2G Layer3-Message Browser

State Message Mode Dir Channel DescriptionId

leRR System Information Type 1 Idle DL BCCH Serving cell frequencies and access rights

RR System Information Type 2 Idle DL BCCH

RR System Information Type 2bis Idle DL BCCH

Neighbour cell frequencies, network colour code (NCC) and access rights

Extended part of Type 2 message sent if neighbour BCCHs cannot fit in 1 message. EXT-IND set to one on Type 2 message also.

Idle

RR System Information Type 2quate Idle DL BCCH

3G Neighbour Cell frequency and SCs (when 3G handset is roaming on 2G it uses this message to find suitable cell to camp on while in Idle)

Idle




Call S

etup P

rocedu

re

RR Channel Request Dedicated UL RACH MS requests Signalling Channel

Cell Id and LAC of cell MS is camped on and further information about organisation of the CCCHs within the BTS.

This message only repeats data sent previously in Sys inform type 1,2 and 3.

Cell information relating to GPRS. If MS does not support GPRS it will ignore message

Call

Setup

Proce

dure

RR Immediate Assignment Dedicated DL AGCH BSS sends information of free SDCCH Channel to MS

RR Immediate Assignment Reject Dedicated DL AGCH

MM CM Service Request Dedicated UL SDCCH

RR Ciphering Mode Command Dedicated DL SDCCHRR Ciphering Mode Complete Dedicated UL SDCCH MS Acknowledges receipt of cypher mode command

CC Setup Dedicated UL SDCCH

CC Call Proceeding Dedicated DL SDCCH

BSC may respond to channel request with a rejection if no SDCCHs are available. In this case no channel is assigned and the CSU process is terminated. Additionally MS is informed about a waiting period during which it may not send a Channel Request

MS indicates to BSS that it wants to initiate outgoing call. Message contains the MS identity (TMSI)calculated from the RAND and the subscriber identity Ki

MS sends message to MSC with the called party number and the bearer service requestedSent by network to indicate that the requested connection has been initiated

Call

Set

up Pro

cedure

RR Assignment Command Dedicated DL SDCCH

RR Assignment Complete Dedicated UL FACCH Channel Assignment acknowledged to the BSS

CC Progress Dedicated DL FACCH

CC Alerting Dedicated DL FACCH Called party is being alerted (ring-ring)

CC Connect Dedicated DL FACCH

CC Connect Acknowledge Dedicated UL FACCH

In C

all

RR System Information Type 6 Dedicated DL

RR System Information Type 5 Dedicated DL

RR System Information Type 5bis Dedicated DL

MS is told what TCH to use. TCH also defines FACCH to continue signalling

MSC sends message to indicate that interworking or transport or inband signalling is necessary.

Informs MS that the call has been accepted by called partyMS indicates that connection between MS and called party is ready to be used

SACCH/ FACCH

Serving cell provides MS with all necessary data of the serving cell.

SACCH/ FACCH

Informs MS about the BCCH frequencies of available Neighbours

SACCH/ FACCH

Extended part of Type 5 message sent if neighbour BCCHs cannot fit in 1 message. EXT-IND set to one on Type 5 message also.

In C

all RR Measurement Report Dedicated UL

RR Handover Command Dedicated DL

RR Physical Information Dedicated DL

RR Handover Complete Dedicated UL Indicates Successful handover initiation

RR Handover Failure Dedicated UL

RR Assignment Command Dedicated DL

RR Assignment Complete Dedicated UL

RR Assignment Failure Dedicated UL

SACCH/ FACCH

MS sends current measurements to BTS. They contain serving cell and neighbour cell levels (Rx, Qual). Message sent every 480ms. Message forwarded then to the BSC.

Note: Due to some anomalies in the display of serving/neighbour BCCH/BSICs and Rx Lev it is recommended to refer to the dedicated mode Rx Lev values under the message browser rather than the L3 ones

SACCH/ FACCH

Provides detailed information about the new traffic channel and the handover reference

SACCH/ FACCH

It is sent to the MS from the new channel detailing the TA the MS needs to use initially

SACCH/ FACCHSACCH/ FACCH

Indicates an unsuccessful handover (with cause). MS remains connected to initial BTS

SACCH/ FACCH

Assignment of new traffic channel (or TS) in the case of Intracell Handover

SACCH/ FACCH

MS confirms that it has successfully changed to the new TCH

SACCH/ FACCH

MS could not change to specified channel so it changes back to previous channel

CC Disconnect Dedicated UL FACCH

CC Release Dedicated DL FACCH MSC responds with the Release message

CC Release Complete Dedicated UL FACCH MS acknowledges the release to the MSC

Location Update

RR Channel Request Dedicated UL RACH

RR Immediate Assignment Dedicated DL AGCH BSS sends information of free SDCCH Channel to MS

MM Location Updating Request Dedicated UL SDCCH

Call

Discon

nec

tSent when 'End' button is pressed on MS or when logging kit issues a disconnect. Message (including release cause) sent transparently to the MSCNote: It is consider a dropped call if the CC Disconnect is sent in the DL or if the MS goes into Idle without issuing a CC Disconnect

3 cases exist for a location update to happen1) If the LAI stored on MS is different to that of the serving cell (when MS is switched off and user moves to different LAC)2) Periodic location updating timer expires in MS3) When MS is powered on after it has performed an IMSI detatch (even if LAI remains the same)

Contains TMSI and LAI of old BTS (if available) as well as the location update type (normal, periodic, IMSI attach)

