Huawei E398 4G/LTE USB-modem - IPCP fails under pppd 2.4.5

Huawei E398 4G/LTE USB-modem - IPCP fails under pppd 2.4.5

[Tomas Lund]

I have a Huawei E398 4G/LTE USB-modem where IPCP fails under pppd 2.4.5 
but works in Windows.

Under linux, this is what happens:

Mar 18 12:16:04 localhost pppd[18558]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x8591b3b5> <pcomp> <accomp>]
Mar 18 12:16:04 localhost pppd[18558]: rcvd [LCP ConfReq id=0x0 <asyncmap 0x0> <auth chap MD5> <magic 0x2b18e0e> <pcomp> <accomp>]
Mar 18 12:16:04 localhost pppd[18558]: sent [LCP ConfAck id=0x0 <asyncmap 0x0> <auth chap MD5> <magic 0x2b18e0e> <pcomp> <accomp>]
Mar 18 12:16:04 localhost pppd[18558]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x8591b3b5> <pcomp> <accomp>]
Mar 18 12:16:04 localhost pppd[18558]: sent [LCP EchoReq id=0x0 magic=0x8591b3b5]
Mar 18 12:16:04 localhost pppd[18558]: rcvd [LCP DiscReq id=0x1 magic=0x2b18e0e]
Mar 18 12:16:04 localhost pppd[18558]: rcvd [CHAP Challenge id=0x1 <26c7ca167a9bd85a2e95c7424221133d>, name = "UMTS_CHAP_SRVR"]
Mar 18 12:16:04 localhost pppd[18558]: sent [CHAP Response id=0x1 <eed8ef3a56256e7f149dc27eff078935>, name = "wap"]
Mar 18 12:16:04 localhost pppd[18558]: rcvd [LCP EchoRep id=0x0 magic=0x2b18e0e 85 91 b3 b5]
Mar 18 12:16:04 localhost pppd[18558]: rcvd [CHAP Success id=0x1 ""]
Mar 18 12:16:04 localhost pppd[18558]: CHAP authentication succeeded
Mar 18 12:16:04 localhost pppd[18558]: CHAP authentication succeeded
Mar 18 12:16:04 localhost pppd[18558]: sent [IPCP ConfReq id=0x1 <addr 0.0.0.0>]
Mar 18 12:16:05 localhost pppd[18558]: rcvd [IPCP ConfNak id=0x1]
Mar 18 12:16:05 localhost pppd[18558]: sent [IPCP ConfReq id=0x2 <addr 0.0.0.0>]
Mar 18 12:16:06 localhost pppd[18558]: rcvd [IPCP ConfNak id=0x2]
Mar 18 12:16:06 localhost pppd[18558]: sent [IPCP ConfReq id=0x3 <addr 0.0.0.0>]
Mar 18 12:16:07 localhost pppd[18558]: rcvd [IPCP ConfNak id=0x3]
Mar 18 12:16:07 localhost pppd[18558]: sent [IPCP ConfReq id=0x4 <addr 0.0.0.0>]
Mar 18 12:16:08 localhost pppd[18558]: rcvd [IPCP ConfNak id=0x4]
(and this just repeats)

In windows, I am running the application that comes with the modem to 
connect, and I have collected a sniff of the serial port between the modem 
and windows where IPCP works and posted it at 
http://tlund.pp.se/ppp/windows_ppp_sniff.txt

I suspect that Huawei PPP/IPCP implementation in the modem requires it to 
be done JUST the way that their application does it, instead of just 
following the relevant RFC:s.

I am willing to provide any additional details that might be needed, do 
additional sniffing and try any patches or config changes you might have.

Best regards,
Tomas

Re: Huawei E398 4G/LTE USB-modem - IPCP fails under pppd 2.4.5

[James Carlson]

Tomas Lund wrote:
> I have a Huawei E398 4G/LTE USB-modem where IPCP fails under pppd 2.4.5
> but works in Windows.

Ah, 4G.  That's difficult.

> Mar 18 12:16:04 localhost pppd[18558]: sent [IPCP ConfReq id=0x1 <addr
> 0.0.0.0>]
> Mar 18 12:16:05 localhost pppd[18558]: rcvd [IPCP ConfNak id=0x1]

Typically, with 4G-type devices, this means that either the
authentication failed or that the phone isn't properly registered with
the network.

What happens here (and it's really just cell-phone brain-damage; nobody
else does it this way) is that the PPP server you're talking to sends
back a fake "success" message regardless of what credentials you offer,
and it delays actually doing the authentication work until you start IPCP.

When you start IPCP, the PPP server sends your credentials to a central
system that either responds with the IP address you should use, which
the PPP server then sends back to you.  If authentication fails, though,
the PPP server wigs out (I think that's the technical term ;-}) and
starts sending garbage.

