Using a ZTE MF180 on GNU/Linux with wvdial

To use a "ZTE MF180 HSDPA USB Stick" (a device typically retailed by network providers like the Austrian bob as the "bob datenstick" (bob data stick)) on a (e.g Debian) GNU/Linux system, these instructions worked for me.

Please note that some of the commads I send to the device were from somewhere in the internet (links given where relevant) or even guessed. They worked for me, but might turn your device into a useless brick!

Step 1: Identify device

When first connecting the stick, it presents itself as as CD-ROM device after a few seconds. dmesg shows:

[...] usb 1-3: new high speed USB device using ehci_hcd and address 45
[...] usb 1-3: New USB device found, idVendor=19d2, idProduct=2000
[...] usb 1-3: New USB device strings: Mfr=3, Product=2, SerialNumber=4
[...] usb 1-3: Product: ZTE WCDMA Technologies MSM
[...] usb 1-3: Manufacturer: ZTE,Incorporated
[...] usb 1-3: SerialNumber: MF1800ZTED010000
[...] scsi46 : usb-storage 1-3:1.0
[...] scsi 46:0:0:0: CD-ROM            ZTE      USB SCSI CD-ROM  2.31 PQ: 0 ANSI: 2
[...] sr0: scsi-1 drive
[...] sr 46:0:0:0: Attached scsi CD-ROM sr0
[...] sr 46:0:0:0: Attached scsi generic sg1 type 5

and lsusb lists it as:

Bus 001 Device 045: ID 19d2:2000 ONDA Communication S.p.A. ZTE MF627/MF628/MF628+ HSDPA

(Of course, som details will differ from system to system.)

This CD typically contains vendor specific Windows drivers; you might want to look for a fitting icon there if you intend to create a graphical button for launching wvdial.

At this stage, the LED on the device should be red.

Step 2: Get rid of the CD thing

In order to access the modem proper, you'll need to signal to the stick that it may switch now. Fortunately, on this particular stick this is implemented in a quite straigt-forward way -- simply eject the CD:

eject /dev/sr0

After ejecting, three new devices will show up at ls /dev/ttyUSB*:

/dev/ttyUSB0  /dev/ttyUSB1  /dev/ttyUSB2

The important one is /dev/ttyUSB2. According to an ubuntuforums entry, /dev/ttyUSB0 is a NMEA port (which I have not yet seen doing anything) and /dev/ttyUSB1 is for montioring (e.g. querying signal strength while a connection is open).

At this stage, the LED should still be red.

You can now communicate with the device using AT commands, e.g. by using screen /dev/ttyUSB2. For example, you can query the security status by entering AT+ZSEC?:

+ZSEC: 0,0


(That is, you enter AT+ZSEC?, followed by return, and the stick responds with a status and an OK message. You can leave the screen session by pressing Ctrl-a, k, and y. If screen complains about "Cannot access line", you might need to invoke it with sudo.)

The exact interpretation of the ZSEC reply is explained in the 3g-modem wiki, but for now it will be sufficient to know that 0,0 means that no PIN has been entered.

Disabling CD mode

There are two parameters that can be set: "autorun" and "download".

Autorun can be enabled using AT+ZCDRUN=9, disabled using AT+ZCDRUN=8 and queried using AT+ZCDRUN=4. [1]

Download mode can be enabled using AT+ZCDRUN=E, disabled using AT+ZCDRUN=F and queried using AT+ZCDRUN=G. [2]

Enabling download mode works best for me as it hides the CD completely. (Autorun mode just makes both the ttyUSB and the CD show up at the same time.)

Step 3: Unlock the SIM card

Before the modem accepts any commands from wvdial to set up the modem connection, it needs the SIM card unlocked by entering the PIN (where 1234 is your PIN):


The LED will then turn blue after a few seconds, and AT+ZSEC? will then receive the response 3,0.

LED color

It might happen that you LED remains red or goes back to red after some time, or goes to green. This seems to be due to bad network connectivity; AT+ZPAS? reported "Limited Service" instead of "UMTS","CS_PS" for me iff the LED was red, and "GPRS","CS_PS" iff the LED was green.

Disabling the PIN

To use the wvdial configuration below, you need to allow the SIM card to connect without a password. Disable password prompting by issuing AT+CLCK="SC",0,"1234" (again, for you PIN being 1234). You can re-enable it using AT+CLCK="SC",1,"1234".

The more secure version would be writing a chat script that enters the pin and polls for the response to AT+ZSEC? or AT+ZPAS? to indicate that everything is ready.

Step 4: Get a network connection

After the device is unlocked and connected to the network, a pretty straightforward /etc/wvdial.conf setting for wvdial is required to get things running; I use this:

[Dialer bobstick]
Phone = *99#
Username =
Password = ppp
Init2 = AT+CGDCONT=4,"IP",""
Modem = /dev/ttyUSB2
Stupid Mode = 1

The Phone, Username and Password parts, the "" section in the Init2 (that's the APN) and the "Stupid Mode" are specific to bob; instructions what to put there should come with your SIM card.

Then, start wvdial bobstick (you might need sudo again, and don't forget to close screen sessions running on /dev/ttyUSB2 as they'll eat the stick's responses):

--> WvDial: Internet dialer version 1.60
--> Cannot get information for serial port.
--> Initializing modem.
--> Sending: ATZ
--> Sending: AT+CGDCONT=4,"IP",""
--> Modem initialized.
--> Sending: ATDT*99#
--> Waiting for carrier.
CONNECT 3600000
--> Carrier detected.  Starting PPP immediately.
--> Starting pppd at [...]
--> Pid of pppd: 22867
--> Using interface ppp0
--> local  IP address [...]

And there you go, network up and running!

The LED should be blinking now.

If you want to further interact with the device, use screen /dev/ttyUSB1 as ttyUSB2 is now in use by PPP.

Step 5: Reset

(Remember what I said about bricking? That's the part where I guessed brutally.)

When a connection is active, just stopping wvdial is not enough to make the connection stop on the stick's side -- the LED keeps blinking. Sending the command AT+ZRST resets the device.

More commands and devices

jtrenchard found some more commands in the binary code of a similar dongle, e.g. a AT+ZVN which I guess stants for "ZTE version" and reports "BD_MF180TLF3V1.0.0B01 [JUNE 8 2010 17:00:00]" for me. The AT+ZRST very much looks like a reset command (as does AT+ZOPRT=0), AT+ZECC? returns US and European emergency numbers.

Similar devices probably have different tty numbers. For example, see the ZTE MF193 guide by Rudy Godoy.

Written by chrysn 2010-10-26 (updated 2014-02-14), published under the terms of CC-BY-SA. For the latest version, look at the original address, where you will also find the reStructuredText source.