【精品】層三信令分析

1、第三層（layer3）信令第三層信令是看網(wǎng)絡(luò)運行情況的信息層，從第三層可以看到網(wǎng)絡(luò)的個利動作：如：呼叫 流程、擁塞、用戶忙、位置更新等，系統(tǒng)信息總共冇8個類型，type 1-4只出現(xiàn)在待機(jī)狀 態(tài)卜type58只出現(xiàn)在通話狀態(tài)21、system information type 1 essa.ge detailsa msisystem information type 1time: 18:25:49.36latitude: n 2312.3120longitude: e 11 31 5.471 0speed : 0.000000frame number: 1 78304read from (ar

2、fcn): 86l2 pseudo length: 21cell channel descriptioncell allocationformat notation: bit map 0arfcn:1 9 28 58 74 86 95rach control parametersmax retransmissions: 1t x-integer: 1 2cell bar access: not barredcall reestablishmentre： not allowed emergency call (ec) allowed: all msnot barred class(es) (ac

3、c): 0 1 2 3 4 5 6 7 8911 12131415si 1 rest octets contains spare bitsmessage dump:00 56 55 06 1 9 00 00 00 00 4020 02 00 02 00 00 00 08 04 0000 25 00 00 2b小區(qū)廣播信息，有該小區(qū)自身的頻點，rach的一些參數(shù)設(shè)置，祥見上圖。2、system information type2essage detailsms1system information type 2time: 14:08:32.60latitude: n 2312.3860longi

4、tude: e 11315.2610speed: 0.000000frame number: 1913987read from (arfcn): 79l2 pseudo length: 22neighbor cells descriptionba-ind: 1ext-ind: 0bcch allocationformat ncitation: bit map 0arfcn:248121471 84 86 90 92ncc permitted: 252 (allowed ncc=251)rach control parametersmax retransmissicm: 2t x-integer

5、: 12cell bar access: not barredcall reestablishment (re): not allowed emergency call (ec) allowed: all msnot barred class(es) (acc): 01 2 3 4 5 6 78911 12131415待機(jī)模式下小區(qū)的測雖頻點，（同頻段，移動網(wǎng)冇兩個頻段，gsm900和dcs1800）,在通話模式下有另外定義的測量頻點，也就是說一個小區(qū)可以在待機(jī)吋做測量頻點，而通話 時不做測量頻點，允許小區(qū)重選而不允許切換，反之也可以只允許切換不允許小區(qū)重選也可 以，不過通常情況卜-待機(jī)和通話

6、時的測量頻點是一致的。3、system information type2terlessage details回msiasystem information type 2tertime: 14:08:31.65latitude: n 2312.3860longitude: e 11315.2610speed: 0.000000frame number: 1913783read from (arfcn): 79再l2 pseudo length: 0neighbor cells description 2multiband reporting: 3ba-ind: 1bcch allocation

7、format notation: variable bit maparfcn:514 539 545 552 554 556si 2ler rest octets contains spare bits待機(jī)模式下小區(qū)的測雖頻點，（異頻段，移動網(wǎng)冇兩個頻段，gsm900和dcs1800）,4、system information type 3essage detailsms1system information type 3time: 14:08:31.89latitude: n 2312.3860longitude: e 11315.2610speed: 0.000000frame numbe

8、r: 1913834read from (arfcn): 79l2 pseudo length: 18cell identity: 33281 (8201 hex)location area identificationmobile country code (mcc): 460mobile nehwrk code (mnc): 00location area code (lac)； 9494 (2516 hex)control channel descriptionattach/detach allowed (att): yesbs-ag-blks-res: 1ccch-conf: 1 ba

9、sic physical channel not combined with sdcch'sbs-pa-mfrms: 5 multiframes periodt 3212 timeout value: 10cell options(bcch)power control indicator (pwrc): not setdtx indicator: ms shall use uplink discontinuous transmissionradio-link-timeout: 32cell selection parameterscell-reselect hysteresis: 8

10、db rxlevmstxfwrmaxcch: 5rxlev-access-min: 11rach control parametersmax retransmissions: 2t x-intege 匚 12cell bar access: not barredcall reestablishment (re): not allowedemergency call (ec) allowed: all msnot barred class(es) (acc): 0 1 2 3 4 5 6 78911 12131415si 3 rest octetscell reselect parameters

11、 in dication (pi): c2 parameters presentcell bar qualify (cbqj; 0if cell bar access = 0cell seleclion priority: normalstatus for cell reselection: normalelsecell selection priority: barredstatus for cell reselection: barredcell reselection offset: 0 dbtemporary offset: 0 dbpenalty time: 20 $power of

12、fset indication (poi): power offset parameter not presentearly sending: explicit# acceptedsystem information 2ter: available小區(qū)廣播信息，可以看到att、t3212、acc、cro> crh以及accmin等，祥見上圖5、system information type 4essage detailsms1system information type 4time: 14:08:31.18latitude: n 2312.3860longitude: e 11315.

