Notes on Setting up a Cambium 850C PTP

These are set up a bit weird compared to normal WISP radio equipment. The default IP address is for the radio. So you need to set a with a subnet of Looks like it is usually only accessible via the management port and you need to make or buy a special patch cable.

The User Guide is available here

You can download the Installation Guide from here

Both those documents show how to install and get into the device.

What is 802.11R (Fast Roaming, Fast Transition, FT PSK)

Fast BSS Transition is a method for a device to seamlessly move move between Basic Service Set (BSS) AKA a Wireless AP’s, inside of an Extended Service Set (ESS) AKA, WLAN deployment.

This can help prevent Voip calls from dropping while someone is walking across campus or between buildings.

FT PSK is a Password option for Cisco equipment The idea is

Some more resources for learning more.

Convert Kismet NetXML capture to CSV

First download the following python script which we’ll use to convert the Kismet NetXML file.


You should now be able to run the script with.


Help output for NetXML to CSV

bob@localhost:~$ python  
Usage: <NetXML File> <oUTPUT File Name> <Filter> (Filter is optional)


python Kismet-file-input.netxml Kismet-csv-output.csv

Example of converting file.

bob@localhost:~$ python Kismet-20191023-12-50-42.netxml Kismet-20191023-12-50-42.csv

You can now import the csv into Google Earth.

SSH into Baicells eNodeB

Based upon multiple nmap scans on Baicells eNoceB’s it appears that they use port 27149 as the default SSH port.

Example scan

Alfred@localhost:~$ nmap -p 1-28999
Starting Nmap 7.60 ( ) at 2019-08-27 21:19 CDT
 Nmap scan report for
 Host is up (0.044s latency).
 Not shown: 28996 closed ports
 80/tcp    open  http
 7547/tcp  open  cwmp
 27149/tcp open  unknown  <-- SSH Port 
Nmap done: 1 IP address (1 host up) scanned in 10.81 seconds

SSH into eNodeB

ssh -p 27149 admin@ 


ssh -p27149 admin@ 
 CELL> ?
   enable      Turn on privileged mode command
   exit        Exit current mode and down to previous mode
   list        Print command list
   passwd      User password
   ping        Send echo messages
   quit        Exit current mode and down to previous mode
   show        Show running system information
   ssh         Open an ssh connection
   telnet      Open a telnet connection
   terminal    Set terminal line parameters
   traceroute  Trace route to destination
   whoami      Show current user in system