Some of these systems will send back a bogus, unusable "default" IP
address.  Some will hang up the call.  Some will terminate LCP or IPCP.
 It seems that this one sends a thoroughly bogus IPCP Configuration-Nak
that lacks any options.

I guess once you walk away from one part of the standard as written, you
might as well go completely nuts.  ;-}

Anyway, check your configured user name / passphrase.  Make sure that
any special characters in the passphrase are escaped properly.

> In windows, I am running the application that comes with the modem to
> connect, and I have collected a sniff of the serial port between the
> modem and windows where IPCP works and posted it at
> http://tlund.pp.se/ppp/windows_ppp_sniff.txt

That shows a blank (!) user name being sent.

> I suspect that Huawei PPP/IPCP implementation in the modem requires it
> to be done JUST the way that their application does it, instead of just
> following the relevant RFC:s.

Possibly so.  It may require some experimentation to figure out just
what it wants to see.

> I am willing to provide any additional details that might be needed, do
> additional sniffing and try any patches or config changes you might have.

Try using this:

	user ""

and adjust /etc/ppp/chap-secrets to match.

That seems to be what the peer wants.  If that doesn't work, someone
with access to the hardware (possibly you) will have to tinker around
with the code to see what might work.

I doubt it's something that could be done effectively at a distance.  I
probably don't have the time to do it, but perhaps someone else on the
list does ...

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>

Re: Huawei E398 4G/LTE USB-modem - IPCP fails under pppd 2.4.5

[Tomas Lund]

On Fri, 18 Mar 2011, James Carlson wrote:

> Ah, 4G. That's difficult.

The difference between how PS works in 2G/3G/4G is not really that big, 
its mostly the name of the boxes and the interfaces that change :)

> Typically, with 4G-type devices, this means that either the 
> authentication failed or that the phone isn't properly registered with 
> the network.

Autentication is disabled in the network and you should be able to send 
anything you want. Access is allowed by the MME and the PGW based on the 
IMSI and configuration made in the HSS.

>> In windows, I am running the application that comes with the modem to 
>> connect, and I have collected a sniff of the serial port between the 
>> modem and windows where IPCP works and posted it at 
>> http://tlund.pp.se/ppp/windows_ppp_sniff.txt
>
> That shows a blank (!) user name being sent.
>
>> I suspect that Huawei PPP/IPCP implementation in the modem requires it 
>> to be done JUST the way that their application does it, instead of just 
>> following the relevant RFC:s.
>
> Possibly so.  It may require some experimentation to figure out just 
> what it wants to see.

I was hoping it should be possible to figure out exactly what the Huawei 
windows application does differently from what pppd does based on my 
sniff. :)

>> I am willing to provide any additional details that might be needed, do 
>> additional sniffing and try any patches or config changes you might 
>> have.
>
> Try using this:
>
> 	user ""
>
> and adjust /etc/ppp/chap-secrets to match.

I tried that, and it made no difference. I also went back to the windows 
box and entered a username/password to see what happened, and it made no 
difference there either.

However, after moving it back to the linux box again, I found someting 
curious! The defined PDP-contexts in the modem (as shown by AT+CGDCONT?) 
was all empty! (possibly removed by doing AT&F, not verified yet)

In my chat-script I always overwrite the APN-name based on what IMSI the 
SIM-card has (i use alot of different dongles and SIM-cards and move them 
around alot), so .. just on a whim, I quickly edited the script not to do 
this, and just go ahead and sedn ATDT*99# anyways, without an APN set.

Success!

I do not yet understand why or how, but this magically worked. :)

I am going to sniff the control-plane of the MME and the SGW to see what 
actually happens in the PDP set-up signaling.

Best regards,
Tomas

Re: Huawei E398 4G/LTE USB-modem - IPCP fails under pppd 2.4.5

[James Carlson]

On 3/20/2011 7:23 AM, Tomas Lund wrote:
> However, after moving it back to the linux box again, I found someting
> curious! The defined PDP-contexts in the modem (as shown by AT+CGDCONT?)
> was all empty! (possibly removed by doing AT&F, not verified yet)
> 
> In my chat-script I always overwrite the APN-name based on what IMSI the
> SIM-card has (i use alot of different dongles and SIM-cards and move
> them around alot), so .. just on a whim, I quickly edited the script not
> to do this, and just go ahead and sedn ATDT*99# anyways, without an APN
> set.
> 
> Success!
> 
> I do not yet understand why or how, but this magically worked. :)

That doesn't surprise me much.  Yes, the special AT commands that do
connection set-up are crucial for the device.  And it sounds like the
problem you had was some sort of network registration issue.

You might want to search around for a programmer's reference for the
modem.  If there is one available, it may provide debug commands that
you could use to get status information and find out why setting the APN
causes trouble.  Maybe.  ;-}

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>