What AT commands are required to register an IoT modem on Verizon? - iot

I'm trying to troubleshoot a wireless modem that contains a Sierra MC73xx module. Also, my SIM is from an MVNO that says it has enabled roaming on Verizon.
I run AT+COPS=? and can see the Verizon network:
+COPS: (0,"T-Mobile","T-Mobile","310260",2),(0,"Verizon","Verizon","311480",7),(0,"T-Mobile","T-Mobile","310260",0),(0,"AT&T","AT&T","310410",7),(0,"AT&T","AT&T","310410",2),(0,"T-Mobile","T-Mobile","310260",7),,(0,1,2,3,4),(0,1,2)
However when I run AT+COPS=1,2,311480 I can't seem to register on the network.
Are there other AT commands required to register a roaming SIM on the Verizon network? BTW through testing I've been able to register on T-Mobile and AT&T.

In the PLMN scan result, there is only one Verizon network,
(0,"Verizon","Verizon","311480",7). "7" indicates the radio access technology(RAT) and I remember 7 is LTE.
On the other hand, both AT&T and T-Mobile has 2G/3G coverage, i.e. RAT 0 and 2. In your successful registration, you probably see the RAT is 0 or 2. You can use at!gstatus to check RAT.
I suspect your SIM card cannot roaming in Verizon LTE network. Usually international roaming agreement does not cover LTE.

The other thing you can check is if this carrier is in your SIM's forbidden list. This can happen if your device tries to connect to a network and is denied.
For clearing this list, see here for instructions.

Verizon (nowadays, as of this response) is very particular about which modems may register to its towers. Verizon certifies cellular modules before they're allowed to register and maintains a list of authorized IMEIs.
If your module's IMEI isn't on that list, it's not going to work.
Even using a Verizon SIM card on a Verizon-certified device, I couldn't connect one time. I had to call Verizon and give them the expected IMEI for that SIM's ICCID so the tower knew what to expect ahead of time. Then it worked.
I suppose that trying to connect through an agreement with an MVNO they wouldn't have you call Verizon and explicitly tell them the IMEI, but it would still need to be in an expected range of IMEIs that Verizon expects.
Verizon does this to assure that customers will have a consistent experience on their network as their LTE system uses frequencies (bands) that other carriers do not; they "certify" modules submitted to them by the manufacturers - give them a stamp of approval - the module has demonstrated the ability to operate according to Verizon's specifications.

Related

ESP32 iPhone Bluetooth, just a general question

I'm writing some code (C++) for ESP32, to act as a BLE beacon. The problem is this: the iPhone doesn't send out its real MAC address, but does a random-generated MAC address, for security. The thing I'm confused about is how do you know if it's a device you've previously paired with?
So let's say I detect a new BLE MAC address, and looking at the manufacturer data I can determine it's an Apple device (first 2 bytes are "4C").
Now I need to know if I've previously paired with that device, so that I can allow the ESP32 to initiate an action (for simplicity let's just say turn on an LED). If that MAC address is in a list of known devices, then I can continue, and if not, I ignore it.
The problem is, if the iPhone is not giving up the real MAC address, the detected MAC address will never match anything. As this is a security situation I'm sure the algorithm for generating those MAC addresses is not known.
To be clear: this code is being written for the ESP32, not the iPhone.
It is in fact not possible to tell if a device has been previously seen, unless you pair and establish a bond with it. Once you pair with the device, long-term keys are exchanged and are used to quickly re-establish the connection.
This is by design. MAC addresses were originally unique, but this allowed tracking people and devices without their consent. You can read more about this in the following ESP-IDF guides:
GATT security server walkthrough
GATT security client walkthrough
So are you using esp32 as a beacon? This dose not involve any pairing or iOS MAC addresses. iOS will just be able to listen and the esp32 will not even know someone is "listening" to its broadcast.
Probably iOS application can store which services it is interested to hear to; may looks like pairing.. but it is a high level application managed technique and not any related to what BT standard calls pairing.

