NetMonitor in Nokia phones (3/7)
Author: Marcin Wiacek
Description: NOKIA NetMonitor description (English version)
Keywords: 3110, 9110, GSM, DCS, Nokia, 3210, 5110, 5130, 6110, 6130, 6150, 8810, FAQ, NetMonitor, Marcin, Wiacek, Marcin Wiacek

Main page

NetMonitor in Nokia phones (3/7)

[Part 1][Part 2][Part 3][Part 4][Part 5][Part 6][Part 7]

1. What is it ?
2. Do I need it ?
3. Does my phone use more power with NetMonitor enabled ?
4. How to activate it ?
5. Which NetMonitor version can be activated in my phone ?
6. Does NetMonitor activation void warranty ?
7. NetMonitor menu in my phone has different number than 10. Is it normal ?
8. NetMonitor menu in my phone has 11 number, hovewer previous position has 9 number. Is it normal ?
9. How to use it ?
10. Can I damage my phone ?
11. Glossary
12. Description of the individual tests
13. You can also use a program...
14. Can I use NetMonitor without SIM card inserted, without PIN number entered or when SIM card is not active ?
15. How can I disable NetMonitor ?
16. Do I need to disable NetMonitor before sending my phone to the service ?
17. Is it possible to re-activate NetMonitor after disabling it ?
18. Is NetMonitor available in analog Nokia phones ?
19. Does NetMonitor allow to use phone like broadcast station ?
20. I don't have all described tests in my phone. Why ? Can I increase their number ?
21. Does NetMonitor allow to identify place, where is my interlocutor ?
22. Does NetMonitor allow to identify place, where am I ?
23. What are NetMonitor codes ?
24. Is it the truth, that in phones with additional hardware changing frequency band NetMonitor doesn't work correct ?
25. Where can I find description of FBUS/MBUS protocol and commands connected with NetMonitor ?
26. Information sources
27. Additional information

12. Description of the individual tests

Existence of the individual test in your phone depends on:

- phone model: generally, never and more complicated models (with more functions and options) have more tests (for example, Nokia 9110 has more tests than 5110, 7110 more than 9110). There is one (only ?) exception: less complicated Nokia 5110 has bigger NetMonitor than 6110 (and that's why I think that this model is better, even though it doesn't have some functions).
- software version - usually the newer version, the more options it has (software can be upgraded in service and its version can be checked in most models with *#0000# code, in Nokia 6130 with *#9999# and in 3110 with *#3110#) - for instance in Nokia 5110 in Menu 10-89 bbbbbb parameter is shown only from firmware 5.07. Firmware upgrade has also additional advantage: newer versions don't contain some bugs (also in NetMonitor).
- who uploaded firmware to the phone: it is usually written in C (and then translated (compiled) to the code of phone's microprocessor). According to my own private theory existence (and running) of an individual tests depends on some constants set (or not) in the source code (programmers :-) surely understand, what I'm trying to write). The best example for this can be Menu 10-38: according to the some English documentation it doesn't exist in phones to be sold, because DEV_FT_MEMORY_DUMP_IN_USE constant in file ftd_conf.h (one of the firmware source code files) wasn't set before compiling. I think, that the same applies to the help screens - their presence doesn't depend on firmware version but on where the phone was purchased (where it comes from - where was its firmware uploaded). How to solve this problem? Unfortunatelly, you can only download firmware again (compiled from source with set constants).

  Aha, I'm also not quite sure, whether DSP tests (Menu 10-70, 10-73, 10-74, 10-76 (except for ab parameter), 10-77, 10-78 and 10-79) don't have to be enabled this way (or whether their existence (or not) depends on the network).

Help screens for tests are written with bold font, concrete (example) values in tests with italic (I put them there, where I didn't have more details about test).

- sample screenshoots from Nokia 2110i, 5110, 6110 and 9110 (of course, with NetMonitor) are on the www.yaws.dk/communicator/faq/miscellanous/mbus/ or www.fan.net.au/~mrvfone/vfone/techtop/ page. First of them contains NetMonitor manual for Nokia 9110 signed with my and Michal Jerz (http://n9k.ats.pl) name. Unfortunatelly, author of this site doesn't want to update it and I suggest rather to read this FAQ..

Back to the top

Menu 10-1
Information about communication with cell

`abbb ccc ddd e ff g mmmm nnn ppp oooo`
`CH RxL TxPwr TS TA RQ RLT C1 C2 CHT`

- a - contains H, if frequency hopping is enabled (otherwise empty). This information can also be found in Menu 10-11 and Menu 10-12.
- bbb - CH (channel): number of the channel used in communication with cell (decimal). If frequency hopping is enabled, this number changes when the display gets refreshed. This parameter determines frequencies used in communication with BTS:

  carrier (middle) frequency of the transmission channel (MHz) | GSM 900 | GSM 1800
  transmission phone-BTS | 890 + CH * 0,2 | 1710 + (CH - 511) * 0,2
  transmission BTS-phone | 935 + CH * 0,2 | 1805 + (CH - 511) * 0,2

  and informs, whether phone use cell working in GSM 900 or 1800 MHz (I write more about channel numbers in Menu 10-17).

