13 Jan
2012
13 Jan
'12
12:10 a.m.
-----Ursprüngliche Nachricht-----
Von: Sylvain Munaut <246tnt(a)gmail.com>
When the phone sees he's being paged, he will
initiate the channel
request procedure.
He sends a RACH at a given time fn with a random reference (8bits).
And then he looks for assignement matching his RACH (i.e. the time fn
and random reference are repeated back by the network in the
assignment so that a phone knows the channel was for it).
Sylvain,
so it goes like this: ?
1. BSC starts paging MS by either TMSI/IMSI
(Paging1: Normal paging chan any to imsi M(262073948077454))
2. MS sends channel request procedure to BSC over RACH
(MS uses special(random) parameters inside this request)
(is there a way to see the RACH-traffic in the "air" with regular tools?)
3. BSC sends Immediate Assignment message to MS and repeates the random
parameters from request
(GSM48 IMM ASS (ra=0x0f, chan_nr=0x49, ARFCN=667, TS=1, SS=1, TSC=5))
Greetings
Stefan