GSM Mobile Network Intro - Nokia Network Monitor

[@daniyar3264]

Hello. I'm working in mobile operator. My speciality is radio network planning and optimization of 2G RAN. I'd like to say that everything you described is absolutelly correct and well simplifided to understand for beginners. So keep doing such a great stuff! If you have any questions related to GSM - feel free to ask. I would help how i can

[@nahrafe]

Maybe me. So its like this: How can SS7 works on GSM? And even can used to intercept SMS Massages? Thanks in advance

[@geekyrajnish]

I want to work on private gsm network at home please guide me

[@semplar2007]

@@geekyrajnish I think for private gsm network, you're going to need lots of expensive equipment, and to have a licence to use certain frequency bands.

[@geekyrajnish]

@@semplar2007 i need full guide please i will do everything for it

[@semplar2007]

@@geekyrajnish I'm not a mobile network specialist, but googling gave me this document (2nd result): www.gsma.com/spectrum/wp-content/uploads/2016/11/spec_best_practice_ENG.pdf In there on page#33 you can see prices for reserving frequency bands in African countries (for example): from $16 to $67 MILLIONS of dollars per 10Mhz band. Idk what time ranges. In my country (Ukraine) auction prices are similar, $15 millions per 10Mhz band.

[@Hereson]

The best teacher one can ask for. This was very interesting! Thank you for your thorough explanations! :)

[@Vidsandso]

I discovered the fun of this back in the days when i got a cable of ebay so i could upload ringtones and images to the phone. The network monitor could also be used to lock in on a certain tower or cell. I remember I used to lock on strong cells close to school and then see how long i could keep a connection on it on the bus ride home... Good days!

[@MeriaDuck]

That the handover of gsm is so reliable never ceases to amaze me, and I know of it since the nineties. It even works in high speed trains and aeroplanes if you're lucky

[@agma]

The traffic light TDMA illustation is hilarious and delivers the message (pun not intented but welcome) beautifully! Thanks for your work!

[@localadm]

Very cool, brings back memories from 1999, when I had a nokia 5110 with network monitor and a 100+ pages manual for it. Back in the day, I almost knew it by heart. Cheers for the video!

[@jugg1049]

Lukasz Racinowski context details?

[@4.0.4]

Hey, this is super cool stuff, even if just GSM. It's like a whole "internet of things" that nobody stops to think about.

[@dinost9057]

Svijet treba vise ljudi kao sto si ti .

[@peelypeel]

THANK YOU. You finally answer how mobile phone networks work! I wanted to know forever

[@liteoner]

This is so cool. It confirmed my suspicion that the design of mobile phone networks is even more outdated than that of the internet. The problem with both is that so many legacy devices use them that it's basically impossible to overhaul without major disruption.

[@Hauketal]

Some countries already started to phase out either G2 or G3, but not both, yet.

[@liteoner]

@@Hauketal any network whose communication depends on a centralised server is outdated in my opinion. So, moving from 2G to 4G is hardly an upgrade (if we ignore the speed benefits of the latter).

[@frankschneider6156]

TCP/IP was designed at the begin of the 80s, SS7 (which is still the basis of carrier communication and horribly vulnerable) was designed in the midst of the 70s. GSM for carrier - end point communication was designed in the midst of the 80s so slightly later than "classical" TCP/IP and it is (partly because of that) also more secure, at least they introduced some encryption like (the intentionally weakened) A5/1 and the even worse A5/2.

[@liteoner]

@@frankschneider6156 for sure, in the sense 2G is actually more advanced than 4G

[@王磊-p3q]

I'm working with mobile cellphone infrastructureand must say, these video series came in good time! Thx

[@jammijavid9316]

Really appreciate! Long live opensource

[@DEMENTO01]

WOW, how interesting, I didnt know how crazy is all tis stuff, i mean, like you said, if you are walking and in a call the phone is continualy changing basestations all the time, and you don't even notice it, is like... WOW, bc works sooo well, and this is on GSM, i mean, from 20+ years ago, I can't believe it. Keep the good work, I love your videos, everything is so well explained.

