LTE NB-IoT: Send and receive a UDP message with Quectel BC66

Now that the firmware was updated to revision BC66NAR01A03_BETA0808 I managed to find out how to send a UDP message and receive a response message indication. The Quectel support informed that the “BC66 is not finally released” and there are a lot of hints about features being “preliminary” in the documentation. So, in the end, I had to collect information from different resources, which is currently really a pain point in my opinion.

Again, I used the terminal application “putty” on channel A at a baud rate of 115200 bps.
You have to press the on/off button to wake the module from sleeping.

A note to the NB-IoT SIM card provided by 1NCE: There is a 6-digit pin printed on the backside of the credit card sized SIM card holder. This is a little bit confusing, because I never got error messages regarding that the SIM card is locked. The 1NCE support stated:

“Wir haben Ihre SIM-Karte bereits vorab aktiviert. Eine Eingabe ihrer SIM-Pin ist in keinem Fall notwendig”

Good to know that 🙂

Following you find a list of AT commands that I used to send and receive a UDP message. On a PC visible to the internet I started a small UDP echo server written in Python. A good example can be found here:

Enable full functionality


Set default APN for PDP (only required once, is stored in NVRAM)
Provider: 1NCE


Set to automatically report network registration status, when the module is
registered on the network, a URC will be reported.


Reset the module now to make the APN settings effective

F1: 0000 0000
V0: 0000 0000 [0001]
00: 0006 000C
01: 0000 0000
U0: 0000 0001 [0000]
T0: 0000 00B4
Leaving the BROM

If the module has not registered with the network before, this process can actually take minutes. You can check with

+CEREG: 0,2

The “2” means, that the module is currently trying to attach or searching an operator to register to. “1” means registered to “home network” and “5” means the module is registered in a “roaming network”

+CEREG: 0,5

Once registered, it should only take some seconds to get an IP address from the network


This IP actually matches the IP address reported in the 1NCE customer portal at


Create a UDP socket



Create a UDP socket connection to, port 20001


Send the string “0123456789”


If the UDP message manages to get to the UDP server and back (UDP messages may get lost), you should get the following “unsolicited result code” (URC), indicating that 16 bytes were received by the module.


That’s an issue and possibly a bug. I would have expected something like


Disconnect the UDP socket


Close the UDP socket


Some furtherAT commands of interest:

Query the available mobile network operators

+COPS: 0,2,"26201",9
           |       +-- NB-IoT 
           +---------- Operator is MCC=262/MNC=01 --> T-Mobile/Telekom


Query current network status

+QENG: 0,3740,0,156,"1D6E105",-78,-4,-74,15,8,"D325",0,
                    |                       | +-- Tracking Area Code (?)
                    |                       +---- Serving cell band
                    +---------------------------- Serving cell (hex) 


  • This module currently seems to be immature. The documentation is a mess, and it isn’t even possible to send and receive a UDP message in a communication round trip.
  • T-Mobile’s IoT Network is available, even though I don’t live in an area of high population density.
  • Would be interesting if someone is able to locate this network cell “1D6E105”. I couldn’t find it.
  • With Quectel OpenCPU, it is possible to write a small application and flash it directly into the module. So there is no longer the need to have a separate MCU. This seems very innovative for me. I will probably try out if I can write such a custom application that reads an external sensor and periodically sends the sensor values via NB-IoT.
  • Please leave me a comment if you like to give feedback or share insight.

16 thoughts on “LTE NB-IoT: Send and receive a UDP message with Quectel BC66

  1. Hi Wolfgang,

    very interesting.
    I already have revision BC66NBR01A02_BETA0720 but I’ve exactly the same issues with +QSONMI=0,16 where the data is missing and the same problem with the cell-id. I’ve currently no idea how it could be possible to get lon and lat. My assumption was that the LTE cell-ids will be reused and that it could be possible to perform a lookup again existing open-databases. It doesn’t seems to be correct.
    I would be really happy for a more detailled conversation. Please feel free to contact me.


  2. Regarding the cell id: In a few hundred meter distance, there is an antenna with cell id 1D6E102 (hex) 30859522 (dec). So this differs just in some minor digits from the “unknown” cell id 30859017. So I think the reason that this cell id does NOT appear in a database is that cells for NB-IoT get their own cell id, and that just up to now nobody has started to add this NB-IoT cells to this public databases.

    Regarding the receive issues, that +QSONMI does NOT return the payload? What is your plan how to go on with that? Wait for new firmware that possibly fixes that problem?

    • Regarding “So I think the reason that this cell id does NOT appear … nobody has started to add this NB-IoT cells to this public databases.”: Yes, that’s also my current point of view. We build a product where it’s very important to get the location without GPS, WIFI or other options. I had a conversation today with the unique operator in Austria which currently provides a nation-wide-coverage for NB-IoT today and positioning “is on our roadmap”, however … the cellIds of one provider doesn’t solve our problem of the cell-ids in europe or even further (fraud-detection-solution). Probably we have to deal with serious restrictions and/or very high cost and/or different proprietary services in order to get lat and lon for the next 2-3 years.
      Regarding “that +QSONMI does NOT return the payload”: I talk a lot with Quectel itself and I hope to get a firmware which solves this and other issues in the next weeks. But yes, wait and hope. Unfortunately the OpenCPU-part of the firmware doesn’t allows to fix this issues.

