# OpenBTS

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/OpenBTS
> Markdown URL: https://mediated.wiki/source/OpenBTS.md
> Source: https://en.wikipedia.org/wiki/OpenBTS
> Source revision: 1337935874
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

Software-based GSM access point

OpenBTS Final release 4.0 / March 26, 2014; 12 years ago (2014-03-26) Written in C++ Operating system Unix-like Type GSM protocol stack License GNU Affero General Public License[1] Repository github.com/RangeNetworks/dev

**OpenBTS** (**Open Base Transceiver Station**) is a software-based [GSM](/source/GSM) access point, allowing standard GSM-compatible [mobile phones](/source/Mobile_phone) to be used as [SIP](/source/Session_Initiation_Protocol) endpoints in [Voice over IP](/source/Voice_over_IP) (VoIP) networks. OpenBTS is open-source software developed and maintained by [Range Networks](/source/Range_Networks). The public release of OpenBTS is notable for being the first [free-software](/source/Free-software) implementation of the lower three layers of the industry-standard GSM [protocol stack](/source/Protocol_stack). It is written in [C++](/source/C%2B%2B) and released as free software under the terms of version 3 of the [GNU Affero General Public License](/source/Affero_General_Public_License).

## Open GSM infrastructure

OpenBTS replaces the conventional GSM operator [core network](/source/Network_switching_subsystem) infrastructure from layer 3 upwards. Instead of relying on external [base station controllers](/source/Base_station_subsystem#Base_station_controller) for [radio resource management](/source/Radio_resource_management), OpenBTS units perform this function internally. Instead of forwarding call traffic through to an operator's [mobile switching center](/source/Mobile_switching_center), OpenBTS delivers calls via [SIP](/source/Session_Initiation_Protocol) to a VOIP soft switch (such as [FreeSWITCH](/source/FreeSWITCH) or [yate](/source/Yate_(telephony_engine))) or [PBX](/source/Private_branch_exchange#Private_branch_exchange) (such as [Asterisk](/source/Asterisk_PBX)). This VOIP switch or PBX software can be installed on the same computer used to run OpenBTS itself, forming a self-contained cellular network in a single computer system. Multiple OpenBTS units can also share a common VOIP switch or PBX to form larger networks[2]

The OpenBTS [Um air interface](/source/Um_air_interface) uses a [software-defined radio](/source/Software-defined_radio) [transceiver](/source/Transceiver) with no specialized GSM hardware. The original implementation used a [Universal Software Radio Peripheral](/source/Universal_Software_Radio_Peripheral) from Ettus Research, but has since been expanded to support several digital radios in implementations ranging from full-scale base stations to embedded [femtocells](/source/Femtocell).

## History

The project was started by Harvind Samra and David A. Burgess[3] with the aim of the project to drastically reduce the cost of GSM service provision in rural areas, the developing world, and hard to reach locations such as oil rigs.[4] The project was initially conducted through Kestrel Signal Processing, the founders' consulting firm.

On September 14, 2010, at the Fall 2010 [DEMO conference](/source/DEMO_conference), the original authors launched [Range Networks](/source/Range_Networks) as a start up company to commercialize OpenBTS-based products.[5]

In September 2013, Burgess left Range Networks and started a new venture called Legba[6] and started a close collaboration with Null Team SRL, the developers of [Yate](/source/Yate_(telephony_engine)). In February 2014, Legba and Null announced the release of YateBTS, a fork of the OpenBTS project that uses Yate for its control layers and network interfaces.

## Platforms

A large number of experimental installations have shown that OpenBTS can run on extremely low overhead platforms. These including some CDMA handsets - making a GSM gateway to a [CDMA](/source/CDMA) network. Computer security researcher Chris Paget reported [7] that a handheld device, such as an [Android](/source/Android_(operating_system)) phone, could act as a gateway base station to which handsets can connect; the Android device then connects calls using an on-board [Asterisk](/source/Asterisk_PBX) server and routes them to the [PSTN](/source/PSTN) via [SIP](/source/Session_Initiation_Protocol) over an existing [3G](/source/3G) network.

## Security

At the 2010 [DEF CON](/source/DEF_CON) conference, it was demonstrated with OpenBTS that GSM calls can be intercepted because in GSM the handset does not authenticate the base station prior to accessing the network.[8]

OpenBTS has been used by the security research community to mount attacks on cellular phone baseband processors.[9][10] Previously, investigating and conducting such attacks was considered impractical due to the high cost of traditional cellular base station equipment.

