Using ping from adb shell on Quectel RM500Q-AE 5G Modem

[jakeresearch]

I'm conducting research on 5G network traffic using a Quectel RM500Q-AE modem and a 5G network in a box and having issues just doing a basic ping from the device to the network using adb.
The modem itself is part of a Wireless Haven adapter enclosure: https://thewirelesshaven.com/shop/mini- ... dapter-v7/

The 5G network core assigns the modem an IP address:

Code: Select all

CGPADDR: 1,"192.168.3.2"

and the modem can ping the network using AT+QPING and the network can ping the modem.

Code: Select all

AT+QPING=1,"8.8.8.8",5,5
OK

+QPING: 0,"8.8.8.8",32,39,255
+QPING: 0,"8.8.8.8",32,40,255
+QPING: 0,"8.8.8.8",32,72,255
+QPING: 0,"8.8.8.8",32,40,255
+QPING: 0,"8.8.8.8",32,34,255
+QPING: 0,5,5,0,34,72,44

However, within 'adb shell' mode, I haven't been able to do so. Here are the default routes when entering adb shell.

Code: Select all

/tmp # route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.225.0   0.0.0.0         255.255.255.0   U     0      0        0 bridge0

And the default ifconfig -a results:

Code: Select all

bridge0   Link encap:Ethernet  HWaddr 76:70:B1:FB:F7:DF  
          inet addr:192.168.225.1  Bcast:192.168.225.255  Mask:255.255.255.0
          inet6 addr: fe80::7470:b1ff:fef8:f4dc/64 Scope:Link
          UP BROADCAST PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:516 (516.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

rmnet_ipa0 Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          UP RUNNING  MTU:9216  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

The different network interfaces that are available are: bridge0, erspan0, gre0, gretap0, ip6gre0, ip6tnl0, lo, rmnet_data0... rmnet_data5, rmnet_ipa0, sit0, tunl0.
I've messed around with configuring the ip routing options (some of the below commands are just a few examples) and haven't had any luck.
ifconfig rmnet_data0 up
ifconfig rmnet_data0 192.168.225.2
route add default gw 192.168.225.2 rmnet_data0

Code: Select all

/ # ping 8.8.8.8
connect: Network is unreachable
/ # ping -I bridge0 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from 192.168.225.1 bridge0: 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
10 packets transmitted, 0 received, 100% packet loss, time 358ms
pipe 4

I really appreciate any help!

[Didneywhorl]

Clarify for me. I am not familiar with the adb shell of the Quectel modems, at all ... are you running the ping from the host device command line here/above or is that via the adb shell?

The gateway address on the routing table confuses me, as you are attempting to ping an external address (8.8.8.8), no? Wouldn't you need a gateway defined if you are accessing external networks from the device in question? I'm not super knowledgeable on routing tables, so there is that.


Also, how did you get the AT+QADBKEY? answer?

I'm assuming you just asked Quectel, but am always on the lookout for a working generator.

[jakeresearch]

Thanks for the reply! I figured it out -- turns out it was a simple Quectel AT command...

Code: Select all

AT+QETH="rgmii","ENABLE",1,0
//Enable RGMII data call of COMMON mode and perform data
call with the default APN.

By running this command, the rmnet_data0 interface automatically gets set up and the routing table is updated.

Yes, I had entered the shell via the 'adb shell' command and was trying to run ping from the modem to my 5G network.

I provided Quectel the output of the AT+QADBKEY? command and they provided me the password to provide to AT+QADBKEY=<password>. You can then change AT+QCFG="usbcfg" to allow for adb capability.

[Didneywhorl]

Ok, cool.

I figured you asked Quectel, that is how I get it for customers.

I was hoping for a generator tool.

[Didneywhorl]

Do you have documentation on the adb tools and use on the Quectel modems?

[jakeresearch]

No, I don't have any documentation specific to adb's use on Quectel modems, though the only commands I need to run on there are:

Code: Select all

// start server and list devices
adb devices

Code: Select all

// launch shell
adb shell

Code: Select all

 // push file to modem or retrieve file from modem
adb push <file location on host computer > <desired file location on modem>
adb pull  <file location on modem> <desired file location on host computer> 

From there I can run any statically compiled binary on the modem itself.

[Didneywhorl]

What do you typically do on these?

Doesn't the ECM mode have it's own webUI as well on these? I swear I've seen that somewhere. Not ADB related exactly, but... :shrug:

[carp4]

I was hoping for a generator tool.

Here’s one.
https://github.com/carp4/qadbkey-unlock