Anything similar I could do on the MicroTik? Setting the device into MBIM Mode from the LTE Interface Settings has no effect. I assume this only works for 'known' devices.
RouterOS has no udev/sysfs access, so that exact rule won't port over. Your best bet is /interface lte at-chat if the VOS 5G exposes a diagnostic AT port in mode 1 (check /port print after plugging in). Qualcomm SG500 based dongles sometimes respond to AT+QCFG="usbcfg" or AT^SETPORT for mode switching even without official support. Worth trying the switch on a Linux box once first since some of these modems store the USB config persistently in NVRAM, not just per session. Also worth checking if the AT port disappears once you're actually in MBIM, since that seems to be the case on other Qualcomm modems in RouterOS too.
Unfortunately no serial port is exposed. In CDC mode the ssh port is reachable, but I was unable to log in as either root nor admin with default password or a new password I set on the WebGUI.
Unfortunately there is hardly any documentation, on that device. I opened a case with Tri Cascade Inc. about one week ago to ask there is a way to permanently switch to MBIM mode but have not heard back yet.
There is a mode switch utility for windows, but that only switched between MBIM and RNDIS and also only fir the current session, not permanently.
No serial port means at-chat is off the table completely for this device. Worth trying default creds on the modem's own SSH (root/root, admin/admin, or check if telnet is open instead), since WebGUI and SSH auth are often separate stores on OEM Qualcomm builds. If that fails, capture the Windows switch utility with Wireshark plus USBPcap. It's either sending a raw USB control transfer or hitting a hidden HTTP API on the modem's local web server, and either one would tell you exactly what needs to be replicated to make the switch persistent.
It looks like somebody managed to get the serial interface by changing the product ID (maybe via adb). Unfortunately my polish is not that good (not even with google translate) so I'm not sure how this was done and I can not reproduce with for example usb-modeswitch.
Just log in and write the altered product ID to the boot_hsusb_comp file as mentioned above to permanently change the operation mode to MBIM.
I purchased my device on Aliexpress - it came with sanded down logos on both side which is very peculiar and would hint to me that it is a counterfeit device - a request to Tri Cascade INC customer service with my devices IMEI and serial was not yet answered.
The device is getting correctly recognized as MBIM Mobile Modem by my Mikrotik now and reports signal strength and SNR.
Overall the device works as expected. On a notebook with USB-C I obtained > 250 Bit/s (both ways as if I correctly recall). I'm not so much keen on speed, it's more about still getting service where 4G LTE is overcrowded.
I'm running the device on an USB-A port so 200M/bit will probably be the best possible.
The device does not seem to support 5G SA but requires 5G NSA with LTE to be functional. But maybe this is also caused by my mobile operator.
Thank you. I've gone ahead and ordered the device from a local reseller, came to about 80 USD. It was slightly cheaper on AliExpress but its banned in my country, plus international shipments can get slapped with customs duty.
@woodych Got my device earlier today and it’s working as expected. Tried setting boot mode to 9085 and it starts in MBIM mode as expected.
However, how do I now change the mode? In MBIM mode SSH is not accessible (kind of expected). The USB switch utility doesn’t detect the device at all.
Answering my own question, as ADB is available, I was able to just run adb shell and could access the shell. From there could change the mode using the same process as earlier.
I never attempted to switch back as for me MBIM is the correct mode
But in MBIM Mode you should be able to issue AT commands on the 'control' interface, I think there is one simiart to AT+USBMODE= to switch the USB Mode.
And as you found out, I selected a modem with active ADB debugging so that there is a door open to still access the device
Yes, on MikroTik in MBIM mode it was plug and play. An LTE interface was automatically created and connection was established without any other input. Operator, Model, IMEI, IMSI and other metadata was visible as well. However from a signal level perspective only the RSSI was available, I guess that’s all that’s exposed. Even in the web UI you can only see the RSSI. One thing I would have liked to see was the specific LTE or 5G band currently locked to, the UI exposes that info.
I wanted to switch back cause MBIM doesn’t play well on a Mac and even with my travel router (Cudy TR3000) it didn’t work.
Another issue is that the operator I’m on uses 5G SA with only IPv6, you don’t get an IPv4 address when connected over 5G. They use 464XLAT, and MikroTik doesn’t seem to have any CLAT support.
