Console & UIs
The mobile station runs as a daemon with a gRPC control API. Every front end (the console, the terminal UI and the handset GUI) is a client of that API. Run one on its own and it starts a daemon for you. Point several at a shared daemon with --connect.
| Command | What you get |
|---|---|
cdma-ms console | Line-oriented shell with history (Up/Down, Ctrl-R) and a live event log |
cdma-ms tui | Full-screen terminal UI: shell plus live signal, serving-cell and paging panels, with Stats and Logs views |
cdma-ms gui | A feature-phone window. Dial, answer, text, and talk through the microphone and speaker (build with gui) |
cdma-ms serve | The daemon alone, for scripting or remote front ends |
cdma-ms scan | One-shot PRL scan: camp on the first permitted system, print what it found, exit |
cdma-ms sweep | Report the pilot on every channel the PRL lists, without camping |

The options shared by most commands are --config, --radio, --prl, --esn and --imsi. console and tui also accept --gui to open the handset window alongside.
# Daemon on the radio host, console from a laptopcdma-ms serve --radio config/radio_uhd_b210_native.json --prl my-network.prl \ --grpc-listen 0.0.0.0:50052cdma-ms console --connect radio-host:50052The control API has no authentication. Bind
serveto a non-loopback address only on a network you trust.
Console commands
Radio and acquisition
| Command | Does |
|---|---|
on / off | Power on (scan and camp) or power off |
status | Serving system, radio and protocol state |
scan [camp|survey] | Scan the loaded PRL, optionally camping on the result |
sweep | Survey every PRL channel without camping |
results | Results of the latest scan |
tune <bc> <channel> | Acquire one channel, e.g. tune bc0 384 |
prl <path> | Load a PRL for later scans |
prl <sid> [nid] | Check whether the loaded PRL permits a system |
channels | List the channels in the loaded PRL |
gain <db> | Set receive gain |
What the cell is sending
| Command | Does |
|---|---|
pilot | Pilot lock, Ec/Io and received power |
sync | The decoded Sync Channel Message |
overhead [spm|apm|espm|cclm|nlm|enlm] | Overhead messages received, or one in detail |
neighbors | The decoded neighbor list |
paging | Paging channel decode counters |
stats | Sample, overflow and real-time counters |
dump <seconds> <file.wav> | Record forward-link IQ on the daemon host |
Calls and messages
| Command | Does |
|---|---|
register | Register now |
call <digits> [codec] | Place a voice call. Codec is evrc-a (default), evrc-b, evrc-wb, tia96 or qcelp-13k |
answer | Answer a ringing call |
hangup | End the call |
dtmf <digits> | Send DTMF during a call |
tone [seconds] | Send a 440 Hz test tone as microphone audio |
mosms <destination> <text> | Send an SMS |
sms [text] | Have the simulated cell send this mobile an SMS (sim radio only) |
mobiles | Mobiles known to the simulated cell (sim radio only) |
Transmit calibration
| Command | Does |
|---|---|
power | Show the transmit calibration |
power tx <dbm> | Set the full-scale transmit reference |
power delay <samples> | Set transmit timing compensation |
power control on|off | Turn calibrated power control on or off |
verbose on|off shows or hides per-second measurements and every paging message. mute and unmute pause the event log.
Calibration changes made with
powerlast until the daemon exits. Copy the values that work intoconfig/ms.local.jsonor the radio config.
gRPC API
The daemon serves ms.v1.MsService on grpc_listen (default [::1]:50052). Everything the console does is available to your own tools: power and scan control, diagnostics, calls (Originate, Answer, HangUp, SendDtmfBurst), SMS (SendSms), 8 kHz PCM call audio in both directions, and live event and metric streams. The service definition is proto/ms/v1/service.proto in the repository.