Introduction
While 3G networks are rapidly being phased out worldwide, the hardware that once relied on them remains abundant. For hackers and hobbyists, this creates a unique opportunity: run your own cellular network using the old CDMA2000 standard. Recently, developer Chrismoos made this significantly easier by releasing 1xBTS, an open-source Rust implementation of the lower three layers of a CDMA2000 network. This article explores how you can set up your own 3G base station, the technology behind it, and the legal pitfalls you must avoid.
The Legacy of CDMA2000
CDMA2000 (Code Division Multiple Access 2000) was one of the primary protocols defined for third-generation (3G) cellular networks. It offered improved data speeds and voice capacity compared to 2G, and was widely deployed by carriers such as Verizon, Sprint, and many others in Asia and the Americas. However, with the advent of 4G LTE and 5G, CDMA2000 is now years out of date and carriers are actively decommissioning their towers. Despite this, vast numbers of phones still support CDMA2000 and will happily connect to any compatible base station, making it an attractive target for hobbyist networks.
Inside 1xBTS: A Rust-Powered 3G Base Station
1xBTS is a software implementation of a CDMA2000 base station (BTS) written in the Rust programming language. Rust was chosen for its memory safety and performance, crucial for real-time radio communication. The project implements the lower three layers of the CDMA2000 protocol stack, effectively handling the physical, data link, and network layers required to communicate with standard handsets.
SDR Hardware Support
The lowest layer of the stack relies on a Software Defined Radio (SDR) for actual radio transmissions. 1xBTS has been tested with several popular SDRs, including the USRP B200 and B210, the LimeSDR Mini 2, and the BladeRF Micro 2.0. Additionally, the code may work with other SDRs that are compatible with the SoapySDR abstraction layer, offering flexibility for different hardware setups.
The Protocol Stack Layers
The SDR is controlled by the BTS software, which in turn communicates with a Base Station Controller (BSC) over an Abis link. The BSC manages essential functions such as channel allocation and mobile device handovers. Above the BSC sits the Mobile Switching Center (MSC), which handles message switching, call routing, and coordination with external networks like the Public Switched Telephone Network (PSTN) or SIP-based VoIP systems.
Authentication and Services
Before any handset can use the network, it must authenticate. 1xBTS includes standard 3G verification: the phone’s identity must be registered in the Home Location Register (HLR). Once authenticated, the handset gains access to all typical cellular services:
- Voice calls – inbound and outbound, via a SIP gateway.
- SMS – both sending and receiving.
- Data packet transfers – allowing internet connectivity through the private network.
All these services are fully compatible with unmodified commercial handsets, meaning you can use an old CDMA2000 phone without any custom firmware.
Managing Your Network: The Web Dashboard
To simplify administration, 1xBTS includes a web-based dashboard. This interface provides a convenient platform for managing subscribers, monitoring network activity, and even packet tracing for debugging. The dashboard makes it easy to add new phones, inspect call logs, and observe traffic patterns—all from a browser.
Legal Considerations
It is crucial to note that operating any radio transmitter on cellular frequencies is legally hazardous. Radio spectrum is strictly regulated in most countries, and unauthorized transmissions in the cellular bands can result in hefty fines or even criminal charges. Before even thinking about setting up a base station, you must obtain the necessary licenses or operate only in experimental or testing environments (such as shielded rooms) where you are not interfering with commercial networks. Always consult your local telecommunications regulator before proceeding.
Alternatives and the Broader DIY Cellular Landscape
If CDMA2000 is not your cup of tea, there are other great open-source projects for running private cellular networks. For example:
- 4G LTE implementation – projects like srsRAN provide a full LTE stack using similar SDR hardware.
- 1G recreation – hobbyists have revived the original analog cellular system for educational purposes.
- GSM network for a hacker camp – a complete GSM network built for events like CCCamp, demonstrating coverage and services on a small scale.
Each of these projects offers a different set of challenges and capabilities, but all share the goal of democratizing the cellular infrastructure.
Conclusion
Running your own 3G network with CDMA2000 is now more accessible than ever thanks to 1xBTS. By combining SDR hardware, Rust software, and a web-based management interface, you can create a fully functional cellular island for experimentation, education, or even rural communication. But remember: spectrum regulations apply, so proceed with caution. The era of 3G may be ending, but the ingenuity of the hacker community ensures its legacy lives on.