From 99a08fb4599ca05bba6e9568586278a5f447bc6e Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <neels@hofmeyr.de>
Date: Mon, 29 Aug 2022 01:44:12 +0200
Subject: [PATCH] add virt-nitb: a fully virtual network with 2 MS

Change-Id: I31cf24006ea9ceb83622aedef22046c53db90142
---
 .gitignore                          |   8 ++
 virt-nitb/README                    |  40 ++++++++
 virt-nitb/call.sh                   |   4 +
 virt-nitb/create_hlr_subscribers.sh |  20 ++++
 virt-nitb/hangup.sh                 |   3 +
 virt-nitb/mobile.cfg                | 151 +++++++++++++++-------------
 virt-nitb/mobile2.cfg               | 110 ++++++++++++++++++++
 virt-nitb/osmo-bsc.cfg              | 105 ++++---------------
 virt-nitb/osmo-bts-virtual.cfg      |  84 ++++++----------
 virt-nitb/osmo-hlr.cfg              |  13 +++
 virt-nitb/osmo-mgw-for-bsc.cfg      |  10 +-
 virt-nitb/osmo-mgw-for-msc.cfg      |  10 +-
 virt-nitb/osmo-msc.cfg              |  12 +--
 virt-nitb/osmo-stp.cfg              |   8 +-
 virt-nitb/run.sh                    | 126 +++++++++--------------
 15 files changed, 393 insertions(+), 311 deletions(-)
 create mode 100644 virt-nitb/README
 create mode 100755 virt-nitb/call.sh
 create mode 100755 virt-nitb/create_hlr_subscribers.sh
 create mode 100755 virt-nitb/hangup.sh
 create mode 100644 virt-nitb/mobile2.cfg

