Wi-Fi Halow 801.11AH - Cheap Aliexpress bridge / TX-AH-R900PNR module

[dmahony]

I was searching for Wi-Fi Halow devices and found this fairly priced kit on Aliexpress:
https://www.aliexpress.com/item/1005005701215525.html?spm=a2g0o.order_list.order_list_main.183.53701802dswxPD

I have had it for a couple of weeks and initially wrote it off as just a simple transparent Wi-Fi bridge.
It looks like there are no configuration options but after searching for info I found a tool that lets you use AT commands. I used the commands to lower the bit rate / Modulation Coding Scheme to 150Kbps!

Here is some more information about this device if anyone is interested:
https://fcc.report/FCC-ID/2AXPI-R900/5139047.pdf
lots of tools and an SDK on the developers website, apparently able to be downloaded once registered:
https://en.taixin-semi.com/Product?prouctSubClass=33
*confirmed, lots of good stuff there.

Thread with lots of good info:
https://discuss.ardupilot.org/t/802-11ah-halow-iot-wifi-920mhz/92988/16

I think it has some potential to be used for Reticulum, especially the Wi-Fi Halow built in features like repeater modes and meshing.

Has anyone else here tried these devices? or any other Halow Devices? I have these and several others, I will post more if people are interested.

Here is a quick recording of running an Iperf3 Speed test, Reticulum Shell and Internet speed test:

https://youtu.be/6nL4PhyddSk

[dmahony]

I got a different device working with these:

Looks to be the same module but in a barebones version.

Link I purchased from:
https://www.aliexpress.com/item/1005004589176264.html?spm=a2g0o.order_list.order_list_main.118.7bf41802xOYjgy

[dmahony]

Seems to be having issues using 1Mhz mode, so used 2Mhz:

[4847889]
LMAC STATUS:
local: ba: 4:59:6d:57:50 AID=0
freq= 927.0 bw=2 chn=3 bgr=-108 iq=0:50:-1:0 dc=-2:-3 tx=*5 dly=65:0:93 sif:rsp=0:0(0)
chn:  916.0  918.0  921.0  923.0  925.0  927.0
bgr:   -108   -108   -109   -108   -105   -109
buf: free=94 tq=0 sq=0 ac=0:0:0:0 agg=0:0:0:0 statq=0 rxq=0 skb=-1:0
irq: ac=40 bkn=12 bo(rts:frm)=0:13:0:0:27 to(rts:frm)=0:0 rx=54
tx : cnt=55 dly=2:10ms cts_be=0:0 agg=1(6010,40:0) data=4KB(5kbps) dur=36ms cca=175 per=0% fail=0 drop=0
rx : cnt=54 bus=1ms cts_bm=0:0 pks=30 data=2KB(3kbps) dur= 25ms err(phy:fcs)=0:0 ecode=0x0
dbg: dtmd=0:0:0 stamap=0x6 flag=0x0 rxdp=0 kerr=0 mic=0 lerr=0 kick=0 csc=0 rst=0 ovf=0 nob=0 tsnr=34 rssi=-54 rxdut=61% txp=0 rxg=5
cca: 4s st12= 0:0 mid1224= 0:0:0:0 ed1224= 0:0:0:0
chip-temperature:41, vcc:3.23, vdd13b:1.31, vdd13c:1.32

STA2: 06:bf:00:5c:84:60
tx2: mcs=0 bw=2MHz snr=34 cnt=12 agg=1 data=0KB(0kbps) dur=7ms dut=17% txq=0 cca=48 ack=0KB(12) drop=0KB(0) per= 0% est_rate=678kbps
rx2: mcs=1 bw=2MHz evm(avg:std)=-18:1 rssi=-49 agc=7773 cnt=16 agg=1 data=1KB(1kbps) dur=14ms dut=35% fcsErr=0, freqDev=-1644Hz adv_bw=0:83:0:0

STA1: ba:04:59:96:71:20
tx1: mcs=0 bw=2MHz snr=34 cnt=12 agg=1 data=0KB(0kbps) dur=7ms dut=17% txq=0 cca=48 ack=0KB(12) drop=0KB(0) per= 0% est_rate=678kbps
rx1: mcs=1 bw=2MHz evm(avg:std)=-25:2 rssi=-54 agc=7773 cnt=14 agg=1 data=1KB(1kbps) dur=11ms dut=28% fcsErr=0, freqDev=1450Hz adv_bw=0:100:0:0

[redfast00]

Can you set a frequency band on these modules? In Europe, we have to use 863 - 868 MHz.

[dmahony]

Yes you can set the frequency, You can even set multiple channels to avoid interference:
AT commands for use with netat.exe :

AT+FREQ_RANGE:8630-8680

AT+CHAN_LIST:8630,8680

[dmahony]

Can anyone assist with finding out how netat.exe communicates with these devices?
It looks like it sends UDP packets to 255.255.255.255 broadcast address.

In Wireshark I can see the commands I enter and their response just not how it initially 'connects' to the device to use AT commands.

[dmahony]

The bare module can be purchased on its own here:
https://www.alibaba.com/product-detail/Customize-730Mhz-950Mhz-802-11-ah_1600543103586.html?spm=a2756.order-detail-ta-ta-b.0.0.202a2fc29lrCUG

[markqvist]

Really cool to see the video you posted demonstrating this working! And thanks for collecting info, notes and resources here in this thread. It looks like these modules have great potential for Reticulum!

