So you pull out your 9926 BBUv2, boot it up, and remember it’s only running LR16.1.L MNCL3. That’s so 2018. You really want to run mid-2019’s MNCL4 drop instead. It’s newer. Fresher. Nicer.

There’s only one way to fix this…

Run NEM

You’ve got the latest Network Element Manager (NEM) installed on your Linux machine. It’s not a Linux app (it’s Java) but you’ve got WINE and that works just fine. The only annoying thing is that you need to type a lot of stuff to start it because [reasons], but that’s a problem for another day.

$ wine ~/.wine/drive_c/users/dcbw/Start\ Menu/Programs/Nokia/NEM/NEM.LR17.1_D1.11.lnk

You remind yourself that WINE is pretty great because it can run all kinds of old enterprise stuff, but before you finish the thought up pops NEM’s login window.

You type in the standard Alcatel-Lucent eNodeB username and password in all three boxes. It complains if any boxes are empty and you don’t want to make it angry.

initial_nem / Vq,A=V8o;#

Up pops the main window, but you can’t do anything for half a minute while NEM reads the BBU’s configuration. Eventually it’s done “reading documents” and “opening channels”.

That’s a Lot of #

Flipping to the SW Properties tab you double-check versions to see what old thing you’ll be overwriting on the passive partition.

Ugh. 2017 is even worse than 2018. Goodbye FL1, to the curb you go. Hello MNCL4, shiny freshness, and sweet sweet 2019. Let’s do this.

But you can’t do anything until you allocate configuration rights. You thought you had all the power but NEM reminds you that you’re still mortal. For now.

That’s better, now the SW Replacement button is enabled and the world is yours. So hit that button already! But wait, this part actually requires some terminal work, not just a Java GUI app. You need to copy MNCL4 to a place where the 9926 can find it with SFTP. Don’t worry; it’s a Linux system. You know this!

$ mkdir /home/rbs/alcatel/ENB_LR1601_D0305_E00771
$ cp ENB_LR1601_D0305_E00771.srs.tar.gz /home/rbs/alcatel/ENB_LR1601_D0305_E00771
$ cd /home/rbs/alcatel/ENB_LR1601_D0305_E00771
$ tar -xvf ENB_LR1601_D0305_E00771.srs.tar.gz
$ systemctl start sshd

Yes! It worked! You log into your local machine’s SFTP server from the chooser dialog and navigate to the SDF file. You select it, pour one out for FL1, and hit OK.

It begins. The BBU reads the file list from the SDF file and begins sucking down the update.

Now’s a good time to get a drink, you tell yourself. Maybe some water. Or coffee? In any case it’ll take a while. You get back with your coffee and it’s still not done loading. You SSH in and poke around.

SDCXM-SDCAM-1-root-enbodev> ps aux | grep dpkg
root 29454 0.0 0.0 2700 948 pts/0 R+ 19:55 0:00 /bin/dpkg --admindir=/ffs1/config/db -1 /data/sw/#BI_0850#FT_OMsw#FI_bcam2#FV_000017D8/uecallp.sdcam.deb
SDCXM-SDCAM-1-root-enbodev>

Yep, it’s still doing stuff. Just Wait Longer. Finally NEM updates, shows the install is complete, and the BBU is rebooting. Just Wait Longer. The BBU comes back up, NEM reconnects, and you verify the load worked as intended.

It did. MNCL4 success! You’ve reached peak Alcatel-Lucent eNodeB; gone as far as you can go. Take the time to enjoy it. Happy LTE-ing!

Small Cells

Airspan AirVelocity 1000 LTE

Airspan AirVelocity 1901 (PIDAV1901) 5G

Baicells Nova 227 (2AG32PBS212096N) LTE

Baicells Nova 430i (2AG32PBS3101S) LTE

Cell Bounce (2AUQ4-CB34U) UMTS

Gemtek WLTGFC-105 (MXF-WLTGFC105) LTE

Nokia Flexi Zone Indoor Pico BTS FWFF LTE

Nokia Flexi Zone Multiband Indoor Pico BTS FW2IRA LTE

Sprint Airave 3 (QHY-S1000C) LTE board

Sprint Airave 3 (QHY-S1000C) CDMA board

Macro eNodeBs/gNodeBs

Alcatel-Lucent 9926 bCAM2 LTE control/modem module [SoC A] [SoC B] [SoC C]

