The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/phreak/cellular/dmpfaq.txt

Text File | 2003-06-11 | 25.9 KB | 752 lines

Digital Mobile Phones FAQ.






Digital Mobile Phones


Where are they, What are they? How do they work. Version 9.999.
Where facts are not confirmed, they have (?) after them. A lot
of the facts may be incomplete, or slightly inaccurate. This version
is available via WWW as http://www.kfs.org/~simon/phones/GSM.html
and is back out of hibernation after the author changed jobs and
couldn't find the tape with it on.


Apologies for any weird links if you're reading it as a plain
text file.

Contents


Introduction
Countries with digital cellular networks
GSM
PCN/DCS1800
SIM cards
SMS
Cell Broadcast
Redirecting calls
Questions & Answers on GSM & Derivatives
Data Services
Delays, Round trip times and echos
CT2
DECT
PHS
JDC
Eavesdropping
Other uses of mobile phones
USA and their standards
Manufacturers & Models
Companies involved
Typical Tariffs



Introduction


Just as digital technology has modernised many normal phone services
throughout the world, it is becoming more and more useful in mobile
communications. Benefits that are noticeable include:

Less interference
More secure communications (The famous "squidgey"
tapes of taped conversations, allegedly of members of the British
royal family having intimate conversations on mobile phones has
been quite a selling point in the UK). Most digital mobile phone
systems feature some form of encryption.
More efficient use of radio bandwidth (due to digital voice
compression)
Easier "roaming" with other networks, due to the
remarkably large adherence to standards.



It is clear that the predominant world standard for digital cellular
is GSM, and its derivatives. The term mobile phone also includes
cordless phones, which have become remarkably adept and flexible
with CT2, PHP and DECT standards.

Countries with digital cellular networks




This list has got too long to maintain my own separate copy. For the
official information, see
href="http://www.gsmworld.The Official GSM web
pages for a full list of GSM derived networks.
Non-GSM digital phone networks are:
USA
D-AMPS
Japan
JDC, PHS (Japan)
NTT (800Mhz) JDC
Tuka Cellular (1.5GHz) JDC



A few notes:
GSM


GSM uses a similar frequency range to conventional cellular phones,
around 900MHz. It currently has a fairly restricted frequency
range (within the UK) since they have to share some of the channels
with the old analogue systems of Cellnet and Vodafone. Eventually,
some of the channels will be reclaimed from the analogue systems
and handed over to the digital systems.

In the UK the TACS channels have all been allocated for GSM use,
and the licence for TACS usage runs out in 1999, which means all
those oh-so-cheap analogue phones have a limited lifetime.
PCN / DCS1800


PCN is based on GSM protocols, but has higher frequencies, (1800MHz),
a larger frequency range to work with, and lower power. This means
that instead of achieving a maximum of about 800 users per square
km, it is possible to double that figure. Also due to the reduced
power levels, batteries should last longer than the equivalent
GSM version of the handset. PCN is also known as DCS1800. Where
GSM is mentioned, odds are that the same thing applies to PCN.
DCS1900


One of the many standards proposed for digital mobile phones in
the USA. The USA doesn't have the 900MHz GSM band, or the 1800MHz
DCS1800 band available. Until otherwise proved otherwise, assume
that protocols remain the same as DCS1800, or GSM. Only differences
so far seem to be the power levels and frequency. (1900MHz band)
INMARSAT


Only really mentioned here because Nokia and Inmarsat have conducted
trails on a GSM based system, with a modified GSM handset attached
to a special antenna, have been able to set up a satellite GSM
call. It sounds useful if you're running a ship and want to give
GSM service to passengers.
SIM cards


PCN and GSM both use SIM cards to identify the customer. These
are smart cards which hold the users phone number, subscription
details, and a calling directory. Theoretically, even though GSM
and PCN phones have different technologies, SIM roaming
is possible. This has yet to be seen in practice. SIM roaming
is where when you go overseas, and say, rent a car with a phone
in it, you could just insert your SIM card and you take your phone
number with you. However, some manufacturers such as Nokia and
Ericsson who use "baby" SIM cards, which need an adapter
to be fitted to normal handsets. Some handset manufacturers have
shown an interest in dual standard handsets that work on both
GSM and PCN networks. In this manner, plain roaming between PCN
and GSM would be possible.

