NetMonitor in Nokia phones (2/7)
Author: Marcin Wiacek
Description: NOKIA NetMonitor description (English version)
Keywords: 3110, 9110, GSM, DCS, Nokia, 3210, 5110, 5130, 6110, 6130, 6150, 8810, FAQ, NetMonitor, Marcin, Wiacek, Marcin Wiacek

Main page

NetMonitor in Nokia phones (2/7)

[Part 1][Part 2][Part 3][Part 4][Part 5][Part 6][Part 7]

1. What is it ?
2. Do I need it ?
3. Does my phone use more power with NetMonitor enabled ?
4. How to activate it ?
5. Which NetMonitor version can be activated in my phone ?
6. Does NetMonitor activation void warranty ?
7. NetMonitor menu in my phone has different number than 10. Is it normal ?
8. NetMonitor menu in my phone has 11 number, hovewer previous position has 9 number. Is it normal ?
9. How to use it ?
10. Can I damage my phone ?
11. Glossary
12. Description of the individual tests
13. You can also use a program...
14. Can I use NetMonitor without SIM card inserted, without PIN number entered or when SIM card is not active ?
15. How can I disable NetMonitor ?
16. Do I need to disable NetMonitor before sending my phone to the service ?
17. Is it possible to re-activate NetMonitor after disabling it ?
18. Is NetMonitor available in analog Nokia phones ?
19. Does NetMonitor allow to use phone like broadcast station ?
20. I don't have all described tests in my phone. Why ? Can I increase their number ?
21. Does NetMonitor allow to identify place, where is my interlocutor ?
22. Does NetMonitor allow to identify place, where am I ?
23. What are NetMonitor codes ?
24. Is it the truth, that in phones with additional hardware changing frequency band NetMonitor doesn't work correct ?
25. Where can I find description of FBUS/MBUS protocol and commands connected with NetMonitor ?
26. Information sources
27. Additional information

11. Glossary

Here you can find explanation to some terms, which can be found in this FAQ:

ACCH (Analog Control Channel) (TDMA 800/TDMA 1900)

AMPS (Advanced Mobile Phone Service)
Analogue cellular system working in 800 Mhz used, for example, in North America.

ASIC (Application Specific Integrated Circuit)
Electronic chips designed for some concrete purposes (for example, in phone it controlls communication between MCU and DSP) They're designed and produced by the companies which use them.

AVCH (Analog Voice Channel) (TDMA 800/TDMA 1900)

BCC (Base-station Color Code) (GSM/DCS/PCS)
3-bit number (from 0-7 range) used to distinguish neighbor cells of the same operator, transmitting using BCCH in the same FDMA channel. Such distinguish is not needed when the cells belong to different operators (they use different channels and their BCCH are in different FDMA channels). It is given in BSIC of each BTS (you can check it for example in Menu 10-2).

BSC (Base Station Controller) (GSM/DCS/PCS)
It controls and supervises one or more BTSes.

BSIC (Base Station Identity Code or Base transceiver Station Identity Code) (GSM/DCS/PCS)
Unique ID number of each BTS. If we code this value binary, first three digits (in decimal format) are BCC and next three are NCC. These values range from 0 - 63. BSIC values can be found among others in Menu 10-2.

BTS (Base Transceiver Station) (GSM/DCS/PCS)
This device allows communication between phones and cellular network (many parameters, like current communication channel, distance to BTS and signal quality can be found, for example, in Menu 10-1).

And here are another classes with maximum power of BTS:

GSM 900 | GSM 1800
320 W (55 dBm) 160 W (52 dBm) 80 W (49 dBm) 40 W (46 dBm) | - - - -
20 W (43 dBm) 10 W (40 dBm) 5 W (37 dBm) 2,5 W (34 dBm)

In Polish version of this FAQ I give many links to WWW pages with BTS lists, their descriptions, pictures (in Poland).

From English pages I recommend www.geckobeach.com/cellular/cellpixs/cellid.htm site - it's about networks and BTSes in North America.