diff --git a/.gitignore b/.gitignore
index 61d0fcf..3b70a48 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,11 @@ ttcn3/out/
 ttcn3/make/
 ttcn3/.run.sh
 ttcn3/usr_local
+current_log
+lastlog
+autolog
+*.db
+*.db-shm
+*.db-wal
+# log file created by udtrace
+virt-nitb/osmo-msc.log
diff --git a/virt-nitb/README b/virt-nitb/README
new file mode 100644
index 0000000..d9fbb65
--- /dev/null
+++ b/virt-nitb/README
@@ -0,0 +1,40 @@
+This is runs a complete core network with a virtual 2G BTS and two virtual 2G phones.
+
+Steps:
+
+- build osmocom-bb
+    git clone https://git.osmocom.org/osmocom-bb
+    cd osmocom-bb/src
+    make nofirmware
+    cd ../..
+  Put programs virtphy and mobile in $PATH, e.g.
+    ln -s $PWD/osmocom-bb/src/host/virt_phy/src/virtphy ~/bin/
+    ln -s $PWD/osmocom-bb/src/host/layer23/src/mobile/mobile ~/bin/
+
+- also have these programs available in $PATH:
+  - osmo-hlr
+  - osmo-msc
+  - osmo-mgw
+  - osmo-stp
+  - osmo-bsc
+  - osmo-bts-virtual (from osmo-bts)
+  - did i miss one?
+
+- prepare HLR db; call this while no other osmo-hlr is running:
+    ./create_hlr_subscribers.sh
+
+- use run.sh to launch N terminals with one component each:
+    ./run.sh
+  when you hit enter in this terminal, the entire network is torn down. (so continue in another terminal)
+  - of course you can instead launch the ten-odd components manually...
+
+- Two virtual phones should subscribe to the network as soon as the two 'mobile' are launched.
+  Watch for 'bssap': "Location Updating Accept" with wireshark tracing 'lo'
+
+- Launch (the signalling of) a voice call:
+    ./call.sh
+    ...
+    ./hangup.sh
+  There will be no voice RTP stream, but the MGWs will be set up for it and the call will remain open.
+
+- ...
diff --git a/virt-nitb/call.sh b/virt-nitb/call.sh
new file mode 100755
index 0000000..e21dd7b
--- /dev/null
+++ b/virt-nitb/call.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+osmo_interact_vty.py -H 127.0.0.1 -p 4247 -c "enable;call 1 2"
+sleep 5
+osmo_interact_vty.py -H 127.0.0.2 -p 4247 -c "enable;call 2 answer"
diff --git a/virt-nitb/create_hlr_subscribers.sh b/virt-nitb/create_hlr_subscribers.sh
new file mode 100755
index 0000000..d73b999
--- /dev/null
+++ b/virt-nitb/create_hlr_subscribers.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+set -x -e
+
+touch empty
+osmo-hlr -c empty &
+sleep 1
+
+osmo_interact_vty.py -H 127.0.0.1 -p 4258 -c "enable
+subscriber imsi 901700000000001 create
+subscriber imsi 901700000000001 update aud2g comp128v1 ki 11111111111111111111111111111111
+subscriber imsi 901700000000001 update msisdn 1
+
+subscriber imsi 901700000000002 create
+subscriber imsi 901700000000002 update aud2g comp128v1 ki 22222222222222222222222222222222
+subscriber imsi 901700000000002 update msisdn 2
+
+show subscribers all
+"
+kill %1
+rm empty
diff --git a/virt-nitb/hangup.sh b/virt-nitb/hangup.sh
new file mode 100755
index 0000000..7f68eb8
--- /dev/null
+++ b/virt-nitb/hangup.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+osmo_interact_vty.py -H 127.0.0.1 -p 4247 -c "enable;call 1 hangup"
+
diff --git a/virt-nitb/mobile.cfg b/virt-nitb/mobile.cfg
index 7aa8e35..5277109 100644
--- a/virt-nitb/mobile.cfg
+++ b/virt-nitb/mobile.cfg
@@ -1,12 +1,87 @@
-log stderr
+ms 1
+ layer2-socket /tmp/osmocom_l2
+ sap-socket /tmp/osmocom_sap
+ sim test
+ test-sim
+  imsi 901700000000001
+  ki comp128 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11
+  no barred-access
+  rplmn 901 70
+  hplmn-search everywhere
+ no shutdown
+
+log file current_log/mobile1.log
  logging filter all 1
- logging print file basename
- logging print category-hex 0
- logging print category 1
- logging print level 1
- logging timestamp 0
  logging color 1
- !
+ logging print level 1
+ logging print category 1
+ logging print category-hex 0
+ logging print file basename last
+ logging print extended-timestamp 1
+ logging level set-all notice
+ logging level lglobal info
+ logging level lsms info
+ logging level rsl notice
+ logging level rr debug
+ logging level plmn debug
+ logging level cs debug
+ logging level nb notice
+ logging level mm debug
+ logging level cc debug
+ logging level ss debug
+ logging level sms debug
+ logging level mncc debug
+ logging level meas debug
+ logging level pag debug
+ logging level l1c error
+ logging level sap debug
+ logging level sum debug
+ logging level sim debug
+ logging level gps debug
+ logging level mob debug
+ logging level prim debug
+ logging level lua debug
+
+log stderr
+ logging filter all 1
+ logging color 1
+ logging print level 1
+ logging print category 1
+ logging print category-hex 0
+ logging print file basename last
+ logging print extended-timestamp 1
+ logging level set-all notice
+ logging level lglobal info
+ logging level lsms info
+ logging level rsl notice
+ logging level rr debug
+ logging level plmn debug
+ logging level cs debug
+ logging level nb notice
+ logging level mm debug
+ logging level cc debug
+ logging level ss debug
+ logging level sms debug
+ logging level mncc debug
+ logging level meas debug
+ logging level pag debug
+ logging level l1c error
