Cell Phone Network Analysis With the Nexus 5

The Nexus 5 may have been discontinued by Google but the phone still packs a powerful punch for those interested in analyzing the cell network they are connected to.  This blog post is the first in a series of posts explaining how to better understand the cellular network.

Screenshot_2015-04-30-13-31-46To properly review the network information, you will need to purchase the app Signal Check Pro.  The pro version contains many logging features, which will make exploring the network much easier.

Signal Check Pro, when launched, will display information such as what is displayed on the left.  Depending on the network you are connected to, you may see various different pieces of data.  In this example, I am connected to the Sprint LTE network, running on Band 25 (1900MHz)

The signal strength bar graph at the top is self explanatory, and the RSRP and RSRQ are signal strength indicators.  Each panel (or directional antenna) will have a unique GCI to identify the panel, however Sprint conventionally assigns all panels on a specific tower the same first 6 hexadecimal numbers.  For instance, in the example to the left, the Coralville water tower, all the panels will share the same beginning GCI of 08A067xx.  Each panel will have a PCI ID as well, but these may not be unique with some PCIs being repeated.  The TAC represents a regional code shared among all sites within a geographic area.

Screenshot_2015-02-28-10-54-02When in LTE mode, Signal Check Pro will also display nearby site information, under the neighbor cells.   In the example above, you can see that my phone saw 3 unique panels at the Coralville water tower — the one it is connected to, and the two neighbor cells.  As for the information displayed about the neighbor cells — the first number is the PCI of the panel, and the second set of numbers are the RSRP signal strength.

Sprint actually runs many different networks that your phone may use.  In addition to running a LTE network on Band 25 (1900MHz) they also run a LTE network on Band 26 (800MHz) and a wideband LTE network Band 41 (2500 MHz).  Sprint has programmed the phone to connect to the LTE network on Band 41 when in a dense metropolitan area when within a few thousand feet of a cell site.  2500 MHz does not travel as far as other frequencies, so the phone will select 1900MHz when further away from a site, or when several floors or walls separate your phone from the tower.  The phone will then select band 26 (800 MHz) when even further away from the cell site.  In this screenshot, we see an example of a connection to the wideband LTE network in the Minneapolis area.

Something most people don’t realize is that for most cell networks, the LTE network is for data only, and phone calls are still routed through the traditional “CDMA” network.  The Nexus 5 will connect to the CDMA network when a phone call is in progress, or when the phone leaves the LTE coverage area.

Screenshot_2015-05-10-14-12-23Sprint’s CDMA network is actually two separate technologies; these are known as 1xRTT (used for voice, text messaging, and 2G data) which is broadcast on 800MHz and 1900MHz, EVDO (used for 3G data, also known as eHRPD) which is broadcast on 1900MHz only.  The phone is programmed to use 1900MHz in population dense metro areas, and to use 800MHz due to it’s improved propagation when further away from a cell tower, or while inside a building.  You can tell if your phone is using 1xRTT on 800MHz, because it will be displayed as 1×800 instead of 1xRTT.

The phone will always connect to both the 1xRTT network and the EVDO network at the same time, assuming both are available.  In this example you can see what Signal Check Pro displays when connected to the Sprint CDMA network.  RSSI and Ec/lo define the current signal and error rate of the signal being detected by the phone.  SID is the network identification for Sprint, 4124 for 1900MHz and 22409 for 800MHz.  BID is a base station identification number and is unique for each panel on a cell site.

Over time, when using Signal Check Pro you can begin to get a better understanding of the  network around you.  You can learn which towers provide which services, and which areas may have a deficiency in a particular type of signal in an area.  In a future post, I will help identify some of the cites around Eastern Iowa, in the database I have built up.

Screenshot_2015-05-10-14-28-19 Screenshot_2015-05-05-15-57-49