How to obtain carrier profile for iOS devices

I am currently experimenting setting up an MVNO - I have the SIMs provided by my host network (from a reseller) and they work as expected on Android devices, but iOS devices considers my SIMs as the host network's ones, and installs their profile.
The issue is that some features (personal hotspot) are restricted on their profile based on their customer-facing terms and conditions, which do not apply to me as I am billed for data by the megabyte and am free to use it as I wish. Some critical features like VoLTE, WiFi Calling and visual voicemail do not work at all as I can't tell the device to use my servers instead of the host carrier's.
I've tried contacting Apple Developer support who referred me to an irrelevant support article, and there's zero public documentation about this. I've also gotten in touch with wwwmarcom#apple.com but have yet to receive any reply and it's been 3 days. The reseller can't help and the host network themselves probably wouldn't care unless this is a million-dollar deal which obviously it isn't (at least not yet).

Is GSM data sending between 2 phones impossible?

Please tell me in detail why it is impossible to send the data between two phones over GSM? I can find almost no information about this problem.
There are 2 points here.
Firstly, GSM is a mobile voice telephony system - plain GSM doesn't do data connections.
GPRS and EDGE are add-ons to the GSM network that allow data to be sent.
There are other kinds of wireless phone networks that also use a SIM and allow data to be sent (UMTS, LTE).
Secondly, when you establish a data connection with a mobile phone and a phone network, you are establishing an IP connection between your phone/modem and a gateway server in the operator's network. The gateway server allows you access to the internet (together with the DNS server etc, obviously).
This is similar to a computer plugging in a LAN cable and connecting to their ISP. But you can also connect 2 computers with a crossover cable, and configure them to have an IP connection directly. So what you are asking is, why can't I do the same with 2 GSM phones? what is the equivalent of a wireless crossover cable?
The reason is because GSM has no protocol to connect phones to each other. It only defines a protocol for phones to connect to a network base station.
To transfer data between 2 phones, therefore, you need a different protocol, one which will work between 2 peers. Bluetooth is a common such protocol, but it only works over short distances.
If you want to connect 2 distant phones, you can do this via a third party, like a website, to which data can be uploaded into the cloud by the first phone and downloaded by the second phone.
Or, you could establish a connection at the IP level via the internet, e.g. if one mobile device was a web server (the last sentence is only theorising).
See also this related question
EDIT: 3GPP Release 12 includes direct Device to Device communications. At the time of writing, it's still very new, and not yet commercially available, so the answer above still holds. D2D is designed for emergency services, eg if the network is damaged by a disaster, they can still communicate directly. But 3GPP suggests that it will be commercially available as well. From 3GPP news
There are also commercial benefits of D2D, with new applications building on the physical proximity of users being trialed by operators.
2nd EDIT: Apple has created a feature called Multipeer Connectivity Framework, which uses a mixture of WiFi networks, peer-to-peer WiFi and Bluetooth to enable short distance connectivity between iPhones when there is no GSM network.
NFC is another peer-to-peer technology for communicating between 2 devices, that is supported by some phones. More information here.

How does the My Verizon Mobile app know the device phone number?

I just installed the My Verizon Mobile app onto an iPhone and upon launch it was immediately able to display the device's phone number - something which is not possible for regular apps to do.
Does anybody know how it does it, could it be one of these, or something else?
As the app is from Verizon, Apple has granted it permission to access private iOS APIs to obtain the phone number
The App makes an HTTP connection to a Verizon server which goes through a gateway which is able to detect the phone number and sends it back to the device in the HTTP response.
These are just my guesses as to what perhaps could be happening, does anybody know what actually is happening?
If you go to Settings/General/About, you'll find an IMEI number and an ICCID number. The IMEI number identifies the phone, the ICCID number identifies the SIM card. If you have a Verizon phone account, then Verizon would have associated that ICCID number with a phone number. They must be able to do that, because otherwise how could Verizon ring your phone if I dial your number?
So what happens is Verizon using their own data, which they must have for your phone to function properly, to find the phone number associated with your SIM card. This should only work for Verizon phones (other phone companies should be able to find your phone number if you have a contract with them, but not if you are with Verizon).
By the way, if you go to Settings/Phone, the first thing my iPhone shows is "My Number".
The Verizon Mobile app, at least for android, carries special code apps in the rom. You cna verify this by taking a Verizon Galaxy Nexus and applying an alternate rom to it such as CM10. Without the special "carrier blobs" in the rom, Verizon "specialized apps", don't work.
This is not a bug per se -- non Verizon roms lack the special "carrier bits" but also like the carrier apps many people don't want on their Nexi. The reason you have no "auto login" on iPhones is because this carrier "app" doesn't exist in the Apple roms.