[dmahony]

Thanks Mark! If you want to play around with them I can set up remote access for you.

[tutugreen]

Coincidentally, I have also recently watched related videos and am very interested in this plan.

But currently, the ready-made bridge products I've see seem to be paired with "one click", and it is unclear how their encryption keys are exchanged and whether they are secure.

It seems that there are also some enterprise level product solutions that support web manage, WPA3, and even 802.1x. Does anyone found way to customize encryption/keys by using AT commands and other methods?

Edit 1 : I've talk to some "taobao" seller, they claim the key will random generate and exchange when pairing, but consider 900Mhz is can reach 1km range, not sure that exchange over the air is a secure solution.

they said their module , can be programmed and use custom keys, I've check the page, looks excatly like @dmahony alibaba ones.

Edit 2 : after a deep search, found another module https://detail.1688.com/offer/747960673579.html 4108E-S, using MM6108, looks better, aim for 32.5Mbps, and that Block Diagram looks excatly (again :) ) like the AzureWave https://www.azurewave.com/wireless-modules-11ah.html ones:

https://www.azurewave.com/img/802.11ah/AW-HM581_DS_DF_C_STD.pdf
https://www.azurewave.com/img/802.11ah/AW-HM581_Reference%20Design%20Guide_Rev01_20220926.pdf
https://www.azurewave.com/img/802.11ah/AW-HM581_V01_Layout%20Guide_20220927.pdf

[dmahony]

I have ordered 2 of those bare Morse Micro modules, they are due to arrive on Monday. It is also an Australian company, so should be easier to communicate with the devs.

[dmahony]

[tutugreen]

Thank you for the clarification. I found this discussion by searching for 802.11ah bridge, and I wasn't familiar with Reticulum before until now. It's a cool project.

[tutugreen]

I have no experience in embedded/pcb development. I asked about 1688’s 4108E-S module seller, They don’t do finished products.

But Taobao’s TaiXin does, I've ordered a pair of “AH netbridge demo box", based on TX-AH-R900Pxx, not cheap (298CNY * 2), but ready to use, wait to see how it performs.

Seller says it can do AT command through serial port.

Translated seller item description:

[dmahony]

Thanks for sharing! these look similar to the set I have but with added external debug port. Hopefully you can sent the AT commands to that port instead of having to use Windows and netat.exe

Do you know of a way for English speaker to use TaoBao? or do you speak a bit of Chinese?
I ordered 2 of the bare modules from there so will see if it works for me.

I spotted this development board for sale:
https://item.taobao.com/item.htm?id=738569462168&spm=pc_detail.27183998.202208.2.255c7dd6olWX5k

I have ordered this one from Alibaba but they are taking their time sending it. Looks to be very interesting as it exposes all the different ways to connect to the board, including USB to use directly with a Linux host. You can set the mode of operation via the jumper pins.

[dmahony]

AT command guide translated into English via Google Translate:
AH module AT command development guide_ ENGLISH.pdf

[markqvist]

If everything can be controlled via an AT command set, and all the AT commands can be mapped out, it should be pretty simple to create a fully functional interface driver for Reticulum.

[dmahony]

Nice! the AT command set is used with the AH- modules when they are attached to a dev board. There are also options to use the bare module directly with a host MCU. Ideally a way to attach these directly to Linux as the host would give us the most flexibility.
They have a linux driver on their site, will be giving this a shot when I receive the bare modules.

[dmahony]

Portable node setup:
Milk-V duo board could be used as a simple host device, it has pins at the bottom of the module for wiring directly into the Ethernet connection of these AH modules:

I cant wire this in at the moment as the module is not configurable from Linux.
The serial port on the AH module unfortunately only shows the output of netlog.exe ( log output, no serial input for AT commands )

The Milk-V uses a USB RNDIS connection this same USB connection can power the AH module via the 3v pins.

[dmahony]

Some of the Linux Wifi driver manual translated into English:
(泰芯Linux_WiFi_FMAC驱动开发指南.pdf)

The TaiXin Linux WiFi FMAC driver supports running the WiFi protocol stack inside the WiFi module, eliminating the need for the host to handle the WiFi protocol stack. The FMAC driver is compatible with the AH module and supports low-power modes, with corresponding WiFi firmware of type vx.x.x.5.

Linux Kernel Compilation Configuration
The FMAC driver supports both SDIO and USB interfaces. During kernel compilation, the following features need to be enabled:

For SDIO interface: Enable Device Driver → MMC/SD/SDIO card support and the corresponding MMC host driver.
For USB interface: Enable Device Driver → USB support and the corresponding USB host driver.
Note: If an "mmc_card_disable_cd" undefined error occurs during driver compilation, open the "if_sdio.c" file and define the "mmc_card_disable_cd" code as shown in the provided image.

