【精品】层三信令分析

1、第三层（layer3）信令第三层信令是看网络运行情况的信息层，从第三层可以看到网络的个利动作：如：呼叫 流程、拥塞、用户忙、位置更新等，系统信息总共冇8个类型，type 1-4只出现在待机状 态卜type58只出现在通话状态21、system information type 1 essa.ge detailsa msisystem information type 1time: 18:25:49.36latitude: n 2312.3120longitude: e 11 31 5.471 0speed : 0.000000frame number: 1 78304read from (ar

2、fcn): 86l2 pseudo length: 21cell channel descriptioncell allocationformat notation: bit map 0arfcn:1 9 28 58 74 86 95rach control parametersmax retransmissions: 1t x-integer: 1 2cell bar access: not barredcall reestablishmentre： not allowed emergency call (ec) allowed: all msnot barred class(es) (ac

3、c): 0 1 2 3 4 5 6 7 8911 12131415si 1 rest octets contains spare bitsmessage dump:00 56 55 06 1 9 00 00 00 00 4020 02 00 02 00 00 00 08 04 0000 25 00 00 2b小区广播信息，有该小区自身的频点，rach的一些参数设置，祥见上图。2、system information type2essage detailsms1system information type 2time: 14:08:32.60latitude: n 2312.3860longi

4、tude: e 11315.2610speed: 0.000000frame number: 1913987read from (arfcn): 79l2 pseudo length: 22neighbor cells descriptionba-ind: 1ext-ind: 0bcch allocationformat ncitation: bit map 0arfcn:248121471 84 86 90 92ncc permitted: 252 (allowed ncc=251)rach control parametersmax retransmissicm: 2t x-integer

5、: 12cell bar access: not barredcall reestablishment (re): not allowed emergency call (ec) allowed: all msnot barred class(es) (acc): 01 2 3 4 5 6 78911 12131415待机模式下小区的测虽频点，（同频段，移动网冇两个频段，gsm900和dcs1800）,在通话模式下有另外定义的测量频点，也就是说一个小区可以在待机吋做测量频点，而通话 时不做测量频点，允许小区重选而不允许切换，反之也可以只允许切换不允许小区重选也可 以，不过通常情况卜-待机和通话

6、时的测量频点是一致的。3、system information type2terlessage details回msiasystem information type 2tertime: 14:08:31.65latitude: n 2312.3860longitude: e 11315.2610speed: 0.000000frame number: 1913783read from (arfcn): 79再l2 pseudo length: 0neighbor cells description 2multiband reporting: 3ba-ind: 1bcch allocation

7、format notation: variable bit maparfcn:514 539 545 552 554 556si 2ler rest octets contains spare bits待机模式下小区的测虽频点，（异频段，移动网冇两个频段，gsm900和dcs1800）,4、system information type 3essage detailsms1system information type 3time: 14:08:31.89latitude: n 2312.3860longitude: e 11315.2610speed: 0.000000frame numbe

8、r: 1913834read from (arfcn): 79l2 pseudo length: 18cell identity: 33281 (8201 hex)location area identificationmobile country code (mcc): 460mobile nehwrk code (mnc): 00location area code (lac)； 9494 (2516 hex)control channel descriptionattach/detach allowed (att): yesbs-ag-blks-res: 1ccch-conf: 1 ba

9、sic physical channel not combined with sdcch'sbs-pa-mfrms: 5 multiframes periodt 3212 timeout value: 10cell options(bcch)power control indicator (pwrc): not setdtx indicator: ms shall use uplink discontinuous transmissionradio-link-timeout: 32cell selection parameterscell-reselect hysteresis: 8

10、db rxlevmstxfwrmaxcch: 5rxlev-access-min: 11rach control parametersmax retransmissions: 2t x-intege 匚 12cell bar access: not barredcall reestablishment (re): not allowedemergency call (ec) allowed: all msnot barred class(es) (acc): 0 1 2 3 4 5 6 78911 12131415si 3 rest octetscell reselect parameters