- ccc - RX: minus is not show if <=-100. This parameter affects following functions:

  - if all channels' signal is weaker than -110 dBm, the phone doesn't monitor channels.
  - if the phone loses signal of your home network, it tries to monitor next available networks and if you don't have access to them, you'll see a network presence symbol and no signal strength bars (but you can make emergency calls)
  - if some other network has a very strong signal (say -85 dBm) and your home network is very weak on that area (for example, -100 dBm), your phone can have big problems with logging into it (you will have to use Menu 10-17 to manually force the phone to use proper channel).
  - RXLev parameter value:

    RX (from) | RX (up to) | RXLev
    less than | -110 dBm | 0
    -110 dBm | -109 dBm | 1
    -109 dBm | -108 dBm | 2
    ... | ... | ...
    -49 dBm | -48 dBm | 62
    -48 dBm | morej | 63

  - signal strength indicator value on the left side of the display (approximately):

    RX (from - to) | amount of bars
    from -105 to -100 dBm | 0
    from -100 to -95 dBm | 1
    from -95 to -90 dBm | 2
    from -90 to -85 dBm | 3
    more than -85 dBm | 4

- ddd - TX: level of the transmitted signal (only during connection). If the phone's transmitter is active, there is an * (asterisk) before the value. The lower value, the higher power level (also the one received by your head!) and energy consumption.

  TX (GSM 900) | 16 |  | 15 |  | 14 |  | 13 |  | 12 |  | 11 |  | 10 |  | 9 |
  TX (GSM 1800) |  | 9 |  | 8 |  | 7 |  | 6 |  | 5 |  | 4 |  | 3 |  | 2
  dBm | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26
  Watts | 0,012 | 0,016 | 0,02 | 0,025 | 0,032 | 0,04 | 0,05 | 0,063 | 0,079 | 0,1 | 0,125 | 0,158 | 0,2 | 0,251 | 0,316 | 0,398

  and continue...

  TX (GSM 900) | 8 |  | 7 |  | 6 |  | 5 |  | 4 |  | 3 |  | 2-0 |  |  |  |
  TX (GSM 1800) |  | 1 |  | 0 |  | 31 |  | 30 |  | 29 |  |  |  |  |  |  |
  dBm | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43
  Watts | 0,501 | 0,631 | 0,794 | 1 | 1,26 | 1,58 | 2 | 2,51 | 3,16 | 3,98 | 5 | 6,31 | 8 | 10 | 12 | 15,8 | 20

  Watt = 10(dBm/10)*0,001
  dBm = 10*log(Watt/0,001)

  There are following classes describing max phone transmission power:

  GSM 900 | GSM 1800
  20 W (not in use) 8 W (car/mobile phone) 5 W (car/mobile phone) 2 W (hand phone) 0,8 (hand phone) | 1 W (hand phone) 0,25 W (hand phone)

  Min. phone transmission power in GSM 900 is 0,02 W and in GSM 1800 is 0,0025 W (4 dBm).

  Max BTS power level can be found in their description.

- e - TS (Time Slot): each radio channel used in communication between phone and BTS is divided into 8 parts (called TS - time slots). If in all BTSes (available for your phone) all time slots are in use, you won't be able to make/receive a call and you'll get a 'Network busy' message (information about reason of connection failure is given among others in Menu 10-39). Unfortunately, each type of connection has the same priority in networks not supporting GSM Phase 2+ (it isn't available in older GSM Phases) - so if you want to dial emergency number 112 and the network is busy, no other call will be interrupted and you won't get connected. This problem can also be solved by adding more BTSes (for example in dual GSM 900/1800 MHz network) or by modifying current stations to allow the use of HR channels (FR and EFR transmission uses whole assigned time slot, while HR (defined in GSM Phase 2) only half of it). Max data transmission speed using one TS is 9.6 kbit/sec (or 14.4 kbit/sec, but only in some additional conditions). There are new systems allowing higher transmission speeds (for example GPRS (Generic Packet Radio Services) or HSCSD (High Speed Circuit Switched Data), but they achieve this using several time slots at the same time (which decreases network capacity). This TS indicator shows number of the used time slot (0..7 for FR (EFR) or 0..15 for HR).

- ff - TA (Timing Advance): BTS informs the phone, when it should start transmission (so that it reaches BTS in time). This information is shown by this indicator. It lets us calculate approximate distance between phone and BTS, which is a value between TA*550 m and (TA+1)*550 m (remember, that sometimes signal is refracted and distance evaluated with this parameter can be wrong). This parameter is updated during communication with network (sending/receiving SMSes, calling, requesting services), for example when using SDCC and TFR channels. It ranges from 0 to 63 (up to 35 km) with FR and EFR channels. HR channels offer theoretically (for example with a car antenna (higher transmitting power) and a flat terrain) twice this range (up to 70 km) and TA contains value up to 128 (English descriptions which I use don't say a word about it - so, it's possible, that for values bigger than 64 phone (?) decreases 64 from it and displays such value in this menu).