FMAC Driver Development (hgic_fmac)
hgic_fmac Driver Files
The hgic_fmac driver is released in source code form for user compilation. When compiling the fmac driver, you can choose to support either SDIO or USB interfaces. Use the make command to view the compilation instructions. The "tools/test_app" directory provides auxiliary tools and driver encapsulation APIs. Execute "build_ahtool.sh" to compile auxiliary tools like hgpriv and hgicf.

hgic_fmac Loading Process

Load the fmac driver: insmod hgicf.ko.
When loading the driver, specify the following parameters if needed:

ifname: Specify the network interface name; the driver defaults to creating the "hg0" interface. For example: insmod hgicf.ko ifname="wlan%d", creating the "wlanx" interface.
conf_file: Specify the parameter configuration file; the default is /etc/hgicf.conf. This can be used in two ways:
Specify a specific file path, e.g., insmod hgicf.ko conf_file=/etc/hgicf.conf.
Specify a directory path, e.g., insmod hgicf.ko conf_file=/etc. In this case, the driver will read /etc/hg0.conf for "hg0" parameters.
fw_file: Specify the AH module firmware name; the driver defaults to loading hgicf.bin. See section 3.3 for firmware download instructions.
Example: insmod hgicf.ko fw_file=xxxx.bin (Note: fw_file should only be the filename, not the full path).

Configure the hg0 interface: Set IP address, bring the interface up.

Use the hgpriv tool for parameter configuration (or use encapsulated APIs).

Basic parameter settings using hgpriv:

hgpriv hg0 set freq_range=9080,9240,8: Set AH module working frequency range and bandwidth.
hgpriv hg0 set bss_bw=8: Set BSS bandwidth to 8M, options are 1/2/4/8, consistent with the bandwidth above.
hgpriv hg0 set tx_mcs=255: Set tx mcs to automatic mode.
hgpriv hg0 set key_mgmt=NONE: Disable encryption.
hgpriv hg0 set ssid=ah_test_ssid: Set SSID.
hgpriv hg0 set mode=ap: Set working mode to AP.
Parameter setting order: Set frequency/bandwidth information, set encryption method/password, set working mode.

Driver Configuration File (Optional)
If quick loading of parameters at startup is needed, create a parameter configuration file for the hgicf driver. Specify the conf_file parameter when loading the driver, and it will automatically load the set parameters. The file content should be in the format of hgpriv commands.

Example file content:

makefile
Copy code
freq_range=9080,9240,8
bss_bw=8
tx_mcs=25
key_mgmt=NONE
ssid=ah_test_ssid
mode=ap
hgpriv Configuration Explanation
Note: The hgpriv tool is recommended for manual input; in code, use the driver's encapsulated API for more convenient integration into applications.

Networking Basic Parameters

hgpriv hg0 set mode=xx: Set the WiFi module's operating mode to AP, STA, Group, or APSTA.

mode=ap: Operate in AP mode.
mode=sta: Operate in STA mode.
mode=group: Operate in broadcast group mode.
mode=apsta: Operate in relay mode. Devices in relay mode connect as STA to a higher-level AP and serve as AP for other STAs. Use r_ssid and r_psk commands to set the connection parameters for the higher-level AP.
(Set other networking parameters first, then set the mode parameter.)
hgpriv hg0 set ssid=xx: Set the AH module's SSID, with a maximum of 32 characters.

hgpriv hg0 set key_mgmt=xx: Set the WiFi module's encryption mode.

NONE: Disable encryption.
WPA-PSK: Enable encryption. (Requires setting wpa_psk.)
hgpriv hg0 set wpa_psk=64_hexchar: Set the WiFi module encryption key, a 64-character hex value. This value can be generated using the wpa_passphrase tool.

[dmahony]

I was just trying to compile the Linux driver and accidently stumbled across a Linux script to send AT commands!

here is the script:
https://github.com/dmahony/TX-AH-R900PNR-module-config
You run the script with your interface name eg,
./libnetat eth0

[dmahony]

It works!

[markqvist]

Oooh, that is very nice!

[tnk3r]

I was just trying to compile the Linux driver and accidently stumbled across a Linux script to send AT commands!

here is the script: https://github.com/dmahony/TX-AH-R900PNR-module-config You run the script with your interface name eg, ./libnetat eth0

Nice Nice!

[dmahony]

MM610X-001 Wi-Fi HaLow Sub-GHz Wireless Module:

[redfast00]

Did you ask AsiaRF for more datasheets? I emailed them, but they would only give a more detailed datasheet after ordering. With the information you linked below, I don't think there's enough info to implement for example an AP/client combination.

[dmahony]

The chip they are using is from Morse Micro. I have tried to sign up for the customer portal on https://www.morsemicro.com/
But still have not been given access. I will try to reach out to them again.
Perhaps not being taken seriously because I'm not a large corporation.

[redfast00]

I've sent multiple mails to Morse Micro, and used their contact form; I haven't received any replies, not even an acknowledgement that my email was received.

[dmahony]

Looks like we have a lot of info for the TX-AH-R900PNR module at least. It is unfortunate that they aren't supporting the maker community. I could imagine something like the LilyGo / TTGO boards but with WiFi HaLow instead.. would sell millions.

[Avamander]

https://www.morsemicro.com/ja/wpdm%E3%83%86%E3%82%B9%E3%83%88/

I haven't stumbled upon any other documents that would shed more light on the modules they provide unfortunately. I don't understand the secrecy considering all the details for example TaiXin shares.

