LTE and NR Network scanner
version 2026-04-02*
This document is based on the latest test release.
Features may not be present in your current installed software. You may check their availability in change history or in your release documentation.
If you require an up to date release, ask for it in a ticket.

1 Introduction
2 Requirements
- 2.1 Hardware requirements
- 2.2 Software requirements
3 Installation
4 Configuration reference
- 4.1 Configuration file syntax
  - 4.1.1 JSON merge rules
- 4.2 Global properties
5 Remote API
6 Command line monitor reference
7 Log file format
- 7.1 PHY layer
8 Change history
9 License

1 Introduction

LTESCAN is a tool using Amarisoft SDR50 boards to scan a band of the RF spectrum searching for either LTE or NR (SA) cells.
LTESCAN can be greatly accelerated by using several boards together.
Depending on conditions, adding a LNA RF amplifier in front of the SDR50 board(s) may give a better detection performance.
Launching “ltescan” will use the default config file “ltescan.cfg”. You can also specify a different config file by launching “ltescan myscan.cfg” Once launched, there are two ways to use it:

- user input on the console, with results on the screen
- websocket API for automatization

2 Requirements

2.1 Hardware requirements

- A fast PC:
- - For best performances, a quad core Intel Core i7 CPU (Haswell architecture or later) is recommended. Support of the AVX2 instruction set extension is required to run the software.
- - At least 2 GB of RAM.
- - At least 1 GB of hard disk space.
- - The video adapter does not matter.
- Radio front end
one or more Amarisoft PCIe SDR50
- Appropriate antennas for the intended LTE frequencies or cables and attenuators to connect to a UE.
- Optional RF amplifier

2.2 Software requirements

A 64 bit Linux distribution. Fedora 42 is the officially supported distribution.
The following distributions are known as compatible:
- Fedora 22 to 42
- Cent OS 7
- Ubuntu 14 to 24
Your system requires at least GLIBC 2.17.

Other distributions can be used provided the radio frontend drivers are available for them.

3 Installation

3.1 Linux setup

3.1.1 Packages

3.1.2 OpenSSL

LTESCAN has been compiled against openssl version 3.5.4.
If your system does not have compatible version installed you may have this error message at startup:

error while loading shared libraries: libssl.so.3: cannot open shared object file: No such file or directory

To overcome this problem, you may:

Copy libssl.so.3 and libcrypto.so.3 from libs subdirectory of your release tarball.
If you have installed software with automatic install script, this should have been done automatically.
Compile and install proper openssl version yourself

In case of persisting issue, raise a ticket from our support site at https://support.amarisoft.com/ with the information provided by below commands executed in LTESCAN directory:

uname -a
ls -l
ldd ./ltescan
openssl version

3.2 RRH setup

Please refer to sub section of your radio frontend to set it up.

3.2.1 Amarisoft PCIe SDR

Read the PCIe SDR documentation (trx_sdr.pdf).

3.3 LTESCAN installation

Decompress the LTESCAN archive to a convenient place. The executable ltescan can be launched from this directory.

4 Configuration reference

4.1 Configuration file syntax

The main configuration file uses a syntax very similar to the Javascript Object Notation (JSON) with few extensions.

Supported types:
- - Numbers (64 bit floating point). Notation: 13.4
- - Complex numbers. Notation: 1.2+3*I
- - Strings. Notation: "string"
- - Booleans. Notation: true or false.
- - Objects. Notation: { field1: value1, field2: value2, .... }
- - Arrays. Notation: [ value1, value2, .... ]
The basic operations +, -, * and / are supported with numbers and complex numbers. + also concatenates strings. The operators !, ||, &&, ==, !=, <, <=, >=, > are supported too.
The numbers 0 and 1 are accepted as synonyms for the boolean values false and true.
{} at top level are optional.
" for property names are optional, unless the name starts with a number.
Properties can be duplicated.
If properties are duplicated, they will be merged following JSON merge rules with overriding occuring in reading direction (last overrides previous).
Ex:
```
{
    value: "foo",
    value: "bar",
    sub: {
        value: "foo"
    },
    sub: {
        value: "bar"
    }
}
```
Will be equivalent to:
```
{
    value: "bar",
    sub: {
        value: "bar"
    }
}
```
Files can be included using include keyword (must not be quoted) followed by a string (without :) representing the file to include (path is relative to current file) and terminating by a comma.
Arrays can’t be included.
Merge will be done as for duplicate properties.
If file1.cfg is:
```
    value: "foo",
    include "file2.cfg",
    foo: "foo"
```
And file2.cfg is:
```
    value: "bar",
    foo: "bar"
```
Final config will be:
```
{
    value: "bar",
    foo: "foo"
}
```
A C like preprocessor is supported. The following preprocessor commands are available:

#define var expr

Define a new variable with value expr. expr must be a valid JSON expression. Note that unlike the standard C preprocessor, expr is evaluated by the preprocessor.

#undef var

Undefine the variable var.

#include expr

Include the file whose filename is the evaluation of the string expression expr.

#if expr

Consider the following text if expr is true.

#else

Alternative of #if block.

#elif

Composition of #else and #if.

#endif

End of #if block.

#ifdef var

Shortcut for #if defined(var)

#ifndef var

Shortcut for #if !defined(var)

In the JSON source, every occurrence of a defined preprocessor variable is replaced by its value.
Backquote strings: JSON expression can be inserted in backquote delimited strings with the ${expr} syntax. Example: `abc${1+2}d` is evaluated as the string "abc3d". Preprocessor variables can be used inside the expression. Backquote strings may span several lines.

4.1.1 JSON merge rules

Merge overriding direction depends on context, i.e source may override destination or the opposite.
JSON merge is recursive for Objects and Arrays.

Example, merging

{
    foo: { value: "bar" },
    same: "one",
    one: 1
}

with

{
    foo: { value: "none", second: true },
    same: "two",
    two: 1
}

Will become:

{
    foo: { value: "bar", second: true },
    same: "one",
    one: 1
    two: 1
}

assuming first object overrides second one.

