I received my BladeRF a few weeks ago and I want to decode GSM chanels with airprobe. My first step is to scan the available GSM chanels with kalibrate so I have downloaded the kalibrate-bladeRF from Nuand GIT repository.
As I've been doing this before with RTL SDR dongles and USRP B200 board, I already know the GSM chanels available close to me, but when I run kalibrate, it shows very strange GSM chanels: most of them don't exist and the "good" or "real" ones aren't shown or detected. Every time I repeat the chanels scan, the "power" value magnitude is completely different. Here I paste one execution example:
Code: Select all
root@babieca:/opt/kalibrate-bladeRF/src# ./kal -s GSM900
Actual filter bandwidth = 1500 kHz
rxvga1 = 20 dB
rxvga2 = 30 dB
kal: Scanning for GSM-900 base stations.
GSM-900:
chan: 1 (935.2MHz - 11.197kHz) power: 21247.06
chan: 6 (936.2MHz - 1.767kHz) power: 16291.96
chan: 7 (936.4MHz - 1.763kHz) power: 15908.28
chan: 8 (936.6MHz - 1.742kHz) power: 16331.60
chan: 9 (936.8MHz - 1.758kHz) power: 15854.79
chan: 13 (937.6MHz - 1.750kHz) power: 14684.43
chan: 14 (937.8MHz - 1.742kHz) power: 14656.51
chan: 15 (938.0MHz - 1.738kHz) power: 16614.46
chan: 16 (938.2MHz - 1.746kHz) power: 74465.67
chan: 17 (938.4MHz - 1.750kHz) power: 83395.16
chan: 18 (938.6MHz - 1.729kHz) power: 85727.16
chan: 19 (938.8MHz - 1.754kHz) power: 87506.78
chan: 20 (939.0MHz - 1.758kHz) power: 83574.33
root@babieca:/opt/kalibrate-bladeRF/src#
Code: Select all
root@babieca:/opt# bladeRF-cli -i
bladeRF> set frequency 1811.0M
Set RX frequency: 1811000000Hz
Set TX frequency: 1811000000Hz
bladeRF> cal lms
Calibrating LMS LPF tuning module...
LPF tuning module: 25
Calibrating LMS TX LPF modules...
TX LPF I filter: 29
TX LPF Q filter: 33
Calibrating LMS RX LPF modules...
RX LPF I filter: 33
RX LPF Q filter: 15
Calibrating LMS RXVGA2 modules...
RX VGA2 DC reference module: 27
RX VGA2 stage 1, I channel: 31
RX VGA2 stage 1, Q channel: 33
RX VGA2 stage 2, I channel: 27
RX VGA2 stage 2, Q channel: 35
bladeRF> cal dc rx
RX DC I Setting = 290, error ~= 0
RX DC Q Setting = 370, error ~= 0
bladeRF> quit
Code: Select all
root@babieca:/opt/kalibrate-bladeRF/src# ./kal -s GSM900 -m12
Actual filter bandwidth = 1500 kHz
rxvga1 = 20 dB
rxvga2 = 30 dB
kal: Scanning for GSM-900 base stations.
GSM-900:
chan: 6 (936.2MHz - 1.651kHz) power: 58250.94
chan: 7 (936.4MHz - 1.643kHz) power: 59834.88
chan: 8 (936.6MHz - 1.626kHz) power: 62583.47
chan: 9 (936.8MHz - 1.647kHz) power: 60081.99
chan: 16 (938.2MHz - 1.647kHz) power: 103431.27
chan: 17 (938.4MHz - 1.651kHz) power: 92819.21
chan: 18 (938.6MHz - 1.639kHz) power: 93522.84
chan: 19 (938.8MHz - 1.655kHz) power: 100255.68
chan: 20 (939.0MHz - 1.639kHz) power: 93232.49
chan: 22 (939.4MHz - 1.659kHz) power: 106057.37
chan: 23 (939.6MHz - 1.634kHz) power: 94088.31
root@babieca:/opt/kalibrate-bladeRF/src#
Code: Select all
bladeRF> info
Serial #: cf91a30fd4c5a161600060a27cf0cf35
VCTCXO DAC calibration: 0x880c
FPGA size: 40 KLE
FPGA loaded: yes
USB bus: 3
USB address: 2
USB speed: SuperSpeed
Backend: libusb
Instance: 0
bladeRF> version
bladeRF-cli version: 0.11.1-git-0bb0cce
libbladeRF version: 0.16.2-git-0bb0cce
Firmware version: 1.7.1-git-ca697ee
FPGA version: 0.0.6
bladeRF>
Code: Select all
average [min, max] (range, stddev)
+ 475.217kHz [475109, 475287] (178, 40.488880)
overruns: 0
not found: 174
Found lowest offset of 475184.687500Hz at 959.000000MHz (495.500196 ppm) using DAC trim 0xfff8
Kind Regards,
Pedro