[dmahony]

MMX610X-001 Documents:

cf1a4017037dfde2f4f789d4772658242cfc1256944ff4f982eeaa55354a32f2_optim.pdf
MM610X-001 Reference Design Guide_V1.pdf
MM610X-001_V2_compressed.pdf
MM610X-001_V2-4P_231201.pdf
mm610x-001-wifi-halow-module-manual.pdf
Morse-Micro_MM6108_Product-Brief_v03-5.pdf

[dmahony]

Another Morse Micro device but this one has an OpenWRT web GUI:
UG MM6108-Web GUI User Guide 2.2.2.pdf

[Erethon]

I just want to say thank you @dmahony for doing all of this work/investigation. I'll most likely wait a week or two to see what works best and buy some modules too.

[dmahony]

Error when setting 1Mhz BSS BW:

[4678903]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678904]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678904]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678905]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678905]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678906]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678906]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678906]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678907]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678907]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678908]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678908]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678909]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678909]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678910]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678910]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678910]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678911]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678911]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678912]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678912]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678913]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678913]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678914]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678914]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678914]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684
[4678915]lmac error!!!len= 640 bw= 1M mcs= 10 syms= 856 too long for non-mcs10, max 684

[LinaAlf]

hi @dmahony how did you get the mcs from the anjielo device? with this AT command? tx_mcs

[dmahony]

Looks like the firmware update on the manufacturers website is newer than what is supplied:

https://www.taixin-semi.com/Product?prouctSubClass=33
But the changelog doesn't seem too exciting:

2023/11/29 Ver26347

1. Improved the scan ap mechanism;

2023/10/20 Ver：25403

1. Fixed the problem of small RSSI at 860M frequency;
2. Fixed the problem of test box occasionally failing;
3. Fixed the problem that caused STA to disconnect during pairing;

2023/7/24 Ver：24032

[teledatics]

We released a HaLow devkit based on the Azurewave NRC7292 module in 2021.

We're currently readying release of a new product line based on the NRC7394 and our own 1W HaLow module design.

https://teledatics.com

https://github.com/teledatics

[teledatics]

@teledatics i am also searching for a 1W AH module for a drone telemetry usecase, can you already share more info on the product?

This is the 1W TD-HALOC m.2 card mounted on an m.2 carrier we created for drone telemetry next to a 500mW Holybro Sik v3.

The TD-TLM1 sends data either over USB or direct UART and has a SPI bus option for higher speed. You can also use it as a Linux USB Wi-Fi HaLow dongle.

https://www.teledatics.com/TD-TLM1_drone_telemetry.png

[cobraPA]

Nice, what's the availability of that setup (TD-HALOC and carrier) for development use?

[julled]

Thanks this format looks very interesting! Can the UART (e.g. flightcontroller ) and USB (e.g. live images via companioncomputer) used in parallel?

When will it be released?

[teledatics]

We're launching our new product line on Crowd Supply this Summer.

UART and SPI can be used independently.

[buhalo1]

Do you plan to make modules for 868 MHz?
Is it possible to use these modules in the usual way, like regular WiFi modules? I mean the possibility of simply replacing a regular WiFi module with HaLow for use in mesh networks like BATMAN-ADV.

[teledatics]

There a preview on our Discord server under the TD-WRLS category.

https://discord.com/invite/WpguKNMR7H

[tnk3r]

Has Anyone found a AT command to remove connected Stations?
For example because maximum stations 8 have been reached and new Stations need to be added?

[dmahony]

at+unpair=f6:de:09:75:a3:61

[fab1an2]

meybe using this https://extrowerk.com/2022-07-31/OpenStick.html too?
usb send data from radio

[dmahony]

That is really cool, I ordered 2 to play with. Thanks!

[aliosa27]

I have been using LicheeRV Nano's because the have wifi6 and in testing they seem to work well with the devboards via usb that @dmahony linked above, I ordered a few from aliexpress. anywho, this combination seems to work so much better then the ah/wifi repeater boards you can source from aliexpress as well. over wifi speeds were much lower then the link rate. I patched the driver for 5.10>above kernels when I was debugging with a raspberry pi(ill post a commit for that)

I built a gui around hgpriv that I have uploaded over to
https://github.com/aliosa27/taixin_tool

the wifi stuff is specific to the rvnano and the buildroot builds the sdk builds but the rest of the interface assuming youve gotten hgpriv in sbin, should work.

this combo nets around 7-10mbps up/down which for some of my test links is fantastic for the actual need.

[aliosa27]

https://github.com/aliosa27/taixin_fmac/tree/main

this should work with newer pi kernels. I compiled it against the latest after making some modifications that changed after kernel 5.17

[aliosa27]

@dmahony I added basic support for libnetat, switchable in the web interface or mode.conf. I modified libnetat to support a new non interactive mode to script against. you'll need to compile that version. some things are not supported yet like the site survey/etc, since it seems libnetat doesnt return data when you run AT+SCAN_AP=2 and then follow it up with AT+BSSLIST, more to come.

[cyberumut]

I have been using LicheeRV Nano's because the have wifi6 and in testing they seem to work well with the devboards via usb that @dmahony linked above, I ordered a few from aliexpress. anywho, this combination seems to work so much better then the ah/wifi repeater boards you can source from aliexpress as well. over wifi speeds were much lower then the link rate. I patched the driver for 5.10>above kernels when I was debugging with a raspberry pi(ill post a commit for that)

I built a gui around hgpriv that I have uploaded over to https://github.com/aliosa27/taixin_tool

the wifi stuff is specific to the rvnano and the buildroot builds the sdk builds but the rest of the interface assuming youve gotten hgpriv in sbin, should work.

this combo nets around 7-10mbps up/down which for some of my test links is fantastic for the actual need.