In case of Array merging, the final array length will be the maximum length of all merged arrays.
For each element of the final array, merge will be done considering defined elements only.
Ex:

{
    array: [0, 1, 2, { foo: "bar" } ],
    array: [3, 4],
    array: [5, 6, 7, { bar: "foo" }, 8 ]
}

Will be merged to:

{
    array: [5, 6, 7, { foo: "bar", bar: "foo" }, 8 ],
}

4.2 Global properties

Example of ltescan.cfg:

/* LTE scan configuration */
{
  log_options: "all.level=debug,all.max_size=1,phy.signal=1",
  log_filename: "/tmp/scan.log",

  com_addr: "[::]:9009",

  //sib_inter_rat: true,

  rf_driver: {
      name: "sdr",
      args: `dev0=/dev/sdr0`,
      /* For multiple boards */
      //args: `dev0=/dev/sdr0,dev1=/dev/sdr1,dev2=/dev/sdr2,dev3=/dev/sdr3`,
  },

  rx_gain: 60,

  scan: {
    lock_timeout: 100,    /* ms: waiting for Cell Lock */
    pbch_timeout: 200,    /* ms waiting for PBCH */
    sib_timeout: 3000,    /* ms: waiting for SIB */
    
    snr_threshold: 3.0,   /* only show cells with SNR greater than 3dB */
    rssi_timeout: 1000,   /* RSSI integration time (ms) */
    rssi_width: 100,      /* RSSI block width for rssi results (KHz) */
  },
}

For UHD driver (B2x0 hardware), the rf_driver must be modified as follows:

  rf_driver: {
      name: "uhd",
      args: "num_recv_frames=64,num_send_frames=64",
      dl_sample_bits: 12,
      ul_sample_bits: 12,
  },

log_filenamelog_filename

String. Set the log filename. If no leading /, it is relative to the configuration file path. See Log file format.

log_optionslog_options

String. Set the logging options as a comma separated list of assignments.

layer.level=verbosity. For each layer, the log verbosity can be set to none, error, info or debug. In debug level, the content of the transmitted data is logged.
layer.max_size=n. When dumping data content, at most n bytes are shown in hexa. For ASN.1, NAS or Diameter content, show the full content of the message if n > 0.
layer.payload=[0|1]. Dump ASN.1, NAS, SGsAP or Diameter payload in hexadecimal.
layer.key=[0|1]. Dump security keys (NAS and RRC layers).
layer.crypto=[0|1]. Dump plain and ciphered data (NAS and PCDP layers).
time=[sec|short|full]. Display the time as seconds, time only or full date and time (default = time only).
time.us=[0|1]. Dump time with microseconds precision.
file=cut. Close current file log and open a new one.
file.rotate=now. Move and rename to the same directory or to the directory pointed by file.path and open a new log file (Headers are kept).
file.rotate=size. Every time log file size reaches size bytes, move and rename to the same directory or to the directory pointed by file.path, and open a new log file (Headers are kept).
Size is an integer and can be followed by K, M or G.
file.rotate=#count. Everytime number of logs in log file reaches count, move and rename to the same directory or to the directory pointed by file.path, and open a new log file (Headers are kept).
Size is an integer and can be followed by K, M or G.
file.path=path. When log rotation is enabled (file.rotate set), rename and move current log to this path instead of initial log path.
append=[0|1]. (default=0). If 0, truncate the log file when opening it. Otherwise, append to it.

Available layers are: phy

log_synclog_sync

Optional boolean (default = false). If true, logs will be synchronously dumped to file.
Warning, this may lead to performances decrease.

sib_inter_ratsib_inter_rat

Optional boolean (default = false). If true, allow scanning of inter-RAT LTE SIBs 6, 7 and 24, and NR SIB 5. Warning: this may add extra timeout.

rx_gainrx_gain

Float. Receive gain in dB. The range is device dependent. For the PCIe SDR board, the range is between -11 and 77 dB (the exact limits depend on the RX frequency). For the USRP N2x0 device with the SBX daughterboard, the range is 0 to 31.5 dB. With an array of floats a different gain is specified for each channel. Ltescan uses this value as initial rx_gain fo each new frequenncy. The actual gain is automatically lowered as needed.

scanscan

Object. Section for scanning parameters

lock_timeoutscan.lock_timeout: Number. Timeout in ms waiting for cell lock on a frequency. (default = 100ms)
pcbh_timeoutscan.pcbh_timeout: Number. Timeout in ms waiting for PBCH (LTE) or PDCCH (NR) when locked on a frequency. (default = 200ms)
sib_timeoutscan.sib_timeout: Number. Timeout in ms waiting for cell SIB (LTE) or MIB (NR) on a frequency when locked. (default = 3000 ms)
snr_thresholdscan.snr_threshold: Float. Minimum SNR in dB to accept SIB or MIB. (default = 3.0 dB)
rssi_timeoutscan.rssi_timeout: Number. Time in ms integrating data when scanning RSSI (default = 100 ms)
rssi_widthscan.rssi_width: Number. Frequency step in KHz when returning RSSI scan result. (granularity = 100KHz, default = 100 KHz)
bandscan.band: Number or String. Optional parameter to force automatic scan when ltescan is launched. Accepts same syntax as the ’scan’ command on command line (see Chapter 6).

sib_format_jersib_format_jer

Optional boolean (default = false). If set, sib ASN.1 content within Cell notification message will be a JSON structure (JER) instead base64 encoding.

com_addrcom_addr

Optional string. Address of the WebSocket server remote API. See Remote API.
If set, the WebSocket server for remote API will be enabled and bound to this address.
Default port is 9009.
Setting IP address to [::] will make remote API reachable through all network interfaces.

com_namecom_name

Optional string. Sets server name. SCAN by default

com_ssl_certificatecom_ssl_certificate

Optional string. If set, forces SSL for WebSockets. Defines CA certificate filename.

com_ssl_keycom_ssl_key

Optional string. Mandatory if com_ssl_certificate is set. Defines CA private key filename.

com_ssl_peer_verifycom_ssl_peer_verify

Optional boolean (default is false). If true, server will check client certificate.

com_ssl_cacom_ssl_ca

Optional string. Set CA certificate. In case of peer verification with self signed certificate, you should use the client certificate.

com_log_lockcom_log_lock

Optional boolean (default is false). If true, logs configuration can’t be changed via config_set remote API.

com_log_uscom_log_us

Optional boolean (default is false). If true, logs sent by log_get remote API response will have a timestamp_us parameters instead of timestamp

com_authcom_auth

Optional object. If set, remote API access will require authentication.
Authentication mechanism is describe in Remote API Startup section.

passfilecom_auth.passfile: Optional string. Defines filename where password is stored (plaintext).
If not set, password must be set
passwordcom_auth.password: Optional string. Defines password.
If not set, passfile must be set.
unsecurecom_auth.unsecure: Optional boolean (default false). If set, allow password to be sent plaintext.
NB: you should set it to true if you access it from a Web Browser (Ex: Amarisoft GUI) without SSL (https) as your Web Browser may prevent secure access to work.

com_log_countcom_log_count

Optional number (Default = 8192). Defines number of logs to keep in memory before dropping them.
Must be between 4096 and 2097152).

sim_eventssim_events

Array of object. Each element defines a remote API request (Remote API) except that message field is replaced by event.

sim_events_loop_countsim_events_loop_count

If set, will define loop_count for each event of sim_events, See loop_count.

sim_events_loop_delaysim_events_loop_delay

If set, will define loop_delay for each event of sim_events, See loop_delay.

license_serverlicense_server

Configuration of the Amarisoft license server to use.
Object with following properties:

server_addrlicense_server.server_addr: String. IP address of the license server.
namelicense_server.name: Optional string. Text to be displayed inside server monitor or remote API.
taglicense_server.tag: Optional string. If set, server will only allow license with same tag.