Location Update

MM Authentication Request Dedicated DL SDCCH

MM Authentication Response Dedicated UL SDCCH

MM Authentication Reject Dedicated DL SDCCH

RR Ciphering Mode Command Dedicated DL SDCCH

RR Ciphering Mode Complete Dedicated UL SDCCH

MM Location Updating Accept Dedicated DL SDCCH

MM Location Updating Reject Dedicated DL SDCCHMM TMSI Reallocation Complete Dedicated UL SDCCH MS Acknowledges new TMSI (if given)

RR Channel Release Dedicated DL SDCCH MSC via BSS sends channel release request to MS

RR Classmark Change Dedicated UL SDCCH

RR Paging Request Type 1/2/3 Dedicated DL BCCH

RR System Information Type 7/8 Idle DL BCCH

Sent by MSC/VLR to authenticate MS. The message contains the RANDMSC/VLR.VLR then compares SRES with the value provided in HLRInforms MS that Authentication Was unsuccessful. Occurs if MSC/VLR found that the result for SRES from the the MS was incorrectand MS to switch on ciphering. The BTS extracts the K1 part from the message and sends to MS the rest which contains the cipher algorithm (As/X) the MS needs to use.MS Acknowledges receipt of cypher mode command and that ciphering is activatedaccepted and is sent the new LAC and TMSI (if given)happen if HLR is not reachable or when IMSI/TMSI are unknown

Additional

Messages

Sent by MS when classmark changes (e.g. when phone is connected to a booster in a car or when it is in poor coverage area). It contains current technical capabilities of MS.It is usually sent during call setupSent in the case of MTC. Contains the IMSI or TMSI of the called party is contained in the message. There are 3 types of paging requestsType 1: Allows the paging of upto 2 MSsType 2: Allows paging of 3 MSsType 3: Allows paging of 4 MSsUsed in DCS1800 and PCS1900 to provide MSs with additional information to access the serving cell

Example002748 11:28:11.181 L3 DL RR System Information Type 1 CA List: 751 758 798 815 847 (Variable Bit Map)MaxRetransmissions: (1) 2 TxInt: (10) 14 slots CellBarAccess: (0) NoCallReEstablishment: (1) No Emergency: (0) All MSsBarred Classes: None002773 11:28:11.418 L3 DL RR System Information Type 2BA-IND: 1, EXT-IND: 1 BA List: 723 734 739 740 744 748 756 760 764 765 766 780 782 794 804 811 815 821 823 825 835 (Range 256)NCC Permitted: 5 (32 decimal)MaxRetransmissions: (1) 2 TxInt: (10) 14 slots CellBarAccess: (0) NoCallReEstablishment: (1) No Emergency: (0) All MSsBarred Classes: None002776 11:28:11.418 L3 DL RR System Information Type 2bisBA-IND: 1, EXT-IND: 1 BA List: 838 852 (Range 256)MaxRetransmissions: (1) 2 TxInt: (10) 14 slots CellBarAccess: (0) NoCallReEstablishment: (1) No Emergency: (0) All MSsBarred Classes: None

005798 11:31:03.908 L3 DL RR System Information Type 2quater Skip Ind.: 0, Prot. Disc.: 6 Msg Type: 7 BA_IND: 1 3G_BA_IND: 1 MP_CHANGE_MARK change: 0 SI2Quater_INDEX: 0 SI2Quater_Count: 2 MEASUREMENT_Parameters Description REPORT_TYPE: Normal, SERVING_BAND_REPORTING: 1 3G Neighbour Cell Description struct UTRAN FDD Description struct Repeated UTRAN FDD Neighbour Cells FDD_ARFCN: 10811 FDD_Indic0: parameter value 0000000000 is not a member of set NR_OF_FDD_CELLS: 13 FDD_CELL_INFORMATION FIELD(P bit field): 102 bits SC Diversity applied for the cell 73 No 104 No 106 No 160 No 177 No 178 No 193 No 200 No

002729 11:28:10.940 L3 DL RR System Information Type 3 SI2ter Indicator: 1 Early Classmark Sending Control: Controlled Early Classmark Sending option is implemented RA Colour: 0, SI13 POSITION: SYSTEM INFORMATION TYPE 13 message is sent on BCCH normMCC-MNC-LAC-CI: 234-33-198-29142IMSI attach/detach: Shall be UsedBS-AG-BLKS-RES: 3 blocks reserved for access grantCCCH-CONF: one basic physical channel, not combined with SDCCHsBS-PA-MFRMS: 6 multiframes period, T3212 Time-out: 15 decihoursPowerControlUsed: YesDTX Usage: Shall use UL DTX on TCH-F, Shall not use on TCH-HMaxRadioLinkTimeout: 16 multiframesCellReselHyst: 6 dBMsTxPowerMaxCCH: 0, Additional Reselect Param Ind (ACS): 0RxLevAccessMin: (6) -104 dBm, Half Rate Support (NECI): (0) New establishment causes notsupportedMaxRetransmissions: (1) 2 TxInt: (10) 14 slots CellBarAccess: (0) NoCallReEstablishment: (1) No Emergency: (0) All MSsBarred Classes: None002731 11:28:10.958 L3 DL RR System Information Type 4MCC-MNC-LAC: 234-33-198CellReselHyst: 6 dBMsTxPowerMaxCCH: 0, Additional Reselect Param Ind (ACS): 0RxLevAccessMin: (6) -104 dBm, Half Rate Support (NECI): (0) New establishment causes notsupportedMaxRetransmissions: (1) 2 TxInt: (10) 14 slots CellBarAccess: (0) NoCallReEstablishment: (1) No Emergency: (0) All MSsBarred Classes: None000020 08:52:02.374 L3 DL RR System Information Type 13 Skip Ind.: 0, Prot. Disc.: 6 Msg Type: 0 BCCH Change Mark: PSI5updated SI Change Field: 0 SI13 Change Mark: 1 HSN: 1 MA_LENGTH: 1, MA_BitMap: 1, Last MA_BitMap: 1 Routing area code (RAC): 1, SPGC_CCCH_SUP: SPLIT_PG_CYCLE is supported on CCCH in this cell, PRIORITY_ACCESS_THR: packet access is allowed for priority level 1 to 4, Network control order: NC0, Network mode of operation (NMO): Network Mode of Operation II, T3168: 1, T3192: 0, DRX_TIMER_MAX: 0, ACCESS_BURST_TYPE: 11 bit access burst shall be used, CONTROL_ACK_TYPE: default format is RLC/MAC control block, BS_CV_MAX: 6 PAN_DEC: 1, PAN_INC: 1, PAN_MAX: max value allowed for counter N3102 is 8 ALPHA: 1.0 alpha, T_AVG_W: 8, T_AVG_T: 6, PC_MEAS_CHAN: downlink measurements for power control shall be made on BCCH, N_AVG_I: 2Establishment Cause: 240 (0xF0), Mobile originating call (TCH/F needed, NECI != 1, or SDCCH proc.), Random Reference: 16

