summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTom2012-06-11 07:51:12 +0200
committerTom2012-06-11 07:51:12 +0200
commit80a6bc8ab8c3105b7c71967aa0a9069ba925833d (patch)
tree89f7911ca112702bbe5dc5b018afff458fee4e06
parentnochmal versuchen (diff)
downloadimsi-catcher-detection-80a6bc8ab8c3105b7c71967aa0a9069ba925833d.tar.gz
imsi-catcher-detection-80a6bc8ab8c3105b7c71967aa0a9069ba925833d.tar.xz
imsi-catcher-detection-80a6bc8ab8c3105b7c71967aa0a9069ba925833d.zip
feddich
-rw-r--r--Tex/Content/Appendix.tex19
-rw-r--r--Tex/Content/Appendix.tex~423
-rw-r--r--Tex/Content/Conclusion.tex50
-rw-r--r--Tex/Content/Conclusion.tex~73
-rw-r--r--Tex/Content/Detection.tex365
-rw-r--r--Tex/Content/Detection.tex~812
-rw-r--r--Tex/Content/Evaluation.tex144
-rw-r--r--Tex/Content/Evaluation.tex~428
-rw-r--r--Tex/Content/GSM_short.tex99
-rw-r--r--Tex/Content/GSM_short.tex~850
-rw-r--r--Tex/Images/databases_window.pngbin32892 -> 32609 bytes
-rw-r--r--Tex/Images/filter_window.pngbin12549 -> 13307 bytes
-rw-r--r--Tex/Images/pch_window.pngbin12162 -> 15604 bytes
-rw-r--r--Tex/Images/rules_window.pngbin29141 -> 26421 bytes
-rw-r--r--Tex/Master/Master.acn1409
-rw-r--r--Tex/Master/Master.acr372
-rw-r--r--Tex/Master/Master.alg6
-rw-r--r--Tex/Master/Master.aux196
-rw-r--r--Tex/Master/Master.lof20
-rw-r--r--Tex/Master/Master.log1588
-rw-r--r--Tex/Master/Master.lot24
-rw-r--r--Tex/Master/Master.pdfbin16646364 -> 20418983 bytes
-rw-r--r--Tex/Master/Master.tex2
-rw-r--r--Tex/Master/Master.tex~171
-rw-r--r--Tex/Master/Master.toc86
25 files changed, 4785 insertions, 2352 deletions
diff --git a/Tex/Content/Appendix.tex b/Tex/Content/Appendix.tex
index 4aa96b9..198a86e 100644
--- a/Tex/Content/Appendix.tex
+++ b/Tex/Content/Appendix.tex
@@ -282,13 +282,14 @@ DB_RX_threshold = 0.05
CH_RX_threshold = 0.02
#-------------Continues on next page---------------------
-
-
\end{lstlisting}
\end{minipage}\\\\
\hspace*{\dimexpr\fboxsep+\fboxrule}%
\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
\begin{lstlisting}
+#How many neighbours need to be discovered
+Neighbours_threshold = 3
+
#How much Pagings per 10s are required to give an Ok
#rating
Pagings_per_10s_threshold = 20
@@ -313,16 +314,12 @@ USR_timeout = 15
Rule_Groups = [
['Provider Check', 'Country Provider Mapping',
- 'ARFCN Mapping', 'LAC Mapping', 'Unique CellID'],
-
+ 'ARFCN Mapping', 'LAC Mapping', 'Unique CellID'],
['LAC Median Deviation', 'Neighbourhood Structure',
'Pure Neighbourhoods', 'Fully Discovered
- Neighbourhoods'],
-
- ['Local Area Database','CellID Database'],
-
- ['LAC Change Rule','rx Change Rule'],
-
+ Neighbourhoods'],
+ ['Local Area Database','CellID Database'],
+ ['LAC Change Rule','rx Change Rule'],
['PCH Scan']
]
@@ -418,4 +415,4 @@ Neighbours &806, 815, 817, &806, 815, 817, \\
\bottomrule
\end{tabular}
\caption{Configurations used for the Database Rules test.}
-\end{table} \ No newline at end of file
+\end{table}
diff --git a/Tex/Content/Appendix.tex~ b/Tex/Content/Appendix.tex~
new file mode 100644
index 0000000..30bfbce
--- /dev/null
+++ b/Tex/Content/Appendix.tex~
@@ -0,0 +1,423 @@
+\chapter{GSM}
+\section{Interfaces}
+\label{sec:interfaces}
+The following table contains a brief description of the interfaces used inside a GSM network.
+On the upper part the interfaces for the Network Subsystem are listed and on the lower part the interfaces for the Base Station Subsystem can be found.
+
+\begin{table}[h!]
+\centering
+\begin{tabular}{lll}
+\toprule
+Name &Between &Function\\
+\midrule
+$A$ &MSC $\leftrightarrow$ BSS &BSS management data for Mobility Management\\
+ & &and Call Control\\
+$B$ &MSC $\leftrightarrow$ VLR &MSC receives data about MSs in the current area\\
+ & & and sends data from Location Updates\\
+$C$ &MSC $\leftrightarrow$ HLR &MSC can request routing data during call setup\\
+ & &and send \eg charging information\\
+$D$ &HLR $\leftrightarrow$ VLR &Exchange of location-dependent subscriber data\\
+ & &and updating the HLR (MSRN \etc)\\
+$E$ &MSC $\leftrightarrow$ MSC &Executing a Handover when subscriber changes\\
+ & &to a new MSC\\
+$F$ &MSC $\leftrightarrow$ EIR &Checking white-/grey- and blacklists before\\
+ & &giving access to the network\\
+$G$ &VLR $\leftrightarrow$ VLR &Connects VLR of different MSCs to exchange\\
+ & &subscriber data during a handover\\
+\midrule
+$A_\text{bis}$ &BSC $\leftrightarrow$ BTS &BSC receives data from MS via the BTS\\
+$U_m$ &BTS $\leftrightarrow$ MS &Registration procedure, call data \etc as well\\
+ & &as broadcast information about the network\\
+ & &and the base station\\
+\bottomrule
+\end{tabular}
+\caption{Interface found in the GSM network.}
+\end{table}
+
+\newpage
+\section{Channel Combinations}
+\label{sec:combinations}
+The following table contains the possible combinations of channels inside the different Multiframes.
+The respective frame type is also indicated in the lower part of the table.
+\begin{table}[h!]
+\centering
+\begin{tabular}{lccccccccc}
+\toprule
+ &M1&M2&M3&M4&M5&M6&M7&M8&M9\\
+\midrule
+TCH/F &\cellcolor[gray]{0.7}&&&&&&&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}\\
+TCH/H &&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&&&&&&\\
+TCH/H &&&\cellcolor[gray]{0.7}&&&&&&\\
+BCCH &&&&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&&&\\
+FCCH &&&&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&&&&\\
+SCH &&&&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&&&&\\
+CCCH &&&&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&&&\\
+SDCCH &&&&&\cellcolor[gray]{0.7}&&\cellcolor[gray]{0.7}&&\\
+SACCH &\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&&\cellcolor[gray]{0.7}&&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}\\
+FACCH &\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&\cellcolor[gray]{0.7}&&&&&\cellcolor[gray]{0.7}&\\
+\midrule
+Multiframe Type &26&26&26&51&51&51&51&26&26\\
+\bottomrule
+\end{tabular}
+\caption{Possible mappings of channels onto Multiframes}
+\end{table}
+
+\chapter{OsmocomBB}
+This section contains general information about how to operate and setup the OsmocomBB framework and the Motorola C123.
+\section{Installation}
+\label{sec:osmo_install}
+The environment used for this project was a Thinkpad X220 Tablet running Xubuntu Linux 11.10.
+The instructions should work for any other distribution of the Ubuntu product palette.
+
+\begin{enumerate}
+ \item Build libraries must be installed on the operating system to enable compiling libraries.
+\begin{verbatim}
+sudo apt-get install libtool shtool autoconf git-core
+pkg-config make gcc wget
+\end{verbatim}
+ \item The GNU Arm cross compiler toolchain needs to be installed so the firmware for the Motorola C123 can be built.
+ It will be added as a repository to \texttt{sources} so it can be easily removed if it is not required any more.
+ \begin{verbatim}
+sudo add-apt-repository ppa:bdrung/bsprak
+sudo apt-get update
+sudo apt-get install arm-elf-toolchain
+ \end{verbatim}
+ \item The source code needs to be obtained.
+ This can be either done by checking out the latest version of the framework from the developers, or by using the code on the CD.
+\begin{verbatim}
+git clone git://git.osmocom.org/osmocom-bb.git
+\end{verbatim}
+ \item At this point some firmwares had build errors, therefore we will compile only the firmware for the Calypso board used by the Motorola C123.
+ This constraint might not be necessary if a newer version of the framework is used.
+ In the \texttt{src} directory of the OsmocomBB framework the build process can be started.
+ \begin{verbatim}
+make BOARDS=compal_e88
+ \end{verbatim}
+ \item If a new version of OsmocomBB is used, the extra code from this project must be included in the build.
+ The three files \texttt{catcher.c}, \texttt{app\_catcher.c} and \texttt{pch\_scan.c} must be moved to \path{osmocom-bb/src/host/layer23/src/misc} and the \texttt{Makefile.am} must be edited to include the new code.
+ \begin{verbatim}
+bin_PROGRAMS = bcch_scan ... cbch_sniff catcher \
+ pch_scan
+catcher_LDADD = $(LDADD) -lm
+catcher_SOURCES = ../common/main.c app_catcher.c \
+ catcher.c ../../../gsmmap/geo.c
+pch_scan_SOURCES = ../common/main.c pch_scan.c rslms.c
+ \end{verbatim}
+\end{enumerate}
+
+\section{Usage}
+\label{sec:osmo_usage}
+To use a program written in the framework, the Motorola C123 needs to be flashed with the custom firmware.
+This can be done with the \texttt{osmocon} application.
+\begin{verbatim}
+cd src/host/osmocon
+
+sudo ./osmocon -p /dev/ttyUSB0 -m c123xor
+../../target/firmware/board/compal_e88/layer1.compalram.bin
+\end{verbatim}
+After \texttt{osmocon} is started and running any application can be started with root privileges.
+\begin{verbatim}
+cd ../layer23/src/misc/
+sudo ./catcher
+\end{verbatim}
+The \texttt{pch\_scan} program requires an ARFCN as an input.
+For example, to conduct a scan on the PCH of ARFCN 127 one would call:
+\begin{verbatim}
+sudo ./pch_scan -a 127
+\end{verbatim}
+\newpage
+
+\section{Serial Cable Schematics}
+\label{sec:osmo_serial_schematics}
+A T191 unlock cable used to connect the Motorola C123 can either be obtained by ordering it from one of the mentioned stores or by building it from scratch.
+These are the schematics required for building the unlock cable taken from a GSM Blog \footnote{GSM Box Schematics, \url{http://gsmringtonefree.blogspot.de/} [Online; Accessed 05.2012]}, which features images of many more cables for different brands.
+\vfill
+\begin{figure}[h!]
+\includegraphics[width=.9\textwidth]{../Images/t191cable}
+\caption{Serial cable schematics.}
+\end{figure}
+\vfill
+\chapter{IMSI Catcher Detection System}
+This section will cover some code related topics of the ICDS.
+
+\section{Extextions}
+\label{sec:extensions}
+Rules, evaluators and filters are implemented in a way that new modules can be added quickly by way of inheritance and instantiating them in the constructor of the controller so they are known to the system.
+The following example shows how to implement a new rule and add it to the system.
+This exemplary process is nearly the same for filters and evaluators.
+
+At first this base class has to be derived.\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
+class Rule:
+ #set whether the rule should be used by the
+ #controller
+ is_active = False
+ #string that will identify the rule in the report
+ identifier = 'Rule'
+
+ #the logic of the rule, will be called by controller
+ def check(self, arfcn, base_station_list):
+ return RuleResult.CRITICAL
+\end{lstlisting}
+\end{minipage}\\\\
+
+The new rule class needs to override the check method to do something meaningful.
+The identifier should also be set to a proper value.\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
+class MyRule (Rule):
+ identifier = 'My own Rule'
+ def check(self,arfcn, base_station_list):
+ result = RuleResult.CRITICAL
+ #do some logic here and set result
+ return result
+\end{lstlisting}
+\end{minipage}\\\\
+\texttt{arfcn} and \texttt{base\_station\_list} are given to the check method by the controller.
+The first parameter is the ARFCN of the base station to which the evaluation will be applied.
+The second one is a list of all the base stations with complete information as far as it has been
+obtained by the ICDS.
+After it has been implemented it can be instantiated and added to the list of active rules in the
+constructor of the controller.\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
+class PyCatcherController:
+ ...
+ def __init__ (self):
+ ...
+ self.my_rule = MyRule()
+ self.my_rule.is_active = True
+ self._rules.add(self._my_rule)
+ ...
+\end{lstlisting}
+\end{minipage}
+\newpage
+\section{Example Configuration}
+\label{sec:example_config}
+This example configuration has been used for the evaluation in the Freiburg area.\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
+#Core Configuration -----------------------------------
+
+#Settings for the Motorola C123 .
+Device_settings = { 'mobile_device' : '/dev/ttyUSB0',
+ 'xor_type' : 'c123xor',
+ 'firmware' : 'compal_e88',
+ }
+
+#Location of the osmocom library.
+Osmocon_lib = '''/home/tom/imsi-catcher-detection/Src/
+osmolib/src'''
+
+#Generates commands from location and device settings.
+#Does normally not have to be edited.
+Commands = {'osmocon_command' : [Osmocon_lib +
+ '/host/osmocon/osmocon',
+ '-p', Device_settings['mobile_device'],
+ '-m', Device_settings['xor_type'],
+ Osmocon_lib + '/target/firmware/board/'
+ + Device_settings['firmware']
+ + '/layer1.compalram.bin'],
+ 'scan_command' : [Osmocon_lib
+ + '/host/layer23/src/misc/catcher'],
+ 'pch_command' : [Osmocon_lib
+ + '/host/layer23/src/misc/pch_scan'],
+}
+
+#Rules Configuration ------------------------------------
+
+#A list of providers that should be taken as legitimate.
+Provider_list = ['T-Mobile', 'O2', 'Vodafone', 'E-Plus']
+
+
+
+#-----------Continues on next page-----------------------
+\end{lstlisting}
+\end{minipage}\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
+#Countries where the given providers have presence.
+Provider_Country_list = {
+ 'T-Mobile':'Germany',
+ 'O2':'Germany',
+ 'Vodafone':'Germany',
+ 'E-Plus':'Germany'
+}
+
+#Comma separated list of LACs that can be observed in the
+#given area.
+LAC_mapping = {
+ 'T-Mobile' : [21014,21015],
+ 'O2' : [50945],
+ 'Vodafone' : [793],
+ 'E-Plus' : [138,588]
+}
+
+#Frequency intervals that are registered to the
+#given providers.
+ARFCN_mapping = {
+ 'T-Mobile' : [(13,49),(81, 102),(122,124),(587,611)],
+ 'O2' : [(0,0),(1000,1023),(637,723)],
+ 'Vodafone' : [(1,12),(50,80),(103,121),(725,751)],
+ 'E-Plus' : [(975,999),(777,863)]
+}
+
+#How much % the LAC of a base station can deviate from
+#the median before throwing an error (range 0 to 1 where
+#0 means no tolerance).
+LAC_threshold = 0
+
+#How much % the rx level is allowed to be away from the
+#interval located in the Location Area Database
+DB_RX_threshold = 0.05
+
+#How much % the rx is allowed to change during the course
+#of a scan.
+CH_RX_threshold = 0.02
+
+#-------------Continues on next page---------------------
+\end{lstlisting}
+\end{minipage}\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
+#How many neighbours need to be discovered
+Neighbours_threshold = 3
+
+#How much Pagings per 10s are required to give an Ok
+#rating
+Pagings_per_10s_threshold = 20
+
+#How many hopping assignments are required to give
+#an Ok rating
+Assignment_limit = 0
+
+#PCH Parameters -----------------------------------------
+
+#How often a failed PCH scan should retry
+PCH_retries = 5
+
+#Time the PCH is scanned during Operation in
+#User Mode
+USR_timeout = 15
+
+#Evaluator Configuration -------------------------------
+
+#This configuration separates the different groups of
+#rules from one another.
+
+#-------------Continues on next page---------------------
+\end{lstlisting}
+\end{minipage}\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
+
+Rule_Groups = [
+ ['Provider Check', 'Country Provider Mapping',
+ 'ARFCN Mapping', 'LAC Mapping', 'Unique CellID'],
+
+ ['LAC Median Deviation', 'Neighbourhood Structure',
+ 'Pure Neighbourhoods', 'Fully Discovered
+ Neighbourhoods'],
+
+ ['Local Area Database','CellID Database'],
+
+ ['LAC Change Rule','rx Change Rule'],
+
+ ['PCH Scan']
+]
+
+#Database Configuration --------------------------------
+
+#The API key for OpenCellID.
+#Can be freely obtained by registering on the web site.
+Open_Cell_ID_Key = 'd7a5bc3f21b44d4bf93d1ec2b3f83dc4'
+
+#Path to the folder where databases should be saved to or
+#loaded from. The ICDS will look in this folder if data-
+#bases are available.
+Database_path = '''/home/tom/imsi-catcher-detection/Src
+/PyCatcher/Databases/'''
+\end{lstlisting}
+\end{minipage}
+
+\chapter{System Information}
+\label{sec:system_infos}
+The following pages contain parsed System Information Messages of type 1--4 for reference \cite{protocols1999}.
+\begin{figure}
+\centering
+\includegraphics[width=.9\textwidth]{../Images/sysinfo1}
+\caption{System Information 1 Message}
+\end{figure}
+\begin{figure}
+\centering
+\includegraphics[width=.9\textwidth]{../Images/sysinfo2}
+\caption{System Information 2 Message}
+\end{figure}
+\begin{figure}
+\centering
+\includegraphics[width=.9\textwidth]{../Images/sysinfo3}
+\caption{System Information 3 Message}
+\end{figure}
+\begin{figure}
+\centering
+\includegraphics[width=.9\textwidth]{../Images/sysinfo4}
+\caption{System Information 4 Message}
+\end{figure}
+\chapter{Evaluation Data}
+\section{Rx and LAC Change Test}
+\label{sec:lac_change_test}
+The following table contains the two configurations that have been used to test the LAC Change and rx Change Rules.
+Config 6 is identical to the configuration used on the base station and thus only triggers the rx Change Rule.
+Config 5 has a different LAC than the original base station and thus was used to test the former one.
+Additionally the rx Change Rule is also triggered for this configuration.
+\begin{table}[h!]
+\centering
+\begin{tabular}{lll}
+\toprule
+ &Config 5 &Config 6\\
+\midrule
+ARFCN &877 &877\\
+ShortName &23 &23\\
+MCC &262 &262\\
+MNC &23 &23\\
+LAC &666 &4711\\
+Cell ID &1800 &1800\\
+Neighbours &806, 815, 817, &806, 815, 817, \\
+ & 818, 823, 880 &818, 823, 880 \\
+\bottomrule
+\end{tabular}
+\caption{Configurations used for the rx\,/\,LAC Change Rules test.}
+\end{table}
+\newpage
+\section{Database Rules Test}
+\label{sec:long_term_test}
+The following table contains the two configurations used to test the Database Rules.
+Config 6 is the same as before.
+It is used to check whether the Local Area Database Rule can find the difference in reception for the replaced base station.
+Config 7 features a new CID and is thus used to check if the Cell ID Database Rule is operating correctly.
+\begin{table}[h!]
+\centering
+\begin{tabular}{lll}
+\toprule
+ &Config 6 &Config 7\\
+\midrule
+ARFCN &877 &877\\
+ShortName &23 &23\\
+MCC &262 &262\\
+MNC &23 &23\\
+LAC &4711 &4711\\
+Cell ID &1800 &666\\
+Neighbours &806, 815, 817, &806, 815, 817, \\
+ & 818, 823, 880 &818, 823, 880 \\
+\bottomrule
+\end{tabular}
+\caption{Configurations used for the Database Rules test.}
+\end{table}
diff --git a/Tex/Content/Conclusion.tex b/Tex/Content/Conclusion.tex
index 3a590b5..c998314 100644
--- a/Tex/Content/Conclusion.tex
+++ b/Tex/Content/Conclusion.tex
@@ -4,22 +4,22 @@ The first section starts by reviewing what has been done while the second sectio
\section{Summary}
The aim of this project was to find ways of unveiling whether an IMSI catcher is being operated in the close perimeter or not.
-In other words to find out if it is safe to connect to the GSM network.
+In other words whether it is safe to connect to the \gls{gsm} network and place phone calls or not.
An unsafe environment could result in IMSI numbers being requested and saved by IMSI catchers or in phone calls being recorded.
-The main premise that distinguishes this project from other similar projects like the also OsmocomBB based 'Catcher Catcher' is that the system is operating in a completely passive manner.
+The main premise that distinguishes this project from other similar projects like the also OsmocomBB based 'Catcher Catcher', is that the system is operating in a completely passive manner.
Therefore it can only work on a limited amount of information, namely on information that is broadcasted on publicly available channels.
The benefit this yields over other projects is that the IMSI Catcher Detection System itself is completely invisible to the IMSI catcher.
Chapter 2 laid out basic concepts of \gls{gsm} communication to create a basis for understanding why and how an IMSI catcher works.
Some more detailed concepts on the $U_m$ interface were discussed to enable the reader to grasp the concept of logical channels and how they can be used to harvest information in a passive manner.
-The chapter concluded with an account of how an IMSI catcher operates by outlining the two main ways of attacking a subscriber --- one by creating a new cell for the subscriber to connect to and the other by overtaking an already existent cell.
+The chapter concluded with an account of how an IMSI catcher operates, by outlining the two main ways of attacking a subscriber --- one by creating a new cell for the subscriber to connect to and the other by overtaking an already existent cell.
Chapter 3 started by explaining how the OsmocomBB framework was used to build the \gls{icds}.
It concluded with a summary of how to configure and use the system.
The two main sources of information, the \gls{bcch} and the \gls{pch} were introduced along with the different parameters that the \gls{icds} bases its findings on.
-An outline of how this finding is reached is illustrated in Figure \ref{fig:decision_process}.
-At first a sweep scan is conducted or an old project is loaded to supply the \gls{icds} with information of the surrounding base stations.
-During the scan or after the data has been loaded the \gls{icds} evaluates different rules on the data.
+An outline of how a finding is reached is illustrated in Figure \ref{fig:decision_process}.
+At first a sweep scan is conducted or an old project is loaded to supply the \gls{icds} with information about surrounding base stations.
+During the scan or after the data has been loaded, the \gls{icds} evaluates different rules on the data.
This can be done with or without consulting databases containing local information.
\begin{figure}
\centering
@@ -27,47 +27,45 @@ This can be done with or without consulting databases containing local informati
\caption{ICDS decision finding process outlined.}
\label{fig:decision_process}
\end{figure}
-The results show that some IMSI catcher configurations can be uncovered by these rules which check basic configuration data obtained from System Information messages.