Example:

license_server: {
    server_addr: "192.168.0.20",
    name: "My license",
}

5 Remote API

You can access LTESCAN via a remote API.
Protocol used is WebSocket as defined in RFC 6455 (https://tools.ietf.org/html/rfc6455).

Note that Origin header is mandatory for the server to accept connections.
This behavior is determined by the use of nopoll library.
Any value will be accepted.

To learn how to use it, you can refer to our the following tutorial.

5.1 Messages

Messages exchanged between client and LTESCAN server are in strict JSON format.

Each message is represented by an object. Multiple message can be sent to server using an array of message objects.

Time and delay values are floating number in seconds.

There are 4 types of messages:

Request
Message sent by client.
Common definition:

messagerequest.message

String. Represent type of message. This parameter is mandatory and depending on its value, other parameters will apply.

message_idrequest.message_id

Optional any type. If set, response sent by the server to this message will have same message_id. This is used to identify response as WebSocket does not provide such a concept.

start_timerequest.start_time

Optional float. Represent the delay before executing the message.
If not set, the message is executed when received.

absolute_timerequest.absolute_time

Optional boolean (default = false). If set, start_time is interpreted as absolute.
You can get current clock of system using time member of any response.

standalonerequest.standalone

Optional boolean (default = false). If set, message will survive WebSocket disconnection, else, if socket is disconnected before end of processing, the message will be cancelled.

loop_countrequest.loop_count

Optional integer (default = 0, max = 1000000). If set, message will be repeated loop_count time(s) after loop_delay (From message beginning of event).
Response will have a loop_index to indicate iteration number.

loop_delayrequest.loop_delay

Optional number (min = 0.1, max = 86400). Delay in seconds to repeat message from its start_time. Mandatory when loop_count is set > 0.
Notification
For some API, intermediate message may be sent by server before reception of response.
Common definition:

messagenotification.message

String. Same as request.

message_idnotification.message_id

Optional any type. Same as in request.

timenotification.time

Number representing time in seconds of the message start, relative to the beginning of the process.
Useful to send command with absolute time.

notificationnotification.notification

String. Notification purpose

utcnotification.utc

Number representing UTC seconds (local clock) when the response has been generated.
Response
Message sent by server after any request message has been processed.
Common definition:

messageresponse.message

String. Same as request.

message_idresponse.message_id

Optional any type. Same as in request.

timeresponse.time

Number representing time in seconds of the message start, relative to the beginning of the process.
Useful to send command with absolute time.

utcresponse.utc

Number representing UTC seconds (local clock) when the response has been generated.

absolute_timeresponse.absolute_time

Optional string. If absolute_time has been set and message is reaching LTESCAN too late, this field is present and set to late.
Events
Message sent by server on its own initiative.
Common definition:

messageevent.message

String. Event name.

timeevent.time

Number representing time in seconds.
Useful to send command with absolute time.

5.2 Startup

When WebSocket connections is setup, LTESCAN will send a first message with name set to com_name and type set to SCAN.

If authentication is not set, message will be ready:

{
    "message": "ready",
    "type": "SCAN",
    "name": <com_name>,
    "version": <software version>,
    "product": <Amarisoft product name (optional)>
}

If authentication is set, message will be authenticate :

{
    "message": "authenticate",
    "type": "SCAN",
    "name": <com_name>,
    "challenge": <random challenge>
}

To authenticate, the client must answer with a authenticate message and a res parameter where:

res = HMAC-SHA256( "<type>:<password>:<name>", "<challenge>" )

res is a string and HMAC-SHA256 refers to the standard algorithm (https://en.wikipedia.org/wiki/HMAC)

If the authentication succeeds, the response will have a ready field set to true.

{
    "message": "authenticate",
    "message_id": <message id>,
    "ready": true
}

If authentication fails, the response will have an error field and will provide a new challenge.

{
    "message": "authenticate",
    "message_id": <message id>,
    "error": <error message>,
    "type": "SCAN",
    "name: <name>,
    "challenge": <new random challenge>
}

If any other message is sent before authentication succeeds, the error "Authentication not done" will be sent as a response.

5.3 Errors

If a message produces an error, response will have an error string field representing the error.

5.4 Sample nodejs program

You will find in this documentation a sample program: ws.js.
It is located in doc subdirectory.
This is a nodejs program that allow to send message to LTESCAN.
It requires nodejs to be installed:

dnf install nodejs npm
npm install nodejs-websocket

Use relevant package manager instead of NPM depending on your Linux distribution.

Then simply start it with server name and message you want to send:

./ws.js 127.0.0.1:9009 '{"message": "config_get"}'

5.5 Common messages

config_get

Retrieve current config.

Response definition:

typeconfig_get.type

Always "SCAN"

nameconfig_get.name

String representing server name.

logsconfig_get.logs

Object representing log configuration.
With following elements:

layersconfig_get.logs.layers

Object. Each member of the object represent a log layer configuration:

layer name

Object. The member name represent log layer name and parameters are:

levelconfig_get.logs.layers.root.level: See log_options
max_sizeconfig_get.logs.layers.root.max_size: See log_options
keyconfig_get.logs.layers.root.key: See log_options
cryptoconfig_get.logs.layers.root.crypto: See log_options
payloadconfig_get.logs.layers.root.payload: See log_options

countconfig_get.logs.count

Number. Number of bufferizer logs.

rotateconfig_get.logs.rotate

Optional number. Max log file size before rotation.

rotate_countconfig_get.logs.rotate_count

Optional number. Max log count before rotation.

pathconfig_get.logs.path

Optional string. Log rotation path.

bcchconfig_get.logs.bcch

Boolean. True if BCCH dump is enabled (eNB only).

mibconfig_get.logs.mib

Boolean. True if MIB dump is enabled (eNB only).

lockedconfig_get.locked

Optional boolean. If true, logs configuration can’t be changed with config_set API.

log_get

Get logs.
This API has a per connection behavior. This means that the response will depend on previous calls to this API within the same WebSocket connection.
In practice, logs that have been provided in a response won’t be part of subsequent request unless connection is reestablished. To keep on receiving logs, client should send a new log_get request as soon as the previous response has been received.
If a request is sent before previous request has been replied, previous request will be replied right now without considering specific min/max/timeout conditions.

