Which cell tower am I connected to

Erholt Rhein

unread,

Sep 29, 2022, 10:11:06 PM9/29/22

to

There are apps which report the exact cell tower that you're connected to
at any given moment but which of the identifiers that these apps provide
tells me the exact cell tower and sector antenna unique identifier?

The stress of this question is on the word "unique" since just knowing the
cell tower location in an Internet lookup database is not as useful as
knowing the exact identifier for the exact sector antenna connection.

This is an example of the sets of numbers which these apps report.
https://mobiletechtalk.co.uk/wp-content/uploads/2019/11/2019-11-01-12.42.46.jpg

There is a mobile tower TAC, PCI, ECI & EARFCN reported by these apps.

What is the minimum combination of those identifiers that is exactly the
unique sector antenna the phone is currently connected to?

Scott

unread,

Sep 30, 2022, 4:56:13 AM9/30/22

to

I wonder if this is the kind of information the networks would prefer
to remain confidential?

MB

unread,

Sep 30, 2022, 5:30:34 AM9/30/22

to

On 30/09/2022 09:56, Scott wrote:
> I wonder if this is the kind of information the networks would prefer
> to remain confidential?

Years ago at work I tried to get a copy of UHF channel numbers for all
sites with the offset and was told that it was "commercially
confidential"!

MB

unread,

Sep 30, 2022, 5:31:33 AM9/30/22

to

On 30/09/2022 10:30, MB wrote:
> Years ago at work I tried to get a copy of UHF channel numbers for all
> sites with the offset and was told that it was "commercially
> confidential"!

TV channels obviously.

Erholt Rhein

unread,

Sep 30, 2022, 8:24:34 PM9/30/22

to

It can't be confidential since every phone reports the exact antenna
connection at all times.

In the example given, this is the unique sector antenna connection.
https://mobiletechtalk.co.uk/wp-content/uploads/2019/11/2019-11-01-12.42.46.jpg

Every phone knows this information and can report it at any time.
TAC = 35088
PCI = 349
ECI = 129457524(505693-116)
EARFCN = 39250

But what do those mean in terms of the cell tower unique identifier?
Specifically, what's the minimum set needed to uniquely identify a sector?

newman

unread,

Oct 1, 2022, 7:09:48 AM10/1/22

to

https://www.google.com/maps/@55.9776162,-3.2479836,3a,75y,167.55h,102.79t/data=!3m7!1e1!3m5!1sPYD9cbweGg-HuUJhckjc-g!2e0!6shttps:%2F%2Fstreetviewpixels-pa.googleapis.com%2Fv1%2Fthumbnail%3Fpanoid%3DPYD9cbweGg-HuUJhckjc-g%26cb_client%3Dmaps_sv.tactile.gps%26w%3D203%26h%3D100%26yaw%3D301.41568%26pitch%3D0%26thumbfov%3D100!7i13312!8i6656

Erholt Rhein

unread,

Oct 1, 2022, 10:47:58 AM10/1/22

to

On Sat, 1 Oct 2022 12:09:44 +0100, newman wrote:

>> Every phone knows this information and can report it at any time.
>> TAC = 35088
>> PCI = 349
>> ECI = 129457524(505693-116)
>> EARFCN = 39250
>>
>> But what do those mean in terms of the cell tower unique identifier?
>> Specifically, what's the minimum set needed to uniquely identify a sector?
> https://www.google.com/maps/@55.9776162,-3.2479836,3a,75y,167.55h,102.79t/data=!3m7!1e1!3m5!1sPYD9cbweGg-HuUJhckjc-g!2e0!6shttps:%2F%2Fstreetviewpixels-pa.googleapis.com%2Fv1%2Fthumbnail%3Fpanoid%3DPYD9cbweGg-HuUJhckjc-g%26cb_client%3Dmaps_sv.tactile.gps%26w%3D203%26h%3D100%26yaw%3D301.41568%26pitch%3D0%26thumbfov%3D100!7i13312!8i6656

Hmm. Is that a specific sector antenna on a specific tower or the location
of the phone itself (it's close but not exactly what the phone reported).

As shown in this example, every phone can report where it is and exactly
what sector antenna on what tower by what carrier it is connected to.
https://i.ibb.co/kHMpDBn/Screenshot-2021-05-16-14-38-14-934-make-more-r2d2-cellular-z.jpg

MY LOC = 60.384528/56.850208
Serving Cell TAC = 26566
Serving Cell PCI = 31
Serving Cell ECI = 170572549(666299-5)
Serving Cell EARFCN = 3300/21300
Serving Cell FREQ = 2675/2555
Serving Cell BAND = 7(FDD)
My current RSRP = -99 dBm

As compared to this phone which also knows all that same identifying data.
https://mobiletechtalk.co.uk/wp-content/uploads/2019/11/2019-11-01-12.42.46.jpg

MY LOC = -3.247542/55.976644
Serving Cell TAC = 35088
Serving Cell PCI = 349
Serving Cell ECI = 129457524(505693-116)
Serving Cell BANDWIDTH = 5 MHz
Serving Cell EARFCN = 39250
Serving Cell FREQ = 2360 MHz
Serving Cell BAND = 40(TDD)
My current RSRP = -93 dBm

I was hoping others would know this already so looking each of those
indicators up to better understand which are the minimum unique set.
https://www.hawkanalytics.com/a-simple-guide-to-understanding-cell-site-terminology-when-mapping-cellular-call-detail-records/

The TAC is the Type Allocation Code.
Used to create the first 8 digits of the International Mobile Equipment
Identity (IMEI), the number that identifies each unique mobile device on
all gsm networks.

