AT Commands 2025: Essential Guide For IoT Devices
AT Commands 2025: Essential Guide For IoT Devices
AT Commands 28.04.2025
Håkon Westh-Hansen
Engineering Team Lead
AT commands (or Hayes commands) form the language used to communicate with cellular
modems. Whether you’re developing an IoT device, working with M2M applications, or trying
to understand how your device talks to cellular networks, understanding “ATtention” or AT
commands is essential.
In this comprehensive guide, I’ll walk you through what AT commands are, how they work,
and provide practical examples to get you started.
Table of Contents
What are AT commands?
Do different manufacturers have different AT commands?
The role of AT Commands in IoT connectivity
How do AT commands work?
AT commands syntax basics
Core format and structure
Setters, getters, and testers
Chaining Commands
AT Command responses
2 types of AT commands
Different categories of AT commands
Practical AT commands examples
1. Standardized list of AT Commands: your cross-modem toolkit
A. Establishing a data connection
AT+COPS
AT+CREG
AT+CEREG
AT+CGREG
AT+CGDCONT
AT+CGACT
Seeing it in action
B. Establishing a PPP Connection
C. Getting the modem and SIM information
Resetting the modem profile
Get the modem meta-data
SIM and device identifiers
D. Sending an SMS
2. Manufacturer-Specific AT Commands (SIMCom and Quectel)
A. Pinging a server
B. TCP/UDP communication
Advanced features and debugging tips
Establish a connection to the network: Signalling investigation
Adding a network preference list
Debugging tips
References
A typical AT command might look like: AT+CREG? (which checks the network registration
status).
Good news: there’s a shared standard across the industry. However, the specific command
set can vary between manufacturers and models. Examples include AT+QIOPEN for Quectel
modules and AT+CIPPING for SIMCom modules.
Additionally, some commands in the standard are optional and may not be present on all
modems.
To read more about telecommunication standardizations, this article paints the full
picture.
From setting the Access Point Name (APN), which is a logical name used to select the
gateway to the external packet data network, to dialing a data connection, AT commands
are the mechanism used to configure and control the modem to get online.
AT<COMMAND><SUFFIX><DATA>
The basic format is AT followed by the command, a suffix indicating the command type (e.g.,
setting a value, querying information), and sometimes additional data. Each command line
ends with a carriage return, but multiple commands can be strung together on a single line
using semicolons.
E.g. AT+CGDCONT=1,"IP","onomondo"
Chaining Commands
Use of ; : AT commands which are to be executed sequentially right after each other can
be delimited with a ; and only the first command should include AT
E.g. AT+CREG?;+GGREG?
AT Command responses
Response What it means Example
+CME ERROR:
Extended error for mobile equipment
<code>
+CMS ERROR:
Error related to SMS functionality
<code>
According to U-Blox, before each transmitted AT command the device communicating with
the modem should:
Wait 20 ms
Flush the buffer
This helps the device handle unsolicited result codes (URCs), which the modem sends for
various events if enabled. A typical URC would be the one coming from network
registrations both data- and phone/SMS wise.
Here’s what it looks like when you issue a command to register on the network — with URC
and without URC:
OK
+CREG: 2
+CREG: 5
+CREG: 5
OK
+CREG: 0,5
2 types of AT commands
All AT commands generally fall into 2 categories: basic and extended.
Basic AT commands: broadly speaking, if a command does not start with + , this is a
basic command.
Test commands
Read commands
Set commands
Execution commands
What is it
Category Suffix Syntax Example
for
To query the
modem
about its
AT<COMMAND
Test capabilities =? ATD=?
or supported NAME>=?
parameter
ranges
To read the
current
Read status or ? AT<COMMAND NAME>? AT+CBC?
configuration
of a setting
To configure
parameters AT<COMMAND
AT+CSCA=”+123456789”,
Set or settings = NAME>=value1,
on the 120
value2, …, valueN
modem
To trigger a
specific
action on AT<COMMAND
AT+CMSS=1,”+123456789”,
Execution the modem, none NAME>=parameter1,…,
such as 120
parameterN
dialing a
number
AT+COPS
What is it for: Choose the network operator to use and register on the circuit-switched
network.
Setting
AT+COPS=[<mode>[,<format>[,<oper>[,<AcT>]]]
syntax
Note: Even though it is not documented in the standards, this command also goes ahead
and connects to the circuits-switched network of the chosen provider (phone/SMS
connection, also called GSM connection in our network logs). As an additional warning from
our engineers, telling your modems to attach/detach is not always a good practice.
For a closer look, we covered the modes, parameters, and some examples in this
dedicated blog for AT+COPS.
