Table of Contents
ZTE MT667 by O2
By strange reasoning I got offered a USB Mobile Internet Stick by my DSL carrier O2. This is how I made use of it
The Stick
The Stick is labeled “O2”, has a SIM card slot and an SD card slot. On USB bus, it identifies itself with 19d2:1405 as an ethernet device. Network access is available by an ethernet emulation with an DHCP server and webserver onboard, The webserver provides an (web)interface to configure the stick, manage contacts on the SIM card and send and read SMS. But its not accessible by standard modem/PPP/SMS clients via an serial emulation - WTF? According to the USB ID is could be an ZTE MF831. Some many steps later, It identifies itself by AT commands as an ZTE MF667.
The Solution
It turned out, the webserver had a “hidden config option” / “easteregg”: By calling the URL http://192.168.0.1/goform/goform_process?goformId=MODE_SWITCH&switchCmd=FACTORY it switched to modem mode!
Tools
I use NetworkManager for managing connections on the desktop level, wammu for accessing phones (reading data, sending SMS). ModemMangers GUI was not much of a help, but gtkterm as a serial console did its job very well.
Connecting to the network
But that was not the end of the struggle, nothing worked “out of the box”. Actually, I got it working as an PPP uplink with NetworkManager, I missed what change made it work - maybe I just misspelled some configuration option in the beginning. For sure, I was not patient enough: After enabling “Broadband connection” the NetworkManagers applet reports “You are now registered on the home network”. This means that you 're registered to you cell phones network - no TCP/IP! You have to wait for that, then select the Broadband connection configuration for the SIM in use and wait again until a 3G (or whatever) connection is established over the cell phone network. (visual effects are the same as when waiting for a WIFI connection to be set up)
Recieving SMS
For a start, I wanted to use wammu for recieving SMS. Unfortunately the sticks status light got red after I disconnected it from NetworkManger, meaning it disconnected from the cellular network.
Entering
AT+ZOPRT=5
in gtkterm switched it back to the network. By1)
AT+ZSNT=...
it can be pushed of forced to specific network types.
Thankfull i got some service provider send me some SMS for free to the SIMs phone number. Nothing showed up. I believe, help was comming from the AT commands 2)
Using SIM cards memory for all types of SMS (send, recieved, …)
AT+CPMS="SM","SM","SM"
Switch from PDU to text mode:
AT+CMGF=1
Enable notification on serial line (avoid polling)
AT+CNMI=3,1,2,2,0
And read all SMS:
AT+CMGL="ALL"
I got new messages notified on the serial line seen by gtkterm, I needed to poll with wammu nevertheless.
Strange disconnects
Every time I send a USSD code or a SMS was expected to come in, the dongle disconnected from the USB bus of my PC and reconnected any momement later. Acutally the stick is providing the ports /dev/ttyUSB0
, /dev/ttyUSB1
and /dev/ttyUSB2
(sometimes - after a disconnect - /dev/ttyUSB3
instead of /dev/ttyUSB2
). I did most experiments with /dev/ttyUSB2
but it seems I did not get disconnects when using /dev/ttyUSB1
. However /dev/ttyUSB0
is something different - I didn't manage to get response to any AT commands here.
USSD Codes
I struggled getting USSD codes to work. Searching in the web yielded some reports, that upgrading the linux system did help. And … well .. switching to an old laptop with a quite recent version of Linux MINT did help …
Command (this time on minicom) to get my balance is:
AT+CUSD=1,"*100#",15
The immediate response was an OK
, but a few moments later, I got something like
+CUSD: 0,"<a lot of characters>",72
While neither gammu3) nor ModemManager showed any results to USSD Code submission, gsm-ussd did the Trick.
Other Codes
Other codes that worked with gtkterm or minicom:
Get signal strength:
AT+ZRSSI
Get operation mode:
AT+ZPAS?
Check possible locks:
AT+ZSEC?
Get manufacturer:
AT+CGMI
Get available networks (only on recent MINT):
AT+COPS=?
Revert Modem Mode (i.e. back to Ethernet Mode):
> ATZ OK > AT&F OK > AT+ZCDRUN=9 Open autorun state result(0:FAIL 1:SUCCESS):1 OK > AT+ZCDRUN=F exit download mode result(0:FAIL 1:SUCCESS):1 OK
Credits
Credits to the sources that allowed me to learn the stuff above
- http://www.3g-modem-wiki.com/page/ZTE+AT-commands let me start with network connections
- https://hristoborisov.com/index.php/projects/turning-the-raspberry-pi-into-a-sms-center-using-python/ teached me what to search for, so I found
- https://stackoverflow.com/questions/29290639/sms-not-arriving-in-the-sm-storage-on-zte-mf667 which helped me to keep and find recieved SMS
Further Reading
Some links I found interessting, but were not used for the compilation above