I have been using LicheeRV Nano's because the have wifi6 and in testing they seem to work well with the devboards via usb that @dmahony linked above, I ordered a few from aliexpress. anywho, this combination seems to work so much better then the ah/wifi repeater boards you can source from aliexpress as well. over wifi speeds were much lower then the link rate. I patched the driver for 5.10>above kernels when I was debugging with a raspberry pi(ill post a commit for that)

I built a gui around hgpriv that I have uploaded over to https://github.com/aliosa27/taixin_tool

the wifi stuff is specific to the rvnano and the buildroot builds the sdk builds but the rest of the interface assuming youve gotten hgpriv in sbin, should work.

this combo nets around 7-10mbps up/down which for some of my test links is fantastic for the actual need.

https://github.com/aliosa27/taixin_tool this tool allows us to interact with halow via ip, right?

[Jookia]

Yes, it supports netat.

[cyberumut]

Yes, it supports netat.

thank you

[dmahony]

The LilyGo T-Halow boards are out, has anyone tried them? I'm waiting for mine to arrive in the mail.

https://www.lilygo.cc/products/t-halow

[aliosa27]

yep I ordered a few! cant wait to port this over to the esp32

[dmahony]

I can't get them working using the ESP mode, need more time for this.
This device requires using an external flash programmer to install the Taixin firmware to the TX-AH part of the module.
I got that sorted but the 2 devices will not connect to each other.
https://github.com/Xinyuan-LilyGO/T-Halow

[aliosa27]

So I can get esp mode to work, which effectively is the usb firmware, with the only difference being the serial pin's changing. With the bridge firmware the serial port on the taixin chip changes and its only accessible via the second usb. My current gripe is that they should of added a switch or something to switch serial port wiring between modes, so that the chip would remain accessible in both modes from the esp32. If you are using it as a bridge, you can even automate configuration or anything since you can't even use the esp32 to send commands to it

[cyberumut]

So I can get esp mode to work, which effectively is the usb firmware, with the only difference being the serial pin's changing. With the bridge firmware the serial port on the taixin chip changes and its only accessible via the second usb. My current gripe is that they should of added a switch or something to switch serial port wiring between modes, so that the chip would remain accessible in both modes from the esp32. If you are using it as a bridge, you can even automate configuration or anything since you can't even use the esp32 to send commands to it

do you have any update ? i would like to use t-halow esp32 with ip mode (MODE 1)I cannot define ip address when using MODE 1

[Jookia]

Just for anyone curious, you CAN use AT commands over UART using manual UNIX commands:

In one window run this:

stty -F /dev/ttyUSB0 raw 115200
cat /dev/ttyUSB0

Then in another window run the commands using echo:

echo 'AT+SYSDBG=LMAC,0' > /dev/ttyUSB0

I'm not sure exactly what Linux is doing differently here but writing a program to run commands and print output couldn't be too hard.

[aliosa27]

I added a crap ton of features to the libnetat code they provided over here at https://github.com/aliosa27/taixin_tools

[cyberumut]

https://github.com/aliosa27/taixin_tools this tool allows us to interact with halow via ip, right?

[aliosa27]

Correct. It does support communication via MAC address

[cyberumut]

Correct. It does support communication via MAC address

can we configure ipv6 or ipv4 address instead of mac address ?

[julled]

https://www.youtube.com/watch?v=Hl06mkjlpXI

some review on the current state of affairs on taixin usage on DEFCON

[aliosa27]

I’ll give it a try. This may require some modification to the firmware on the device. There is a built in dhcp client however netat doesnt seem to listen. In another quick test , I can send udp packets directly to an ip address which in this case was 169 address and it will run what it’s sent, it just responds back to 0.0.0.0 which defeats the point in this case. I think the netat code is an object in the firmware sources so it might not be possible to add a direct mode. I’ll take a look and see what I can do Sent from [Proton Mail](https://proton.me/mail/home) for iOS

…

On Mon, Sep 16, 2024 at 7:21 AM, cyberumut ***@***.***(mailto:On Mon, Sep 16, 2024 at 7:21 AM, cyberumut <<a href=)> wrote: > Correct. It does support communication via MAC address can we configure ipv6 or ipv4 address instead of mac address ? — Reply to this email directly, [view it on GitHub](#421 (reply in thread)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/ADZD3IRPM4R7UYUQ5LXN5ALZW3LORAVCNFSM6AAAAABBPSY23OVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANRVHE3TANA). You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[LinaAlf]

Hi All
Im a student currently working on a project trying to measure Wifi Halow devices by chinese company, anjielo. @dmahony your software was given to us by the professor to communicate with the devices and it works perfectly. Now we would like to log the data over multiple measurements. Would it be possible to save it into a csv file? Im asking bc i cant figure out if there is a non exe version of the netlog.exe
Thank you for any help in adavance
kind Regards a student

[aliosa27]

you should be able to use my python version on linux to log. in non interactive mode it just spits everything out to stdout. you can combine something like ./libnetat.py eth1 at+ssid 00:00:00:00:06:33 >log to log output.

[LinaAlf]

Thank you for your reply
we both have a windows laptop, but we could dual boot so no issue there.
I can then copy the values from the stdout in the Terminal?
We want to measure the difference over different distances, so it would also be handy to be able to plug in either a timestamp or GPS data(maybe possible with python?)

what do you think would be the best method?