Aspects Software Ltd
are a company with lots of specialist knowledge about SIMs, and
provide tools for service providers to deal with SIM problems.

Some networks may be a little surprised when you ask for a SIM,
without a phone. (Orange, in the UK is one - In this case, ask
to speak to the registration supervisor, because they know that
it can be done, and they know the procedures to ship out an unregistered
SIM to insert in your phone).
SMS (Short Message Service)


PCN & GSM both have the ability in their protocols for customers
to receive text messages, rather like a text message pager, but
delivery is guaranteed (when the phone is unavailable due to being
out of service area, etc., the network will hold the message and deliver
it shortly after the phone comes back into range). The message
can be sent by a central paging service, or by a compatible handset
(E.g. Nokia Orange). SMS is also used for "internal"
messages, such as activating a phone when you first buy it, remote
programming of numbers into your directory on your SIM card, and
alerting the user of voicemail. It's also used internally within
the networks for transfer of call logging information and the
like from the switches to the billing centres. If a phone is stolen,
the provider can block the handset and the SIM card, some phones
will then continue to broadcast their location, and some will
display the message "STOLEN HANDSET", which cannot be
removed without the operator unblocking the handset.
CELL BROADCAST


A broadcast form of SMS. Some operators use it to inform users
what cell they are attached to, and therefore where local calls
are possible, and how much you can expect to pay for the call.
In theory, could also be used for news and information broadcast
services, stockmarket prices and so on. These would be subscription
features. Don't buy a phone for Vodafone Metrodigital without
Cell Broadcast facilities, or you won't be able to see if you're
in your "home cell".
REDIRECTIONS


Almost all modern phone services provide some form of call redirection
facility. GSM & Derivatives have a number of standard call
divert codes. Not all are supported on all networks. Some phones
have menu options to support these easily. They take the form:

**divert code*number#

**divert code*number*service code#
divert codes:


61 no answer

62 not reachable

21 always

67 busy (would be an engaged tone)
service codes:


10 All teleservices

11 Voice calls

12 All data

13 All fax

16 SMS

18 All data except SMS

19 All teleservices except SMS

25 All Data Async

Also, divert on no answer has the option of **62*number*service
code*n# - divert after n seconds ringing

Questions on GSM & Derivatives



Q) Why can't I make a call when my handset indicates a
strong base station signal. Particularly in rural areas.

A) Its probably due to dispersion of the digital signal.
In simple terms, its like the ghosting seen on a TV. Where a reflected
signal is of similar strength to the main signal. Normally the
time difference between main and reflected signal is small. However,
in rural areas, the reflected path may arrive at the handset at
a far latter time than the main signal. This confuses the handset/network
at the call cannot be made. May also be that the handset is greater
than 35km from the base station.

Q) Why wont a GSM handset work more than 35km from a transmitter.

A) (Over simplification alert). GSM uses TDMA when communicating
with the many handsets in its cell. The GSM base station sends
a page to a handset. Because of TDMA, the base station can only
wait a short period of time for the handset to respond before
it has to start looking after other handsets on that frequency.
If the handset is further than 35 KM from the base, the signal
does not have enough time to get out to the handset, and then
the handsets response back to the base station. At greater than
35km, the handsets response falls into the next TDMA time slot.
I.E., the base station moves onto handling another phone.

Alcatel Australia have produced a system for 70km range. Works
fine with a standard 2W handheld. Implemented in a number of Telecom
sites in Australia. There is also a system in the standard for
70km range. Alcatel actually did something different.

Q) Why can't I put a One2One SIM into my Orange handset
and use it?