11、 in dication (pi): c2 parameters presentcell bar qualify (cbqj; 0if cell bar access = 0cell seleclion priority: normalstatus for cell reselection: normalelsecell selection priority: barredstatus for cell reselection: barredcell reselection offset: 0 dbtemporary offset: 0 dbpenalty time: 20 $power of

12、fset indication (poi): power offset parameter not presentearly sending: explicit# acceptedsystem information 2ter: available小区广播信息，可以看到att、t3212、acc、cro> crh以及accmin等，祥见上图5、system information type 4essage detailsms1system information type 4time: 14:08:31.18latitude: n 2312.3860longitude: e 11315.

13、2610speed: 0.000000frame number: 1913681read from (arfcn): 79l2 pseudo length: 16location area identificationmobile country code (mcc): 460mobile network code (mnc): 00location area code (uc): 9494 (2516 hex)cell selection parameterscell-re select hysteresis: 8 db rxlevmsjxfwr-max-cch: 5additional r

14、eselect param ind (acs)the si 4 rest octets, if present, shall be used to derive thevalue of pi and possibly c2 parameters and/or other parametershalf rate support (neci):new establishment causes are supported rxlev-access-min: 11rach control parametersmax retransmissions: 2t x-integer: 12cell bar a

15、ccess: not barredcall reestablishment (re): not allowedemergency call (ec) allowed: all msnot barred class(es) (acc): 01 2 3 4 5 6 78911 12131415channel descriptionchannel type: sdcch/8 + sacch/c8 or cbch (sdcch/8) subchannel number: 2timeslot number (tn): 2tvining sequence code (tsc): 4hopping chan

16、nel: single rf channel fb-no:bandoabsolute rf channel number (arfcn): 79si 4 rest octetscell reselect parameters indicationi): c2 parameters presenthcell bar qualify (cbq): 0if cell bar access = 0cell selection priority: normalstatus for cell reselection: normalelsecell selection priority: barredsta

17、tus for cell reselection: barredcell reselection offset: 0 dbtemporary offset: 0 dbpenalty time: 20 $power offset indication (poi): power offset parameter not present小区广播信息，在这里可以看到小区的crh、cro、accmin、maxret、cb、cbq、pt 等一些参数的设置值，祥见上图。6 system information type 5激活模式下服务小区测量频点，（同频段，移动网冇两个频段，gsm900和dcs1800）

18、 只有服务小区有做该小区的测量频点，才会测量到该小区的信号，否则在邻区列表屮不会看 到该小区，也不会切换。在我们平时路测当屮，经常遇到强信号不切换，如果做了测暈频点, 可以很明了地看到冇一个强的邻区信号，但是要是没冇做测量频点的话就比较隐性。7、system information type 5ter激活模式下服务小区的测量频点，（界频段，移动网有两个频段，gsm900和dcs1800）8、system information type 6essage detailsms1system information type 6time: 14:10:55.40latitude: n 2312.38

19、40longitude: e 11315.2620speed: 0.000000frame number: 1944908cell identity: 33281 (8201 hex)location area identificationmobile country code (mcc): 460mobile network code (mnc): 00location area code (lac)； 9494 (2516 hex)cell options(sacch)pover control indicator (fv/rc): not setdtx indicator:the ms

20、shall use uplink discontinuous smission on a tch-f the ms shall use uplink discontinuous transmission on tch-h radio-link-timeout- 32ncc permitted: 252 (allowed ncc=251)si 6 rest octets contaispare bits通话状态下面服务小区的一些信息，他跟typel冇点相彖，还可以看到ncc permitted;9、system information type 7暂时没有见过。10、system informa

21、tion type 8 暂吋没有见过。11、paging requst type 1圉 layer 3i匚回冈sourcedirec.messagei g 'msidownlinksystwm information type 4:msidownlinkpaging request type 2msidownlinksystwm information typg 3msidownlinkpaging request type 3msidownlinkpaging request type 1msidownlinkpaging request type 1msidownlinksynch

