-----Ursprüngliche Nachricht----- Von: Sylvain Munaut <246tnt@gmail.com>
When the phone sees he's being paged, he will initiate the channel request procedure.
He sends a RACH at a given time fn with a random reference (8bits). And then he looks for assignement matching his RACH (i.e. the time fn and random reference are repeated back by the network in the assignment so that a phone knows the channel was for it).
Sylvain, so it goes like this: ? 1. BSC starts paging MS by either TMSI/IMSI (Paging1: Normal paging chan any to imsi M(262073948077454)) 2. MS sends channel request procedure to BSC over RACH (MS uses special(random) parameters inside this request) (is there a way to see the RACH-traffic in the "air" with regular tools?) 3. BSC sends Immediate Assignment message to MS and repeates the random parameters from request (GSM48 IMM ASS (ra=0x0f, chan_nr=0x49, ARFCN=667, TS=1, SS=1, TSC=5)) Greetings Stefan