- g - RXQUAL_SUB (rate of transmission errors with DTX active (DTX state can be checked in Menu 10-12)): it determines, how many errors during connection have to be corrected by the phone for the call to be possible. Range 0 - 7 (0 - means no errors; more than 5 - connection may be interrupted). The higher it is, the worse quality you have...

  RQ value | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7
  Max error amount | <0,2% | <0,4% | <0,8% | <1,6% | <3,2% | <6,4% | <12,8% | >12,8%

- mmmm - RLT (Radio Link Timeout): if it is negative, 0 is shown. Max value of this parameter is 64. If the phone uses a channel different than TCH or SDCC, xx is displayed

- nnn - C1 parameter

- ppp - C2 parameter. If network supports only GSM Phase 1, C1 value is displayed here.

- oooo - type of channel currently used by the phone (visit www.pins.co.uk/upages/stratfordc/ to find C programs containing algorithms used to encode different channels). With HR channels phone even show, if first or second part of TS is used (subchannel 0 or 1 is written):

  AGCH | (Access Grant Channel) - a channel used by BTS to inform the phone about what channel it should use (it is a BTS answer to RACH) - it assigns the phone to SDCCH
  BCCH | (Broadcast Control Channel) - a channel in direction BTS-phone, containing precise information about network (needed for identification and access) - for example how often the phone should inform network about its location (T3212 counter value - more detailed description in Menu 10-10) whether frequency hopping is supported by the network CELL_RESELECT_HYSTERESIS parameter (see C2 parameter description) CELL_BARRED parameter (which informs, whether this cell is in test phase or is available for public use - but the phone can ignore this and use test cells too - see Menu 10-19)
  THR0 | TCH HR subchannel 0
  THR1 | TCH HR subchannel 1
  TFR | TCH FR
  TEFR | TCH EFR
  F144 | TCH FR - data transmission, speed 14.4 kbit/sec.
  F96 | TCH FR - data transmission, speed 9.6 kbit/sec.
  F72 | TCH FR - data transmission, speed 7.2 kbit/sec.
  F48 | TCH FR - data transmission, speed 4.8 kbit/sec.
  F24 | TCH FR - data transmission, speed 2.4 kbit/sec.
  H480 | TCH HR - data transmission, speed 4.8 kbit/sec., subchannel 0
  H481 | TCH HR - data transmission, speed 4.8 kbit/sec., subchannel 1
  H240 | TCH HR - data transmission, speed 2.4 kbit/sec., subchannel 0
  H241 | TCH HR - data transmission, speed 2.4 kbit/sec., subchannel 1
  FA | TCH FR - used only for quick signalization, for example in case of handovers (FACCH - Fast Associated Control Channel)
  FAH0 | TCH HR -used only for quick signalization, for example in case of handovers (FACCH - Fast Associated ControlChannel), subchannel 0
  FAH1 | TCH HR - used only for quick signalization, for example in case of handovers (FACCH - Fast Associated Control Channel), subchannel 1
  SDCC | SDCCH (Stand-alone Dedicated Control Channel) - used for system signalization of: establishing connection user verification Location Update executing assigning to TCH sending SMSes
  CCCH | (Common Control Channel ?) - used, when the phone is in standby mode (it doesn't transmit not receive data)
  CBCH | (Cell Broadcast Channel) - a channel in BTS-phone direction used for cell broadcast (for example in Nokia 5110 it can be enabled in Menu 2-5 and Menu 4-2-2, in Nokia 6110 in Menu 1-5 and Menu 4-4-2)
  CCHR | CCCH and CBCH joined in one
  SEAR | the phone is searching for network
  NSPS | (No Serve Power Save) - the phone is not in range of any network, energy saving has been activated (information, whether your SIM card can stop its clock in energy saving mode, can be found in Menu 10-51)

In Nokia 3110 this test looks similiar:

`abbb cccc ddd e ff g qqrr s Bttuu mmmm w ppp oonnn z`
`CH RxL TxPwr TS TA QPM RAR Ro BsiCLK RLT S C2 CHT C1 B`

- cccc - in this phone minus is always shown
- ooo - hex values
- qq - paging mode (see Menu 10-2)
- rr - RAR (description in Menu 10-2)
- s - roaming indicator (description in Menu 10-2)
- tt - BSIC for current cell (see Menu 10-2)

Level of received signal (RX) is connected with phone transmission power (TX): the weaker the former, the stronger the latter (take a look at example indications of 6110 using SDCC and TFR channels):

RX | TX
from -38 to -49 dBm | 19
from -68 to -75 dBm | 9-14 (0,032 - 0,316 Watt)
from -79 to -85 dBm | 7-9 (0,794 - 0,032 Watt)
from -85 to -93 dBm | 5-7 (2 - 0,794 Watt)

For curious people: some of these data can also be found in Nokia service programs (for example in WinTesla in "Testing" / "RF Information" menu).