[@luqmaanalbahassan5763]

Great content, i loved each second of it, i mean you usually don't see such type of contents it's so unique. Few months back i was asking myself on how does a sim card connect to a nearby base station.

[@maxthewincat]

Thank you for explaining how does mobile network work

[@faultyfailure9147]

Thank you for helping everyone to understand the world better... In fact, just in this small piece of new information, wow, it opens many doors to ponder to and think of. It is really amazing and marvelous how everything works out in such an almost perfect and complex way... Things that we didn't even care about and we use every day. Man, it is amazing. Thanks!

[@gromanfreedan]

BTW about basestations. That's the one of the earliest reasons to turn off your phones while on plane. Imagine hundred of phones on plane constantly changing basestations at the speed higher than 300 kmh. At that time it was creating a huge load on basestations from time to time. Now load is dispersed thanks to different generations and improved capacity of basestations. Correct me if I'm wrong.

[@haukauntrie]

2:35 Wait, that means that when I purchase by card on a POS terminal, there are actually 3 Tiny Computers in this device? That info from the first video still blows my mind.

[@FredrikHistherRasch]

Up here in Norway, VoLTE is deployed and available wherever we have LTE. And we have LTE in all Norwegian cities (i.e. more than ~10,000 inhabitants)

[@CubbyTech]

TDMA was replaced by CDMA some time ago! GSM and CDMA are being phased out and being replaced by LTE. In the US, a few years ago - AT&T and T-Mobile were the original GSM carriers, where Verizon and Sprint were CDMA only and did not use SIM cards (giving users less choice, flexibility). Now that everyone is using LTE, every phone uses a SIM card to access the network, as well as the phone's radio needs to use that carrier's band(s).

[@unlimitedcoder2189]

Love the videos keep up the good work!

[@johannes-vollmer]

I like that you drew ASCII emoticons, which exist solely because one was not able to draw anything :D also, typing the ASCII emoticon would have been too easy anyways

[@chris_sndw]

I still have one of these phones and the cable they sold back then (bought directly from harald welke). Back then I compiled the osmocom software and was looking at the phone screen. Felt like I was doing some important hacking but had no idea what it all meant. Thanks for the video.

[@kimbol496]

Great vid once again, please do more software defined radio based videos and possibly touching on the ss7 exploit.

[@NullaNulla]

They use basic radio trunking alike used by emergency services. Catch here though you didn't note is usually base stations have more than 1 frequency pair obviously the more pairs the more time slots and thus capacity available. Also here in Australia 2G is finished, gone, ripped up and binned with all eftpos etc sent to 3G and 4G for the newer ones. I have to admit that the cell/tower/base handover is bloody magic for the phone network. A 2way radio is a lot easier you just force the change between a and b talking (silent time) to do the change but a phone requires seamless changeover and does so without most noticing (a little klunky at times out here in the country with larger gaps bbetween towers and thus different lag times).

[@RafaelAcurcio]

Incredible content!! Super interesting and also very relevant. Can't wait for the next episode.

[@nexisle7508]

Bro, you have one of a kind videos on youtube. Deeply appreciate your hard work man and my good wishes to you :)

[@nikidino8]

it was still private when I clicked it, I am clearly too early!

[@nicoper]

Same thing happened to me, lol.

[@RegressStage]

nikidino8 same

[@unlimitedcoder2189]

Same here

[@TheWoosh]

nikidino8 same

[@liteoner]

You mean unlisted

[@mohamedazoukni8370]

Thank you guys. I'm so excited for the next video .Keep Up the good work :)

[@Ghozer]

I remember YEARS ago, adding a Vibrate motor to my 3210, and enabling the 'hidden' menu's, The network monitor was fun to watch, but never knew what they all meant, until now xD I still have that 3210 - might hook it up and see what happens ;)

[@JohnnyWanX]

I clicked like before I watched it, nice work!

[@Junior83ist]

Great content! I hope you'll keep it up! All the best, man!