+ logging level sap debug
+ logging level sum debug
+ logging level sim debug
+ logging level gps debug
+ logging level mob debug
+ logging level prim debug
+ logging level lua debug
+
+log gsmtap 127.0.0.12
+ logging filter all 1
+ logging color 1
+ logging print level 1
+ logging print category 1
+ logging print category-hex 0
+ logging print file basename last
+ logging print extended-timestamp 1
  logging level set-all notice
  logging level lglobal info
  logging level lsms info
@@ -30,65 +105,3 @@ log stderr
  logging level mob debug
  logging level prim debug
  logging level lua debug
-!
-line vty
- no login
-!
-!gps host localhost:2947
-!gps device /dev/ttyACM0
-!gps baudrate default
-no gps enable
-!
-no hide-default
-!
-ms 1
- layer2-socket /tmp/osmocom_l2.mobile
- sap-socket /tmp/osmocom_sap
- sim test
- network-selection-mode auto
- imei 350608603062429 0
- imei-fixed
- no emergency-imsi
-! sms-service-center +491722270333
- no call-waiting
- no auto-answer
- no force-rekey
- no clip
- no clir
- tx-power auto
- no simulated-delay
-! stick 791
- location-updating
- no neighbour-measurement
- codec full-speed prefer
- codec half-speed
- no abbrev
- support
-  sms
-  a5/1
-  no a5/2
-  p-gsm
-  e-gsm
-  r-gsm
-  no gsm-850
-  dcs
-  no pcs
-  class-900 4
-  class-850 4
-  class-dcs 1
-  class-pcs 1
-  channel-capability sdcch+tchf
-  full-speech-v1
-  full-speech-v2
-  half-speech-v1
-  min-rxlev -106
-  dsc-max 90
-  no skip-max-per-band
- test-sim
-  imsi 901700000000001
-  ki comp128 ca 7c 00 11 22 33 44 55 66 77 88 99 aa bb cc dd
-  no barred-access
-  rplmn 901 70
-  hplmn-search everywhere
- c7-any-timeout 30
- no shutdown
diff --git a/virt-nitb/mobile2.cfg b/virt-nitb/mobile2.cfg
new file mode 100644
index 0000000..c773131
--- /dev/null
+++ b/virt-nitb/mobile2.cfg
@@ -0,0 +1,110 @@
+line vty
+ bind 127.0.0.2
+
+ms 2
+ layer2-socket /tmp/osmocom_l2
+ sap-socket /tmp/osmocom_sap
+ sim test
+ test-sim
+  imsi 901700000000002
+  ki comp128 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22
+  no barred-access
+  rplmn 901 70
+  hplmn-search everywhere
+ no shutdown
+
+log file current_log/mobile2.log
+ logging filter all 1
+ logging color 1
+ logging print level 1
+ logging print category 1
+ logging print category-hex 0
+ logging print file basename last
+ logging print extended-timestamp 1
+ logging level set-all notice
+ logging level lglobal info
+ logging level lsms info
+ logging level rsl notice
+ logging level rr debug
+ logging level plmn debug
+ logging level cs debug
+ logging level nb notice
+ logging level mm debug
+ logging level cc debug
+ logging level ss debug
+ logging level sms debug
+ logging level mncc debug
+ logging level meas debug
+ logging level pag debug
+ logging level l1c error
+ logging level sap debug
+ logging level sum debug
+ logging level sim debug
+ logging level gps debug
+ logging level mob debug
+ logging level prim debug
+ logging level lua debug
+
+log stderr
+ logging filter all 1
+ logging color 1
+ logging print level 1
+ logging print category 1
+ logging print category-hex 0
+ logging print file basename last
+ logging print extended-timestamp 1
+ logging level set-all notice
+ logging level lglobal info
+ logging level lsms info
+ logging level rsl notice
+ logging level rr debug
+ logging level plmn debug
+ logging level cs debug
+ logging level nb notice
+ logging level mm debug
+ logging level cc debug
+ logging level ss debug
+ logging level sms debug
+ logging level mncc debug
+ logging level meas debug
+ logging level pag debug
+ logging level l1c error
+ logging level sap debug
+ logging level sum debug
+ logging level sim debug
+ logging level gps debug
+ logging level mob debug
+ logging level prim debug
+ logging level lua debug
+
+log gsmtap 127.0.0.11
+ logging filter all 1
+ logging color 1
+ logging print level 1
+ logging print category 1
+ logging print category-hex 0
+ logging print file basename last
+ logging print extended-timestamp 1
+ logging level set-all notice
+ logging level lglobal info
+ logging level lsms info
+ logging level rsl notice
+ logging level rr debug
+ logging level plmn debug
+ logging level cs debug
+ logging level nb notice
+ logging level mm debug
+ logging level cc debug
+ logging level ss debug
+ logging level sms debug
+ logging level mncc debug
+ logging level meas debug
+ logging level pag debug
+ logging level l1c error
+ logging level sap debug
+ logging level sum debug
+ logging level sim debug
+ logging level gps debug
+ logging level mob debug
+ logging level prim debug
+ logging level lua debug
diff --git a/virt-nitb/osmo-bsc.cfg b/virt-nitb/osmo-bsc.cfg
index 63b574a..a9528d9 100644
--- a/virt-nitb/osmo-bsc.cfg
+++ b/virt-nitb/osmo-bsc.cfg
@@ -1,19 +1,3 @@
-# DO NET EDIT THIS FILE DIRECTLY!
-# This is generated from templates, and manual edits will be overwritten.
-
-stats interval 5
-!
-stats reporter statsd
-  disable
-  remote-ip 127.0.0.1
-  remote-port 9125
-  level global
-  no prefix
-  enable
-!
-line vty
- no login
-!
 e1_input
  e1_line 0 driver ipa
  e1_line 0 port 0
@@ -34,24 +18,18 @@ network
 
