Sunday, January 27, 2019
LTE Attach and Default Bearer Setup Messaging
Prior to the LTE mobile phone being tracked in the LTE network their is still the setup process that enables the handset to gain access to network services. This useful guide illustrates the steps involved which a CSA investigator should have an understanding, not least of which is knowing S1AP: when the IMSI and GUTI are used; S11: The IP assigned to the mobile station and current location of the user; and a host of other useful information that often crops up in investigations.
LTE Tracking Area Update
This useful guide produced using EventStudio System Designer drives home the processes and procedures involved to understand how LTE Tracking Area Update works. Every CSA investigator will need to have knowledge in this area to be able to define in a statement, report or at Court how a mobile phone is tracked whilst switched ON and moving around in an LTE network.
3G Networks position techniques.pdf
For those CSA investigators interested in a skeleton outline on 3G Networks position techniques, this info should help as a starting point.
Cell Site Analysis - location and radio coverage signals
It still holds true with LTE radio coverage that signals arrive in a scattered manner detected at the mobile phone handset. A good CSA investigator will know how to explain how coverage might inconceivably be thought by the untrained not to be detected at a particular location, may well be possible due to the location of the phone at the material time.
As mentioned in a previous post understanding density of masts in an area must equally be understood not simply from the point of calls handled by a single mast. There is also the instance where a call's start and end masts are different that can be involved, which may involve the network having to deal with 'hard handover'. Advancements with 3G and 4G enables calls (data) being handled by several masts delivering data to the smartphone in a seamless fashion. This maybe due to the amount of data involved or fast-fading etc. These types of handovers are called 'soft-handover'. When understood correctly the use of these combined masts in soft-handover because they are often in very close proximity can narrow down the location through improved triangulation (etc.).
There is the occasion where the operator only has one mast in a particular area but several sectors of the same mast might be used seamlessly for an e.g. data call, and this is called softer-handover. When thinking about soft and softer handover think in terms of 'inter' and 'intra'.
Furthermore, smartphones, which I call 'ultra-smarts' due to their increased embedded communications capabilities, use close proximity masts or access points (Wi-Fi) to enable uninterrupted communication and network access. Network operators have deployed microcells, as you (may) know. Microcells deployment help remove the burden of signalling and traffic on macro-cells by directing slow-moving mobiles to short range coverage. These microcells can be useful for slow-moving users, walking down the high street or located in one area for a period of time. Remaining in an area for a period of time is called 'dwell time'. The latter is a term CSA investigators should know as it can have important bearing upon a case. In some instances, small coverage points have been deployed called pico-cells and nano-cells which can refine location distances between the mobile phone and the cell to a few meters.
The 'ultra-smarts' Wi-Fi capability creates an additional attractive proposition for cell site analysis investigations as the investigator will need to be keenly aware that dual usage of cellular and Wi-Fi coverage can produce a rich resource of location positioning. The image below has been used at this blog before but it is still a useful reminder what should be considered when conducting radio surveys.
And if further illustration is needed to illuminate a survey assessment criteria then hopefully this image below will provide the investigator with some ideas.
Cell site analysis has evolved so much more from the days of GSM and early days of WCDMA. It is not enough to use call records and CDRs in isolation and/or going to a particular geographical location to conduct tests at one single location; the wider area needs to be taken into context as to what impact that might have on a call or calls being handled by a cell or cells etc. (mast, masts or access points).
LTE Positionng Methods
As with GSM and WCDMA, LTE is no different. Cell Site Analysis investigators still need to have a general understanding of location positioning methods in order to refine how using static and drive test radio test measurements do not clearly define radio boundaries alone. There are a enormous range of strategies that can be adopted and should be adopted based on a case-by-case basis.
If network operator adopted methods for determining location (and they have the infrastructure to do that) an external investigator cannot use CDRs and radio test measurements to pinpoint call location at the material time. It still requires knowing how each operator has planned their network radio coverage and still does no harm to request single cell prediction maps and best server plots -density maps.
Remember the density-map is important as it provides an underlying indication of potential cell usage or handover.
