join Date: Oct 2002
Posts: 9
Member: 16687 Status: Offline Thanks Meter: 2 | I think the correct command description is in the GSM standard TS 11.4. You can download the document for free at www.etsi.org. (For decoding the network management results you will also need the GSM standard TS 04.08, chapter 10.5.2.20. It is also at www.etsi.org). The request look like this: Byte# Value (Hex) Description 1 D0 Proactive SIM command tag 2 09 length 3 81 command details tag 4 03 length 5 01 command number 6 26 Command: provide local info 7 00 '00' = Loc Info (MCC, MNC, LAC and Cell Id) '01' = IMEI of the ME '02' = Network Measurement results '03' = Date, time and time zone '04' = Language setting '05' = Timing Advance 8 82 Device identities tag 9 02 length 10 81 source: 81=SIM, 1X = Add Card Reader X (0..7), 2Y = Channel Y (1..7) 11 82 destination: 82=ME, 02=Display, 03=Earpice Example: (not sure, if the lenght in the "AT^SSTK=len,count" is correct because my S45 seems to ignore this parameter :-) Request Network, LAI and Cell ID: AT^SSTK=22,0 > D009810301260082028182 [Ctrl-Z] AT^SSTK 810301260082028281830100930762F210081C0005 1 81 command details tag 4 03 length 5 01 command number 6 26 Command: provide local info 7 00 '00' = Loc Info (MCC, MNC, LAC, Cell Id) 8 82 Device identities tag 9 02 length 10 82 source = ME 11 81 dest = SIM 12 83 result tag 13 01 length 14 00 00 = success 15 93 Locinfo Tag 16 07 Length 17-19 62F210 MCC2|MCC1|1111|MCC3|NMC2|NMC1| -> 262 01 20-21 081C LAC (where I am? :-) 22-23 0005 Cell ID Request IMEI: AT^SSTK=22,0 > D009810301260182028182 [Ctrl-Z] AT^SSTK 81030126018202828183010094083A057150xxxxxxxx ... everything the same ... 15 94 IMEI Tag 16 08 Length 17-24 3A057150xxxxxxxx IMEI Request Network Measurement Info: AT^SSTK=22,0 > D009810301260282028182 [Ctrl-Z] AT^SSTK 81030126028202828183010096101A1A01564BC70DD282C928 6C93BC0000 9D0D088270A852154571645C184640 ... everything the same ... 15 96 Network Measurement Results tag 16 10 Length 17-32 1A1A01564BC70DD282C9286C93BC0000 Results (see TS04.08) 33 9D BCCH channel list tag 34 0D Length 35-47 088270A852154571645C184640 BCCH channel list Results (see TS04.08): 1| | A |1| | A |0| |1 | 5 | 6 |4 B| C | 7 0| 0|0|011010|0|0|011010|0|000|000|101|010110|01001|0 11110|001110| D | D |2 8 | 2 | C 9| 2 | 8 |6 C | 00011|011101|001010|00001|011001|001001|01000|0110 11| 9 |3 B| C | 0 0| 0 | 0 001001|00111|011110|000000|00000|000000 1-Bit-BA-Used 0 0 1-Bit-DTX-Used 0 0 6-Bit-RXLEV-FULL-SERVING-CELL 011010 26 1-Bit-Spare 0 0 1-Bit-Measurement-Valid-Bit 0 0 6-Bit-RXLEV-SUB-SERVING-CELL 011010 26 1-Bit-Spare 0 0 3-Bit-RXQUAL-FULL-SERVING-CELL 000 0 3-Bit-RXQUAL-SUB-SERVING-CELL 000 0 3-Bit-NO-NCELL 101 5 6-Bit-RXLEV-NCELL 1 010110 21 5-Bit-BCCH-FREQ-NCELL 1 01001 9 6-Bit-BSIC-NCELL 1 011110 30 6-Bit-RXLEV-NCELL 2 001110 14 5-Bit-BCCH-FREQ-NCELL 2 00011 3 6-Bit-BSIC-NCELL 2 011101 29 6-Bit-RXLEV-NCELL 3 001010 10 5-Bit-BCCH-FREQ-NCELL 3 00001 1 6-Bit-BSIC-NCELL 3 011001 25 6-Bit-RXLEV-NCELL 4 001001 9 5-Bit-BCCH-FREQ-NCELL 4 01000 8 6-Bit-BSIC-NCELL 4 011011 27 6-Bit-RXLEV-NCELL 5 001001 9 5-Bit-BCCH-FREQ-NCELL 5 00111 7 6-Bit-BSIC-NCELL 5 011110 30 6-Bit-RXLEV-NCELL 6 000000 0 5-Bit-BCCH-FREQ-NCELL 6 00000 0 6-Bit-BSIC-NCELL 6 000000 0 BCCH channel list: 10Bit packed for every ARFCN: 0 8 8 | 2 7 |0 A 8 | 5 2 |1 5 4 | 5 7 | 0000100010|0000100111|0000101010|0001010010|000101 0101|0001010111| 1 6 4 | 5 C |1 8 4 | 6 4 |0 0001011001|0001011100|0001100001|0001100100|0000 0000100010 = 34 = ARFCN Absolut Radio Frequency Channel Number 0000100111 = 39 0000101010 = 42 0001010010 = 82 0001010101 = 85 0001010111 = 87 0001011001 = 89 0001011100 = 92 0001100001 = 97 0001100100 = 100 They are crazy! best regards Mike |