A) You can, but since both networks had to highly subsidize
the development of the phones (since DCS-1800 is quite new) they
ship out the phones "locked" onto their network, and
networks with roaming agreements. If after your initial service
contract (1 year?) has expired, you pay about ú50 and they'll
remove this block. This facility is available on almost all mobile
phones It's designed to restrict roaming so you don't "accidentally"
roam onto another network, with perhaps higher charges. (No, the
Motorola test mode setup as used on the Micro-TacII doesn't work
on the DCS-1800 Motorola's)

Then you've got the problem that One2One only SUPPORT their phones,
and Orange only SUPPORT their phones. There's some quite clever
phone- specific stuff that can be done over the network.

Q) Can I plug my SIM card into any GSM family of phones
and use it?

A) Yes, if there's a roaming agreement to support it, and
the SIM is the same size, and it's not locked. Some handsets have
baby sized SIM cards which are little more than the chip, some
have the full credit-card sized cards. It's possible to just trim
the large ones to the smaller size if you swap phones. If you
have a smaller SIM card, it's possible to get a SIM carrier that
will allows you to put it into a full sized phone. Best talk to
your service provider before taking scissors to your SIM card.

Q) Why is digital coverage more patchy than analogue?

A) There is an essential difference between the old fashioned
analogue approach to radio transmissions (as used in the standard
Cellnet and Vodafone services) and digital services such as Orange
et al. This is why many users consider the basic Cellnet coverage
better than a digital service and why the Orange Engineers can
be so precise about coverage of the Orange service.

With an analogue system the signal deteriorates generally gradually.
It also gets worse as the distance from the transmitter increases.
However, even at the fringes of a coverage area the signal may
be intelligible even if very noisy, crackly, faint or whatever.
So a one blob signal on an analogue system may well be usable
for anyone willing to persevere.

With a digital system the signal is either O.K. in which case
you'll get broadly excellent signal or it isn't in which case
you'll get nothing. The signal strength is only important in as
far as it must be sufficient for the digital signals to be registered
at the cell serving the caller at any time. Because of this, combined
with the very high frequencies used by Orange, it is possible
to predict quite accurately where coverage will be good and where
it will be patchy or non existent. When you call Orange the customer
service staff can call up maps of the coverage areas of each cell
and overlay them on the screen to see whether you are in coverage
of a particular site.
CT2


The first standard for digital cordless phones, fine if you want
a nice cordless phone in your house/office, but they also have
the ability to log onto other base stations, if the bases are
set up accordingly. Range is up to around 300 metres from the
nearest base, expect 100 metre range. No hand-over between base
stations, unless the base stations themselves do some co-operation.

When using a "network" base rather than your own, you
may, or may not receive calls (This depends on the operator).
BiBop offers call reception for a small additional monthly fee,
but the network cannot locate the phone in a similar way to a
cellular network. You need to log onto a base, and stay there
if you expect to receive a call. If you wander onto another base,
you will need to re-register there. If the call is unsuccessful,
the call is routed onto voicemail.

CT2 has the ability to handover, to adjacent bases. However, since
the range is far less than most other mobile phone systems, unless
there are several bases per kilometre, and you know that fact,
don't expect to be able to walk very far and keep a call active.

However, in an office situation, CT2 is fairly ideal, you can
have a CT2 PBX, and all the office staff can have their own CT2
phone. Provided there are enough bases to cover the office space,
they can prove very useful, and certainly cheaper than issuing
all staff with cellular telephones.

There used several CT2 networks in the UK: Rabbit (which was the
biggest), Telepoint and so on. All of them have now closed down
due to the very few subscribers who ever used the service, but
the handsets, when used with a home base station, make excellent
cordless phones. None of the former UK CT2 public networks allowed
incoming calls, which kind of explains their lack of market.

From [e-mail]:


Yup, there were originally 3 mutually incompatible CT2 networks.