The PCI is the Physical Cell Id.
This is the identifier of a network cell in the physical layer. This
property is limited to 504 values, and therefore needs to be reused in the
network. If the PCI assignment is poorly planned, the risk for network
conflicts is high.

The ECI is the Extended Cell identification or ECGI (Global).
This number consists of the MCC, MNC, eNodeB and Cell ID.

The CGI is the Cell Global Identification for a Base Transceiver Station in
mobile phone networks. This number is used in the GSM and UMTS networks and
is a combination of the MCC, MNC, LAC and the CI.

The MCC is the Mobile Country Code.
The mobile country code consists of three decimal digits and the mobile
network code consists of two or three decimal digits (for example: MNC of
001 is not the same as MNC of 01). The first digit of the mobile country
code identifies the geographic region as follows (the digits 1 and 8 are
not used):

0: Test networks
2: Europe
3: North America and the Caribbean
4: Asia and the Middle East
5: Australia and Oceania
6: Africa
7: South and Central America
9: Worldwide (Satellite, Air?aboard aircraft, Maritime?aboard ships,
Antarctica)

The MCC is used in combination with an MNC (a combination known as an
"MCC/MNC tuple") to uniquely identify a mobile network operator (carrier)
using the GSM (including GSM-R), UMTS, LTE, and 5G public land mobile
networks. Some but not all CDMA, iDEN, and satellite mobile networks are
identified with an MCC/MNC tuple as well.

The MNC is the Mobile Network Code.
The Mobile Network Code is a unique two- or three-digit number used to
identify a home Public Land Mobile Network (PLMN). MNC is allocated by the
national regulator. A MNC is used in combination with the Mobile country
code to derive the Home Network Identity (HNI).

The LAC is the Location Area Code.
The LAC is the unique number given to each location area within the
network. The served area of a cellular radio access network is usually
divided into location areas, consisting of one or several radio cells.

The eNodeB is the Enhanced NodeB which references a group of antennas on a
cell tower. The eNodeB alone does not identify the sector. To identify the
sector or direction the specific antenna faced, you'll need to refer to the
Cell ID.

The GSM Cell ID is the Cell Identity.
It is a generally unique number used to identify each base transceiver
station (BTS) or sector of a BTS within a location area code (LAC) if not
within a GSM network.

The EARFCN is the E-UTRA Absolute Radio Frequency Channel Number.
In LTE, the carrier frequency in the uplink and downlink is designated by
EARFCN, which ranges between 0-65535. EARFCN uniquely identify the LTE band
and carrier frequency.

From that information which every phone easily reports, I should be able to
deduce the exact sector antenna used by any one connection at any given
time.

Specifically, if I have multiple people at the same place, each of us
should be able to instantly determine which unique sector antenna each of
us is connected to.

Pamela

unread,

Oct 9, 2022, 5:41:06 PM10/9/22

to

See "App to show connected cell tower", 19 Nov 2021.

http://al.howardknight.net/?ID=164179249600

news://XnsADE721E...@144.76.35.252

David Woolley

unread,

Oct 10, 2022, 7:22:10 AM10/10/22

to

On 09/10/2022 22:35, Pamela wrote:

> news://XnsADE721E...@144.76.35.252

I think this was meant to be:

<news:XnsADE721E...@144.76.35.252>

As given it isn't valid, although Thunderbird seems to infer a trailing
/ and treat it as everything on the server 144.76.35.252, accessed as
user XnsADE721E6729537B93. I didn't actually see if it would actually
do that, but it displayed it, on the bottom line, as though it would.

Andy Burns

unread,

Oct 10, 2022, 8:18:40 AM10/10/22

to

thunderbird without an add-on, is pretty crap at handling news:// URLs and
accessing articles by ID

The "mnenhy" add-on used to improve it, but it's not compatible with recent
versions of TB.

Pete Forman

unread,

Oct 10, 2022, 6:00:22 PM10/10/22

to

A news URL has two standard forms (see RFC 5538 and 1738).

news:newsgroup-name
news:message-id

There is also a common extension supported by many browsers.

news://server/newsgroup-name
news://server/article-number

In addition there are standard nntp URLs.

nntp://server/newsgroup-name
nntp://server/newsgroup-name/article-number

In the above "server" should actually be "authority". The server name
may optionally be preceded by userinfo@ and followed by :port.

So TB is correct to treat news://XnsADE721E...@144.76.35.252 as
user XnsADE721E6729537B93 on server 144.76.35.252 following common
browser extended behaviour.

--
Pete Forman
https://payg.pythonanywhere.com/