| Using CCCH or CBCH channel by the phone (if the cell doesn't support cell broadcast - you can check this in Menu 10-7) depends on its firmware version and whether cell broadcasting has been enabled (or not) by the user. For example: Nokia 5110 v 5.04 uses CBCH channel, if you enable this feature in Menu 2-5 or Menu 4-2-2 (and CCCH channel, if you disable it). I think, that cell broadcast should be disabled when it is not supported by the network - probably you can save some battery power. It has been corrected in version 5.07 (when CB is not supported by the network, the phone uses CCCH regardless of "Info service" and "Cell info display" settings). Additionally, ccc (RX) parameter can be used to set the direction of your antenna (especially directional one) much more precisely than when using the indicator on the left side of phone's display ! I also have a piece of advice for you: never touch the antenna (in any case, you can check how it affects level of received signal just by holding it with your fingers) ! TA parameter can be also used (apart from calculating the distance to BTS) to measure speed (for example of the care you're driving). I'm serious! But this can be done only when: the road is straight (no bends) the phone uses only one BTS BTS must be located near the road A little bit of mathematics: From Pitagoras' theorem: a2 = c2 + e2 b2 = c2 + f2 So: e = f = Now d = e - f =- If you know: the way traveled by the car (on the drawing: length of "d" segment; it can be calculated form the lengths of "a" and "b" segments (multiples of 513 m (for simplification) read from TA) and c (described later)) time, in which TA has changed (measured by a stopwatch) you can measure your speed. Inaccuracy of this measure depends on: distance between BTS and road (segment "c") velocity itself distance between car and BTS (with longer distance inaccuracy depends less from "c" segment) And here is a concrete example: The original value of TA was 2 and after 15 seconds it has changed to 1. You will get following results: 123,120 km/h (BTS 0 m from road) 124,320 km/h (100 m from road) 128,160 km/h (200 m) 135,600 km/h (300 m) You can assume, that "c" segment is 100 m (or 0 if you count in memory - then d = e - f) and the inaccuracy of the measured velocity is 5 km/h.

In Nokia 2120 this test looks as follows:

Digital mode
`rssi DVC d chan l a S BB TT`
| Analog mode
`rssi s d chan l a CS-state`

and in Nokia 2160 is different:

DCCH mode
`rssi DVC S chan Pw A CS-state`
| DTCH mode
`rssi s d chan l a CS-state`
ACCH mode
`rssi D d chan Pw A CS-state`
| AVCH mode
`rssi DVC S chan l a CS-state`

for Nokia 6160 it looks like follows:

DCCH mode
`rssi DVC S Bchan Pw A CS-state`
| DTCH mode
`rssi DVC s Bchan Be l CS-state`
ACCH mode
`rssi D d Bchan Pw A CS-state`
| AVCH mode
`rssi s d Bchan l a CS-state`

- B = current network/frequency

  - a = a-side 800mhz cellular
  - b = b-side 800mhz cellular
  - A = A-block (30 mhz) 1900mhz PCS
  - B = B-block (30 mhz) 1900mhz PCS
  - C = C-block (30 mhz) 1900mhz PCS
  - D = D-block (10 mhz) narrowband 1900mhz PCS
  - E = E-block (10 mhz) narrowband 1900mhz PCS
  - F = F-block (10 mhz) narrowband 1900mhz PCS

- Be = Bit Error rate in % (0-16)
- TT = last received time alignment value (0-31)
- rssi = received signal strength (dBm) (min= -113dBm, max= -51dBm, 2dB steps)
- DVC = Digital Verification Color code (1-255, - = not locked)
- D = DCC (Digital Color Code) on ACCH (0-3, - = not locked)
- s = SAT color (0-2, - = not locked)
- d = data receiving status

  0. no sync/no data
  1. sync/not able to read
  2. reading correcting
  3. reading no correction

- S = slot (1-3)
- chan = channel number (0001-1023)
- Pw = Max access power

  - DCCH: MS-ACC-PWR (0-10, - = not locked)
  - ACCH: CMAC (0-7, - = not locked)

- l = Tx level (0-10, - = TxOff)
- a = audio state (0=off, 1=on)
- CS-state = Cellular State

  - DCCH: `SCAN-LOCK` : Scanning and locking of DCCH
  - DCCH: `DCCH-SEL` : DCCH selection
  - DCCH: `CAMPING` : Camping
  - DCCH: `REGISTR` : Registration proceeding
  - DCCH: `WAIT-ORDER`: Waiting for order
  - DCCH: `ORIGINAT` : Origination proceeding
  - DCCH: `RSELECT` : Reselection
  - DCCH: `ORIG-SMS` : Sending SMS proceeding
  - DCCH: `TERM-SMS` : Receiving SMS proceeding
  - DTCH: `TCH` : Confirm traffic channel
  - ATCH or DTCH: `CONVERSAT` : Conversation
  - ACCH: `OOR` : Out of range
  - ACCH: `SCAN-PDCH` : Scan primary dedicated control channels
  - ACCH: `SCAN-SDCH` : Scan secondary dedicated control channels
  - ACCH: `SCAN-PCH` : Scan paging channels
  - ACCH: `IDLE` : Idle
  - ACCH: `ACCESS` : Access
  - ACCH: `VCH` : Confirm voice channel