BT PhonePoint, Mercury CallPoint and Ferranti ZonePhone. The
lack

of an open standard was certainly one of the things that killed

all these off. The 4th network, Hutchinson Rabbit, only came

on the scene afterwards, once the CAI (Common Air Interface)
standard

had been defined.



From [e-mail]:


Further to you re Digital Phones, Telecom Australia is finishing
a disastrous trial of a CT2 compatible phone in Brisbane. The
phone was quite expensive and in the usual Telecom style if you
asked someone about having cell handoff when walking around
town, one day you would get yes and another day you would get
no.

I did manage to speak to an engineer at one time. I asked are
they CT2 compatible or not? He said yes, sort of. Apparently
there are about 40 channels or so (I can't recall the exact
number) and the Australian spectrum does not allow 100% mapping
of foreign CT2 phones. Only 50% common frequency. So he said,
even if you did register overseas, you would probably have
trouble getting a line.

Telecom Finland seem to have discontinued their Pointer CT2 system
due to lack of consumer interest (since GSM is hugely popular
and cheap there)

However, all this is not bad news. CT2 is still a very worthy
cordless telephone if you buy the base station as well. If you're
looking for a Cordless phone that has a decent range, doesn't
suffer from interference, is secure, and relatively cheap, then
try to track down a supplier of old Rabbit equipment.

Peter Parry wrote:


CT2 uses a base frequency of about 1GHz I think. It is effectively
secure, using digital speech encoding. Quality of reception and transmission
is good, if you can get the Motorola Silverlink handset even
better.

Although the Rabbit network was discontinued CT2 is very much
alive and well.

Any CT2 handset will work with a Rabbit base station once
registered (a simple procedure you do) so you will not be
investing in obsolete technology.

Why Hutchison never targeted the Rabbit at the cordless market
is a source of wonderment to many, the Rabbit as a business
competitor to mobile phones was a daft idea, as a business or
home cordless it is wonderful.

As a matter of interest Motorola amongst others are now heavily
promoting CT2 systems for business and industrial use (at a
price 3 times that of a Rabbit!!!)


DECT


DECT (Digital European Cordless Telecommunications) standard is
for cordless phones, and is intended to be a far more flexible
standard than the CT2 standard, in that it has more RF channels
(10 RF carriers x 12 duplex bearers per carrier = 120 duplex voice
channels). CT2 has 40 carriers x 1 duplex bearer per carrier =
40 voice channels. It also has a better multimedia performance
since 32kbit/s bearers can be concatenated.


PHS

Personal Handyphone, developed in Japan, some Hong Kong networks
showing an interest. Will start service in Japan Mid '95. Similar
service to CT2.


JDC

Japanese Digital Cellular, a digital protocol unique to Japan.
Known to operate in two different frequency bands, 800MHz and
1.5GHz. GSM will probably never be implemented in Japan. All the
service providers now use JDC.
EAVESDROPPING


Digital mobile phones are inherently difficult to eavesdrop, GSM
and PCN both feature multiple encryption systems, uncrackable
by anyone without GCHQ style equipment. PCN has the added bonus
that it's very difficult to come by scanners which cover the 1800MHz
bandwidth. GSM and PCN both change the encryption codes many times
a second, and frequency hop on a regular basis. Both standards
have the encryption level set by the network operator.
Data services on GSM / PCN.


Since GSM was designed to be "a mobile version of ISDN",
this was thought of from the start. However, the channels are
narrower than ISDN, rather than 64k they are 9600. The data cards generally
offer no data compression.

PCMCIA card plugs into bottom of phone. Nokia's price is about
500 pounds.

The data passes down a 'data' channel, which is not the same as
the signaling channel used by SMS. The signaling for modem setup
works the same way as an ISDN phone dialing into PSTN where there
is a modem at the boundary - the signaling for call setup tells
the network which parameters to use, and the network then tells
the modem. You don't need to know anything except how to talk
to your data adapter. Most of the data adapters on the market
emulate the AT command set and translate whatever is asked into
signalling.

Some networks  have direct links to Internet Service
Providers giving faster connection and protocol negotiation.

