Using TEMS Pocket. Johan Montelius

Size: px
Start display at page:

Download "Using TEMS Pocket. Johan Montelius"

Transcription

1 Using TEMS Pocket Johan Montelius Introduction In this laboration you will get acquainted with the TEMS Pocket tool. You will examine both the Monaco network and a commercial network. Since this is your first laboration and we have not talked about the details during lectures yet, much of the information will look like Greek (unless you master Greek in which case it will look like some other incomprehensible language). Don t worry, we will go through the details during lectures as we proceed. 1 Getting started TEMS is a tool used to examine the performance of a mobile network from the mobile stations point of view. There are of course allot of statistics that can be gathered form the network it self but some information is only available or best collected using a mobile terminal. TEMS can be operated in two modes: either using Pocket which is operated using only the mobile or, connecting the mobile to a PC and logging all traffic for later examination. In this laboration you will use the Pocket tool and examine the Monaco network. To start the laboration you should have a T68 TEMS phone with a SIM card for the Monaco network. The IMSI number of the cards is written on the card and from this you can derive your MSISDN which is xx where xx is the two last digits on your SIM card. Turn the phone on and try to call another group. If you see a lot of strange figures when you turn on the phone press the options key (below the YES button) and select Pocket View Off. You should also make sure that GPRS is properly configured. Create a data GPRS account called Monaco using the APN apn01.ericsson.com, no user name nor password. Also create a WAP profile that used the created account and the WAP gateway Try to access a WAP site (wap.svd.se for example). You could also, from the options menu, choose Pocket View Help. This will give you a hint of what the figures in each display means. 2 A first look You re now ready to turn on Pocket. Press the options key and select Pocket View On. You should now see the first screen Serving Cell 1 with the basic information about the mobile network that you re connected 1

2 to. If you use the navigation button you can switch to different pages (twelve in total) even more cryptic names and content but we will start by looking at the Serving Cell. 2.1 Serving Cell The B in the beginning of the first row means that the row is the information of the broadcast control channel (BCCH). This is logical channel that the mobile is currently listening to for information of the network or paging messages. The numbers to the right of the B are carrier number (or the Absolute Radio Frequency Channel Number - ARFCN), the Base Station Identity Code (BSIC) and, the received signal strength in dbm. All carriers in the GSM spectrum are numbered by the ARFCN. The numbers are used in the 900-band, in the 1800-band. If you know the ARFCN you can calculate exactly which frequency that is used. One interesting thing to observe is if the frequency used is in the 900-band or the 1800-band. The BSIC consist of a 3-bit Network Color Code (NCC) and a 3-bit Base Transceiver Station Color Code (BCC). These codes are only internal to a mobile operator and a BSIC does not uniquely identify a base station. However base stations in range of each other that uses the same frequencies must have different color codes. This means that operators need to synchronize their BSIC values close to national borders where they are in range of another operator using the same frequencies. The received signal strength should between -60dBm and -90dBm. If it s above -70dBm the signal strength is very good while below -90dBm is poor. The network can set a limit on how weak a signal could be while still allow a mobile to attach to the system but this limit is normally set to less than -100dBm. When you later take a walk you will check this figure to examine how the signal strength varies depending on your location. The third line shows the Carrier to Interference ratio (C/I) of the current active channel in db. In idle mode this mean that it shows the value for the channel indicated by the first row. If we set up a call the value will pertain to the traffic channel that we are using. We will get back to this row later since it will show more information once we have a traffic channel in operation. On the fourth line we have a two figures 10/10 or similar. This is the Downlink Signaling Failure Counter (DSC), the current value and the max value. When a signaling packet is successfully received on the broadcasting channel the counter is incremented by one (but never above the max value). When a signaling packet is lost the current value is decremented with four. If the current value reaches 0 it s high time to perform a cell re-selection. You could check this value later when you take a walk. 2

3 2.2 Mobile Network Codes In the two last rows on the screen you will see the Mobile Country Code (MCC) which is 240 for Sweden and the Mobile Network Code (MNC) which we have chosen to be 98. The last figure on the row is the Location Area Code (LAC). The last row shows the Routing Area Code (RA) and the Cell Identity (CI). The routing area code is used for GPRS and divides the location area into smaller sections. The cell identity is used by the Serving GPRS Support Node (SGSN) to identify the cell used by a GPRS terminal. 2.3 The Neighborhood Switching to the second page we will take a look at the Neighbor List. This page is for our network utterly boring since we do not have any neighbors. There is only one dummy neighbor defined and since this neighbor is only in our minds it does not transmit with very high power. If you have your own SIM card you can switch cards and look at a real network. A real network will list six neighbors giving their frequency numbers (ARFCN), Base Station Identity Codes (BSIC) and, receiving signal strength. Note that the mobile is probably listening to the strongest signal (the first row) but that is probably has several base stations to select from. The following page, the Cell Selection page is the same set of neighbors but now ranked according to the Path Loss Criterion and Cell Reselection Criterion. The path loss criterion is a better value to watch when doing a cell selection, the reason is that is take into account not only the receiving signal strength but also the required signal strength to connect to the cell and the maximal transmitting power allowed. To complicate matters even further the Cell Reselection Criterion is the value that is actually used when the cells are compared. The re-selection criterion is very similar and often identical to the cell selection value. The re-selection criteria however also weigh in a time factor to avoid selecting string cells that have only been visible for a short time. A penalty could also be given by the network to prevent mobiles from selecting certain cells such as macro cells that should be reserved for fast moving terminals. If you want to learn the details study TS The current channel Page number four show similar selection criteria using GPRS information and page five is a collection of the six strongest neighbors. The sixth page, Current Channel gives us a little bit more information about the broadcasting channel. The two first rows are only shown when the phone is idle. The first row shows: 3