[LinaAlf]

you should be able to use my python version on linux to log. in non interactive mode it just spits everything out to stdout. you can combine something like ./libnetat.py eth1 at+ssid 00:00:00:00:06:33 >log to log output.

Hi @aliosa27 so to retrieve the mcs I should be able to use AT+tx_mcs right? wenn configured in a certain way it sadly just spits out: 255.
Any clue on another way to get the mcs? the TX_power and RSSI could be gathered with AT commands luckily, the rest we did with iperf3 so far.

[aliosa27]

@LinaAlf must be a firmware bug. same thing happens here:

: at+tx_mcs
+TX_MCS:255
OK

: exit
root@osboxes:/home/osboxes# python3 test.py --command at+tx_mcs --dest_mac 06:bf:00:61:92:50 ens33 --logfile test
+TX_MCS:255
OK

root@osboxes:/home/osboxes#

btw I added logging to the python version

[jodoe]

I've extracted the AT commands from the firmware update file, many of these work, be careful playing with them. They are follows;

AT+FWUPG=
AT+SKBDUMP=
AT+SYSDBG=
AT+STA_INFO=
AT+ACS=
AT+ACK_TO= 				set extra ack timeout(us), e.g. =? =100
AT+ADC_DUMP=			adc dump=?, =val , =0
						dump flag list
						1.normal
						2.fcs err
						3.pv err
						4.rxinfo err
						5.mgmt
						6.ctrl
						7.data
						8.ext
						9.phy err
						10.rxend err
						11.fifo err
						12.len err
						13.bw adv 1m
						14.bw adv 2m
						15.bw adv 4m
						16.bw adv 8m
AT+AP_SLEEP_MODE=		ap sleep enable rc or not
AT+ANT_DUAL=			dual ant en/disable e.g. =? =0,1
AT+ANT_CTRL=			ant ctrl pin e.g. =? =31
AT+ANT_AUTO=			auto ant select en/disable e.g. =? =0,1
AT+ANT_DEF=				default ant select e.g. =? =0,1
AT+BGRSSI_MARGIN=		set margin for bgrssi, e.g. =? =0 =5
AT+BGRSSI_MAX=			set max threshold for bgrssi, e.g. =? =0 =-80
AT+BGRSSI_SPUR=			set bgrssi spur threshold, e.g. =? =200
AT+BSS_BW=				bss bandwidth, valid value 1/2/4/8 MHz, e.g. =1; =2; =4; =8; =?
AT+BUS_WT=				keep write bus in testmode, e.g. =?
AT+CCA_OBSV=			cfg cca observation duration, 1~128 seconds, e.g. =? =4 =128
AT+CCA_CE=				cfg cca according spec,s, e.g. =? =0 =1
AT+CCMP_SUPPORT=		aes ccmp, 0: disable, 1: enable, e.g. =0; =1; =?
AT+CHAN_SCAN= 			all chan bgrssi scan enable or disable
AT+CS_CNT=				set  channel switch counter down(beacons)
AT+CS_NUM=				set channel switch num, 1M space start from 700M
AT+CS_PERIOD			auto chan switch period, unit ms
AT+CS_TH=				auto chan switch bgrssi threshold, e.g. =? =6
AT+CTS_DUP=				en/disable cts dup
AT+DUMPFLASH=                   addr:%x, size
AT+EDCA_AIFS=			aifs, format: =ac,aifs  e.g. =0,7; =1,3; =2,2; =3,2; =?
AT+EDCA_CW=			min and max backoff CW, format: =ac,cwmin,cwmax  e.g.=0,7,1023; =?
AT+EDCA_TXOP=			txop(ms), format: =ac,txop  e.g. =0,2; =1,3; =2,21; =3,21; =?
AT+EVM_MARGIN=			evm margin for mcs adjust, e.g. =-2; =3; =?
AT+FREQ_LIST=			set channel list, e.g. =760000,768000,774000 =?
AT+FT_ATT=				set FT ATT, e.g. =? =0/2.../62
AT+LMAC_DBGSEL=	        en/disable lmac debug, e.g. =? =0x01
AT+LO_FREQ=				LO frequency, unite KHz, range 730000 ~ 930000, e.g. =730000; =930000; =?
AT+LOADDEF=			restore the default settings in Flash., e.g. =1; =?
AT+MAC_ADDR=			device mac address, e.g. =0xa0b0c0d0e0f0; =?
AT+MCAST_DUP=			mcast tx dup cnt, e.g. =3; =?
AT+MCAST_REORDER=            mcast rx dup det and reorder enable, e.g. =0/1; =?
AT+MCAST_BW=			tx bandwidth for multicast data, valid value 1/2/4/8 MHz
AT+MCAST_MCS=			tx mcs for multicast data, valid value 0 ~ 7
AT+MCAST_RTS=			mcast rts , e.g. =1; =?
AT+NOR_RD=				keep read nor flash in testmode, e.g. =?
AT+OBSS_CCA_DIFF=		cfg obss energy detect threshold for cca, e.g. =? =4
AT+OBSS_EDCA=			obss EDCA en, e.g. =?/0/1
AT+OBSS_NAV_DIFF=		cfg obss rssi threshold for dual nav, e.g. =? =6
AT+OBSS_SWITCH=			obss freq switch en, e.g. =?/0/1
AT+OBSS_TH=				obss freq switch rssi threshold, e.g. =?/-30
AT+OBSS_PER=			obss freq switch per threshold, e.g. =?/30
AT+PCF_EN=				en/disable pcf, e.g. =? =0 =1
AT+PCF_PERCENT=			cfg cfp percent, 0~100 , e.g. =? =80
AT+PCF_PERIOD=			cfg pcf period(xDTIM), e.g. =? =0 =3
AT+PHY_RESET=			reset phy dev=?, =1 , =0
AT+PRI_CHAN=			set primary chanel 1~6, e.g. =1, =?
AT+PRINT_PERIOD=		print period, unite ms, 0 for diable print, e.g. =0; =5; =?
