#hack FAQ Home | Computers | Data Networks | Wireless Networks | Telephony | Mobile Telephony
Radio | Television | Resources | 2600 | Smart Cards and Magnetic Cards | Miscellaneous

Section E -- Mobile Telephony


E-01. How many types of mobile telephone systems are there?

The mainstream mobile telephone systems in the last twenty five years have been:

YearMobile Telephone System
1981Nordic Mobile Telephone (NMT)
1983American Mobile Phone System (AMPS)
1985Total Access Communication Systems (TACS)
1986Nordic Mobile Telephony (NMT)
1991American Digital Cellular (ADC)
1991Global System for Mobile Communication (GSM)
1992Digital Cellular System (DCS) 1800
1994Personal Digital Cellular (PDC)
1995Personal Communications Service (PCS) 1900 - Canada
1996Personal Communications Service (PCS) - USA

Mobile telephone systems are either analog or they are digital. In analog systems, voice messages are transmitted as sound waves. When you speak into an analog mobile telephone, your voice wave is linked to a radio wave and transmitted. In digital systems, voice messages are transmitted as a stream of zeroes and ones. When you speak into a digital mobile telephone, your voice wave is converted into a binary pattern before being transmitted.

Mobile telephone system all utilize some method to allow multiple users to share the system concurrently. The three methods for doing this are:

FDMFrequency Division Multiplexing
TDMATime Division Multiple Access
CDMACode Division Multiple Access

In a FDM system, the available frequency is divided into channels. Each conversation is given a channel. When the system runs out of channels in a given area, no more telephone calls can be connected. In this way, FDM operates much like the channel button on your television set. The AMPS and NAMPS systems utilize FDM.

In a TDMA system, your encoded voice is digitized and then placed on a radio-frequency (RF) channel with other calls. This is accomplished by allocating time slots to each call within the freuqncy. In the D-AMPS (Digital AMPS) system, each 30kHz carrier frequency is divided into three time slots. In the GSM and PCS systems, each 200kHz carrier is divided into eight time slots. The D-AMPS, D-AMPS 1900, GSM, PCS and iDEN systems all utilize TDMA.

In a CDMA system, your encoded voice is digitized and divided into packets. These packets are tagged with "codes." The packets then mix with all of the other packets of traffic in the local CDMA network as they are routed towards their destination. The receiving system only accepts the packets with the codes destined for it.

Analog systems are FDM. Digital systems can utilize either TDMA or CDMA.

FDM systems typically allow one call per 10Khz or 30Khz of spectrum. TDMA systems typically triple that capacity. In CDMA systems, all of the calls share the entire range of assigned bandwidth. In the U.S., PCS voice service is assigned 1.25Mhz of bandwidth.

Before there were cellular telephone systems, there was MTS (Mobile Telephone Service) and IMTS (Improved Mobile Telephone Service). These early systems have ceased operations.

The first cellular mobile system was AMPS (Advanced Mobile Phone Service). AMPS operates as an analog system using 30 kHz wide channels. AMPS was later enhanced to NAMPS (Narrowband Advanced Mobile Phone Service), a version of AMPS that uses 10 kHz channels and by doing so triples cellular capacity. AMPS, NAMPS, D-AMPS (IS-136) and CDMA (IS-95) are all licensed in the U.S. for operation between 824Mhz-849Mhz (Mobile to Base) and 869Mhz-894Mhz (Base to Mobile). AT&T Wireless operates a NAMPS and D-AMPS (TDMA) network in the United States.

GSM (Global System for Mobile communication) is a digital TDMA system that utilizes eight timeslots of 25khz each. GSM is popular in Europe and Asia. VoiceStream Wireless operates a GSM networks in the United States on the 1,900Mhz band. GSM networks in other countries operate at 900Mhz, 1,800Mhz, or 1,900Mhz.

For more information on GSM, visit A Brief Overview of GSM by John Scourias

PCS (Personal Communications Service) is a set of standards. Both TDMA and CDMA versions exist. PCS utilizes the 1,900Mhz band. Sprint PCS operates a PCS network in the United States.

For more information on PCS, visit Personal Communications Service (PCS) at the International Engineering Consortium.

iDEN (Integrated Dispatch Enhanced Network) was developed by Nextel and Motorola. iDEN is a TDMA trunked radio system which operated at 806-821Mhz and 851-866Mhz. Nextel operates an iDEN network in the United States.

Many other mobile telephone systems exist in the world, including NMT, TACS/ETACS, and JTACS. New systems are constantly in development.



E-02. What is a MTSO?

MTSO stands for Mobile Telephone Switching Office. The MTSO is the switching office that connects all of the individual cell towers to the Central Office (CO).

The MTSO is responsible for monitoring the relative signal strength of your cellular phone as reported by each of the cell towers, and switching your conversation to the cell tower which will give you the best possible reception.



E-03. What is a NAM?

NAM stands for Number Assignment Module. The NAM is the EPROM that holds information such as the MIN and SIDH. Cellular fraud is committed by modifying the information stored in this component.



E-04. What is an ESN?

ESN stands for Electronic Serial Number. The is the serial number of your cellular telephone which is transmitted to the cell site, and used in conjuction with the NAM to verify that you are a legitimate user on the system.



E-05. What is a MIN?

MIN stands for Mobile Identification Number. This is the phone number of the cellular telephone.



E-06. What is a SCM?

SCM stands for Station Class Mark. The SCM is a 4 bit number which holds three different pieces of information. Your cellular telephone transmits this information (and more) to the cell tower. Bit 1 of the SCM tells the cell tower whether your cellphone uses the older 666 channel cellular system, or the newer 832 channel cellular system. The expansion to 832 channels occured in 1988. Bit 2 tells the cellular system whether your cellular telephone is a mobile unit or a voice activated cellular telephone. Bit's 3 and 4 tell the cell tower what power your cellular telephone should be transmitting on.

Bit 1:
0 == 666 channels
1 == 832 channels

Bit 2:
0 == Mobile cellular telephone
1 == Voice activated cellular telephone

Bit 3/4:
00 == 3.0 watts (Mobiles)
01 == 1.2 watts (Transportables)
10 == .06 watts (Portables)
11 == Reserved for future use


E-07. What is a SIDH?

SIDH stands for System Identification for Home System. The SIDH in your cellular telephone tells the cellular system what system your cellular service originates from. This is used in roaming (making cellular calls when in an area not served by your cellular provider).

Every geographical region has two SIDH codes, one for the wireline carrier and one for the nonwireline carrier. These are the two companies that are legally allowed to provide cellular telephone service in that region. The wireline carrier is usually your local telephone company, while the nonwireline carrier will be another company. The SIDH for the wireline carrier is always an even number, while the SIDH for the nonwireline carrier is always an odd number. The wireline carrier is also known as the Side-B carrier and the non-wireline carrier is also known as the Side-A carrier.

SIDH is often abbreviated to SID.



E-08. What are the forward/reverse channels?

Forward channels are the frequencies the cell towers use to talk to your cellular telephone. Reverse channels are the frequencies your cellular telephone uses to talk to the cell towers.

The forward channel is 45 mhz above the reverse channel. For example, if the reverse channel is at 824 mhz, the forward channel would be at 869 mhz.




#hack FAQ Home | Computers | Data Networks | Wireless Networks | Telephony | Mobile Telephony
Radio | Television | Resources | 2600 | Smart Cards and Magnetic Cards | Miscellaneous