This test in Nokia 6185/6188 is, of course ;-), different:

CDMA control
`CSST CHAN SP PPN EC/SO XF LOS XHO FR B -Rxx-Txx FER`
| CDMA traffic
`CONV 0450 NP 8000 2 000 0D9 00 0 -093+006 000`
| AMPS control
`RSSI S D CHAN P A CSST SID E XTBY MINMAX`
| AMPS traffic
`-095 2 3 0273 0 0 CONV 16427 0 Y`
CDMA | AMPS
CSST - Cellular State: IDLE, CONVE, PLIOS, TIME, SYNC, RELE, PAGE, TRFIN, W_OR Chan - Channel PPN - PseudoNoise offset EC/SO - Energy per chip per noise B - Current network/frequency. a,b are A and B 800 MHz AMPS (analog). A-F indicate the digital block in use Rxx - Receive power in dB Txx - Transmit power in dB FER - Frame Error Rate In CDMA traffic screen you have current used codec too (one from these below): 8000 - 13 kbit/sec 0001 - 8 kbit/sec 0003 - EVRC | RSSI - Received signal strength S - Slot (1-3) D - Digital Colour Code on analog control channel (0-3 or - for not locked) CHAN - Channel CSST - Cellular State: IDLE, CONVE, PLIOS, TIME, SYNC, RELE, PAGE, TRFIN, W_OR SID - System ID (Cantel = odd number) MINMAX: Minimum and Maximum RSSI over last time period ?

Menu 10-2
More information about used cell

`aa b c Bdd ee f ggg hh iii H=j mm nn`
`PM RAR Ro BC RelR QLF CRO TO PenT H MAIO HSN`

- aa - paging mode:

  - NO : normal
  - EX : extended
  - RO lub SB : paging reorganization

- b - RAR (Random Access Retransmission): max amount of transmissions using RACH channel (Random Access Channel - a phone-BTS channel used to send a network access request - for example during logging in)
- c - if your phone is in roaming, R is displayed (otherwise empty). This information is also shown on the top of the display.
- dd - BSIC value for current cell
- ee - reason of last connection end (this parameter is also present in Menu 10-63 and Menu 10-39 (you will find explanation there - see description of the first parameter))
- f - RXQUAL_FULL (error rate in transmission with DTX disabled (DTX state can be checked in Menu 10-12)): it determines, how many errors have to be corrected by the phone, for the connection to be possible. Range 0 - 7 (0 - means none, more than 5 - connection may be interrupted).

  RQ value | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7
  Max amount of errors | <0,2% | <0,4% | <0,8% | <1,6% | <3,2% | <6,4% | <12,8% | >12,8%

- ggg - Cell reselect offset: range 0 - 63 (this value should be multiplied by 2 dB), 'xxx' when transmitting. Needed to calculate C2.

- hh - Temporary offset: range 0 - 7 (this value should be multiplied by 10 dB, 70 dB means infinitely long time), 'xx' when transmitting. Needed to calculate C2.

- iii - Penalty time: range 0 - 31 (it should be multiplied by 20 s), 'xxx' when transmitting. Needed to calculate C2.

- j - information about frequency hopping:

  - 0 - not used (single frequency used - so called RF (Radio Frequency))
  - 1 - used (different RF (Radio Frequencies) used)

- mm - MAIO (Mobile Allocation Index Offset). Range 0 - 63, 'xx' when j=0 (when frequency hopping is disabled - you can check this in Menu 10-12)

- nn - HSN (Hopping Sequence Number).Range 0 - 63, 'xx' when j=0 (when frequency hopping is disabled - you can check this in Menu 10-12)

In Nokia 3110 this test looks as follows:

`aaabbbccccddd aaabbbccccddd aaabbbccccddd w z`
`S CH C1 rx C2 1 CH C1 rx C2 2 CH C1 rx C2 S 1N 2N B`

Description of the parameters can be found in menu Menu 10-3 (in this model cccc parameters are always preceded by minus).

In Nokia 2120 this test looks as follows:

`ENCR CIPH DTX XSTBY CS-state`

- ENCR = when message encryption is on
- CIPH = when Ciphering is on
- DTX = when DTX is on
- XSTBY= when enabled standby is on
- CS-state = see previous parameter for details

and in Nokia 2160 is different:

DCCH mode
`mode DTX ENCR CIPH d Be TA`
| DTCH mode
`mode DTX ENCR CIPH d Be TA`
ACCH mode
`mode XSTBY SID`
| AVCH mode
`mode SAT`

and here is for Nokia 6160:

DCCH mode
`mode M C FB E SP pc net SID..`
| DTCH mode
`mode DTX ENCR CIPR d a TA S CODEC...`
ACCH mode
`mode XSTBY SID`
| AVCH mode
`mode SAT`

- mode = DCCH, DTCH, ACCH, AVCH
- SID = system ID [0-32767, - = not locked]
- DCCH mode

