System Overview
1xBTS is organized as explicit network nodes. One MSC serves any number of base stations. Each base station is a BSC serving any number of cells, and each cell is a BTS driving one SDR. The cdma-nib launcher runs a complete single-cell network on one host, while the configuration model keeps BTS, BSC, MSC, PCF, PDSN, HLR, SMSC, and the voice gateway as separate components that can also run on their own hosts.
The radio side is hybrid: CDMA2000 1x and EV-DO / HRPD use separate radio access paths, but converge at the shared PCF/PDSN packet core. The BSC owns 1x voice, SMS, and SO7/SO33 packet-data control. The HRPD access network (AN) runs inside each EV-DO cell’s BTS and owns that cell’s UATI sessions, traffic connections, and packet streams. HLR/SMSC remain shared subscriber services: 1x uses them for registration and messaging, and the HRPD access network uses HLR hardware-identity resolution to map ESN/MEID to IMSI before completing A9 setup.
Standards Interfaces
| Interface | Nodes | Transport | Purpose |
|---|---|---|---|
| Abis signaling | BTS ↔ BSC | TCP 5604 with F634 framing | BTS/BSC control messages |
| Abis bearer | BTS ↔ BSC | UDP — BTS-side 17014, BSC-side 17022 | traffic frames and timing metadata |
| A1 | BSC ↔ MSC | TCP — the MSC dials each base station’s a1_bind_addr (17013 by default) | IOS call control |
| A2p | BSC ↔ MSC | per-circuit RTP/UDP | QCELP/EVRC voice bearer with circuit-specific RTP sessions |
| A8/A9 | BTS (HRPD access network) ↔ PCF | A8 keyed GRE, A9 UDP control | HRPD packet-data radio edge, one A8 bearer per EV-DO cell |
| A10/A11 | PCF ↔ PDSN | A10 keyed GRE, A11 UDP control | packet-data core anchor. One PDSN serves several PCFs. |
gRPC is not used for these standards interfaces. It is used for management, diagnostics, web UI integration, HLR/SMSC/packet service APIs, the 1x BSC-to-PCF packet client boundary, and SIP voice gateway control.
Packet data is anchored by the PDSN packet service on 127.0.0.1:17021. 1x packet data enters through the BSC using SO7/SO33 traffic channels and the BSC-facing PCF packet client boundary. EV-DO packet data enters through the HRPD access network in the cell’s BTS using standards A8/A9. The PCF handles radio-edge packet setup for both paths, while the PDSN handles PPP/IP routing. A single PDSN serves several PCFs at once, so base stations on different hosts can each run their own PCF against the one packet core. HRPD A8/A10 user traffic uses the bearer mode configured in pcf.json and pdsn.json. UDP-encapsulated GRE works without host privileges. Native GRE is available when the host grants raw-socket capability.
Node Responsibilities
| Node | Owns |
|---|---|
| BTS | PHY, local MAC/LAC execution, forward/reverse channel processing, paging transmission, RX measurements, radio diagnostics, cell enrollment. When EV-DO is enabled, also the HRPD access network: session and stream state, UATI allocation, route update, traffic connection setup, and the A8/A9 edge toward the PCF |
| BSC | 1x radio access state for all its cells, paging policy, traffic assignment, existing-traffic-channel service negotiation, Abis peer state, A1/A2p behavior, PCF packet-client behavior, power-control policy, base station enrollment |
| MSC | voice/circuit call policy, A1 state, per-circuit A2p RTP bearer setup, MT/MO call orchestration, preemption, call list management, voice gateway control and media routing, SMS coordination via A1 ADDS |
| PCF | packet-data radio-edge session state, packet setup timers, HRPD A8/A9-facing control, 1x packet-client boundary, and A11 registration toward the PDSN |
| PDSN | packet session anchor for every PCF, PPP/IPCP, mobile IP allocation, TUN/FOU/FOU-TCP transport, A10/A11-facing state, packet gRPC service |
| HLR | subscriber records, registration bindings, HRPD ESN/MEID-to-IMSI identity resolution, mobiles_seen ledger, and HLR gRPC service backed by PostgreSQL |
| SMSC | SMS submissions, delivery attempts, welcome SMS requests, and SMSC gRPC service backed by PostgreSQL |
| Voice Gateway | MSC-controlled SIP/RTP interop and QCELP/EVRC↔G.711 media conversion |
Deployment
cdma-nib loads per-node configs from config/ and runs each component — BTS, BSC, MSC, PCF, PDSN, HLR, SMSC, and the event bus — as its own process, supervising them together and relaying their output to one terminal. Every component retries its peers, so start order does not matter and each can also run on its own from the same config. The checked-in configs wire everything over localhost:
cargo run --release -p cdma-nib -- --config-dir configThe BSC attaches to each BTS through the bts_peers list in config/bsc.json — one entry per cell, giving that BTS’s operations endpoint plus its Abis signaling and bearer addresses. A split deployment (BTS and BSC on separate hosts) or a multi-cell deployment is therefore just a matter of pointing each bts_peers entry at the right host and running a BTS there.
The MSC serves the base stations listed in base_stations in config/msc.json — one entry per BSC. The MSC dials each base station’s management endpoint to enroll it, learns its A1 address and cells, then connects A1. Running multiple base stations under one MSC is a matter of listing each one there.
pcf.json points packet setup at the packet service and configures the PCF side of A8/A10/A11. pdsn.json configures the packet service listener, packet transport, A10 bearer, and the matching A11 security association. When EV-DO is enabled on a cell, that cell’s BTS also runs the HRPD access network and connects it to the PCF through the evdo.a9 addresses in bts.json.
Management Plane
| Endpoint | Default | Purpose |
|---|---|---|
| MSC management | 127.0.0.1:17017 | The single management interface the web uses — calls, SMS, OTASP, and all radio, HRPD, and packet management, routed to the right base station |
| Base station management | 127.0.0.1:17016 | Per-base-station enrollment, BTS/BSC management and events, reached through the MSC |
| Cell management | 127.0.0.1:17024 | Per-cell enrollment, radio metrics and IQ capture, reached through the BSC |
| HRPD access network | 127.0.0.1:17030 | EV-DO sessions for one cell, hosted by that cell’s BTS and reached through the MSC |
| HLR service | 127.0.0.1:17019 | subscriber and registration storage API |
| SMSC service | 127.0.0.1:17020 | SMS submission and delivery storage API |
| Packet service | 127.0.0.1:17021 | packet session service used by PCF/PDSN-facing runtime paths |
| Event bus | 127.0.0.1:17023 | aggregated network event stream |
| Voice gateway | 127.0.0.1:17015 | MSC-controlled SIP gateway control/media service |
| 1xbts-web | http://localhost:3000 | Next.js UI, API routes, SSE streams |
The web uses the MSC management endpoint as its single management interface: the MSC forwards each request to the addressed base station, cell, or HRPD access network, or to the packet core, and aggregates network-wide views. The web never connects to a BSC, a BTS, or the PDSN directly. HLR, SMSC and the event bus keep their own service APIs, which the web reaches directly. See Management Plane.