Monitoring cell towers

One of my favorite books is High Performance Browser Networking by Ilya Grigorik. In addition to many helpful tips, the book contains many fascinating stories from real life.



imageโ€œ46% of battery consumption for transferring 0.2% of information from the total number of bytes.



Whenever a Pandora user plays a song, the music file is transmitted by the app from the network in one go, which is the correct behavior: copy as much data as possible, and then you can turn off the radio for a long time.



However, after the music is streamed, the app will periodically analyze the audience, sending intermittent analytic requests every 60 seconds. Pure effect? Analytics queries accounted for 0.2% of the total bytes transferred and 46% of the total application power consumption! "



- Ilya Grigorik, High Performance Browser Networking



Ilya takes his time to state his point of view in detail. To educate readers on cell phone battery life, he devotes an entire chapter to detailed descriptions of GSM, UMTS and LTE radio modems. It is surprising to realize that problems at one level can find their roots at several levels below.



image



Drive from Sunnyvale to downtown Mountain View.



By examining the entire stack, High Performance Browser Networking does more than provide facts. He defends philosophy.



Good developers know how things work.

Great developers know why everything works.



- Steve Souders, High Performance Browser Networking, Foreword




The old idea is new again



When I read this in 2013, I thought it would be cool to do my own research and visualize the radio jumping from one cell to another while the phone is traveling.



This idea could not be implemented with my 2013 iOS phone as it did not provide the data I needed, but my current Pixel does not have this problem. LocationManager can provide GPS location (latitude, longitude) every second. Meanwhile, TelephonyManager gives out cellID = (mmc, mcc, lac, cid) which radio is currently on.



The CellID database [1] allows you to find out (latitude, longitude) of each CellID. All that remains is to draw the route (in red) and for each second a color-coded cell connection.



The above result shows a 7-minute trip, 3.7 km long, with an LTE-enabled phone (also known as UE for user equipment). Five towers and nine cells (also known as eNB for Evolved NodeB) were discovered along the way.



Analysis



imageCombining the map, Google StreetView, and Wikipedia made a lot of things sorted out.



  • Multiple cell IDs are mapped to the same latitude and longitude coordinates of the eNB. This is because the antennas installed on the eNB do not have 360 โ€‹โ€‹ยฐ coverage. The angle and range of each antenna divides the space into pizza-shaped cells.
  • . 85, . . , .
  • eNB , . ยซ ยป, 45 . , eNB . , .
  • . CellID (CellMapper) , Google StreetView . , , .
  • eNB , [2]. [3], [4] .
  • , .
  • LTE- UE . , -, , .
  • ( ) . โ€ฆ , SIB. , .
  • ยซยป (10 ) , LAC ( ) CellID . LTE, UE, LAC. , RCC_IDLE . , , , , LAC ( GSM [5]).
  • , 120ยฐ. , .




image



120 ยฐ .





Drawing maps was fun. This made me want to know more about this area. I found that it was not only deep but also quite wide. Even compiling a minimal table to summarize it required a significant amount of research on abbreviations.



image



Esoteric world



Since 1998 with 2G (GSM), all technology stacks have been standardized and documented by 3GPP. These specifications cover over a hundred documents. Understanding them seems to be the achievement of a lifetime.



There is no open source LTE stack to learn from [6], and even if there was, cell phone band emissions are tightly regulated to ensure that frequencies are not contaminated by buggy modems.



Few books from this area are very expensive. My "genuine window of interest" was fueled by these three.



  • An introduction to LTE by Christopher Cox.
  • LTE Advanced Sasana Ahmadi.
  • Long Term Evolution in Bullets, 2nd Edition by Chris Johnson.




Finally, there are apps that let you look under the hood to show the status of the modem and messages. I decided not to use them as they are not only expensive but also require rooting the phone.



Sources of



  1. Wikipedia list of CellID databases
  2. Cell tower on a mast
  3. Cell tower on a church
  4. Cell tower on an electric pylon
  5. Cell tower junk science
  6. Osmocom and srsRAN .



All Articles