13、2610speed: 0.000000frame number: 1913681read from (arfcn): 79l2 pseudo length: 16location area identificationmobile country code (mcc): 460mobile network code (mnc): 00location area code (uc): 9494 (2516 hex)cell selection parameterscell-re select hysteresis: 8 db rxlevmsjxfwr-max-cch: 5additional r

14、eselect param ind (acs)the si 4 rest octets, if present, shall be used to derive thevalue of pi and possibly c2 parameters and/or other parametershalf rate support (neci):new establishment causes are supported rxlev-access-min: 11rach control parametersmax retransmissions: 2t x-integer: 12cell bar a

15、ccess: not barredcall reestablishment (re): not allowedemergency call (ec) allowed: all msnot barred class(es) (acc): 01 2 3 4 5 6 78911 12131415channel descriptionchannel type: sdcch/8 + sacch/c8 or cbch (sdcch/8) subchannel number: 2timeslot number (tn): 2tvining sequence code (tsc): 4hopping chan

16、nel: single rf channel fb-no:bandoabsolute rf channel number (arfcn): 79si 4 rest octetscell reselect parameters indicationi): c2 parameters presenthcell bar qualify (cbq): 0if cell bar access = 0cell selection priority: normalstatus for cell reselection: normalelsecell selection priority: barredsta

17、tus for cell reselection: barredcell reselection offset: 0 dbtemporary offset: 0 dbpenalty time: 20 $power offset indication (poi): power offset parameter not present小區(qū)廣播信息，在這里可以看到小區(qū)的crh、cro、accmin、maxret、cb、cbq、pt 等一些參數(shù)的設(shè)置值，祥見上圖。6 system information type 5激活模式下服務(wù)小區(qū)測量頻點，（同頻段，移動網(wǎng)冇兩個頻段，gsm900和dcs1800）

18、 只有服務(wù)小區(qū)有做該小區(qū)的測量頻點，才會測量到該小區(qū)的信號，否則在鄰區(qū)列表屮不會看 到該小區(qū)，也不會切換。在我們平時路測當(dāng)屮，經(jīng)常遇到強(qiáng)信號不切換，如果做了測暈頻點, 可以很明了地看到冇一個強(qiáng)的鄰區(qū)信號，但是要是沒冇做測量頻點的話就比較隱性。7、system information type 5ter激活模式下服務(wù)小區(qū)的測量頻點，（界頻段，移動網(wǎng)有兩個頻段，gsm900和dcs1800）8、system information type 6essage detailsms1system information type 6time: 14:10:55.40latitude: n 2312.38

19、40longitude: e 11315.2620speed: 0.000000frame number: 1944908cell identity: 33281 (8201 hex)location area identificationmobile country code (mcc): 460mobile network code (mnc): 00location area code (lac)； 9494 (2516 hex)cell options(sacch)pover control indicator (fv/rc): not setdtx indicator:the ms

20、shall use uplink discontinuous smission on a tch-f the ms shall use uplink discontinuous transmission on tch-h radio-link-timeout- 32ncc permitted: 252 (allowed ncc=251)si 6 rest octets contaispare bits通話狀態(tài)下面服務(wù)小區(qū)的一些信息，他跟typel冇點相彖，還可以看到ncc permitted;9、system information type 7暫時沒有見過。10、system informa

21、tion type 8 暫吋沒有見過。11、paging requst type 1圉 layer 3i匚回岡sourcedirec.messagei g 'msidownlinksystwm information type 4:msidownlinkpaging request type 2msidownlinksystwm information typg 3msidownlinkpaging request type 3msidownlinkpaging request type 1msidownlinkpaging request type 1msidownlinksynch