  bts 0
   description my test BTS 0
-  type sysmobts
+  type osmo-bts
   band GSM-1800
-  ip.access unit_id 0 0
+  ip.access unit_id 1 0
   location_area_code 23
   cell_identity 0
   base_station_id_code 0
   codec-support fr amr
-  amr tch-f modes 3
-  amr tch-f start-mode 3
-  amr tch-h modes 3
-  amr tch-h start-mode 3
-  gprs mode gprs
-  gprs nsvc 0 remote ip 127.0.0.3
-  gprs nsvc 0 remote udp port 23000
-  gprs nsvc 0 local udp port 23000
-  gprs nsvc 0 nsvci 0
-  gprs nsei 0
-  gprs cell bvci 1000
+  amr tch-f modes 2 3 5 7
+  amr tch-f start-mode 2
+  amr tch-h modes 2 3 5
+  amr tch-h start-mode 2
+  gprs mode none
   trx 0
    arfcn 512
    description my test BTS 0
@@ -59,73 +37,31 @@ network
    nominal power 23
    max_power_red 22
    timeslot 0
-    phys_chan_config CCCH+SDCCH4
+    phys_chan_config ccch
    timeslot 1
-    phys_chan_config SDCCH8
+    phys_chan_config sdcch8
    timeslot 2
-    phys_chan_config TCH/H
+    phys_chan_config tch/f
    timeslot 3
-    phys_chan_config TCH/H
+    phys_chan_config tch/f
    timeslot 4
-    phys_chan_config TCH/H
+    phys_chan_config tch/f
    timeslot 5
-    phys_chan_config TCH/H
+    phys_chan_config tch/f
    timeslot 6
-    phys_chan_config TCH/H
+    phys_chan_config tch/f
    timeslot 7
-    phys_chan_config PDCH
- bts 1
-  description my test BTS 1
-  type sysmobts
-  band GSM-1800
-  ip.access unit_id 1 0
-  location_area_code 23
-  cell_identity 1
-  base_station_id_code 1
-  codec-support fr amr
-  amr tch-f modes 3
-  amr tch-f start-mode 3
-  amr tch-h modes 3
-  amr tch-h start-mode 3
-  gprs mode gprs
-  gprs nsvc 0 remote ip 127.0.0.3
-  gprs nsvc 0 remote udp port 7777
-  gprs nsvc 0 local udp port 23000
-  gprs nsvc 0 nsvci 1
-  gprs nsei 1
-  gprs cell bvci 1001
-  trx 0
-   arfcn 514
-   description my test BTS 1
-   rf_locked 0
-   nominal power 23
-   max_power_red 22
-   timeslot 0
-    phys_chan_config CCCH+SDCCH4
-   timeslot 1
-    phys_chan_config SDCCH8
-   timeslot 2
-    phys_chan_config TCH/H
-   timeslot 3
-    phys_chan_config TCH/H
-   timeslot 4
-    phys_chan_config TCH/H
-   timeslot 5
-    phys_chan_config TCH/H
-   timeslot 6
-    phys_chan_config TCH/H
-   timeslot 7
-    phys_chan_config PDCH
+    phys_chan_config tch/f
 