AT+CREG
What is it for: Circuit-switched network registration status, which is the connection that
provides the phone/SMS service.
Testing
AT+CREG=<n>
syntax
Example +CREG:
response <n>,<stat>[,[<lac>],[<ci>],[<AcT>][,<cause_type>,<reject_cause>]]
To get a practical overview on how to use this command including the variables, check
out this AT+CREG blog.
AT+CEREG
What is it for: Registration status of the device for LTE or newer cellular network
technologies.
Full command details (variables) are here on this dedicated AT+CEREG blog.
AT+CGREG
What is it for: Packet-switched network registration status.
+CGREG:
OK
Example response
+CGREG: (0-2)
OK
Note: Identical to AT+CREG but for the packet-switched network instead, i.e. data
connection
CREG vs CGREG vs CEREG, what are the difference between these AT commands? Find
the answer and variables in this in-depth AT+CGREG blog.
AT+CGDCONT
What is it for: Define packet data protocol (*PDP) context
<PDP_type>: string type; specifies the type of packet data protocol. The
default value is manufacturer-specific.
X.25 ITU-T/CCITT X.25 layer 3 (Obsolete)
IP Internet Protocol (IETF STD 5 [103])
IPV6 Internet Protocol, version 6 (see RFC 2460 [106])
IPV4V6 Virtual <PDP_type> introduced to handle dual IP stack UE
capability. (See 3GPP TS 24.301 [83])
OSPIH Internet Hosted Octect Stream Protocol (Obsolete)
PPP Point to Point Protocol (IETF STD 51 [104])
Non-IP Transfer of Non-IP data to external packet data network
(see 3GPP TS 23.401 [82]) Ethernet
Ethernet protocol (IEEE 802.3)
Unstructured Transfer of Unstructured data to the Data Network via N6
(see 3GPP TS 23.501 [165])
<APN>: string type; a logical name that is used to select the GGSN or
the external packet data network.
*A PDP context is a piece of information that is needed inside the mobile core in order for it
to set up a data session. From the device point of view, this is where the access point name
(APN) is set. The command in itself does not activate any signalling.
For EPS and 5G, this command instead sets the PDN connection and PDU session
respectively.
AT+CGACT
What is it for: Activate/deactivate PDP context
If an activation of a PDP context is issued and the modem is not connected to the packet-
switched (PS) network then it will first attach to the PS network, this is equivalent to running
AT+CGATT=1
Using the AT command sequence in this blog, you can establish a data connection to
your cellular IoT connectivity provider to test modem connectivity.
Seeing it in action
In order to get a data connection we have to do the following:
AT – check the connection to the modem, should respond OK (this step is not strictly
needed)
AT+COPS=0 – choose network operator and register on the circuit-switched network
This procedure could be used to test whether or not there are any problems in terms of just
getting a connection.
Since the SIM has already been attached at some point to the network operator a new
authentication is not needed. We first see new signalling when the modem actually attaches
to the packet-switched network, i.e. when AT+CGACT=1,1 is issued.
AT+CGACT=1,1 – activate PDP context (will also call AT+CGATT=1 , which is a network
attach command if not already attached)
ATD*99# – dial up provider ( *99# is the standard number to dial up the operator)
This procedure is actually what is being carried out by Linux’s PPP daemon, pppd, on the
deveyes and watchdogs.
Also as a side note then some modems might require that the baud rate used with the serial
connection be fixed to a specific value.
Reset commands
Modem meta-data
SIM and device identifiers
The settings that will change are not clearly stated in the standard but check with the
settings with your modem. Additionally, the reset will never trigger a change in the baud
rate.
D. Sending an SMS
To send a text message:
> Your message text here # Type message after '>' prompt
# Press Ctrl+Z to send
Now, you can try it out using the AT+CMGS=<number> command, e.g.:
AT+CMGS="1234"
> saying hello from modem!
+CMGS: 11
OK
Start testing
A. Pinging a server
For SIMCom modems:
In order to use any of the subsequent SIMCom’s AT commands an active PDP context is
needed, but it has to be established using SIMCom’s own special AT commands12. Here’s
the procedure:
AT+CIPPING=<host>[,<retryNum>[,<dataLen>[,<timeout>[,<ttl>]]]]
# Ping Google's DNS server
<host> Address of the remote host, string type. This parameter can be
either:
<timeout> The timeout, in units of 100 ms, waiting for a single Echo
Reply
1-600 Default: 100(10 seconds)
For these Quectel specific AT commands to work, an activated PDP context is needed, i.e.
an active data session, which was discussed in the “establishing a data connection” part.
Then you can run the commands accordingly.