+The results show that some IMSI catcher configurations can be uncovered by these rules which check basic configuration data obtained from System Information Messages.
In addition to this data broadcasted on the \gls{bcch}, reception levels and \glspl{lac} are also monitored over time to unveil attacks in which existing base stations are replaced by IMSI catchers.
This leaves IMSI catchers that have a consistent configuration and blend well in their surroundings concerning the reception levels.
They are also broadcasting the same \gls{lac} as the replaced base station, even if this means it could take a long time until the \gls{ms} announces itself.
-To handle this case the \gls{icds} can monitor the \gls{pch} of the base station in question to gather Paging Messages and Immediate Assignments.
-Since an IMSI catcher is not part of the provider's network no Paging Messages will be forwarded to the connected subscribers.
-These findings have been confirmed with the experiments in Chapter 4 where different attack scenarios have been tested.
-In cases where the \gls{icds} was not able to uncover the IMSI catcher by rule evaluation the \gls{pch} scan yielded the desired result.
+To handle this case, the \gls{icds} can monitor the \gls{pch} of the base station in question to gather Paging Messages and Immediate Assignments.
+Since an IMSI catcher is not part of the provider's network, no Paging Messages will be forwarded to the connected subscribers.
+These findings have been confirmed with the experiments performed in Chapter 4 where different attack scenarios have been tested.
+In cases where the \gls{icds} was not able to uncover the IMSI catcher by rule evaluation, the \gls{pch} scan yielded the desired result.
It should be kept in mind that the evaluation has been done against a prototype IMSI catcher since data from a real IMSI catcher is not available.
-However the results provided in this thesis are based more on general procedures, the \gls{gsm} protocol itself and not tailored to the specific system.
+However, the results provided in this thesis are based more on general procedures, the \gls{gsm} protocol itself and not tailored to the specific system.
Therefore they should be applicable to any IMSI catcher that uses the attacks outlined here.
\section{Future Work}
There are several ways in which the \gls{icds} could be improved.
The experiments showed that one of the main issues is the duration of the sweep scans.
-If a \gls{bts} is replaced right after it has been scanned it can take up to seven minutes until it is scanned again and the IMSI catcher is uncovered.
+If a \gls{bts} is replaced right after it has been scanned, it can take up to seven minutes until it is scanned again and the IMSI catcher is uncovered.
That is the time that is needed to do a complete sweep scan.
-The \gls{icds} could be refined so that only base stations of a particular provider are monitored so the duration of sweep scans is cut down, this could also be done upon entering \emph{User Mode}.
+The \gls{icds} could be refined so that only base stations of a particular provider are monitored
+This would cut down the time to conduct sweep scans significantly, it could also be done upon entering \emph{User Mode}.
In case of the Open Source IMSI-Catcher no Paging Messages were sent.
-However it would be possible for a catcher that is aware of this evaluation criterion to send fake Paging Messages to arbitrary \glspl{tmsi} to deceive the \gls{icds}.
-To face this the \gls{icds} could be extended.
-Since Paging Messages would be unreliable in such a case one would have to use \glspl{ia}.
+However, it would be possible for a catcher that is aware of this evaluation criterion, to send fake Paging Messages to arbitrary \glspl{tmsi} to deceive the \gls{icds}.
+To face this, the \gls{icds} could be extended.
+Since Paging Messages would be unreliable in such a case, one would have to use \glspl{ia}.
The experiments have shown that this might increase scanning time on the \gls{pch} since these messages are much more rare than Paging Messages.
An \gls{ia} sent to a subscriber contains the dedicated channel on which the conversation between the base station and the mobile phone is to continue.
-At this point the \gls{icds} already uses the information about dedicated channels to see whether frequency hopping is used or not.
+At this point, the \gls{icds} already uses the information about dedicated channels to see whether frequency hopping is used or not.
If an \gls{ia} is caught by the \gls{icds} one could follow on the assigned channel and catch the Cipher Mode Message.
-Since an IMSI catcher will disable encryption to tap into calls, the Cipher Mode Message would contain A5/0 as its encryption algorithm instead of A5/1 which is used in Germany.
-This feature could be used to handle cases of fake Paging Messages or \glspl{ia}, however it would take longer to conduct the \gls{pch} scan.
+An IMSI catcher will disable encryption to tap into calls, the Cipher Mode Message would contain A5/0 as its encryption algorithm instead of A5/1 which is used in Germany.
+This feature could be used to handle cases of fake Paging Messages or \glspl{ia}, however, it would take longer to conduct the \gls{pch} scan.
Another problem would be that it requires another subscriber that is connected to the IMSI catcher initiating a call.
On the other hand a regular base station using encryption can also be verified this way.
-These approaches are not strictly passive since they require another participant to become active.
-Although not strictly passive the \gls{icds} would still be invisible thus fulfilling the premise of not being uncovered itself.
-
-\paragraph{}This thesis analysed the threats that an IMSI catcher poses an which security flaws are responsible for its success.
+\paragraph{}This thesis analysed the threats that an IMSI catcher poses and which security flaws are responsible for its success.
The main security flaw used in \gls{gsm}, namely authentication not being mutual, is fixed in the next generation \gls{umts} networks.
-However the topic will be of importance for years to come since as long as \gls{umts} coverage is not complete mobile phones will continue to have a fallback mechanism to look for \gls{gsm} cells when no \gls{umts} cells are available.
+The topic will, nevertheless, be of importance for years to come since as long as \gls{umts} coverage is not complete, mobile phones will continue to have a fallback mechanism to look for \gls{gsm} cells when no \gls{umts} cells are available.
To force a mobile phone to fall back to \gls{gsm} an IMSI catcher operator could jam the \gls{umts} frequency band and wait until the \gls{ms} connects.
-The results show that it is possible to identify suspicious base stations and therefore lessen the thread of being caught.
+The results show that it is possible to identify suspicious base stations and in this way lessen the thread of being caught.
We presented, with the \gls{icds}, a step into the direction of more security aware systems.
A step that could and should also be taken by telephone manufacturers when designing the firmware and operating system for their next device.
diff --git a/Tex/Content/Conclusion.tex~ b/Tex/Content/Conclusion.tex~
new file mode 100644
index 0000000..c998314
--- /dev/null
+++ b/Tex/Content/Conclusion.tex~
@@ -0,0 +1,73 @@
+\chapter{Conclusion}
+This chapter will give a short summary of the whole project and its findings.
+The first section starts by reviewing what has been done while the second section will then bring up some aspects where the \gls{icds} could be improved to yield results either faster or more accurate.
+
+\section{Summary}
+The aim of this project was to find ways of unveiling whether an IMSI catcher is being operated in the close perimeter or not.
+In other words whether it is safe to connect to the \gls{gsm} network and place phone calls or not.
+An unsafe environment could result in IMSI numbers being requested and saved by IMSI catchers or in phone calls being recorded.
+The main premise that distinguishes this project from other similar projects like the also OsmocomBB based 'Catcher Catcher', is that the system is operating in a completely passive manner.
+Therefore it can only work on a limited amount of information, namely on information that is broadcasted on publicly available channels.
+The benefit this yields over other projects is that the IMSI Catcher Detection System itself is completely invisible to the IMSI catcher.
+
+Chapter 2 laid out basic concepts of \gls{gsm} communication to create a basis for understanding why and how an IMSI catcher works.
+Some more detailed concepts on the $U_m$ interface were discussed to enable the reader to grasp the concept of logical channels and how they can be used to harvest information in a passive manner.
+The chapter concluded with an account of how an IMSI catcher operates, by outlining the two main ways of attacking a subscriber --- one by creating a new cell for the subscriber to connect to and the other by overtaking an already existent cell.
+
+Chapter 3 started by explaining how the OsmocomBB framework was used to build the \gls{icds}.
+It concluded with a summary of how to configure and use the system.
+The two main sources of information, the \gls{bcch} and the \gls{pch} were introduced along with the different parameters that the \gls{icds} bases its findings on.
+An outline of how a finding is reached is illustrated in Figure \ref{fig:decision_process}.
+At first a sweep scan is conducted or an old project is loaded to supply the \gls{icds} with information about surrounding base stations.
+During the scan or after the data has been loaded, the \gls{icds} evaluates different rules on the data.
+This can be done with or without consulting databases containing local information.
+\begin{figure}
+\centering
+\includegraphics{../Images/flowchart}
+\caption{ICDS decision finding process outlined.}
+\label{fig:decision_process}
+\end{figure}
+The results show that some IMSI catcher configurations can be uncovered by these rules which check basic configuration data obtained from System Information Messages.
+In addition to this data broadcasted on the \gls{bcch}, reception levels and \glspl{lac} are also monitored over time to unveil attacks in which existing base stations are replaced by IMSI catchers.
+This leaves IMSI catchers that have a consistent configuration and blend well in their surroundings concerning the reception levels.
+They are also broadcasting the same \gls{lac} as the replaced base station, even if this means it could take a long time until the \gls{ms} announces itself.
+To handle this case, the \gls{icds} can monitor the \gls{pch} of the base station in question to gather Paging Messages and Immediate Assignments.
+Since an IMSI catcher is not part of the provider's network, no Paging Messages will be forwarded to the connected subscribers.
+These findings have been confirmed with the experiments performed in Chapter 4 where different attack scenarios have been tested.
+In cases where the \gls{icds} was not able to uncover the IMSI catcher by rule evaluation, the \gls{pch} scan yielded the desired result.
+It should be kept in mind that the evaluation has been done against a prototype IMSI catcher since data from a real IMSI catcher is not available.
+However, the results provided in this thesis are based more on general procedures, the \gls{gsm} protocol itself and not tailored to the specific system.
+Therefore they should be applicable to any IMSI catcher that uses the attacks outlined here.
+
+\section{Future Work}
+There are several ways in which the \gls{icds} could be improved.
+The experiments showed that one of the main issues is the duration of the sweep scans.
+If a \gls{bts} is replaced right after it has been scanned, it can take up to seven minutes until it is scanned again and the IMSI catcher is uncovered.
+That is the time that is needed to do a complete sweep scan.
+The \gls{icds} could be refined so that only base stations of a particular provider are monitored
+This would cut down the time to conduct sweep scans significantly, it could also be done upon entering \emph{User Mode}.
+
+In case of the Open Source IMSI-Catcher no Paging Messages were sent.
+However, it would be possible for a catcher that is aware of this evaluation criterion, to send fake Paging Messages to arbitrary \glspl{tmsi} to deceive the \gls{icds}.
+To face this, the \gls{icds} could be extended.
+Since Paging Messages would be unreliable in such a case, one would have to use \glspl{ia}.
+The experiments have shown that this might increase scanning time on the \gls{pch} since these messages are much more rare than Paging Messages.
+An \gls{ia} sent to a subscriber contains the dedicated channel on which the conversation between the base station and the mobile phone is to continue.
+At this point, the \gls{icds} already uses the information about dedicated channels to see whether frequency hopping is used or not.
+If an \gls{ia} is caught by the \gls{icds} one could follow on the assigned channel and catch the Cipher Mode Message.
+An IMSI catcher will disable encryption to tap into calls, the Cipher Mode Message would contain A5/0 as its encryption algorithm instead of A5/1 which is used in Germany.
+This feature could be used to handle cases of fake Paging Messages or \glspl{ia}, however, it would take longer to conduct the \gls{pch} scan.
+Another problem would be that it requires another subscriber that is connected to the IMSI catcher initiating a call.
+On the other hand a regular base station using encryption can also be verified this way.
+
+\paragraph{}This thesis analysed the threats that an IMSI catcher poses and which security flaws are responsible for its success.
+The main security flaw used in \gls{gsm}, namely authentication not being mutual, is fixed in the next generation \gls{umts} networks.
+The topic will, nevertheless, be of importance for years to come since as long as \gls{umts} coverage is not complete, mobile phones will continue to have a fallback mechanism to look for \gls{gsm} cells when no \gls{umts} cells are available.
+To force a mobile phone to fall back to \gls{gsm} an IMSI catcher operator could jam the \gls{umts} frequency band and wait until the \gls{ms} connects.
+
+The results show that it is possible to identify suspicious base stations and in this way lessen the thread of being caught.
+
+We presented, with the \gls{icds}, a step into the direction of more security aware systems.
+A step that could and should also be taken by telephone manufacturers when designing the firmware and operating system for their next device.
+
+
diff --git a/Tex/Content/Detection.tex b/Tex/Content/Detection.tex
index 0ffa67a..297557e 100644
--- a/Tex/Content/Detection.tex
+++ b/Tex/Content/Detection.tex
@@ -1,8 +1,8 @@
\chapter{IMSI Catcher Detection System}
-This chapter will give outline the \gls{icds} and the technologies and techniques used.
+This chapter will give an outline if the \gls{icds}, the technologies and techniques used.
The first part summarises the frameworks and hardware upon which the system has been developed.
-From this point on the second part explains how this framework can be used to harvest information and describes the process that is used by the \gls{icds} to evaluate this information.
+From this point on, the second part explains how this framework can be used to harvest information and describes the process that is used by the \gls{icds} to evaluate this information.
The last part shows how to configure and use the system to gather information from the surroundings and unveil IMSI catchers.
\section{Framework and Hardware}
@@ -14,9 +14,9 @@ OpenBTS was used to realise the open source IMSI Catcher \cite{dennis} and the b
\subsection{OsmocomBB}
OscmocomBB implements the baseband part of \gls{gsm} as an open source project.
Baseband part in this case means that it is an open source software to control the baseband chip inside the mobile phone.
-The baseband chip is the processor that manages the radio functionality of a mobile device.
-The goal is to have a phone, when using compatible hardware, operating on open source software only as opposed to proprietary baseband implementations.
-Therefore the project scope is implementing \gls{gsm} Layer 1--3 as well as hardware drivers for the baseband chipset.
+The baseband chip is the processor which manages the radio functionality of a mobile device.
+The goal is to have a phone, when using compatible hardware, operating on open source software only, as opposed to proprietary baseband implementations.
+Therefore, the project scope is implementing \gls{gsm} Layer 1--3 as well as hardware drivers for the baseband chipset.
A simple user interface on the phone is planned but not yet implemented.
At this stage a verbose user interface on the computer is used.
The implementation being open source is beneficial to multiple areas \cite{osmo_rationale}:
@@ -25,37 +25,39 @@ The implementation being open source is beneficial to multiple areas \cite{osmo_
The source is often disclosed only to the mobile phone manufacturers using the specific chipset.
One cannot be sure that this software does not have bugs that could be exploited and ultimately pose a security risk to the subscriber.
\item \textbf{Education:} Currently knowledge about \gls{gsm} and its layers on a technical level is not very well spread.
- An open source implementation as a reference could serve to educate more developers generally interested in the subject of mobile communications and thus improve products and software.
- Additionally this implementation enables universities to hold practical lab courses and interested individuals to do hands-on experiments.
- \item \textbf{Research:} A free implementation can decouple research on \gls{gsm} technologies from the industry since key technologies are no longer only available to researchers employed by a specific company.
- Additionally this way security holes can be uncovered and fixed more easily.
+ An open source implementation as a reference could serve to educate more developers, generally interested in the subject of mobile communications and thus improve products and software.
+ Additionally, this implementation enables universities to hold practical lab courses and interested individuals to do hands-on experiments.
+ \item \textbf{Research:} A free implementation can decouple research on \gls{gsm} technologies from the industry, because key technologies are no longer only available to researchers employed by a specific company.
+ Additionally, security flaws can be uncovered and fixed more easily.
Modifications to the protocol stack can be deployed and tested in a real environment.
It is also possible to redirect all received and sent packages directly to Wireshark\footnote{Wireshark, \url{http://www.wireshark.org/} [Online; Accessed 04.2012]} for further analysis.
\end{itemize}
\subsubsection{Project Status}
-At this point Layer 2 and Layer 3 do not actually run on the phone but rather on a computer to which the phone is connected via a serial cable.
-Layer 1 runs inside the custom firmware on the \gls{me} itself, since the procedures involving Layer 1 are time critical.
+At this point, Layer 2 and Layer 3 do not actually run on the phone but rather on a computer to which the phone is connected via a serial cable.
+Layer 1 runs inside the custom firmware on the \gls{me} itself, since the procedures involving Layer 1 are very time critical.
This has advantages as well as disadvantages.
The disadvantage is that in order to run an application written using OsmocomBB you always have to have a computer in addition to the phone.
-The benefit however is that during the development process, the phone does not have to be touched after an initial deployment of the firmware.
+The benefit, however, is that during the development process, the phone does not have to be touched after an initial deployment of the firmware.
This means code can be modified, compiled and tested locally without the need of remote debugging.
Experimenting is considerably easier this way.
-This separation however would not work in the original \gls{gsm} specification, therefore an extra interface layer between Layer 1 and 2 had to be implemented to handle messaging over the serial interface between the two original layers.
+This separation would not work in the original \gls{gsm} specification.
+This is why an extra interface layer between Layer 1 and 2 had to be implemented to handle messaging over the serial interface between the two original layers.
It is called Layer 1 Control, L1CTL.
-The current state of the project is, according to a presentation given on the 27$^\text{th}$ chaos communication congress\footnote{27C3 public wiki (Day 3), \url{http://events.ccc.de/congress/2010/wiki/Welcome} [Online; Accessed 04.2012]} by Dieter Spaar and Harald Welte, that the network Layers 1--3 are fully implemented, SIM cards can be accessed or emulated and \gls{gsm} cell selection and reselection are working.
+The current state of the project is, according to a presentation given on the 27$^\text{th}$ Chaos Communication Congress\footnote{27C3 public wiki (Day 3), \url{http://events.ccc.de/congress/2010/wiki/Welcome} [Online; Accessed 04.2012]} by Dieter Spaar and Harald Welte that the network Layers 1--3 are fully implemented, SIM cards can be accessed or emulated and \gls{gsm} cell selection and reselection are working.
A3/A8 as well as A5/1 and A/52, Full Rate and Enhanced Full Rate codecs are there, so it is possible to do voice calls with an OsmocomBB application written for that purpose, called \texttt{mobile}.
-It features a terminal\,/\,telnet based interface much like Cisco routers however there is no user interface for the phone so far.
+It features a terminal\,/\,telnet based interface, much like Cisco routers, however, there is no user interface for the phone so far.
\subsection{Motorola C123}
\label{sec:osmo_phones}
-Since the general idea behind OsmocomBB was to become a vendor independent open source \gls{gsm} implementation for everyone to use, there were certain requirements the targeted hardware would have to meet.
-For the consumer side requirements these were having a low price and a good availability.
-This criterion rules out \gls{diy} approaches since the number of produced devices would be low and thus costly or a significant technical knowledge would be expected from all users to assemble the hardware.
-For the developer side this would also mean implementing a lot on the lower levels of analog logic.
+Since the general idea behind OsmocomBB was to become a vendor independent open source \gls{gsm} implementation for everyone to use, there were certain requirements, the targeted hardware would have to meet.
+For the consumer side requirements, these were having a low price and a good availability.
+This criterion rules out \gls{diy} approaches since the number of produced devices would be low and thus costly or a significant amount of technical knowledge would be expected from all users to assemble the hardware.
+For the developer side, this would also mean implementing a lot on the lower levels of analog logic.
Therefore the Motorola C123 was chosen, an old, very cheap phone that is well spread.
-It has the advantage of being very simple on the hardware side and very well documented since the technical documentation for the Texas Instruments Calypso Chipset \cite{osmo_slides} has been leaked.
+It has the advantage of being very simple on the hardware side and very well documented because the technical documentation for the Texas Instruments Calypso Chipset \cite{osmo_slides} has been leaked.
+The TI Calypso is the baseband chipset that is used by the Motorola C123.
Table \ref{tab:c123_specs} shows an overview of the main specifications for the phone.
\begin{table}
\centering
@@ -83,10 +85,10 @@ Figure \ref{fig:osmo_c123} shows an image of the Motorola C123 circuit board wit
\caption{Circuit board of the Motorola C123 with its components \cite{osmo_wiki_c123}.}
\label{fig:osmo_c123}
\end{figure}
-Another reason for choosing this hardware platform was that during the start of the OsmocomBB project an open source implementation of \gls{gsm} Layer 1 was already available on Sourceforge (TSM30 Project) that could be used as a reference.
+Another reason for choosing this hardware platform was that during the start of the OsmocomBB project, an open source implementation of \gls{gsm} Layer 1 was already available on Sourceforge (TSM30 Project) that could be used as a reference.
At this point the original project has been removed from the Sourceforge site.
-In order to use the Motorola C123 in combination with the OsmocomBB framework the custom firmware implementing Layer 1 and L1CTL has to be flashed onto the board.
+In order to use the Motorola C123 in combination with the OsmocomBB framework, the custom firmware implementing Layer 1 and L1CTL has to be flashed onto the board.
This has to be done using a RS332 serial cable that is connected to the 2.5\,mm audio jack.
The audio jack of the Motorola C123 and other Calypso based mobile phones typically have a 3.3 V serial port on their audio jacks.
These cables are normally referred to as T191 unlock cables.
@@ -98,14 +100,14 @@ Schematics for such an unlock cable are given in Appendix \ref{sec:osmo_serial_s
\subsection{OsmocomBB and ICDS}
The setup that is used for the \gls{icds} project can be seen in Figure \ref{fig:osmo_setup}.
-It was build and tested in a Xubuntu 11.10 environment\footnote{Xubuntu, \url{http://xubuntu.org/} [Online; Accessed 04.2012]} which is a more lightweight variant of the popular Debian based Ubuntu Linux distribution.
-The process of acquiring, compiling and running the OsmocomBB framework itself in this environment is explained in Appendix \ref{sec:osmo_install}.
+It was built and tested in a Xubuntu 11.10 environment\footnote{Xubuntu, \url{http://xubuntu.org/} [Online; Accessed 04.2012]} which is a more lightweight variant of the popular Debian based Ubuntu Linux distribution.
+The process of acquiring, compiling and running the OsmocomBB framework in this environment is explained in detail in Appendix \ref{sec:osmo_install}.
-When setting up the system it is recommended \emph{not} to use a virtual machine.
+When setting up the system, it is recommended \emph{not} to use a virtual machine.
The bootloader and the firmware can fail to be deployed correctly if a virtual machine is used as development system.
This is because the protocol used by Motorola to do the actual flashing process is \emph{very} time critical and thus timeouts can occur that are caused by the overhead the virtual machine imposes on the hardware\,/\,software communication.
-As can be seen in Figure \ref{fig:osmo_setup} Layer 1 of the OsmocomBB \gls{gsm} stack runs on the phone which is connected via a serial cable to the computer running the \gls{icds}.
+As can be seen in Figure \ref{fig:osmo_setup}, Layer 1 of the OsmocomBB \gls{gsm} stack runs on the phone which is connected via a serial cable to the computer running the \gls{icds}.
On the computer side the \texttt{osmocon} program provides a general interface to the phone.
\texttt{Osmocon} is also used to load the firmware up to the Motorola C123.