N/A

000074 08:52:04.091 L3 UL RR Ciphering Mode Complete

000055 08:52:03.311 L3 DL RR Immediate AssignmentTwo-message assignment: (0) No meaningDownlink assignment to mobile in packet idle mode: (0) No meaningTBF or dedicated mode: (0) Assigns a dedicated mode resourcePage Mode: (0) Normal pagingChannel Type: SDCCH/8 + SACCH/C8 or CBCH [SDCCH/8], Subchannel 0TimeSlot: 1 TrainingSeq: 5Hopping: Yes, MAIO: 0 HoppingSeq (HSN): 1Establishment Cause: 240 (0xF0), Mobile originating call (TCH/F needed, NECI != 1, or SDCCH proc.), Random Reference: 16T1': 12, T2: 4, T3: 26, Frame: 17060 (mod 42432)TimingAdvance: 3 bitsMA: 1 2

000058 08:52:03.386 L3 UL MM CM Service RequestMobile originating call establishmentCipherKeySeq: 0MS Class: Class 1Revision: Phase 2 MSAlgorithms available: A5/1 Yes A5/2 Yes A5/3 NoControlled early classmark sending: ImplementedMobile terminated SMS: SupportedTMSI: 2617795465 (0x9c086389)000067 08:52:03.823 L3 DL RR Ciphering Mode CommandStart ciphering

000084 08:52:04.327 L3 UL CC SetupCC Setup

Bearer Capability- Radio Channel Requirement: 1, Coding Standard: 0, Transfer Mode: 0, Information Transfer Capability: 0 (Prefered Codec: 2)Type of Number: unknownNumbering Plan Id: ISDN/TelephonyCalled Party #: 07973990011 000086 08:52:04.529 L3 DL CC Call ProceedingCC Call Proceeding

000097 08:52:05.006 L3 DL RR Assignment CommandChannel Type: TCH/F + FACCH/F and SACCH/FTimeSlot: 1 TrainingSeq: 5Hopping: Yes, MAIO: 1 HoppingSeq (HSN): 1MsTxPower Ordered: (0 GSM) CA List: 729 818 (Variable Bit Map)Channel Mode: Speech full rate or half rate version 2MA: 1 2 000106 08:52:05.157 L3 UL RR Assignment CompleteNormal event (Hex 00)000120 08:52:05.299 L3 DL CC ProgressCC ProgressUserIn-band information or appropriate pattern now available000125 08:52:05.619 L3 DL CC AlertingCC Alerting000132 08:52:06.061 L3 DL CC ConnectCC Connect000135 08:52:06.061 L3 UL CC Connect AcknowledgeCC Connect Acknowledge000138 08:52:06.083 L3 DL RR System Information Type 6MCC-MNC-LAC-CI: 234-33-1363-36922PowerControlUsed: YesDTX Usage: The MSs shall use uplink discontinuous transmissionMaxRadioLinkTimeout: 16 multiframesNCC Permitted: 5 (32 decimal)000146 08:52:06.563 L3 DL RR System Information Type 5BA-IND: 0, EXT-IND: 0 BA List: 720 740 742 749 750 757 759 768 774 775 777 784 790 830 832 843 (Range 256)000268 08:52:13.423 L3 DL RR System Information Type 5bisBA-IND: 0, EXT-IND: 1 BA List: 852 (Range 256)

001676 08:53:42.802 L3 UL RR Measurement ReportRxLevFull: -70 dBm, RxQualFull: 0RxLev Sub: -68 dBm, RxQual Sub: 0BA Used: 0, UL DTX: Not UsedMeasurements are validN1: Freq 729 Level -57 dBm BSIC 45(dec) 55(oct)N2: Freq list [ 20 ] Level -69 dBm BSIC 47(dec) 57(oct)N3: Freq 774 Level -74 dBm BSIC 42(dec) 52(oct)N4: Freq 749 Level -76 dBm BSIC 44(dec) 54(oct)N5: Freq 750 Level -78 dBm BSIC 42(dec) 52(oct)N6: Freq list [ 22 ] Level -85 dBm BSIC 44(dec) 54(oct)004430 08:56:33.449 L3 DL RR Handover CommandBCCH: 777 BSIC: 41(dec) 51(oct)Channel Type: TCH/F + FACCH/F and SACCH/FTimeSlot: 4 TrainingSeq: 1Hopping: Yes, MAIO: 1 HoppingSeq (HSN): 1HandoverRef: 98 OrderedPowerLevel: 1Synchronized: No CA List: 737 777 792 (Variable Bit Map)Channel Mode: Speech full rate or half rate version 2MA: 1 2 3 Signal handoff from Unknown(Unknown) to Unknown(Unknown)001701 08:53:43.997 L3 DL RR Physical InformationTimingAdvance: 4 bits001705 08:53:44.099 L3 UL RR Handover CompleteNormal event (Hex 00)067355 10:02:56.287 L3 UL RR Handover FailureAbnormal release, unspecified (Hex 01)004514 08:56:38.114 L3 DL RR Assignment CommandChannel Type: TCH/F + FACCH/F and SACCH/FTimeSlot: 2 TrainingSeq: 1Hopping: Yes, MAIO: 0 HoppingSeq (HSN): 1MsTxPower Ordered: (0 GSM) CA List: 737 777 792 (Variable Bit Map)Channel Mode: Speech full rate or half rate version 2MA: 1 2 3 004526 08:56:38.291 L3 UL RR Assignment CompleteNormal event (Hex 00)