      Another point: Are you aware of the versioning? My point of view is that the BC66NA and the BC66NB are different hardwares, not only firmwares. I’m not sure if the NA (I have one too) can be used with the NB firmwares or the other way around. Do you have any information about that? If you are interested I have the BC66NA OpenCPU SDK. Do you have any idea how the debugging-toolchain for the OpenCPU SDK works? Serial-debugging is ok (really) but probably the USB-Debug-interface allows to use something like OpenOCD which acts as GDB-server and can be used with any IDE which uses a GDB-client. Do you have more sophisticated debugging-experiences?

      • When I did the firmware update, I was told to check for the right version – A or B. But I don’t know about the differences.

        About OpenCPU: It sounds interesting to interface with external sensors without the need to have an extra MCU, but I didn’t try it out. I don’t know how I can go on with a RF module that is apparently unable to receive messages. I am disappointed at the moment and looking for other alternatives.

  3. Dear Wolfgang,
    Thank you for your article!

    I am trying to make the BC66 module work, but I get stuck on AT+COPS command – if I issue AT+COPS=1,2,”23003″, the module gets stuck and does not answer to any AT command. (23003 is Vodafone CZ)
    I was using BC95 in my previous design with not problem, so signal should not be the issue.

    Is the update of the firmware necessary for the module to work?
    Currently I have revision BC66NAR01A01 and I did not find the flash update tool nor a download area to get the latest firmware for the module.

    I would be very happy if you could share some directions…

    • I have given up working with the BC66, moved to the BG96. It can be quite annoying that the radio modules have issues to register at the wanted radio network. Can you use a AT command to specify which LTE band Vodafone uses in CZ? This may reduce the time to register at the radio network. If I switch between providers Vodafone and 1NCE in Germany, I also often have the effect that it doesn’t work immediately for some reason. But, on the next day, it suddenly works without reason. Can interfering Bluetooth LE be the reason? Do the network providers need some hours to “provision” the network? Actually, I can’t give you a satisfying answer.

  4. Hi Wolfgang,
    I have a 1NCE SIM card and managed to connect to the network after a channel modification (I’m using the UBLOX R410M modem). Now I’m trying to send some UDP messages to the AllThingsTalk cloud for testing but no data arrives. Do you know if there is any filtering on the IP one can send UDP messages using 1NCE? Do you use any cloud service?
    Thank you.


    • No, I am not aware of any issues regarding UDP. I tested using MQTT and myDevices Cayenne, and also sent messages to my PC at home through my Internet provider‘s network.

      • Hello Wolfgang,
        Many thanks for the article.
        Could you kindly explain to me how to sent those messages to my PC through my internet providers network? I would like to sniff the UDP packets with Wireshark… I have not found the way to do this, I will highly appreciate it!

      • First you need to run a small UDP server on your PC that will receive and print out the messages. Google for „python udp server“. This server will listen on a local port of your choice.

        To make this PC connectable from your internet provider‘s network, you need to create a „port forwarding“ in the router of your home network.

        You need to find out the IP address of your router in the internet provider‘s network.

        Use this IP address and the source port of the „port forwarding“ when you send the UDP message from the NB-IoT module.

  5. Hello Mr. Klenk,
    I have seen their contributions and read very curious.
    I find your projects very interesting.
    I only started with a small project myself.
    I would like to read more in the topic NB-Iot.
    I also got a sim card from 1nce.

    And a device from the company

    You have specified a configuration for the BC96 in your blog. Do you also know the configuration for a BC95G-20 from Quectel?

    Unfortunately I found a bigger problem where I do not know any more.

    With the device I have to give a few details for the configuration, where unfortunately I can not answer.

    under the following link and then under STEP 3 I have to configure true or false. Do you know the answers for the GSM provider 1nce.

    Please help me.

    Thank you very much.

    With best regards

    Dirk Franke

  6. Here are the settings for 1NCE that work for me:

    Band: B8
    PLMN Code: 26201

    I am a little confused about what your statement that the communication module is a Quectel BC95G-20. This can’t be. It either is a BC95-G or it is a BC95-B20. If it is a BC95-G (G stands for “global”), then it should work in ALL radio bands. If it is a BC95-B20, then it is designed to operate in the B20 radio band. And in germany, Deutsche Telekom and 1NCE operate in band B8, so I am not sure if this will work.

  7. Hi Wolfgang
    I found your blog after searching for some info about BC85 & 1NCE. Your post is from 2018. Have you solved the issues? I made the first steps on AT command base but it seems for me very difficult to grab the required info. My hardware is a Dragino IoT shield. In another test, I want to try GPy from Pycom.

  8. My experience is, that once you have a solution running, once the chip is configured in the right way, registration at the network goes rather fast. But, for example when changing from 1nce to vodafone, it sometimes took several hours … and then it suddently worked.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s