4 the Common Control Channel (CCCH) configuration, a 0 means that we have one CCCH that is not combined with any Stand-alone Dedicated Control Channel (SDCCH), a 1 means that the CCCH is combined with a SDCCH BS-PA-MFRMS, the numbers of multiframes between paging groups (2-9), this is for how long the mobile has to wait in between paging messages from the network BS-AG-BLKS-RES, the number of Common Control Channel (CCCH) blocks (0-7) that are reserved for the Access Grant Channel (AGCH) if attach and detach is enabled (0/1) The second row shows: MT-TXPWR-MAX-CCH, the maximum power (in dbm) the mobile is allowed to use when performing a random access RXLEV-ACESS-MIN, the minimum required signal strength required for accessing the cell T3212, a timer, current/max, that defines when the mobile has to do a location update (not set in the Monaco network) The lower three rows shows the current channel type, which is BCCH if the phone is idle. Set up a call between two phones and see how the phones first switch over to a Stand-alone Dedicated Control Channel (SDCCH) and then over to a Traffic Channel (TCH). The traffic channel will be one of: FR, full-rate voice mode HR, half-rate voice mode EFR, enhanced full-rate voice mode D24,... different kinds of data modes The number after the channel mode is a sub-channel number which is for example needed for half-rate voice mode. Notice that the two phones can have different voice modes, one can be in full-rate and the other in half-rate. The voice mode is only valid between the mobile phone and the Transceiver Rate Adaption Unit (TRAU) which will recode the voice into a 64kps voice stream. The two lowest low show information for frequency hopping or ciphering. This is not used in the Monaco network at the moment but if you insert an operator SIM card you will be able to discover which frequency hopping patter and ciphering algorithms that are used. 4

5 2.5 Paging and random access Moving on to the next page we find information about the paging and random access channels. The first row shows: the Common Control Channel (CCCH) group the paging multiframe group the paging block index These entries will become clear once we learn about paging of mobiles for incoming call. The next two lines show the Temporary Mobile Subscriber Identity (TMSI) and Packet Temporary Mobile Subscriber Identity (PTMSI). These are temporary addresses used by the network when identifying a subscriber. These numbers can change and are partly there to hide the true identity of subscribers. The five figures in the middle shows information that is related to the random access channel, how many retransmissions are allowed (third figure) and number of re-transmissions performed in the last attempt (fourth figure). 2.6 More on the current cell Pages eight and nine show more information about which frequencies are used by the current cell, the CA List, and which are used by neighboring cells, the BA list. In the Monaco network the CA list should show two entries since we have a base station with one cell that uses two frequencies (1 and 4). In a large network you would typically see more entries especially in urban environment. 2.7 GPRS information The following two pages are related to GPRS traffic and we will not go in to them on this laboration. But if you do some waping you will see that your are allocated a IP number. 2.8 The last page The last page shows some Channel/Interference numbers for the carriers that are currently used. In idle mode this is only the value of the carrier of Broadcasting Control Channel but in dedicated mode it could show several carriers that are used in a frequency hopping scheme. 5

6 3 Take a walk Ok, so let s take a walk. Remember to be back well in time for the next group. Also before you go make a phone call to another group so you have their phone number stored in the mobile. 3.1 The Monaco network You use a Monaco SIM card, walk through the building and toward Kista IP. Since we only have one base station the mobile will be forced to talk to this station and can not switch over to any alternative stations (you could force the TEMS phone to lock on station if you want). Observe the signals strength on page one and how it changes in the building. The base station is on the roof so try go down in the garage to observe some low values. If values get low check the Downlink Signaling Failure Counter (page one fourth row). Does it move? Now set up a call to the other group and observe the information on the first page. You will see how a signaling channel is first allocated and then how a traffic channel is set up once the call is connected. If you keep the call open the second row shows information about the traffic channel. The third figure is the time slot that you are using (if we all make calls it will get crowded but it should work). The last figure in that row shows the transmit power in dbm. The power level should change as conditions changes but I don t know if this is turned on properly. The third row shows the channel to interference ratio, it should show good values since we do not have any other base station transmitting in the same frequency band anywhere near Kista. When you walk toward Kista IP you will notice how the signal gets weaker but you have to walk very far to get our of range of the base station. One figure to keep track on is the Timing Advance information that is shown on the first page during a call. It s the first figure on the fourth row, inside the Forum building it will show 0 but as you get close to Kista IP it will turn to 1. Can you walk far enough to get a timing advance of 2? 3.2 A commercial network If you have SIM card from one of the real operators you can plug it in and examine their network. You will see a lot more base stations and if you set up a call you will see how they use frequency hopping to provide better signal quality. If you walk through Kista you can keep your eyes on the broadcast control channel shown on the first page. As the signal strength of the carrier get lower the terminal will choose another carrier to camp on. If you take 6

7 the terminal on a sub-way ride you will see how it does locations updates but there is no time for this today. 7

GSM: PHYSICAL & LOGICAL CHANNELS

GSM: PHYSICAL & LOGICAL CHANNELS GSM: PHYSICAL & LOGICAL CHANNELS AN OVERVIEW Prepared by Learntelecom.com 1. GSM: PHYSICAL AND LOGICAL CHANNELS GSM uses a mix of Frequency Division Multiple Access (FDMA) and Time Division Multiple Access

More information

GSM Channels. Physical & Logical Channels. Traffic and Control Mutltiframing. Frame Structure

GSM Channels. Physical & Logical Channels. Traffic and Control Mutltiframing. Frame Structure GSM Channels Physical & Logical Channels Traffic and Control Mutltiframing Frame Structure Engr. Mian Shahzad Iqbal Lecturer Department of Telecommunication Engineering Radio Interface The radio interface

More information

Ch 2.3.3 GSM PENN. Magda El Zarki - Tcom 510 - Spring 98

Ch 2.3.3 GSM PENN. Magda El Zarki - Tcom 510 - Spring 98 Ch 2.3.3 GSM In the early 80 s the European community decided to work together to define a cellular system that would permit full roaming in all countries and give the network providers freedom to provide

More information

GSM LOGICAL CHANNELS

GSM LOGICAL CHANNELS GSM LOGICAL CHANNELS There are two types of GSM logical channels 1. Traffic Channels (TCHs) 2. Control Channels (CCHs) Traffic channels carry digitally encoded user speech or user data and have identical