086172 12:46:41.227 L3 UL CC DisconnectCC DisconnectCoding Standard: GSM PLMNS StandardLocation: UserClass: Normal Event (1) (Hex 01)Cause: normal call clearing (Hex 10)086179 12:46:41.378 L3 DL CC ReleaseCC Release086182 12:46:41.401 L3 UL CC Release CompleteCC Release Complete

017706 11:42:38.616 L3 UL RR Channel RequestEstablishment Cause: 13 (0x0D), Location updating, Random Reference: 13017714 11:42:38.698 L3 DL RR Immediate AssignmentTwo-message assignment: (0) No meaningDownlink assignment to mobile in packet idle mode: (0) No meaningTBF or dedicated mode: (0) Assigns a dedicated mode resourcePage Mode: (0) Normal pagingChannel Type: SDCCH/8 + SACCH/C8 or CBCH [SDCCH/8], Subchannel 2TimeSlot: 1 TrainingSeq: 4Hopping: Yes, MAIO: 1 HoppingSeq (HSN): 1Establishment Cause: 13 (0x0D), Location updating, Random Reference: 13T1': 13, T2: 16, T3: 15, Frame: 17202 (mod 42432)TimingAdvance: 0 bitsMA: 1 2 3 4 5 017717 11:42:38.856 L3 UL MM Location Updating RequestNormal location updatingCipherKeySeq: 4MCC-MNC-LAC: 234-33-1463MS Class: Class 1Revision: Phase 2 MSAlgorithms available: A5/1 Yes A5/2 No A5/3 NoControlled early classmark sending: ImplementedMobile terminated SMS: Not supportedTMSI: 3156466842 (0xbc23dc9a)

N/A

017755 11:42:40.036 L3 UL RR Ciphering Mode Complete

N/A017770 11:42:40.504 L3 UL MM TMSI Reallocation Complete

N/A

017730 11:42:39.294 L3 DL MM Authentication RequestCipherKeySeq: 0Random: 94 D2 26 72 15 E6 B5 B6 5C D8 BE 6C C8 58 0C B5

017743 11:42:39.563 L3 UL MM Authentication ResponseSRES: AF C0 CE 08

017745 11:42:39.773 L3 DL RR Ciphering Mode CommandStart ciphering

017757 11:42:40.240 L3 DL MM Location Updating AcceptMCC-MNC-LAC: 234-33-198

017772 11:42:40.705 L3 DL RR Channel ReleaseNormal event (Hex 00)116055 10:50:00.711 L3 UL RR Classmark ChangeMS Class: Class 1Revision: Phase 2 MSAlgorithms available: A5/1 Yes A5/2 Yes A5/3 NoControlled early classmark sending: ImplementedMobile terminated SMS: Supported

121275 10:53:14.767 L3 DL RR Paging Request Type 1Page Mode: (0) Normal pagingChannel Needed: MS1 TCH/HorF (Dual rate), MS2 Any channelTMSI: 3164560787 (0xbc9f5d93)

Layer Message Dir DescriptionNemo

Nemo Call Attempt --

Nemo Call Failed --

Nemo Call Disconnect --

L3 Contains All Layer 3 messages discribed in L3 Messages Sheet

L2

I-CMD

UI-CMD

SABM-CMD UL

UA-RESP

FILL

UNIT_DATA DL

Additional Messages

Channel Info --

Radio Link Timeout --

T seconds after this (set at 30s) unless the call is setup successfully NEMO will issue a disconnect.

NEMO interpretation of when a CSUF occurs. Time from call attempt and cause useful for fault debug

NEMO interpretation of when a DC occurs. Time from call attempt and cause useful for fault debug

UL/DL

responsible for the packaging of the data to be transmitted. Its purpose is error detection and correction.

I-CMD: Information FrameUI-CMD: Unnumbered frame group. Information FrameSABM-CMD: Unnumbered frame group, set-asynchronous-balance-modeUA-RESP: Unnumbered frame group, unnumbered-acknowledgement

FILL: A-Format frame sent when no payload is available on DCH. Usually in short time after TCH connection

UNIT-DATA: Used by MAP/TCAP for all data transfer tasks and on A-interface to convey paging messages. Also used to transmit SCCP management messages

UL/DL

UL/DL

UL/DL

Recorded when the mobile changes cellular system, serving cell, or channel type.

Recorded when mobile phone reports the information. RLT event is written to output file only when value is changed from previous value.

