Packet Data

Service Options

SO33 can add a Forward Supplemental Channel for downlink data. Reverse data still uses the reverse fundamental channel; R-SCH is not implemented yet.

F-SCH Capacity

These are downlink RLP payload capacities before PPP/IP/TCP overhead and retransmissions. The session count assumes no other traffic users on the carrier; each packet session still consumes one F-FCH plus one F-SCH allocation.

Session Flow

Session Establishment

Simple IP vs Mobile IPv4

Simple IP remains the normal path. In that flow, the handset includes the IPCP IP-Address option, usually IP=0.0.0.0, and the PDSN NAKs with the assigned pool address. Once the handset requests that assigned address and ACKs the PDSN’s IPCP request, IPCP opens and IP forwarding starts.

When Mobile IPv4 is enabled, it is selected only if the handset opens IPCP without an IP-Address option. The PDSN then waits for the phone to register before allowing data through. A successful registration gives the phone its home address and the configured primary and secondary DNS servers.

1xBTS rejects the RFC 2290 IPCP Mobile IPv4 option. Mobile IPv4 registration happens as IP packets over PPP after IPCP opens.

Mobile IPv4 is enabled in the checked-in pdsn.json, with the authenticated registration used by tested legacy Sprint phones. Other phones that ask for a Simple IP address continue to use Simple IP.

1xBTS can validate the configured MN-HA SPI and shared secret. It does not provide an external AAA service. allow_unverified_mn_aaa: true is available for older phones that require MN-AAA to be present, but it does not verify that device credential. If the phone requires authentication infrastructure that is not configured, the PDSN tries Simple IP instead. A request with the wrong MN-HA SPI or secret is rejected.

PPP Session Resume

The PDSN keeps an open PPP/LCP/IPCP session cache per device identity. The key uses IMSI and ESN when both are known, otherwise whichever identity is available. When a packet traffic channel closes, the radio-side RLP state is discarded, but an open PPP state can remain cached for pdsn.ppp_session_timeout_secs.

If the same mobile opens another packet traffic channel before that timeout, the new channel still performs a fresh RLP sync. After RLP reaches data transfer, the PDSN restores the cached LCP/IPCP state and resumes IP transfer without renegotiating PPP. If the cache is missing or expired, the session follows the normal RLP -> LCP -> IPCP flow.

Cached PPP sessions keep their mobile IP allocation reserved so the resumed session receives the same peer IP. Expired cached sessions are reaped periodically and release their IP allocation.

PCF / PDSN Packet Core

Packet-data control is split between the radio edge and the packet anchor. For 1x SO7/SO33, the BSC asks the PCF packet client to set up the packet session and streams RLP/PPP frames through the packet service path. The PCF/PDSN side owns the packet-core state before the PDSN hands IP packets to TUN, FOU, or FOU-TCP transport. Standards A8/A9 bearer transport is used by the HRPD/EV-DO AN path, not by the current 1x BSC path.

FOU and FOU-TCP carry the PDSN’s IP traffic to the outside network. They are separate from the HRPD A8/A10 bearer settings, which control how EV-DO packet data moves between the AN, PCF, and PDSN.

Duplicate Service Connect Completion handling is idempotent. If the mobile retransmits completion during setup, the BSC does not leak an extra packet session. The PCF queues pending A11 registrations per packet session while the PDSN-side transport comes up, then drains them after activation. If an existing packet traffic channel is converted to voice, the BSC closes the old packet session after voice service connects.

IP Routing

Transport modes: TUN (local kernel interface, requires root), FOU (UDP tunnel), or FOU-TCP (TCP relay path).

The default DNS points mobiles at the packet gateway resolver. In the compose stack, that resolver serves the local speed test at http://speed/ and http://speed.local.1xbts.org/.

See Packet Data Setup for FOU configuration.