[@bhageerathamusic6405]

Very useful information. Thanks a lot for making this attempt. For letting us to know all these uncommon matters.😊👍

[@chancegg00]

Please keep these videos comming!!!! I love them!!!!

[@harshthakur7215]

Hey Liveoverflow , it would be really helpful if you shared the sample files(.cfile) of the network capture with us. Loving the series btw ! Keep it coming

[@dummypg6129]

Ohh, that was the network monitor means, i had a 3315 phone that was reprogrammed its firmware with a custom one. I always enabled it to show more geeky on my phone. Uhh nostalgia... Those days..

[@quarkonia]

Hi, Great video but I would like to add that the MSC keeps track of the VLR and it's that which is updated with the Location Update contain the Location Area Codewhich is a group of BTS cells on one or a few BSCs. The VLR may be located logically within the MSC but it does not have to be. This is because some vendors had limitations on how many IMSIs could fit within each VLR database that normaly covered a geographical area.

[@MaghrebProductions]

Thank you LiveOverflow for keeping promises!

[@First_Principals]

Great video. You should write an ebook for complete beginners and update it as more information becomes available. If you start a crowd funding campaign you could give the donators free editions of the ebook.

[@cat47]

bad idea

[@borisdorofeev5602]

Great stuff. I made sure to subscribe, and I am looking forward to your future videos.

[@techsniffer7143]

really, you are the best in means of clarification .

[@GreenyDe]

Very cool and interesting content... i would like to see more stuff like that... maybe you can do some Software Defined Radio projects / tutorials! :)

[@ashvinbhuttoo]

Great videos, very well put together content! Thank you

[@zer0day463]

5:12 His Nokia screen is broken, you 'know he was doing something 😂

[@ShinobiEngineer]

SUPER INTERESTING ! ! ! THANK YOU.

[@yazzindev]

I really appreciate the insights!

[@TheKinGG0ld]

It could be cool to see how far you can trilaterate your position with your current cell tower and its neighbours! Anyway, cool video ;))

[@ExEBoss]

*+TheKinGG0ld* That’s actually one of the sources of location data used by smartphones in order to improve location accuracy.

[@TheKinGG0ld]

I meant, an app that use just this method to point you in the map when you have no data mobile available. Based on a database.

[@gwg]

What happens if the paging request fails? Does it try to send it to other nearby base stations? If the phone is turned off, or not in a coverage zone, how would the network know when to give up on trying to deliver a paging request?

[@LiveOverflow]

Afaik it might try base stations in the area and then give up. And then you get the voicemail on the other sode

[@kevinpielacki127]

A page request is initiated by a subsystem that manages many base stations like an MME for LTE or MSC/BSC for 2G/3G technology. These base stations (BS) are all grouped into multiple smaller areas and the managing subsystem only knows the last area you were registered to. Like maybe an area covering an airport before you take a flight. Like LiveOverflow mentioned, the BS's that belong to that area are sent the paging request and it's broadcasted by all the BS's. If your mobile device does not respond, your location will be set to unknown and a core component will track all missed calls and failed messages until it knows where you are again. When you finally land, your UE will find a new BS to camp on, the location register will be updated, and the core will begin forwarding all missed page requests so you get notified of your missed calls and get bombarded with text messages. Huge fan of your videos LiveOverflow. I was so excited when I saw you were covering mobile technology and I vaguely remember some weaknesses in GSM's encryption algorithm so can't wait to see more.

[@MadushanNishantha]

AFAIK, you can sniff and break GSM encryption with an RTL-SDR dongle and some software. Encryption is not that great.

[@daniyar3264]

@@MadushanNishantha when you are turning off your MS, it sends "IMSI deatached" to MSC/HLR by sdcch channel. So if someone calls you when your MS is turned off - GSM system doesn't even try to send paging, knowing that you are "offline"

[@quarkonia]

This is when a divert could kick in, if the paging response is not answered the the network updates the with No Response, then if you have a divert configured then that will be actioned. If it was to the carrier voicemail then a network waiting indicator will be sent to you device and will wait to be received, shortly after the device location updates and receives the MWI the device will flag to the user a message is waiting. Should you just pull the battery, then no last gasp will be sent to the network and the network will try to page until no response. This is for GSM or DCS1800 of course. Diverts can be network or user set and each has its own priority such as user overrule networks divert.

