“Local Breakout” in GPRS
This article describes the “local breakout” function in YateBTS/OpenBTS GPRS cells, where user IP traffic originates directly from the cell site instead of from a centralized GGSN in the core network.
Hardware Diagnostics in Your Cellular Network
The purpose of this article is to provide some background for network managers about the kinds of hardware diagnostics that are available from typical radio basestations (GSM BTS, UMTS NodeB, LTE eNodeB, 5G-NR gNodeB, etc.).
The MPDCCH in LTE-M
This article describes the operation of the MTC Physical Downlink Control Channel (MPDCCH) for sending downlink assignments and uplink grants to the client device.
Sorting Out New-Generation RAN Terminology
A race to standardize the RAN architecture has left us with a confusing collection of terminology. We will try to put some order to it.
Ad Hoc Private Networks in GSM
Unlike later technologies, GSM can provide full service to device without full authentication. This can be useful in some private networks, allowing a device to bring its own SIM without needing a roaming agreement.
Public Warning Systems in Mobile Networks
Cell broadcast (CB) is a way to deliver a text message to large numbers of handsets over the cellular network. Its main use today is the delivery of Public Warning System (PWS) messages, also called CMAS, ETWS, or other names in different parts of the world. The Legba Lab Kit is an easy and inexpensive way to generate PWS test messages on your bench.
CSFB with the Legba Lab Kit
Many 4G networks cannot carry plain old telephone calls, so many mobile operators support voice calls by transferring the handset to a 2G or 3G network for the duration of the call. The procedure for doing this is called “Circuit-Switched Fallback”, or CSFB. CSFB is an interesting procedure from a network operation perspective and from a security perspective. With a pair of Legba Lab Kits, one in 2G mode and one in 4G mode, you can reproduce and modify the CSFB procedure on a test bench.