Sunday, September 28, 2014
CSA - Site Survey Method/LTE SIBtype1
CSA - Site Survey Method/LTE SIBtype1
Before continuing with GSM/GERAN System Information Message Types, thanks for the enquiries regarding LTE and requests for an example of a systeminformationblocktype(SIB). It would appear there is a requirement to explore LTE and UMTS SIBs some more before moving on to GSM/GERAN. I will do my best to answer some of the enquiries.
For educational purposes only, followingthe masterinformationblock(MIB) having been decoded by the UE a useful example of content for systeminformationblocktype1 was illustrated by Ralf Kreher and Karsten Gaenger (c)2011 using Tektronix K2Air as an example when conducting a LTE investigation into signalling troubleshooting and optimisation.
This form of analysis provides an excellent grounding when conducting ICCSA.Why would that be so? Familiarisation with this education content enables knowledge to be gleaned from the real-world SIBs detected by the UE at particular locations. Importantly information that informs the UE about varying cells benefits an investigation. For instance, we know that when the UE has successfully received and decoded MIB and SIBs type 1 and 2 etc during its travels SIB type9 might identify (H)eNobeB that is available. To be clear that latter information provides two unique pieces of information. (1) The identity of the radio source (2) it is location specific to tens of metres in an area thus refines location identification where the UE would have dwelt (dwell time - slow moving UE).
It also refines the location for the investigation and even where SIB1 and SIB2 provide a wider location area the UE detection (SIB type9) of the (H)eNobeB coverage would have the effect of demonstrating pre-requisite requirement of proximity to an area. Now readers could point out how would the person conducting the ICCSA know about the (H)eNobeB in the first place if call/data records are not available. For those situations where immediate is important aspect of current bandit surveillance the UE stores relevant information of the radio resources in an area for up to 3-hours after which old data are discarded. For a live UE acquisition this time frame could be useful. For a UE switched off (e.g. at the target site area) retains that information and requires extraction and harvest without invoking UE power up and network detection and registration.
Before continuing with GSM/GERAN System Information Message Types, thanks for the enquiries regarding LTE and requests for an example of a systeminformationblocktype(SIB). It would appear there is a requirement to explore LTE and UMTS SIBs some more before moving on to GSM/GERAN. I will do my best to answer some of the enquiries.
For educational purposes only, followingthe masterinformationblock(MIB) having been decoded by the UE a useful example of content for systeminformationblocktype1 was illustrated by Ralf Kreher and Karsten Gaenger (c)2011 using Tektronix K2Air as an example when conducting a LTE investigation into signalling troubleshooting and optimisation.
+-------------------------------------------------------+---------------------------------------------+
|ID Name |Comment or Value |
+-------------------------------------------------------+---------------------------------------------+
|56 05:43:34,555,032 RRC-UU K2AIR-PHY PDSCH
LTE-RLC/MAC MAC-TM-PDU (DL) LTE-RRC_BCCH_DL_SCH
systemInformationBlockType1 |
|Tektronix K2Air LTE PHY Data Message Header
(K2AIR-PHY) PDSCH (= PDSCH Message) |
|1 PDSCH Message |
|1.1 Common Message Header |
|Protocol Version |0 |