22、 channel information：m31downlinkpaging request type 2psidownlinksystem information type 3msidownlinkpaging request type 1vtlllcio一 p t- 1essageailsms1paging request type 2time: 14:08:23.24latitude: n 2312.3870longitude: e 11315.2610speed: 0.000000frame number* 1911961l2 pseudo length: 21page mode: n

23、ormal pagingchan riels needed for mobiles可以看到，在信令里血，paging的信令出现次数特别多，原因是网络对手机寻呼是对一 个位进区内进行寻呼的，只有当手机解开这条信息才会作出响应。12.synch channel informationessage detailsms1synch channel informationtime: 14:10:38.74latitude: n 2312.3840longitude: e 11315.2620speed: 0.000000frame number: 1941307read from (arfcn): 14

24、frame offset: 104644t $0 quarter bit offset: 8688old style decodingread from (arfcn): 14frame offset: 104644t $0 quarter bit offset: 8688bsic: 57t1:1542t2:7t3':3同步信息，在待机状态和通话状态都会出现，数字通信当小，同步是最基本也是最重要 的，跟邻区也需要同步。13、 其他：掉话：£ layer 3口回区source direcmsi msi msi msi msi msi msi msi msi msi msi ms

25、i msi msi msi msi msi msiuplinkdownlinkuplinkdownlinkuplinkdownlinkuplinkuplinkuplinkuplinkuplinkuplinkuplinkuplinkdownlinkuplinkuplinkmessagemeasurement report synch channel information measurement reportsynch channel information measurement reportsynch channel information measurementmeasurement me

26、asurement measurement measurement measurement measurement measurement synch channel information measurement report measurement reporreport report reportreport reportreport直接从邑话状态返回！ j待机状新report 正常的话有channel ifchease信令reportupli一mwdbutpitfstrr rep3dotwoxink downlinir downlink downlink downlink downli

27、nk downlinkl iti system system system system system c.x 壬nfwm informati on information informati on information informationw mb obsystem information typeype type type type type type43334位置更新rs layer 3口回冈sourcedi rec.message-msidownlinksyetqm information typw 2imsiuplinkchannel reques tmsidownlinkpag

28、ing request type 1msidownlinkpaging request type 1msidownlinkpaging request type 1msidownlinkpaging request type 1msidownlinkpaging request type 2msidownlinksystem information typ© 3msidownlinkimmedi atw assi grimentmsiuplinkluocan on up aai, 1 ng rle que s t1msiuplinkclassmark changemsidownlin

29、ksystem information type 5正常位msidownlinkauthentication requestmsiuplinkautheiit 1 catl oh. re sp ons emsidownlinkinformation type 51msiuplinkmeasurement reportmsidownlinklocation updaaccept 1msiuplinkmeasui'ement rep l丿1msidownlinkchannel releasemsidownlinksystem information type 4msidownlinksys

30、tem information type 3msidownlinksystem information type 2msidownlinksy£twm information type 3msidownlinksystem information tjqpe 4msidownlinksystem information type 1msidownlinkpaging request type 1il更新时的信令切换messagedownlink system inforrztion type 61ms1msiims1msimsimsi川sidownlink handover comm

31、and uplinkdownlinkuplinkdownlinkdownlinkdownlinkhandover accesshandover completejtysical information physical information system information typ.切换信令essage detailsms1handover commandtime: 13:22:54.64handover command里面: 小区的信息，有该小区£ 方式、跳频序列号以及其他到的信息是目标 有的频点.跳频 播信息（祥见右图）latitude: n 2312.1070l:llon

32、gitude: e 11321.8540speed: 18.571444frame number: 728649cell descriptionplmn colour code (ncc): 3bs colour code (bcc): 2bcch arfcn: 539channel descriptionchannel type: tch/f + acchstimeslot number (tn): 4t raining sequence code (tsc): 2hopping channel: rf hopping channelmobile allocation index offse

