On Sun, Jan 30, 2011 at 11:20 AM, Bogdan Alecu <b.alecu(a)yahoo.com> wrote: If you send an SMS to the phone, the "typical scenario" would be: -Network pages the mobile, most likely with its TMSI (as stated before) -Mobile will send a RACH to request a dedicated channel -Network will assign the mobile to a dedicated channel (typically a SDCCH) -Network will perform contention resolution on the dedicated channel to ensure that it is the correct mobile (to cover the rare case where two mobiles RACH at the exact same time) -Network may or may not begin ciphering at this point -Network will deliver the SMS payload to the mobile through a series of messages on the dedicated channel -Mobile will ack each message, letting the network know that it has received what was sent -Network will release the dedicated channel, the mobile will go back to its idle mode (monitoring the paging channels etc), and the mobile will then have the SMS It is up to the network to decide what ID type it wants to use to page a mobile, and this is dependent on a number of factors. Almost always it uses the TMSI, sometimes IMSI, and _very_ rarely an IMEI. It is certainly possible that the network can also request identity info (IMSI, IMEI) from the mobile on the dedicated channel, as well as a whole host of other message requests while on the dedicated channel. So in short, unless you're lucky enough to have the network page you with your IMSI, it is unlikely you will see it. -- John Orlando CEO/System Architect Epiq Solutions www.epiq-solutions.com

Hi, On 30.01.2011 18:59, mad(a)auth.se wrote: "The reason why you see paging by IMSI in real-world GSM networks" http://laforge.gnumonks.org/weblog/2010/06/28/ Regards, Steve

On Sun, 30 Jan 2011 19:32:04 +0100, Steve Markgraf wrote: No, you were right about that, second part of my post was about imsis on air. I already had read Haralds post but I'm not fully convinced of all of his explainations. At least not on modern state-of-the-art core networks. Too less ram or volatile storage on restarting VLRs, is that really still an issue there? The third point, that expired tmsis on unreachable phones with a fallback on imsi paging as the main cause sounds much more convincing to me. But as David pointed out, 10-25% imsi paging is a lot, even about constant 2-5% as I observed are much for a location area or whole msc area. Did anyone do some research on that? Regards, Mad

I find that real-world networks page by IMSI 10%-25% of the time, depending on the operator and location. According to Harald's blog post on this topic, recently referenced on this list, he has made similar observations and offers some possibilities as to why. Also, as Steve Markgraf pointed out, GSM 04.08 9.1.22.3 explicitly disallows paging by IMEI. Networks are not supposed to do it and phones are not supposed to respond to it. It would be easy for someone to hack OpenBTS or OpenBSC to see how phones respond to this type of paging, but I have never seen it in a real network. I doubt seriously if any phone will respond, but I do wonder how many will crash their baseband stacks when presented with these messages. On Jan 30, 2011, at 9:34 AM, John Orlando wrote: David A. Burgess Kestrel Signal Processing, Inc.