any way to detect iPads or iPhones on wireless network? bonjour?

I am trying to detect Apple devices connected to a wireless network. This is relatively simple using Bonjour, however I am also trying to detect what kind of device it is. Like, a MacBook Air, a MacBook Pro, a MacPro, an iPhone, iPod, or an iPad.
I have found that Bonjour requests to MacBook's and MacPros include an "ADDITIONAL SECTION" response to the query which includes the model:
;; ADDITIONAL SECTION:
Q9550._device-info._tcp.local. 10 IN TXT "model=MacPro3,1"
and
;; ADDITIONAL SECTION:
Air._device-info._tcp.local. 10 IN TXT "model=MacBookAir4,2"
From testing an iPhone (3GS and 4), an iPod touch, and an iPad2, all of the iDevices only respond with their name:
;; ANSWER SECTION:
111.1.168.192.in-addr.arpa. 10 IN PTR gmPad2.local.
Clearly, the name may not reflect the device. So, I would not like to try to extrapolate the type of device from the name. Does anyone know any other ways to detect iDevice types?
Edit: just to be clear, the command I am using is: dig #224.0.0.251 -p5353 -x 192.168.1.111 ... substituting the IP address of the Apple device
Use port 62078
The most reliable indicator I have seen is whether you can connect to IP port 62078.
Port 62078 is used for the "iphone-sync" service, and I don't think MacBooks use it. This port always appears to be open for the iPhones and iPads on our (very small) network.
Possibly (but not probably) there are messages you can send to the port to sniff out more details...
I think the official xml list of port assignements is here, although it wasn't working for me just now:
http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml
MAC address
In theory the MAC addresses might help - but probably not much use unless you can find somewhere that maintains a reliable list of ranges (e.g. a network security firm, or hardware provider). MAC addresses do depend on the actual chips used (or a flashed MAC). The database is at the organisation level (although organisations sometimes choose to use specific ranges for specific devices).
http://standards.ieee.org/develop/regauth/oui/public.html allows you to download the database of "Organizationally Unique Identifiers", or you can look up "Apple", or the first three bytes of a MAC address e.g. 00264A.
Anecdotally, the MAC lookup doesn't work... First three digits of my iPad MAC are 28-68-BA and that comes up with nothing.
User agent
Probably not useful, but if you can watch the network traffic or have an http proxy, then the user-agent string could help (see http://developer.apple.com/library/IOS/documentation/AppleApplications/Reference/SafariWebContent/OptimizingforSafarioniPhone/OptimizingforSafarioniPhone.html#//apple_ref/doc/uid/TP40006517-SW3).
Edit (added):
Appleā€™s Bonjour protocol relies on Multicast DNS (mDNS) operating at UDP port 5353 and sends to these reserved group addresses: IPv4 Group Address - 224.0.0.251, IPv6 Group Address - FF02::FB - reference.
This would help get push notification when Apple devices connect to a local network (link-local) by listening for multicast messages on 5353 UDP. Perhaps sniff the packet and see if it has any extra information in it :)
Although I presume that Bonjour API also allows for seeing this...
You can also use the airport utility to do this manually :
1) open AirportUtility
2) Go to "Wireless Clients" (hover mouse by the arrow and click it)
3) Go to DHCP Clients, and you will see iPad,iPhone, computer name, etc.... as the Client ID column.

Resources