 msc 0
  mgw remote-ip 127.0.0.3
  mgw remote-port 2427
  mgw endpoint-domain bsc
  allow-emergency deny
- codec-list hr3
- amr-config 12_2k forbidden
+ codec-list fr3 hr3 fr2 fr1 hr1
+ amr-config 12_2k allowed
  amr-config 10_2k forbidden
- amr-config 7_95k forbidden
+ amr-config 7_95k allowed
  amr-config 7_40k forbidden
  amr-config 6_70k allowed
  amr-config 5_90k allowed
@@ -141,7 +77,6 @@ log stderr
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level hodec info
  logging level ho info
  logging level nm info
@@ -152,6 +87,7 @@ log stderr
  logging level lsccp notice
  logging level lsua notice
  logging level lm3ua notice
+
 log file current_log/osmo-bsc.log
  logging filter all 1
  logging color 1
@@ -161,7 +97,6 @@ log file current_log/osmo-bsc.log
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level hodec info
  logging level ho info
  logging level nm info
@@ -172,6 +107,7 @@ log file current_log/osmo-bsc.log
  logging level lsccp notice
  logging level lsua notice
  logging level lm3ua notice
+
 log gsmtap 127.0.0.9
  logging filter all 1
  logging color 1
@@ -181,7 +117,6 @@ log gsmtap 127.0.0.9
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level hodec info
  logging level ho info
  logging level nm info
diff --git a/virt-nitb/osmo-bts-virtual.cfg b/virt-nitb/osmo-bts-virtual.cfg
index 13bc0e5..d2a075a 100644
--- a/virt-nitb/osmo-bts-virtual.cfg
+++ b/virt-nitb/osmo-bts-virtual.cfg
@@ -1,42 +1,3 @@
-!
-! OsmoBTS (0.4.0.216-bc49-dirty) configuration saved from vty
-!!
-!
-log stderr
- logging filter all 1
- logging color 0
- logging print category 1
- logging timestamp 0
- logging level rsl info
- logging level oml info
- logging level rll notice
- logging level rr notice
- logging level meas notice
- logging level pag info
- logging level l1c info
- logging level l1p info
- logging level dsp error
- logging level pcu notice
- logging level ho debug
- logging level trx notice
- logging level loop notice
- logging level abis debug
- logging level rtp notice
- logging level sum error
- logging level lglobal notice
- logging level llapd notice
- logging level linp notice
- logging level lmux notice
- logging level lmi notice
- logging level lmib notice
- logging level lsms notice
- logging level lctrl notice
- logging level lgtp notice
- logging level lstats error
-!
-line vty
- no login
-!
 e1_input
  e1_line 0 driver ipa
  e1_line 0 port 0
@@ -44,17 +5,38 @@ e1_input
 phy 0
  instance 0
 bts 0
- band DCS1800
- ipa unit-id 6969 0
- oml remote-ip 127.0.0.1
- rtp jitter-buffer 100
- paging queue-size 200
- paging lifetime 0
- min-qual-rach 50
- min-qual-norm -5
+ band GSM-1800
+ ipa unit-id 1 0
+ oml remote-ip 127.0.0.3
  trx 0
-  power-ramp max-initial 23000 mdBm
-  power-ramp step-size 2000 mdB
-  power-ramp step-interval 1
-  ms-power-control osmo
   phy 0 instance 0
+
+log stderr
+ logging filter all 1
+ logging color 1
+ logging print level 1
+ logging print category 1
+ logging print category-hex 0
+ logging print file basename last
+ logging print extended-timestamp 1
+ logging level set-all info
+
+log file current_log/osmo-bts-virtual.log
+ logging filter all 1
+ logging color 1
+ logging print level 1
+ logging print category 1
+ logging print category-hex 0
+ logging print file basename last
+ logging print extended-timestamp 1
+ logging level set-all info
+
+log gsmtap 127.0.0.9
+ logging filter all 1
+ logging color 1
+ logging print level 1
+ logging print category 1
+ logging print category-hex 0
+ logging print file basename last
+ logging print extended-timestamp 1
+ logging level set-all info
diff --git a/virt-nitb/osmo-hlr.cfg b/virt-nitb/osmo-hlr.cfg
index 88ff4d8..302b081 100644
--- a/virt-nitb/osmo-hlr.cfg
+++ b/virt-nitb/osmo-hlr.cfg
@@ -16,6 +16,18 @@ log stderr
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
+ logging level linp notice
+
+log file current_log/osmo-hlr.log
+ logging filter all 1
+ logging color 1
+ logging print level 1
+ logging print category 1
+ logging print category-hex 0
+ logging print file basename last
+ logging print extended-timestamp 1
+ logging level set-all debug
+ logging level linp notice
 