AT+QPING=<contextID>,<host>[,<timeout>[,<pingnum>]]
# Pings a remote server
<host> The host address in string type. The format is a domain name or a
dotted decimal IP address.
<timeout> Integer type. Set the maximum time to wait for the response of
each ping request. The range is 1-255, and the default value is 4.
Unit:second.
<pingnum>Integer type. Set the maximum number of time for sending ping
request. The range is 1-10, and the default value is 4.
B. TCP/UDP communication
To send data over TCP (again, varies by manufacturer):
SIMCom example:
AT+CIPMODE=<mode>
# Set transparent (1) or non-transparent mode (0)
AT+CIPSTART=[n,]<mode>,<host>,<port>
# The setting syntax. Connect to server on port 80 ([0…5]<”TCP” or
“UDP”>,<remote server IP address>,<Remote server port>
AT+CIPSEND
# Send data through TCP or UDP. AT+CIPSEND[=<length>|] (in case of
multiple connections a <n> variable also need to be set.
AT+CIPSERVER=<mode>[,<port>]
# Set up a TCP server. `port` is not needed when closing it =<mode> 0
Close server, 1 Open server, <port> 1..65535 Listening port
Quectel example:
AT+QIOPEN=<contextID>,<connectID>,<service_type>,<host>,<remote_port>[,
<local_port>][,<access_mode>]
<contextID> Integer type. The context ID. The range is 1-16. (the PDP
context ID)
<connectID> Integer type. The socket service index. The range is 0-11.
<access_mode> Integer type. The data access mode of the socket service.
0 Buffer access mode
1 Direct push mode
2 Transparent access mode
AT+QIRD=<connectID>[,<read_length>]
# Retrieve the received data from a socket =<socket service index from
0-11>[,<0-1500 byte range>]
OK
OK
OK
OK
OK
OK
In Onomondo, we have a feature that allows you to see the network logs. When the
commands above were executed, here’s what the logs show:
OK
Using AT commands allow you to change your prefered networks with these 2 commands:
We created a full tutorial to use these AT commands in this PLMN list blog, that also includes
a template you can use to help you manage your list.
Debugging tips
1. Enable verbose error reporting with AT+CMEE=2 to get detailed error messages
2. Check signal quality with AT+CSQ before attempting connections
3. Enable network registration notifications with AT+CREG=1 to receive real-time updates
4. Verify APN settings with AT+CGDCONT?
5. Check if the modem is attached to the packet network with AT+CGATT?
References
This guide originally appeared on the author’s GitHub.
https://www.itu.int/rec/T-REC-V.250/en
https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?
specificationId=1515
https://www.u-blox.com/sites/default/files/AT-CommandsExamples_AppNote_(UBX-
13001820).pdf
Exploratory Analysis of a GGSN’s PDP Context Signaling
Load, http://downloads.hindawi.com/journals/jcnc/2014/526231.pdf
https://www.cika.com/soporte/Information/GSMmodules/Quectel/AppNotes/Quectel_GSM_PPP_Application_Note.pdf
https://zoomtel.zendesk.com/hc/en-us/articles/212403243-Mobile-broadband-service-
provider-settings
https://simcom.ee/documents/SIM7100E/SIM7100_AT%20Command%20Manual_V1.01.pdf
https://www.telit.com/wp-content/uploads/2018/03/Telit-LN940-SERIES-AT-Command-
User-Guide-REV1.4.pdf
http://www.python-
exemplary.com/download/sim800_series_tcpip_application_note_v1.00.pdf
https://simcom.ee/documents/SIM900/SIM900_PING_AT%20Command%20Manual_V1.00.pdf
(even though it is for the SIM900’s series it still works for the SIM800 series)
https://www.elecrow.com/wiki/images/2/20/SIM800_Series_AT_Command_Manual_V1.09.pdf
https://sixfab.com/wp-
content/uploads/2018/09/Quectel_EC2xEG9xEM05_TCPIP_AT_Commands_Manual_V1.0.pdf
AT commands FAQs
Related articles
How to test connectivity with How to ping your modem using AT+COPS: Modes, parameters,
AT commands AT commands and examples
Building & Debugging Connectivity Building & Debugging Building & Debugging
By using the AT command sequence in this Checking your modem’s data connection by
blog, you can establish a data connection to performing a ping after a successful network
your cellular IoT connectivity provider to test… attachment can help debug connectivity…
modem connectivity. issues. This blog shows you how.
Read more Read more Read more
FAQs
Deploying IoT in the UK?
Explore our solution, coverage,
and best practices.
Learn more
Privacy Policy Cookie Policy © 2025 Onomondo ApS, H. C. Hansens Gade 4 DK-2300 Copenhagen, Denmark