Other software can communicate with \texttt{osmocon} and subsequently with the phone using Unix sockets.
@@ -116,7 +118,7 @@ Other software can communicate with \texttt{osmocon} and subsequently with the p
\label{fig:osmo_setup}
\end{figure}
-The program \texttt{catcher}, the OsmocomBB part of the \gls{icds}, is a modified version of the \texttt{cell\_log} by Andreas Eversberg that interfaces with \texttt{osmocon} to harvest information from \glspl{bts} and forward it to the core \gls{icds}.
+The program \texttt{catcher}, the OsmocomBB part of the \gls{icds}, is a modified version of \texttt{cell\_log} by Andreas Eversberg that interfaces with \texttt{osmocon} to harvest information from \glspl{bts} and forward it to the core \gls{icds}.
It can be seen as a Layer 3 program that scans through available frequencies and reads information from the \gls{bcch} whenever one such channel is available on the frequency at hand.
The forwarding is done directly via \texttt{stdout} since it runs as a child process of the \gls{icds}.
In a similar way, \texttt{pch\_scan} gathers information on the \gls{pch} of a specific base station.
@@ -124,24 +126,24 @@ The functionality of \texttt{catcher} and \texttt{pch\_scan} will be explained i
\section{Procedure}
The main goal of the \gls{icds} is to reach a conclusion on whether it is safe to initiate a phone call or not, in other words if the base station our mobile phone will connect to is trustworthy.
-As mentioned before, as soon as a subscriber connects to an IMSI catcher it automatically gives up information on his\,/\,her location.
-Therefore this project will use a passive approach on information harvesting, meaning we will only use information that is broadcasted or freely available as to not give up any hints of the \gls{icds} being active.
+As mentioned before, as soon as a subscriber connects to an IMSI catcher, information on his\,/\,her location is automatically given up.
+Therefore, this project will use a passive approach on information harvesting, meaning we will only use information that is broadcasted or freely available as to not give up any hints of the \gls{icds} being active.
To that end a four-step process is taken.
First \emph{information is gathered}.
This process is explained in detail in Section \ref{sec:info_gathering}.
After information on the surrounding \glspl{bts} is ready inside the \gls{icds}, a set of checks is evaluated on each base station individually, with each yielding a specific result for the station.
These checks are called \emph{rules} and discussed further along with the next two steps in Section \ref{sec:info_evaluation}.
-Afterwards the results the rules yielded for each base station have to be aggregated into one single result for each \gls{bts} by an \emph{evaluator}.
-At last, after every \gls{bts} has its evaluation it can be decided whether to \emph{tell the subscriber} if it is safe to initiate a phone call or not.
+Afterwards, the results the rules yielded for each base station have to be aggregated into one single result for each \gls{bts} by an \emph{evaluator}.
+At last, after every \gls{bts} has its evaluation, it can be decided whether to \emph{tell the subscriber} if it is safe to initiate a phone call or not.
\subsection{Information Gathering}
\label{sec:info_gathering}
-As explained in Section \ref{sec:common_channels} every base station has an associated \gls{bcch} where information about the station and its network is spread.
+As explained in Section \ref{sec:common_channels}, every base station has an associated \gls{bcch} where information about the station and its network is spread.
\gls{bcch} frames are always sent inside a 51-Multiframe.
-After the \gls{ms} has synchronised using the values on the \gls{fcch} and \gls{sch} it can determine which kind of information is hosted inside the \gls{bcch} message.
+After the \gls{ms} has synchronised using the values on the \gls{fcch} and \gls{sch}, it can determine which kind of information is hosted inside the \gls{bcch} message.
These so called \emph{System Information Messages} originate at the \gls{bsc} and are produced for each \gls{bts} individually and then periodically broadcasted.
-Since all the required information would not fit inside a single frame there are different kinds of System Information Messages that are distinguished by their \gls{tc} and host different kinds of information.
+Since all the required information would not fit inside a single frame, there are different kinds of System Information Messages that are distinguished by their \gls{tc} and host different kinds of information.
The type can be extracted using the \gls{fn} of the frame the message is sent in \cite{GSM2009}:
\[\text{TC}=(\text{FN} \text{ div } 51)\text{ mod } 8\]
Table \ref{tab:tc_mapping} shows how the \glspl{tc} can be mapped on those types.
@@ -161,17 +163,17 @@ TC &System Information Type\\
\caption{Type Codes and the corresponding System Information Types \cite{GSM2009}.}
\label{tab:tc_mapping}
\end{table}
-For this project the System Information Type 1--4 are of interest because these are available to all \glspl{ms} that tune in to the particular \gls{bcch} of the respective \gls{bts} without actively connecting to it.
+For this project the System Information Type 1--4 are of interest because these are available to all \glspl{ms} that tune in to the particular \gls{bcch} of the respective \gls{bts}, without actively connecting to it.
The information contained inside the System Information Messages is harvested via the \texttt{catcher} program.
\texttt{Catcher} is implemented inside the OsmocomBB framework and connects over the \texttt{osmocon} application to the Motorola C123.
-At first a sweep scan is done over all the \glspl{arfcn} to measure their reception levels in order to determine where base stations and thus \glspl{bcch} are located.
+At first, a sweep scan is done over all the \glspl{arfcn} to measure their reception levels, in order to determine where base stations and thus \glspl{bcch} are located.
Afterwards \texttt{catcher} tunes the phone to those specific frequencies where a \gls{bts} was found.
-At each such frequency it waits until all the System Information Messages are gathered and extracts parameters where possible.
-The parameters along with the raw data are forwarded to the main \gls{icds} application for further evaluation.
-An example of a fully parsed System Information Type 2 can be seen in Figure \ref{fig:si1} \cite{protocols1999}.
-The Neighbouring Cell List which is a very valuable source of information is located in inside the highlighted section of the message.
+At each such frequency, it waits until all the System Information Messages are gathered and extracts parameters where possible.
+The parameters, along with the raw data are forwarded to the main \gls{icds} application for further evaluation.
+An example of a fully parsed System Information Type 2 Message can be seen in Figure \ref{fig:si1} \cite{protocols1999}.
+The Neighbouring Cell List for example which is a very valuable source of information, is located in inside the highlighted section of the message.
\begin{figure}
\centering
\includegraphics[width=.8\textwidth]{../Images/sysinfo2marked}
@@ -179,8 +181,8 @@ The Neighbouring Cell List which is a very valuable source of information is loc
\label{fig:si1}
\end{figure}
Examples for all the System Information Messages used, along with an interpretation are located in Appendix \ref{sec:system_infos} and information on how they are interpreted can be found in 3GPP TS 44.018 \cite{sysinfos}.
-As long as scanning mode is active all the available stations are scanned repeatedly and changes in the \glspl{bts} will continuously update the data model inside the \gls{icds} software.
-The parameters harvested so far are:
+As long as scanning mode is active, all the available stations are scanned repeatedly and changes in the \glspl{bts} will continuously update the data model inside the \gls{icds} software.
+The parameters currently harvested are:
\begin{itemize}
\item MCC: The Mobile Country Code the base station is broadcasting.
\item MNC: The Mobile Network Code the base station is broadcasting.
@@ -188,22 +190,22 @@ The parameters harvested so far are:
\item rxlev: Receiving strength in dB.
This parameter is measured by the Motorola C123 and not part of the System Information Messages.
Even small changes in the location can have a large impact on this parameter due to shadowing and reflection.
- \item BSIC: Because of frequency reuse in a cellular network it is possible that two different base stations can send at the same \gls{arfcn}.
- In order for the \gls{ms} to keep these apart the \gls{bsic} is also broadcasted.
+ \item BSIC: Because of frequency reuse in a cellular network, it is possible that two different base stations can send at the same \gls{arfcn}.
+ In order for the \gls{ms} to keep these apart a \gls{bsic} is broadcasted by each \gls{bts}.
It consists of a \gls{ncc} identifying the provider, so the \gls{ms} can filter out messages that it does not need beforehand and the \gls{bcc} that must be unique for a given provider over all base station in a large area.
- \item LAC: This is the last part of the \gls{lai} (that consists of \gls{mcc} + \gls{mnc} + \gls{lac}) and is a hierarchical identifier for a given base station.
+ \item LAC: This is the last part of the \gls{lai} (that consists of \gls{mcc} + \gls{mnc} + \gls{lac}) and is a hierarchical identifier for a given set of base station.
The hierarchy is provider wide, meaning two different providers may use \glspl{lac} with a completely different numbering system.
- The \gls{lac} is used by the provider to tell the \gls{me} that it entered a new area and has to announce itself.
- \item Cell ID: The Cell ID is a unique identifier for the cell the \gls{ms} is connected to.
- Unique in this case means unique in a large area so that a mobile phone should never receive the same Cell ID for different base stations.
- \item Neighbouring Cells: Each base station keeps a list of other base stations in the perimeter for the \gls{ms} to scan and determine if there is a \gls{bts} with a better reception in the area.
+ The \gls{lac} is used by the provider to tell the \gls{ms} that it entered a new area and has to announce itself.
+ \item \gls{cid}: The \gls{cid} is a unique identifier for the cell the \gls{ms} is connected to.
+ Unique in this case means unique in a large area so that a mobile phone should never receive the same \gls{cid} for different base stations.
+ \item Neighbouring Cell List: Each base station keeps a list of other base stations in the perimeter for the \gls{ms} to scan and determine if there is a \gls{bts} with a better reception in the area.
\end{itemize}
Note that there are different formats for the Neighbouring Cell List since the original number of 17 bytes could only present a bit mask for 124 neighbouring \glspl{arfcn}.
-This works for the 900 MHz band, but for the extended 900\MHz and the 1800\MHz band the System Information Type 2bis and System Information Type 2ter have to be harvested additionally to construct the Neighbouring Cell List.
+This works for the 900 MHz band, but for the extended 900\MHz and the 1800\MHz band the System Information Type 2bis and System Information Type 2ter have to be harvested additionally, to construct the Neighbouring Cell List.
-The \texttt{pch\_scan} tool does not rely on the \gls{bcch} but rather on information available on the \gls{pch} as the name implies.
-If a mobile phone is connected to a base station and not actively participating in a communication process, it is in a passive mode to save battery waiting for either the user to initiate communication or the network to contact it.
-As mentioned in Section \ref{sec:common_channels} the network contacts the \gls{ms} on the \gls{pch} if there is a text message or a call waiting to be delivered.
+The \texttt{pch\_scan} tool does not rely on the \gls{bcch} but rather on information available on the \gls{pch}, as the name implies.
+If a mobile phone is connected to a base station and not actively participating in a communication process, it is in a passive mode to save battery, waiting for either the user to initiate communication or the network to contact it.
+As mentioned in Section \ref{sec:common_channels}, the network contacts the \gls{ms} on the \gls{pch} if there is a text message or a call, waiting to be delivered.
\begin{figure}
\centering
\includegraphics{../Images/Paging}
@@ -216,15 +218,15 @@ From this point on the connection can be set up.
The \texttt{pch\_scan} listens for activity on this channel and harvests the following information:
\begin{itemize}
- \item Pagings: Informs the \gls{icds} about every Paging Message that has been caught.
+ \item Paging Messages: The \gls{icds} is informed about every Paging Message that has been caught.
\item Immediate Assignment: If an \gls{ia} is caught, it is logged and parsed.
- The \gls{tmsi} that got the \gls{ia} as well as the assigned channel number and whether it is a frequency hopping channel or not is forwarded to the \gls{icds}.
+ The \gls{tmsi} to which the \gls{ia} was sent as well as the assigned channel number and whether it is a frequency hopping channel or not is forwarded to the \gls{icds}.
\end{itemize}
\subsection{Information Evaluation}
\label{sec:info_evaluation}
-Each base station is evaluated the moment the data completely arrived at the \gls{icds} application.
-Additionally when a new \gls{bts} has been found and added all formerly discovered stations are also re-evaluated since new discoveries can have an impact on the rules that evaluate the context surrounding an old base station.
+Each base station is evaluated, the moment the data completely arrived at the \gls{icds} application.
+Additionally, when a new \gls{bts} has been found and added, all formerly discovered stations are also re-evaluated since new discoveries can have an impact on the rules that evaluate the context surrounding an old base station.
As mentioned above, evaluation is done based on constructs called \emph{rules}.
Each rule represents one check that can be performed on a base station and yields a result based on its findings.
@@ -234,25 +236,25 @@ A rule can also be seen as a mapping from a set of input parameters to one of th
A \emph{Critical} result means that the base station evaluated has a critical configuration error or critical settings that are not found on normal base stations, \eg unknown provider names or empty neighbourhood lists.
This station should not be trusted.
-If a \emph{Warning} status is yielded the \gls{bts} at hand has some concerning features but it could not be said whether it really is an IMSI catcher or sheer coincidence.
-An example would be a base station having a Neighbouring Cell List of which none of the cells therein have actually been discovered up to that point.
+If a \emph{Warning} status is yielded, the \gls{bts} at hand has some concerning features but it could not be said whether it really is an IMSI catcher or sheer coincidence.
+An example would be a base station having a Neighbouring Cell List of which none of the cells therein have actually been discovered.
The list could either be a fake or it could simply be coincidence that the scan has not found any.
They could have been out of range for example.
In some cases a rule cannot yield a finding.
-That is when the state is explicitly set to \emph{Ignore} so the evaluator knows that this rule should have no influence on the final outcome.
+That is when the state is explicitly set to \emph{Ignore}, so the evaluator knows that this rule should have no influence on the final outcome.
This is the case for example when a rule refers to a parameter that has not been looked up or scanned.
If everything went as expected, \emph{Ok} is returned.
The rules can be divided into four different categories depending on how they work and which situations they are tailored to.
-Most of the rules are parametrised so they can be tweaked to different environments and standards.
+Most of the rules are parametrised, so they can be tweaked to different environments and standards.
The different rule categories are \emph{Configuration Rules}, \emph{Context Rules}, \emph{Databse Rules} and \emph{Scan Rules}.
\subsubsection{Configuration Rules}
-The first set of rules called \emph{Configuration Rules} targets the base station itself.
-Rules in this category are meant to check parameters that concern the \gls{bts} for integrity and configuration mistakes that could have been made by an IMSI catcher operator.
-An overview of which Configuration Rules are currently implemented inside the \gls{icds} is given in Table \ref{tab:config_rules}.
+The first set of rules, called \emph{Configuration Rules}, targets the base station itself.
+Rules in this category are meant to check parameters of a single \gls{bts} for integrity and configuration mistakes that could have been made by an IMSI catcher operator.
+An overview of the Configuration Rules that are currently implemented inside the \gls{icds} is given in Table \ref{tab:config_rules}.
\begin{table}
\centering
\begin{tabular}{ll}
@@ -264,7 +266,7 @@ Provider Known &Checks whether the provider is in a list of known \\
Country\,/\,Provider Map &Checks whether the given provider is a valid provider\\
&for the given country.\\
LAC\,/\,Provider Map &Checks whether the LAC of the station is in the normal\\
- &LAC range for that provider given the area.\\
+ &LAC range for that provider, given the area.\\
ARFCN\,/\,Provider Map &Checks whether the ARFCN is in the officially registered\\
&range of the provider.\\
\bottomrule
@@ -274,17 +276,17 @@ ARFCN\,/\,Provider Map &Checks whether the ARFCN is in the officially registere
\end{table}
A few things have to be noted when configuring these rules.
-Since there is no official listing or rule how the \gls{lac} is derived the LAC\,/\,Provider Mapping Rule needs knowledge of the area in which the \gls{icds} is used.
-The \gls{icds} itself can be used to gather that knowledge but it has to be done prior to using the rule for base station evaluation.
+Since there is no official listing or rule on how the \gls{lac} should look like, the LAC\,/\,Provider Mapping Rule needs knowledge of the area in which the \gls{icds} is used.
+The \gls{icds} itself can be used to gather that knowledge, but it has to be done prior to using the rule for base station evaluation.
The \gls{arfcn} range each provider has registered in Germany can be looked up at the website of the Bundesnetzagentur\footnote{Bundesnetzagentur Vergabeverfahren, \url{http://www.bundesnetzagentur.de/cln_1911/DE/Sachgebiete/Telekommunikation/RegulierungTelekommunikation/Frequenzordnung/OeffentlicherMobilfunk/VergabeVerfahrenDrahtlosNetzzugang/vergabeVerfahrenDrahtlosNetzzugang_node.html} [Online, Accessed 04.2012]} which is needed for the ARFCN\,/\,Provider Mapping Rule.
The main problem at this point is that all the parameters that can be checked by these rules can also be set by the operator of the IMSI catcher.
-If these are set in a consistent way this set of rules is not sufficient to identify a catcher.
-Therefore another set of rules has to be added that incorporates information of the surrounding nodes.
+If these are set in a consistent way, this set of rules is not sufficient to identify a catcher.
+Therefore, another set of rules has to be added that incorporates information of surrounding nodes.
\subsubsection{Context Rules}
The second set of rules is called \emph{Context Rules}.
-As the name suggests these rules serve the purpose of checking how well a given \gls{bts} fits into its neighbourhood.
+As the name suggests, these rules serve the purpose of checking how well a given \gls{bts} fits into its neighbourhood.
Table \ref{tab:context_rules} shows which rules have been implemented.
\begin{table}
\centering
@@ -295,31 +297,31 @@ Rule &Functionality\\
LAC Median Deviation &Checks whether the LAC of the given BTS deviates\\
&more than a certain threshold from the median LAC of\\
&that provider.\\
-Pure Neighbourhoods &Checks whether all found stations in the Neighbouring\\
+Pure Neighbourhoods &Checks whether all stations found in the Neighbouring\\
&Cell List share the same provider.\\
Neighbourhood Structure &Checks the structure of the Neighbouring Cell List for\\
&certain patterns.\\
Discovered Neighbours. &Checks whether a certain amount of the cells in the\\
&Neighbouring Cell List have actually been found.\\
Cell ID Uniqueness &Checks whether there are other cells with the same\\
- &Cell ID.\\
+ &CID.\\
\bottomrule
\end{tabular}
\caption{Context Rules implemented inside the ICDS.}
\label{tab:context_rules}
\end{table}
-For the LAC Median Deviation the median was chosen over the average since an extreme value (ill configured IMSI catcher) would have too strong an impact on the average to which all the \gls{bts} are compared.
+For the LAC Median Deviation Rule, the median was chosen over the average since an extreme value (ill configured IMSI catcher) would have too strong an impact on the average, to which all the \gls{bts} are compared.
It could even have such a strong effect on the average that legitimate base stations would fall below the threshold and be recognised as catchers.
-The threshold when a deviation is evaluated as being \emph{Critical} can be set in the configuration section for the rule.
+The threshold, at which deviation a node is evaluated as being \emph{Critical} can be set in the configuration section for the rule.
A value of 0 would mean that no deviation from the median is allowed.
This could lead to problems as some experimental scans have shown.
-However in none of the scans more than two different \glspl{la} have been found per provider and since these were neighbouring areas, the difference in the code was only 1.
+However, in none of the scans more than two different \glspl{la} have been found per provider and since these were neighbouring areas, the difference in the code was only 1.
For the Freiburg area a 1\% threshold for the deviation yielded good results.
\paragraph{Neighbourhood Structure}
The Neighbourhood Structure is the graph that is described by the Neighbouring Cell List located in the System Inforamtion 2\,/\,2bis\,/\,2ter constructs.
-Figure \ref{fig:neighbourhood_example} shows an extract of the neighbourhood graphs at the Faculty of Engineering of the University of Freiburg\footnote{Georges Koehler Allee, Freiburg}.
+Figure \ref{fig:neighbourhood_example} shows an extract of the neighbourhood graphs at the Faculty of Engineering of the University of Freiburg\footnote{Georges K\"ohler Allee, Freiburg}.
The E-Plus subgraph has been enlarged.
\begin{figure}
\centering
@@ -329,22 +331,23 @@ The E-Plus subgraph has been enlarged.
\end{figure}
It can be seen that for each provider, the neighbourhood forms an isolated, nearly fully connected subgraph.
Nodes with a green background have an \emph{Ok} rating, while the red node has a \emph{Critical} rating.
-The bordering white nodes have not yet been discovered and evaluated therefore they have no outgoing edges, they were merely found by extracting the neighbourhood lists.
+The bordering white nodes have not yet been discovered and evaluated, therefore, they have no outgoing edges, for no Neighbouring Cell Lists have been extracted.
+They were merely found by extracting the Neighbouring Cell Lists of other nodes.
This could be the case because they are too far away for the Motorola to receive or because of signal damping due to shadowing and reflection effects.
-In the \gls{icds} the aspect of isolated subgraphs for neighbourhoods is captured inside the \emph{Pure Neighbourhoods Rule}.
+In the \gls{icds}, the aspect of isolated subgraphs for neighbourhoods is captured inside the \emph{Pure Neighbourhoods Rule}.
An interesting fact is that one node inside the E-Plus subgraph on the upper right is marked \emph{Critical}.
This is because it is a \gls{bts} of the university's own \gls{gsm} network.
It was set up to be in a E-Plus neighbourhood but is not consistent with the E-Plus nodes surrounding it.
Therefore it is marked by the \gls{icds}.
-The node was set up inside the E-Plus neighbourhood for another Master Thesis \cite{richy} at the Chair of Communication Systems where the goal was to estimate the most probably position of a subscriber given his\,/\,her reception levels.
+The node was set up inside the E-Plus neighbourhood for another Master Thesis \cite{richy} at the Chair of Communication Systems where the goal was to estimate the most probably position of a subscriber, given his\,/\,her reception levels.
Some of the attacks discussed in Section \ref{sec:attacks} imply a certain structure of the neighbourhood graph.
Since the IMSI catcher tries to lock in \glspl{ms} that have connected from switching back to a normal cell, the neighbourhood list of such a catcher cell would either be empty or would only host neighbour cells that have a lower reception strength than itself.
An empty Neighbouring Cell List is represented in the graph by a node that has been discovered and has no outgoing edges.
-A Neighbouring Cell list containing only imaginary nodes serves the same purpose.
+A Neighbouring Cell List containing only imaginary nodes serves the same purpose.
\begin{figure}
\centering
\subfigure[Normal neighbourhood]{
@@ -385,13 +388,13 @@ A Neighbouring Cell list containing only imaginary nodes serves the same purpose
\caption{Comparison between a normal neighbourhood subgraph and a tainted one.}
\label{fig:structure_comparison}
\end{figure}
-Figure \ref{fig:structure_comparison} shows a simplified regular neighbourhood graph compared to a graph with two catcher nodes inside.
-In this case catcher C chose the attack where it replaces a previously existent \gls{bts} whereas catcher D opened up a new cell.
+Figure \ref{fig:structure_comparison} shows a simplified, regular neighbourhood graph, compared to a graph with two catcher nodes inside.
+In this case, catcher C chose the attack where it replaces a previously existent \gls{bts}, whereas catcher D opened up a new cell.
Replacing has several advantages, one being already integrated in the neighbourhood of other nodes.