 log gsmtap 127.0.0.9
  logging filter all 1
@@ -26,3 +38,4 @@ log gsmtap 127.0.0.9
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
+ logging level linp notice
diff --git a/virt-nitb/osmo-mgw-for-bsc.cfg b/virt-nitb/osmo-mgw-for-bsc.cfg
index e9fd74d..8d2219b 100644
--- a/virt-nitb/osmo-mgw-for-bsc.cfg
+++ b/virt-nitb/osmo-mgw-for-bsc.cfg
@@ -1,6 +1,3 @@
-# DO NET EDIT THIS FILE DIRECTLY!
-# This is generated from templates, and manual edits will be overwritten.
-
 mgcp
  domain bsc
  bind ip 127.0.0.3
@@ -9,6 +6,8 @@ mgcp
  number endpoints 1024
 line vty
  bind 127.0.0.7
+ctrl
+ bind 127.0.0.7
 
 log stderr
  logging filter all 1
@@ -19,9 +18,9 @@ log stderr
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level rtp info
  logging level lmgcp info
+
 log file current_log/osmo-mgw-for-bsc.log
  logging filter all 1
  logging color 1
@@ -31,9 +30,9 @@ log file current_log/osmo-mgw-for-bsc.log
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level rtp info
  logging level lmgcp info
+
 log gsmtap 127.0.0.9
  logging filter all 1
  logging color 1
@@ -43,6 +42,5 @@ log gsmtap 127.0.0.9
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level rtp info
  logging level lmgcp info
diff --git a/virt-nitb/osmo-mgw-for-msc.cfg b/virt-nitb/osmo-mgw-for-msc.cfg
index 9249df4..f7c4ec5 100644
--- a/virt-nitb/osmo-mgw-for-msc.cfg
+++ b/virt-nitb/osmo-mgw-for-msc.cfg
@@ -1,6 +1,3 @@
-# DO NET EDIT THIS FILE DIRECTLY!
-# This is generated from templates, and manual edits will be overwritten.
-
 mgcp
  domain msc
  bind ip 127.0.0.4
@@ -9,6 +6,8 @@ mgcp
  number endpoints 1024
 line vty
  bind 127.0.0.6
+ctrl
+ bind 127.0.0.6
 
 log stderr
  logging filter all 1
@@ -19,9 +18,9 @@ log stderr
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level rtp info
  logging level lmgcp info
+
 log file current_log/osmo-mgw-for-msc.log
  logging filter all 1
  logging color 1
@@ -31,9 +30,9 @@ log file current_log/osmo-mgw-for-msc.log
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level rtp info
  logging level lmgcp info
+
 log gsmtap 127.0.0.9
  logging filter all 1
  logging color 1
@@ -43,6 +42,5 @@ log gsmtap 127.0.0.9
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level rtp info
  logging level lmgcp info
diff --git a/virt-nitb/osmo-msc.cfg b/virt-nitb/osmo-msc.cfg
index 182c6c0..e64c2f8 100644
--- a/virt-nitb/osmo-msc.cfg
+++ b/virt-nitb/osmo-msc.cfg
@@ -1,13 +1,10 @@
-# DO NET EDIT THIS FILE DIRECTLY!
-# This is generated from templates, and manual edits will be overwritten.
-
 network
  network country code 001
  mobile network code 01
  authentication required
  encryption a5 1
- short name 35c3
- long name 35c3
+ short name virt
+ long name virt
  mm info 1
 msc
  mncc internal
@@ -37,12 +34,12 @@ log stderr
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level linp notice
  logging level lss7 notice
  logging level lsccp notice
  logging level lsua notice
  logging level lm3ua notice
+
 log file current_log/osmo-msc.log
  logging filter all 1
  logging color 1
@@ -52,12 +49,12 @@ log file current_log/osmo-msc.log
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level linp notice
  logging level lss7 notice
  logging level lsccp notice
  logging level lsua notice
  logging level lm3ua notice
+
 log gsmtap 127.0.0.9
  logging filter all 1
  logging color 1
@@ -67,7 +64,6 @@ log gsmtap 127.0.0.9
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level linp notice
  logging level lss7 notice
  logging level lsccp notice
diff --git a/virt-nitb/osmo-stp.cfg b/virt-nitb/osmo-stp.cfg
index cbfbab6..333c0ac 100644
--- a/virt-nitb/osmo-stp.cfg
+++ b/virt-nitb/osmo-stp.cfg
@@ -1,6 +1,3 @@
-# DO NET EDIT THIS FILE DIRECTLY!
-# This is generated from templates, and manual edits will be overwritten.
-
 cs7 instance 0
  xua rkm routing-key-allocation dynamic-permitted
  listen m3ua 2905
@@ -15,12 +12,12 @@ log stderr
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level linp notice
  logging level lss7 notice
  logging level lsccp notice
  logging level lsua notice
  logging level lm3ua notice
+
 log file current_log/osmo-stp.log
  logging filter all 1
  logging color 1
@@ -30,12 +27,12 @@ log file current_log/osmo-stp.log
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level linp notice
  logging level lss7 notice
  logging level lsccp notice
  logging level lsua notice
  logging level lm3ua notice
+
 log gsmtap 127.0.0.9
  logging filter all 1
  logging color 1
@@ -45,7 +42,6 @@ log gsmtap 127.0.0.9
  logging print file basename last
  logging print extended-timestamp 1
  logging level set-all debug
-
  logging level linp notice
  logging level lss7 notice
  logging level lsccp notice
diff --git a/virt-nitb/run.sh b/virt-nitb/run.sh
index 1512023..dea3c39 100755
--- a/virt-nitb/run.sh
+++ b/virt-nitb/run.sh
@@ -1,41 +1,5 @@
 #!/usr/bin/env bash
-
-if ! ../fill_config.py --check-stale; then
-	echo
-	echo "WARNING: STALE CONFIGS - your net configs are older than the templates they should be based on!"
-	echo " * Hit enter to continue, and use the stale config files"
-	echo " * Hit ^C and run 'make regen' to regenerate your configs"
-	read enter_to_continue
-fi
-
-dev="eth0"
-apn="apn0"
-
-sudo true || exit 1
-
-if [ -z "$(sudo iptables -L -t nat | grep MASQUERADE)" ]; then
-  sudo iptables -t nat -A POSTROUTING -s 192.168.42.0/24 -o $dev -j MASQUERADE
-fi
-
-if [ "$(sudo cat /proc/sys/net/ipv4/ip_forward)" = "0" ]; then
-  sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"
-fi
-
-if [ -z "$(ip tuntap show | grep $apn)" ]; then
-  sudo ip tuntap add dev $apn mode tun user $USER group $USER
-  sudo ip addr add 192.168.42.0/24 dev $apn
-  sudo ip link set $apn up
-fi
-
-if [ -z "$(ip addr show | grep "127.0.0.3")" ]; then
-  echo "No interface has IP address 127.0.0.3! Hit enter to continue anyway."
-  read enter_to_continue
-fi
-if [ -z "$(ip addr show | grep "127.0.0.4")" ]; then
-  echo "No interface has IP address 127.0.0.4! Hit enter to 'ip addr add 127.0.0.4/32 dev $dev'"
-  read enter_to_continue
-  sudo ip addr add 127.0.0.4/32 dev $dev
-fi
+#set -x
 