33、t (maio): 0hopping sequence number (hsn): 19handover referenee value: 97power level: 0synchronization indication (si): non-synchro门izedreport observed time differenee (rot): mobile time difference ie shall not be includecnormal cell indicalion (nci): out of range timing advance is ignoredfrequency l

34、ist after timeformat notation: variable bit maparfcn:526 531 539 546 559 576测量报告measurement resultsrxlev-fu ll-s e rvin g: 40 rxlev-sub-serving: 39 rxq u al-fu ll-s e r vin g: 1 rxqualsub-serving: 0 ba-used: 0 dtx: usedmeasurement results (meas-valid): valid number of neighboring cell measurements:

35、6 ncell rxlev-ncell1 632 633 594 435 426 39123456bsic-ncell504637325433message dump:服务小区信号质量bcch-freq-ncell1505 110003016个邻区信号质量sowrcft i direcmessagemsidownlink system informati on type sterms1msimsimsimsimsimsidownlink uplink downlink uplink downlink uplink downlinkreportcommandaccessinformati onc

36、ompleteinformati on ess&ce deta,ilmessage dump:faessae1面bcch-freq-ncell000000000000bsic-ncell000000000000msimeasurement reporttime: 13:22:55.57latitude: n 2312.1220 longitude: e 11321 8510 speed : 19.343111 frame number: 409086锁溜舉measurement resultsrxlev-fu ll-s e rvin g: 40rxlev-sub-serving: 39

37、rxq ual-fu ll-s e rvin g: 0rxq ual-s u b -s e rvin g: 3ba-used: 0dtx: not usedmeasurement results （meas-valid）: validnumber of neighboring cell measurements: information not available ncell rxlev-ncell1 002 003 004 005 006 00sour-cedirecmsidownlinkmsiuplinkmsidownlinkmsiupl i nkmsidownlinkmsidownlir

38、dkmsidownlinkmsiuplinkimsidownlirikss layer 3handover commandhandover accessphysi cal informati on handover completephysi cal informati on fhysi cal informati on system 工nformaiti on typesystern informati on type 6在这.里说说锁频和强制切换的原理，平时我们测试中经常会用到锁频和强制切换，这些操作是不需耍网络动作的，只是由手机来完成，而手机是怎样完成的呢？就是通过改变测量报告。当测试人

39、员点击锁频或者强制切换命令，手机会停止对英他频点的测量，只是上传测试人员锁定的频点的测量报告，其他频点不进行上传，如上图所示，所以网络会认为手机就 只收到该信号从而如果是服务小区就会锁频，如果是邻区网络就会进行切换。channel release信令里面的cause （事件号）对应的网络发生的事情，在这里我们可以看 到很多网络释放的原因，例如：我们平时测试时，在被叫手机没有人接听或者正在通话的情 况下，就会统计成-次连接失败，如果我们在报告里血仅仅用文字表达的话，说服力不强,但是要是在报告里而能说明cause是17、19的话就很容易说服別人，还有拥塞也町以在信 令里面看到cause是34,除次

40、以外还有很多cause,可以看下表：编巧原因13616171819212226272829unassiagned number （未分配的号码（空号）no route to destination（无至目的地的路由）channel unacceptable （不可接受的信道）normal clearing （ie常清除）user busy （用户忙）no user responding（无用户响应）user alerting,no answer（已有用户提醒,但无应答）call rcjcctcd（呼叫拒绝）number changed（兮码改变）non selected user cleari

41、ng（iff 除未选择的用户）destination out of order（终点故障）incomplete number（无效号码格式（不完全的号码）facility rcjcctcd（设施被拒绝）response to status enquiry（对状态询问的响应）normal,unspecified（正常,未规定）no circuit/channel available（无电路/信道可用）network out of order（网络故障）temporary failure（临时故障）switching equipment congestion（交换设备拥塞）access information discardcd（接入信息被丢弃）requested circuit/channcl not available（请求的电路/信道不可用）resources unavailable,unspecified（资源不可用,未规定）quality of service unavailable（服务质