Mobile phones will constantly monitor the reception strength of all neighbouring nodes and thus also the reception strength of the IMSI catcher which replaced one.
For catcher D it is the other way around, it has only outgoing edges.
This means that this cell is not known by any other node of the same provider.
-Nevertheless it has some outgoing edges to nodes with significantly less transmission strength to not stick out too much as a completely isolated node.
+Nevertheless, it has some outgoing edges to nodes with significantly less transmission strength to not stick out too much as a completely isolated node.
Combinations of these two approaches are also possible.
These thoughts are basically what is captured inside the \emph{Neighbourhood Structure Rule}.
The procedure the Neighbourhood Structure Rule follows is:
@@ -401,35 +404,37 @@ This rules out the cases where IMSI catchers have no neighbours or only an imagi
\item If no neighbours have been discovered by the \gls{icds}, check if other nodes share some of the neighbours, if yes yield a \emph{Warning}, else yield \emph{Critical}.
If the node is question is a legitimate node and the rare case occurs that none of its neighbours are in reach, most of its neighbours should be shared by other nodes of the same provider.
\item Check if other nodes of the same provider have the node in question inside their neighbourhood list, \eg if the node in question has incoming edges.
-This would not be the case for example for an IMSI catcher that broadcasts on a new \gls{arfcn}.
- \item If all the above criteria are met, yield \emph{Ok}.
+This would not be the case, for example, for an IMSI catcher that broadcasts on a new \gls{arfcn}.
+ \item If none of the above criteria suggested otherwise, yield \emph{Ok}.
\end{enumerate}
-This rule cannot find an IMSI catcher that has in- and outgoing edges, in other words a device that replaced a legitimate base station and copied the neighbourhood list from the original cell.
-Such a catcher would transmit at a very high strength and thus make sure all its neighbours have a worse reception on the target mobile phone than itself.
-It is generally not possible to rule out base stations where all outgoing edges point to base stations with a lower reception, since every legitimate neighbourhood will have one node that excels all other nodes in terms of reception.
+This rule cannot find an IMSI catcher that has in- and outgoing edges, in other words a device that replaced a legitimate base station and copied the Neighbouring Cell List from the original cell.
+Such a catcher would transmit at a very high strength and thus make sure all its neighbours have a worse reception on the target mobile phone.
+It is generally not possible, to rule out base stations where all outgoing edges point to base stations with a lower reception, since every legitimate neighbourhood will have one node that excels all other nodes in terms of reception.
-The Neighbourhood Structure Rule tests if at least one neighbour has actually be found.to raise this threshold the \emph{Discovered Neighbours Rule} can be used.
+The Neighbourhood Structure Rule tests if at least one neighbour has actually be found.
+To raise this threshold the \emph{Discovered Neighbours Rule} can be used.
It takes a parameter as an input which is interpreted differently depending on its range.
If the threshold is in the interval $[0,1]$ it is interpreted as a percentage.
$0.5$ meaning that at least half the neighbours in the list need to be found for the rule to give an \emph{Ok} rating.
-A threshold in the interval $(1,+\infty)$ means that this absolute number of base stations have to be found, if a floating point number is provided the real part is stripped.
-As an example $3$ and $3.47$ would both mean that at least $3$ neighbours would have to be found.
-This representation cannot cover the 'at least one' case since $1$ equals $100\%$ which is no problem for this case is already covered by the Neighbourhood Structure Rule.
+A threshold in the interval $(1,+\infty)$ means that this absolute number of base stations have to be found.
+If a floating point number is provided the decimal places are stripped.
+As an example $3$ and $3.84$ would both mean that at least $3$ neighbours would have to be found.
+This representation cannot cover the 'at least one' statement since $1$ equals $100\%$, which is no problem for this case is already covered by the Neighbourhood Structure Rule.
\subsubsection{Database Rules}
Let us do a quick summary of the situation so far.
-To investigate the current possibilities unveiling a catcher we will look over the parameters with the two attack types presented in Section \ref{sec:attacks} in mind.
-For both attack types presented it is possible to find a parameter configuration that does not raise suspicion, if the operator chooses a compatible \gls{arfcn}, \etc for the mimicked provider.
+To investigate the current possibilities unveiling a catcher, we will look over the parameters with the two attack types presented in Section \ref{sec:attacks} in mind.
+For both attack types presentedm it is possible to find a parameter configuration that does not raise suspicion, if the operator chooses a compatible \gls{arfcn}, \etc for the mimicked provider.
Therefore the Configuration Rules and most of the Context Rules will yield an \emph{Ok} result.
The Neighbouring Cell List is a bit different.
-Since the catcher wants to keep lured subscribers it will normally have an empty list or a list pointing only to \glspl{bts} imaginary neighbours.
+Since the catcher wants to keep lured subscribers, it will normally have an empty list or a list pointing only to \glspl{bts} imaginary neighbours.
Both of these cases can be detected.
However the operator \emph{may} also choose to set a list consistent with the neighbouring cells, \eg a catcher replacing a cell and copying the neighbourhood list.
-A new parameter has to be introduced to yield information in the cases the rules mentioned before fail, the \gls{cid}.
-For the \gls{cid} there are basically two possibilities depending on which attack type is used.
-The first possibility was that the IMSI catcher opens up a new cell and the second one was that it replaces a formerly existent cell.
+Another parameter has to be introduced to yield information in the cases the rules mentioned before fail, the \gls{cid}.
+For the \gls{cid}, there are basically two possibilities depending on which attack type is used.
+The first possibility is that the IMSI catcher opens up a new cell and the second one is that it replaces a formerly existent cell.
In the first case parameters can be chosen in a consistent way although a new \gls{cid} has to be chosen, as the \gls{cid} needs to be unique.
In the second case all parameters can be copied from the original cell.
Both possibilities can be resolved by adding outside knowledge to the \gls{icds} thus circumventing the problem of other parameters being forged.
@@ -441,7 +446,7 @@ This is done by rules called \emph{Database Rules}.
\toprule
Rule &Functionality\\
\midrule
-Cell ID Database &Checks all CIDs in the area against a datbase.\\
+Cell ID Database &Checks all CIDs in the area against a database.\\
Local Area Databse &Checks whether the LAC of the given BTS deviates.\\
\bottomrule
\end{tabular}
@@ -452,25 +457,25 @@ Local Area Databse &Checks whether the LAC of the given BTS deviates.\\
Table \ref{tab:database_rules} shows the rules that each handles one of these cases.
The first case is the easier of both.
We know that the catcher cell has a new \gls{cid} that has not been there before.
-Therefore the \emph{Cell ID Database Rule} has two different means to exploit this fact:
+Therefore, the \emph{Cell ID Database Rule} has two different means to exploit this fact:
\begin{itemize}
\item A database of \glspl{cid} can be learned by the \gls{icds} beforehand.
This can be used to detect new \glspl{cid} that have not been seen before.
\item A commercial or public \gls{cid} database can be used to compare against the \glspl{cid} found by the \gls{icds}.
- A web service also offered by most providers of Cell ID databases.
+ A web service is also offered by most providers of Cell ID databases.
\end{itemize}
-The three largest Cell ID databases are the two commercial ones by Ericson\footnote{Ericson Labs, \url{https://labs.ericsson.com/apis/mobile-location/} [Online; Accessed 04.2012]} and combain\footnote{Mobile Positioning Solutions, \url{http://location-api.com/} [Online; Accessed 04.2012]} as well as the free alternative OpenCellID\footnote{OpenCellID, \url{http://www.opencellid.org/} [Online; Accessed 04.2012]} \cite{wiki_cells}.
-Ericson and combain have trial modes, where the first 1000 requests are free for developers afterwards a subscription or a fee per request must be paid.
-Another free alternative with a large coverage is Google Mobile Maps, that also offers a web service where \glspl{cid} and their respective \glspl{lai} can be checked against their database to obtain localisation information (or simply check if they are part of the database).
+The three largest \gls{cid} databases are the two commercial ones by Ericson\footnote{Ericson Labs, \url{https://labs.ericsson.com/apis/mobile-location/} [Online; Accessed 04.2012]} and combain\footnote{Mobile Positioning Solutions, \url{http://location-api.com/} [Online; Accessed 04.2012]} as well as the free alternative OpenCellID\footnote{OpenCellID, \url{http://www.opencellid.org/} [Online; Accessed 04.2012]} \cite{wiki_cells}.
+Ericson and combain have models where a subscription or a fee per request must be paid.
+Another free alternative with a large coverage is Google Mobile Maps that also offers a web service where the \glspl{cid} and the respective \glspl{lac} can be checked against their database to obtain localisation information (or simply check if they are contained in the database).
By adding this information new cells can be identified.
-The second attack type where an existing cell is replaced is a bit more complicated since its parameters are an exact copy of the old cell.
+The second attack type where an existing cell is replaced, is a bit more complicated since its parameters are an exact copy of the old cell.
Attacking by replacing a cell works in a way that the cell with the worst reception is targeted.
That way when the IMSI catcher finished replacing it, the reception goes up a significant amount and the mobile phone will move over to that cell.
The difference in reception can be used to identify this kind of attack.
-In general the reception cannot be used well as a parameter because shadowing and reflection can substantially change the reception from one moment to the other.
-However if reception intervals are logged for a fixed location like an office then important calls made from that specific location can be protected against this kind of attack.
-To that end the \gls{icds} can monitor reception levels to build up databases with information on the reception intervals of the cells in different, fixed locations.
+In general the reception cannot be used well as a parameter because shadowing and reflection can substantially change the reception from one moment to the other when minimal movements have occurred.
+However, if reception intervals are logged for a fixed location, like an office, important calls made from that specific location can be protected against this kind of attack.
+To that end, the \gls{icds} can monitor reception levels to build up databases, with information on the reception intervals of the cells in different, fixed locations.
The \emph{Local Area Database Rule} then checks if reception levels differ significantly for a given location.
\subsubsection{Scan Rules}
@@ -488,38 +493,38 @@ LAC Change &Watches out for changes in LACs.\\
\label{tab:scan_rules}
\end{table}
At this stage, if local information is present, an IMSI catcher should be identified with a high probability.
-However if local information has not been gathered in advance, the main idea of Database Rules can still be applied.
+However, if local information has not been gathered in advance, the main idea of Database Rules can still be applied.
In contrast to the other three categories of rules mentioned before, \emph{Scan Rules} evaluate parameter changes over time.
This means parameters are being monitored over the duration of one or multiple sweep scans and changes are noted.
-The \emph{rx Change Rule} builds upon the same idea as the \emph{Local Area Database Rule}, only applied to a scan to scan basis.
+The \emph{rx Change Rule} builds upon the same idea as the \emph{Local Area Database Rule}, only applied to a scan-to-scan basis.
Changes in reception are evaluated against the last known reception level for each base station.
-When watching for parameter changes the \gls{lac} is another interesting parameter.
-If a mobile phone connects to an IMSI catcher due to its better reception level the mobile phone will not immediately announce itself thus the IMSI catcher has no knowledge that a new subscriber connected to it.
+When watching for parameter changes, the \gls{lac} is another interesting parameter.
+If a mobile phone connects to an IMSI catcher due to its better reception level, the mobile phone will not immediately announce itself, thus the IMSI catcher has no knowledge that a new subscriber connected to it.
A mobile phone announces itself by sending Location Updates to the network, this is only done when a certain timeout is reached or when the phone enters a new \gls{la}.
-Since this timeout can be very large (the lowest value possible is 6 minutes) an IMSI catcher usually sends a different \gls{lac} than the original cell to force the \gls{ms} to announce itself by sending a Location Update.
+Since this timeout can be very large (the lowest value possible is 6 minutes), an IMSI catcher usually sends a different \gls{lac} than the original cell, to force the \gls{ms} to announce itself by sending a Location Update.
IMSI catchers showing this kind of behaviour are uncovered by the \emph{LAC Change Rule}
\subsubsection{Remaining Issues and Paging}
\label{sec:paging}
-If a catcher is configured in a consistent way, replaces a cell and by chance has an \emph{appropriate distance} from the subscriber that is its target, the \gls{icds} will not unveil it up to now if it also chooses to maintain a non-suspicious neighbourhood list and shows the patience to wait for the \gls{ms} to announce itself, \eg not changing the \gls{lac}.
-\emph{Appropriate distance} in this case means that the distance is chosen in a way that the reception of the catcher does not differ significantly from the reception of the original base station.
+If a catcher is configured in a consistent way, replaces a cell and by chance has an \emph{appropriate transmission power}, the \gls{icds} will not unveil it up to now, if it also chooses to maintain a non-suspicious Neighbouring Cell List and does not transmit a new \gls{lac}.
+\emph{Appropriate transmission power} in this case means that the reception of the catcher does not differ significantly from the reception of the original base station.
An IMSI catcher is not part of a provider's network, it is merely a proxy for a base station.
-At best it can route calls into a network but it cannot take calls that are intended for a subscriber and route them.
-Therefore an IMSI catcher will not page connected subscribers while a normal base station will have a very high number of pagings depending on the number of subscribers that are connected.
+At best, it can route calls into a network but it cannot take calls that are intended for a subscriber and route them.
+Therefore, an IMSI catcher will not send Paging Messages to connected subscribers, while a normal base station will have a very high number of pagings depending on the number of subscribers that are connected.
This is a significant difference between a catcher and a regular base station.
This is an additional information that can be used to identify an IMSI catcher.
The program \texttt{pch\_scan} tunes the Motorola C123 to the \gls{pch} of a particular base station and gathers Paging Messages and \glspl{ia}.
-If no Paging Messages could be collected during longer period of scanning it is a strong indicator towards being confronted with an IMSI catcher.
-Additionally when \glspl{ia} are found the scan extracts whether the assigned channel is a frequency hopping channel or not.
+If no Paging Messages could be collected during a longer period of scanning it is a strong indicator towards being confronted with an IMSI catcher.
+Additionally, when \glspl{ia} are found the scan extracts whether the assigned channel is a frequency hopping channel or not.
Since frequency hopping is considered a security feature by providers, all German providers always assign frequency hopping channels.
An IMSI catcher however may not support hopping since it does not have multiple frequencies at hand.
-The \emph{PCH Scan} feature has not been implemented as a regular rule since each given base station needs some time to be scanned.
-If that would be done on a regular basis for every station that has been discovered it would delay the whole scan by a large amount of time and the interval between re-evaluations would be very high.
-Therefore it was implemented as an extra feature to be used when needed.
+The \emph{PCH Scan} feature has not been implemented as a regular rule because each given base station needs some time to be scanned.
+If that would be done on a regular basis for every station that has been discovered, it would delay the whole scan by a large amount of time and the interval between re-evaluations would be very high.
+Therefore, it was implemented as an extra feature to be used when needed.
The \gls{icds} also uses this method on particularly filtered base stations in \emph{User Mode} as will be explained in Section \ref{sec:user_mode}.
\subsection{Base Station Evaluation}
@@ -532,17 +537,17 @@ Currently there are two different evaluators implemented inside the \gls{icds}:
It iterates over all the rule findings and yields the most concerning finding as its result.
By default this evaluator is enabled in the system.
\item Grouped Evaluator: With this evaluator rules can be grouped together.
- Inside each group the result for the group is found by majority vote whereas the final result is conservatively found by comparing all the group results.
+ Inside each group the result for the group is found by majority vote, whereas the final result is conservatively found by comparing all the group results.
\end{itemize}
Different kinds of evaluators can be used to tweak the whole system more to a specific environment or purpose, if specific rules are grouped together.
-They are meant more for experimental purpose if the \gls{icds} is used as a toolbox for analysing base stations, to give more freedom in use to the operator.
+They are meant more for experimental purpose, if the \gls{icds} is used as a toolbox for analysing base stations, to give more freedom in use to the operator.
In case of the system being used in \emph{User Mode} or for the sole purpose of finding whether an IMSI catcher is active or not, the conservative evaluator should almost always be the evaluator of choice and tweaking should be done on the rule parameters rather than on the evaluator.
After a result has been determined for each station, all the results are again aggregated into a final result.
The overall result depends on which mode the \gls{icds} is used in.
-If it is used as analysis tool the final result will be a conservatively aggregated result over all the stations in the list.
-If the \gls{icds} is run in \emph{User Mode}, which is the mode an end user would use the system in, the \gls{icds} looks up the provider the user has entered, filter out the base station with the best reception for that provider and yield its evaluation as final evaluation.
-This reflects the fact that a subscriber cannot choose the \gls{bts} it connects to, since the \gls{me} will always connect to the best base station available for its given provider.
+If it is used in normal mode, the final result will be a conservatively aggregated result over all the stations in the list.
+If the \gls{icds} is run in \emph{User Mode}, which is the mode an end user would use the system in, the \gls{icds} looks up the provider the user has entered, filters out the base station with the best reception for that provider and yields its evaluation as final evaluation.
+This reflects the fact that a subscriber cannot choose the \gls{bts} it connects to, since the \gls{ms} will always connect to the best base station available for its given provider.
\section{Implementation}
\label{sec:icds}
@@ -558,10 +563,10 @@ The first section focuses on architectural aspects and how the architecture can
\end{figure}
Figure \ref{fig:architecture} shows a diagram describing the system architecture, the modules in light blue have been implemented for this project.
The application consists of two main parts.
-One part, the \texttt{catcher}, is implemented inside the OsmocomBB framework, the other part, \emph{PyCatcher}, is a Python application that uses \texttt{catcher} and \texttt{pch\_scan} to harvest information and evaluate it afterwards.
-Since the way these two sub-programs work has already been described in Section \ref{sec:info_gathering} this section will focus on the Python application part.
+One part, the \texttt{catcher} and \texttt{pch\_scan} programs, are implemented inside the OsmocomBB framework, the other part, \emph{PyCatcher}, is a Python application that uses \texttt{catcher} and \texttt{pch\_scan} to harvest information and evaluate it afterwards.
+Since the way these two sub-programs work has already been described in Section \ref{sec:info_gathering}, this section will focus on the Python application part.
-As mentioned before Layer 1 of the \gls{gsm} stack is implemented in the firmware running on the Motorola C123.
+As mentioned before, Layer 1 of the \gls{gsm} stack is implemented in the firmware running on the Motorola C123.
Layer 2 and Layer 3 are implemented on the computer and are used by the \texttt{catcher} and the \texttt{pch\_scan} software to harvest information from the \gls{bcch} and \gls{pch} respectively.
The PyCatcher application was designed with a \gls{mvc} approach in mind to make it easy to implement new functionality.
@@ -570,15 +575,15 @@ That way each of the different components can be exchanged without affecting the
An additional module has been added, the \emph{OsmoConnector} that is loaded by the controller and spawns \texttt{catcher} as a child process.
It takes the output back in and transforms it into an object oriented representation of the discovered base stations.
These are then handed over and update the data model.
-This way it can be ensured that only coherent and complete information is incorporated in the data model.
+This way, it can be ensured that only coherent and complete information is incorporated in the data model.
Another benefit is that the parsing module is isolated from the main program logic.
OsmoConnector is also the module that spawns \texttt{pch\_scan} when requested by the controller.
The \emph{controller} is the main part of the program and instantiates all the other modules.
It loads data from the model, triggers the evaluation and sends the results to the view to be displayed.
-As discussed before there are several rules that can be evaluated for each base station.
+As discussed before, there are several rules that can be evaluated for each base station.
These rules are stored within the controller and can be enabled or disabled by using the view that relays new rule configurations back to the controller to be applied.
-Whenever a new evaluation is requested the controller evaluates the active rules and gives the results to the active evaluator, afterwards the results are send to the view for display to the user.
+Whenever a new evaluation is requested, the controller evaluates the active rules and gives the results to the active evaluator, afterwards the results are send to the view for display to the user.
Note that all the structures used are view independent, this way the current view could easily be exchanged with a web interface for example.
The \texttt{view} in this project consists of a GTK3\footnote{The GTK+ Project, \url{http://www.gtk.org/} [Online; Accessed 06.2012]} window with several forms for user input.
@@ -587,7 +592,7 @@ Details on the view and how to use it will be explained in Section \ref{sec:icds
Rules and evaluators were designed in a plugin fashion, since these are the main points where the program can be enhanced and new ideas can be realised.
Implementing a new rule or a new evaluator works by extending the rule or evaluator base class and implementing one method inside the derived class that contains the actual logic.
-After that they only need to be added to the list of evaluators and rules included inside the controller.
+After that has been done, they only need to be added to the list of evaluators and rules included inside the controller.
Appendix \ref{sec:extensions} gives an example of how this can be done.
\subsection{Configuration}
@@ -608,7 +613,7 @@ variable = value_7 #simple variable
\caption{Configuration Dictionary in the settings file.}
\label{fig:python_dict}
\end{figure}
-The configuration of the system is done in the file \texttt{settings.py}.
+The configuration of the system is located in the \texttt{settings.py} file.
All configuration is done within the python language, where each module has its own dictionary inside which it can have an arbitrary number of parameters with their respective values or if only few parameters are required they are read in as simple variables.
Figure \ref{fig:python_dict} shows an example with the four common expressions used for parameters in this project.
@@ -618,11 +623,11 @@ The first one contains parameters that are needed for the correct operation of t
\item \texttt{Device\_settings}: The setting for the mobile phone that is used.
In case the Motorola C123 is used, this section does not need to be edited.
\item \texttt{Osmocom\_lib}: The path to the folder that contains the OsmocomBB framework.
- \item \texttt{Commands}: This is only to be edited when a newer version of the framework is used and the folder structure has changed since the release used in this project.
+ \item \texttt{Commands}: This is only to be edited when a newer version of the framework is used and the folder structure has changed compared to the release that was used in this project.
\end{itemize}
The second and third sections contain parameters for the different rules and evaluators.
This is followed by a section to set some general parameters for the \texttt{pch\_scan} tool and a section where the locations of the different databases can be changed.
-A completely documented configuration file with all the rules and evaluator parameters can be found in Appendix \ref{sec:example_config}.
+A completely documented configuration file with all the rule and evaluator parameters can be found in Appendix \ref{sec:example_config}.
The file is read in as a python file.
This way python code can also be used to change settings dynamically depending on the environment or how the \gls{icds} is started.
@@ -644,10 +649,10 @@ The different elements shown in the main window are:
\begin{enumerate}
\item Firmware Loader: This button is used to load the OsmocomBB firmware onto the Motorola C123.
For this to work, the mobile phone must be connected correctly to the computer and available on the configured \texttt{tty} interface.
-After pressing the button on-screen instructions will lead the user through the process of flashing.
+After pressing the button, on-screen instructions will lead the user through the process of flashing.
\item Scanner: This starts the \texttt{catcher} subprocess in the background and fills the data model with information on the discovered base stations.
-During this process the Base Station List (11) and the Base Station Graph (13) will also be populated in realtime.
+During this process, the Base Station List (11) and the Base Station Graph (13) will also be populated in realtime.
Re-evaluation on all base stations is done for every new \gls{bts} that has been found.
\item Filter Window: This brings up the window shown in Figure \ref{fig:filters_window}, where different view filters for the Base Station List and the Base Station Graph can be set.