|Transport Channel Type |DL-SCH |
|Physical Channel Type |PDSCH |
|System Frame Number |454 |
|Direction |Downlink |
|Radio Mode |FDD |
|Internal use |0 |
|Status |Original data |
|Reserved |0 |
|Physical Cell ID |0 |
|UE ID/RNTI Type |SI-RNTI |
|Subframe Number |5 |
|UE ID/RNTI Value |'ffff'H |
|1.2 PDSCH Header |
|CRC report |CRC ok |
|HARQ process number |0 |
|Reserved |0 |
|Transport Block Indicator |single TB info |
|Reserved |0 |
|1.2.1 Transport Block#1 Information |
|Transport Block#1 Size |144 |
|Modulation Order DL 1 |QPSK |
|New Data Indicator DL 1 |new data |
|Redundancy Version DL 1 |1 |
|Reserved |0 |
|Modulation Scheme Index DL 1 |5 |
|Reserved |0 |
|1.2.2 Transport Block Data |
|TB1 Mac-PDU Data |40 51 00 21 00 00 20 00 10 0c 14 01
10
21 00 68 22 b6 |
|Padding |'0068'H |
|1.3 Additional Call related Info |
|Number Of Logical Channel Informations |1 |
|1.3.1 Logical Channel Information |
|LCID |0 |
|RLC Mode |Transparent Mode |
|Radio Bearer ID |0 |
|Radio Bearer Type |Control Plane (Signalling) |
|Spare |0 |
|Spare |0 |
|Logical Channel Type |BCCH |
|Call ID |'fffffff5'H |
|3GPP LTE-RLC/MAC Rel.8 (MAC TS 36.321 V8.5.0,
2009-03, RLC TS 36.322 V8.5.0, 2009-03) (LTE-RLC/
MAC) MAC-TM-PDU (DL) (= MAC PDU (Transparent Content
Downlink)) |
|1 MAC PDU (Transparent Content Downlink) |
|MAC Transparent Data |40 51 00 21 00 00 20 00 10 0c 14
01 10
21 00 68 22 b6 |
|RRC (BCCH DL SCH) 3GPP TS 36.331 V8.5.0 (2009-03)
(LTE-RRC_BCCH_DL_SCH)
systemInformationBlockType1 (=
systemInformationBlockType1) |
|bCCH-DL-SCH-Message |
|1 message |
|1.1 Standard |
|1.1.1 systemInformationBlockType1 |
|1.1.1.1 cellAccessRelatedInfo |
|1.1.1.1.1 plmn-IdentityList |
|1.1.1.1.1.1 pLMN-IdentityInfo |
|1.1.1.1.1.1.1 plmn-Identity |
|1.1.1.1.1.1.1.1 mcc |
|1.1.1.1.1.1.1.1.1 mCC-MNC-Digit |2 |
|1.1.1.1.1.1.1.1.2 mCC-MNC-Digit |9 |
|1.1.1.1.1.1.1.1.3 mCC-MNC-Digit |9 |
|1.1.1.1.1.1.1.2 mnc |
|1.1.1.1.1.1.1.2.1 mCC-MNC-Digit |0 |
|1.1.1.1.1.1.1.2.2 mCC-MNC-Digit |0 |
|1.1.1.1.1.1.2 cellReservedForOperatorUse |notReserved |
|1.1.1.1.2 trackingAreaCode |'0000'H |
|1.1.1.1.3 cellIdentity |'2000100'H |
|1.1.1.1.4 cellBarred |notBarred |
|1.1.1.1.5 intraFreqReselection |notAllowed |
|1.1.1.1.6 csg-Indication |false |
|1.1.1.2 cellSelectionInfo |
|1.1.1.2.1 q-RxLevMin |-65 |
|1.1.1.3 freqBandIndicator |1 |
|1.1.1.4 schedulingInfoList |
|1.1.1.4.1 schedulingInfo |
|1.1.1.4.1.1 si-Periodicity |rf16 |
|1.1.1.4.1.2 sib-MappingInfo |
|1.1.1.4.2 schedulingInfo |
|1.1.1.4.2.1 si-Periodicity |rf32 |
|1.1.1.4.2.2 sib-MappingInfo |
|1.1.1.4.2.2.1 sIB-Type |sibType3 |
|1.1.1.4.2.2.2 sIB-Type |sibType6 |
|1.1.1.4.3 schedulingInfo |
|1.1.1.4.3.1 si-Periodicity |rf32 |
|1.1.1.4.3.2 sib-MappingInfo |
|1.1.1.4.3.2.1 sIB-Type |sibType5 |
|1.1.1.5 si-WindowLength |ms20 |
|1.1.1.6 systemInfoValueTag |22 |
This form of analysis provides an excellent grounding when conducting ICCSA.Why would that be so? Familiarisation with this education content enables knowledge to be gleaned from the real-world SIBs detected by the UE at particular locations. Importantly information that informs the UE about varying cells benefits an investigation. For instance, we know that when the UE has successfully received and decoded MIB and SIBs type 1 and 2 etc during its travels SIB type9 might identify (H)eNobeB that is available. To be clear that latter information provides two unique pieces of information. (1) The identity of the radio source (2) it is location specific to tens of metres in an area thus refines location identification where the UE would have dwelt (dwell time - slow moving UE).