Alcatel-Lucent 9926 bCEM2 LTE modem module [SoC A] [SoC B] [SoC C]

Alcatel-Lucent 9926 eCCM2 UMTS/LTE control module

Alcatel-Lucent 9926 eCCM UMTS/LTE control module

Alcatel-Lucent 9926 eCEM UMTS/LTE modem module

Nokia AirScale ASIL GSM/UMTS/LTE/5G control module

Nokia AirScale ASIK 5G control module

Nokia AirScale ASIA GSM/UMTS/LTE control module

Nokia AirScale ASIB GSM/UMTS/LTE/5G control module

Samsung CDU30 LMD1-J1A LTE control module

Samsung CDU30 LCC4-B1A LTE baseband module

Samsung GCB1-C1A LTE/5G baseband module

Unfortunately the hub is powered on by a momentary push-button, but it’ll be stuck inside an RF shield box and externally power-controlled with a Synaccess IP managed power strip. There is no non-physical way to turn the hub on when first powered. Can we change that?

Yes we can.

Open it Up

Taking off the four rubber feet reveals four Phillips screws.

Removing those lets the bottom come off, revealing the PCB, which easily comes out of the case with a small tilt and a tug.

I’ve circled the power switch I need to bypass, so let’s flip over the board and use a multimeter to figure out whether the switch is normally open (NO) or normally closed (NC) and what pins I need to solder together.

Solder Time

Turns out it’s very simple; the switch is normally open (NO) and pressing the power button continuously doesn’t seem to put the switch into any kind of debug, reset, or firmware download mode. I just need to connect these two pins together and the hub will automatically turn on every time power is connected.

Ugly solder job for sure, but it works.

Today I’m converting my Nokia Flexi Zone Multiband Indoor Pico BTS model FW2IRA to use external antennas. It’s a 2×2 LTE band 66+46 eNodeB about the size of a couple dinner plates stacked up. I need external antennas because, like my previous conversion of a Nokia FWFF, I’m going to pipe the radios into a Willtek RF Shield so I don’t make mobile carriers angry.

The Multiband part of the name (and the “2” part of the model number) indicate these are second generation Nokia LTE Pico BTSs which support two LTE bands each. The first generation (like the FWFF) only supports a single band.

Here I’m starting with the top of the unit off, looking at the four antennas that I’m going to remove.

The antennas themselves just screw into the huge heatsink, but unfortunately to disconnect their cables we have remove the heatsink because the connectors are far underneath:

While I’ve got the heatsink removed, let’s take a look inside.

Immediately you can see a huge CPU, another big chip that’s probably an ASIC, a Lattice FPGA, a bunch of DDR3, and two RF cards. Nokia Flexi Zone Picos support a huge number of bands and to manage that the base BTS is the same but the RF cards are changed to support each frequency combination.

Now that I have access to the antenna connectors, I’m going to snap in the SMA pigtails.

And then screw the heatsink back on and route the pigtails around it:

Next I drilled four holes in the corners of the top case for the SMA connectors to screw into:

And repeat a couple more times…

I tightened up the SMA connectors on the outside:

And now I have four external antenna connectors on the FW2IRA. It’s definitely not as elegant as the pre-existing SMA connector holes on the FWFF but it’ll work.

You get a GPS receiver and feed it to an NTP server, that’s what. Let’s do it.

GPS Receiver

The most important choice is which GPS receiver. You want one that provides “Pulse Per Second” (PPS) so the time server knows when each second actually starts and can compensate for latency or jitter. That significantly limits your options, but aside from overbuilt marine units like the Garmin 16x you can usually find cheap u-blox modules like the 7M, M8, or F9. My advice: look at pictures of the board and make sure something says “PPS” before you buy it.

I’m going to use USB because the HP EliteDesk 800 G4 mini that will be my NTP server doesn’t have a serial port and if I added a serial port then I couldn’t have two NICs. And while USB PPS is less accurate than serial-based PPS, that doesn’t really matter for my application.