@@ -658,46 +663,47 @@ Available filters are:
\item Provider Filter: Takes a comma separated white list of providers that should be shown.
\item ARFCN Filter: Takes a range of \glspl{arfcn} to be shown.
\end{itemize}
-These two filters can arbitrarily be combined together.
+These two filters can be combined together.
Filters are designed the same way as rules and evaluators, a new filter can be implemented by derivation of the base class.
\item Rules Window: All the rules implemented inside the \gls{icds} will be brought up with a check box to enable or disable these rules.
Disabling means that they will not be considered for the evaluation of a base station.
A screenshot can be seen in Figure \ref{fig:rules_window}.
-If rules are changed during a sweep scan, everything will be re-evaluated according to the new rules set without interrupting the scan.
+If rules are changed during a sweep scan, everything will be re-evaluated according to the new rule set, without interrupting the scan.
-\item Evaluator Window: This window will let the user choose which evaluator already discussed in Section \ref{sec:evaluators} to use for \gls{bts} evaluation.
+\item Evaluator Window: This window will let the user choose which evaluator, discussed in Section \ref{sec:evaluators}, to use for \gls{bts} evaluation.
Choosing a new evaluator will also trigger a re-evaluation of all the data collected so far.
-\item Evaluation: This button brings up a separate window showing only the final evaluation of the scan.
+\item Evaluation: This button brings up a separate window, showing only the final evaluation of the scan.
The final evaluation shown in this dialog \emph{will} be affected by the filters set.
Base stations that are filtered out are not considered.
\item Databases Window: The window shown in Figure \ref{fig:databases_window} contains settings for all the databases the \gls{icds} uses.
These settings are mandatory if the Local Area Database Rule or the Cell ID Rule is going to be used.
-It is also possible here to export the current scan as a \gls{csv} file or a Sqlite database to be used in other programs.
+It is also possible to export the current scan as a \gls{csv} file or a Sqlite database, to be used in other programs.
-\item PCH Scan Window: This button brings up the dialog illustrated in Figure \ref{fig:pch_window} in which an \gls{arfcn} or a list of \glspl{arfcn} can be scanned to discover Paging Messages and \glspl{ia} on the \glspl{pch}.
+\item PCH Scan Window: This button brings up the dialog illustrated in Figure \ref{fig:pch_window}, in which an \gls{arfcn} or a list of \glspl{arfcn} can be scanned to discover Paging Messages and \glspl{ia} on the \glspl{pch}.
The timeout sets the duration of a scan.
-Results of the scan will be shows in a list in the lower part of the window after the scan is finished.
+Results of the scan will be shown in a list in the lower part of the window after the scan is finished.
+If the checkbox is checked, the results from the scan will also carry over in the data model.
\item Save\,/\,Load Project: The current state of the application can be saved as or loaded from a \texttt{.cpf} file.
This enables the user to continue a scan at a later time or to compare different data sets scanned at different points in time or locations with one another.
\item User Mode: The \gls{icds} is ultimately meant to be a tool that can be used by end users to check whether it is safe to initiate a phone call or not.
-This dialog presents a way the already configured tool could be shown to end users.
-Only the provider is to be entered and a final evaluation will be returned once the \gls{icds} is done with the process.
+This dialog presents a way, the already configured system could be shown to end users.
+Only the provider is to be entered and a final evaluation will be returned, once the \gls{icds} is done with the process.
-\item Base Station List: This list gives an overview of which base stations have been discovered so far along with some distinguishing information including its evaluation.
+\item Base Station List: This list gives an overview of which base stations have been discovered so far, along with some distinguishing information including its evaluation.
A detailed view of a base station can be brought up by selecting it in the list and pressing the enter or return key.
The report is separated into four main parts, the first being all the harvested parameters, followed by findings the different rules and evaluators yielded and a section with the raw uninterpreted System Information data.
-\item Log Window: Every important event inside the \gls{icds} is reported in the log together with a time stamp when it occurred.
+\item Log Window: Every important event inside the \gls{icds} is reported in the log together with a time stamp, when it occurred.
-\item Base Station Graph: This graph displays the base station found in the Base Station List (11).
+\item Base Station Graph: This graph displays the base stations found in the Base Station List (11).
A node represents a single \gls{bts} and is labelled with its respective \gls{arfcn}.
An edge from note $A$ to $B$ is drawn if node $B$ occurs in the Neighbouring Cells List of $A$.
-Nodes with a white background have only been found inside Neighbouring Cell Lists but not yet by the \gls{icds} scanner itself whereas nodes with a red, yellow or green background have been found and evaluated with the colour representing either a critical, a warning or an ok status respectively.
+Nodes with a white background have only been found inside Neighbouring Cell Lists but not yet by the \gls{icds} scanner itself, whereas nodes with a red, yellow or green background have been found and evaluated with the colour representing either a critical, a warning or an ok status respectively.
\item Graph Controls: These are meant to make navigating the graph a bit easier.
From left to right the functionality is zoom in, zoom out, fit the whole graph to the viewport and display the graph in original size.
@@ -705,10 +711,10 @@ Zooming can also be done with the mouse wheel and it is possible to drag the gra
\end{enumerate}
\begin{figure}
\centering
-\subfigure[Databases window.]{\includegraphics[width=.4\textwidth]{../Images/databases_window}\label{fig:databases_window}}
-\subfigure[Rules window.]{\includegraphics[width=.4\textwidth]{../Images/rules_window}\label{fig:rules_window}}\\
-\subfigure[Filters window.]{\includegraphics[width=.4\textwidth]{../Images/filter_window}\label{fig:filters_window}}
-\subfigure[PCH scan window.]{\includegraphics[width=.4\textwidth]{../Images/pch_window}\label{fig:pch_window}}
+\subfigure[Databases window.]{\includegraphics[scale=0.55]{../Images/databases_window}\label{fig:databases_window}}
+\subfigure[Rules window.]{\includegraphics[scale=0.55]{../Images/rules_window}\label{fig:rules_window}}\\
+\subfigure[Filters window.]{\includegraphics[scale=0.55]{../Images/filter_window}\label{fig:filters_window}}
+\subfigure[PCH scan window.]{\includegraphics[scale=0.55]{../Images/pch_window}\label{fig:pch_window}}
\caption{Dialogs for different settings.}
\label{fig:dialogs}
\end{figure}
@@ -721,48 +727,48 @@ Button numbering refers back to Figure \ref{fig:icds}.
\paragraph{Conducting sweep scans:} This is the normal mode of operation, scanning and evaluating all base stations in the perimeter.
This is also used for gathering various kinds of information to be used for analysis later.
At first the firmware needs to be flashed onto the device by pressing (1).
-After the flashing process is finished the scan can be started by pressing (2).
+After the flashing process is finished, the scan can be started by pressing (2).
Either before or during the scan (3),(4) and (5) can be used to customise the output or rules that should be considered during evaluation.
The scan can be stopped at any time.
Resuming the scan will renew the information in the Base Station List.
The scan will continue renewing information until it is terminated by the user.
The number of times a specific \gls{bts} has been scanned is shown in the \emph{Sightings} column of the Base Station List.
-\paragraph{Using and obtaining Cell ID Information:} \gls{cid} information can be obtained through several different means.
+\paragraph{Using and obtaining CID Information:} \gls{cid} information can be obtained through several different means.
The Databases window shown in Figure \ref{fig:databases_window} can be brought up by pressing (7).
-In the upper part settings concerning the acquisition of \glspl{cid} can be found.
+In the upper part, settings concerning the acquisition of \glspl{cid} can be found.
The operator has the choice between three different methods which can also be used in combination.
-\emph{Google Mobile Maps Service} compares the stations' \glspl{cid} and \glspl{lai} to the ones in the Google database.
+\emph{Google Mobile Maps Service} compares the stations' \glspl{cid} and \glspl{lac} to the ones in the Google database.
If they are found they are marked as such and additionally their location information will be set.
\emph{OpenCellID Web Service} performs the same task if activated.
-As of now OpenCellID has a very low coverage compared to Google's service but it has been included since it is an open source approach that is in development and updated constantly.
+As of now, OpenCellID has a very low coverage compared to Google's service but it has been included since it is an open source approach that is in development and updated constantly.
The \emph{Use Local Databse} feature allows to use a previously build Local Area Database as Cell ID Database for lookups.
For this purpose the location to be used as database has to be entered in the textfield, \eg 'office' or 'home'.
-Offline lookups can be done that way, which are considerably faster that online lookups, the raw data used by the OpenCellID project can also be downloaded and used as a offline version for reference that way.
-Since these lookups take some time if performed using webservices, this is not done while the scan is taking place, to not delay the acquisition of information from new base stations.
+Offline lookups can be done that way, which are considerably faster that online lookups.
+Since these lookups take some time, if performed using webservices, this is not done while the scan is taking place, to not delay the acquisition of information from new base stations.
Pressing the button below the checkboxes will add the Cell ID Database information from the selected sources to all the stations currently in the base station list.
-If more than one service is activated lookups will be done starting with the Google service, if active and using the next one in line only if the previous lookup failed.
+If more than one service is activated, lookups will be done starting with the Google service, if active and using the next one in line only if the previous lookup failed.
Having at least one service activated and run on the base station list is a precondition for the Cell ID Database Rule to work.
\paragraph{Building or using a Local Area Database:} Having set up the correct location in the \emph{Current Location} field of the databases window and having a valid database for that location are preconditions for the Local Area Database Rule to work.
To build up a database for a specific location a sweep scan for this location has to be done.
-After the sweep scan is finished, the current location has to be set in the dialog and the button for adding\,/\,updating the database has to be pressed.
-If there was no existing database for that location it will be created, otherwise the database will be updated with the new information acquired by the sweep scan.
+After the sweep scan is finished, the current location, \eg 'office', has to be set in the dialog and the button for adding\,/\,updating the database has to be pressed.
+If there was no existing database for that location, it will be created, otherwise the database will be updated with the new information acquired by the sweep scan.
To enhance the quality of a Local Area Database it is recommended to do multiple sweep scans and integrate them rather than relying on a single scan only.
-This raises the probability that all \gls{bts} in the perimeter are found is higher and it solidifies the interval in which the base station signal strength varies.
+This raises the probability that all \gls{bts} in the perimeter are found and it solidifies the interval in which the base station signal strength varies.
-\paragraph{Conducting a PCH Scan:} A \gls{pch} scan can be conducted in addition to a sweep scan or as a standalone method therefore no scan data needs to be present.
-Since PHC scans and sweep scans use the Motorola C123 a PCH scan can only be done when no sweep scan is active and vice versa.
+\paragraph{Conducting a PCH Scan:} A \gls{pch} scan can be conducted in addition to a sweep scan or as a standalone method, therefore, no scan data needs to be present.
+Since PHC scans and sweep scans both use the Motorola C123, a PCH scan can only be done when no sweep scan is active and vice versa.
The first parameter is a comma separated list of \glspl{arfcn} that will be scanned.
The second parameter is the timeout.
-A scan for a particular \gls{arfcn} will tune in on the \gls{pch} of each \gls{arfcn} given and wait there until the timeout is reached gathering all paging messages and \gls{ia} that are sent in that time interval.
+A scan for a particular \gls{arfcn} will tune in on the \gls{pch} of each \gls{arfcn} given and wait there until the timeout is reached, gathering all Paging Messages and \glspl{ia} that are sent in that time interval.
In the lower part of the dialog, after the scan has finished, the statistics for the scanned \glspl{bts} will occur.
If the checkbox is checked, the data acquired by the scan will also be integrated with the data model and will have an impact on the evaluation displayed in the Base Station Graph.
The findings can then also be seen in the report for a base station.
\begin{figure}
\centering
-\includegraphics[width=.4\textwidth]{../Images/user_window}
+\includegraphics[scale=0.45]{../Images/user_window}
\caption{The User Mode window.}
\label{fig:user_mode}
\end{figure}
@@ -775,21 +781,21 @@ If the station already has been evaluated as \emph{Critical}, \emph{User Mode} w
In all other cases it performs an additional \gls{pch} scan on that station to rule out the scenario where a catcher has not been detected by the currently active set of rules.
After the evaluation has been completed, the picture on the bottom will change to reflect the result found.
-Additionally if PCH scan integration is enabled the results from \emph{User Scan} will also carry over to the data model if a PCH scan has been carried out in the process.
+Additionally, if PCH scan integration is enabled, the results from \emph{User Scan} will also carry over to the data model if a PCH scan has been carried out in the process.
\section{Related Projects}
-IMSI catcher detection is a topic that has not emerged until recently therefore not a lot of work and research has been done upon that subject.
-This is mainly due to the fact that is was very hard to get information from the mobile network onto a computer for evaluation and the threat seemed to be not as large as today with cheap self build IMSI catchers.
+IMSI catcher detection is a topic that has not emerged until recently, therefore, not a lot of work and research has been done upon that subject.
+This is mainly due to the fact that it was hard to get information from the mobile network onto a computer for evaluation and the threat seemed to be not as large as today with cheap self build IMSI catchers available.
About the same time as this project, in December 2011, another project was announced with the same goals of detecting an IMSI catcher.
-The project is called 'Catcher Catcher'\footnote{Catcher Catcher Wiki, \url{http://opensource.srlabs.de/projects/catcher/wiki/Tutorial} [Online; Accessed 05.2012]} and also builds up on the OsmocomBB framework.
-The goals are the same however the means are very different.
+The project is called 'Catcher Catcher'\footnote{Catcher Catcher Wiki, \url{http://opensource.srlabs.de/projects/catcher/wiki/Tutorial} [Online; Accessed 05.2012]} and also builds upon the OsmocomBB framework.
+The goals are the same, however, the means are very different.
As a codebase 'Catcher Catcher' uses the \texttt{mobile} application, a software that implements the firmware part of a mobile phone.
This results in an active approach to IMSI catcher detection.
An active connection is established between the phone and the base station in question.
-Basically this means that identification is done be letting a bait-phone get caught.
+Basically this means that identification is done by letting a bait-phone get caught.
-The advantage compared to the passive approach of this project uses is that one has more sure means at hand of identifying a potential catcher.
+The advantage compared to the passive approach this project uses is that one has more sure means at hand of identifying a potential catcher.
Features that are already implemented are \cite{catcher_catcher}:
\begin{itemize}
\item Encryption: Check whether encryption is enabled when doing a phone call.
@@ -801,7 +807,6 @@ Features that are already implemented are \cite{catcher_catcher}:
\end{itemize}
As one can see, missing encryption and reception of a silent text message are very strong indicators of being connected to a catcher.
This however comes at the cost of being discovered oneself.
-Additionally if the IMSI catcher is configured only to allow specific IMSI numbers an active approach cannot be used to evaluate it.g
It is not clear whether the project has been abandoned or whether it is developed further.
-Activity on the Wiki and Git has seized after December 2012. \ No newline at end of file
+Activity on the Wiki and Git has seized after December 2012.
diff --git a/Tex/Content/Detection.tex~ b/Tex/Content/Detection.tex~
new file mode 100644
index 0000000..45bdd4d
--- /dev/null
+++ b/Tex/Content/Detection.tex~
@@ -0,0 +1,812 @@
+\chapter{IMSI Catcher Detection System}
+
+This chapter will give an outline if the \gls{icds}, the technologies and techniques used.
+The first part summarises the frameworks and hardware upon which the system has been developed.
+From this point on, the second part explains how this framework can be used to harvest information and describes the process that is used by the \gls{icds} to evaluate this information.
+The last part shows how to configure and use the system to gather information from the surroundings and unveil IMSI catchers.
+
+\section{Framework and Hardware}
+The following section will give an overview of the OsmocomBB framework and how it works in conjunction with the Motorola C123 mobile phone to enable information harvesting for the \gls{icds}.
+OsmocomBB is one of many \gls{osmo} projects\footnote{Osmocom, \url{http://osmocom.org/} [Online; Accessed 04.2012]}. It delivers an open source implementation for the base band chip for certain mobile phones.
+Another \gls{osmo} project is OpenBTS which delivers software for configuring and operating a \gls{bts}.
+OpenBTS was used to realise the open source IMSI Catcher \cite{dennis} and the base station that will be used later to evaluate the performance of the \gls{icds}.
+
+\subsection{OsmocomBB}
+OscmocomBB implements the baseband part of \gls{gsm} as an open source project.
+Baseband part in this case means that it is an open source software to control the baseband chip inside the mobile phone.
+The baseband chip is the processor which manages the radio functionality of a mobile device.
+The goal is to have a phone, when using compatible hardware, operating on open source software only, as opposed to proprietary baseband implementations.
+Therefore, the project scope is implementing \gls{gsm} Layer 1--3 as well as hardware drivers for the baseband chipset.
+A simple user interface on the phone is planned but not yet implemented.
+At this stage a verbose user interface on the computer is used.
+The implementation being open source is beneficial to multiple areas \cite{osmo_rationale}:
+\begin{itemize}
+ \item \textbf{Security:} The software running on the baseband chips is highly proprietary and closed.
+ The source is often disclosed only to the mobile phone manufacturers using the specific chipset.
+ One cannot be sure that this software does not have bugs that could be exploited and ultimately pose a security risk to the subscriber.
+ \item \textbf{Education:} Currently knowledge about \gls{gsm} and its layers on a technical level is not very well spread.
+ An open source implementation as a reference could serve to educate more developers, generally interested in the subject of mobile communications and thus improve products and software.
+ Additionally, this implementation enables universities to hold practical lab courses and interested individuals to do hands-on experiments.
+ \item \textbf{Research:} A free implementation can decouple research on \gls{gsm} technologies from the industry, because key technologies are no longer only available to researchers employed by a specific company.
+ Additionally, security flaws can be uncovered and fixed more easily.
+ Modifications to the protocol stack can be deployed and tested in a real environment.
+ It is also possible to redirect all received and sent packages directly to Wireshark\footnote{Wireshark, \url{http://www.wireshark.org/} [Online; Accessed 04.2012]} for further analysis.
+\end{itemize}
+
+\subsubsection{Project Status}
+At this point, Layer 2 and Layer 3 do not actually run on the phone but rather on a computer to which the phone is connected via a serial cable.
+Layer 1 runs inside the custom firmware on the \gls{me} itself, since the procedures involving Layer 1 are very time critical.
+This has advantages as well as disadvantages.
+The disadvantage is that in order to run an application written using OsmocomBB you always have to have a computer in addition to the phone.
+The benefit, however, is that during the development process, the phone does not have to be touched after an initial deployment of the firmware.
+This means code can be modified, compiled and tested locally without the need of remote debugging.
+Experimenting is considerably easier this way.
+This separation would not work in the original \gls{gsm} specification.
+This is why an extra interface layer between Layer 1 and 2 had to be implemented to handle messaging over the serial interface between the two original layers.
+It is called Layer 1 Control, L1CTL.
+
+The current state of the project is, according to a presentation given on the 27$^\text{th}$ Chaos Communication Congress\footnote{27C3 public wiki (Day 3), \url{http://events.ccc.de/congress/2010/wiki/Welcome} [Online; Accessed 04.2012]} by Dieter Spaar and Harald Welte that the network Layers 1--3 are fully implemented, SIM cards can be accessed or emulated and \gls{gsm} cell selection and reselection are working.
+A3/A8 as well as A5/1 and A/52, Full Rate and Enhanced Full Rate codecs are there, so it is possible to do voice calls with an OsmocomBB application written for that purpose, called \texttt{mobile}.
+It features a terminal\,/\,telnet based interface, much like Cisco routers, however, there is no user interface for the phone so far.
+
+\subsection{Motorola C123}
+\label{sec:osmo_phones}
+Since the general idea behind OsmocomBB was to become a vendor independent open source \gls{gsm} implementation for everyone to use, there were certain requirements, the targeted hardware would have to meet.
+For the consumer side requirements, these were having a low price and a good availability.
+This criterion rules out \gls{diy} approaches since the number of produced devices would be low and thus costly or a significant amount of technical knowledge would be expected from all users to assemble the hardware.
+For the developer side, this would also mean implementing a lot on the lower levels of analog logic.
+Therefore the Motorola C123 was chosen, an old, very cheap phone that is well spread.
+It has the advantage of being very simple on the hardware side and very well documented because the technical documentation for the Texas Instruments Calypso Chipset \cite{osmo_slides} has been leaked.
+The TI Calypso is the baseband chipset that is used by the Motorola C123.
+Table \ref{tab:c123_specs} shows an overview of the main specifications for the phone.
+\begin{table}
+\centering
+ \begin{tabular}{ll}
+ \toprule
+ Component &Specification\\
+ \midrule
+ Band &GSM 900, GSM 1800\\
+ Size &$101\times 45\times 21$ mm\\
+ Weight &86 g\\
+ Battery &920mAh Li-Ion battery\\
+ Digital Baseband &Texas Instruments Calypso\\
+ Analog Basenand &Texas Instruments Iota TWL3025\\
+ GSM Transceiver &Texas Instruments Rita TRF6151C\\
+ \bottomrule
+ \end{tabular}
+ \caption{Technical specifications for the Motorola C123.}
+ \label{tab:c123_specs}
+\end{table}
+The OsmocomBB framework should work well or with small adjustments for any phone that is based on the same components.
+Figure \ref{fig:osmo_c123} shows an image of the Motorola C123 circuit board with the components mentioned before.
+\begin{figure}
+\centering
+ \includegraphics[width=.9\textwidth]{../Images/c123_pcb}
+ \caption{Circuit board of the Motorola C123 with its components \cite{osmo_wiki_c123}.}
+ \label{fig:osmo_c123}
+\end{figure}
+Another reason for choosing this hardware platform was that during the start of the OsmocomBB project, an open source implementation of \gls{gsm} Layer 1 was already available on Sourceforge (TSM30 Project) that could be used as a reference.
+At this point the original project has been removed from the Sourceforge site.
+
+In order to use the Motorola C123 in combination with the OsmocomBB framework, the custom firmware implementing Layer 1 and L1CTL has to be flashed onto the board.
+This has to be done using a RS332 serial cable that is connected to the 2.5\,mm audio jack.
+The audio jack of the Motorola C123 and other Calypso based mobile phones typically have a 3.3 V serial port on their audio jacks.
+These cables are normally referred to as T191 unlock cables.
+A variety of stores around the internet sell the cables ready made for about \$10--\$15.
+One must be careful when using the PC's serial port to communicate with the phone though.
+Since the phone's serial operates at 3.3\,V and is internally connected to the 2.8\,V IO-pins of the baseband processor, directly connecting it to the computer's 12\,V serial port will destroy the hardware.
+Therefore it is recommended to use a USB serial cable.
+Schematics for such an unlock cable are given in Appendix \ref{sec:osmo_serial_schematics}.
+
+\subsection{OsmocomBB and ICDS}
+The setup that is used for the \gls{icds} project can be seen in Figure \ref{fig:osmo_setup}.
+It was built and tested in a Xubuntu 11.10 environment\footnote{Xubuntu, \url{http://xubuntu.org/} [Online; Accessed 04.2012]} which is a more lightweight variant of the popular Debian based Ubuntu Linux distribution.
