16-bit cellids with radio UMTS

[Gitschubser]

In the export file MLS-full-cell-export-2014-12-19T000000.csv exists 25165 false 16-bit cellids (<=65535) with radio UMTS.

I see

• 8768 cellids have less than two samples
• much cells are a duplicate from cells with radio gsm
• GSM-Cellids with UMTS-LAC
• MCC, MNC with LAC and cellid from another provider in the country
• the same cellid with different LAC but same update timestamp
• 16-bit cellid with radio UMTS and a value psc

[Gitschubser]

Rudloff/mls-cell-map#17

[E3V3A]

This is very interesting and important for us, in order to resolve detection item DB_id=1 in our detection list.

[SecUpwN]

@hannosch, you seem to be the rockstar of this repo, could you have a look at this, please? 🎸

[hannosch]

@SecUpwN this is on our todo list. I got @jaredkerim to look at all kinds of cell related tasks right now, so this one might be another good fit for him :)

[sshvetsov]

I have not seen this personally, but I've heard that some phones strip the RNC value (the 12 most significant bits in the 28 bit CID value) from the CID before they pass cell info to the OS. So perhaps it is possible to collect 16 bit CIDs from LTE (#415) and WCDMA networks. Could these samples be the case?

[hannosch]

I've looked at this again. From what I can tell there is nothing that forbids the RNC-Id from being 0. Which means the combined cell id for UMTS and LTE networks can indeed be 1 or any other number below 65536 as we only get an integer number here and don't see leading zeros. For example in TS 25.413 9.2.1.39 the RNC-Id is explicitly mentioned as being in the range of 0-4095 (ignoring the extended RNC).

Looking at our data, there are about 130k cell networks for each of WCMDA and LTE that have a cid < 65536. Comparing the WCMDA cells with equivalent GSM cells, about half of them exist as both WCMDA and GSM and they virtually all match up in terms of their lat/lon coordinates. For LTE the situation is different, and there are only about 5k cells which also appear in the GSM list.

Based on this I think there's something to do here, but it's not as simple as correcting the radio type of all WCMDA or LTE networks to be GSM if the cid is below 65536.

If we were to address this, we'd have to do some kind of matching of networks, and correct the incoming data based on whether or not we already have other networks with very similar overall ids. But it is than also unclear which one is the correct version, as each of the radio types could be correct, not just the one we saw first.

[kolesar-andras]

I have just posted at the linked issue (#415) that LTE cellid is valid from 256. Perhaps even from 0 but it's a good idea to filter bad records out where upper bits (LTE calls that eNB) are zero. Similar to RNC in WCDMA but starts at a different bit position: RNC stats at bit 16, eNB starts at bit 8.

If you declare an error limit at RNC>=1 in WCDMA and eNB >=1 in LTE then only cellids below 256 are suspicious in LTE.

[kolesar-andras]

Sorry, yesterday I have not recognized from title that this issue is about UMTS only, LTE was only mentioned later.

I have analyzed a lot of OpenCellID measurements (from myself and also others) and all RNC=0 seemed to be invalid. Either GSM or LTE (with eNB < 256) but not valid UMTS. Usually LAC helped to identify that record had mixed attributes of more cells from different RATs (radio access technologies). Such records were marginally few, probably captured RAT changes.