It also refines the location for the investigation and even where SIB1 and SIB2 provide a wider location area the UE detection (SIB type9) of the (H)eNobeB coverage would have the effect of demonstrating pre-requisite requirement of proximity to an area. Now readers could point out how would the person conducting the ICCSA know about the (H)eNobeB in the first place if call/data records are not available. For those situations where immediate is important aspect of current bandit surveillance the UE stores relevant information of the radio resources in an area for up to 3-hours after which old data are discarded. For a live UE acquisition this time frame could be useful. For a UE switched off (e.g. at the target site area) retains that information and requires extraction and harvest without invoking UE power up and network detection and registration.
Tuesday, September 23, 2014
CSA - Site Survey Method/LTE-UMTS SIBs
There is a huge volume of materials and standards to be considered when undertaking study or work as an InnerCity CSA (ICCSA) expert, technician or student. However, the materials and standards referred to at my webblog aim to control the flow of such volumous information and provide instead an easy guide to seeking out the information experts, technicians or students can be exposed to when involved with ICCSA.
A highly defined smartphone etc can be offered services by a range of mobile network access systems e.g. GSM, GERAN, UTRAN, e-UTRAN etc when switched ON and actively in use or in idle mode. Access system information for LTE and UMTS are mapped in System Information Blocks (SIBs). When conducting ICCSA test measurement it is useful to identify which broadcasted SIBs contain data to help understand the survey results. Knowing the content allocated to SIBs can assist enormously in interpretation and when considering the propositions highlighted in the previous discussion thread - http://cellsiteanalysis.blogspot.co.uk/2014/08/csa-site-survey-method4cell-types.html
Below are commonly referred to LTE/UMTS SIBs. GSM and GERAN data are mapped to System Information Types that will be given in the next discsssion.
LTE System Information Blocks
***************************
SIB 1 contains PLMN identity, tracking area code, and CI of the broadcasting cell. Q-RxLevMin minimumRSRP threshold that a broadcasting cell should be measured before initial cell selection, and later for random access performed by UE. SIB Mapping Info included to inform the UE which SIBs are transmitted and how they are scheduled.
SIB 2 contains timers and constants, access barring information, UL frequency information, and UL bandwidth information.
SIB 3 contains parameters for the cell reselection procedure.
SIB 4 contains neighbour cell information for intra-frequency cell reselection.
SIB 5 contains information for interfrequency cell reselection.
SIB 6 contains information for inter-RAT cell reselection to the UTRAN.
SIB 7 contains information for inter-RAT cell reselection to the GERAN.
SIB 8 contains information for inter-RAT cell reselection to CDMA2000.
SIB 9 is used to broadcast the home eNB name (HNB name).
SIB 10 and SIB 11 can be used to broadcast warning information to subscribers (e.g. tsunami warnings).
SIB 12 assigned for Commercial Mobile Alerting System (CMAS) information usage
UMTS System Information Blocks
*****************************
SIB 1 NAS System Information, UE Timer and counter for RRC idle and connected mode
SIB 2 URA Identity
SIB 3 Parameter for Cell Selection and Cell Reselection
SIB 4 Parameter for Cell Selection and Cell Reselection in RRC connected mode
SIB 5 Parameter for configuration of Common Physical Channel (CPCH) of actual cell
SIB 6 Parameter for configuration of Common and shared Physical Channel of actual cell
SIB 7 Fast changing parameter for uplink Interference and Dynamic Persistent Level
SIB 8 Static CPCH Information of actual cell [FDD only]
SIB 9 CPCH Information of actual cell [FDD only]
SIB 10 Information for UE, which DCH is controlled by Dynamic Resource Allocation Control Procedure
SIB 11 Measurement Control Information of actual cell
SIB 12 Measurement Control Information of actual cell in RRC connected mode
SIB 13 ANSI-41 System Information
SIB 13.1 ANSI-41 RAND Information
SIB 13.2 ANSI-41 User Zone Identification
SIB 13.3 ANSI-41 Private Neighbour List
SIB 13.4 ANSI-41 Global Service Redirection
SIB 14 UL outer loop power control information for common and dedicated physical channels in RRC idle and connected mode
SIB 15 Information for UE positioning method
SIB 15.1 Information for UE GPS positioning method with Differential Global Positionig System (DGPS) correction
SIB 15.2 Information for GPS Navigation-Model
SIB 15.3 Information for GPS Almanac, ionospheric and UTC Model
SIB 15.4 Ciphering Information of SIB 15.5
SIB 15.5 Information for OTDOA UE positioning method
SIB 16 Information of Radio Bearer, transport and physical channels for UE in RRC idle or connection mode in case of Handover to UTRA
SIB 17 Fast changing parameter for the configuration of Shared Physical Channels in RRC conected mode [FDD only]
SIB 18 PLMN Identifies neighbour cells
A highly defined smartphone etc can be offered services by a range of mobile network access systems e.g. GSM, GERAN, UTRAN, e-UTRAN etc when switched ON and actively in use or in idle mode. Access system information for LTE and UMTS are mapped in System Information Blocks (SIBs). When conducting ICCSA test measurement it is useful to identify which broadcasted SIBs contain data to help understand the survey results. Knowing the content allocated to SIBs can assist enormously in interpretation and when considering the propositions highlighted in the previous discussion thread - http://cellsiteanalysis.blogspot.co.uk/2014/08/csa-site-survey-method4cell-types.html
Below are commonly referred to LTE/UMTS SIBs. GSM and GERAN data are mapped to System Information Types that will be given in the next discsssion.