## Field tests

Large scale live tests of OpenBTS have been conducted in the United States in Nevada and northern California using temporary radio licenses applied for through Kestrel Signal Processing and [Range Networks](/source/Range_Networks), Inc.

### Burning Man

During the [Burning Man](/source/Burning_Man) festival in August 2008, a week-long live field test was run under [special temporary authorization](/source/Special_temporary_authorization) license.[11][12] Although this test had not been intended to be open to Burning Man attendees in general, a number of individuals in the vicinity succeeded in making out-going calls after a mis-configured Asterisk PBX installation allowed through test calls prefixed with an [international code](/source/List_of_country_calling_codes).[13] The test connected about 120 phone calls to 95 numbers in area codes over North America.

At the 2009 Burning Man festival, a larger test setup was run using a 3-sector system.[14] For the 2010 festival, an even larger 2-sector 3-carrier system was tested.

At the 2011 festival, the OpenBTS project set up a 3-site network with [VSAT](/source/VSAT) gateway and worked in conjunction with the [Voice over IP](/source/Voice_over_IP) services company [Voxeo](/source/Voxeo) to provide much of the off-site call routing.[15][16]

### "RELIEF" exercises

RELIEF is a series of disaster response exercises managed by the [Naval Postgraduate School](/source/Naval_Postgraduate_School) in [California](/source/California), USA.[17] Range Networks operated OpenBTS test networks at the RELIEF exercises in November 2011 [18] and February 2012.[19]

### Niue

In 2010, an OpenBTS system was installed on the island of [Niue](/source/Niue) and became the first installation to be connected and tested by a telecommunication company. Niue is a very small island country with a population of about 1,700 - too small to attract mobile telecommunications providers. The cost structure of OpenBTS suited Niue, which required a mobile phone service but did not have the volume of potential customers to justify buying and supporting a conventional GSM basestation system.[20]

The success of this installation and the demonstrated demand for service helped bootstrap later commercial services. The OpenBTS installation was later decommissioned ~February 2011 by Niue Telecom, a commercial grade GSM 900 network with Edge support was instead launched few months later (3x sites in Kaimiti O2, Sekena S2/2/2 and Avatele S2/2/2) this provided full coverage around the island and around the reef, the installation included a pre-pay system, USSD, Int. SMS and new Int. Gateway.

### Defcon 20

From July 26 to July 29, 2012, the Ninja Networks team set up a "[NinjaTel Van](/source/NinjaTel_Van)" in the Vendor[21] area of Defcon 20 (at the Rio Hotel/Casino in Las Vegas.) It used OpenBTS and served a small network of 650 [GSM](/source/GSM) phones with custom SIM cards.[22]

## See also

- [Free and open-source software portal](https://en.wikipedia.org/wiki/Portal:Free_and_open-source_software)

- [Base station subsystem](/source/Base_station_subsystem)

- [Um interface](/source/Um_interface)

- [USRP](/source/USRP)

- [GNU Radio](/source/GNU_Radio)

- [Osmocom](/source/Osmocom)

## References

1. **[^](#cite_ref-licensing_1-0)** ["/openbts/trunk/LEGAL – rangepublic"](https://wush.net/trac/rangepublic/browser/openbts/trunk/LEGAL). *wush.net*. Retrieved 15 November 2025.{{[cite web](https://en.wikipedia.org/wiki/Template:Cite_web)}}: CS1 maint: deprecated archival service ([link](https://en.wikipedia.org/wiki/Category:CS1_maint:_deprecated_archival_service))

1. **[^](#cite_ref-2)** ["RELIEF 12-2 : Actual Event"](https://web.archive.org/web/20120712105135/http://wush.net/trac/rangepublic/wiki/RELIEF12-2#ActualEven). OpenBTS wiki. Archived from [the original](http://wush.net/trac/rangepublic/wiki/RELIEF12-2#ActualEven) on 12 July 2012. Retrieved 11 April 2012.

1. **[^](#cite_ref-3)** Bort, Julie. [Burning Man's open source cell phone system could help save the world](http://www.networkworld.com/news/2010/083010-open-source-voip-cell-phones-at-burning-man.html) [Archived](https://web.archive.org/web/20120111210320/http://www.networkworld.com/news/2010/083010-open-source-voip-cell-phones-at-burning-man.html) 2012-01-11 at the [Wayback Machine](/source/Wayback_Machine), Network World, August 30, 2010. Retrieved December 6, 2011.