Some networks (Radiolinja) charge extra for data services, call
charges over and above their voice call rates, presumably to cover
the cost of providing a modem pool.

A Diagram and some Swedish text about data services is
available. DELAYS, round trip times and echos

Because of the nature of the voice compression on GSM derivative
networks, there is a delay of approx. 100ms. This is not normally
that noticeable if the network is designed to eliminate a lagged
sidetone. (Sidetone is the amount of feedback that a phone system
gives to the earpiece fed back from the microphone, so the speaker
doesn't think the line is dead).

I've noticed that it only affects people who talk loudly on the
phone, so loudly that their voice gets sounded in the earpiece
of the mobile phone, and also picked up by the microphone, thus
giving approx. 200ms round trip delay on the caller's own voice.

If your callers report these symptoms, the best thing to do is
to lower the earpiece volume on your handset such that you can
hear it, but the other person can't hear it fed back. Tricky if
you're outside in a noisy street.

For data applications, the lag is about as noticeable as a transatlantic
submarine cable call, it's noticeable, but should quite easily
be dealt with.


Other uses of a mobile phone


This one seems useful, if you're sat next to a perfectly functional
landline telephone that accepts a call via DTMF, and you don't
want to clock up your mobile phone bill (since they are normally
more expensive than a fixed line phone), with the Nokia
2100 series phones, you can use them as a handy tone dialer, so
if you have someone's phone number on your SIM, you can get the
Nokia to dial it using [Menu] [Green phone] buttons.


United States of America

Large amounts of this section thanks to [e-mail] (Bruce
McGuffin)

Cellular One, in New York are offering GSM roaming. If you have
an account with Cellular One, then you can take a GSM handset
overseas and use it there, with the billing all done to one account.
You can't use the GSM handset in the USA, you have to use a US
standard handset. I think that incoming calls will go to your
GSM handset if that's in a GSM service area.

PCS is a generic term used in the USA to mean Personal Communication
Systems. There are a number of standards in use.

The PCS frequency band is 1850 to 1990 MHz.

This includes three 30 MHz allocations (15 MHz in each direction),
three 10 MHz allocations, and 20 MHz for unlicensed use. The last
I heard (Radio Communications Report, June 29, 1994) the plan
is:

A: 1850-1865 MHz and 1930-1945 MHz
B: 1870-1885 MHz and 1950-1965 MHz
C: 1895-1910 MHz and 1975-1990 MHz
D: 1865-1870 MHz and 1945-1950 MHz
E: 1885-1890 MHz and 1965-1970 MHz
F: 1890-1895 MHz and 1970-1975 MHz
Unlicensed: 1910-1930 MHz.


PCS Standards are being set by the Joint Technical Committee (JTC)
of the ECSA (electronic communications ????? association?) which
represents operators, and the TIA (Telecommunications Industry
Association) which represents equipment manufacturers. There are
currently 7 competing proposals for PCS standards, several of
which I expect will be approved and compete in the market place,
just as the TDMA and CDMA standards are competing now at cellular
frequencies.

IS-95 is CDMA based. IS-54 is TDMA based, and is actually a dual
standard, sometimes called Digital AMPS.

IS-95 and IS-54 both apparently will fall back to AMPS analog
service if out of range of a digital transmitter. This means the
network providers can take much longer to upgrade to a fully digital
service, until people start complaining that they can't use all
the fancy facilities of their phone.

