Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem
After wikipedia: The Broadband Global Area Network (BGAN) is a global satellite network with telephony owned by Inmarsat using portable terminals. The terminals are normally used to connect a laptop computer to broadband Internet in remote locations, although as long as line-of-sight to the satellite exists
From technical perspective BGAN is an UMTS compatible network running on L-Band satellite frequencies - with the terminal receiving frequencies of 1525.0-1559.0MHz & transmitting frequencies of 1626.5-1660.5MHz. BGAN is standarized under ETSI GMR-1 standard.
RBGAN (Regional BGAN) was initial service offering by Inmarsat, limited to 144 kbps and using leased regional beams from Thuraya satellites. After Inmarsat I-4 satellites were deployed, service was superseded by BGAN with more beams and higher capacity.
Goal of this reverse engineering effort is to get access to potential debugging modes to decode Inmarsat BGAN control channels (as I suppose control channels are still compatible between RBGAN and BGAN). Same goal can be probably achieved using SDR radio and Osmocom GMR project as both BGAN and Thuraya use GMR-1 protocols.
Terminal connectivity
Hughes 9101 can be interfaced using Ethernet, Bluetooth and USB.Only one interface can be active - you select interface using "select" button and then modem restarts with selected interface active. To check what interface is active - press "select" for 2 seconds and proper LED blinks for a very short time.
- Bluetooth - device is detected as some kind of ancient Bluetooth PPP profile, probably additional drivers are needed (bluetooth password: "blue")
- USB - no known drivers, although I suspect this is some kind of virtual/RNDIS-type device, showing as ethernet network card on your PC
- Ethernet (actually works)
IP address: 192.168.128.100
Open ports
| Port number | Protocol | Description |
|---|---|---|
| Port number | ||
| 21 | TCP | FTP - user/password is: eetadmin/eetlogin
FTP according to documentation is used to upgrade the firmware using PC application (not found anywhere yet). It is also possible to download and upload modem config file. |
| 23 | TCP | Telnet - user/password is: eetadmin/eetlogin
After authorization, VxWorks kernel shell starts on console. |
| 80 | TCP | Web interface. Used to configure device and assists with pointing it to the proper satellite. Part of the interface is in Java and uses proprietary debug interface.
Please note that without BGAN SIM car, web interface will not start - leaving you with an error message. You cannot trick it by inserting regular SIM card. |
Operating system
OS is VxWorks 5.4.2 working on Intel SmartARM ARMSA1100
VxWorks (for HNS inmEET - ARMSA1110) version VxWorks5.4.2.
Kernel: WIND version 2.5.
Made on Jul 11 2005, 14:12:40.
Boot line:
tffsBootDev(0,0)host:/tffs0/vxWorks h=192.168.128.50 e=192.168.128.100:ffffff00 g=192.168.128.200 u=anonymous pw=inmarsat o=ekh
value = 140 = 0x8c
