-----Ursprüngliche Nachricht----- Von: Sylvain Munaut 246tnt@gmail.com

When the phone sees he's being paged, he will initiate the channel request procedure.

He sends a RACH at a given time fn with a random reference (8bits). And then he looks for assignement matching his RACH (i.e. the time fn and random reference are repeated back by the network in the assignment so that a phone knows the channel was for it).

Sylvain,

so it goes like this: ?

1. BSC starts paging MS by either TMSI/IMSI (Paging1: Normal paging chan any to imsi M(262073948077454))

2. MS sends channel request procedure to BSC over RACH (MS uses special(random) parameters inside this request) (is there a way to see the RACH-traffic in the "air" with regular tools?)

3. BSC sends Immediate Assignment message to MS and repeates the random parameters from request (GSM48 IMM ASS (ra=0x0f, chan_nr=0x49, ARFCN=667, TS=1, SS=1, TSC=5))

Greetings

Stefan