Additional Messages

Dedicated Mode: RxLev --

Enhanced RxLev --

Quality --

Timing Advance --

MS Power Level --

Frame error rate --

Carrier / Interference --

Recorded when measurement sample is receivedfrom mobile

Contains: System, ARFCN, BSIC, RxLev full, RxLev sub

Recorded when measurement sample is received from mobile

Contains: System, #Chs, Params/ch, ARFCN, BSIC, RxLev full/sub, HCS priority, HCS thr., CI, LAC, RACinformation. RXQ value is written to output file only when the value is changed from the previous valueinformation. TAD event is written to the output file only when the value is changed from the previous value.Note: Approximately each unit corresponds to 500m distance from serving cellRecorded when the mobile phone reports the information. MSP event is written to the output file only when the value is changed from the previous valueReported by mobile. Values range from 0 to 100 (%)Recorded when mobile phone reports the informationdB.Recorded when the mobile reports the information.

Example

Contains All Layer 3 messages discribed in L3 Messages Sheet

011678 13:03:02.347 Nemo Call AttemptVoice call (1), Count 6, PhoneNum 07973990011 CAA 0.204041 52.093658 111 16590 1 9 94 13:03:02.347 1 6 07973990011Call attempt failure status: Test system failure (These failures should be rejected in Quality Survey Reports.) (5), Time from attempt (s): 30.0,OS RAS Cause: N/A (-1) CAF 0.200368 52.087395 108 17315 1 9 85 13:03:32.457 5 30 -1123478 10:54:27.952 Nemo Call DisconnectStatus: Dropped call. (i.e., network release) (2), Cause: normal, unspecified (31), Time from attempt 00:00:08 CAD -1.735480 52.492840 149 78329 1 8 73 10:54:27.952 2 00:00:08 31

000060 08:52:03.648 L2 UL 18 I-CMD L2U -1.722620 52.542530 133 54 1 7 97 08:52:03.648 SDCCH "I-CMD" 01 00 35 06 16 03 50 18 81 20 05 60 14 4C 80 00 2B 2B 2B 2B 2B 2B 2B000062 08:52:03.735 L2 DL 90 UI-CMD L2D -1.722620 52.542530 133 54 1 7 97 08:52:03.735 SACCH "UI-CMD" 00 03 03 03 2D 06 1E 90 3A 32 F4 33 05 53 53 20 2B 2B 2B 2B 2B 2B 2B000057 08:52:03.386 L2 UL 50 SABM-CMD L2U -1.722619 52.542530 133 54 1 7 97 08:52:03.386 SDCCH "SABM-CMD" 01 3F 35 05 24 01 03 50 18 81 05 F4 9C 08 63 89 2B 2B 2B 2B 2B 2B 2B000059 08:52:03.648 L2 DL 50 UA-RESP L2D -1.722620 52.542530 133 54 1 7 97 08:52:03.648 SDCCH "UA-RESP" 01 73 35 05 24 01 03 50 18 81 05 F4 9C 08 63 89 2B 2B 2B 2B 2B 2B 2B000056 08:52:03.351 L2 DL 2B FILL L2D -1.722429 52.542744 133 27 1 7 98 08:52:03.351 SDCCH "FILL" 03 03 01 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B000051 08:52:03.235 L2 DL 2B UNIT_DATA L2D -1.722429 52.542744 133 27 1 7 98 08:52:03.235 CCCH "UNIT_DATA" 15 06 21 00 01 F0 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B000113 08:52:05.218 Channel InfoCellular system: GSM 1800 Channel type: traffic channel, Channel number in use: 729, Cell identification: 36922, LAC: 1363, Reserved: -1, Uplink DTX: DTX not in use, Radio Link Timeout (from 4 to 64): 16, Extended channel type: Uknown Channel type, Timeslot number: 1, BCCH channel: 729 CHI -1.722814 52.542316 133 81 1 7 98 08:52:05.218 2 2 729 36922 1363 -1 0 16 -1 1 729000116 08:52:05.218 Radio Link Timeout Event ID: RLT, Longitude: -1.72281, Latitude: 52.5423, Height: 133, Distance(m): 81, GPS status: with GPS, No. Satellites: 7, Velocity(km/h): 98 kph, Time: 08:52:05.218 Radio Link Timeout (from 0 to 64): 16 RLT -1.722814 52.542316 133 81 1 7 98 08:52:05.218 16

N/A

N/A

000141 08:52:06.160 Dedicated Mode: RxLev Full: -77 RxLev Sub: -77BCCH 729, BSIC 55Likely serving CellID Unknown on UnknownN1: BCCH 832 BSIC 57 RxLev -71 C1 NA C2 21 (likely CellID Unknown on Unknown)N2: BCCH 749 BSIC 54 RxLev -72 C1 NA C2 14 (likely CellID Unknown on Unknown)N3: BCCH 740 BSIC 53 RxLev -80 C1 NA C2 14 (likely CellID Unknown on Unknown)N4: BCCH 720 BSIC 53 RxLev -86 C1 NA C2 17 (likely CellID Unknown on Unknown)N5: BCCH 790 BSIC 57 RxLev -91 C1 NA C2 14 (likely CellID Unknown on Unknown)N6: BCCH 742 BSIC 50 RxLev -91 C1 NA C2 17 (likely CellID Unknown on Unknown)N7: BCCH 750 BSIC 50 RxLev -92 C1 NA C2 13 (likely CellID Unknown on Unknown)