  - M = maximum paging frame class supported by network (1-8)
  - C = current PFC (Paging Frame Class) (1-8)
  - FB = number of F-BCCH slots
  - E = number of E-BCCH slots
  - SP = number of SPACH slots
  - pc = PCH subchannel
  - net = supported network types, bit map (1=suported, 0=not, C=current): first bit for Public, second for Private, third for Residential

- DTCH mode

  - DTX = shown when DTX is on
  - ENCR = shown when message encryption is on
  - CIPH or CIPR = shown when voice ciphering is on
  - d = data receiving status (0=no sync, 1=sync)
  - Be = Bit Error rate in % (0-16)
  - TA = current time alignment (0-30)
  - a = audio state (0=off, 1=on)
  - CODEC... = current codec:

    - -EFR- = IS-136A ACELP coder

- ACCH mode

  - XSTBY = shown when extended standby is on

- AVCH mode

  - SAT = SAT validity as measured by DSP (0-32767)

and for Nokia 6185/6188:

CDMA control
`PN1 ECK`
| CDMA traffic
`PN1 PN3 PN5 ECK ECK ECK PN2 PN4 PN6 ECK ECK ECK`
| AMPS control
`X F S N N C SLEEP EMC SCC STC M RSSCPLCC CAL`
| AMPS traffic
`2 2 1 0 4 1 00015F927B13 0029B 0A0 2 140 372 0000`
CDMA PNx: CDMA PN offsets handoff canidate listing. Shows only the current offset while idling. Shows 1 to 6 additional choices during traffic.

Menu 10-3
Information about current and neighbor cells

`aaabbbcccddd aaabbbcccddd aaabbbcccddd ef gh`
`SCH C1 rx C2 1CH C1 rx C2 2CH C1 rx C2 1N 2N`

Meaning of these lines:

1. information about current cell
2. 1st neighbor cell
3. 2nd neighbor cell
4. e,f concern 1st neighbor cell, g,h concern 2nd neighbor cell

- aaa - CH (channel): number of channel used for communication with cell (decimal)
- bbb - C1 values displayed only in standby mode. In active mode (ie. during connection) letter B and BSIC for current cell are displayed.
- ccc - RX: minus is not shown if <=-100. Lets us calculate RXLev parameter value:

  RX (from) | RX (up to) | RXLev
  less than | -110 dBm | 0
  -110 dBm | -109 dBm | 1
  -109 dBm | -108 dBm | 2
  ... | ... | ...
  -49 dBm | -48 dBm | 62
  -48 dBm | more | 63

- ddd - C2 parameter
- e,g - contains F, if current cell is located on a restricted area (otherwise empty)
- f,h:

  - B means a cell in test phase (your phone can use barred cells - this can be enabled in Menu 10-19)
  - N - a cell given for normal use
  - L - means low level
  - otherwise empty

| If you want to see, if actual used cell is barred or not, see on Menu 10-19 (it depends on setting in that test)

Sometimes phone shows, that both C1 and C2 for channel are equal -99 - it means probably, that it wouldn't be able to log into it...

In Nokia 3110 this test looks like Menu 10-4.

In Nokia 2120 this test looks like test 4 in Nokia 2160.

In Nokia 2160 this test looks different (is displayed in DCCH mode only):

`RS SS SI b NA ND`

and here is for Nokia 6160:

`RS SS SI b NA ND MA MD MO`

- RS = minimum Received signal Strength required to access cell (0-31, where 0=-113 dBm and 31=-51 dBm)
- SS = minimum signal Strength Sufficient for candidate of reselection (0-31, where 0=-113 dBm and 31=-51 dBm)
- SI = Scan Interval between consecutive strength measurements in hyperframes (1-16)
- b = access burst size (0=normal, 1=abbreviated RACH)
- NA = Number of Analog neighbors (0-24)
- ND = Number of Digital neighbors (0-24)

and for Nokia 6185/6188:

`OWNNUMBER ESN-00000000 ESN-HEX SL P MD PC`

- OWNNUMBER - phone number
- ESN - Electronic Serial Number
- MD - [AD] changes to [DI] at 800 CDMA

Menu 10-4
Information about neighbor cells

`aaabbbcccddd aaabbbcccddd aaabbbcccddd ef gh ij`
`3CH C1 rx C2 4CH C1 rx C2 5CH C1 rx C2 3N 4N 5N`

Meaning of the lines:

1. 3rd neighbor cell
2. 4th neighbor cell
3. 5th neighbor cell
4. e,f concern 3rd neighbor cell, g,h 4th neighbor cell, i,j 5th neighbor cell

Meaning of the letters is the same as in Menu 10-3 (i is the same as e, j is the same as f)

Sometimes phone shows, that both C1 and C2 for channel are equal -99 - it means probably, that it wouldn't be able to log into it...

In Nokia 3110 this test looks like Menu 10-5.