22、 channel information：m31downlinkpaging request type 2psidownlinksystem information type 3msidownlinkpaging request type 1vtlllcio一 p t- 1essageailsms1paging request type 2time: 14:08:23.24latitude: n 2312.3870longitude: e 11315.2610speed: 0.000000frame number* 1911961l2 pseudo length: 21page mode: n

23、ormal pagingchan riels needed for mobiles可以看到，在信令里血，paging的信令出現(xiàn)次數(shù)特別多，原因是網(wǎng)絡(luò)對手機(jī)尋呼是對一 個位進(jìn)區(qū)內(nèi)進(jìn)行尋呼的，只有當(dāng)手機(jī)解開這條信息才會作出響應(yīng)。12.synch channel informationessage detailsms1synch channel informationtime: 14:10:38.74latitude: n 2312.3840longitude: e 11315.2620speed: 0.000000frame number: 1941307read from (arfcn): 14

24、frame offset: 104644t $0 quarter bit offset: 8688old style decodingread from (arfcn): 14frame offset: 104644t $0 quarter bit offset: 8688bsic: 57t1:1542t2:7t3':3同步信息，在待機(jī)狀態(tài)和通話狀態(tài)都會出現(xiàn)，數(shù)字通信當(dāng)小，同步是最基本也是最重要 的，跟鄰區(qū)也需要同步。13、 其他：掉話：£ layer 3口回區(qū)source direcmsi msi msi msi msi msi msi msi msi msi msi ms

25、i msi msi msi msi msi msiuplinkdownlinkuplinkdownlinkuplinkdownlinkuplinkuplinkuplinkuplinkuplinkuplinkuplinkuplinkdownlinkuplinkuplinkmessagemeasurement report synch channel information measurement reportsynch channel information measurement reportsynch channel information measurementmeasurement me

26、asurement measurement measurement measurement measurement measurement synch channel information measurement report measurement reporreport report reportreport reportreport直接從邑話狀態(tài)返回！ j待機(jī)狀新report 正常的話有channel ifchease信令reportupli一mwdbutpitfstrr rep3dotwoxink downlinir downlink downlink downlink downli

27、nk downlinkl iti system system system system system c.x 壬nfwm informati on information informati on information informationw mb obsystem information typeype type type type type type43334位置更新rs layer 3口回岡sourcedi rec.message-msidownlinksyetqm information typw 2imsiuplinkchannel reques tmsidownlinkpag

28、ing request type 1msidownlinkpaging request type 1msidownlinkpaging request type 1msidownlinkpaging request type 1msidownlinkpaging request type 2msidownlinksystem information typ© 3msidownlinkimmedi atw assi grimentmsiuplinkluocan on up aai, 1 ng rle que s t1msiuplinkclassmark changemsidownlin

29、ksystem information type 5正常位msidownlinkauthentication requestmsiuplinkautheiit 1 catl oh. re sp ons emsidownlinkinformation type 51msiuplinkmeasurement reportmsidownlinklocation updaaccept 1msiuplinkmeasui'ement rep l丿1msidownlinkchannel releasemsidownlinksystem information type 4msidownlinksys

30、tem information type 3msidownlinksystem information type 2msidownlinksy£twm information type 3msidownlinksystem information tjqpe 4msidownlinksystem information type 1msidownlinkpaging request type 1il更新時的信令切換messagedownlink system inforrztion type 61ms1msiims1msimsimsi川sidownlink handover comm

31、and uplinkdownlinkuplinkdownlinkdownlinkdownlinkhandover accesshandover completejtysical information physical information system information typ.切換信令essage detailsms1handover commandtime: 13:22:54.64handover command里面: 小區(qū)的信息，有該小區(qū)£ 方式、跳頻序列號以及其他到的信息是目標(biāo) 有的頻點.跳頻 播信息（祥見右圖）latitude: n 2312.1070l:llon

32、gitude: e 11321.8540speed: 18.571444frame number: 728649cell descriptionplmn colour code (ncc): 3bs colour code (bcc): 2bcch arfcn: 539channel descriptionchannel type: tch/f + acchstimeslot number (tn): 4t raining sequence code (tsc): 2hopping channel: rf hopping channelmobile allocation index offse

33、t (maio): 0hopping sequence number (hsn): 19handover referenee value: 97power level: 0synchronization indication (si): non-synchro門izedreport observed time differenee (rot): mobile time difference ie shall not be includecnormal cell indicalion (nci): out of range timing advance is ignoredfrequency l