I looked hard for an off-the-shelf USB GPS unit that had PPS capability via USB but those either don’t exist or are hard to find. So I chose a u-blox NEO-7M based board with a clearly marked PPS pin next to the TX/RX pins. Plus it had an external antenna connector (not shown below, but present at J1 as shipped).

The board has a USB-C port already and I hoped the PPS signal would be connected there so I wouldn’t have to buy an RS-232/USB converter. Spoiler alert: it isn’t. This is quite silly. So we need a USB serial cable too.

The USB Serial Cable

The PPS signal usually arrives on the host as one of the RS-232 signals like DCD or RI or CTS. So I need a cable that exposes those signals and can just connect to my GPS board’s serial pins. I found an FTDI C232HD-DDHSP-0 with all the required signals broken out.

Since it’s gotta look nice everything is going into a small project box, which means I need to drill a hole for the USB serial cable and its cord grip.

On to the antenna; it’s just a male SMA to female SMA bulkhead cable:

Time to hook up the board… I connected the cable RX to the board’s TXD, cable TX to board’s RXD, and VCC and GND.

What about PPS? I first tried the Ring Indicator (RI) signal and could not get PPS to be recognized by gpsd, while ppscheck worked fine. It turns out gpsd doesn’t read the serial signals directly but tries to use the kernel’s pps_ldisc driver which only supports DCD. Lame.

Everything Else

With the board hooked up and tested I added two mounting brackets and insulated the inside with hot glue.

Screw on the top, and we’re ready to set up the software side of things.

Double-check

It’s worth running gpsmon /dev/ttyUSB0 to ensure everything (including PPS) is working before getting gpsd running. It should look something like this:

┌──────────────────────────────────────────────────────────────────────────────┐
│Time: 2025-09-26T01:57:18.000Z   Lat: YY ZZ.046970' N   Lon:  ZZ XX.045530' W │
└───────────────────────────────── Cooked TPV ─────────────────────────────────┘
┌──────────────────────────────────────────────────────────────────────────────┐
│ GPRMC GPVTG GPGGA GPGSA GPGSV GPGLL                                          │
└───────────────────────────────── Sentences ──────────────────────────────────┘
┌───────────────────────┌─────────────────────────┌────────────────────────────┐
│ SVID  PRN  Az El SN HU│Time:     015718.00	  │Time:      015718.00        │
│GP  2    2 101 30 26  Y│Latitude:   XXXX.04697 N │Latitude:  XXXX.04697       │
│GP  7    7 113 81 29  Y│Longitude: YYYYY.04553 W │Longitude: YYYYY.04553      │
│GP  8    8  75 48 41  Y│Speed:    0.223          │Altitude:  267.9            │
│GP 27   27  22 17 33  Y│Course:                  │Quality:   1   Sats: 05     │
│GP 30   30 156 65 30  Y│Status:   A        FAA:A │HDOP:      2.42             │
│GP  9    9  67 15 25  N│MagVar:                  │Geoid:     -30.9            │
│                       └───────── RMC ───────────└─────────── GGA ────────────┘
│                       ┌─────────────────────────┌────────────────────────────┐
│                       │Mode: A3 Sats: 2 7 8 27 +│UTC:           RMS:         │
│                       │DOP H=2.42 V=3.44 P=4.21 │MAJ:           MIN:         │
│                       │TOFF: -1.280474680       │ORI:           LAT:         │
│                       │PPS: -1.412210534        │LON:           ALT:         │
└──────── GSV ──────────└────── GSA + PPS ────────└─────────── GST ────────────┘

gpsmon talks directly to the device so it will read PPS on more RS-232 control signals than the kernel’s PPS driver supports. Just something to watch out for in case gpsmon shows PPS but gpsd doesn’t.

gpsd

On the software side the GPS module is managed by gpsd, which autodetects vendor quirks and (as long as you’re using DCD for PPS) configures the kernel’s PPS device for you.

My simple Fedora gpsd config gets written to /etc/sysconfig/gpsd but other distros use /etc/default/gpsd.