[@toshineon]

Me: live in a city with good LTE coverage and 5G, has a high-end phone that supports VoLTE My phone: calls over GSM

[@SopanKotbagi]

Keep these videos coming!!!!!

[@kozmaz87]

The sad thing about modern modems, especially the qualcomm ones that they can no longer perform country switching seamlessly. It takes them forever to switch between roaming providers and so your call drops at the border as you drive across. This used to work seamlessly with Nokia phones on 2G. You drove through 3 countries while being on the same call... of course that time the service was way more expensive and exclusive as well....

[@ushisushie]

Thank you for these videos! They are fantastic! You should familiarize yourself with SS7 and the possible hacks on that. It would be great to see your video on it.

[@SumanRoy.official]

I know where this series is going, I am waiting for the SS7 attacks on Live overflow.

[@taozam]

Keep up the unique content 👾🔰

[@monad_tcp]

4:30 I don't mind it, newer things are built on top of older ones. I like to start from an historical perspective when learning anything. Why go always to the newfangled things

[@silkworm6861]

Wow! So informative, thanks!

[@nem64]

Next on liveoverflow: I hacked the FBI, NSA and the CIA using only a potato

[@AlexVasiluta]

Next on ScreenRant* FTFY

It's easier than you might think :) Search youtube for "Wiretapping the Secret Service can be easy and fun". The guy listened to FBI and Secret Service calls using man-in-the-middle approach. He created fake business record on Google using his phone. People searched for FBI office, they found number and called it. Guy's phone called real phone number and recorded everything.

[@slackerengi2401]

Hey Have some respect, that was his grandpa's potato

[@renakunisaki]

FBI, CIA, KFC, PBS...

[@dannyteebone9233]

Great!! There goes our potato chips and Freedom fries

[@JM-sz1gl]

I am loving it!

[@jaa93997]

It was not "secret" per se, engineering mode was used, for example, when testing / accepting a new BTS, a test was timeslot per timeslot hop observation when in tcch, another one was validation of bcch when idle, and so on. Fun times!

[@DerfJagged]

As far as I know, the Nokia game "Cavern Crawl" hasn't been dumped or emulated anywhere. Any chance you'd take on a challenge to dump it? :)

[@lukasvolcik5109]

I love your channel so much! :) I would love some videos about antiviruses ^_^

[@marciocorreafilho8293]

If you have some time... Could you answer one question: Can I buy or build a small network antenna for home or office use and have my own local network PABX local phone network?

Great videos, thank you

[@rohitshetty9531]

So If we can listen to paging request broadcast would be very useful. Think non governmental entity trying to narrow down if a phone is in some area or not. ?

[@reegunj]

Interesting, Thanks for sharing

[@AlanMedina314]

TDMA reminds me of a RR scheduler.

[@moweME]

Beste Uploadzeit... 👍

[@flTobi]

Isso

[@ko-Daegu]

Möwe *best *Uploader

[@NtQueryInformationProcess]

@@ko-Daegu what do you mean?

[@matthewlandry1352]

DOS to a cell tower! Wow... I bet that’s how REvil did it!

[@Choptec]

Enjoyed the video.

[@lmarloe]

Cool. Right now I'm testing osmo-fl2k project, it's SDR based on VGA chip

[@goncalogomes3456]

loving this vids

[@serafinrt]

hi man, one question... what model of nokia devices you recommend? or other devices for other manufacturers?

[@krishnadeshpande6197]

Hey, by using time division multiple access we will be sending signal after particular time. So wouldn't it be a packet

[@justcurious1940]

Is it possible for two GSM phones to communicate directly without cell tower ?

[@shubham399]

Cool

[@gspapp]

Fun fact: the nokia 3310 was made in finland and hungary

[@muhammadishak8636]

Which motorola phone you are using in this video?

