LTE NB-IoT: Send and receive a UDP message with Quectel BC66

Now that the firmware was updated to revision BC66NAR01A03_BETA0808 I managed to find out how to send a UDP message and receive a response message indication. The Quectel support informed that the “BC66 is not finally released” and there are a lot of hints about features being “preliminary” in the documentation. So, in the end, I had to collect information from different resources, which is currently really a pain point in my opinion.

Again, I used the terminal application “putty” on channel A at a baud rate of 115200 bps.
You have to press the on/off button to wake the module from sleeping.

A note to the NB-IoT SIM card provided by 1NCE: There is a 6-digit pin printed on the backside of the credit card sized SIM card holder. This is a little bit confusing, because I never got error messages regarding that the SIM card is locked. The 1NCE support stated:

“Wir haben Ihre SIM-Karte bereits vorab aktiviert. Eine Eingabe ihrer SIM-Pin ist in keinem Fall notwendig”

Good to know that 🙂

Following you find a list of AT commands that I used to send and receive a UDP message. On a PC visible to the internet I started a small UDP echo server written in Python. A good example can be found here:

Enable full functionality


Set default APN for PDP (only required once, is stored in NVRAM)
Provider: 1NCE


Set to automatically report network registration status, when the module is
registered on the network, a URC will be reported.


Reset the module now to make the APN settings effective

F1: 0000 0000
V0: 0000 0000 [0001]
00: 0006 000C
01: 0000 0000
U0: 0000 0001 [0000]
T0: 0000 00B4
Leaving the BROM

If the module has not registered with the network before, this process can actually take minutes. You can check with

+CEREG: 0,2

The “2” means, that the module is currently trying to attach or searching an operator to register to. “1” means registered to “home network” and “5” means the module is registered in a “roaming network”

+CEREG: 0,5

Once registered, it should only take some seconds to get an IP address from the network


This IP actually matches the IP address reported in the 1NCE customer portal at


Create a UDP socket



Create a UDP socket connection to, port 20001


Send the string “0123456789”


If the UDP message manages to get to the UDP server and back (UDP messages may get lost), you should get the following “unsolicited result code” (URC), indicating that 16 bytes were received by the module.


That’s an issue and possibly a bug. I would have expected something like


Disconnect the UDP socket


Close the UDP socket


Some furtherAT commands of interest:

Query the available mobile network operators

+COPS: 0,2,"26201",9
           |       +-- NB-IoT 
           +---------- Operator is MCC=262/MNC=01 --> T-Mobile/Telekom


Query current network status

+QENG: 0,3740,0,156,"1D6E105",-78,-4,-74,15,8,"D325",0,
                    |                       | +-- Tracking Area Code (?)
                    |                       +---- Serving cell band
                    +---------------------------- Serving cell (hex) 


  • This module currently seems to be immature. The documentation is a mess, and it isn’t even possible to send and receive a UDP message in a communication round trip.
  • T-Mobile’s IoT Network is available, even though I don’t live in an area of high population density.
  • Would be interesting if someone is able to locate this network cell “1D6E105”. I couldn’t find it.
  • With Quectel OpenCPU, it is possible to write a small application and flash it directly into the module. So there is no longer the need to have a separate MCU. This seems very innovative for me. I will probably try out if I can write such a custom application that reads an external sensor and periodically sends the sensor values via NB-IoT.
  • Please leave me a comment if you like to give feedback or share insight.