Message definition:

minlog_get.min: Optional number (default = 1). Minimum amount of logs to retrieve.
Response won’t be sent until this limit is reached (Unless timeout occurs).
maxlog_get.max: Optional number (default = 4096). Maximum logs sent in a response.
timeoutlog_get.timeout: Optional number (default = 1). If at least 1 log is available and no more logs have been generated for this time, response will be sent.
allow_emptylog_get.allow_empty: Optional boolean (default = false). If set, response will be sent after timeout, event if no logs are available.
rntilog_get.rnti: Optional number. If set, send only logs matching rnti.
ue_idlog_get.ue_id: Optional number. If set, send only logs with matching ue_id.
layerslog_get.layers: Optional Object. Each member name represents a log layer and values must be string representing maximum level. See log_options.
If layers is not set, all layers level will be set to debug, else it will be set to none.
Note also the logs is also limited by general log level. See log_options.
shortlog_get.short: Optional boolean (default = false). If set, only first line of logs will be dumped.
headerslog_get.headers: Optional boolean. If set, send log file headers.
start_timestamplog_get.start_timestamp: Optional number. Is set, filter logs older than this value in milliseconds.
end_timestamplog_get.end_timestamp: Optional number. Is set, filter logs more recent than this value in milliseconds.
max_sizelog_get.max_size: Optional number (default = 1048576, i.e. 1MB). Maximum size in bytes of the generated JSON message. If the response exceeds this size, the sending of logs will be forced independently from other parameters.

Response definition:

logslog_get.logs

Array. List of logs. Each item is a an object with following members:

datalog_get.logs.data: Array. Each item is a string representing a line of log.
timestamplog_get.logs.timestamp: Number. Milliseconds since January 1st 1970. Not present if com_log_us is set in configuration.
timestamp_uslog_get.logs.timestamp_us: Number. Microseconds since January 1st 1970. Only present if com_log_us is set in configuration.
layerlog_get.logs.layer: String. Log layer.
levellog_get.logs.level: String. Log level: error, warn, info or debug.
dirlog_get.logs.dir: Optional string. Log direction: UL, DL, FROM or TO.
ue_idlog_get.logs.ue_id: Optional number. UE_ID.
celllog_get.logs.cell: Optional number (only for PHY layer logs). Cell ID.
rntilog_get.logs.rnti: Optional number (only for PHY layer logs). RNTI.
framelog_get.logs.frame: Optional number (only for PHY layer logs). Frame number (Subframe is decimal part).
channellog_get.logs.channel: Optional string (only for PHY layer logs). Channel name.
srclog_get.logs.src: String. Server name.
idxlog_get.logs.idx: Integer. Log index.
headerslog_get.logs.headers: Optional array. Array of strings.

discontinuitylog_get.discontinuity

Optional number. If set, this means some logs have been discarded due to log buffer overflow.

microsecondslog_get.microseconds

Optional boolean. Present and set to true if com_log_us is set in configuration file.

log_set

Add log.
Message definition:

loglog_set.log: Optional string. Log message to add. If set, layer and level are mandatory.
layerlog_set.layer: String. Layer name. Only mandatory if log is set.
levellog_set.level: String. Log level: error, warn, info or debug. Only mandatory if log is set.
dirlog_set.dir: Optional string. Log direction: UL, DL, FROM or TO.
ue_idlog_set.ue_id: Optional number. UE_ID.
flushlog_set.flush: Optional boolean (default = false). If set, flushes fog file.
rotatelog_set.rotate: Optional boolean (default = false). If set, forces log file rotation.
cutlog_set.cut: Optional boolean (default = false). If set, forces log file reset.

log_reset

Resets logs buffer.

license

Retrieves license file information.

Response definition:

productslicense.products: String. List of products, separated by commas.
userlicense.user: String. License username.
validitylicense.validity: String. License end of validity date.
idlicense.id: Optional string. License ID.
id_typelicense.id_type: Optional string. License ID type. Can be host_id or dongle_id
uidlicense.uid: Optional string. License unique ID.
filenamelicense.filename: Optional string. License filename.
serverlicense.server: Optional string. License server URL.
server_idlicense.server_id: Optional string. License server ID.

quit

Terminates ltescan.

help

Provides list of available messages in messages array of strings and events to register in events array of strings.

stats

Report statistics for LTESCAN.
Every time this message is received by server, statistics are reset.
Warning, calling this message from multiple connections simultaneously will modify the statistics sampling time.

Response definition:

cpustats.cpu: Object. Each member name defines a type and its value cpu load in % of one core.
instance_idstats.instance_id: Number. Constant over process lifetime. Changes on process restart.

register

registerregister.register: Optional string or array of string. List of messages to register to.
Can be cell, scan
unregisterregister.unregister: Optional string or array of string. List of messages to unregister.
Can be cell, scan

5.6 LTE messages

scan

Launches a scan on selected bands.
The response is sent when scanning is over.
During scanning, notification intermediate message will be sent to notify progress.
Closing connection before end of scan does not stop scanning.
If a scanning is already in progress, it will be stopped. Message definition:

bandscan.band

Number, string, object or array. Defines the list of bands to scan.
If an array is defined, all elements must be a number, string or object.
A number represents a LTE band number to scan.
A string represents a single band with the command line syntax (see below).

7: band LTE 7
7(3000): arfcn 30000 of band LTE 7
n78(7838,7850): gscn 7838 to 7850 on band NR 78

An object will have following properties:

bandscan.band.band: Number. Band to scan
typescan.band.type: String. Can be nr or lte.

Cell notification. Every time a cell is found, such notification is sent.

