Some time back I got hold of an IPhone from ATT and did a field test.
It releived quite an interesting results and gave a blue print of ATT
network. Field test application can be invoked using keypad
and by typing *3001#12345#*. It shows a lot of information about
cellular network including RRC, NAS and PDP context. I tried
to analyze some part by taking a bus ride, from one place to another,
which is apporximately 5 miles.
Routing Area and Cell id
Cell id kept changing every quarter to half a mile. Routing area changed every mile to 2. A cell id change mean that there was a NodeB change and Routing area change indicates that RNC has changed. I hope location reporting for cell id is not enabled, otherwise there will be so many updates to the network. Imagine a bus loaded with 40 people out which atleast 20 are carrying phones by ATT network. This creates 20 cell updates at almost same point. Cell Id update is optional so I am sure the cell id update must has been turned off in the network.
But Routing area cannot be avoided. Which means the network was receiving 20 Routing Area Updates every 5 mins from the bus. So if you combine the traffic that is outside the bus, during a peak time, its is quite a load on SGSN/RNCs to process the routing area updates. Unfortunately every Routing Area needs to be reprted to SGSN, but with LTE and concept of Tracking Area List the updates can be significantly reduced. But again that will depend on how the network is designed. During attach in LTE, network may send a max of 16 tracking areas and If UE is moving across those tracking areas then there is no need for a Tracking Area Update.
PDP contexts
The IPhone atleast opens 2 primary PDP contexts. One is for regular data and other is for visual voice mail. Now another interesting thing, for pulling an voice mail, phone always connects to a different APN, this means voice mail can be given free of charge without much of hassle. Because voice mail APN can be a plain APN withouth charging or DPI turned on.. On the other hand if voice mail is pulled from regular APN, then DPI needs to be turned on the APN and voice mail traffic should be zero rated. Its an absolute pain. So the work aroud is to make phone connect to different APN.
I was wondering, if a Phone is bought unlocked then how to make it connect to two different APNs. I know that I can trigger another primary pdp using a console connection and AT commands, but how do we do it from a phone. May be that is one of the reasons why ATT doenst unlock IPhones.
There are still some more interesting aspects to look at, but I will leave it you. Will grab an LTE phone and perform some more tests as and when time permits.
Cell id kept changing every quarter to half a mile. Routing area changed every mile to 2. A cell id change mean that there was a NodeB change and Routing area change indicates that RNC has changed. I hope location reporting for cell id is not enabled, otherwise there will be so many updates to the network. Imagine a bus loaded with 40 people out which atleast 20 are carrying phones by ATT network. This creates 20 cell updates at almost same point. Cell Id update is optional so I am sure the cell id update must has been turned off in the network.
But Routing area cannot be avoided. Which means the network was receiving 20 Routing Area Updates every 5 mins from the bus. So if you combine the traffic that is outside the bus, during a peak time, its is quite a load on SGSN/RNCs to process the routing area updates. Unfortunately every Routing Area needs to be reprted to SGSN, but with LTE and concept of Tracking Area List the updates can be significantly reduced. But again that will depend on how the network is designed. During attach in LTE, network may send a max of 16 tracking areas and If UE is moving across those tracking areas then there is no need for a Tracking Area Update.
PDP contexts
The IPhone atleast opens 2 primary PDP contexts. One is for regular data and other is for visual voice mail. Now another interesting thing, for pulling an voice mail, phone always connects to a different APN, this means voice mail can be given free of charge without much of hassle. Because voice mail APN can be a plain APN withouth charging or DPI turned on.. On the other hand if voice mail is pulled from regular APN, then DPI needs to be turned on the APN and voice mail traffic should be zero rated. Its an absolute pain. So the work aroud is to make phone connect to different APN.
I was wondering, if a Phone is bought unlocked then how to make it connect to two different APNs. I know that I can trigger another primary pdp using a console connection and AT commands, but how do we do it from a phone. May be that is one of the reasons why ATT doenst unlock IPhones.
There are still some more interesting aspects to look at, but I will leave it you. Will grab an LTE phone and perform some more tests as and when time permits.
Posts
13 comments:
You can have 1 RA for all your RNCs :) You can also have 100 RAs per RNC :) RAU is not always caused by RNC change... :)
Correct! But that wasnt what I observed. RA did change often and I arm assuming there was a RaU for that. Reverse engineering, may not be correct ;)
In Android phones you can have so many apps to see TAC, CellId etc of the network as i use GSM Monitoring system app in India.
Thanks for your very interesting blog on "wired n wireless". I have the following question. How can a phone be connected to two different APNs, as each APN is associated with its original PDP context activation, and each PDP context activation resulted in giving a source IP to the phone. Having various connected APNs would mean that Phone has various Ip address, which isn't possible. Thanks to clarify on this.
Eric A. Smekens
It is possible for UE to connect to 2 APNs and obtain 2 different IP addresses. I have tried in several UEs and they all support this. Infact in LTE, 1 PDP/Bearer can have both IPv4 and IPv6.
IPhone does use a different IP address to obtain voice mail. Tested!
Hello, Santosh.
Thanks for your answer.
Can it be more than 2 APN/IP for one same UE ?. Is there any limitation to this ?. Is there any standard required for UE to support this ?.
Standards support upto 11 PDP types, so technically speaking a UE can connect to 11 APNs and obtain 11 IP addresses. It totally depends on UE and operator with regards to how many PDPs are supported.
About the RAU: The fact that you get RAUs does not necessarily (and more often does not) mean that you change RNCs. Just that you change PS paging areas. Typically a single RNC has upwards of 1000+ BTSs connected to it. The paging areas are made to reduce the number of paging broadcasta/cell. So in busy areas with lots of smartphones, the RAs are going to be small while still being connected to the same RNC.
To really see an RNC change, you'd have to see a SRNS relocation (only visible via signalling). If your RNTI didn't change, that's a sure way to tell that you stayed with the same RNC.
Also typically one BTS (or more correctly Node-B) has more than one cell. Typical are three sector configs (one cell per sector) and if the operator has more than one frequency, this means double or triple that.
Thanks Nasula for your comment. Ian not well versed with RAN but I was more concerned from SGSN side. Only message that SGSN sees is Routing Area Update or if location update is turned on the there may be a location update per CGI.
Hello, Santosh.
Thanks again for answering my question.
You write" Standards support upto 11 PDP types", "UE can connect to 11 APNs". Would you mind to tell me which 3GPP references explain this ?. (http://www.3gpp.org/specification-numbering)
Is there also any specification which UE must comply with to support concurrent APN's.
Kind regards.
Hi Eric
Read "11 pdp types" as "11 pdp's", as there are only 2pdp types in 3G (IPv4 & v6). You can refer to 29.060, Nsapi is of 4 bits, which gives values fom 0 to 15, out of which values 0 to 4 are reserved. So we are left with 11 values which UE can use for 11 primary pdp's.
Refer to 23.401 & 29.274 for LTE.
Regards, Santosh
Santosh, you should check the messages relocation prepare and relocation resource allocation messages. They are a good hint that you are infact changing RNCs.
Of course if the RAN (in the case of Ericsson or Huawei for example) doesn't have support for SRNS relocation then you'd have to know a bit more about the structure of the operator's RAN to know. But there is still a shortcut.
It is very likely that if the IP address of the GTP tunnel to the RNC changes, that you changed RNCs. Not 100%, but quite probable.
Thanks Nasula for the comment. When I last did the IOT I observed that phones were very pro-octive than NodeB's, before even Relocation Request was triggered then one would have already performed a RAU. I do know few operators who have disabled the SRNS relocation procedures.
Post a Comment