In Nokia 2160 this test looks different:

`bVo mod bs Tbat1 Tb2 Wpwm FCmAh`

- bVo = battery voltage
- mod = charging mode

  - FAS = Fast charging
  - COL = Cold battery charging
  - MAI = Maintenance charging
  - ERR = wrong charger or battery not OK
  - LIC = LiION battery charging
  - TXO = charging, transmitter active (connection in progress)
  - *** = charger disconnected

- bs = battery is full or reason for fast charge termination

  - TI = max. charge Time elapsed
  - DV = dV/peak value detected (full)
  - BV = Battery voltage max limit
  - BT = Battery temp max limit (overheat)
  - ** = battery is not full

- Tbat1 = battery temp. a/d reading (subtracted from 1023)
- Tb2 = battery temp. in C (not implemented)
- Wpwm = PWM charge control output (000-250)
- FCmAh = mAh rating of charge given to the battery

In Nokia 2120 this test looks like follows

`ChargV:NNN ST hex des B:LLLL KKK`

but it was not implemented.

In Nokia 6160 this test looks like follows

`SID ##### NN NT NR Alphatag`

- SID = System Identification Number (0 to 32767, odd for 'A' carriers, even for 'B' carriers, - = not locked)
- Alphatag.. = textual end-user display of current system

and for Nokia 6185/6188:

`CSST CHAN A B SID SD IT TM CAP`

- CSST - Cellular state: IDLE, CONVE, PLIOS, TIME, SYNC, RELE, PAGE, TRFIN, W_OR
- CHAN - Channel
- B - Network Band and Frequency (lowercase a,b = 800 MHz band; uppercase A,B = 1900 MHz band)
- SID - System ID:

  - [17500] - Clearnet PCS
  - [16422] - BC Tel Mobility
  - [16xxx odd number] - Cantel AT&T

Menu 10-5
Information about neighbor cells

`aaabbbcccddd aaabbbcccddd aaabbbcccddd ef gh ij`
`6CH C1 rx C2 7CH C1 rx C2 8CH C1 rx C2 6N 7N 8N`

Meaning of the lines:

1. 6th neighbor cell
2. 7th neighbor cell
3. 8th neighbor cell
4. e,f concern 6th neighbor cell, g,h 7th neighbor cell, i,j 8th neighbor cell

Meaning of the letters is the same as in Menu 10-3 (i is the same as e, j is the same as f)

Sometimes phone shows, that both C1 and C2 for channel are equal -99 - it means probably, that it wouldn't be able to log into it...

In Nokia 3110 this test looks like Menu 10-6.

As far as I know, Nokia 3210 is the first model which can "observe" 8 neighbor cells (older series - like Nokia 5110 . display parameters of only 6 neighbor cells).

In Nokia 2160 this test looks different:

`ROM SW EPROM SW Prod type`

- ROM SW = ROM software version, e.g. V 65.08
- EPROM SW = EPROM (flash) version, e.g. V 1.45
- Prod type = product type, e.g. NHC-4NE

And here is for Nokia 6160:

`S bandorde NC NP IRC RSCO RSLO`

- S = system indicator:

  - H = hometype system
  - P = partner roam
  - F = preffered roam
  - N = normal roam
  - X = no service
  - a, b, A, B, C, D, E, F = current band while scanning for a control channel (see next parameter for details)

- bandorde = network search order:

  - a = a-side 800mhz cellular
  - b = b-side 800mhz cellular
  - A = A-block (30 mhz) 1900mhz PCS
  - B = B-block (30 mhz) 1900mhz PCS
  - C = C-block (30 mhz) 1900mhz PCS
  - D = D-block (10 mhz) narrowband 1900mhz PCS
  - E = E-block (10 mhz) narrowband 1900mhz PCS
  - F = F-block (10 mhz) narrowband 1900mhz PCS

- NC = Number of Cellular = number of probability blocks to scan in cellular bands
- NP = Number of PCS - number of sub blocks to scan in PCS bands
- IRC = IR Control:

  - 1 = only systems with home SID or SOC are accepted
  - 0 = any system not listed as forbidden is accepted

- RSCO = Rescan Count - rescan time in hyperframes
- RSLO = Rescan Loop - defines when all the bands in bandorder are to be scanned

and for Nokia 6185/6188:

`1YNC_OK_097B SYNC_FAI4CC1 FOCC_WOR587C WORD_OK_3E65`

Menu 10-6
Information about preferred and restricted networks of the inserted SIM card.

`aaabb aaabb aaabb aaabb aaabb aaabb aaabb aaabb`
`LReg 1_For 1_Pre 2_For 2_Pre 3_For 3_Pre 4_For`

Meaning of the individual lines:

last registered network | 1st forbidden network
1st preferred network | 2nd forbidden network
2nd preferred network | 3rd forbidden network
3rd preferred network | 4rd forbidden network

- last registered network - you used it last time. When you're in home country, it can be your home network (you pay them for your calls - if it is, after choosing it manually (in Nokia 5110 - Menu 4-2-4) phone displays "Home network selected").
- preferred network - network, to which your SIM card was logged (when it was in its range) - for example in roaming.
- forbidden network - your SIM card was in range of that network, but wasn't allowed to log in...