AT+QA_ATT=				att(dB) for qa scan: e.g. =? =20
AT+QA_CFG=				cfg golden 4 params: e.g. =? =freq,bw,mcs,per
AT+QA_RESULTS=			cfg dut tx thresholds, 8 params, e.g. =?
AT+QA_RXTHD=			dut rx thresholds, 8 params, e.g. =? =rssi,evm,freq_dev,..7,8
AT+QA_START=			QA start/stop e.g. =? =0/1
AT+QA_TXTHD=			dut tx thresholds, 8 params, e.g. =? =rssi,evm,freq_dev,...7,8
AT+RC_NEW=				enable/disable rate ctrl new algorithm=?, =1 , =0
AT+REG_RD=				read reg, 32bits or 16bits(rf), e.g. =0x20001000; =0x830
AT+REG_WT=				write reg, 32bits or 16bits(rf), e.g. =0x20001000,0x12345678; =0x830,0x80
AT+RF_RESET=			        reset rf dev=?, =1 , =0
AT+RTS_DUP=				en/disable rts dup
AT+RX_AGC=				read agc info, e.g. =?
AT+RX_ERR=				read rx error packets, e.g. =?
AT+RX_EVM=				read rx average evm, unite dB, e.g. =?
AT+RX_PKTS=				read rx packets number, e.g. =?
AT+RX_REORDER=			en/disable lmac rx ordered service
AT+RX_RSSI=				read rssi, unite dBm, e.g. =?
AT+SET_AGC=				cfg agc and gain idx, zero means enable agc, value 4/5 means set fix gain, e.g. =? =0/4/5
AT+SET_AGC_TH=			cfg agc threshold, need two args, e.g. =? =-90,-100
AT+SET_BGRSSI=			bgrssi, 0: auto bgrssi(and cca threshold), others: fix bgrssi(and cca threshold), e.g. =23, =?
AT+SET_BGRSSI_AVG=		pks for bgrssi avg, e.g. =10; =?
AT+SET_RTS=				rts threshold, unite symbol(40us), e.g. =50, =?
AT+SET_VDD13=			set vdd13, 0: 1.32v; 1:disbale vdd13; 2: 1.43v;
AT+SHORT_GI=			short gi end/disable, e.g. =?/0/1
AT+SHORT_TH=			len of short frame=?, =256 , =0
AT+SLEEP_EN=			enter sleep, test command for sta
AT+T_SENSOR=			read temperature seneor, unite Celsius degree, e.g. =?
AT+TEST_START=			test mode, 0: stop, 1: start, e.g. =0; = 1; =?
AT+TX_AGG_AUTO=			enable/disable tx agg auto adjust
AT+TX_ATTN=				tx digital gain attenuation, unite dB, min step 1, value >= -6, 0dB for 0x400, e.g. =-6; =0; =1; =2; =?
AT+TX_BW=				tx bandwidth, valid value 1/2/4/8 MHz, else dynamic bandwidth adjust
AT+TX_BW_DYNAMIC=		en/disable tx bandwidth dynamic adjust, e.g. =? =0 =1
AT+TX_CNT_MAX=			set max tx cnt for each frame/rts e.g. =7,31, =?
AT+TX_CONT=			continus tx, 0: normal (frame one by one), 1: continues (payload infinite), e.g. =0; = 1; =?
AT+TX_DELAY=			tx delay for test mode, e.g. =?/5/10
AT+TX_DST_ADDR=			tx destination address, e.g. =0xa0b0c0d0e0f0; =?
AT+TX_FAIL=				read tx failed packets number, e.g. =?
AT+TX_FC=				tx frame control, e.g. =0x0308; =?
AT+TX_FLAGS=			tx info flags, e.g. =0x80000000(dup); =?
AT+TX_LEN=				tx payload length, decimal base. e.g. =1024; =?
AT+TX_MAX_AGG=			tx max aggregation subframe number, range 1~64, e.g. =1; =64; =?
AT+TX_MAX_SYMS=		tx max symbols, max= 511, e.g. =255; =511; =?
AT+TX_MCS=				tx mcs, valid value 0 ~ 7/10, else dynamic mcs adjust
AT+TX_MCS_MAX=			limit tx mcs [0 MAX], e.g. = 3; =?
AT+TX_MCS_MIN=			limit tx mcs [MIN MAX], e.g. = 3; =?
AT+TX_ORDERED=			enable/disable lmac strictly ordered service
AT+TX_PHA_AMP=			LUT phase-amp, 0: normal, 1: in-pha & half-amp, 2:ort-pha & full-amp, 3:orth-pha & half amp e.g. =0; = 1; =2; =3; =?
AT+TX_PKTS=				read tx packets number, e.g. =?
AT+TX_PWR_AUTO=		tx power auto adjust, 0: disable; 1: enable, e.g. =0; =1; =?
AT+TX_PWR_MAX=			max tx power idx, 3 ~ 5, e.g. =5; =?
AT+TX_PWR_SUPER=		allow tx power exceed max, e.g. =0/1; =?
AT+TX_PWR_SUPER_TH=		snr threshold for enable super power, e.g. =20; =?
AT+TX_RATE_FIXED=		tx rate fixed, no adjust when retry, e.g. =0/1; =?
AT+TX_START=			        test tx, 0: stop, 1: start, e.g. =0; = 1; =?
AT+TX_STEP=				sine/Triangle LUT step, max 511, e.g. =1; =50; =?
AT+TX_TRIG=				tx one frame, 0: stop, 1: start, e.g. =0; = 1; =?
AT+TX_TYPE=				tx frame type, Normal, Sine, or Triangle, e.g. =N; =S; =T; =?
AT+TXOP_EN=				en/disable txop, e.g. =? =0 =1
AT+WAKE_EN=			wake stas, test command for ap
AT+XO_CS=				XO frequency deviation adjust manual, e.g. =0x8; =?
AT+XO_CS_AUTO=			XO frequency deviation adjust auto, range params: =min,max e.g.=-2000,2000, =?
AT+LO_TABLE=			LO table read e.g =?
AT+PS_CHECK=			PS debug check e.g =?
AT+RADIO_ONOFF=		radio on/off e.g =0/1/?
AT+STA_INFO=			sta lmac info e.g =1/2/?
AT+STA_PSK=				sta psk set by aid or check e.g = 1,psk/?

