mcc-500 gsm analyzer overview en v 1 final

8/12/2019 MCC-500 GSM Analyzer Overview en v 1 Final

1/14

www.proximus.com.ua Page 1

MCC-500 dual band GSM

analyzer

Document number OTK-201335

Copyright 2012 Proximus LLC. All rights reserved

Covering the following modifications MCC-500-A (dual band GSM 900/1800 MHz)

MCC-500-B (dual band GSM 850/1900 MHz)

Document Nr. OTK-201335

Date June 18th, 2013

Last updated revision v. 01

Product overview


2/14


Table of contents

1. Overview

2. Acronyms and abbreviations

3. Functionality and operation

3-1. Preparing the unit for use

3-2. Creating cellular providers list

3-3. Modes of operation

3-4. Storing your files

4. Technical specifications

5. Troubleshooting

6. Notes



3/14


PLMN - Public Land Mobile Network

IMSI - The International Mobile Subscriber Identity (IMSI) is an internationally standardized unique

number to identify a mobile subscriber. The IMSI is defined in ITU-T Recommendation E.212. The IMSI

consists of a Mobile Country Code (MCC), a Mobile Network Code (MNC) and a Mobile Station

Identification Number (MSIN).

IMEI - The International Mobile Equipment Identity (IMEI) is a unique number used to identify a mobile

station. Identification is used to identify valid devices and ban devices that are lost or stolen from the

network. The IMEI is 15 of 16 decimal digits long. It consists of three parts. The first 8 digits, the TypeApproval Code, are used to identify the model. The next 5 digits are a unique serial number for this type

of device. This is followed by either a 1 digit control code or a 2 digit software version number

ARFCN - The Absolute Radio Frequency Channel Number (ARFCN) is a unique number given to each radio

channel in GSM. The ARFCN can be used to calculate the exact frequency of the radio channel

CRO - Cell Reselect Offset. Value range: 0~63, the corresponding level value: 0~126dB, stepped every 2dB

C2 - After cell selection, MS will reselect another better cell in idle mode. It is C2 parameter that

determines cell reselection.

C1 parameter that indicates the quality of radio channel


Acronyms and abbreviations1


4/14


MCC-500 is a tool aimed to perform analysis of GSM networks

active in certain area and to analyze the RF environment against

a number of predefined parameters.

MCC-500 analyzer unit is managed over Bluetooth interface

using any available Android smartphone.

Max 3 dBi receiving antenna is connected to the MCC-500 unit

using standard SMA male RF connector

Functionality

Collection and recording of information on all GSM cellular providers within any specific coverage area

Collection of information on available BCCH channels for all or selected operators.

Tracking of any selected ARFCN

Analysis of 2 adjacent cells

Detection of fake GSM networks in the area

Displaying collected information on the map Storage of collected information in separate event-based file for further post processing


1- on/off button

2 - on/off indicator

3 - battery discharge indicator

4- power supply connector

5 - battery charging indicator

Indicators and controls

Overview2


5/14


3-1. Preparing the unit for use

1) Switch on both MCC-500 analyzer and managing Android cellphone

2) Run GSM MONITOR application the smartphone

3) Activate the Bluetooth interface

4) Activate GPS (if needed)

5) Press CONNECT button


Main MCC-500 analyzer window Bluetooth connection dialogue Bluetooth and GPS are activated

3-2. Creating cellular providers list

During the first session user shall create a list of available

cellular providers.

Press LIST OF AVAILABLE OPERATORS button and then pressUPDATE LIST button.

The analyzer will start scanning the RF environment and log

data on all available networks.

As soon as the scanning in completed, the list of available

networks will be displayed on a screen.

Functionality and operation3


6/14


3-3. Modes of operation

MCC-500 analyzer supports the following operation modes:

a) Search mode

b) Surveillance mode

c) Tracking mode

d) Neighboring cells analysis

e) Detection of fake networks in the area


a) Search mode

This mode is applied when user needs to find a required Base Station cell with known parameters and

collect information on all available BCCH channels. All information is stored in a separate file as soon as

the required Base Station cell is detected. The following info is displayed on a screen: Operator name,

Channel Number, LAC, Cell ID, Received Signal Strength.

As soon as MCC-500 is logged into required cell, COLLECT BCCH INFORMATION button gets active. By

pressing this button MCC-500 scans the RF environment and collects data on all neighboring cells of all

aoperators in the area. This may take from 2 to 5 minutes depending on situation. In case MCC-500 loses

connection to the required cell, the BTS indicators will go RED. By pressing STOP button user can

terminate current session and store collected data into a separate file.



7/14

www.proximus.com.ua Page 7Document number OTK-201335

b) Surveillance mode

With this this mode real time data on a serving cell and neighboring cells are collected and stored into a

separate file. The result list is being updated 2 times per second and contains the following information:

Channel Number, LAC, Cell ID, neighboring cells power level. To initiate this mode, user shall select GSM

Operator and press START button. When STOP button is pressed, all collected data are automatically stored

as a separate file.



8/14


c) Tracking mode

This mode allows user to control the cell power level based on known ARFCN. All data are displayed on a

screen and stored along with corresponding GPS coordinates. NO SIGNAL message will be displayed in case

the required ARFCN is not present in the area. Collected data can also be used to mark the borders of a

particular cell on the map.