1. **[^](#cite_ref-4)** Naone, Erica. [Build Your Own Cellular Network](http://www.technologyreview.com/communications/25107/?a=f) [Archived](https://web.archive.org/web/20120124152128/http://www.technologyreview.com/communications/25107/?a=f) 24 January 2012 at the [Wayback Machine](/source/Wayback_Machine), Technology World, May 2010. Retrieved on December 7, 2011.

1. **[^](#cite_ref-5)** Takahash, Dean [DEMO: Range Networks rings in cell-phone service for $2 a month](https://venturebeat.com/2010/09/14/demo-range-networks-cheap-cell-phone-service/) VentureBeat, September 14, 2010. Retrieved December 6, 2011.

1. **[^](#cite_ref-6)** Finley, Klint [Out in the Open: This super-cheap cellphone network brings coverage almost anywhere](https://www.wired.com/2014/06/openbts/) Wired, June 9, 2014.

1. **[^](#cite_ref-7)** Paget, Chris. [OpenBTS on Droid](http://www.tombom.co.uk/blog/?p=144) [Archived](https://web.archive.org/web/20110912160307/http://www.tombom.co.uk/blog/?p=144) 2011-09-12 at the [Wayback Machine](/source/Wayback_Machine), Chris Paget's Blog, February 19, 2010. Retrieved Dec. 6 2011.

1. **[^](#cite_ref-8)** Paget, Chris. [Practical Cellphone Spying](https://www.defcon.org/html/defcon-18/dc-18-speakers.html#Paget), DEF CON 18, July 30, 2010. Retrieved Dec. 6 2011.

1. **[^](#cite_ref-9)** Stevens, Mike (19 February 2018). ["HOW TO INTERCEPT MOBILE COMMUNICATIONS (CALLS AND MESSAGES) EASILY WITHOUT HACKING"](https://www.securitynewspaper.com/2018/02/19/intercept-mobile-communications-calls-messages-easily-without-hacking/). *Information Security Newspaper*.

1. **[^](#cite_ref-10)** Claburn, Thomas. [Google Bets $20,000 You Can't Hack Chrome](http://www.informationweek.com/news/security/vulnerabilities/229201164), Information Week, February 04, 2011. Retrieved December 6, 2011.

1. **[^](#cite_ref-11)** Federal Communications Commission, [WD9XKN](https://openbts.sourceforge.net/FieldTest/WD9XKN.pdf) Experimental Special Temporary Authorization, August 24, 2008. Retrieved December 6, 2011.

1. **[^](#cite_ref-12)** Burgess, David. [The OpenBTS Project - an open-source GSM base station](https://lwn.net/Articles/297038/) LWN.net, September 4, 2008. Retrieved December 6, 2011.

1. **[^](#cite_ref-13)** [The Unofficial Non-Carrier of Burning Man 2008](https://openbts.sourceforge.net/FieldTest/) OpenBTS website. Retrieved December 6, 2011.

1. **[^](#cite_ref-14)** Burgess, David. [OpenBTS Nevada Test Site](https://openbts.sourceforge.net/FieldTest2/Astricon2009DBurgess.key.pdf) Astricon 2009, October 13, 2009. Retrieved December 7, 2011.

1. **[^](#cite_ref-15)** Burgess, David. ["Papa Legba 2011 - Network"](https://web.archive.org/web/20111202105602/http://papalegba2011.wikispaces.com/Network). Archived from [the original](http://papalegba2011.wikispaces.com/Network) on 2 December 2011.

1. **[^](#cite_ref-16)** Burgess, David. [Burning Man 2011 - Yes we were there](https://openbts.blogspot.com/2011/09/burning-man-2011-yes-we-were-there.html) The OpenBTS Chronicles, September 6, 2011. Retrieved on December 7, 2011.

1. **[^](#cite_ref-17)** ["RELIEF"](http://www.nps.edu/Academics/Schools/GSOIS/Departments/IS/Research/FX/RELIEF/relief.html). Naval Postgraduate School. Retrieved 11 April 2012.