More information

Coverage measurement systems. Radio Network Analyzer R&S TSMU. Interferences a frequent impairment in radio networks

Coverage measurement systems. Radio Network Analyzer R&S TSMU. Interferences a frequent impairment in radio networks MOBILE RADIO Coverage measurement systems 44820/2 FIG 1 The R&S TSMU automatically detects, analyzes and displays the results of co-channel and adjacent-channel interferences in GSM networks during a drive

More information

GSM GSM 05.08 TECHNICAL July 1996 SPECIFICATION Version 5.1.0

GSM GSM 05.08 TECHNICAL July 1996 SPECIFICATION Version 5.1.0 GSM GSM 05.08 TECHNICAL July 1996 SPECIFICATION Version 5.1.0 Source: ETSI TC-SMG Reference: TS/SMG-020508QR ICS: 33.060.50 Key words: Digital cellular telecommunications system, Global System for Mobile

More information

RELEASE NOTE. Recc)mmendation GSM 05.08. Previously distributed version :3.7.0 ( Updated Release 1/90

RELEASE NOTE. Recc)mmendation GSM 05.08. Previously distributed version :3.7.0 ( Updated Release 1/90 ETSI /TC SMG Release by : ETSI /PT 12 Release date : December 1995 RELEASE NOTE Recc)mmendation GSM 05.08 Radio Sub - system Link Control Previously distributed version :3.7.0 ( Updated Release 1/90 New

More information

Frequency [MHz] ! " # $ %& &'( " Use top & bottom as additional guard. guard band. Giuseppe Bianchi DOWNLINK BS MS 890.4 UPLINK MS BS 890.2.

Frequency [MHz] !  # $ %& &'(  Use top & bottom as additional guard. guard band. Giuseppe Bianchi DOWNLINK BS MS 890.4 UPLINK MS BS 890.2. Frequency [MHz] 960 DOWNLINK BS MS 935 915 UPLINK MS BS 890 890.4 890.2 guard band Use top & bottom as additional guard! " # $ %& &'( " 1 2 3 4 5 6 7 8 F F uplink dwlink ( n) = [ 890.2 + 0.2( n 1) ] (

More information

Keysight Technologies Testing Mobile Station Cell Transitions and Handovers. Application Note

Keysight Technologies Testing Mobile Station Cell Transitions and Handovers. Application Note Keysight Technologies Testing Mobile Station Cell Transitions and Handovers Application Note Introduction The handover procedure is what makes a mobile station (MS) mobile. Successful handovers facilitate

More information

Global System for Mobile Communications (GSM)

Global System for Mobile Communications (GSM) Global System for Mobile Communications (GSM) Nguyen Thi Mai Trang LIP6/PHARE Thi-Mai-Trang.Nguyen@lip6.fr UPMC/PUF - M2 Networks - PTEL 1 Outline Principles of cellular networks GSM architecture Security

More information

Global System for Mobile Communication (GSM)

Global System for Mobile Communication (GSM) Global System for Mobile Communication (GSM) Li-Hsing Yen National University of Kaohsiung GSM System Architecture Um (ME/SIM) C E C PSTN, ISDN, PSPDN, CSPDN A-bis A F A-bis C B BTS BSS BSC HLR VLR EIR

More information

GSM Network and Services

GSM Network and Services GSM Network and Services Cellular networks GSM Network and Services 2G1723 Johan Montelius 1 The name of the game The number one priority for mobile/cellular networks is to implement full-duplex voice

More information

GSM System. Global System for Mobile Communications

GSM System. Global System for Mobile Communications GSM System Global System for Mobile Communications Introduced in 1991. Settings of standards under ETSI (European Telecommunication Standards Institute) Services - Telephone services - Data services -

More information

9.1 Introduction. 9.2 Roaming

9.1 Introduction. 9.2 Roaming 9 Location Updating Objectives After this chapter the student will: be able to define the concepts of roaming and location updating. be able to name the different types of location updating and why they

More information

GSM and Similar Architectures Lesson 03 GSM System Architecture

GSM and Similar Architectures Lesson 03 GSM System Architecture GSM and Similar Architectures Lesson 03 GSM System Architecture 1 Mobile communication using base station in cellular networks A mobile station, MS, communicates with a GSM public land mobile network (PLMN)

More information

GSM GSM 05.01 TECHNICAL May 1996 SPECIFICATION Version 5.0.0

GSM GSM 05.01 TECHNICAL May 1996 SPECIFICATION Version 5.0.0 GSM GSM 05.01 TECHNICAL May 1996 SPECIFICATION Version 5.0.0 Source: ETSI TC-SMG Reference: TS/SMG-020501Q ICS: 33.060.50 Key words: Digital cellular telecommunications system, Global System for Mobile

More information

PW1 Monitoring a GSM network with a trace mobile

PW1 Monitoring a GSM network with a trace mobile LPRO WireLess Network and security PW1 Monitoring a GSM network with a trace mobile Module GSM MOBILE LPRO 2012-13 Experimental set-up: 1. SAGEM OT230/OT260 Trace Mobile and charger 2. GSM antenna and

More information

GSM BASICS GSM HISTORY:

GSM BASICS GSM HISTORY: GSM BASICS GSM HISTORY: In 1982 the Nordic PTTs sent a proposal to CEPT (Conference of European Postal & telegraph Administration) to study and to improve digital cellular technology by forming a team

More information

Evaluating GSM A5/1 security on hopping channels

Evaluating GSM A5/1 security on hopping channels Evaluating GSM A5/1 security on hopping channels Bogdan Diaconescu v1.0 This paper is a practical approach on evaluating A5/1 stream cipher on a GSM hopping network air interface called Um. The end goal

More information

Optimization. Log File Analysis GSM

Optimization. Log File Analysis GSM Optimization and Log File Analysis in GSM by Somer GOKSEL January 26, 2003 2 Contents 1 INTRODUCTION...04 1.1 PURPOSE and SCOPE of OPTIMIZATION... 04 1.2 OPTIMIZATION PROCESS... 05 1.2.1 PROBLEM ANALYSIS...