 logdir="current_log"
 mkdir -p "$logdir"
@@ -59,31 +23,37 @@ term() {
   if [ -z "$title" ]; then
     title="$(basename $@)"
   fi
-  exec $terminal -title "CN:$title" -e sh -c "export LD_LIBRARY_PATH='/usr/local/lib'; $1; echo; while true; do echo 'q Enter to close'; read q_to_close; if [ \"x\$q_to_close\" = xq ]; then break; fi; done"
+  exec $terminal -title "CN:$title" -e sh -c "$1; echo; while true; do echo 'q Enter to close'; read q_to_close; if [ \"x\$q_to_close\" = xq ]; then break; fi; done"
 }
 
 find_term
 
-hnbgw="osmo-hnbgw"
-msc="gdb -ex run --args $(which osmo-msc)"
+asan="$(ls -1 /usr/lib/x86_64-linux-gnu/libasan.so.* | tail -n 1)"
+udtrace="/n/git/udtrace/libudtrace.so"
+titan="/usr/lib/titan/libttcn3-dynamic.so"
+
+#msc="gdb -ex run --args $(which osmo-msc)"
 # To enable udtrace on osmo-msc MNCC socket, use this with adjusted /path/to/udtrace:
-# - LD_LIBRARY_PATH allows linking to titan if udtrace was compiled with titan support.
+# - LD_PRELOAD of titan is needed if udtrace was compiled with titan support.
 # - LD_PRELOAD of libasan allows building osmo-msc with the sanitize.opts.
 # - the tee saves the stderr logging as well as the udtrace output to new file current_log/osmo-msc.out, since udtrace
 #   will not show in osmo-msc.log
-#msc="LD_LIBRARY_PATH=/usr/lib/titan LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libasan.so.5:/path/to/udtrace/libudtrace.so osmo-msc 2>&1 | tee -a current_log/osmo-msc.out"
-gbproxy="osmo-gbproxy"
-sgsn="osmo-sgsn"
-ggsn="osmo-ggsn"
+msc="LD_PRELOAD=$asan:$udtrace:$titan osmo-msc 2>&1 | tee -a current_log/osmo-msc.out"
+#msc="osmo-msc"
 mgw4msc="osmo-mgw -c osmo-mgw-for-msc.cfg"
-#mgw4bsc="gdb -ex run --args osmo-mgw -c osmo-mgw-for-bsc.cfg"
 #mgw4bsc="strace osmo-mgw -c osmo-mgw-for-bsc.cfg"
 mgw4bsc="osmo-mgw -c osmo-mgw-for-bsc.cfg"
-hlr="LD_LIBRARY_PATH=/usr/local/lib gdb -ex run --args osmo-hlr --db-upgrade"
+hlr="osmo-hlr"
 stp="osmo-stp"
-bsc="LD_LIBRARY_PATH=/usr/local/lib gdb -ex run --args osmo-bsc -c osmo-bsc.cfg"
+bsc="osmo-bsc"
+bts="osmo-bts-virtual -c osmo-bts-virtual.cfg"
+virtphy="LD_PRELOAD=$asan virtphy"
+ms1="LD_PRELOAD=$asan mobile -c mobile.cfg"
+ms2="LD_PRELOAD=$asan mobile -c mobile2.cfg"
 
