██╗██╗ ██╗██████╗ ████████╗███████╗ ███║╚██╗██╔╝██╔══██╗╚══██╔══╝██╔════╝ ╚██║ ╚███╔╝ ██████╔╝ ██║ ███████╗ ██║ ██╔██╗ ██╔══██╗ ██║ ╚════██║ ██║██╔╝ ██╗██████╔╝ ██║ ███████║ ╚═╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚══════╝
open-source cellular network
CDMA2000 1x from RF to core.
A full cellular stack in Rust — SDR air interface, BTS/BSC split, MSC, SMSC, HLR, packet data, and a dashboard.
Radio
The air interface is built on CDMA2000 Spread Rate 1, driven by a software-defined radio. Phones connect over a real 1.25 MHz channel — pilot, sync, paging, and traffic channels — using Walsh code spreading and Viterbi decoding. Closed-loop power control runs at 800 Hz to keep signal quality stable as the phone moves.
Air interface →Base Station
The BTS handles the physical radio layer and hands off decoded frames to the BSC over an internal Abis interface. The BSC manages channel assignment, radio configurations (RC1/RC3), and the state machines that take a phone from idle to active. Together they form the radio access network.
System overview →Switching
The MSC is where calls get made. It handles call origination and termination, routes audio between parties via an internal bridge, and bridges to SIP trunks in both directions — outbound from a handset and inbound from a SIP caller. Voice is carried as EVRC over the A2p interface from the BSC, then transcoded or passed through to the far end.
Voice calls →Subscribers
The HLR keeps track of who is on the network — each phone's IMSI, its current registration, and its history. When a phone powers on and registers, the HLR records the binding. That record is what lets the network page the phone for an incoming call or message.
Identity & registration →Messaging
The SMSC handles SMS end-to-end. Messages are carried as data bursts over the traffic channel, tracked for delivery state, and can be sent to a phone at any time while it's registered. A configurable welcome SMS goes out automatically on first registration. MS-to-MS messages forward through the same pipeline; offline recipients are delivered on next registration.
An optional MMS profile adds an embedded Mbuni MMSC plus WAP Push delivery on the same air-interface path. Captive DNS hijacks carrier MMSC hostnames so handsets with baked-in MMS settings reach the cell's MMSC without reprovisioning.
Packet Data
Phones can get an IP address and route real traffic. Data calls use Service Option 33 with RLP framing, PPP negotiation, and optional F-SCH downlink acceleration. The packet core uses TUN or FOU transport to carry IP to and from the phone.
Packet data guide →Provisioning
Dial *228 from a handset and the network can read or rewrite its identity, dialed number, operator banner, MMS URL, and roaming list over the air. A structured PRL editor handles classic and Extended PRLs — upload an existing .prl file or build one from scratch, then push it to handsets through the same flow.
OTASP guide →