More information

Implementation of Mobile Measurement-based Frequency Planning in GSM

Implementation of Mobile Measurement-based Frequency Planning in GSM Implementation of Mobile Measurement-based Frequency Planning in GSM Comp.Eng. Serkan Kayacan (*), Prof. Levent Toker (**) (*): Ege University, The Institute of Science, Computer Engineering, M.S. Student

More information

GSM Radio Part 1: Physical Channel Structure

GSM Radio Part 1: Physical Channel Structure GSM Radio Part 1: Physical Channel Structure 1 FREQUENCY BANDS AND CHANNELS...2 2 GSM TDMA...4 3 TDMA FRAME HIERARCHY...6 4 BURST STRUCTURE...7 5 TDMA MULTIFRAME STRUCTURE...9 5.1 Traffic Multiframe (26-Multiframe)...10

More information

GSM VOICE CAPACITY EVOLUTION WITH VAMOS Strategic White Paper

GSM VOICE CAPACITY EVOLUTION WITH VAMOS Strategic White Paper GSM VOICE CAPACITY EVOLUTION WITH VAMOS Strategic White Paper Table of contents VAMOS increases your GSM voice capacity at minimum investment / 1 Take the full benefit of VAMOS / 1 Standard aspects / 1

More information

GSM - Global System for Mobile Communications

GSM - Global System for Mobile Communications GSM - Global System for Mobile Communications VLR BTS BSC GMSC PSTN MS HLR 1) Overview of GSM architecture 2) GSM channel structure 05-1 GSM - Global System for Mobile Communications VLR BTS BSC GMSC PSTN

More information

GSM and Similar Architectures Lesson 07 GSM Radio Interface, Data bursts and Interleaving

GSM and Similar Architectures Lesson 07 GSM Radio Interface, Data bursts and Interleaving GSM and Similar Architectures Lesson 07 GSM Radio Interface, Data bursts and Interleaving 1 Space Division Multiple Access of the signals from the MSs A BTS with n directed antennae covers mobile stations

More information

CS 8803 - Cellular and Mobile Network Security: GSM - In Detail

CS 8803 - Cellular and Mobile Network Security: GSM - In Detail CS 8803 - Cellular and Mobile Network Security: GSM - In Detail Professor Patrick Traynor 9/27/12 Cellular Telecommunications Architecture Background Air Interfaces Network Protocols Application: Messaging

More information

Cellular Network Planning and Optimization Part V: GSM. Jyri Hämäläinen, Communications and Networking Department, TKK, 18.1.2008

Cellular Network Planning and Optimization Part V: GSM. Jyri Hämäläinen, Communications and Networking Department, TKK, 18.1.2008 Cellular Network Planning and Optimization Part V: GSM Jyri Hämäläinen, Communications and Networking Department, TKK, 18.1.2008 GSM Briefly 2 General GSM was the first digital cellular system. GSM was

More information

RADIUS. Brief brochure. Product Purpose

RADIUS. Brief brochure. Product Purpose Product Purpose The Product is designed for searching, intercepting, registering and analyzing of communication sessions as well as service information circulating in cellular GSM networks without encryption

More information

Voice services over Adaptive Multi-user Orthogonal Sub channels An Insight

Voice services over Adaptive Multi-user Orthogonal Sub channels An Insight TEC Voice services over Adaptive Multi-user Orthogonal Sub channels An Insight HP 4/15/2013 A powerful software upgrade leverages quaternary modulation and MIMO techniques to improve network efficiency

More information

GSM Databases. Virginia Location Area HLR Vienna Cell Virginia BSC. Virginia MSC VLR

GSM Databases. Virginia Location Area HLR Vienna Cell Virginia BSC. Virginia MSC VLR Update ( Update Procedure) Network Mobiles Maryland Maryland Other Rockville Bethesda Maryland Mobile Mobile Cell Cell HLR Vienna Cell 12-Jun-14 22:48 (Page 1) This sequence diagram was generated with

More information

Mobile Network Evolution Part 1. GSM and UMTS

Mobile Network Evolution Part 1. GSM and UMTS Mobile Network Evolution Part 1 GSM and UMTS GSM Cell layout Architecture Call setup Mobility management Security GPRS Architecture Protocols QoS EDGE UMTS Architecture Integrated Communication Systems

More information

MicroNet dual band IMSI and IMEI catcher

MicroNet dual band IMSI and IMEI catcher MicroNet dual band IMSI and IMEI catcher Datasheet Models: MNG-300-01 (GSM 900, 1800) MNG-300-02 (GSM 850, 1900) Document Nr OTK-012010 Date: 10-09-2012, revision B Table of contents 1. Acronyms and abbreviations

More information

Handoff in GSM/GPRS Cellular Systems. Avi Freedman Hexagon System Engineering

Handoff in GSM/GPRS Cellular Systems. Avi Freedman Hexagon System Engineering Handoff in GSM/GPRS Cellular Systems Avi Freedman Hexagon System Engineering Outline GSM and GSM referemce model GPRS basics Handoffs GSM GPRS Location and Mobility Management Re-selection and routing

More information

The GSM and GPRS network T-110.300/301

The GSM and GPRS network T-110.300/301 The GSM and GPRS network T-110.300/301 History The successful analog 1:st generation mobile telephone systems proved that there is a market for mobile telephones ARP (AutoRadioPuhelin) in Finland NMT (Nordic

More information

MRN 6 GSM part 1. Politecnico di Milano Facoltà di Ingegneria dell Informazione. Mobile Radio Networks Prof. Antonio Capone

MRN 6 GSM part 1. Politecnico di Milano Facoltà di Ingegneria dell Informazione. Mobile Radio Networks Prof. Antonio Capone Politecnico di Milano Facoltà di Ingegneria dell Informazione MRN 6 GSM part 1 Mobile Radio Networks Prof. Antonio Capone A. Capone: Mobile Radio Networks 1 General characteristics of the system A. Capone:

More information

GSM Network and Services

GSM Network and Services GSM Network and Services GPRS - sharing of resources 1 What is the problem? Many data applications are very bursty in its traffic pattern: http, smtp, pop, telnet,... Why reserve physical resources at

More information

CS263: Wireless Communications and Sensor Networks

CS263: Wireless Communications and Sensor Networks CS263: Wireless Communications and Sensor Networks Matt Welsh Lecture 4: Medium Access Control October 5, 2004 2004 Matt Welsh Harvard University 1 Today's Lecture Medium Access Control Schemes: FDMA TDMA

More information

GSM Sniffing. Karsten Nohl, Sylvain Munaut,

GSM Sniffing. Karsten Nohl, Sylvain Munaut, GSM Sniffing Karsten Nohl, nohl@srlabs.de Sylvain Munaut, 246tnt@gmail.com GSM networks are victim and source of attacks on user privacy SS7 Phone Base station GSM backend network User database (HLR) Attack

More information

SPYTEC 3000 The system for GSM communication monitoring

SPYTEC 3000 The system for GSM communication monitoring SPYTEC 3000 The system for GSM communication monitoring The SPYTEC 3000 system is intended for passive (if system encryption is absent of if A5.2 encryption is used) or semi-active (if A5.1 encryption

More information

Global System for Mobile Communication Technology

Global System for Mobile Communication Technology Global System for Mobile Communication Technology Mobile Device Investigations Program Technical Operations Division DHS - FLETC GSM Technology Global System for Mobile Communication or Groupe Special

More information

GSM GPRS. Course requirements: Understanding Telecommunications book by Ericsson (Part D PLMN) + supporting material (= these slides)

GSM GPRS. Course requirements: Understanding Telecommunications book by Ericsson (Part D PLMN) + supporting material (= these slides) GSM Example of a PLMN (Public Land Mobile Network) At present most successful cellular mobile system (over 200 million subscribers worldwide) Digital (2 nd Generation) cellular mobile system operating

More information

Base Jumping. Attacking the GSM baseband and base station

Base Jumping. Attacking the GSM baseband and base station Base Jumping Attacking the GSM baseband and base station grugq@coseinc.com Overview GSM Base Station Base Band Conclusion 2 GSM: The Protocol 3 Documents Dozens of docs Thousands of pages Important one

More information

An investigation into the claims of IMSI catchers use in Oslo in late 2014. Centre for Resilient Networks and Applications Simula Research Laboratory

An investigation into the claims of IMSI catchers use in Oslo in late 2014. Centre for Resilient Networks and Applications Simula Research Laboratory An investigation into the claims of IMSI catchers use in Oslo in late 2014 Centre for Resilient Networks and Applications Simula Research Laboratory Publication date 01. July 2015 Contents 1 Introduction

More information

-The equipment was limited to operate only within the boundaries of each country. -The market for each mo bile equipment was limited.

-The equipment was limited to operate only within the boundaries of each country. -The market for each mo bile equipment was limited. 1 History of GSM During the early 1980s, analog cellular telephone systems were experienced a very fast growth in Europe, particularly in Scandinavia and the United Kingdom, but also in France and Germany.

More information

GSM GSM 05.02 TECHNICAL May 1996 SPECIFICATION Version 5.0.0

GSM GSM 05.02 TECHNICAL May 1996 SPECIFICATION Version 5.0.0 GSM GSM 05.02 TECHNICAL May 1996 SPECIFICATION Version 5.0.0 Source: ETSI TC-SMG Reference: TS/SMG-020502Q ICS: 33.060.50 Key words: Digital cellular telecommunications system, Global System for Mobile

More information

Mobile Communications TCS 455

Mobile Communications TCS 455 Mobile Communications TCS 455 Dr. Prapun Suksompong prapun@siit.tu.ac.th Lecture 26 1 Office Hours: BKD 3601-7 Tuesday 14:00-16:00 Thursday 9:30-11:30 Announcements Read the following from the SIIT online

More information

Dimensioning, configuration and deployment of Radio Access Networks. Lecture 2.1: Voice in GSM

Dimensioning, configuration and deployment of Radio Access Networks. Lecture 2.1: Voice in GSM Dimensioning, configuration and deployment of Radio Access Networks. Lecture.: Voice in GSM GSM Specified by ETSI Frequency Division Duplex TDMA system Originally at 900MHz, but today also at 800, 800,

More information

General Packet Radio Service (GPRS): Mobility- and Session Management

General Packet Radio Service (GPRS): Mobility- and Session Management ehrstuhl für ommunikationsnetze Prof. Dr.-Ing. Jörg Eberspächer General Packet Radio Service (GPRS): Mobility- and Session Management ITG-Fachgruppe 5.2.4 "IP und Mobility June 20, 2001. Tagung amp-intfort

More information

2G/3G Mobile Communication Systems

2G/3G Mobile Communication Systems 2G/3G Mobile Communication Systems Winter 2012/13 Integrated Communication Systems Group Ilmenau University of Technology Outline 2G Review: GSM Services Architecture Protocols Call setup Mobility management

More information

3GPP Wireless Standard

3GPP Wireless Standard 3GPP Wireless Standard Shishir Pandey School of Technology and Computer Science TIFR, Mumbai April 10, 2009 Shishir Pandey (TIFR) 3GPP Wireless Standard April 10, 2009 1 / 23 3GPP Overview 3GPP : 3rd Generation

More information

Wireless Cellular Networks: 1G and 2G

Wireless Cellular Networks: 1G and 2G Wireless Cellular Networks: 1G and 2G Raj Jain Professor of Computer Science and Engineering Washington University in Saint Louis Saint Louis, MO 63130 Audio/Video recordings of this lecture are available

More information

GSM Air Interface & Network Planning

GSM Air Interface & Network Planning GSM Air Interface & Network Planning Training Document TC Finland Nokia Networks Oy 1 (40) GSM Air Interface & Network Planning The information in this document is subject to change without notice and

More information

ETSI TS 123 251 V6.5.0 (2005-09)