C1 (path loss-criterium) (GSM/DCS/PCS)
This is a parameter (ranging from -99 to 99 dBm) calculated by the phone to decide which cells to use (it uses the cell only if its C1 is positive). This value is based on:

- RX
  Strength of signal received in BCCH channel. If it is equal or less than RxLevAm, the phone searches for next BCCH channel. It is shown in Menu 10-1 (for current channel) and also in Menu 10-3, Menu 10-4 and Menu 10-5 (for neighbor channels). The amount of measurements of the quality of transmission with BCCH channels in neighbor cells is given in Menu 10-62
- RxLevAm (Rx Level Access minimum)
  Min. level of the received signal (usually from -100 dBm to -110 dBm) needed by the phone to use particular cell.
- MSTxPwr
  Max power, which can be transmitted by phone to get access to RACH channel (i.e. max power allowed by current cell). Actually, it is lower in towns (where cells are small) and higher outside them.
- MSMaxTxPwr
  Max permissible transmission power of the phone (its classes are described in TX description).

It is calculated using following formula: C1 = (RX - RxLevAm - MAX ( ( MSTxPwr - MSMaxTxPwr ), 0) ) , where MAX(x,y) is obviously a mathematical function giving the bigger one of the discussed numbers. The phone shows C1 value in Menu 10-1 (for current channel) and in Menu 10-3, Menu 10-4 and Menu 10-5 (for neighbor channels).

C2 (cell-reselection criterion) (GSM/DCS/PCS)
This parameter (-99 to 99 dBm) is calculated with following formula: C2 = C1 + Cell reselect offset - Temporary offset * H (Penalty time - T). If this value for some other cell (C2 for neighbor channels can be found in Menu 10-3, Menu 10-4 and Menu 10-5) is higher than this value for current cell (shown in Menu 10-1 and Menu 10-3) for a period of time longer than 5 seconds, the phone switches cells. There are two exceptions to the rule:

- if the new cell is located on different Location Area (this parameter for current cell can be checked in Menu 10-11), C2 for this cell must be (during more than 5 seconds) higher than C2+CELL_RESELECT_HYSTERESIS for old cell (where CELL_RESELECT_HYSTERESIS is a special parameter sent in BCCH channel).
- if the phone switched cells during last 15 seconds, C2 for a new cell must be higher at least 5 dBm from C2 value of the old cell.

H(x) function for currently not used cells is 0 (if x<0) or 1 (if x>=0). For current cell H(x) is always equal 0.
By a skillful manipulation of this parameter (through CELL_RESELECT_HYSTERESIS), operators can direct connections to specific cells (thus lightening load of the network).

CDMA (Code Division Multiple Access; also known as IS-95)
One of the newer digital technologies in 800 or 1900 Mhz. Used in North America, Australia and some southeastern Asian countries (e.g. Hong Kong and South Korea). It doesn't divide the radio frequency spectrum into separate user channels by frequency slices or time slots, but separates users by assigning them digital codes within the same broad spectrum.

DCCH (Digital Control Channel) (TDMA 800/TDMA 1900)

DCS (Digital Cellular System)
Cellular communication system working in 1800 MHz frequency band (currently more often called GSM 1800) - a changed version of GSM (900 MHz) system. Its new features allowed to increase network capacity (that's why this system is used in urban areas with huge number of subscribers) at the cost of thick net of the base stations (BTSes) and to provide roaming within one country. GSM 1800 has different channel numbers (see Menu 10-17), different phone (see RX description) and BTSes transmission power and also different max speed of the user, at which he can use his phone (250 km/h in GSM and 130 km/h in DCS).

DSP (Digital Signal Processor)
Signal processor (digital signals processing chip - controls radio interface and speech coding/decoding). Its version can be checked in Menu 10-88.

DTCH (Digital Traffic Channel) (TDMA 800/TDMA 1900)

DTX (Discontinous Transmission Exchange)
Some phones and networks "care" ;-) about battery life using so called discontinuous transmission (DTX), which turns off phone's transmitter when we don't talk (but - for example - listen to the calling party). During that period the phone generates a so called comfortable :-) noise, because if our interlocutor heard the silence, he could think that the connection was broken.

(GSM/DCS/PCS):
DTX must be supported by the phone (Nokia does - see Menu 10-78) and BTS - you can check and (sometimes) change this in Menu 10-12 and Menu 10-13.