The Following User Says Thank You to Mike.Joohsen For This Useful Post: |
03-17-2003, 11:57 | #12 (permalink) |
Insane Poster Join Date: Feb 2003 Location: Poland Age: 50
Posts: 76
Member: 22528 Status: Offline Thanks Meter: 0 | Thanks a lot. In fact, very difficult protocol (much comiled) I will try implement netmonitor function based on Sim Toolkit in future version of gammu. Best Regards |
07-07-2003, 17:41 | #13 (permalink) |
Junior Member Join Date: Jul 2003
Posts: 2
Member: 33623 Status: Offline Thanks Meter: 0 | Hi, I'm searching for an at-command to identify current cell from neighbouring cells. I 'm searching for a common information element for current and neighbour cells, which can be read from a mobile via at-commands. I can't find a command that fits. I can receive the LAC and CI of the current cell, but only BCCH of the ncells. If the current cell changes, I have no information which new neighbour cell is my old current cell. Any idea? Is it possible with the BCCH channel list? Ii the current cell included in the list of Absolut Radio Frequency Channel Numbers? |
07-08-2003, 08:19 | #14 (permalink) |
Insane Poster Join Date: Feb 2003 Location: Poland Age: 50
Posts: 76
Member: 22528 Status: Offline Thanks Meter: 0 | I am afraid , that you can read only channel number, reception level, NCC and BCC afterwards from neighbouring cells. To read LAC and CI cell has to be in use (It was been possible to read only from current cell). BTW: Do you use different model siemens mobile than c35i? If so, you can check result of option --siemensnetmonitor from current version of gammu? Last edited by Jester74; 07-09-2003 at 06:57. |
07-08-2003, 14:21 | #15 (permalink) |
Junior Member Join Date: Jul 2003
Posts: 2
Member: 33623 Status: Offline Thanks Meter: 0 | I tried using gammu, but it seems to have a problem decoding 'PROVIDE LOCAL INFORMATION' with command details 'Network Measurement results'. I receive a correct reply from my mobile (Siemens ME45). But gammu exits with an error message: [ERROR 16: Function not supported by phone.] Nevertheless, this message does not contain any kind of cell identifiers in common with current and neighbouring cells. Is it possible to get the BCCH-FREQ of the current cell? In my application I store some data for every cell. I need this info for every ncell and my current cell. When I read the information out of the database, I need an index or identifier of the cells, which is unique and available for current and neighbouring cells. What can be used as an index? |
Bookmarks |
| |
Similar Threads | ||||
thread | Thread Starter | Forum | Replies | Last Post |
AT commands for initiate 3G call & send AT commands to GPRS modem from computer need | codec_romania | GSM Programming & Reverse Engineering | 0 | 08-26-2006 07:53 |
AT commands for Siemens S55 | timmi | GSM Programming & Reverse Engineering | 0 | 10-14-2003 08:35 |
AT Command for Siemens MC35 | Fonetrack | GSM Programming & Reverse Engineering | 0 | 08-26-2003 12:36 |
AT Commands for siemens on this site | jonwillow | x1x to x45/x50 | 0 | 11-25-2001 09:46 |
AT commands for x35 | SpE | x1x to x45/x50 | 1 | 06-25-2001 11:50 |
|