ETSI TS 123 251 V6.5.0 (2005-09) TS 123 251 V6.5.0 (2005-09) Technical Specification Universal Mobile Telecommunications System (UMTS); Network sharing; Architecture and functional description (3GPP TS 23.251 version 6.5.0 Release 6)

More information

ASR 5x00 Series SGSN Authentication and PTMSI Reallocation Best Practices

ASR 5x00 Series SGSN Authentication and PTMSI Reallocation Best Practices ASR 5x00 Series SGSN Authentication and PTMSI Reallocation Best Practices Document ID: 119148 Contributed by Krishna Kishore DV, Sujin Anagani, and Parthasarathy M, Cisco TAC Engineers. Jun 12, 2015 Contents

More information

GSM Frequency Planning with Band Segregation for the Broadcast Channel Carriers

GSM Frequency Planning with Band Segregation for the Broadcast Channel Carriers GSM Frequency Planning with Band Segregation for the Broadcast Channel Carriers F. Galliano (1), N.P. Magnani (1), G. Minerva (1), A. Rolando (2), P. Zanini (3) (1) CSELT - Via G. Reiss Romoli, 274 - Torino

More information

Attenuation (amplitude of the wave loses strength thereby the signal power) Refraction Reflection Shadowing Scattering Diffraction

Attenuation (amplitude of the wave loses strength thereby the signal power) Refraction Reflection Shadowing Scattering Diffraction Wireless Physical Layer Q1. Is it possible to transmit a digital signal, e.g., coded as square wave as used inside a computer, using radio transmission without any loss? Why? It is not possible to transmit

More information

NTT DOCOMO Technical Journal. Core Network Infrastructure and Congestion Control Technology for M2M Communications

NTT DOCOMO Technical Journal. Core Network Infrastructure and Congestion Control Technology for M2M Communications M2M 3GPP Standardization Further Development of LTE/LTE-Advanced LTE Release 10/11 Standardization Trends Core Network Infrastructure and Congestion Control Technology for M2M Communications The number

More information

Location management Need Frequency Location updating

Location management Need Frequency Location updating Lecture-16 Mobility Management Location management Need Frequency Location updating Fig 3.10 Location management in cellular network Mobility Management Paging messages Different paging schemes Transmission

More information

GSM Architecture and Interfaces

GSM Architecture and Interfaces GSM.05 Page 71 Monday, November 30, 1998 2:07 PM C H A P T E R 5 GSM Architecture and Interfaces 5.1 INTRODUCTION In this chapter we present an overview of the GSM as described in ETSI s recommendations.

More information

Chapter 6 Wireless and Mobile Networks

Chapter 6 Wireless and Mobile Networks Chapter 6 Wireless and Mobile Networks A note on the use of these ppt slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you see the animations;

More information

Ett halvt steg framåt. Mats Carlberg

Ett halvt steg framåt. Mats Carlberg GSM, GPRS och EDGE Ett halvt steg framåt Mats Carlberg matca@lysator.liu.se mats.carlberg@ericsson.com 2003 12 09 Översikt GSM systemets delar och hur de hänger ihop. Paketdata i GSM. GPRS som utbyggnad

More information

Basic Network Design

Basic Network Design Frequency Reuse and Planning Cellular Technology enables mobile communication because they use of a complex two-way radio system between the mobile unit and the wireless network. It uses radio frequencies

More information

Wireless Access of GSM

Wireless Access of GSM Wireless Access of GSM Project Report FALL, 1999 Wireless Access of GSM Abstract: Global System for Mobile communications (GSM) started to be developed by Europeans when the removal of many European trade

More information

Sierra Wireless AirCard Watcher Help for Mac OS X

Sierra Wireless AirCard Watcher Help for Mac OS X Sierra Wireless AirCard Watcher Help for Mac OS X Sierra Wireless AirCard Watcher allows you to manage and monitor the connection between your modem and the network. With Watcher, you can: Determine signal

More information

Nokia Siemens Networks LTE 1800 MHz Introducing LTE with maximum reuse of GSM assets

Nokia Siemens Networks LTE 1800 MHz Introducing LTE with maximum reuse of GSM assets Nokia Siemens Networks LTE 1800 MHz Introducing LTE with maximum reuse of GSM assets White paper Table of contents 1. Overview... 3 2. 1800 MHz spectrum... 3 3. Traffic Migration... 5 4. Deploying LTE-GSM

More information

Architecture Overview NCHU CSE LTE - 1

Architecture Overview NCHU CSE LTE - 1 Architecture Overview NCHU CSE LTE - 1 System Architecture Evolution (SAE) Packet core networks are also evolving to the flat System Architecture Evolution (SAE) architecture. This new architecture optimizes

More information

Dimensioning and Deployment of GSM Networks

Dimensioning and Deployment of GSM Networks Case Study: Dimensioning and Deployment of GSM Networks Acknowledgement: some of these slides are based on originals and information kindly provided by Ian O Shea of Altobridge Ltd. 2011 1 GSM System Architecture

More information

Wireless Networks. Reading: Sec5on 2.8. COS 461: Computer Networks Spring 2011. Mike Freedman

Wireless Networks. Reading: Sec5on 2.8. COS 461: Computer Networks Spring 2011. Mike Freedman 1 Wireless Networks Reading: Sec5on 2.8 COS 461: Computer Networks Spring 2011 Mike Freedman hep://www.cs.princeton.edu/courses/archive/spring11/cos461/ 2 Widespread Deployment Worldwide cellular subscribers

More information

Firmware version: 1.10 Issue: 7 AUTODIALER GD30.2. Instruction Manual

Firmware version: 1.10 Issue: 7 AUTODIALER GD30.2. Instruction Manual Firmware version: 1.10 Issue: 7 AUTODIALER GD30.2 Instruction Manual Firmware version: 2.0.1 Issue: 0.6 Version of the GPRS transmitters configurator: 1.3.6.3 Date of issue: 07.03.2012 TABLE OF CONTENTS

More information

Mobility and cellular networks

Mobility and cellular networks Mobility and cellular s Wireless WANs Cellular radio and PCS s Wireless data s Satellite links and s Mobility, etc.- 2 Cellular s First generation: initially debuted in Japan in 1979, analog transmission