RXL -1.723007 52.542099 134 108 1 7 99 08:52:06.160 2 729 45 -77 -77 28 28 832 47 -71 -100 21 720 43 -86 -100 17 742 40 -91 -100 17 740 43 -80 -100 14 749 44 -72 -100 14 790 47 -91 -100 14 750 40 -92 -100 13Cellular system: GSM 1800 Num channels: 8, Parameters/channel: 16 Idx Arfcn BSIC RxLev RxLev C1 C2 C31 C32 HCS HCS CI LAC RAC Srxlev Hrxlev Rrxlev Full Sub Pri. thr. (dBm) (dBm) (dB) (dB) (dBm) (dBm) (dBm) (dBm) (dBm) (dBm) 0 729 55 -77 -77 28 28 N/A N/A -1 N/A 36922 1363 1 256 256 256 1 832 57 -71 N/A N/A 21 N/A N/A -1 N/A 20182 1363 N/A N/A N/A N/A 2 720 53 -86 N/A N/A 17 N/A N/A -1 N/A 36967 1363 N/A N/A N/A N/A 3 742 50 -91 N/A N/A 17 N/A N/A -1 N/A 21494 1363 N/A N/A N/A N/A 4 740 53 -80 N/A N/A 14 N/A N/A -1 N/A 24059 1363 N/A N/A N/A N/A 5 749 54 -72 N/A N/A 14 N/A N/A -1 N/A 36969 1363 N/A N/A N/A N/A 6 790 57 -91 N/A N/A 14 N/A N/A -1 N/A 22565 1363 N/A N/A N/A N/A 7 750 50 -92 N/A N/A 13 N/A N/A -1 N/A 36920 1363 N/A N/A N/A N/A ERXL -1.723007 52.542099 134 108 1 7 99 08:52:06.160 2 8 16 729 45 -77 -77 28 28 -100 -100 -1 255 36922 1363 1 256 256 256 832 47 -71 255 -100 21 -100 -100 -1 255 20182 1363 -1 255 255 255 720 43 -86 255 -100 17 -100 -100 -1 255 36967 1363 -1 255 255 255 742 40 -91 255 -100 17 -100 -100 -1 255 21494 1363 -1 255 255 255 740 43 -80 255 -100 14 -100 -100 -1 255 24059 1363 -1 255 255 255 749 44 -72 255 -100 14 -100 -100 -1 255 36969 1363 -1 255 255 255 790 47 -91 255 -100 14 -100 -100 -1 255 22565 1363 -1 255 255 255 750 40 -92 255 -100 13 -100 -100 -1 255 36920 1363 -1 255 255 255

000114 08:52:05.218 Quality, RxQualFull 0, RxQualSub 0 RXQ -1.722814 52.542316 133 81 1 7 98 08:52:05.218 0 0

000117 08:52:05.218 Timing Advance 3 TAD -1.722814 52.542316 133 81 1 7 98 08:52:05.218 3

000115 08:52:05.218 Power Level, MsTxPower Control Level (0) MSP -1.722814 52.542316 133 81 1 7 98 08:52:05.218 0

Orange T-MobileSpectrum 30MHz 30MHzChannels 150 150BCCH Alloc 0 40 (Approx)RLT 16 multiframes 16 multiframesHopping BB BB

HSN Range 1-63MAIO Range 0-9 0-8DL DTX No Yes (rel 5)

UL DTX

HR

Mobile Allocation Yes

RxLevAccessMin -104dBm

MaxRetransmissions 2 4TxInt 14slots 12slotsBS-AG-BLKS-RES 3 blocks reserved for access grant 1 blocks reserved for access grant

RSCP e1f -106dBm -108dBmEc/Io e1f -13dB -15dB

0-1Why 0?

42%Shall use UL DTX on TCH-F,

Shall not use on TCH-H

42%Shall use UL DTX on TCH-F, Shall not use on TCH-H

New establishment causes notsupported

New establishment causes supported

No-105dBm

Can they be getting handovers we are missing?

Vodafone O2 Commnet

24 multiframes 16 multiframes

0-63 0-63

Yes (rel 5) No

Yes No

-107dBm -105dBm

4 425 14

1 blocks reserved for access grant2 blocks reserved for access grant

42%Shall use UL DTX on TCH-F,

Shall not use on TCH-H

42%Shall use UL DTX on TCH-F, Shall not use on TCH-H



does no use mean all are allowed?Is this faster?

Orange and O2 fastest HO

Consecutive times MS sends CHAN_REQ message to BTS (1,2,4,7)

State Message Mode Dir Channel DescriptionGP

RS A

ttach

GPRS MM - ATTach REQuest UL

RR Channel Request UL

RR Immediate Assignment DL

MM Identity Request DL

The terminal initiates the attach procedure after power on. The message contains the previously used TMSI (Temporary Mobile Subscriber Id). The mobile network identity, the location area and routing area information is also included in the message.

When SGSN cannot find the TMSI in its databases it contacts the old serving SGSN (based on old LA) and gets IMSI. It then asks terminal to Identify itself

GPRS A

ttach

MM Identity Response UL Terminal responds with IMSI for identification

GPRS MM - AUthentication && CIPher REQuest DL

GPRS MM - AUthentication && CIPher RESPonse UL

GPRS MM - ATTach ACCept DL

GPRS MM - ATTach COMPlete UL

PDP Cont

ext Ac

tivati

on

GPRS SM - Activate PDP context request UL

The SGSN authenticates the GPRS mobile by sending a RAND value (a random value).

The SIM applies secret GSM algorithms on the RAND and the secret key Ki to obtain the session key Kc and SRES. The computed SRES value is passed to the SGSN.After verifying IMEI and EIR SGSN contacts HLR to inform it about new location of GPRS mobile. HLR updates SGSN about subscriber info.

The SGSN responds back to the GPRS mobile with attach accept containing new TMSI, mobile network identity, the location area and routing area information.The GPRS mobile acknowledges the receipt of "Attach Accept".The Attach Complete signals the completion of the attach procedure. This is passed to the MSC-VLR as "TMSI Reallocation Complete".activation procedure to obtain the IP address for the device.

The Access Point Name (APN) specified by the service provider is passed as a parameter.

The SGSN contacts GGSN correspondiong to the APN specified by the mobile.

The GGSN authenticates the GPRS subscription (RADIUS) and gets dynamic IP address for the GPRS mobile (DNS).