notificationscan.notification: String. Set as cell
bandscan.band: Number. Band
typescan.type: String. Can be nr or lte.
frequencyscan.frequency: Number. Cell center frequency in Hz.
dl_earfcnscan.dl_earfcn: Number. Downlink earfcn (LTE only).
dl_arfcnscan.dl_arfcn: Number. Downlink arfcn (NR only).
gscnscan.gscn: Number. SSB gscn (NR only).
nsascan.nsa: Optional boolean. Cell only supports NSA (no SIB1 scheduled, NR only).
mibscan.mib: String. Content of MIB in base64 encoding.
bandwidthscan.bandwidth: Number. Cell bandwidth in MHz.
n_rb_dlscan.n_rb_dl: Number. Number of resource blocks.
rssiscan.rssi: Number. RSSI in dBm.
rsrqscan.rsrq: Number. RSRQ in dB
rsrpscan.rsrp: Number. RSRP in dBm.
snrscan.snr: Number. SNR in dB.
n_antenna_pbchscan.n_antenna_pbch: Number. Number of antenna as reported in the PBCH (LTE only)
lte_mscan.lte_m: Boolean. Cell supports LTE-M (LTE only)
n_ssbscan.n_ssb: Number. Number of SSB (antennas) from ’ssb-PositionsInBurst’ in SIB1 (NR only)
ssb_indexscan.ssb_index: Number. SSB index as reported in MIB (NR only)
ssb_subcarrier_spacingscan.ssb_subcarrier_spacing: Number. SSB subcarrier spacing in KHz (NR only)
subcarrier_spacingscan.subcarrier_spacing: Number. subcarrier spacing in KHz (NR only)
uldl_configscan.uldl_config: Number. uldl config if TDD mode (LTE only)
special_subframe_configscan.special_subframe_config: Number. special subframe config if TDD mode (LTE only)
tp1_periodscan.tp1_period: Number. Period in ms of TDD Pattern_1 if TDD mode (NR only)
tp1_dl_slotsscan.tp1_dl_slots: Number. Number of DL slots in Pattern_1 if TDD mode (NR only)
tp1_ul_slotsscan.tp1_ul_slots: Number. Number of UL slots in Pattern_1 if TDD mode (NR only)
tp1_dl_symbsscan.tp1_dl_symbs: Number. Number of DL symbols in special slot in Pattern_1 if TDD mode (NR only)
tp1_ul_symbsscan.tp1_ul_symbs: Number. Number of UL symbols in special slot in Pattern_1 if TDD mode (NR only)
tp2_periodscan.tp2_period: Number. Period in ms of TDD Pattern_2 if TDD mode (NR only)
tp2_dl_slotsscan.tp2_dl_slots: Number. Number of DL slots in Pattern_2 if TDD mode (NR only)
tp2_ul_slotsscan.tp2_ul_slots: Number. Number of UL slots in Pattern_2 if TDD mode (NR only)
tp2_dl_symbsscan.tp2_dl_symbs: Number. Number of DL symbols in special slot in Pattern_2 if TDD mode (NR only)
tp2_ul_symbsscan.tp2_ul_symbs: Number. Number of UL symbols in special slot in Pattern_2 if TDD mode (NR only)
sib1scan.sib1: String. Content of LTE or NR SIB1 (if broadcasted). May be base64 encoding or JER depending on sib_format_jer.
sib2scan.sib2: String. Content of LTE or NR SIB2 (if broadcasted). May be base64 encoding or JER depending on sib_format_jer.
sib3scan.sib3: String. Content of LTE or NR SIB3 (if broadcasted). May be base64 encoding or JER depending on sib_format_jer.
sib4scan.sib4: String. Content of LTE or NR SIB4 (if broadcasted). May be base64 encoding or JER depending on sib_format_jer.
sib5scan.sib5: String. Content of LTE or NR SIB5 (if broadcasted). May be base64 encoding or JER depending on sib_format_jer.
sib6scan.sib6: String. Content of LTE SIB6 (if broadcasted). May be base64 encoding or JER depending on sib_format_jer.
sib7scan.sib7: String. Content of LTE SIB7 (if broadcasted). May be base64 encoding or JER depending on sib_format_jer.
sib24scan.sib24: String. Content of LTE SIB24 (if broadcasted). May be base64 encoding or JER depending on sib_format_jer.

Band notification. Every time a new band is being scanned, such notification is sent.

notificationscan.notification: String. Set as cell
bandscan.band: Number. Band
typescan.type: String. Can be nr or lte.

cells

Returns last scanning results. Response definition:

cellscells.cells: Array of object. Each item represents a cell as described in See Cell notification.
scanningcells.scanning: Boolean. If true, a scanning is in progress.

scan_rssi

Launches a RSSI scan on selected bands.
Results are returneded by frequency step (defined by rssi_width parameter). During scanning, notification intermediate message will be sent to notify progress.
Closing connection before end of scan does not stop scanning.
If a scanning is already in progress, it will be stopped. Message definition:

bandscan_rssi.band

Number, object or array. Defines the list of bands to scan.
If an array is defined, all elements must be a number or an object.
A number represents a LTE band number to scan. An object will have following properties:

bandscan_rssi.band.band: Number. Band to scan
typescan_rssi.band.type: String. Can be nr or lte.

RSSI notification. For every frequency step, a notification is sent.

notificationscan_rssi.notification: String. Set as rssi
frequencyscan_rssi.frequency: Number. Frequency in Hz.
arfcnscan_rssi.arfcn: Number. Downlink arfcn (LTE only).
rssiscan_rssi.rssi: Number. RSSI in dBm.

rssis

Returns last RSSI scanning results. Response definition:

rssisrssis.rssis: Array of object. Each item represents a cell as described in See RSSI notification.
scanningrssis.scanning: Boolean. If true, a scanning is in progress.

Exemple of scan command:

./ws.js -t 600 127.0.0.1:9009 '{"message": "scan","band":["7(3000)","n78"]}'

5.7 LTE events

Following events are sent by scanner to remote API client if they have been registered on WebSocket.

cell

Cell has been scanned. Same definition as See Cell notification.

scan

Provides information on scanning progress

notificationscan.notification: String. Can be band when a new band is being scanned, end when scanning is over.

5.8 Examples

Config

Client sends

{
    "message": "config_get",
    "message_id": "foo"
}

Server replies

{
    "message_id": "foo",
    "message": "config_get",
    "name": "UE",
    "logs": {
        "phy": {
            "level": "error",
            "max_size": 0
        },
        ...
        "rrc": {
            "level": "debug",
            "max_size": 1
        }
    }
}

Error

Client sends

{
    "message": "bar",
    "message_id": "foo"
}

Server replies

{
    "message_id": "foo",
    "message": "bar",
    "error": "Unknown message: bar"
}

6 Command line monitor reference

The following commands are available:

help

Display the help. Use help command to have a more detailed help about a command.

t [port]

Activate various traces on the console. The display is stopped when typing return. The default trace is the current scan status. An optional RF port may be given for cpu and spl traces.

Available traces:

scant scan: Display current scan information.
cput cpu: Display the CPU usage from the TRX (transceiver) API and the TX-RX latency statistics.
splt spl: Display various statistics about the sent and received complex samples (at the TRX API level). For the TX side, the RMS and maximum sample value are displayed. The number of saturation events (abs(sample) > 1) are displayed too. For the RX side the RMS and maximum sample value are displayed. The unit is dB FS (dB Full Scale). 0 dB FS is reached with a square signal of amplitude 1.

scan bands

Start a cell scan on the specified band(s); LTE band: 1..256; NR band: n1..n256 You can also add arfcn/gscn limits for each band. Examples:
scan 7 20 will scan bands LTE 7 and 20
scan 7(3000) scan arfcn 3000 on band LTE 7
scan n78(7838,7850) scan gscn 7838 to 7850 on band NR 78

scan_rssi bands

Start a RSSI scan on the specified band(s); LTE band: 1..256; NR band: n1..n256

com

COM connection status.

7 Log file format

7.1 PHY layer

When a PHY message is dumped (debug level), the format is:

time layer dir ue_id cell rnti frame.subframe channel:short_content
        long_content

time: Time using the selected format.
layer: Layer ([PHY] here).
dir: UL (uplink) or DL (downlink).
ue_id: eNodeB UE identifier (hexadecimal, unique among all cells).
cell: Low 8 bits of the cell identifier (hexadecimal).
rnti: Associated RNTI (hexadecimal) or - if none.
frame.subframe: Frame number (0-1023) and either subframe number (0-9) for LTE and NB-IoT cells or slot number for NR cells.
channel: PHY channel name (e.g. PUSCH, PUCCH, PRACH, SRS, PSS, PBCH, PDSCH, PHICH, PDCCH, EPDCCH, ...).
short_content: Single line content.
long_content: Hexadecimal dump of the message if phy.max_size > 0.