1. **[^](#cite_ref-18)** ["RELIEF 12-1 Quicklook Report"](http://www.nps.edu/Academics/Schools/GSOIS/Departments/IS/Research/FX/docs/RELIEF12-1_QLR.pdf) (PDF). Naval Postgraduate School. Retrieved 11 April 2012.

1. **[^](#cite_ref-19)** ["RELIEF 12-2 Quicklook Report"](http://www.nps.edu/Academics/Schools/GSOIS/Departments/IS/Research/FX/docs/RELIEF12-2_QLR.pdf) (PDF). Naval Postgraduate School. Retrieved 11 April 2012.

1. **[^](#cite_ref-20)** Burgess, David. [FAKALOFA LAHI ATU](https://openbts.blogspot.com/2010/03/fakalofa-lahi-atu.html), The OpenBTS Chronicles, March 7, 2010. Retrieved on December 7, 2011.

1. **[^](#cite_ref-21)** ["At Defcon, hackers get their own private cell network: Ninja Tel"](https://arstechnica.com/security/2012/07/ninja-tel-hacker-phone-network/). *Ars Technica*. 28 July 2012. Retrieved 2 August 2012.

1. **[^](#cite_ref-22)** ["A Phone Network Just for Hackers"](https://blogs.wsj.com/digits/2012/07/26/a-phone-network-just-for-hackers/). *Wall Street Journal*. 26 July 2012. Retrieved 2 August 2012.

## External links

- [Official website](http://openbts.org)

v t e Telecommunications History Beacon Broadcasting Cable protection system Cable TV Communications satellite Computer network Data compression audio DCT image video Digital media Internet video online video platform social media streaming Drums Edholm's law Electrical telegraph Fax Heliographs Hydraulic telegraph Information Age Information revolution Internet Mass media Mobile phone Smartphone Optical telecommunication Optical telegraphy Pager Photophone Prepaid mobile phone Radio Radiotelephone Satellite communications Semaphore Phryctoria Semiconductor device MOSFET transistor Smoke signals Telecommunications history Telautograph Telegraphy Teleprinter (teletype) Telephone history The Telephone Cases Television digital streaming Undersea telegraph line Videotelephony Whistled language Wireless revolution Pioneers Nasir Ahmed Edwin Howard Armstrong Mohamed M. Atalla John Logie Baird Paul Baran John Bardeen Alexander Graham Bell Emile Berliner Tim Berners-Lee Francis Blake Jagadish Chandra Bose Charles Bourseul Walter Houser Brattain Vint Cerf Claude Chappe Yogen Dalal Donald Davies Daniel Davis Jr. Amos Dolbear Thomas Edison Philo Farnsworth Reginald Fessenden Lee de Forest Elisha Gray Oliver Heaviside Robert Hooke Erna Schneider Hoover Harold Hopkins Gardiner Greene Hubbard Bob Kahn Dawon Kahng Charles K. Kao Narinder Singh Kapany Hedy Lamarr Roberto Landell Innocenzo Manzetti Guglielmo Marconi Robert Metcalfe Antonio Meucci Samuel Morse Jun-ichi Nishizawa Charles Grafton Page Radia Perlman Alexander Stepanovich Popov Tivadar Puskás Johann Philipp Reis Claude Shannon Almon Brown Strowger Henry Sutton Charles Sumner Tainter Nikola Tesla Camille Tissot Alfred Vail Thomas A. Watson Charles Wheatstone Vladimir K. Zworykin Internet pioneers Transmission media Coaxial cable Fiber-optic communication optical fiber Free-space optical communication Molecular communication Radio waves wireless Transmission line telecommunication circuit Network topology and switching Bandwidth Links Network switching circuit packet Nodes terminal Telephone exchange Multiplexing Space-division Frequency-division Time-division Polarization-division Orbital angular-momentum Code-division Concepts Communication protocol Computer network Data transmission Store and forward Telecommunications equipment Types of network Cellular network Ethernet ISDN LAN Mobile NGN Public Switched Telephone Radio Television Telex UUCP WAN Wireless network Notable networks ARPANET BITNET CYCLADES FidoNet Internet Internet2 JANET NPL network TANet Toasternet Usenet Locations Africa Americas North South Antarctica Asia Europe Oceania Global telecommunications regulation bodies Telecommunication portal Category Outline Commons

---
Adapted from the Wikipedia article [OpenBTS](https://en.wikipedia.org/wiki/OpenBTS) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/OpenBTS?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.