16-bit cellids with radio LTE

[Gitschubser]

The export file MLS-full-cell-export-2015-03-06T000000.csv contains 33833 false 16-bit cellids (<=65535) with radio LTE (MozStumbler collects 28-bit cellids with radio LTE). The file includes 4757716 cellids, 791843 cellids with radio LTE and 33833 16-bit cellids with radio LTE.

[Gitschubser]

A short example from the provider T-Mobile Germany (mcc: 262, mnc: 1) with false 16-bit cellids with radio LTE. All cellids with radio LTE (28-bit) from T-Mobile have 8 digits, UMTS has 6 or 7 digits (simple schema). You can see a wrong radio or lac with this cellid and in many case 1 sample and a range that is 0. This wrong 16-bit cellid with radio LTE is a duplicate from the correct cellid with the correct radio or lac.

I've made a mistake, 17511 is a GSM LAC.

[Gitschubser]

Here are examples where the radio is CDMA and LTE with the same lac and cellid (16-bit): LTE,311,40,6,428,,-122.119655899,37.3638478343,1381,70,1,1394756475,1425714268, CDMA,311,40,6,428,,-122.115971,37.3646588,4039,107,1,1394756475,1408453644,

CDMA,311,40,6,952,,-122.166697,37.3517147,9297,706,1,1394756945,1408453644, LTE,311,40,6,952,,-122.1712322,37.3547754,2983,395,1,1394756945,1408453644,

CDMA,311,40,6,443,,-122.2010037,37.3043336,1791,683,1,1394757932,1408453644, LTE,311,40,6,443,,-122.2030079,37.3013746,1188,95,1,1394757933,1408453644,

CDMA,311,40,6,678,,-122.1733847,37.3318323,19,3,1,1395159861,1408453644, LTE,311,40,6,678,,-122.156310802,37.3670908753,9748,93,1,1395159861,1426460625,

[hannosch]

The same comment as in #373 applies, the RNC-Id can be zero, which means these networks aren't necessarily invalid.

[kolesar-andras]

LTE uses different cell numbering than WCDMA. Full cell identifier is 28 bit for both but divided at different position:

• WCDMA has 12-bit RNC and 16-bit short cellid
• LTE has 20-bit eNB and 8-bit short cellid

For example if eNB=1 and cellid=2 then full cellid is 1*256 + 2 = 258. Vodafone in Hungary numbers LTE cells from 0 therefore even 256 is a valid full cell id. I have not seen eNB=0 but theoretically possible.

[E3V3A]

@kolesar-andras Nice catch. Not to be PITA, but can you provide any 3GPP (or so) links (or quotes) for reference? (That would probably help @hannosch to verify and implement.)

[kolesar-andras]

For example:

• https://www.slideshare.net/allabout4g/lte-identifiers
• http://easylte.blogspot.com/2015/08/lte-terminologies-explanations.html

[kolesar-andras]

eNodeB identifier (eNB) identifies a base station. It is a short number between 1 and some thousands. Base stations usually have 3 sectors, these are numbered as 1-2-3.

In LTE operators combine base station identifiers with sector identifiers in a binary way (bit positions). The same method was used in 3G and 2G in a decimal way, using simple decimal digits. Highest cell identifier is 65535, decimal representation is 5 digits. In Hungary there are only few thousand base stations in a network therefore 4 digits are enough to identify them. The same 4 digits identify the base station in LTE (eNB) and upper digits in 3G/2G. Last digit is used as sector identifier. For example:

• LTE eNB is 1234, sectors are 1-2-3.
• WCDMA lowest 16 bits (cellid & 0xFFFF) is 12341, 12342, 12343
• GSM cellid is 12341, 12342, 12343

Many base stations have more bands at each sectors. The simple example above is usually extended in the following way:

• LTE has two frequencies (1800 and 800) numbered as 1-2-3 and 6-7-8 (network dependent)
• WCDMA cell ids are repeated for each band: 12344, 12345, 12346 for the second band and so on
• GSM cellid ids are continued the same way when both 900 and 1800 MHz are used

Network operators use slightly different numberings.

• As I have mentioned above, Vodafone (at least in Hungary) uses numbers 0-1-2 for LTE. They started with 800 MHz (even in cities), later installed 1800 MHz sectors numbered as 10-11-12. There are cells numbered from 20, probably even higher frequency bands.

• Telenor numbers LTE 1800 cells as 1-2-3, LTE 800 cells as 6-7-8. Even when only 800 MHz cells are installed. Numbers 4 and 9 are only used when station has 4 directions, usually churches.

• Telekom numbers cells continously, for example 1-2-3 and 4-5-6.

WCDMA numbering is even more different:

• Vodafone assigns last digits as 1-2-3, 4-5-6, 7-8-9 for the three 2 GHz bands. There are sometimes 900 MHz WCDMA cells numbered as 1-2-3 with a station identifier derived from the original leaving first digit: instead of 1234 only 234 (2341, 2342, 2343). This works fine as their first station was numbered as 1001.

• Telenor left room for 4th (or even 5th) cell, always start second round from six: 6-7-8(-9). When all three 3G bands are used, third round does not fit into last digit. They have assigned a new station identified for all affected stations without any correlation of the original. The only connection between cells is PSC. The same PSC is used at the same directions. Sectors at a base station usually have incrementing PSCs for example 345, 346, 347. It is same for Vodafone.

• Telekom uses automatically incremented cell identifier countrywide. It means no connection is among sectors on the same base station. Neither PSCs are related together.

You can check these rules on base station of Hungary: http://cellavadasz.openstreetmap.hu/

We use our measurements and OpenCellID raw data to identify base stations precisely. You can click on any symbols. Datasheet is stored in OpenStreetMap database as attribute of the base stations, usually towers, chimneys, water towers and roof antennas.