- aaa - MCC (Mobile Country Code) - code of the network home country (260 for Poland) in BCD code

- bb - MNC (Mobile Network Code) - network code (different for networks with the same MCC) in BCD. When you use phone working in PCS 1900 system (for example, Nokia 6190), this number can be 3-digit long.

What are these lists stored on SIM card for? Because:

1. the phone doesn't have to waste its power while trying to log to the network, which is forbidden for SIM card (it is checked only once and then stored, so the phone doesn't have to repeat this procedure anymore)
2. when you have automatic network selection enabled, your phone in first turn searches for networks it was previously using ("preferred").

The list of "preferred" and "forbidden" networks is written by the phone (Nokia saves last chosen networks). Preffered networks can be also edited - for example in Motorola and Alcatel phones (not in Nokia). Sometimes it is done by the operator (he writes preferred and forbidden networks to the SIM card before selling it (it's known, that you cannot log to competitive network - it can be stored in card programming phase). Both these lists can be changed using a Czech program called SIMedit (www.compelson.cz/simedit.htm)...

URL http://kbs.cs.tu-berlin.de/~jutta/gsm/gsm-list.html contains list of the MCC and MNC parameters for different networks.

| Using this menu you can check (probably - NOT ALWAYS!), where SIM card was used lately (in your country, abroad) and where its owner was traveling

In Nokia 2160 use this test, when you want to "disable" NetMonitor tests.

And here is for Nokia 6160:

`PSC PSD FSC FSD XSC XSD`

Intelligent Roaming Database (IRDB) statistics:

This lists the total count of SOCs and SIDs in each category. The database has a total memory limit of 82 entries, which may be distributed amongst these categories:

PSC = number of Partner SOCs
PSD = number of Partner SIDs
FSC = number of Preffered SOCs
FSD = number of Preffered SIDs
XSC = number of Forbidden SOCs
XSD = number of Forbidden SIDs

Partner SOC/SID = treated like the home system by the phone
Preffered SOC/SID = preferred over neutral (undefined) systems when available
Forbidden SOC/SID = rejected by the phone as service providers

and for Nokia 6185/6188:

CDMA
`SID NID BASE ID P_REV MIN_P_REV`
| AMPS
`0ORD_COR0CE3 WORD_FAI0E76 CTRL_FIL787D SAT_V_OK0004`
CDMA SID - System ID: [17500] - Clearnet PCS [16422] - BCTel Mobility [16xxx odd number] - Cantel AT&T [00000]: Second SID assignment Are lines 3,4 CDMA specs ? [ANSI] for 1900 MHz, [TSB74] for 800 MHz CDMA

Menu 10-7
Information about current (recently monitored) cell

`E A H C I BR a b c d e fg ECSC 2Ter MB h i j`
`Serving Cell system info bits`

- a - 1, if emergency calls (112) are possible
- b - 1, if IMSI attach and IMSI detach are possible
- c - 1, if the cell supports HR channels
- d - 1, if C2 values are broadcasted
- e - 1, system information 7 and 8 are broadcasted
- f - 1, if the cell supports cell broadcasting (CBCH channel)
- g - 1, if cell re-establishment is possible

Last two lines are present only in dual phones (GSM 900/1800 - for example Nokia 6150 and 3210):

- h - 1 in standby mode, if ECSC (Early Classmark) sending is supported. During a call "x" is displayed.
- i - 1 in standby mode, if 2-Ter messages are supported. During call "x" is displayed
- j - information (if supported) which cells from both frequencies bands (900 and 1800 MHz) are shown (MULTIBAND_REPORTING parameter value). Description from Phase2+ ETSI GSM 05.08 version 5.4.0, section 8.4.3 "Additional cell reporting requirements for multi band MS" specification:

  - 0 - 6 strongest cells (with known and allowed NCC from BSIC), regardless their frequency band (900 or 1800 MHz)
  - 1 - strongest cell (with known and allowed NCC from BSIC) in each frequency band on BA list, except for frequency band of the current cell. Remaining positions should be used to show cells in frequency band of the current cell. If there are free positions left, further strongest and recognized cells from other bands are shown (their frequencies bands are not important).
  - 2 - like in 1, but two strongest cells are shown first (with known and allowed NCC from BSIC) in each band...
  - 3 - three strongest cells are shown first...

If your phone wasn't logged to any network, some default values are shown.

In Nokia 6160 this test is different:

`User interface display`

and here is for Nokia 6185/6188:

CDMA
`CSST DATE TIME`
| AMPS
`1AT_V_FA0000 FVC_S_FA0000 WFLG_INT7046 NORMALRXFE25`
CDMA CSST - Cellular state: [IDLE], [CONVE], [PLIOS], [TIME], [SYNC], [RELE], [PAGE], [TRFIN], [W_OR] DATE - CDMA Network date TIME - CDMA Network time

Back to the top

[Part 1][Part 2][Part 3][Part 4][Part 5][Part 6][Part 7]

Marcin Wiacek (WWW)
Last modification: 4 May 2000