PDP Cont

ext Ac

tivati

on

GPRS SM - Activate PDP context accept DL

GPRS SM - Deactivate PDP context request UL

GPRS SM - Deactivate PDP context accept DL

GPRS

Det

tach

GPRS MM - DETach REQuest DL

GPRS MM - DETach ACCept DL

The GGSN responds back to the SGSN, indicating completion of the PDP context activation procedure.

The SGSN replies back to the GPRS mobile. This signals completion of the PDP context activation.

PDP

Cont

ext

De

acti

vatio

n

ExampleSoLSA = the ME does not support SoLSA CKSN: 3 Follow-on request: No follow on request pending, Attach type: GPRS attach Split PG cycle code: 7, Split on CCCH: split pg cycle on CCCH is not supported by the mobile station, Non-DRX timer: max. 8 sec non-DRX mode after transfer stateEI IMSI, P_TMSI: 3519865056 (0xd1cce0e0)EI: Old Routing Area Identification: MCC=234, MNC=33, LAC=30, RAC=1

EI: MS Radio Access Capability: Access Technology Type = GSM E (900), RF Power Capability = 4Available Encryption Algorithms: A5/1, A5/2ES IND = "controlled early Classmark Sending" option is implementedPS capability not presentno VGCS capability or no notifications wanted, no VBS capability or no notifications wantedHSCSD Multislot Class = 6,GPRS Multislot Class = 10, Extended Dynamic Allocation Capability for GPRS is not implemented

Access Technology Type = GSM 1800, RF Power Capability = 1ES IND = "controlled early Classmark Sending" option is implementedPS capability not presentno VGCS capability or no notifications wanted, no VBS capability or no notifications wanted003234 12:33:15.822 L3 UL RR Channel RequestEstablishment Cause: 124 (0x7C), One phase packet access with request for single timeslot uplink transmission; one PDCH is needed, Random Reference: 0003254 12:33:15.911 L3 DL RR Immediate AssignmentTwo-message assignment: (0) No meaningDownlink assignment to mobile in packet idle mode: (0) No meaningTBF or dedicated mode: (1) Assigns a Temporary Block Flow (TBF)Page Mode: (0) Normal paging

Channel type: 1, Timeslot (TN): 7, Training Sequence Code (TSC): 1 ARFCN: 828Establishment Cause: 124 (0x7C), One phase packet access with request for single timeslot uplink transmission; one PDCH is needed, Random Reference: 0T1': 3, T2: 6, T3: 0, Frame: 3672 (mod 42432)TimingAdvance: 4 bits TFI Assignment: 20, Polling: 0 USF: 0, USF_Granularity: the mobile station shall transmit one RLC/MAC block Channel coding command: CS2, TLLI Block channel coding: MS shall use value commanded in the CHANNEL_CODING_COMMAND Gamma: 30 dB Timing advance index (TAI): 9

036335 12:52:42.286 L3 DL MM Identity RequestIMEI

036339 12:52:42.551 L3 UL MM Identity ResponseIMEI: 355661003470910003267 12:33:16.462 L3 DL GPRS MM - AUthentication && CIPher REQuest GPRS Protocol discriminator: GPRS Mobility Management Msg Type: Authentication & ciphering req IMEISV request: IMEISV not requested Ciphering algo.: GPRS Encryption Algorithm GEA/1 A&&C ref no.: 1 Force to standby: Force to standby not indicatedEI: Authentication parameter RAND: [ 0x 00 45 7e 37 7c 34 90 1f 4d 42 9a 1a da 56 e1 00 ] EI: Cell Identifier, Key seq.Identity: 4003282 12:33:16.977 L3 UL GPRS MM - AUthentication && CIPher RESPonse GPRS Protocol discriminator: GPRS Mobility Management Msg Type: Authentication & ciphering resp A&&C ref no.: 1EI: Authentication parameter SRES: [ 0x 00 00 00 00 ] EI: Packet Flow Timer, RES[0]: 147, [1]: 33, [2]: 173, [3]: 151 003316 12:33:18.709 L3 DL GPRS MM - ATTach ACCept GPRS Protocol discriminator: GPRS Mobility Management Msg Type: Attach accept Force to standby: Force to standby not indicated Attach result: GPRS only attached Timer: 79 Radio priority for SMS: 4EI: Routing Area Identification: MCC=234, MNC=33, LAC=30, RAC=1 EI: Radio Cause, P-TMSI signature: 29347 EI: Priority, Negotiated READY Timer: 22EI IMSI, Allocated P_TMSI: 3519911239 (0xd1cd9547)

003320 12:33:18.709 L3 UL GPRS MM - ATTach COMPlete GPRS Protocol discriminator: GPRS Mobility Management Msg Type: Attach complete003432 12:33:21.722 L3 UL GPRS SM - Activate PDP context request GPRS Protocol discriminator: Session Management Msg Type: Activate PDP context request Network service access point identifier: 5 LLC SAPI: 3 Delay Class: Subscribed delay class, Reliability Class: Subscribed reliability class, Peak Throughput: Subscribed peak throughput, Precedence Class: Subscribed precedence, Mean Throughput: Best effort Traffic class: Subscribed, Delivery order: Subscribed, Delivery of erroneous SDU: Subscribed, Max. SDU size: Subscribed, Max bit rate UL: Subscribed, Max bit rate DL: Subscribed, Residual BER: Subscribed, SDU error ratio: Subscribed, Transfer delay: Subscribed, Traffic handling priority: Subscribed, Guaranteed bit rate UL: Subscribed, Guaranteed bit rate DL: SubscribedPDP Type Org: 1 PDP Type Number: 0x21 (IPv4)APN value: orangeinternet Protocol Config.: 0 Protocol Id: 4918701 05 00 06 00 00 Protocol Id: 3280101 02 00 10 81 06 00 00 00 00 83 06 00 00 00 00 Protocol Id: 3280101 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00