FDMA (Frequency Division Multiple Access) (GSM/DCS/PCS)
This name means multiaccess on frequency field: transmission proceeds on different frequencies at the same time (this is a "full duplex" connection): there is a “down-link” from BTS to the phone and “up-link” - from the phone to BTS (this is called "up" and "down" because BTS antennas are usually higher than phone ones, so the signal from BTS to the phone really must go down (and vice versa)).

GSM (Global System for Mobile Communication)
Cellular telecommunication system working at 900 MHz. It also has a 1800 MHz (DCS) and 1900 MHz (PCS) version.

HLR (Home Location Register) (GSM/DCS/PCS)
Network register containing information about subscribers (i.e. about their subscribed services, tariff, last network they were logged in, etc.).

IMEI (International Mobile Equipment Identification code) (GSM/DCS/PCS)
Unique 15-digit identification number of every GSM phone on the world. It can be checked using *#06# code (all phones) or in service menu (Nokia), which can be activated by typing a code *#WAR0ANTY# or *#WARRANTY# (Nokia 6130). In Nokia 3110 after entering service menu (*#WAR0ANTY#) you have to additionally enter a code 9268. IMEI contains information about the manufacturer, place of production and serial number (check www.tele-servizi.com/janus/texts/imei.txt for such list for Motorola phones). Operators can restrict network access for particular phones - for example the stolen ones (identified using IMEI number). Different operators can exchange such lists too.

IMSI (International Mobile Subscriber Identify) (GSM/DCS/PCS)
Unique (max 15-digit) number given to the phone:

- first three digits are MCC
- next three digits are MNC
- the rest is a unique number

IMSI attach (GSM/DCS/PCS)
It is a procedure executed after each power on. The phone informs network that it is active (and is ready for communication - receiving waiting SMS, etc.) and then it receives the IMSI number. The counter connected with IMSI attach is located in Menu 10-64, Menu 10-7 informs whether this is allowed by the current cell.

IMSI detach (GSM/DCS/PCS)
The phone informs network that it is going to switch off and the communication won't be possible (its IMSI expires). The counter connected with IMSI detach is located in Menu 10-64. Menu 10-7 informs whether this is allowed by the current cell.

Location Update (GSM/DCS/PCS)
Every GSM phone periodically informs network about its current location. This function is called Location Update. It is executed after changing Location Area (phone makes it "intelligent" - when it's moved out of network coverage and the logs again to the network, makes Location Update only when current BTS has different LAC than previous one - before losing the signal) or PLMN (after leaving the range of one network and trying to log in to another). Then information about Location Update is transferred to a new MSC/VLR, which in turn passes this information to HLR. When the phone works in new MSC/VLR, HLR doesn't identify the user by the number received from old MSC/VLR anymore. Location Update has a couple of varieties: PLU, IMSI attach and IMSI detach (they're distinquished in Menu 10-64). Current Location Area code can be checked in Menu 10-11.

MCU (Master Control Unit processor)
Main processor in phone.

MSC (Mobile Switching Center) (GSM/DCS/PCS)
Part of the system responsible for communication between subscribers and other users (also from other networks).

NCC (National Color Code or Network Color Code) (GSM/DCS/PCS)
3-bit number (from 0-7 range) used to differentiate cells of the operators from different countries (for example near the border, where the phone is in range of several different networks) transmitting using BCCH in the same FDMA channel. This number is constant within PLMN. It is given in BSIC of every BTS (you can check it in Menu 10-2).

PLMN (Public Land Mobile Network) (GSM/DCS/PCS)
Area covered by one operator (one network). After changing this area, the phone executes Location Update.

- Coverage maps of different operators worldwide can be found at www.subcam.freeserve.co.uk/mark/orange/ora.html.

PLU (Periodic Location Update) (GSM/DCS/PCS)
The phone informs network, on which country area (in the range of which cells) it is located. This procedure is executed periodically (depending on the network, for example in polish Era GSM and Plus GSM networks every 3rd hour, in Idea every 2th hour) - this can be checked in Menu 10-10. This period is counted from the last „contact” with network (the counter doesn't stop even if the phone loses network signal!) - from the last call, sending/receiving SMS, requesting some services (for example enabling call diverting), because the network is then informed about phone's location (but this is not registered in Menu 10-64). The counter connected with PLU is in Menu 10-64.