# Options for gpsd, including serial devices
OPTIONS="-n"
DEVICES="/dev/ttyUSB0"
# Set to 'true' to add USB devices automatically via udev
USBAUTO="true"

Later I’ll be replacing the /dev/ttyUSB0 device path with a more permanent one since there will eventually be 10+ modems connected and USB device names are notoriously unstable.

Now I can start gpsd:

systemctl start gpsd

and double-check one last time by running gpsmon again, but this time without arguments since it will automatically use data from the running gpsd.

chrony

Now that I have GPS up and running it’s time for NTP, which was the whole point of this exercise. gpsd writes location and timing data from GPS receivers to a well-known Shared Memory (SHM) segment that other daemons like ntpd or chrony read. I’m going to use chrony.

Here’s my minimal /etc/chrony.conf:

# Record the rate at which the system clock gains/losses time.
driftfile /var/lib/chrony/drift

# Allow the system clock to be stepped in the first three updates
# if its offset is larger than 1 second.
makestep 1.0 3

# Enable kernel synchronization of the real-time clock (RTC).
rtcsync

# Allow NTP client access from local network.
allow all

# Serve time even if not synchronized to a time source.
local stratum 1

# Set the TAI-UTC offset of the system clock.
leapseclist /usr/share/zoneinfo/leap-seconds.list

# Specify directory for log files.
logdir /var/log/chrony

# Listen to gpsd for reference time
refclock SHM 0 refid GPS precision 1e-1 offset 0.0
refclock SHM 1 refid PPS precision 1e-7

The important bits are the “allow all“, “local stratum 1“, and both “refclock” lines. The NTP server will be on an isolated network so I don’t care much about limiting access by source IP. The local stratum 1 ensures that NTP clients see the server as high-precision (which it is!). The refclock lines are what tells chrony to get timing information from gpsd for both GPS time and PPS high precision adjustment. The SHM 0 and SHM 1 are gpsd‘s predefined shared memory segments for GPS and PPS info, respectively. Eventually I’ll do some tests and figure out better timing offsets, but not today.

Now I can start chronyd:

systemctl start chronyd

and double-check that it’s working and synced to GPS by running chronyc sources a couple times until it’s synced up:

$ chronyc sources
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
#x GPS                           0   4   177    14    +81ms[  +81ms] +/-  100ms
#x PPS                           0   4   177    16    -35ms[  -35ms] +/-   98us

and finally double-check by sending an NTP request to the server:

$ ntpcheck utils ntpdate -s localhost

Server: localhost:123, Stratum: 1, Requests 3
Last Request:Offset: 0.000000s (0us) | Delay: 0.000058s (58us)
Correct Time is 2025-10-02 19:29:15.287043328 -0500 CDT

Average (3 requests):
Offset: 0.000015s (15us) | Delay: 0.000094s (94us)

And now I’m done! Time to point my base stations to this chronyd.

I’ll be piping the FWFF’s Band 2 LTE signals into the Willtek later, but that requires getting the RF signals out of the Nokia. How do we do that? SMA pigtails, of course. But first I have to open up some mounting holes. Luckily Nokia did the hard work by milling holes into the aluminum chassis already, and all we have to do is remove some of the heavy-duty faceplate label:

Now that I’ve got somewhere to mount the pigtails let’s take a look inside. I’ve circled the U.FL connectors on the RF card that I’ll be replacing. The internal antennas are printed onto PCBs that you can see at the bottom of the picture as a thin gray line that the black ANT2 cable leads to. I’m going to leave those in place since they’re taped into the unit.

I carefully inserted the SMA connectors through the holes, tightened the retaining bolts and routed the cables back over the RF card’s heatsink to the antenna connectors. Then since we’re not removing the internal antennas, and because I don’t have any Kapton tape, I tucked the old antenna cables into the heatsink to hold them in place.

Last thing to do is put the case back on, and we’ve successfully converted our Nokia Flexi Zone Pico BTS FWFF into an FWFG!

It’s already commissioned to be part of my LTE lab network, but I’m waiting on putting together a local GPS-synced NTP server since all my eNBs want one, and the Nokia won’t enable the radios until it has one. (Thanks to Alexander Couzens/@lynxis for that suggestion…)