8 Change history

8.1 Version 2026-03-13

added LTE bands 246 and 249 definition
added NR bands 68, 87, 88, 110 and 252 definition
added sib_inter_rat parameter. Note that NR SIB5 is now only reported when this parameter is set to true
added sib6, sib7 and sib24 parameters to notification remote API event

8.2 Version 2025-12-12

OpenSSL library is upgraded to 3.5.4
added LTE bands 111, 112, 113 and 252 definition
added NR bands 247, 248, 250, 251 and 253 definition

8.3 Version 2025-09-19

dump MIB for NSA cells also in cell notification
added SCS and BW for NR NSA cells in NR console display

8.4 Version 2025-06-13

renamed ntx parameter to n_ssb for NR console display

8.5 Version 2025-03-14

the crc=KO log is renamed to crc=FAIL

8.6 Version 2024-12-13

added sib_format_jer parameter

8.7 Version 2024-09-13

added LTE bands 107 and 108 definition
added mib parameter to cell notification
added license remote API
com_logs_lock parameter is renamed to com_log_lock. com_logs_lock is still supported for backward compatibility
added com_log_us parameter

8.8 Version 2024-06-14

OpenSSL library is upgraded to 1.1.1w
added NR band 54 definition
added lte_m and nsa parameters to cell notification
added MIB info for WS API

8.9 Version 2024-03-15

added LTE bands 106, 253 and 254 definition
added NR bands 31, 72, 105, 109 and 254 definition

8.10 Version 2023-12-15

added loop_count and loop_delay to remote API messages
added sim_events, sim_events_loop_count and sim_events_loop_delay
added com_ssl_ca parameter for SSL verification

8.11 Version 2023-06-10

com_logs_lock parameter added to disable logs configuration change via remote API

8.12 Version 2023-03-17

com_addr parameter now uses [::] address instead of 0.0.0.0 in the delivered configuration file to allow IPv6 connection

8.13 Version 2022-12-16

utc parameter is added to remote API response messages

8.14 Version 2022-06-17

OpenSSL library is upgraded to 1.1.1n
start_timestamp and end_timestamp are added to log_get API

8.15 Version 2022-03-18

Added Introduction
Added sample config file
Use retransmission to improve all SIB decoding in low SNR conditions
Indicate NSA cells
Fixed cell detection when SSB spacing is different
Fixed BWP parsing

9 License

ltescan is available without any express or implied warranty. In no event will Amarisoft be held liable for any damages arising from the use of this software.

For more information on licensing, please refer to license terms.

License terms

Amarisoft SAS - www.amarisoft.com
16-18 rue Rivay, 92300 LEVALLOIS PERRET, France SAS with a capital of 300,000 Euros - VAT FR21753998269 - SIREN: 753998269 (RCS Nanterre) - NAF 6201Z – DUNS 264482426

SOFTWARE LICENSE TERMS
NOTICE: THE AMARISOFT SOFTWARE PRODUCT, TOGETHER WITH ITS ACCOMPANYING DOCUMENTATION,
(THE "PRODUCT") IS THE PROPERTY OF AMARISOFT. THE PRODUCT IS MADE AVAILABLE TO YOU, THE
PURCHASER, SUBJECT TO THE FOLLOWING LICENSE AGREEMENT ("LICENSE AGREEMENT"). PLEASE READ
THIS LICENSE CAREFULLY BEFORE INSTALLING OR USING THE PRODUCT. A COPY OF THIS LICENSE IS
AVAILABLE FOR YOUR FUTURE REFERENCE IN THE "LICENSE.TXT" FILE PROVIDED WITH THE PRODUCT.
IF YOU DO NOT AGREE TO THE TERMS AND CONDITIONS OF THIS AGREEMENT AND THE TERMS AND
CONDITIONS OF ANY APPLICABLE LICENSE AGREEMENTS OR NOTICES INDICATED OR REFERENCED BELOW,
THEN YOU MAY NOT USE THE PRODUCT. ANY USE BY YOU OF THIS PRODUCT OR INSTALLATION OF THE
PRODUCT ALSO CONSTITUTES YOUR ACCEPTANCE OF THESE TERMS.
AMARISOFT is only willing to grant you a license under this License Agreement if you obtained the Product
from AMARISOFT or an AMARISOFT authorized distributor or reseller, a list of which is available on
AMARISOFT website. If you obtained the Product from any other source you may not install or use the
Product.

1. GRANT OF LICENSE AND SCOPE OF USE
For each license that you acquire to use the Product, you will be provided with a License Certificate (a "License
Certificate"), which may be either a certificate, the installation and licensing instructions, your invoice, or an
activation file and which may be provided to you either with the Product media or separately by AMARISOFT
or its authorized distributors or resellers. The License Certificate will contain information specific to the
Product, the type of license under which you may use the Product and the number of licenses that you have
acquired. In order to activate and use the Product as set forth in this License Agreement, you must follow the
instructions when prompted by the Product.
The type of license you may acquire is a Standard License or a Floating License, all defined in Sections 1.1 and
Section 1.2 of this License Agreement. Unless your License Certificate identifies your acquisition of another
license type, you have acquired a Standard License. For more information on which license types, if any, is
included with the Product media, you should contact AMARISOFT or your AMARISOFT authorized distributor or
reseller.
Unless otherwise agreed, one (1) AMARISOFT license provides the right to use only one instance of the Product
software at a time.
Subject to the other terms and conditions of this License, you may make a reasonable number of copies of the
Product to backup devices such as hard disks, optical media, or tape and one (1) physical CD media backup
copy of the Product solely to replace the original copy provided to you if the original copy is damaged or
destroyed. All rights not specifically granted to you herein are retained by AMARISOFT.

1.1 Standard License
The terms of this Section 1.1 are applicable to you only if you have purchased a Standard License, as defined
below, for the Product directly from AMARISOFT or an AMARISOFT authorized distributor or reseller.
Subject to the terms and conditions of this License, AMARISOFT grants you, if you are an individual or if you
are an entity, a personal, non-exclusive, non-transferable and limited license to use the Product solely with
one (1) designated single hardware in your organization (a "Standard License"). This hardware is either a
Personal Computer that you hold in your organization or that AMARISOFT has supplied you. This hardware can
also be a USB device supplied by AMARISOFT.
You may purchase from AMARISOFT or an AMARISOFT authorized distributor or reseller additional licenses to
permit multiple hardware to use the Product. This right shall be agreed in writing. The Standard License shall
provide you with the right to access and use the Product, only for the number of hardware for which you have
paid the applicable license fees and obtained a License Key Certificate. The Product may be used exclusively by
the specifically designated hardware, subject to all the terms and conditions of this License Agreement. You
agree that you will not designate more hardware than the number of Standard Licenses that AMARISOFT or an
AMARISOFT authorized distributor or reseller has expressly granted you and you will not allow the Product to
be used by any hardware other than the hardware designated by you.