Configuration

In config/pdsn.local.json:

{
  "packet_grpc_listen_addr": "127.0.0.1:17021",
  "ppp_session_timeout_secs": 1800,
  "packet": {
    "transport": "fou_tcp",
    "fou_remote": "127.0.0.1:17012",
    "fou_local_port": 17011,
    "gateway_ip": "10.55.0.1",
    "primary_dns": "10.55.0.1",
    "secondary_dns": "10.55.0.1",
    "enable_uplink_vj_compression": false,
    "enable_downlink_vj_compression": false,
    "mobile_ip": {
      "enabled": true,
      "fa_address": "10.55.0.1",
      "home_agent_address": "10.55.0.1",
      "advertisement_count": 3,
      "advertisement_lifetime_secs": 9000,
      "registration_lifetime_secs": 1200,
      "auth_mode": "mn_ha",
      "mn_ha_spi": 1234,
      "mn_ha_secret_base64": "c2VjcmV0",
      "allow_unverified_mn_aaa": true,
      "home_address_pool": null
    }
  }
}

The two VJ settings control Van Jacobson TCP/IP header compression separately for each direction. enable_uplink_vj_compression asks mobiles to compress traffic they send to the PDSN. enable_downlink_vj_compression accepts mobile requests to compress traffic sent to them. Leave both false unless your phones handle VJ reliably.

mobile_ip.enabled controls Mobile IPv4 registration. Sprint handsets are known to require this when they complete IPCP without taking a Simple IP address. Enabling it does not change phones that request a Simple IP address. When enabled, registration_lifetime_secs must be lower than ppp_session_timeout_secs.

The shown MN-HA values match the compatibility settings included for tested legacy Sprint phones. They are not secure, general-purpose credentials. If a phone is provisioned with a different MN-HA SPI or secret, override both values to match it. The secret is binary data encoded as base64, and the SPI must be greater than 255.

F-SCH is controlled from config/bsc.local.json:

{
  "traffic_assignment": {
    "enable_f_sch": true,
    "f_sch_rate_bps": 153600
  }
}

Valid F-SCH rates are 19200, 38400, 76800, and 153600. 9600 is the fundamental-channel data rate and is not valid for f_sch_rate_bps.

The configured rate is a carrier-wide packet-data policy: every eligible SO33 packet session gets the same F-SCH rate.

Troubleshooting

If packet data does not connect, is slow, or stops working, collect a short log and packet capture to send with the issue report. This gives support the session setup, radio packet activity, and the phone’s network traffic from the same run.

Record the problem

From the 1xBTS repository, choose a new output directory and start 1xBTS with capture and debug logging enabled. This example uses the UHD B210 radio config:

mkdir -p /tmp/1xbts-packet-debug-1

CDMA_PACKET_CAPTURE=1 \
CDMA_PACKET_CAPTURE_DIR=/tmp/1xbts-packet-debug-1 \
RUST_LOG=debug \
cargo run --release -p cdma-nib -- \
  --config-dir config \
  --radio-config config/radio_uhd_b210_native.json \
  2>&1 | tee /tmp/1xbts-packet-debug-1/1xbts.log

Use the radio config and carrier profile options from your normal start command. Then:

1. Wait for the phone to start a packet data session.
2. Reproduce the problem once.
3. Let 1xBTS continue running for another 15 seconds.
4. Press Ctrl+C to stop 1xBTS.

Send the results

The output directory normally contains these files:

Check which files were created:

ls -lh /tmp/1xbts-packet-debug-1

If either PCAP is missing, send the log and the files that were created anyway. Also include the phone model, selected carrier profile, what you attempted, and the approximate time of the attempt.

Package everything into one file for sending:

tar -czf /tmp/1xbts-packet-debug-1.tar.gz \
  -C /tmp 1xbts-packet-debug-1

Use a new output directory for each attempt. Reusing the directory replaces its existing PCAP files.

Dashboard

The /packets page shows active sessions, assigned IPs, RLP statistics, PPP state, and throughput.

Live session events

PDSN publishes session bind/unbind events to the aggregated event bus. Subscribe to EVENT_SOURCE_PDSN on events.v1.EventService to receive a PacketSessionBound when a mobile acquires an IP and a PacketSessionUnbound when the session is torn down:

grpcurl -plaintext -d '{"source_filter":["EVENT_SOURCE_PDSN"]}' \
  localhost:17023 events.v1.EventService/ListenEvents

See gRPC API → EventService for the full event schema.