Skip to content

Signal analyzer GSM

voxo22 edited this page Oct 11, 2026 · 3 revisions

2G GSM (Global System for Mobile Communications) is a second-generation digital cellular communication standard developed to replace first-generation (1G) analogue mobile networks. It was introduced in the early 1990s and became one of the most widely adopted mobile communication standards worldwide. GSM enables mobile devices to communicate with cellular base stations to provide voice calls, text messaging (SMS), and basic data transmission. It introduced digital voice encoding, subscriber identity modules (SIM cards), and improved network security compared with analogue cellular systems.

Typical bandwidth of GSM downlink channel is 200 kHz.

GSM analyzer detects downlink GSM control channels and decodes public cell information from SCH/BCCH when possible.

Main acquisition fields

  • FCCH - Frequency Correction Channel. Used to find GSM carrier frequency and coarse timing.
  • SCH - Synchronization Channel. Carries BSIC and frame number.
  • BCCH - Broadcast Control Channel. Carries public system information.
  • CCCH - Common Control Channel. Carries common control and paging-related messages.
  • FIRE CRC - GSM block error-checking code used on control-channel messages.
  • RR - Radio Resource message type.
  • CFO - carrier frequency offset in Hz.
  • Burst level - received GSM burst level in dBFS.

Serving cell fields

  • ARFCN - Absolute Radio Frequency Channel Number.
  • Selected downlink - tuned downlink frequency.
  • PLMN - Public Land Mobile Network, shown as MCC-MNC.
  • MCC - Mobile Country Code.
  • MNC - Mobile Network Code.
  • LAC - Location Area Code.
  • Cell ID - cell identity broadcast by the serving cell.
  • BSIC - Base Station Identity Code.
  • NCC / BCC - Network Colour Code and Base-station Colour Code, the two parts of BSIC.
  • SI - System Information message. SI1, SI2, SI3, SI4, SI13 and related variants carry cell and neighbour information.
  • GPRS - packet data service advertised by SI13.
  • EDGE / EGPRS - enhanced packet data support.
  • RAC - Routing Area Code for packet services.
  • PBCCH - Packet Broadcast Control Channel.
  • Network Control Order - network-controlled cell reselection behaviour for packet mode.

Neighbour cells

The neighbour table lists ARFCNs advertised by decoded System Information messages. Downlink frequency is calculated from the ARFCN when it is known for the supported band.

Timeslot load

  • TS0 - usually BCCH / CCCH / system timeslot on a GSM broadcast carrier.
  • TS1-TS7 - additional timeslots on the tuned carrier.
  • Non-dummy - bursts classified as active traffic/control content.
  • Dummy - filler bursts.
  • Unknown - bursts not classified.
  • Observed occupancy - recent ratio of non-dummy bursts to known bursts.

Paging statistics

Paging observations are anonymous and session-only.

  • UE - local anonymous label assigned by the program for this session.
  • Identity type - temporary or permanent identity type detected in paging.
  • Home PLMN - decoded home MCC-MNC when available.
  • Relation - LOCAL, ROAMING or UNKNOWN compared to the serving PLMN.
  • Paging count - number of observed paging events for that anonymous UE.
  • First seen / Last seen - session timestamps.

Clone this wiki locally