More information

CS 326e F2002 Lab 1. Basic Network Setup & Ethereal Time: 2 hrs

CS 326e F2002 Lab 1. Basic Network Setup & Ethereal Time: 2 hrs CS 326e F2002 Lab 1. Basic Network Setup & Ethereal Time: 2 hrs Tasks: 1 (10 min) Verify that TCP/IP is installed on each of the computers 2 (10 min) Connect the computers together via a switch 3 (10 min)

More information

Figure 1: cellular system architecture

Figure 1: cellular system architecture Question 1: (30 marks) Consider a FDM cellular system with 120 cites, a frequency reuse factor of N=12, and 900 overall two-way channels. Omni-directional antennas are used: Figure 1 shows some of the

More information

Mobile Computing. Basic Call Calling terminal Network Called terminal 10/25/14. Public Switched Telephone Network - PSTN. CSE 40814/60814 Fall 2014

Mobile Computing. Basic Call Calling terminal Network Called terminal 10/25/14. Public Switched Telephone Network - PSTN. CSE 40814/60814 Fall 2014 Mobile Computing CSE 40814/60814 Fall 2014 Public Switched Telephone Network - PSTN Transit switch Transit switch Long distance network Transit switch Local switch Outgoing call Incoming call Local switch

More information

Yu.M. Tulyakov, D.Ye. Shakarov, A.A. Kalashnikov. Keywords: Data broadcasting, cellular mobile systems, WCDMA, GSM.

Yu.M. Tulyakov, D.Ye. Shakarov, A.A. Kalashnikov. Keywords: Data broadcasting, cellular mobile systems, WCDMA, GSM. Аnalysis of data broadcasting in modern cellular mobile systems of ground radio communications Yu.M. Tulyakov, D.Ye. Shakarov, A.A. Kalashnikov At the analysis of channel formation in WCDMA networks the

More information

RESOURCE ALLOCATION FOR INTERACTIVE TRAFFIC CLASS OVER GPRS

RESOURCE ALLOCATION FOR INTERACTIVE TRAFFIC CLASS OVER GPRS RESOURCE ALLOCATION FOR INTERACTIVE TRAFFIC CLASS OVER GPRS Edward Nowicki and John Murphy 1 ABSTRACT The General Packet Radio Service (GPRS) is a new bearer service for GSM that greatly simplify wireless

More information

PART 4 GSM Radio Interface

PART 4 GSM Radio Interface PRT 4 GSM Radio Interface Lecture 4. Physical channels Frequency [MHz] 960 OWNLINK BS MS 95 95 UPLINK MS BS 890 GSM Radio Spectrum 890.4 890.2 guard band 2 x 25 Mhz band uplex spacing: 45 MHz 24 carriers

More information

2.0 System Description

2.0 System Description 2.0 System Description The wireless alarm system consists of two or more alarm units within a specified range of one another. Each alarm unit employs a radio transceiver, allowing it to communicate with

More information

Frequently Asked Questions: Home Networking, Wireless Adapters, and Powerline Adapters for the BRAVIA Internet Video Link

Frequently Asked Questions: Home Networking, Wireless Adapters, and Powerline Adapters for the BRAVIA Internet Video Link Frequently Asked Questions: Home Networking, Wireless Adapters, and Powerline Adapters for the BRAVIA Internet Video Link What is a home network? A home network is a way of connecting your BRAVIA Internet

More information

2 System introduction

2 System introduction 2 System introduction Objectives After this chapter the student will: be able to describe the different nodes in a GSM network. be able to describe geographical subdivision of a GSM network. be able to

More information

CMU200: 2 2,5 Generation of Mobile Communication Systems GSM / GPRS / EGPRS. 2 MAR Re 1 1 CMU 200 GSM / GPRS / EGPRS

CMU200: 2 2,5 Generation of Mobile Communication Systems GSM / GPRS / EGPRS. 2 MAR Re 1 1 CMU 200 GSM / GPRS / EGPRS CMU200: 2 2,5 Generation of Mobile Communication Systems GSM / GPRS / EGPRS 2 MAR Re 1 1 08/00 of GSM, GPRS and EGPRS Basic Information about: u Physical Resource u GMSK and 8PSK u Mapping u Coding Schemes

More information

Mobile Services (ST 2010)

Mobile Services (ST 2010) Mobile Services (ST 2010) Chapter 3: Mobility Management Axel Küpper Service-centric Networking Deutsche Telekom Laboratories, TU Berlin 1 Mobile Services Summer Term 2010 3 Mobility Management 3.1 Handover

More information

Cisco IP Phone System Basic Features Model 7940 Durham, NC

Cisco IP Phone System Basic Features Model 7940 Durham, NC Cisco IP Phone System Basic Features Model 7940 Durham, NC This guide will walk you through setting up and using some very useful features on the new Cisco IP telephone. First of all, your phone will look

More information

User Guide for Network Monitoring Menu EGSM900 DCS1800 PCS1900

User Guide for Network Monitoring Menu EGSM900 DCS1800 PCS1900 User Guide for Network Monitoring Menu EGSM900 DCS1800 PCS1900 Copyright Nokia Corporation 2002. All rights reserved. Reproduction, transfer, distribution or storage of part or all of the contents in this

More information

LoRaWAN. What is it? A technical overview of LoRa and LoRaWAN. Technical Marketing Workgroup 1.0

LoRaWAN. What is it? A technical overview of LoRa and LoRaWAN. Technical Marketing Workgroup 1.0 LoRaWAN What is it? A technical overview of LoRa and LoRaWAN Technical Marketing Workgroup 1.0 November 2015 TABLE OF CONTENTS 1. INTRODUCTION... 3 What is LoRa?... 3 Long Range (LoRa )... 3 2. Where does

More information

Interpreting the Information Element C/I

Interpreting the Information Element C/I Prepared Date Rev Document no pproved File/reference 1(17) 2000-04-11 Interpreting the Information Element C/I This document primarily addresses users of TEMS Investigation. 2(17) 1 Introduction Why is

More information

Indian Journal of Advances in Computer & Information Engineering Volume.1 Number.1 January-June 2013, pp.1-5 @ Academic Research Journals.