+The process of acquiring, compiling and running the OsmocomBB framework in this environment is explained in detail in Appendix \ref{sec:osmo_install}.
+
+When setting up the system, it is recommended \emph{not} to use a virtual machine.
+The bootloader and the firmware can fail to be deployed correctly if a virtual machine is used as development system.
+This is because the protocol used by Motorola to do the actual flashing process is \emph{very} time critical and thus timeouts can occur that are caused by the overhead the virtual machine imposes on the hardware\,/\,software communication.
+
+As can be seen in Figure \ref{fig:osmo_setup}, Layer 1 of the OsmocomBB \gls{gsm} stack runs on the phone which is connected via a serial cable to the computer running the \gls{icds}.
+On the computer side the \texttt{osmocon} program provides a general interface to the phone.
+\texttt{Osmocon} is also used to load the firmware up to the Motorola C123.
+Other software can communicate with \texttt{osmocon} and subsequently with the phone using Unix sockets.
+\begin{figure}
+\centering
+\includegraphics{../Images/OsmoStructure}
+\caption{Interaction of the OsmocomBB components with the ICDS software.}
+\label{fig:osmo_setup}
+\end{figure}
+
+The program \texttt{catcher}, the OsmocomBB part of the \gls{icds}, is a modified version of \texttt{cell\_log} by Andreas Eversberg that interfaces with \texttt{osmocon} to harvest information from \glspl{bts} and forward it to the core \gls{icds}.
+It can be seen as a Layer 3 program that scans through available frequencies and reads information from the \gls{bcch} whenever one such channel is available on the frequency at hand.
+The forwarding is done directly via \texttt{stdout} since it runs as a child process of the \gls{icds}.
+In a similar way, \texttt{pch\_scan} gathers information on the \gls{pch} of a specific base station.
+The functionality of \texttt{catcher} and \texttt{pch\_scan} will be explained in detail in Section \ref{sec:info_gathering} while the implementation and operation of the \gls{icds} will be discussed in Section \ref{sec:icds}.
+
+\section{Procedure}
+The main goal of the \gls{icds} is to reach a conclusion on whether it is safe to initiate a phone call or not, in other words if the base station our mobile phone will connect to is trustworthy.
+As mentioned before, as soon as a subscriber connects to an IMSI catcher, information on his\,/\,her location is automatically given up.
+Therefore, this project will use a passive approach on information harvesting, meaning we will only use information that is broadcasted or freely available as to not give up any hints of the \gls{icds} being active.
+
+To that end a four-step process is taken.
+First \emph{information is gathered}.
+This process is explained in detail in Section \ref{sec:info_gathering}.
+After information on the surrounding \glspl{bts} is ready inside the \gls{icds}, a set of checks is evaluated on each base station individually, with each yielding a specific result for the station.
+These checks are called \emph{rules} and discussed further along with the next two steps in Section \ref{sec:info_evaluation}.
+Afterwards, the results the rules yielded for each base station have to be aggregated into one single result for each \gls{bts} by an \emph{evaluator}.
+At last, after every \gls{bts} has its evaluation, it can be decided whether to \emph{tell the subscriber} if it is safe to initiate a phone call or not.
+
+\subsection{Information Gathering}
+\label{sec:info_gathering}
+As explained in Section \ref{sec:common_channels}, every base station has an associated \gls{bcch} where information about the station and its network is spread.
+\gls{bcch} frames are always sent inside a 51-Multiframe.
+After the \gls{ms} has synchronised using the values on the \gls{fcch} and \gls{sch}, it can determine which kind of information is hosted inside the \gls{bcch} message.
+These so called \emph{System Information Messages} originate at the \gls{bsc} and are produced for each \gls{bts} individually and then periodically broadcasted.
+Since all the required information would not fit inside a single frame, there are different kinds of System Information Messages that are distinguished by their \gls{tc} and host different kinds of information.
+The type can be extracted using the \gls{fn} of the frame the message is sent in \cite{GSM2009}:
+\[\text{TC}=(\text{FN} \text{ div } 51)\text{ mod } 8\]
+Table \ref{tab:tc_mapping} shows how the \glspl{tc} can be mapped on those types.
+\begin{table}
+\centering
+\begin{tabular}{lc}
+\toprule
+TC &System Information Type\\
+\midrule
+0 &Type 1\\
+1 &Type 2\\
+2,6 &Type 3\\
+3,7 &Type 4\\
+4,5 &Any (optional)\\
+\bottomrule
+\end{tabular}
+\caption{Type Codes and the corresponding System Information Types \cite{GSM2009}.}
+\label{tab:tc_mapping}
+\end{table}
+For this project the System Information Type 1--4 are of interest because these are available to all \glspl{ms} that tune in to the particular \gls{bcch} of the respective \gls{bts}, without actively connecting to it.
+
+The information contained inside the System Information Messages is harvested via the \texttt{catcher} program.
+\texttt{Catcher} is implemented inside the OsmocomBB framework and connects over the \texttt{osmocon} application to the Motorola C123.
+At first, a sweep scan is done over all the \glspl{arfcn} to measure their reception levels, in order to determine where base stations and thus \glspl{bcch} are located.
+Afterwards \texttt{catcher} tunes the phone to those specific frequencies where a \gls{bts} was found.
+
+At each such frequency, it waits until all the System Information Messages are gathered and extracts parameters where possible.
+The parameters, along with the raw data are forwarded to the main \gls{icds} application for further evaluation.
+An example of a fully parsed System Information Type 2 Message can be seen in Figure \ref{fig:si1} \cite{protocols1999}.
+The Neighbouring Cell List for example which is a very valuable source of information, is located in inside the highlighted section of the message.
+\begin{figure}
+\centering
+\includegraphics[width=.8\textwidth]{../Images/sysinfo2marked}
+\caption{System Information 2 Message \cite{protocols1999}.}
+\label{fig:si1}
+\end{figure}
+Examples for all the System Information Messages used, along with an interpretation are located in Appendix \ref{sec:system_infos} and information on how they are interpreted can be found in 3GPP TS 44.018 \cite{sysinfos}.
+As long as scanning mode is active, all the available stations are scanned repeatedly and changes in the \glspl{bts} will continuously update the data model inside the \gls{icds} software.
+The parameters currently harvested are:
+\begin{itemize}
+ \item MCC: The Mobile Country Code the base station is broadcasting.
+ \item MNC: The Mobile Network Code the base station is broadcasting.
+ \item ARFCN: The \gls{arfcn} on which the base station is located.
+ \item rxlev: Receiving strength in dB.
+ This parameter is measured by the Motorola C123 and not part of the System Information Messages.
+ Even small changes in the location can have a large impact on this parameter due to shadowing and reflection.
+ \item BSIC: Because of frequency reuse in a cellular network, it is possible that two different base stations can send at the same \gls{arfcn}.
+ In order for the \gls{ms} to keep these apart a \gls{bsic} is broadcasted by each \gls{bts}.
+ It consists of a \gls{ncc} identifying the provider, so the \gls{ms} can filter out messages that it does not need beforehand and the \gls{bcc} that must be unique for a given provider over all base station in a large area.
+ \item LAC: This is the last part of the \gls{lai} (that consists of \gls{mcc} + \gls{mnc} + \gls{lac}) and is a hierarchical identifier for a given set of base station.
+ The hierarchy is provider wide, meaning two different providers may use \glspl{lac} with a completely different numbering system.
+ The \gls{lac} is used by the provider to tell the \gls{ms} that it entered a new area and has to announce itself.
+ \item \gls{cid}: The \gls{cid} is a unique identifier for the cell the \gls{ms} is connected to.
+ Unique in this case means unique in a large area so that a mobile phone should never receive the same \gls{cid} for different base stations.
+ \item Neighbouring Cell List: Each base station keeps a list of other base stations in the perimeter for the \gls{ms} to scan and determine if there is a \gls{bts} with a better reception in the area.
+\end{itemize}
+Note that there are different formats for the Neighbouring Cell List since the original number of 17 bytes could only present a bit mask for 124 neighbouring \glspl{arfcn}.
+This works for the 900 MHz band, but for the extended 900\MHz and the 1800\MHz band the System Information Type 2bis and System Information Type 2ter have to be harvested additionally, to construct the Neighbouring Cell List.
+
+The \texttt{pch\_scan} tool does not rely on the \gls{bcch} but rather on information available on the \gls{pch}, as the name implies.
+If a mobile phone is connected to a base station and not actively participating in a communication process, it is in a passive mode to save battery, waiting for either the user to initiate communication or the network to contact it.
+As mentioned in Section \ref{sec:common_channels}, the network contacts the \gls{ms} on the \gls{pch} if there is a text message or a call, waiting to be delivered.
+\begin{figure}
+\centering
+\includegraphics{../Images/Paging}
+\caption{Procedure taken when the network has a call\,/\,text waiting for a passive subscriber.}
+\label{fig:paging}
+\end{figure}
+The procedure is outlined in Figure \ref{fig:paging}.
+A paging request by the network is answered by the \gls{ms} by requesting a dedicated channel, which is assigned by the network in turn with an \gls{ia}.
+From this point on the connection can be set up.
+
+The \texttt{pch\_scan} listens for activity on this channel and harvests the following information:
+\begin{itemize}
+ \item Paging Messages: The \gls{icds} is informed about every Paging Message that has been caught.
+ \item Immediate Assignment: If an \gls{ia} is caught, it is logged and parsed.
+ The \gls{tmsi} to which the \gls{ia} was sent as well as the assigned channel number and whether it is a frequency hopping channel or not is forwarded to the \gls{icds}.
+\end{itemize}
+
+\subsection{Information Evaluation}
+\label{sec:info_evaluation}
+Each base station is evaluated, the moment the data completely arrived at the \gls{icds} application.
+Additionally, when a new \gls{bts} has been found and added, all formerly discovered stations are also re-evaluated since new discoveries can have an impact on the rules that evaluate the context surrounding an old base station.
+
+As mentioned above, evaluation is done based on constructs called \emph{rules}.
+Each rule represents one check that can be performed on a base station and yields a result based on its findings.
+A rule can also be seen as a mapping from a set of input parameters to one of the values \emph{Ok}, \emph{Warning}, \emph{Critical}, \emph{Ignore}.
+\[\lbrace \text{Base station parameters}\rbrace \mapsto \lbrace \text{Ok}\lvert\text{Warning}\lvert\text{Critical}\lvert\text{Ignore}\rbrace\]
+
+A \emph{Critical} result means that the base station evaluated has a critical configuration error or critical settings that are not found on normal base stations, \eg unknown provider names or empty neighbourhood lists.
+This station should not be trusted.
+
+If a \emph{Warning} status is yielded, the \gls{bts} at hand has some concerning features but it could not be said whether it really is an IMSI catcher or sheer coincidence.
+An example would be a base station having a Neighbouring Cell List of which none of the cells therein have actually been discovered.
+The list could either be a fake or it could simply be coincidence that the scan has not found any.
+They could have been out of range for example.
+
+In some cases a rule cannot yield a finding.
+That is when the state is explicitly set to \emph{Ignore}, so the evaluator knows that this rule should have no influence on the final outcome.
+This is the case for example when a rule refers to a parameter that has not been looked up or scanned.
+
+If everything went as expected, \emph{Ok} is returned.
+
+The rules can be divided into four different categories depending on how they work and which situations they are tailored to.
+Most of the rules are parametrised, so they can be tweaked to different environments and standards.
+The different rule categories are \emph{Configuration Rules}, \emph{Context Rules}, \emph{Databse Rules} and \emph{Scan Rules}.
+
+\subsubsection{Configuration Rules}
+The first set of rules, called \emph{Configuration Rules}, targets the base station itself.
+Rules in this category are meant to check parameters of a single \gls{bts} for integrity and configuration mistakes that could have been made by an IMSI catcher operator.
+An overview of the Configuration Rules that are currently implemented inside the \gls{icds} is given in Table \ref{tab:config_rules}.
+\begin{table}
+\centering
+\begin{tabular}{ll}
+\toprule
+Rule &Functionality\\
+\midrule
+Provider Known &Checks whether the provider is in a list of known \\
+ &providers.\\
+Country\,/\,Provider Map &Checks whether the given provider is a valid provider\\
+ &for the given country.\\
+LAC\,/\,Provider Map &Checks whether the LAC of the station is in the normal\\
+ &LAC range for that provider, given the area.\\
+ARFCN\,/\,Provider Map &Checks whether the ARFCN is in the officially registered\\
+ &range of the provider.\\
+\bottomrule
+\end{tabular}
+\caption{Configuration Rules implemented inside the ICDS.}
+\label{tab:config_rules}
+\end{table}
+
+A few things have to be noted when configuring these rules.
+Since there is no official listing or rule on how the \gls{lac} should look like, the LAC\,/\,Provider Mapping Rule needs knowledge of the area in which the \gls{icds} is used.
+The \gls{icds} itself can be used to gather that knowledge, but it has to be done prior to using the rule for base station evaluation.
+The \gls{arfcn} range each provider has registered in Germany can be looked up at the website of the Bundesnetzagentur\footnote{Bundesnetzagentur Vergabeverfahren, \url{http://www.bundesnetzagentur.de/cln_1911/DE/Sachgebiete/Telekommunikation/RegulierungTelekommunikation/Frequenzordnung/OeffentlicherMobilfunk/VergabeVerfahrenDrahtlosNetzzugang/vergabeVerfahrenDrahtlosNetzzugang_node.html} [Online, Accessed 04.2012]} which is needed for the ARFCN\,/\,Provider Mapping Rule.
+
+The main problem at this point is that all the parameters that can be checked by these rules can also be set by the operator of the IMSI catcher.
+If these are set in a consistent way, this set of rules is not sufficient to identify a catcher.
+Therefore, another set of rules has to be added that incorporates information of surrounding nodes.
+
+\subsubsection{Context Rules}
+The second set of rules is called \emph{Context Rules}.
+As the name suggests, these rules serve the purpose of checking how well a given \gls{bts} fits into its neighbourhood.
+Table \ref{tab:context_rules} shows which rules have been implemented.
+\begin{table}
+\centering
+\begin{tabular}{ll}
+\toprule
+Rule &Functionality\\
+\midrule
+LAC Median Deviation &Checks whether the LAC of the given BTS deviates\\
+ &more than a certain threshold from the median LAC of\\
+ &that provider.\\
+Pure Neighbourhoods &Checks whether all stations found in the Neighbouring\\
+ &Cell List share the same provider.\\
+Neighbourhood Structure &Checks the structure of the Neighbouring Cell List for\\
+ &certain patterns.\\
+Discovered Neighbours. &Checks whether a certain amount of the cells in the\\
+ &Neighbouring Cell List have actually been found.\\
+Cell ID Uniqueness &Checks whether there are other cells with the same\\
+ &CID.\\
+\bottomrule
+\end{tabular}
+\caption{Context Rules implemented inside the ICDS.}
+\label{tab:context_rules}
+\end{table}
+
+For the LAC Median Deviation Rule, the median was chosen over the average since an extreme value (ill configured IMSI catcher) would have too strong an impact on the average, to which all the \gls{bts} are compared.
+It could even have such a strong effect on the average that legitimate base stations would fall below the threshold and be recognised as catchers.
+The threshold, at which deviation a node is evaluated as being \emph{Critical} can be set in the configuration section for the rule.
+A value of 0 would mean that no deviation from the median is allowed.
+This could lead to problems as some experimental scans have shown.
+However, in none of the scans more than two different \glspl{la} have been found per provider and since these were neighbouring areas, the difference in the code was only 1.
+For the Freiburg area a 1\% threshold for the deviation yielded good results.
+
+\paragraph{Neighbourhood Structure}
+The Neighbourhood Structure is the graph that is described by the Neighbouring Cell List located in the System Inforamtion 2\,/\,2bis\,/\,2ter constructs.
+Figure \ref{fig:neighbourhood_example} shows an extract of the neighbourhood graphs at the Faculty of Engineering of the University of Freiburg\footnote{Georges K\"ohler Allee, Freiburg}.
+The E-Plus subgraph has been enlarged.
+\begin{figure}
+\centering
+\includegraphics[width=.9\textwidth]{../Images/neighbourhoods_fak}
+\caption{Some base stations and their neighbourhood connections at the Faculty of Engineering.}
+\label{fig:neighbourhood_example}
+\end{figure}
+It can be seen that for each provider, the neighbourhood forms an isolated, nearly fully connected subgraph.
+Nodes with a green background have an \emph{Ok} rating, while the red node has a \emph{Critical} rating.
+The bordering white nodes have not yet been discovered and evaluated, therefore, they have no outgoing edges, for no Neighbouring Cell Lists have been extracted.
+They were merely found by extracting the Neighbouring Cell Lists of other nodes.
+This could be the case because they are too far away for the Motorola to receive or because of signal damping due to shadowing and reflection effects.
+In the \gls{icds}, the aspect of isolated subgraphs for neighbourhoods is captured inside the \emph{Pure Neighbourhoods Rule}.
+
+An interesting fact is that one node inside the E-Plus subgraph on the upper right is marked \emph{Critical}.
+This is because it is a \gls{bts} of the university's own \gls{gsm} network.
+It was set up to be in a E-Plus neighbourhood but is not consistent with the E-Plus nodes surrounding it.
+Therefore it is marked by the \gls{icds}.
+
+The node was set up inside the E-Plus neighbourhood for another Master Thesis \cite{richy} at the Chair of Communication Systems where the goal was to estimate the most probably position of a subscriber, given his\,/\,her reception levels.
+
+Some of the attacks discussed in Section \ref{sec:attacks} imply a certain structure of the neighbourhood graph.
+Since the IMSI catcher tries to lock in \glspl{ms} that have connected from switching back to a normal cell, the neighbourhood list of such a catcher cell would either be empty or would only host neighbour cells that have a lower reception strength than itself.
+
+An empty Neighbouring Cell List is represented in the graph by a node that has been discovered and has no outgoing edges.
+A Neighbouring Cell List containing only imaginary nodes serves the same purpose.
+\begin{figure}
+\centering
+\subfigure[Normal neighbourhood]{
+\begin{tikzpicture}[->,>=stealth',shorten >=1pt,auto,node distance=3cm,
+ thick,main node/.style={circle,fill=blue!10,draw,font=\sffamily\Large\bfseries}]
+
+ \node[main node] (1) {A};
+ \node[main node] (2) [below left of=1] {B};
+ \node[main node] (3) [below right of=1] {C};
+
+ \path[every node/.style={font=\sffamily\small}]
+ (1) edge node {} (2)
+ edge node {} (3)
+ (2) edge node {} (1)
+ edge node {} (3)
+ (3) edge node {} (1)
+ edge node {} (2);
+\end{tikzpicture}
+}
+\subfigure[Tainted neighbourhood]{
+\begin{tikzpicture}[->,>=stealth',shorten >=1pt,auto,node distance=3cm,
+ thick,main node/.style={circle,fill=blue!10,draw,font=\sffamily\Large\bfseries}]
+
+ \node[main node] (1) {A};
+ \node[main node] (2) [below left of=1] {B};
+ \node[main node, fill=orange!20] (3) [below right of=1] {C};
+ \node[main node, fill=orange!20] (4) [right of=1] {D};
+
+ \path[every node/.style={font=\sffamily\small}]
+ (1) edge node {} (2)
+ edge node {} (3)
+ (2) edge node {} (1)
+ edge node {} (3)
+ (4) edge node {} (1)
+ edge node {} (2);
+\end{tikzpicture}
+}
+\caption{Comparison between a normal neighbourhood subgraph and a tainted one.}
+\label{fig:structure_comparison}
+\end{figure}
+Figure \ref{fig:structure_comparison} shows a simplified, regular neighbourhood graph, compared to a graph with two catcher nodes inside.
+In this case, catcher C chose the attack where it replaces a previously existent \gls{bts}, whereas catcher D opened up a new cell.
+Replacing has several advantages, one being already integrated in the neighbourhood of other nodes.
+Mobile phones will constantly monitor the reception strength of all neighbouring nodes and thus also the reception strength of the IMSI catcher which replaced one.
+For catcher D it is the other way around, it has only outgoing edges.
+This means that this cell is not known by any other node of the same provider.
+Nevertheless, it has some outgoing edges to nodes with significantly less transmission strength to not stick out too much as a completely isolated node.
+Combinations of these two approaches are also possible.
+These thoughts are basically what is captured inside the \emph{Neighbourhood Structure Rule}.
+The procedure the Neighbourhood Structure Rule follows is:
+\begin{enumerate}
+ \item Check if the node in question has neighbours and check if at least one neighbour has been discovered.
+This rules out the cases where IMSI catchers have no neighbours or only an imaginary list.
+ \item If no neighbours have been discovered by the \gls{icds}, check if other nodes share some of the neighbours, if yes yield a \emph{Warning}, else yield \emph{Critical}.
+If the node is question is a legitimate node and the rare case occurs that none of its neighbours are in reach, most of its neighbours should be shared by other nodes of the same provider.
+ \item Check if other nodes of the same provider have the node in question inside their neighbourhood list, \eg if the node in question has incoming edges.
+This would not be the case, for example, for an IMSI catcher that broadcasts on a new \gls{arfcn}.
+ \item If none of the above criteria suggested otherwise, yield \emph{Ok}.
+\end{enumerate}
+This rule cannot find an IMSI catcher that has in- and outgoing edges, in other words a device that replaced a legitimate base station and copied the Neighbouring Cell List from the original cell.
+Such a catcher would transmit at a very high strength and thus make sure all its neighbours have a worse reception on the target mobile phone.
+It is generally not possible, to rule out base stations where all outgoing edges point to base stations with a lower reception, since every legitimate neighbourhood will have one node that excels all other nodes in terms of reception.
+
+The Neighbourhood Structure Rule tests if at least one neighbour has actually be found.
+To raise this threshold the \emph{Discovered Neighbours Rule} can be used.
+It takes a parameter as an input which is interpreted differently depending on its range.
+If the threshold is in the interval $[0,1]$ it is interpreted as a percentage.
+$0.5$ meaning that at least half the neighbours in the list need to be found for the rule to give an \emph{Ok} rating.
+A threshold in the interval $(1,+\infty)$ means that this absolute number of base stations have to be found.
+If a floating point number is provided the decimal places are stripped.
+As an example $3$ and $3.84$ would both mean that at least $3$ neighbours would have to be found.
+This representation cannot cover the 'at least one' statement since $1$ equals $100\%$, which is no problem for this case is already covered by the Neighbourhood Structure Rule.
+
+\subsubsection{Database Rules}
+Let us do a quick summary of the situation so far.
+To investigate the current possibilities unveiling a catcher, we will look over the parameters with the two attack types presented in Section \ref{sec:attacks} in mind.
+For both attack types presentedm it is possible to find a parameter configuration that does not raise suspicion, if the operator chooses a compatible \gls{arfcn}, \etc for the mimicked provider.
+Therefore the Configuration Rules and most of the Context Rules will yield an \emph{Ok} result.
+
+The Neighbouring Cell List is a bit different.