LTE System Information Blocks
***************************
SIB 1 contains PLMN identity, tracking area code, and CI of the broadcasting cell. Q-RxLevMin minimumRSRP threshold that a broadcasting cell should be measured before initial cell selection, and later for random access performed by UE. SIB Mapping Info included to inform the UE which SIBs are transmitted and how they are scheduled.
SIB 2 contains timers and constants, access barring information, UL frequency information, and UL bandwidth information.
SIB 3 contains parameters for the cell reselection procedure.
SIB 4 contains neighbour cell information for intra-frequency cell reselection.
SIB 5 contains information for interfrequency cell reselection.
SIB 6 contains information for inter-RAT cell reselection to the UTRAN.
SIB 7 contains information for inter-RAT cell reselection to the GERAN.
SIB 8 contains information for inter-RAT cell reselection to CDMA2000.
SIB 9 is used to broadcast the home eNB name (HNB name).
SIB 10 and SIB 11 can be used to broadcast warning information to subscribers (e.g. tsunami warnings).
SIB 12 assigned for Commercial Mobile Alerting System (CMAS) information usage
UMTS System Information Blocks
*****************************
SIB 1 NAS System Information, UE Timer and counter for RRC idle and connected mode
SIB 2 URA Identity
SIB 3 Parameter for Cell Selection and Cell Reselection
SIB 4 Parameter for Cell Selection and Cell Reselection in RRC connected mode
SIB 5 Parameter for configuration of Common Physical Channel (CPCH) of actual cell
SIB 6 Parameter for configuration of Common and shared Physical Channel of actual cell
SIB 7 Fast changing parameter for uplink Interference and Dynamic Persistent Level
SIB 8 Static CPCH Information of actual cell [FDD only]
SIB 9 CPCH Information of actual cell [FDD only]
SIB 10 Information for UE, which DCH is controlled by Dynamic Resource Allocation Control Procedure
SIB 11 Measurement Control Information of actual cell
SIB 12 Measurement Control Information of actual cell in RRC connected mode
SIB 13 ANSI-41 System Information
SIB 13.1 ANSI-41 RAND Information
SIB 13.2 ANSI-41 User Zone Identification
SIB 13.3 ANSI-41 Private Neighbour List
SIB 13.4 ANSI-41 Global Service Redirection
SIB 14 UL outer loop power control information for common and dedicated physical channels in RRC idle and connected mode
SIB 15 Information for UE positioning method
SIB 15.1 Information for UE GPS positioning method with Differential Global Positionig System (DGPS) correction
SIB 15.2 Information for GPS Navigation-Model
SIB 15.3 Information for GPS Almanac, ionospheric and UTC Model
SIB 15.4 Ciphering Information of SIB 15.5
SIB 15.5 Information for OTDOA UE positioning method
SIB 16 Information of Radio Bearer, transport and physical channels for UE in RRC idle or connection mode in case of Handover to UTRA
SIB 17 Fast changing parameter for the configuration of Shared Physical Channels in RRC conected mode [FDD only]
SIB 18 PLMN Identifies neighbour cells
Subscribe to:
Posts (Atom)