1.2 Floating License
The terms of this Section 1.2 are applicable to you only if you have purchased a Floating License, as defined
below, for the Product directly from AMARISOFT or an AMARISOFT authorized distributor or reseller.
Subject to the terms and conditions of this License, AMARISOFT grants you, if you are an individual or if you
are an entity, a personal, non-exclusive, non-transferable and limited license to use the Product from our
floating license server in your organization ("FLS"). Our floating license server will allow you to run the license
on a virtual machine and thus use it on any hardware in your organization (an "FLS License").
You may purchase from AMARISOFT or an AMARISOFT authorized distributor or reseller additional licenses
and place them on our license server to permit multiple hardware to use the Product.

2. SPECIAL TERMS
The following terms and conditions ("Special Terms") are specific to certain editions, versions and components
of the Product and are in addition to the provisions of Section 1. If any provision of the Special Terms
applicable to the Product conflicts with any other provision of this License, then the provision of the Special
Terms will supersede and control.

2.1 Additional license terms applicable to third party software
Certain components of the Product use or incorporate third-party software programs and/or libraries ("Third-
Party Software"), which are loaded or integrated (in both object and source code form) on the Product. You
agree that AMARISOFT's third-party licensors and suppliers are intended third party beneficiaries of all terms
and conditions of this License intended to protect intellectual property rights in the Product (including the
Third-Party Software) and limit certain uses thereof.

3. LIMITATIONS
You may not:
(a) modify, adapt, alter, translate or create derivative works of the Product or merge the Product with other
software other than as described in the Product's accompanying documentation or as approved of in writing
by AMARISOFT;
(b) lease, rent or loan the Product to any third party;
(c) sublicense, distribute or otherwise transfer the Product or any component thereof to any third party except
as expressly authorized in this Agreement;
(d) reverse engineer, decompile, disassemble or otherwise attempt to derive the source code of the Product;
(e) remove, alter or obscure any confidentiality or proprietary notices (including copyright and trademark
notices) of AMARISOFT or its licensors or suppliers on or accompanying the Product;
(f) allow third parties to access or use the Product including but not limited to using the Product in a time-
sharing arrangement, operating the Product as part of a service bureau or, except as expressly authorized
under Sections 1 and 2 otherwise using the Product for the use or benefit of third parties;
(g) reproduce or use the Product except as expressly authorized under Sections 1 and 2;
(h) use the Product with any other hardware than the hardware designated in your organization; or
(i) disclose or publish performance benchmark results for the Product. The rights granted under this License
apply only to this Product.
You must procure a separate license to use other AMARISOFT software. Furthermore, you may not permit end
users of the Product ("End Users") to conduct the restricted activities limited by items (a) through (e), (g) and
(i) above insofar as they apply to certain files, libraries and/or source code specifically designated as
"redistributables" by AMARISOFT in the accompanying printed or on-line documentation and that are
necessary to use your own application programs and other works created using the Product
("Redistributables"), and such End User's sublicense rights to the Redistributables are conditioned upon
compliance with such limitations. The limitations in this Section 3 apply equally to your use of the Product, in
whole or in part, including any component or Redistributable.

4. LIMITED WARRANTY AND DISCLAIMER
AMARISOFT warrants you, the initial purchaser and no other party, that any physical media included with the
Product, as and when provided to you, will be free of physical defects in materials and workmanship for a
period of thirty (30) days after the date that you initially acquire the Product.
Your exclusive remedy and AMARISOFT's sole liability for breach of this warranty is that AMARISOFT will
replace any defective media returned to AMARISOFT within the thirty (30) day warranty period. This warranty
does not apply to damages resulting from misuse, abuse or neglect. Any replacement media will be warranted
as above for the remainder of the original warranty period or twenty (20) days from the date we ship it to you,
whichever is longer.
EXCEPT FOR THIS EXPRESS LIMITED WARRANTY, THE PRODUCT IS PROVIDED "AS IS" AND WITHOUT
WARRANTY OF ANY KIND. AMARISOFT HEREBY EXCLUDES AND DISCLAIMS ALL IMPLIED OR STATUTORY
WARRANTIES, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE,
QUALITY, NONINFRINGEMENT, TITLE, RESULTS, EFFORTS OR QUIET ENJOYMENT. THERE IS NO WARRANTY
THAT THE PRODUCT WILL BE ERROR-FREE OR WILL FUNCTION WITHOUT INTERRUPTION. YOU ASSUME THE
ENTIRE RISK FOR THE RESULTS OBTAINED USING THE PRODUCT. TO THE EXTENT THAT AMARISOFT MAY NOT
DISCLAIM ANY WARRANTY AS A MATTER OF APPLICABLE LAW, THE SCOPE AND DURATION OF SUCH
WARRANTY WILL BE THE MINIMUM PERMITTED UNDER SUCH LAW.

5. SERVICES, UPDATES AND PRODUCT CHANGES
AMARISOFT is not required under this License Agreement to provide any installation, maintenance service,
training or other services to you, except those expressly provided herein. Such services, if available, must be
purchased separately.
If, pursuant to a separate support agreement or otherwise, AMARISOFT provides you with a new release, error
correction, update, upgrade or other modification to the Product, such modification will be deemed part of the
Product, and subject to the terms of this License Agreement, unless the modification is expressly provided
subject to a separate License Agreement.
AMARISOFT reserves the right at any time not to release or to discontinue release of any Product and to alter
prices, features, specifications, capabilities, functions, licensing terms, release dates, general availability or
other characteristics of any future releases of the Product.

5.1 Support extension
Unless otherwise indicated, AMARISOFT License includes a one-year email support period and update.
You can subscribe to an additional one-year support and update period, at the latest within the four months
following the expiry date of the initial purchase. You can then renew subscription to this extension every year,
with the same four-month deadline. The extended support and update period starts on the day after the initial
expiry date.
Once this four-month deadline is over, an extra administrative reactivation fee is invoiced in addition to the
extension cost. The extended support and update period starts when payment of the corresponding invoice is
received.

6. REGISTRATION
You must register the Product with AMARISOFT as a condition to your rights to use the Product.
For all concerned, you will be asked to provide identification information on the hardware (serial number,
internal inventory number, other) you plan to install the Product on.

7. CONFIDENTIALITY
You acknowledge that if part of the Product in source code form exists, it remains a confidential trade secret of
AMARISOFT. You agree to hold this information in confidence, not to disclose it to any person, and not to use it
for any purpose other than the use and operation of the Product as permitted under this License Agreement.