+Since the catcher wants to keep lured subscribers, it will normally have an empty list or a list pointing only to \glspl{bts} imaginary neighbours.
+Both of these cases can be detected.
+However the operator \emph{may} also choose to set a list consistent with the neighbouring cells, \eg a catcher replacing a cell and copying the neighbourhood list.
+
+Another parameter has to be introduced to yield information in the cases the rules mentioned before fail, the \gls{cid}.
+For the \gls{cid}, there are basically two possibilities depending on which attack type is used.
+The first possibility is that the IMSI catcher opens up a new cell and the second one is that it replaces a formerly existent cell.
+In the first case parameters can be chosen in a consistent way although a new \gls{cid} has to be chosen, as the \gls{cid} needs to be unique.
+In the second case all parameters can be copied from the original cell.
+Both possibilities can be resolved by adding outside knowledge to the \gls{icds} thus circumventing the problem of other parameters being forged.
+This is done by rules called \emph{Database Rules}.
+
+\begin{table}
+\centering
+\begin{tabular}{ll}
+\toprule
+Rule &Functionality\\
+\midrule
+Cell ID Database &Checks all CIDs in the area against a database.\\
+Local Area Databse &Checks whether the LAC of the given BTS deviates.\\
+\bottomrule
+\end{tabular}
+\caption{Database Rules implemented inside the ICDS.}
+\label{tab:database_rules}
+\end{table}
+
+Table \ref{tab:database_rules} shows the rules that each handles one of these cases.
+The first case is the easier of both.
+We know that the catcher cell has a new \gls{cid} that has not been there before.
+Therefore, the \emph{Cell ID Database Rule} has two different means to exploit this fact:
+\begin{itemize}
+ \item A database of \glspl{cid} can be learned by the \gls{icds} beforehand.
+ This can be used to detect new \glspl{cid} that have not been seen before.
+ \item A commercial or public \gls{cid} database can be used to compare against the \glspl{cid} found by the \gls{icds}.
+ A web service is also offered by most providers of Cell ID databases.
+\end{itemize}
+The three largest \gls{cid} databases are the two commercial ones by Ericson\footnote{Ericson Labs, \url{https://labs.ericsson.com/apis/mobile-location/} [Online; Accessed 04.2012]} and combain\footnote{Mobile Positioning Solutions, \url{http://location-api.com/} [Online; Accessed 04.2012]} as well as the free alternative OpenCellID\footnote{OpenCellID, \url{http://www.opencellid.org/} [Online; Accessed 04.2012]} \cite{wiki_cells}.
+Ericson and combain have models where a subscription or a fee per request must be paid.
+Another free alternative with a large coverage is Google Mobile Maps that also offers a web service where the \glspl{cid} and the respective \glspl{lac} can be checked against their database to obtain localisation information (or simply check if they are contained in the database).
+By adding this information new cells can be identified.
+
+The second attack type where an existing cell is replaced, is a bit more complicated since its parameters are an exact copy of the old cell.
+Attacking by replacing a cell works in a way that the cell with the worst reception is targeted.
+That way when the IMSI catcher finished replacing it, the reception goes up a significant amount and the mobile phone will move over to that cell.
+The difference in reception can be used to identify this kind of attack.
+In general the reception cannot be used well as a parameter because shadowing and reflection can substantially change the reception from one moment to the other when minimal movements have occurred.
+However, if reception intervals are logged for a fixed location, like an office, important calls made from that specific location can be protected against this kind of attack.
+To that end, the \gls{icds} can monitor reception levels to build up databases, with information on the reception intervals of the cells in different, fixed locations.
+The \emph{Local Area Database Rule} then checks if reception levels differ significantly for a given location.
+
+\subsubsection{Scan Rules}
+\begin{table}
+\centering
+\begin{tabular}{ll}
+\toprule
+Rule &Functionality\\
+\midrule
+rx Change &Watches out for changes in reception.\\
+LAC Change &Watches out for changes in LACs.\\
+\bottomrule
+\end{tabular}
+\caption{Scan Rules implemented inside the ICDS.}
+\label{tab:scan_rules}
+\end{table}
+At this stage, if local information is present, an IMSI catcher should be identified with a high probability.
+However, if local information has not been gathered in advance, the main idea of Database Rules can still be applied.
+In contrast to the other three categories of rules mentioned before, \emph{Scan Rules} evaluate parameter changes over time.
+This means parameters are being monitored over the duration of one or multiple sweep scans and changes are noted.
+The \emph{rx Change Rule} builds upon the same idea as the \emph{Local Area Database Rule}, only applied to a scan-to-scan basis.
+Changes in reception are evaluated against the last known reception level for each base station.
+
+When watching for parameter changes, the \gls{lac} is another interesting parameter.
+If a mobile phone connects to an IMSI catcher due to its better reception level, the mobile phone will not immediately announce itself, thus the IMSI catcher has no knowledge that a new subscriber connected to it.
+A mobile phone announces itself by sending Location Updates to the network, this is only done when a certain timeout is reached or when the phone enters a new \gls{la}.
+Since this timeout can be very large (the lowest value possible is 6 minutes), an IMSI catcher usually sends a different \gls{lac} than the original cell, to force the \gls{ms} to announce itself by sending a Location Update.
+IMSI catchers showing this kind of behaviour are uncovered by the \emph{LAC Change Rule}
+
+\subsubsection{Remaining Issues and Paging}
+\label{sec:paging}
+If a catcher is configured in a consistent way, replaces a cell and by chance has an \emph{appropriate transmission power}, the \gls{icds} will not unveil it up to now, if it also chooses to maintain a non-suspicious Neighbouring Cell List and does not transmit a new \gls{lac}.
+\emph{Appropriate transmission power} in this case means that the reception of the catcher does not differ significantly from the reception of the original base station.
+
+An IMSI catcher is not part of a provider's network, it is merely a proxy for a base station.
+At best, it can route calls into a network but it cannot take calls that are intended for a subscriber and route them.
+Therefore, an IMSI catcher will not send Paging Messages to connected subscribers, while a normal base station will have a very high number of pagings depending on the number of subscribers that are connected.
+This is a significant difference between a catcher and a regular base station.
+
+This is an additional information that can be used to identify an IMSI catcher.
+The program \texttt{pch\_scan} tunes the Motorola C123 to the \gls{pch} of a particular base station and gathers Paging Messages and \glspl{ia}.
+If no Paging Messages could be collected during a longer period of scanning it is a strong indicator towards being confronted with an IMSI catcher.
+Additionally, when \glspl{ia} are found the scan extracts whether the assigned channel is a frequency hopping channel or not.
+Since frequency hopping is considered a security feature by providers, all German providers always assign frequency hopping channels.
+An IMSI catcher however may not support hopping since it does not have multiple frequencies at hand.
+
+The \emph{PCH Scan} feature has not been implemented as a regular rule because each given base station needs some time to be scanned.
+If that would be done on a regular basis for every station that has been discovered, it would delay the whole scan by a large amount of time and the interval between re-evaluations would be very high.
+Therefore, it was implemented as an extra feature to be used when needed.
+The \gls{icds} also uses this method on particularly filtered base stations in \emph{User Mode} as will be explained in Section \ref{sec:user_mode}.
+
+\subsection{Base Station Evaluation}
+\label{sec:evaluators}
+All the rules are evaluated for each base station.
+Aggregation of these rule results into a single result is done by modules called \emph{evaluators}.
+Currently there are two different evaluators implemented inside the \gls{icds}:
+\begin{itemize}
+ \item Conservative Evaluator: This is a worst-case evaluator.
+ It iterates over all the rule findings and yields the most concerning finding as its result.
+ By default this evaluator is enabled in the system.
+ \item Grouped Evaluator: With this evaluator rules can be grouped together.
+ Inside each group the result for the group is found by majority vote, whereas the final result is conservatively found by comparing all the group results.
+\end{itemize}
+Different kinds of evaluators can be used to tweak the whole system more to a specific environment or purpose, if specific rules are grouped together.
+They are meant more for experimental purpose, if the \gls{icds} is used as a toolbox for analysing base stations, to give more freedom in use to the operator.
+In case of the system being used in \emph{User Mode} or for the sole purpose of finding whether an IMSI catcher is active or not, the conservative evaluator should almost always be the evaluator of choice and tweaking should be done on the rule parameters rather than on the evaluator.
+
+After a result has been determined for each station, all the results are again aggregated into a final result.
+The overall result depends on which mode the \gls{icds} is used in.
+If it is used in normal mode, the final result will be a conservatively aggregated result over all the stations in the list.
+If the \gls{icds} is run in \emph{User Mode}, which is the mode an end user would use the system in, the \gls{icds} looks up the provider the user has entered, filters out the base station with the best reception for that provider and yields its evaluation as final evaluation.
+This reflects the fact that a subscriber cannot choose the \gls{bts} it connects to, since the \gls{ms} will always connect to the best base station available for its given provider.
+
+\section{Implementation}
+\label{sec:icds}
+This section will discuss some technical aspects of the \gls{icds} software itself.
+The first section focuses on architectural aspects and how the architecture can be extended whereas the second and third section will then explain how to configure and operate the application.
+
+\subsection{Architecture}
+\begin{figure}
+\centering
+\includegraphics{../Images/Architecture_software}
+\caption{System architecture of the ICDS. The arrows indicate the flow of data.}
+\label{fig:architecture}
+\end{figure}
+Figure \ref{fig:architecture} shows a diagram describing the system architecture, the modules in light blue have been implemented for this project.
+The application consists of two main parts.
+One part, the \texttt{catcher} and \texttt{pch\_scan} programs, are implemented inside the OsmocomBB framework, the other part, \emph{PyCatcher}, is a Python application that uses \texttt{catcher} and \texttt{pch\_scan} to harvest information and evaluate it afterwards.
+Since the way these two sub-programs work has already been described in Section \ref{sec:info_gathering}, this section will focus on the Python application part.
+
+As mentioned before, Layer 1 of the \gls{gsm} stack is implemented in the firmware running on the Motorola C123.
+Layer 2 and Layer 3 are implemented on the computer and are used by the \texttt{catcher} and the \texttt{pch\_scan} software to harvest information from the \gls{bcch} and \gls{pch} respectively.
+
+The PyCatcher application was designed with a \gls{mvc} approach in mind to make it easy to implement new functionality.
+The \gls{mvc} pattern is used to separate the data model of an application from the logic as well as from the way it is presented to the user.
+That way each of the different components can be exchanged without affecting the other two.
+An additional module has been added, the \emph{OsmoConnector} that is loaded by the controller and spawns \texttt{catcher} as a child process.
+It takes the output back in and transforms it into an object oriented representation of the discovered base stations.
+These are then handed over and update the data model.
+This way, it can be ensured that only coherent and complete information is incorporated in the data model.
+Another benefit is that the parsing module is isolated from the main program logic.
+OsmoConnector is also the module that spawns \texttt{pch\_scan} when requested by the controller.
+
+The \emph{controller} is the main part of the program and instantiates all the other modules.
+It loads data from the model, triggers the evaluation and sends the results to the view to be displayed.
+As discussed before, there are several rules that can be evaluated for each base station.
+These rules are stored within the controller and can be enabled or disabled by using the view that relays new rule configurations back to the controller to be applied.
+Whenever a new evaluation is requested, the controller evaluates the active rules and gives the results to the active evaluator, afterwards the results are send to the view for display to the user.
+Note that all the structures used are view independent, this way the current view could easily be exchanged with a web interface for example.
+
+The \texttt{view} in this project consists of a GTK3\footnote{The GTK+ Project, \url{http://www.gtk.org/} [Online; Accessed 06.2012]} window with several forms for user input.
+It is bound to the controller using PyGTK\footnote{PyGTK, \url{http://www.pygtk.org/} [Online; Accessed 06.2012]}.
+Details on the view and how to use it will be explained in Section \ref{sec:icds_operation}.
+
+Rules and evaluators were designed in a plugin fashion, since these are the main points where the program can be enhanced and new ideas can be realised.
+Implementing a new rule or a new evaluator works by extending the rule or evaluator base class and implementing one method inside the derived class that contains the actual logic.
+After that has been done, they only need to be added to the list of evaluators and rules included inside the controller.
+Appendix \ref{sec:extensions} gives an example of how this can be done.
+
+\subsection{Configuration}
+\label{sec:configuration}
+\begin{figure}
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
+dictionary = {
+ 'key_1': value_1, #single value
+ 'key_2': (value_2,value_3) #value range
+ 'key_3': [value_5, value_6] #list of values
+}
+
+variable = value_7 #simple variable
+\end{lstlisting}
+\end{minipage}
+\caption{Configuration Dictionary in the settings file.}
+\label{fig:python_dict}
+\end{figure}
+The configuration of the system is located in the \texttt{settings.py} file.
+All configuration is done within the python language, where each module has its own dictionary inside which it can have an arbitrary number of parameters with their respective values or if only few parameters are required they are read in as simple variables.
+Figure \ref{fig:python_dict} shows an example with the four common expressions used for parameters in this project.
+
+The file consists of five main sections.
+The first one contains parameters that are needed for the correct operation of the \gls{icds} system and have to be edited depending on the environment:
+\begin{itemize}
+ \item \texttt{Device\_settings}: The setting for the mobile phone that is used.
+ In case the Motorola C123 is used, this section does not need to be edited.
+ \item \texttt{Osmocom\_lib}: The path to the folder that contains the OsmocomBB framework.
+ \item \texttt{Commands}: This is only to be edited when a newer version of the framework is used and the folder structure has changed compared to the release that was used in this project.
+\end{itemize}
+The second and third sections contain parameters for the different rules and evaluators.
+This is followed by a section to set some general parameters for the \texttt{pch\_scan} tool and a section where the locations of the different databases can be changed.
+A completely documented configuration file with all the rule and evaluator parameters can be found in Appendix \ref{sec:example_config}.
+The file is read in as a python file.
+This way python code can also be used to change settings dynamically depending on the environment or how the \gls{icds} is started.
+
+\subsection{Graphical User Interface}
+\label{sec:icds_operation}
+The \gls{icds} main application has to be started with root privileges since it needs to work with Unix sockets and open up connections to the Motorola C123.
+This should be done by starting up the \texttt{main} class that initialises everything else.
+\[\texttt{sudo python /path-to-project/Src/PyCatcher/src/main.py}\]
+After a brief loading time the main window shown in Figure \ref{fig:icds} will appear if a valid configuration is set up.
+
+\begin{figure}
+\centering
+\includegraphics[width=\textwidth]{../Images/ICDS}
+\caption{The ICDS main window.}
+\label{fig:icds}
+\end{figure}
+
+The different elements shown in the main window are:
+\begin{enumerate}
+\item Firmware Loader: This button is used to load the OsmocomBB firmware onto the Motorola C123.
+For this to work, the mobile phone must be connected correctly to the computer and available on the configured \texttt{tty} interface.
+After pressing the button, on-screen instructions will lead the user through the process of flashing.
+
+\item Scanner: This starts the \texttt{catcher} subprocess in the background and fills the data model with information on the discovered base stations.
+During this process, the Base Station List (11) and the Base Station Graph (13) will also be populated in realtime.
+Re-evaluation on all base stations is done for every new \gls{bts} that has been found.
+
+\item Filter Window: This brings up the window shown in Figure \ref{fig:filters_window}, where different view filters for the Base Station List and the Base Station Graph can be set.
+Note that these filters do not modify the underlying data model or the behaviour of the scanner, they merely manipulate the view.
+Hidden base stations will be scanned and added to the data model independent from the filters set, so they can be viewed at a later point if necessary.
+Available filters are:
+ \begin{itemize}
+ \item Provider Filter: Takes a comma separated white list of providers that should be shown.
+ \item ARFCN Filter: Takes a range of \glspl{arfcn} to be shown.
+ \end{itemize}
+These two filters can be combined together.
+Filters are designed the same way as rules and evaluators, a new filter can be implemented by derivation of the base class.
+
+\item Rules Window: All the rules implemented inside the \gls{icds} will be brought up with a check box to enable or disable these rules.
+Disabling means that they will not be considered for the evaluation of a base station.
+A screenshot can be seen in Figure \ref{fig:rules_window}.
+If rules are changed during a sweep scan, everything will be re-evaluated according to the new rule set, without interrupting the scan.
+
+\item Evaluator Window: This window will let the user choose which evaluator, discussed in Section \ref{sec:evaluators}, to use for \gls{bts} evaluation.
+Choosing a new evaluator will also trigger a re-evaluation of all the data collected so far.
+
+\item Evaluation: This button brings up a separate window, showing only the final evaluation of the scan.
+The final evaluation shown in this dialog \emph{will} be affected by the filters set.
+Base stations that are filtered out are not considered.
+
+\item Databases Window: The window shown in Figure \ref{fig:databases_window} contains settings for all the databases the \gls{icds} uses.
+These settings are mandatory if the Local Area Database Rule or the Cell ID Rule is going to be used.
+It is also possible to export the current scan as a \gls{csv} file or a Sqlite database, to be used in other programs.
+
+\item PCH Scan Window: This button brings up the dialog illustrated in Figure \ref{fig:pch_window}, in which an \gls{arfcn} or a list of \glspl{arfcn} can be scanned to discover Paging Messages and \glspl{ia} on the \glspl{pch}.
+The timeout sets the duration of a scan.
+Results of the scan will be shown in a list in the lower part of the window after the scan is finished.
+If the checkbox is checked, the results from the scan will also carry over in the data model.
+
+\item Save\,/\,Load Project: The current state of the application can be saved as or loaded from a \texttt{.cpf} file.
+This enables the user to continue a scan at a later time or to compare different data sets scanned at different points in time or locations with one another.
+
+\item User Mode: The \gls{icds} is ultimately meant to be a tool that can be used by end users to check whether it is safe to initiate a phone call or not.
+This dialog presents a way, the already configured system could be shown to end users.
+Only the provider is to be entered and a final evaluation will be returned, once the \gls{icds} is done with the process.
+
+\item Base Station List: This list gives an overview of which base stations have been discovered so far, along with some distinguishing information including its evaluation.
+A detailed view of a base station can be brought up by selecting it in the list and pressing the enter or return key.
+The report is separated into four main parts, the first being all the harvested parameters, followed by findings the different rules and evaluators yielded and a section with the raw uninterpreted System Information data.
+
+\item Log Window: Every important event inside the \gls{icds} is reported in the log together with a time stamp, when it occurred.
+
+\item Base Station Graph: This graph displays the base stations found in the Base Station List (11).
+A node represents a single \gls{bts} and is labelled with its respective \gls{arfcn}.
+An edge from note $A$ to $B$ is drawn if node $B$ occurs in the Neighbouring Cells List of $A$.
+Nodes with a white background have only been found inside Neighbouring Cell Lists but not yet by the \gls{icds} scanner itself, whereas nodes with a red, yellow or green background have been found and evaluated with the colour representing either a critical, a warning or an ok status respectively.
+
+\item Graph Controls: These are meant to make navigating the graph a bit easier.
+From left to right the functionality is zoom in, zoom out, fit the whole graph to the viewport and display the graph in original size.
+Zooming can also be done with the mouse wheel and it is possible to drag the graph around by clicking and holding it with the mouse and then moving it in the desired direction.
+\end{enumerate}
+\begin{figure}
+\centering
+\subfigure[Databases window.]{\includegraphics[scale=0.55]{../Images/databases_window}\label{fig:databases_window}}
+\subfigure[Rules window.]{\includegraphics[scale=0.55]{../Images/rules_window}\label{fig:rules_window}}\\
+\subfigure[Filters window.]{\includegraphics[scale=0.55]{../Images/filter_window}\label{fig:filters_window}}
+\subfigure[PCH scan window.]{\includegraphics[scale=0.55]{../Images/pch_window}\label{fig:pch_window}}
+\caption{Dialogs for different settings.}
+\label{fig:dialogs}
+\end{figure}
+
+\subsection{Usage}
+\label{sec:user_mode}
+This section will list some common use cases and explain how to setup and operate the system to achieve the desired result.
+Button numbering refers back to Figure \ref{fig:icds}.
+
+\paragraph{Conducting sweep scans:} This is the normal mode of operation, scanning and evaluating all base stations in the perimeter.
+This is also used for gathering various kinds of information to be used for analysis later.
+At first the firmware needs to be flashed onto the device by pressing (1).
+After the flashing process is finished, the scan can be started by pressing (2).
+Either before or during the scan (3),(4) and (5) can be used to customise the output or rules that should be considered during evaluation.
+The scan can be stopped at any time.
+Resuming the scan will renew the information in the Base Station List.
+The scan will continue renewing information until it is terminated by the user.
+The number of times a specific \gls{bts} has been scanned is shown in the \emph{Sightings} column of the Base Station List.
+
+\paragraph{Using and obtaining CID Information:} \gls{cid} information can be obtained through several different means.
+The Databases window shown in Figure \ref{fig:databases_window} can be brought up by pressing (7).
+In the upper part, settings concerning the acquisition of \glspl{cid} can be found.
+The operator has the choice between three different methods which can also be used in combination.
+\emph{Google Mobile Maps Service} compares the stations' \glspl{cid} and \glspl{lac} to the ones in the Google database.
+If they are found they are marked as such and additionally their location information will be set.
+\emph{OpenCellID Web Service} performs the same task if activated.
+As of now, OpenCellID has a very low coverage compared to Google's service but it has been included since it is an open source approach that is in development and updated constantly.
+The \emph{Use Local Databse} feature allows to use a previously build Local Area Database as Cell ID Database for lookups.
+For this purpose the location to be used as database has to be entered in the textfield, \eg 'office' or 'home'.
+Offline lookups can be done that way, which are considerably faster that online lookups.
+Since these lookups take some time, if performed using webservices, this is not done while the scan is taking place, to not delay the acquisition of information from new base stations.
+Pressing the button below the checkboxes will add the Cell ID Database information from the selected sources to all the stations currently in the base station list.
+If more than one service is activated, lookups will be done starting with the Google service, if active and using the next one in line only if the previous lookup failed.
+Having at least one service activated and run on the base station list is a precondition for the Cell ID Database Rule to work.
+
+\paragraph{Building or using a Local Area Database:} Having set up the correct location in the \emph{Current Location} field of the databases window and having a valid database for that location are preconditions for the Local Area Database Rule to work.
+To build up a database for a specific location a sweep scan for this location has to be done.
+After the sweep scan is finished, the current location, \eg 'office', has to be set in the dialog and the button for adding\,/\,updating the database has to be pressed.
+If there was no existing database for that location, it will be created, otherwise the database will be updated with the new information acquired by the sweep scan.
+To enhance the quality of a Local Area Database it is recommended to do multiple sweep scans and integrate them rather than relying on a single scan only.
+This raises the probability that all \gls{bts} in the perimeter are found and it solidifies the interval in which the base station signal strength varies.
+
+\paragraph{Conducting a PCH Scan:} A \gls{pch} scan can be conducted in addition to a sweep scan or as a standalone method, therefore, no scan data needs to be present.
+Since PHC scans and sweep scans both use the Motorola C123, a PCH scan can only be done when no sweep scan is active and vice versa.