34、ist after timeformat notation: variable bit maparfcn:526 531 539 546 559 576測量報告measurement resultsrxlev-fu ll-s e rvin g: 40 rxlev-sub-serving: 39 rxq u al-fu ll-s e r vin g: 1 rxqualsub-serving: 0 ba-used: 0 dtx: usedmeasurement results (meas-valid): valid number of neighboring cell measurements:

35、6 ncell rxlev-ncell1 632 633 594 435 426 39123456bsic-ncell504637325433message dump:服務(wù)小區(qū)信號質(zhì)量bcch-freq-ncell1505 110003016個鄰區(qū)信號質(zhì)量sowrcft i direcmessagemsidownlink system informati on type sterms1msimsimsimsimsimsidownlink uplink downlink uplink downlink uplink downlinkreportcommandaccessinformati onc

36、ompleteinformati on ess&ce deta,ilmessage dump:faessae1面bcch-freq-ncell000000000000bsic-ncell000000000000msimeasurement reporttime: 13:22:55.57latitude: n 2312.1220 longitude: e 11321 8510 speed : 19.343111 frame number: 409086鎖溜舉measurement resultsrxlev-fu ll-s e rvin g: 40rxlev-sub-serving: 39

37、rxq ual-fu ll-s e rvin g: 0rxq ual-s u b -s e rvin g: 3ba-used: 0dtx: not usedmeasurement results （meas-valid）: validnumber of neighboring cell measurements: information not available ncell rxlev-ncell1 002 003 004 005 006 00sour-cedirecmsidownlinkmsiuplinkmsidownlinkmsiupl i nkmsidownlinkmsidownlir

38、dkmsidownlinkmsiuplinkimsidownlirikss layer 3handover commandhandover accessphysi cal informati on handover completephysi cal informati on fhysi cal informati on system 工nformaiti on typesystern informati on type 6在這.里說說鎖頻和強(qiáng)制切換的原理，平時我們測試中經(jīng)常會用到鎖頻和強(qiáng)制切換，這些操作是不需耍網(wǎng)絡(luò)動作的，只是由手機(jī)來完成，而手機(jī)是怎樣完成的呢？就是通過改變測量報告。當(dāng)測試人

39、員點擊鎖頻或者強(qiáng)制切換命令，手機(jī)會停止對英他頻點的測量，只是上傳測試人員鎖定的頻點的測量報告，其他頻點不進(jìn)行上傳，如上圖所示，所以網(wǎng)絡(luò)會認(rèn)為手機(jī)就 只收到該信號從而如果是服務(wù)小區(qū)就會鎖頻，如果是鄰區(qū)網(wǎng)絡(luò)就會進(jìn)行切換。channel release信令里面的cause （事件號）對應(yīng)的網(wǎng)絡(luò)發(fā)生的事情，在這里我們可以看 到很多網(wǎng)絡(luò)釋放的原因，例如：我們平時測試時，在被叫手機(jī)沒有人接聽或者正在通話的情 況下，就會統(tǒng)計成-次連接失敗，如果我們在報告里血僅僅用文字表達(dá)的話，說服力不強(qiáng),但是要是在報告里而能說明cause是17、19的話就很容易說服別人，還有擁塞也町以在信 令里面看到cause是34,除次

40、以外還有很多cause,可以看下表：編巧原因13616171819212226272829unassiagned number （未分配的號碼（空號）no route to destination（無至目的地的路由）channel unacceptable （不可接受的信道）normal clearing （ie常清除）user busy （用戶忙）no user responding（無用戶響應(yīng)）user alerting,no answer（已有用戶提醒,但無應(yīng)答）call rcjcctcd（呼叫拒絕）number changed（兮碼改變）non selected user cleari

41、ng（iff 除未選擇的用戶）destination out of order（終點故障）incomplete number（無效號碼格式（不完全的號碼）facility rcjcctcd（設(shè)施被拒絕）response to status enquiry（對狀態(tài)詢問的響應(yīng)）normal,unspecified（正常,未規(guī)定）no circuit/channel available（無電路/信道可用）network out of order（網(wǎng)絡(luò)故障）temporary failure（臨時故障）switching equipment congestion（交換設(shè)備擁塞）access information discardcd（接入信息被丟棄）requested circuit/channcl not available（請求的電路/信道不可用）resources unavailable,unspecified（資源不可用,未規(guī)定）quality of service unavailable（服務(wù)質(zhì)