This article describes the “local breakout” function in YateBTS/OpenBTS GPRS cells, where user IP traffic originates directly from the cell site instead of from a centralized GGSN in the core network.
The purpose of this article is to provide some background for network managers about the kinds of hardware diagnostics that are available from typical radio basestations (GSM BTS, UMTS NodeB, LTE eNodeB, 5G-NR gNodeB, etc.).
This article describes the operation of the MTC Physical Downlink Control Channel (MPDCCH) for sending downlink assignments and uplink grants to the client device.
A race to standardize the RAN architecture has left us with a confusing collection of terminology. We will try to put some order to it.
Unlike later technologies, GSM can provide full service to device without full authentication. This can be useful in some private networks, allowing a device to bring its own SIM without needing a roaming agreement.
Cell broadcast (CB) is a way to deliver a text message to large numbers of handsets over the cellular network. Its main use today is the delivery of Public Warning System (PWS) messages, also called CMAS, ETWS, or other names in different parts of the world. The Legba Lab Kit is an easy and inexpensive way to generate PWS test messages on your bench.
Many 4G networks cannot carry plain old telephone calls, so many mobile operators support voice calls by transferring the handset to a 2G or 3G network for the duration of the call. The procedure for doing this is called “Circuit-Switched Fallback”, or CSFB. CSFB is an interesting procedure from a network operation perspective and from a security perspective. With a pair of Legba Lab Kits, one in 2G mode and one in 4G mode, you can reproduce and modify the CSFB procedure on a test bench.