[DrSamjames]

Hi

Hope you don't mind me jumping on this thread, I found it while trying to do some research on 802.11AH HaLow. I've already tried the units that kicked this off and they didn't work for me.

I've now bought some of the very much more expensive units like this:

https://www.aliexpress.com/item/1005007541623821.html

I’m not sure what the difference is, apart from the price. The internals look very different, but I can’t identify the chip easily as it has a metal shield in place. After reading this thread I’m thinking about sending them back and trying to experiment with the development boards. But before I do, has anyone played with these more expensive boards? Do they have anything onboard to make the price worth paying?

[DrSamjames]

Just out of intrest, how do you know they are 2W units? is that from the photo or have you got more info on these?

[aliosa27]

I ordered that same amp, that and a 1w to test with. - https://www.aliexpress.us/item/3256806293522378.html?spm=a2g0o.productlist.main.11.7d90UoYTUoYT9G&algo_pvid=d6e8cda6-d4d0-4561-b67c-85debddfa9ff&algo_exp_id=d6e8cda6-d4d0-4561-b67c-85debddfa9ff-5&pdp_npi=4%40dis%21USD%21110.02%21110.02%21%21%21799.00%21799.00%21%402151e6dc17349661568863149e73fe%2112000037353952151%21sea%21US%21129596529%21X&curPageLogUid=Lmcj3IS5BARx&utparam-url=scene%3Asearch%7Cquery_from%3A

[aliosa27]

you shouldnt need serial to see whats going on. I am going to guess your link is really really reallllly hot. but the netlog/netat programs for windows or my python script for linux should get you access to the settings without serial

[DrSamjames]

I'm still looking into your script and the possible AT commands. Unfortunately I'll need to make a decision on whether to send the unit back very quickly, so I don’t have much time to finish my research.

It seems from what I’m reading that people have managed to get 1km distance out of these boards with the 2W amp. What setting would it be possible for me to alter to make mine work? Or to put the question another way, what could they have set badly at the factory?
Also worth pointing out I’m in the UK, so I’m guessing they will have set it up for the EU regulations.

[jodoe]

I'm in the UK and have tested the basic units without the RF amplifier with their omni directional antennas. With the TX unit inside a top floor window of my house I've managed a max of 150m range, at low connection quality in an urban area. There was plenty of other objects in the way (houses, trees), so I consider that quite reasonable seeing as there was no direct line of sight and no directional antennas.

To get optimum range would require line of sight with no obstacles. The UK spec version of these devices can only transmit at 4mbps, if you increase the bandwidth via AT commands you are breaking the law. If you run one of these with an RF amplifier you breaking the law even more.

[cyberumut]

Can I use t-halow with nrc7292? Will it connect to the ap I created with nrc7292?

[aliosa27]

nope it seems that taixin stuff is not really 802.11ah interoperable. that might change with some firmware but thats up to taixin

[cyberumut]

nope it seems that taixin stuff is not really 802.11ah interoperable. that might change with some firmware but thats up to taixin

Isn't this also a halow module? Why is there a problem? https://github.com/Xinyuan-LilyGO/T-Halow

[aliosa27]

you are correct. it should but it does not. I think this is more related to taixin.

[cyberumut]

you are correct. it should but it does not. I think this is more related to taixin.

thank you for answer

Do you think it is possible to make it communicate by changing the firmware?

[jodoe]

I thought I'd reintroduce the large missing SMD filter capacitors for the voltage regulation side of the board, they were not populated from the factory. If you look at the reference design they are meant to be there. Adding these back improved the AC ripple on the 3.3v DC voltage, no doubt it also improves capacity under sudden load when switching from low power to full power transmission.