003552 12:33:25.125 L3 DL GPRS SM - Activate PDP context accept GPRS Protocol discriminator: Session Management Msg Type: Activate PDP context accept LLC SAPI: 11 Delay Class: Delay class 4 (best effort), Reliability Class: Unacknowledged GTP and LLC; Acknowledged RLC, Protected data, Peak Throughput: Up to 256 000 octet/s, Precedence Class: Normal priority, Mean Throughput: Best effort Traffic class: Background, Delivery order: Without delivery order (no), Delivery of erroneous SDU: Erroneous SDUs not delivered, Max. SDU size: 1500 octets, Max bit rate UL: 2048 kbps, Max bit rate DL: 2048 kbps, Residual BER: 1e-5, SDU error ratio: 1e-4, Transfer delay: Subscribed, Traffic handling priority: Level 3, Guaranteed bit rate UL: Subscribed, Guaranteed bit rate DL: Subscribed EI: Alignment Octects, Radio Priority: 4PDP Type Org: 1 PDP Type Number: 0x21 IPv4: 10.32.149.90 Protocol Config.: 0 Protocol Id: 3280103 00 00 10 81 06 c1 23 85 0a 83 06 c1 23 86 0a 003984 12:33:37.139 L3 UL GPRS SM - Deactivate PDP context request GPRS Protocol discriminator: Session Management Msg Type: Deactivate PDP context request SM Cause: Regular deactivation004005 12:33:37.761 L3 UL GPRS SM - Deactivate PDP context accept GPRS Protocol discriminator: Session Management Msg Type: Deactivate PDP context accept004006 12:33:37.761 L3 DL GPRS MM - DETach REQuest GPRS Protocol discriminator: GPRS Mobility Management Msg Type: Detach request Force to standby: Force to standby not indicated Power Off: normal detach, Detach Type: (MS->net: GPRS detach) or (net->MS: re-attach required) Mobile Identity[0]: 244, [1]: 209, [2]: 205, [3]: 149, [4]: 71 EI: Radio Cause, P-TMSI signature 2: 29347004026 12:33:38.399 L3 DL GPRS MM - DETach ACCept GPRS Protocol discriminator: GPRS Mobility Management Msg Type: Detach accept

State Message Mode Dir ChannelId

le

MasterInformationBlock Idle DL BCCH

Idle DL BCCH

Idle DL BCCH

Idle DL BCCH

Idle DL BCCH

System Information Block 1 (SIB 1)




Idle

Idle DL BCCHSystem Information Block 5 (SIB 5)

Descriptionwhich SIBs it needs to monitor thus saving Battery power

Transmitted every 8th radio frame on P-CCPCH (on position SFN mod 8=0, and with TTI of 20ms)

For most SIBs used within the system the MIB may carry a value tag. The only exceptions are SIB 15.2, SIB 15.3 and SIB 16.

If a value tag is unchanged, the corresponding system information has not been modified. Thus the UE does not need to read corresponding SIB.

SIB 7 has no value tag. It changes with each occurrence

Scheduling information is used to inform UE, where and when a specific system information is transmittedContains UE timers used during RRC Idle and RRC Connected Mode.

SIB 1 is valid in one PLMN.

MIB is read in RRC modes/states RRC idle, CELL_FACH, CELL_PCH and URA_PCH. Its parameters are valid in these and also the RRC sub-state CELL_DCH.

When UE selects new cell it checks the SIB 1 value tag. If number is the same as in previous cell then the content transmitted in SIB 1 is also the same. There is no necessity for UE to read the SIB 1 message.

Message valid in RRC sub-state URA_PCHA change in SIB 2 is indicated by a value tag (in MIB)Also contains cell identity and cell restriction data

Is valid in RRC idle mode.

Also read and valid in RRC connected mode sub-states CELL_FACH, CELL_PCH and URA_PCH when SIB 4 is not broadcasted

A change in SIB 3 is indicated by a value tag (in MIB)Parameters for cell selection and re-selection for Ues in connected mode

Contains mostly same data as SIB 3 but is read and is valid only when UE is in the RRC connected mode.

Read and valid in the CELL_FACH, CELL_PCH and URA_PCH sub state.

A change in SIB 3 is indicated by a value tag (in MIB)

Parameters for common physical channel configuration

Parameters cover the PICH power offset, AICH power offset, P-CCPCH, S-CCPCH and PRACH System information list

Read and valid in the CELL_FACH, CELL_PCH and URA_PCH sub state.

A change in SIB 5 is indicated by a value tag (in MIB)

Example

003362 09:37:17.344 RRC DL BCCH-BCH SysInfoType2

SysInfoType2- URA_IdentityList_0: 11101

System Info Block 3.rtf


Master Information Block.rtf

Timeslot Usage HoppingT-Mobile Orange T-Mobile Orange

0 1 0.22% 7 1.12% Yes 594 84.62% 671 67.10%1 242 53.19% 325 52.08% No 108 15.38% 329 32.90%2 42 9.23% 58 9.29% 702 100.00% 1000 100.00%3 39 8.57% 43 6.89%4 33 7.25% 38 6.09%5 30 6.59% 33 5.29%6 57 12.53% 34 5.45%7 11 2.42% 86 13.78%

455 100.00% 624 100.00%

C/iT-Mobile Orange

0-10 244 3.56% 556 4.15%10-20 6031 87.97% 9807 73.17%20-30 581 8.47% 3040 22.68%

6856 100.00% 13403 100.00%

2G Layer3-Message Browser

Documents

Transcript of 2G Layer3-Message Browser