Frequency hopping (channel hopping) (GSM/DCS/PCS)
During connection your phone can continuously change used frequency (used channel) in communication with cell. It's used, when some channel is still troubled - without channel hopping communication with phone could not be possible, with it it's - only this part of transmition, which is made on this frequency, is lost (so, if gives less number of signal loss, but doesn't change sound quality - methods of coding it are always the same). You can check (during a call) if your phone uses this function in Menu 10-1. Menu 10-12 informs if it is allowed by the cell (these values are updated only during a call). Channel hopping requires Hopping Sequence Number (frenquencies are changed according to known for phone and network sequence) - see Menu 10-2.

TCH (Traffic Channels) (GSM/DCS/PCS)
Two way user data (computer data or digitized voice) channels. They can be divided to:

- HR (Half Rate Traffic): max data transfer rate is 6.5 kbit/sec (introduced in GSM phase 2). HR channels offer worse sound quality but also longer phone standby time (even up to 30%), because the phone using HR uses less power. The main advantage of this kind of channels is that they enable the network to double its capacity (the number of subscribers able to make a call at the same time - see TS parameter description for more details) or to double the max range of the BTS. Using these channels must be allowed and supported by the network (this can be checked in Menu 10-7) and the phone. Activation code is *HRC0#, deactivation code is #HRC0#. Unfortunately, not all Nokia phones accept these codes (the phone should reset itself after entering them) - in older models they're not supported, in never they're deactivated, when the phone is directed to countries with networks, which doesn't support it. Interesting fact is that in Nokia 6110 (firmware 5.24) you can decide whether the phone can use this channel or not by modifying following EEPROM memory cells values:

  enabling | disabling
  cell 0070 value for 78 cell 011F value for 84 | cell 0070 value for 70 cell 011F value for 7C

- FR (Full Rate Traffic):transmission at 13 kbit/sec, coding using LPC-RPE (Linear Prediction Coding with Regular Pulse Excitation) algorithm
- EFR (Enhanced Full Rate): 13 kbit/sek, coding algorithm different than in FR (ASELP (AlgebraicCode Excitation Linear Prediction) created by Nokia and Sherbrooke University; recognized as an industrial standard for GSM). EFR provides better sound quality at the same data transmission rate (and up to 5% faster battery drain compared to FR). This mode can be enabled using *EFR0# code (the phone then tries to use TCH channels in following order: EFR, FR, (HR)) and disabled with #EFR0# (order: FR, (HR)). These codes may be not recognized by some models (for example 6110 with some firmware versions) - if your phone accepts them, it should reset itself right after typing them (if this doesn't happen, you won't be able to enable/disable EFR using a keyboard code). This channel is not supported in all older models (for example, 2110). The type of channel used by your phone can be checked only during connection.

When you network doesn't support one of these channel and phone recognizes its activation code, you may see "Not ready" message.

You can check this in Menu 10-1. The sequence of TCH channels can be freely set using some of the service programs (for example WinTesla - in Software/Product Profile menu) - it can be only possibility to enable HR channel in phone.

TDMA (Time Division Multiple Access) (GSM/DCS/PCS)
This means multiaccess in time: several phones can transmit signal (either digitized voice or computer data) in the same time on the same channel (its number can be checked in Menu 10-1) - actually, this period of time is divided into very small parts (see TS description), invisible for us, so we can assume it happens simultaneously).

TMSI (Temporary Mobile Subscriber Identity): (GSM/DCS/PCS)
During signalization procedures encrypted on radio channel (for example, during location update) this number is assigned by MSC to phone. In the moment, when network wants to contact with concrete phone and transmission on radio channel is not encrypted, it's send instead of IMSI and allows phone to indentify, that concrete call concern on it. It doesn't have global meaning and it's structure is definited by network administrator. Actual TMSI you can check in Menu 10-10.

VLR (Visitor Location Register) (GSM/DCS/PCS)
This register contains the same data as HLR, but for roaming guests (their data are taken from their home network HLR).

Back to the top

[Part 1][Part 2][Part 3][Part 4][Part 5][Part 6][Part 7]

Marcin Wiacek (WWW)
Last modification: 4 May 2000