I don't know the details of all proposals, but here is a partial
list

CDMA by Qualcomm (IS-95 based)
Wideband CDMA by interdigital
TDMA (IS-54 based)
DCS-1900 (GSM based) network list



Known manufacturers and models of Digital Cellular Phones


AT&T
AT&T 3245. (GSM)


  mr1 (PCN). Receive SMS, flip design,
  Cell Broadcast. Designed for Orange Price about 150 pounds.
  m100 (PCN). Designed for One2One
  m300 (PCN). Designed for One2One. Receive SMS (though not on One2One)
  m301 (PCN). Designed for One2One. Receive SMS (though not on One2One)
  m400 (PCN). Designed for One2One, Flip design, "simplified
  menus"
  7200
(GSM). Receive SMS, flip design, Cell Broadcast(?).
  5200
(GSM). Receive SMS, flip design, Cell Broadcast. New version of
7200 Badged as Pioneer PCC-D700. Telecom 528 Bosh Cartel SL/SC
  8200
(GSM). Receive SMS, Cell Broadcast, Caller ID, Vibration alarm,
data/fax adapter available. Weight 149/179g
  Flare (GSM,PCN versions) Receive SMS, Cell Broadcast, Caller ID

nb. Motorola phones are often badged Storno, Bosch, Roadstar,
Mercury



GH197 (GSM).
GH198
(GSM).
GH337
(GSM) Receive SMS, Caller ID, Cell Broadcast (Very small).
PH337 (PCN) Receive SMS, Caller ID, Cell Broadcast (see GH337)

nb. Ericsson phones are often badged Ascom.

Mitel(Canada) CT2 systems


  Nokia 1011 (GSM). First GSM phone by Nokia. Send/Receive SMS.
8 hours standby on standard NiCd
  Nokia 2110
(GSM) Send(?)/Receive SMS.
  Nokia 2010 (GSM) No data/fax adapter. Latest model, old casing.
Cheap design Send/Receive SMS.
  Nokia 2120
(TDMA)Large screen, similar design to Nokia Orange, but works
dual standard (TDMA/AMPS) on American networks eg SBMS.
  Nokia 2191 (DCS 1900) Designed for the American Digital Cellular
System.
  Nokia Orange (PCN) also known
as
  Nokia 2140(PCN). Send/Receive SMS, Caller ID, nice big screen.
Designed for Orange. Price around 199 pounds.
nb. Nokia phones often badged Mobira, Technophone, Philips.


Northern Telecom
CT2 & CT2plus PBX systems
Orbitel

  Orbitel 901 (GSM) Transportable. Has a V.24 connector on the side.
  Orbitel 902 (GSM) Receive SMS, Caller ID, Cell Broadcast.
  Price about UKP 120


Panasonic

  EU2000 (GSM)


Phillips

  Fizz (GSM)
  DECT


Peacock Computer(Germany)

  CT2 systems


Siemens

  m200 (PCN). Designed for One2One. Baby size SIM
  S3 (GSM). SMS, Caller ID, Data/fax adapter available, large
  SIM Weight:278g





CM-D100 (GSM)
CM-D200
(GSM)




Companies involved


These companies are in some way involved, albeit indirectly,
with digital mobile phones. Cray Systems, the software
development and systems integration division of Cray plc, has
been selected by GSM Facilities Ltd (the legal entity formed by
the GSM-MoU Group) to develop and supply the GSM Phase 2 Mobile
Station Type Approval Test Equipment. Contact is Stuart Loynes.

Aspects Software Ltd
are a company with lots of specialist knowledge about SIMs, and
provide tools for service providers to deal with SIM problems.






Any updates to this document are welcome. Send updates to
[e-mail]

Credit goes to

[e-mail] (Serge Burzak)
[e-mail] (John Ray)
[e-mail] (Richard Cox)
[e-mail] (Bruce McGuffin)
[e-mail] (Ben Wright)
[e-mail] (Kevin Hopkins)
[e-mail] (John Phillips)
[e-mail] (Kevin Holley)
[e-mail] (Chris Hodgkins)
[e-mail] (Jan Joris Vereijken)
[e-mail] (Kimmo Ketolainen)
[e-mail] (Patrick Lidstone)
[e-mail] (John Leske)
[e-mail] (Masaaki Iwasa)
[e-mail] (Stuart Loynes)
[e-mail] (Iain Harrison)
[e-mail] (Fong Ken Ying)
[e-mail] (Szijarto Szabolcs)

for helping to update this document.





Simon Hewison <[e-mail]>