-if [ "xinternal" != "xinternal" ]; then
+SIPCON_SERVER="internal"
+
+if [ "x$SIPCON_SERVER" != "xinternal" ]; then
   sipcon="osmo-sip-connector -c osmo-sip-connector.cfg"
 
   case "kamailio" in
@@ -114,83 +84,79 @@ if [ "xinternal" != "xinternal" ]; then
   esac
 fi
 
-sudo tcpdump -i $dev -n -w current_log/$dev.single.pcap -U not port 22 &
-sudo tcpdump -i lo -n -w current_log/lo.single.pcap -U not port 22 &
+#sudo tcpdump -i $dev -n -w current_log/$dev.single.pcap -U not port 22 &
+#sudo tcpdump -i lo -n -w current_log/lo.single.pcap -U not port 22 &
 
-term "$ggsn" GGSN &
-sleep .2
 term "$stp" STP &
 sleep .2
 term "$hlr" HLR &
 sleep .2
-term "$sgsn" SGSN &
-sleep .2
-term "$gbproxy" GBPROXY &
-sleep .2
 term "$mgw4msc" MGW4MSC &
 sleep .2
 term "$mgw4bsc" MGW4BSC &
 sleep .2
 term "$msc" MSC &
 sleep 2
-term "$hnbgw" HNBGW &
-sleep .2
 term "$bsc" BSC &
+sleep 2
+term "$bts" BTS &
+sleep .2
+term "$virtphy" virtphy &
+sleep .2
+term "$ms1" MS1 &
+sleep .2
+term "$ms2" MS2 &
 
-if [ "xinternal" != "xinternal" ]; then
+if [ "x$SIPCON_SERVER" != "xinternal" ]; then
   sleep .2
   term "$sipcon" SIPCON &
   sleep .2
-  case "kamailio" in
+  case "$SIPCON_SERVER" in
     "kamailio") term "$kamailio" KAMAILIO &;;
     "freeswitch") term "./freeswitch/freeswitch.sh" FREESWITCH &;;
   esac
 fi
 
-#ssh bts rm /tmp/bts.log /tmp/pcu.log
-#ssh bts neels/run_remote.sh &
-
+set +x
+sleep 1
+echo
 echo enter to close
 read enter_to_close
 echo Closing...
+#set -x
 
-#ssh bts neels/stop_remote.sh
+if [ "x$SIPCON_SERVER" != "xinternal" ]; then
+  kill %11
+  # 'killall' seems to work only with the shortened name
+  killall osmo-sip-connec
+  killall "$SIPCON_SERVER"
+fi
 
-kill %1 %2 %3 %4 %5 %6 %7 %8 %9 %10 %11 %12 %13 %14
+kill %1 %2 %3 %4 %5 %6 %7 %8 %9 %10
 killall osmo-msc
 killall osmo-bsc
-killall osmo-gbproxy
-killall osmo-sgsn
-#killall osmo-hnbgw
 killall osmo-mgw
 killall osmo-hlr
 killall -9 osmo-stp
-sudo killall tcpdump
-killall osmo-ggsn
-
-if [ "xinternal" != "xinternal" ]; then
-  # 'killall' seems to work only with the shortened name
-  killall osmo-sip-connec
-  killall "kamailio"
-fi
+killall mobile
+killall virtphy
+killall osmo-bts-virtual
 
 
 set +e
 cp *.cfg "$logdir"/
 
+set +x
 echo
 echo enter name to save log
 read log_name
 if [ -n "$log_name" ]; then
   newlogdir="log/$log_name"
-  #scp "bts:/tmp/{bts,pcu}.log" "bts:neels/osmo-{bts,pcu}.cfg" "$logdir"
 else
   newlogdir="autolog/log_$(date +%Y-%m-%d_%H-%M-%S)"
 fi
 mkdir -p "$(dirname "$newlogdir")"
 
-mergecap -w "$logdir/trace.pcap" "$logdir/"*.single.pcap && rm -f "$logdir/"*.single.pcap
-
 if [ -x "$newlogdir" ]; then
   echo "already exists, move it manually: $newlogdir"
 else