Indian Journal of Advances in Computer & Information Engineering Volume.1 Number.1 January-June 2013, pp.1-5 @ Academic Research Journals. Cellular System Rajat Chugh, Parag Jasoria, Tushar Arora, Nitin Ginotra and Vivek Anand V Semester, Department of Computer Science and Engineering, Dronacharya College of Engineering, Khentawas, Farukhnagar,

More information

Wireless Phone GSM tracking. Denis Foo Kune, John Koelndorfer, Nick Hopper, Yongdae Kim

Wireless Phone GSM tracking. Denis Foo Kune, John Koelndorfer, Nick Hopper, Yongdae Kim Wireless Phone GSM tracking Denis Foo Kune, John Koelndorfer, Nick Hopper, Yongdae Kim Can someone track your phone? GPS Need access to phone Cell network trilateration/triangulation Multiple base stations

More information

Episode 5: Cellular Networks (GSM and UMTS)

Episode 5: Cellular Networks (GSM and UMTS) Episode 5: Cellular Networks (GSM and UMTS) Hannes Frey and Peter Sturm University of Trier Motivation Mobile telephone networks are nearly ubiquitous Still basic client/server architecture Only last mile

More information

Lecture 1. Introduction to Wireless Communications 1

Lecture 1. Introduction to Wireless Communications 1 896960 Introduction to Algorithmic Wireless Communications Lecture 1. Introduction to Wireless Communications 1 David Amzallag 2 May 25, 2008 Introduction to cellular telephone systems. How a cellular

More information

Π1: Wireless Communication Systems

Π1: Wireless Communication Systems Π1: Wireless Communication Systems Preface The scope of this deliverable is to provide an overview of modern wireless communication systems. This report has taken into consideration the popular cellular

More information

Technical Service Bulletin

Technical Service Bulletin Wireless Handoff/Fast Roaming/802.11rk This powerful feature, known in Araknis products as Fast Roaming, is essential for building reliable Wi-Fi networks with multiple access points. After a client joins

More information

Scanning with Sony Ericsson TEMS Phones. Technical Paper

Scanning with Sony Ericsson TEMS Phones. Technical Paper Scanning with Sony Ericsson TEMS Phones Technical Paper Scanning with Sony Ericsson TEMS Phones 2009-05-13 Ascom 2009. All rights reserved. TEMS is a trademark of Ascom. All other trademarks are the property

More information

CS6956: Wireless and Mobile Networks Lecture Notes: 2/11/2015. IEEE 802.11 Wireless Local Area Networks (WLANs)

CS6956: Wireless and Mobile Networks Lecture Notes: 2/11/2015. IEEE 802.11 Wireless Local Area Networks (WLANs) CS6956: Wireless and Mobile Networks Lecture Notes: //05 IEEE 80. Wireless Local Area Networks (WLANs) CSMA/CD Carrier Sense Multi Access/Collision Detection detects collision and retransmits, no acknowledgement,

More information

Mobile Communications

Mobile Communications October 21, 2009 Agenda Topic 2: Case Study: The GSM Network 1 GSM System General Architecture 2 GSM Access network. 3 Traffic Models for the Air interface 4 Models for the BSS design. 5 UMTS and the path

More information

Technical Notes TN 1 - ETG 3000. FactoryCast Gateway TSX ETG 3021 / 3022 modules. How to Setup a GPRS Connection?

Technical Notes TN 1 - ETG 3000. FactoryCast Gateway TSX ETG 3021 / 3022 modules. How to Setup a GPRS Connection? FactoryCast Gateway TSX ETG 3021 / 3022 modules How to Setup a GPRS Connection? 1 2 Table of Contents 1- GPRS Overview... 4 Introduction... 4 GPRS overview... 4 GPRS communications... 4 GPRS connections...

More information

!!! "# $ % & & # ' (! ) * +, -!!. / " 0! 1 (!!! ' &! & & & ' ( 2 3 0-4 ' 3 ' Giuseppe Bianchi

!!! # $ % & & # ' (! ) * +, -!!. /  0! 1 (!!! ' &! & & & ' ( 2 3 0-4 ' 3 ' Giuseppe Bianchi !!! "# $ % & & # ' (! ) * +, -!!. / " 0! 1 (!!! ' &! & & & ' ( 2 3 0-4 ' 3 ' "#$!!% "&'! #&'!%! () *+,, 3 & 5 &,! #-!*! ' & '.! #%!* //!! & (0)/!&/, 6 5 /, "! First system: NMT-450 (Nordic Mobile Telephone)

More information

Contents VULNERABILITIES OF MOBILE INTERNET (GPRS), 2014

Contents VULNERABILITIES OF MOBILE INTERNET (GPRS), 2014 VULNERABILITIES OF MOBILE INTERNET (GPRS) Dmitry Kurbatov Sergey Puzankov Pavel Novikov 2014 Contents 1. Introduction 2. Summary 3. Mobile network scheme 4. GTP protocol 5. Searching for mobile operator

More information

The Network Layer Layer 3

The Network Layer Layer 3 CHAPTER 7 The Network Layer Layer 3 Now it is time to hijack the GSM freight train, to see what is inside, to break into the time-slotted boxcars and spill the drums of unknown acids and solvents on the

More information

The Global System for Mobile communications (GSM) Overview

The Global System for Mobile communications (GSM) Overview The Global System for Mobile communications (GSM) Overview GSM D-AMPS Japan Digital PCS 1900 DCS 1800 CDMA Digital Cellular Systems World-wide Multiple Access Techniques In the GSM/DCS mobile system each

More information

GSM frequency planning

GSM frequency planning GSM frequency planning Band : 890-915 and 935-960 MHz Channel spacing: 200 khz (but signal bandwidth = 400 khz) Absolute Radio Frequency Channel Number (ARFCN) lower band: upper band: F l (n) = 890.2 +

More information