Skip to main content

OpenWRT - Sending AT Commands to WWAN 4G USB Modem

Introduction

When using an LTE USB modem (like the Huawei E3372s-153) on an embedded system or single-board computer (SBC), the device operates black-boxed behind network layers. Standard web interfaces (LuCI) or network commands (ifconfig) only show Layer 3 parameters (IP addresses, active traffic). To diagnose low-level physical issues, we must bypass the networking stack and talk directly to the modem's internal controller chip.

Why do we need this?

  • Thermal Monitoring: USB LTE modems run hot. High workloads or ambient heat from the host SBC can cause the modem to cross its thermal threshold (+65 ºC), triggering thermal throttling (automatic speed reduction) or hardware instability/reboots.

  • RF Signal Analysis: When troubleshooting erratic connections, standard bars are not enough. Direct access allows us to pull raw Layer 1 metrics: RSRP (Signal Power), RSRQ (Signal Quality), and SINR (Signal-to-Noise Ratio).

  • Electrical Instability Detection: Modems pull heavy current spikes when transmitting data over LTE. If using a low-quality USB extension cable or an unstable power supply, voltage drops will cause the modem to crash. Monitoring via a serial terminal helps catch the hardware state right before a failure occurs.

AT Commands

AT commands (short for Attention commands) are an industry-standard control language dating back to the early days of dial-up modems (Hayes command set). Every command string starts with the prefix AT to catch the modem’s "attention," followed by specific parameters.

While basic AT commands handle legacy functions (like dialing a number or hanging up), modern cellular hardware manufacturers include proprietary extension commands (prefixed with AT^ on Huawei devices) to query advanced hardware states.

Core Commands Used for Diagnostics:

  • AT: The fundamental ping test. The modem should instantly reply with OK if the serial connection and baud rate are synchronized.

  • AT^CHIPTEMP?: Queries the onboard telemetry thermistor. It prints an unscaled integer representing internal core temperature (e.g., 515 = $51.5^\circ\text{C}$).

  • AT^HCSQ?: Queries the physical Layer 1 wireless subsystem status. It returns raw RSSI, RSRP, SINR, and RSRQ values directly from the baseband processor.

Using Picocom To Send AT Commands

picocom is a minimalist, lightweight terminal emulation program designed for Linux systems.

Think of it as a bare-bones, command-line version of PuTTY or HyperTerminal specifically built to talk to serial ports. It does not possess a heavy footprint, making it ideal for resource-constrained systems running OpenWrt.

How it works in this setup:

  1. Driver Level: The Linux kernel detects the USB modem and loads the usb-serial-option driver, mapping the modem's internal interfaces to virtual serial terminal ports named /dev/ttyUSB0, /dev/ttyUSB1, etc.

  2. Bridging the Gap: picocom opens a direct communication line to one of these /dev/ttyUSBX ports at a specified data transmission speed (Baud Rate, commonly 9600).

  3. The Interactive Session: Once connected, picocom acts as a middleman: anything you type is sent directly to the modem's firmware, and any data the modem outputs is printed straight onto your console screen.

Step 1: Update package feeds and install picocom:

opkg update && opkg install picocom

Step 2: Connect to the modem:

  • First we need to know the device to which we should connect:

    root@OpenWrt:~# ls -la /dev/ttyUSB*
crw-rw----    1 root     dialout   188,   0 May 15 23:37 /dev/ttyUSB0
crw-rw----    1 root     dialout   188,   1 May 15 23:37 /dev/ttyUSB1
  • The modem is at /dev/ttyUSB0, hence we will use the commnand

    picocom -b 9600 /dev/ttyUSB0 the -b 9600 indicates 9600 baud rate
root@OpenWrt:~# picocom -b 9600 /dev/ttyUSB0
picocom v3.1

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 9600
parity is      : none
databits are   : 8
stopbits are   : 1
escape is      : C-a
local echo is  : no
noinit is      : no
noreset is     : no
hangup is      : no
nolock is      : no
send_cmd is    : sz -vv
receive_cmd is : rz -vv -E
imap is        :
omap is        :
emap is        : crcrlf,delbs,
logfile is     : none
initstring     : none
exit_after is  : not set
exit is        : no

Type [C-a] [C-h] to see available commands
Terminal ready

^DSFLOWRPT:0000020C,00000000,00000000,000000000000FD33,0000000000117AD0,00000000,00000000

^DSFLOWRPT:0000020E,00000000,00000000,000000000000FD33,0000000000117AD0,00000000,00000000

^RSSI: 10

^HCSQ:"WCDMA",48,29,27

^DSFLOWRPT:00000210,00000050,00000060,000000000000FD83,0000000000117B30,00000000,00000000

^DSFLOWRPT:00000212,00000000,00000000,000000000000FD83,0000000000117B30,00000000,00000000

Terminating...
Thanks for using picocom

To close picocom --> Ctrl+A immediately followed by Ctrl+X

Querying Temperature

AT^CHIPTEMP?: Queries the onboard telemetry thermistor. It prints an unscaled integer representing internal core temperature (e.g., 515 = 51.5º C).

root@OpenWrt:~# picocom -b 9600 /dev/ttyUSB0
picocom v3.1

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 9600
<ommitted>

Type [C-a] [C-h] to see available commands
Terminal ready
AT^CHIPTEMP?

^CHIPTEMP: 352,352,65535,27,20

OK

We can see the temperature now is 352 ->35.2ºC

Querying Signal

AT^HCSQ?: Queries the physical Layer 1 wireless subsystem status. It returns raw RSSI, RSRP, SINR, and RSRQ values directly from the baseband processor.

root@OpenWrt:~# picocom -b 9600 /dev/ttyUSB0
picocom v3.1

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 9600
<ommitted>

Type [C-a] [C-h] to see available commands
Terminal ready
AT^HCSQ?
^HCSQ:"WCDMA",47,30,31

OK

This is highly revealing for the network setup. It tells us two major things:

  • Technology Shift ("WCDMA"): The modem is currently dropped back to 3G (HSPA/UMTS) instead of LTE. This explains why the speed might feel sluggish or why latency is behaving differently. It happens either because the 4G signal is blocked by walls or because the cell tower is congested.

  • The Signal Metrics: For WCDMA, the fields are parsed as ["SYSMODE", RSSI, RSCP, ECIO].

    • RSSI = 47: This is a relative signal strength index. 47 is decent (ranges 0-91 in Huawei's scale).

    • RSCP = 30: Received Signal Code Power. A value of 30 maps to roughly -91 dBm. This is a fair/acceptable 3G signal, but not great.

    • ECIO = 31: Carrier-to-interference ratio. 31 is on the lower side, meaning there is a fair amount of background noise/interference on that frequency.

 

Back to top