8. LIMITATION OF LIABILITY
IN NO EVENT WILL AMARISOFT BE LIABLE TO ANY PARTY FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL,
EXEMPLARY, SPECIAL OR PUNITIVE DAMAGES, INCLUDING ANY LOSS OF PROFIT, REVENUE, BUSINESS
OPPORTUNITY OR DATA, ARISING FROM OR RELATING TO THIS LICENSE AGREEMENT OR THE PRODUCT,
WHETHER IN CONTRACT, IN TORT, NEGLIGENCE OR OTHERWISE, EVEN IF AMARISOFT KNEW, SHOULD HAVE
KNOWN OR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. AMARISOFT'S TOTAL CUMULATIVE
LIABILITY ARISING FROM OR RELATED TO THIS LICENSE AGREEMENT OR THE PRODUCT, WHETHER IN
CONTRACT, IN TORT OR OTHERWISE, WILL NOT EXCEED THE FEES ACTUALLY PAID BY YOU UNDER THIS
LICENSE AGREEMENT. THIS SECTION 8 WILL APPLY EVEN IF AN EXCLUSIVE REMEDY HEREUNDER HAS FAILED
OF ITS ESSENTIAL PURPOSE.

9. TERM AND TERMINATION

9.1 Term
The term of this License Agreement will begin as of the date that you receive the Product and will remain in
effect unless terminated under this Section 9.

9.2 Termination for Convenience
You may terminate this License Agreement for any reason, or for no reason, by giving AMARISOFT a five-day
(5) written notice. You shall not be entitled to request repayment of any fee or payment made to AMARISOFT.

9.3 Termination for Cause
AMARISOFT may terminate this License Agreement if you breach your obligations hereunder. AMARISOFT will
affect such termination by giving you notice of termination, specifying therein the alleged breach. If your
breach is curable, you will have a grace period of thirty (30) days after such notice is served to cure the breach
described therein. If the breach is cured within the thirty (30) day grace period, then this License Agreement
will remain in effect; otherwise, this License Agreement will automatically terminate upon the conclusion of
the thirty (30) day grace period.

9.4 Effect of Termination
Upon the termination of this License Agreement for any reason the following terms shall apply:
(a) all rights granted under this License Agreement will immediately terminate and you must stop all use of the
Product and any Redistributables;
(b) you must return to AMARISOFT or destroy all copies of the Product provided to or made by you, and will,
within ten (10) days after the effective date of termination, provide AMARISOFT with written certification that
all such copies have been returned or destroyed; and
(c) all provisions of this License Agreement with the exception of the licenses granted in Sections 1 and 2, will
survive termination of this License Agreement for any reason.

10. GENERAL PROVISIONS

10.1 Audit
If you are entering into this License Agreement as an entity other than an individual (e.g., as a corporation, a
partnership, or other organization), during the term of this License and for three (3) years thereafter,
AMARISOFT or its outside auditors will have the right to conduct an audit of your records and computer
systems to verify that you have paid to AMARISOFT the correct amounts owed under this License Agreement
and determine whether the Products are being used in accordance with the terms of this License Agreement.
Any audit will be conducted during regular business hours at your facilities, with reasonable notice. You agree
to provide the audit team access to the relevant records and facilities and to provide reasonable assistance to
AMARISOFT in connection with this provision. You agree to pay the cost of the audit if any underpayments
during the period covered by the audit amount to more than five percent (5%) of the fees actually owed or if
the number of deployments of the Products is more than five percent (5%) of that licensed.

10.2 Hazardous Uses
The Product is not intended for use in connection with any application requiring fail-safe performance such as
the operation of nuclear power facilities, air traffic control or navigation systems, weapons control systems,
life support systems, or any other system whose failure could lead to injury, death, environmental damage or
mass destruction. You agree that AMARISOFT will have no liability of any nature, and you are solely
responsible, for any expense, loss, injury or damage incurred as a result of such use of the Product.

10.3 Entire License and Severability
This License Agreement constitutes the entire, final and exclusive agreement between you and AMARISOFT
regarding the specific license transaction described herein. If any provision of this License Agreement is held to
be illegal, invalid or unenforceable for any reason, then such provision will be enforced to the maximum extent
permissible and the remainder of the provisions of this License Agreement will remain in full force and effect.

10.4 Assignment
You may not transfer the Product, assign this License Agreement or assign any of your rights or delegate any of
your obligations under this License Agreement, by operation of law or otherwise (including by merger, sale of
assets or consolidation), without AMARISOFT's prior written consent. Any attempted assignment in violation
of this Section 10.4 will be void.

10.5 Export Control
You may not directly or indirectly transfer the Product, including its documentation, to any country if such
transfer would be prohibited by applicable law. You agree to the foregoing and you are representing and
warranting that you are not located in, under the control of, or a national or resident of any such country. You
will be solely responsible for identifying and complying with all laws of any jurisdiction regarding the import,
export or use of Products and technical data supplied by AMARISOFT. You will obtain at your own expense all
licenses, permits or approvals required by any government to use the Product.

10.6 Waiver and Modifications
All waivers must be in writing. Any waiver or failure to enforce a provision of this License Agreement on one
occasion shall not be deemed a waiver of any other provision or such provision on any other occasion. This
License Agreement may only be amended by a written document signed by both parties.

11. CRYPTOGRAPHY
The Product and the content provided by AMARISOFT may contain encryption software. The country in which
you are currently may have restrictions on the import, possession, and use, and/or re-export to another
country, of encryption software. BEFORE using any encryption software, please check the country's laws,
regulations and policies concerning the import, possession, or use, and re-export of encryption software, to
see if this is permitted.

12. NON-RECURRING ENGINEERING
The intellectual property of all items designed, developed and manufactured by AMARISOFT resides and
remains with AMARISOFT. The payment of Non-Recurring Engineering (NRE) charges by you does not confer
any rights to the intellectual property of any designs which emanate directly or indirectly from the
development. As part of any contract, whether it includes the payment of NRE or not, you must accept
without reservation that AMARISOFT is the rightful owner of all intellectual property rights for the Product
and/or other products which are supplied under this Licence Agreement or standard supplies to you. You must
not copy, or allow any third party to copy the designs of any AMARISOFT's products.

Table of Contents

1 Introduction

2 Requirements

2.1 Hardware requirements

2.2 Software requirements

3 Installation

3.1 Linux setup

3.1.1 Packages

3.1.2 OpenSSL

3.2 RRH setup

3.2.1 Amarisoft PCIe SDR

3.3 LTESCAN installation

4 Configuration reference

4.1 Configuration file syntax

4.1.1 JSON merge rules

4.2 Global properties

5 Remote API

5.1 Messages

5.2 Startup

5.3 Errors

5.4 Sample nodejs program

5.5 Common messages

5.6 LTE messages

5.7 LTE events

5.8 Examples

6 Command line monitor reference

7 Log file format

7.1 PHY layer

8 Change history

8.1 Version 2026-03-13

8.2 Version 2025-12-12

8.3 Version 2025-09-19

8.4 Version 2025-06-13

8.5 Version 2025-03-14

8.6 Version 2024-12-13

8.7 Version 2024-09-13

8.8 Version 2024-06-14

8.9 Version 2024-03-15

8.10 Version 2023-12-15

8.11 Version 2023-06-10

8.12 Version 2023-03-17

8.13 Version 2022-12-16

8.14 Version 2022-06-17

8.15 Version 2022-03-18

9 License

License terms