[@mrvtrx5627]

🥺❤️ thanks

[@SourceCodeDeleted]

I haven't really cared about phones and this is really interesting. since the phones talk directly to each other, does this mean you can enumerate a general location of their phone with the replies from the base stations?

[@privateger]

Exactly!

[@LuigiEnTwitch]

Epic dude!

[@new_contents_all_day]

Can we use osmocombb in Nokia phones ?? Motorola are very rare now

[@jaa93997]

Depending on the firmware, you can maybe enable engineering mode on Nokia with *3001#12345# If that doesn't work, in the old days you had to ask Nokia to flash the program in your field engineers phones...

[@salimmachila5736]

Nice video thanks

[@itachi2011100]

VoLTE is pretty big in India

[@fictionstudios6876]

Awesome sir.I have a doubt .I have read in some blogs that sim cloning can be done easily in GSM.Is it possible sir??If yes is possible with LTE ??And how sim cloning works??How will it effect people? Because if a sim is cloned anything can be done. If any people knows plz answer here??

[@new_contents_all_day]

Sim cloning is possible , but you need to crack the secret key in sim card

[@new_contents_all_day]

Infact , if you have that key , you don't need a sim

[@prinzrainerbuyo3234]

Actually when multiple phones RACHed with same preamble at the time, there will be one of them that will be granted channel resource through contention resolution.

[@sflux4593]

This is supported in LTE. I'm not sure if this also happens in GSM.

[@prinzrainerbuyo3234]

It is specified in GSM 04.08 3.1.5, it compares service request message sent and response to determine whether ue is the rightful for the channel. Similar to LTE msg 4 contains MAC CRI (which is the sent RRC Connection Request) along with RRC Connection Setup.

[@sflux4593]

Offtopic, your favourite pokemon is Articuno?

[@prinzrainerbuyo3234]

pakyu

[@mentaripagi__]

Any update resources for learning Telcom security?

[@SwordQuake2]

Are you going to talk about the Nokias that were used for fraud?

[@meksaldi]

Amazing

[@late7245]

Can you tether two cellphones to each other without a basestation.?

[@metaorior]

thanks

[@SanketDube]

This is interesting! I am not at all familiar with this subject. However, I am curious; If I happen to know what's the frequency of uplink and downlink of a device. Will I be able to tune into that frequencies and hear calls if I had a device to tune into that frequency? Or is the signal somehow obfuscated or stooped without a handshake?

[@LiveOverflow]

Multiple devices use the same frequency thanks to TDMA. So that already is not so easy. And then usually there is also crypto.

[@varbaek]

No, SMS and phone calls are encrypted. Typically using A5/1 or A5/3. (I don't think anyone uses the intentionally vulnerable A5/2 anymore.) Some countries might usr A5/0 (no encryption). For phone calls you also need to be able to handle channel hopping so you need a HackRF or better, or multiple RTL-SDRs.

[@frankschneider6156]

A5/1 is stronger than A5/2 but can also be easily broken using lookup tables, so in practice there is no difference if using A5/1 or A5/2. Both are insecure.

[@Ulvis_B]

GSM+GPRS+EDGE ,3G +HSDPA ,4G ,5G

[@rodigoduterte9192]

Thw only teacher I'd pay for my whole fortune with

[@maycodes]

can we use gsm arduino model for some tweaking ?

[@ky8920]

these ppt style is highly influenced by tu berlin right?

[@elecom5858]

Hello sir, How can clear data internet using on sim card?

[@Atmatan]

It's been five years. Can I set up my own gsm network yet?

[@turkeyphant]

When is the next video in this series?

[@TheImpetuousDanny]

So can you, in theory, sniff Paging Messages so see what other phones are in the area? Like a cell network airodump?

[@isaacp1218]

TheImpetuousDanny I don't know much about this, but from other comments I have seen it seems like there is encryption used in connections. Apparently there are a few types, with older versions having issues with security (they weren't very good). The types I noticed referenced were "A5/1", "A5/2" and "A5/3". A guy in a comment above said the first two weren't good but (I'm quoting this part) "A5/3 isn't that bad."