9/14


d) Neighboring cells analysis mode

This mode provides for two neighboring cells analysis. The current location of the MCC-500 unit is

shown on the map, as well as the area created by overlapping cell coverage areas. Collected data are

stored in the memory in cases when MCC-500 unit receives signal from both serving and neighboring

cells.

Prior to running the session user needs to press relevant text fields on the managing cellphone and

manually input base station sector data, then press START. Once the session is over, press STOP button.

Use of Google maps requires Internet connectivity over Wi-Fi or 3G/4G network.



10/14


e) Detection of fake networks in the area (AS Scanner)

MCC-500 unit can be used to detect Cellular IMSI and IMEI catchers or Active

Intercept systems (AS) masquerading as normal GSM network nodes in any

particular area. Prior to using this function user needs to make sure the MCC-

500 unit contains data on PLMN providers actual LAC values. It is

recommended to update this data each time before using AS Scanner mode.

Detection of the AS is performed against several criteria including LAC, C1, C2

and CRO values. To run the unit in this mode, select the Cellular provider and

press START button on a screen. The analysis can be done for one particularoperator at a time. Processing of one request normally takes from 7 to 10

seconds. This means that user will spend minimum 30 seconds to quickly

analyze the RF environment at presence of 3 PLMN provides networks. At the

same time the longer user stays within selected network, the higher detection

accuracy can be achieved. After completing the analysis, user will receive one

of 4 messages, listed below

12

3 4

5 6

7 8

1 - MCC-500 unit did not find any

Active Systems. LAC values are

correct and the CRO value (C1-C2)

is correct

2 - User will hear a warning sound

and view message indicating that

possible Active System is

transmitting in the area and the

CRO value is greater than 20

3 - This message informs that C1

value of the frequency channel is

greater than 60 and there is high

probability of Active System

working in the area

4 - This message indicates that another network operating under different LAC is active in the area. This

could be a sign of either GSM catcher or Active Intercept system

5 - This message informs that C1 value of the frequency channel is greater than 60 and CRO is greater

than 60 and this can indicate on another Active System in the area

6 - This message informs that C1 value of the frequency channel is greater than 60 and CRO is greater

than 60, and LAC values is not correct, this can indicate on another Active System in the area

7 - This message informs that CRO is greater than 60, and LAC values is not correct, this can indicate on

another Active System present in the area

8 - This message informs that C1 value of the frequency channel is greater than 60 and LAC value is not

correct probably another Active System is operating.

http://www.teletopix.org/gsm/what-is-gsm-cell-reselection-and-how-it-workshttp://www.teletopix.org/gsm/what-is-gsm-cell-reselection-and-how-it-workshttp://www.teletopix.org/gsm/what-is-gsm-cell-reselection-and-how-it-workshttp://www.teletopix.org/gsm/what-is-gsm-cell-reselection-and-how-it-works


11/14




3-4. Storing your files

All data processed by MCC-500 analyzer are stored on managing cellular phone SD card

The directory where stored files are located is SD:/GSM/

Operator.scn list of cellular providers

GSM/Scan/ folder contains the following directories, separate for each mode:

SD:/GSM/Scan/Exploring

SD:/GSM/Scan/Find

SD:/GSM/Scan/Tracking

SD:/GSM/Scan/RelatedCells

All files are stored in a text form for further processing in any available office program.


12/14


Parameter Value

Frequency range 900 / 1800 MHz

Sensitivity 900 MHz -107 dBm (typ.) ; 1800 MHz -106 dBm (typ.)

Power consumption (typical values) off-62uA;idle-1,5mA;dedicated mode- 2 W peak power

VSWR absolute max


13/14


Problem Action

The green LED indicator does nor go

GREEN when switched on

This means the battery is fully discharged, please connect

the charging device to the mains power supply

Green and red indicators are on

simultaneously

The battery power is low. Please connect the charging

device

Received is not getting connected to the

managing smartphone (No Connection)

Please check Bluetooth setting on the Android smartphone,

in Wireless Networks section


Troubleshooting5


14/14

Information accuracy

We have made all efforts to ensure the accuracy of the features and techniques presented in this

product overview.

Restricted Rights

You may not reproduce, transmit, transcribe, store in a retrieval system, or translate into any language

or computer language, in any form or by any means, electronic, mechanical, optical, magnetic,

photographic, manual, or otherwise, any part of this publication without the express permission of

Proximus LLC.

Limitations

This document has the following conditions and restrictions:

This document contains proprietary information belonging to Proximus LLC. Such information is

supplied solely for assisting explicitly and properly authorized users. No part of its contents may be

used for any other purpose, disclosed to any person or firm or reproduced by any means, electronic

and mechanical, without the express prior written permission of Proximus LLC. No part or parts of this

document shall be copied, used for commercial purposes or passed to any third party for any use,

without approval of Proximus LLC. The text and graphics are for the purpose of illustration and

reference only. The specifications on which they are based are subject to change without notice.

Notes5

mcc-500 gsm analyzer overview en v 1 final

Documents