+The first parameter is a comma separated list of \glspl{arfcn} that will be scanned.
+The second parameter is the timeout.
+A scan for a particular \gls{arfcn} will tune in on the \gls{pch} of each \gls{arfcn} given and wait there until the timeout is reached, gathering all Paging Messages and \glspl{ia} that are sent in that time interval.
+In the lower part of the dialog, after the scan has finished, the statistics for the scanned \glspl{bts} will occur.
+If the checkbox is checked, the data acquired by the scan will also be integrated with the data model and will have an impact on the evaluation displayed in the Base Station Graph.
+The findings can then also be seen in the report for a base station.
+
+\begin{figure}
+\centering
+\includegraphics[scale=0.4]{../Images/user_window}
+\caption{The User Mode window.}
+\label{fig:user_mode}
+\end{figure}
+
+\paragraph{Utilising User Mode:} Data needs to be present inside the \gls{icds} either by loading a project file for the corresponding location the system is used in or by having performed a sweep scan in advance.
+There is only one input field in the dialog as Figure \ref{fig:user_mode} illustrates.
+The user has to enter the provider name in this field and push the \emph{Start Evaluation} button.
+From the scan data, the \gls{icds} extracts the base station with the highest reception for the given provider since this would be the station a \gls{ms} would connect to if started up.
+If the station already has been evaluated as \emph{Critical}, \emph{User Mode} will instantly yield this as result.
+In all other cases it performs an additional \gls{pch} scan on that station to rule out the scenario where a catcher has not been detected by the currently active set of rules.
+
+After the evaluation has been completed, the picture on the bottom will change to reflect the result found.
+Additionally, if PCH scan integration is enabled, the results from \emph{User Scan} will also carry over to the data model if a PCH scan has been carried out in the process.
+
+\section{Related Projects}
+IMSI catcher detection is a topic that has not emerged until recently, therefore, not a lot of work and research has been done upon that subject.
+This is mainly due to the fact that it was hard to get information from the mobile network onto a computer for evaluation and the threat seemed to be not as large as today with cheap self build IMSI catchers available.
+
+About the same time as this project, in December 2011, another project was announced with the same goals of detecting an IMSI catcher.
+The project is called 'Catcher Catcher'\footnote{Catcher Catcher Wiki, \url{http://opensource.srlabs.de/projects/catcher/wiki/Tutorial} [Online; Accessed 05.2012]} and also builds upon the OsmocomBB framework.
+The goals are the same, however, the means are very different.
+As a codebase 'Catcher Catcher' uses the \texttt{mobile} application, a software that implements the firmware part of a mobile phone.
+This results in an active approach to IMSI catcher detection.
+An active connection is established between the phone and the base station in question.
+Basically this means that identification is done by letting a bait-phone get caught.
+
+The advantage compared to the passive approach this project uses is that one has more sure means at hand of identifying a potential catcher.
+Features that are already implemented are \cite{catcher_catcher}:
+\begin{itemize}
+ \item Encryption: Check whether encryption is enabled when doing a phone call.
+ \item IMEI: \gls{imei} is not requested in Cipher Mode Complete message.
+ \item LAC: \gls{lac} of a base station changes.
+ \item Location Updates: IMEI is requested during Location Updates.
+ \item Silent Text: Checks whether a silent text message is received.
+ \item Call Setup: Do not receive a Call Setup message while being on a traffic channel for two seconds.
+\end{itemize}
+As one can see, missing encryption and reception of a silent text message are very strong indicators of being connected to a catcher.
+This however comes at the cost of being discovered oneself.
+
+It is not clear whether the project has been abandoned or whether it is developed further.
+Activity on the Wiki and Git has seized after December 2012.
diff --git a/Tex/Content/Evaluation.tex b/Tex/Content/Evaluation.tex
index 4fc1a87..0658c18 100644
--- a/Tex/Content/Evaluation.tex
+++ b/Tex/Content/Evaluation.tex
@@ -1,16 +1,15 @@
\chapter{Evaluation}
-The following chapter presents the results of the experiments carried out with the \gls{icds}.
+The following chapter presents the results of the experiments, carried out with the \gls{icds}.
Evaluation has been done in different areas to give a complete impression of how the \gls{icds} performs.
-In the first section some general findings will be described that affect overall performance.
-Afterwards the test environment and setup of the IMSI catcher is discussed.
-The last two sections evaluate the \gls{icds} against a configured catcher.
-At first the individual rules are tested, then the two attacks described in the theory section were conducted.
+In the first section, some general findings will be described that affect overall performance.
+Afterwards, the test environment and setup of the IMSI catcher is discussed.
+The last section describes the evaluation of the \gls{icds} against a configured catcher, performing different attacks.
\section{Performance Evaluation}
-In order to evaluate general performance it has to be considered that the \gls{icds} can be deployed in different environments.
+In order to evaluate general performance, it has to be considered that the \gls{icds} can be deployed in different environments.
To reflect different compositions and densities of base stations from different areas, four distinct data sets will be used for the experiments in this section.
The data sets have been taken in areas surrounding the city of Freiburg.
-For each area three scans were made on a fixed position and the duration was averaged.
+For each area, three scans were made on a fixed position and the duration was averaged.
Table \ref{tab:key_data} shows some of the data sets' key values.
\begin{table}
\centering
@@ -32,13 +31,13 @@ Name &Description &Number of BTS &Duration\\
\label{tab:key_data}
\end{table}
-Apart from nodes of the four German \gls{gsm} providers E-Plus, T-Mobile, Vodafone and O2, nodes from the Deutsche Bahn also occur in these scans.
-These nodes form a private network used for internal communications by the Deutsche Bahn.
+Apart from nodes of the four German \gls{gsm} providers E-Plus, T-Mobile, Vodafone and O$_2$, nodes from the Deutsche Bahn also occur in these scans.
+These nodes form a private network, used for internal communications by the Deutsche Bahn.
They are identified by their broadcast name \emph{DB Systel GSM-R} and their frequency which is a in a range registered to the Deutsche Bahn.
Since the distribution of these nodes is very sparse, only one node can be found in each scan.
They yield a false positive for no neighbouring nodes can be discovered.
These nodes are not relevant to subscribers because they are not able to connect to them.
-Therefore they will be ignored and factored out for the remainder of this evaluation.
+Therefore, they will be ignored and factored out for the remainder of this evaluation.
\subsection{Scan Duration}
\begin{figure}
@@ -51,30 +50,29 @@ Therefore they will be ignored and factored out for the remainder of this evalua
ylabel=Scan duration in s,
xticklabel style={/pgf/number format/1000 sep=}
]
- \addplot [mark=*, blue, only marks] plot coordinates {
- (68, 385)
- (54, 373)
- (53, 292)
- (22, 239)
- };
+ \addplot [mark=*, blue, only marks] plot coordinates {(68, 385)[foo]};
+ \addplot [mark=*, blue, only marks] plot coordinates {(54, 373)[foo]};
+ \addplot [mark=*, blue, only marks] plot coordinates {(53, 292)[foo]};
+ \addplot [mark=*, blue, only marks] plot coordinates {(22, 239)[foo]};
+
\end{axis}
\end{tikzpicture}
-\caption{Scan durations for the sample data sets.}
+\caption{Scan durations for the sample data sets. From left to right the datasets are: \texttt{house\_area}, \texttt{ind\_park}, \texttt{cbd}, \texttt{airport}}.
\label{fig:durations}
\end{figure}
-Table \ref{tab:key_data} shows that the time needed for a sweep scan in the Freiburg area can differ by large amounts depending on how many base stations have been scanned.
-Generally said it takes longer the more dense the base station distribution is in the area.
+Table \ref{tab:key_data} shows that the time needed for a sweep scan in the Freiburg area can differ by large amounts, depending on how many base stations have been scanned.
+Generally said, it takes longer, the more dense the base station distribution is in the area.
This is however not the only factor, as Figure \ref{fig:durations} visualises.
If the scan duration would only depend on the number of base stations scanned, a linear growth could be expected.
This is however not the case as the plot shows.
A bad reception means that a lot of \gls{bcch} frames are rendered unusable and have to be retransmitted.
-Therefore it takes significantly longer to gather all System Information Messages for a single \gls{bts} that has a bad reception.
-Looking at the overall reception in the datasets shows that no base stations in the \texttt{cbd} dataset had a reception of below -95\,dB.
-In the three other datasets stations with reception levels of below -100\,dB can be found.
+It takes significantly longer to gather all System Information Messages for a single \gls{bts} that has a bad reception.
+Looking at the overall reception in the datasets shows that no base stations in the \texttt{house\_area} dataset had a reception of below -95\,dB.
+In the three other datasets, stations with reception levels of below -100\,dB can be found.
Overall reception was worst in the \texttt{airport} and \texttt{cbd} datasets which explains the large jump in time although only one more base station has been scanned between the \texttt{ind\_park} and \texttt{cbd} datasets.
-Re-evaluation of a base station based on its own parameters thus occurs only every seven minutes in the worst scenario we experienced.
+Re-evaluation of a base station, based on its own parameters thus occurs only every seven minutes in the worst scenario we experienced.
This is an inherent problem to the approach of scanning and updating all base stations and not only monitoring a subset belonging to a single provider.
If an IMSI catcher replaces a base station directly after it was scanned, it could take up to seven minutes until it is discovered.
To lessen this threat, if the \gls{icds} is used in \emph{User Mode}, the base station with the strongest reception is scanned again with a PCH scan, to eliminate the possibility of having been taken over and not being detected.
@@ -101,34 +99,34 @@ OCID& 0.57&51& &0.58&68& &0.58&55& &0.41&19\\
\end{table}
Google Mobile Maps service scored a complete coverage on all the data sets while OpenCellID could cover about half the nodes in the different sets.
The Ericson and combain databases could not be evaluated since it was not possible to obtain an API key without handing out credit card details for billing.
-The reason the Google service had only a 99\% coverage on the \texttt{airport} data set is that base station that has not been found was the one operated by the Chair of Communication Systems, therefore it can be factored out.
+The reason the Google service only had a 99\% coverage on the \texttt{airport} data set is that the base station that has not been found was the one operated by the Chair of Communication Systems, therefore, this is not a problem.
The OpenCellID database is not a good source of information for this project as is shown by its coverage scores.
Both services also show a large difference in response time.
-The time needed to do a single lookup could take up to several seconds while a single lookup on the Google service presented a result almost instantly.
+The time needed to do a single lookup on OpenCellID could take up to several seconds while a single lookup on the Google service presented a result almost instantly.
This is most probably due to the fact that Google's server infrastructure is strongly optimised for tasks like this.
The times also show that if the \gls{icds} would be connected to the internet, the lookups on Google's database could also be done during the course of a sweep scan since they do not impose a large time overhead per base station.
-However it must be said that these two services are intended for localisation and thus do not have the demand to yield a complete coverage of all the base stations in the area.
-Therefore it must be kept in mind when using this rule for analysis that false positives might still be brought forth.
-What can be said though is that a base station that has been found may only be subject to a type of attack that replaces an existing base station and can thus be investigated more specifically on that ground.
+However, it must be said that these two services are intended for localisation and thus do not have the demand to yield a complete coverage of all the base stations in the area.
+It must be kept in mind when using this rule for analysis that false positives might still be brought forth when using online services.
+What can be said though is that a base station that has been found, may only be subject to a type of attack that replaces an existing base station and can thus be investigated more specifically on that ground.
\subsection{PCH Scans}
-In order to establish a baseline on what to expect from the \gls{pch} scans additional measurements have been done.
+In order to establish a baseline on what to expect from the \gls{pch} scans, additional measurements have been done.
Table \ref{tab:pagings} shows scans that have been done in the different areas.
-In each area the cell with the strongest reception for each provider was chosen as a representative for the respective provider.
-The duration of each scan was set to 60 seconds, while the values in the table have been averaged for 10 seconds since this is the unit the \gls{icds} is using.
+In each area, the cell with the strongest reception for each provider was chosen as a representative for the respective provider.
+The duration of each scan was set to 60\,s, while the values in the table have been averaged for 10\,s for this is the unit the \gls{icds} is using.
A comparison of the results suggests that different providers also have different policies when to page.
Vodafone has about six times the paging rate of other providers.
This can be explained by further examining the Vodafone network structure.
-Another scan showed that for other providers the Paging Messages were addressed to between 70 and 120 different \glspl{tmsi} whereas for Vodafone between 600 and 700 different \glspl{tmsi} were found.
+Another scan showed that for other providers, the Paging Messages were addressed to between 70 and 120 different \glspl{tmsi} whereas for Vodafone between 600 and 700 different \glspl{tmsi} were found.
The large difference in \glspl{tmsi} is due to the fact that Vodafone's \glspl{la} are larger than the \glspl{la} other providers use.
For the Freiburg area two different \glspl{lac} were found for each of the providers E-Plus, T-Mobile and O$_2$ while for Vodafone only one \gls{lac} was found.
These facts were also checked against the OpenCellID database which yielded the same results for \glspl{lac} used in the Freiburg area.
All this gives some insights into the paging policy that Vodafone might have.
If the network is looking for a subscriber the last known \gls{la} for this subscriber is paged rather than starting with the last known cell and expanding the paging radius.
Since the area covered by a single \gls{la} is very large, a lot of subscribers are registered for a single area.
-This theory would also be consistent with the face that despite of the large number of Paging Messages only an average number of \glspl{ia} were caught which are restricted to the serving cell.
+This theory would also be consistent with the fact that despite of the large number of Paging Messages, only an average number of \glspl{ia} were caught which are restricted to the serving cell.
Another scan was also done on the IMSI catcher.
No Paging Messages or \glspl{ia} were detected although a \gls{ms} was connected to it.
@@ -148,23 +146,23 @@ Vodafone& 776&6& &720&5& &712&6&&743&2\\
O$_{2}$& 117&9& &106&16& &94&11&&95&7\\
\bottomrule
\end{tabular}
-\caption{Number of Paging Messages and Immediate Assignments (per 10 seconds) for the four German providers at different locations.}
+\caption{Number of Paging Messages and Immediate Assignments (per 10\,s) for the four German providers at different locations.}
\label{tab:pagings}
\end{table}
\section{IMSI Catcher Detection}
-Before using an IMSI catcher for testing purpose or a launching an OpenBTS base station it should be ensured that licenses for the specific frequencies that are used, have been obtained.
-This way it can be ensured that the operation does not interfere with regular radio communication.
-In case of our experiments we always used \gls{arfcn} 877 and broadcasted '23' as provider name.
-The university has acquired a license for this frequency and since the provider identification differs from the four common providers' \glspl{mnc} we do not lure mobile subscribers into connecting to the catcher.
+Before using an IMSI catcher for testing purpose or a launching an OpenBTS base station, it should be ensured that licenses for the specific frequencies that are used, have been obtained.
+This way, the operation of these devices does not interfere with regular radio communication.
+In case of our experiments we always used \gls{arfcn} 877, for which the university has acquired a license.
+The identification we broadcasted was '23' to not accidantly lure subscribers into trying to connect.
\subsection{Open Source IMSI Catcher}
Some of the rules cannot be tested without an active IMSI catcher.
-For this purpose the Open Source IMSI Catcher \cite{dennis} is used.
+For this purpose the Open Source IMSI-Catcher \cite{dennis} is used.
-This project prototypes an IMSI catcher using only open source systems and freely available hardware so it can basically be used and built by anybody.
+This project prototypes an IMSI catcher using only open source systems and freely available hardware, so it can be used and built by anybody.
On the hardware side a computer running a Linux operating system is used, as well as the \gls{usrp} as the radio transmitter.
-The \gls{usrp} allows the signal processing for radio transmissions to be done in software, therefore it can be used for a multitude of purposes and protocols.
+The \gls{usrp} allows the signal processing for radio transmissions to be done in software, therefore, it can be used for a multitude of purposes and protocols.
Some hardware modifications have to be done to the device to empower it to send and receive data on the frequency bands used for \gls{gsm} communication.
An external clock needs to be used since \gls{gsm} operations are very time critical.
Figure \ref{fig:setup} shows the Open Source IMSI Catcher and the \gls{icds} side by side.
@@ -184,7 +182,7 @@ Calls are routed from here on to the \gls{voip} network of the university.
Since we do not want to actually connect to the IMSI catcher, the Asterisk part and user configuration will be omitted here.
The parameters necessary to simulate a \gls{gsm} cell have to be set inside the \texttt{OpenBTS.conf}.
-Figure \ref{fig:openbts_parameters} shows an annotated example for a configuration simulating a T-Mobile cell.
+Figure \ref{fig:openbts_parameters} shows an annotated example for a configuration which would simulate a T-Mobile cell.
\begin{figure}
\hspace*{\dimexpr\fboxsep+\fboxrule}%
\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
@@ -212,19 +210,24 @@ GSM.T3212 1
\label{fig:openbts_parameters}
\end{figure}
\texttt{Control.OpenRegistration} is explicitly set to 0 which prevents anyone from connecting to the IMSI catcher since connections are not part of the test and we do not want to interfere with other peoples' communications in the area.
-More precisely this will only let users connect that have been set up in the \texttt{sip.conf} of the Asterisk server.
+More precisely, this will only let users connect that have been set up in the \texttt{sip.conf} of the Asterisk server.
Only the test phone does have a valid account.
-As a general note, when the experiments were conducted the \gls{icds} and the Open Source IMSI Catcher were located in the same room, therefore the IMSI catcher had always good reception levels.
+As a general note, when the experiments were conducted the \gls{icds} and the Open Source IMSI-Catcher were located in the same room, therefore the IMSI catcher had always good reception levels.
This is not a problem since an IMSI catcher operator generally wants to have high reception levels on the target phone to lure it to connect to the device.
So if the IMSI catcher would be located farther away the operator would increase transmission power accordingly.
\subsubsection{Modifications to the ICDS Configuration}
A few small modifications have to be made to the configuration of the \gls{icds} to not instantly evaluate the university base station and the IMSI catcher as \emph{Critical}.
-The configuration of the ARFCN\,/\,Provider Mapping Rule has been changed to include the \gls{arfcn} 877 as valid \gls{arfcn} for the imaginary provider '23' since it is the frequency that we are allowed to send on.
-Furthermore '23' was included in the list of known providers, that the Provider Known Rule uses.
+
+'23' is the provider name broadcasted by the university base station.
+The configuration of the ARFCN\,/\,Provider Mapping Rule has been changed to include the \gls{arfcn} 877 as valid \gls{arfcn} for the imaginary provider '23'.
+The country 'Germany' was also added to the dictionary as a valid country for provider '23'.
+Furthermore '23' was included in the list of known providers which the Provider Known Rule uses and 4711 was included as a valid \gls{lac} for this provider.
+
Another small change has been done to the implementation of the Neighbourhood Structure Rule to treat the provider '23' as an equivalent to E-Plus.
-One the one hand this has been done because the university base station has E-Plus nodes as neighbours which would normally trigger a \emph{Critical} rating on the Neighbourhood Structure Rule and on the other hand this makes it possible to integrate the IMSI catcher into an E-Plus neighbourhood.
+This has been done because the university base station has E-Plus nodes as neighbours which would normally trigger a \emph{Critical} rating on the Neighbourhood Structure Rule.
+On the other hand this needed to be done so we could add E-Plus neighbours to the catcher cell in order to have a valid neighbouhood list when needed.
\subsection{Configuration and Context Rules Evaluation}
With the environment set up we will now evaluate the individual Rules.
@@ -235,13 +238,13 @@ The IMSI catcher was launched with the three different configurations 2--4 shown
\toprule
&Conf. 1 &Conf. 2 &Conf. 3 &Conf. 4\\
\midrule
-ARFCN &50 &877 &877 &877 \\
-ShortName &T-Mobile &Vodafone &E-Plus &O2 \\
+ARFCN &50 &877 &877 &877 \\
+ShortName &T-Mobile &23 &23 &23 \\
MCC &262 &262 &262 &505 \\
-MNC &01 &02 &03 &07 \\
-LAC &21010 &123 &588 &50945 \\
-Cell ID &1 &2 &3 &4 \\
-Neighbours &42, 44, 45 &10, 11, 12 &695, 20, 21 &1022, 1001, 1015\\
+MNC &01 &23 &23 &23 \\
+LAC &21010 &123 &4711 &4711 \\
+Cell ID &1 &2 &3 &19279 \\
+Neighbours &42, 44, 45 &778, 779, 780 &818, 695, 828 &977, 997, 992\\
\bottomrule
\end{tabular}
\caption{Erroneous configurations for the IMSI catcher.}
@@ -277,18 +280,16 @@ Cell ID Uniqueness &\emph{Ok} &No duplicate Cell ID found.\\
Configuration 1 will now be used to recap the rules theoretically since we cannot actually transmit on \gls{arfcn} 50.
Table \ref{tab:config_rules_eval} summarises and explains the findings of the different Configuration and Context Rules for this imaginary scenario.
The Neighbourhood Structure Rule should be given a closer examination.
-Since neighbours are present and at least one neighbour has been found directly the basic requirements for the rule to yield an \emph{Ok} have been met.
+Since neighbours are present and at least one neighbour has been found directly, the basic requirements for the rule to yield an \emph{Ok} have been met.
However since its \gls{arfcn} is 50, it has no incoming edges in the neighbourhood graph from other T-Mobile nodes thus the rule only yields a \emph{Warning} result.
-With each of the remaining configurations the \gls{icds} detected the catcher for various reasons.
+With each of the remaining configurations, the \gls{icds} detected the catcher for various reasons.
All rules mentioned did yield a \emph{Critical} rating unless noted otherwise.
\begin{itemize}
\item Config 2: The detected errors within this configuration are that none of the neighbours mentioned was in range to be detected, which is very unlikely for a normal base station.
- Additionally LAC 123 is not a known LAC for Vodafone in the Freiburg area.
- As a result the LAC deviation triggered the respective rule.
- The neighbour on \gls{arfcn} 11 could not be found by the sweep scan so the Discovered Neighbours Rule.
- Rules triggered: Neighbourhood Structure, LAC\,/\,Provider Map, LAC Median Deviation, Discovered Neighbours Rule.
- \item Config 3: In this configuration one of the neighbours, namely 695 (O$_2$) is not consistent with the set provider.
+ Additionally LAC 123 is not a known LAC for '23'.
+ Rules triggered: Neighbourhood Structure, LAC\,/\,Provider Map, Discovered Neighbours Rule.
+ \item Config 3: In this configuration one of the neighbours, namely 695 (O$_2$) is not consistent with the set provider ('23'\,/\,E-Plus).
The base station breaks up the isolated subgraph structure for E-Plus and is thus detected.\\
Rules triggered: Pure Neighbourhoods
\item Config 4: The chosen provider is not consistent with the country set.
@@ -300,7 +301,7 @@ All rules mentioned did yield a \emph{Critical} rating unless noted otherwise.
\subsection{Scan Rules Evaluation}
For the purpose of testing the LAC Change and rx Change Rules the procedure was as follows.
At first the \gls{icds} was turned on and scanning commenced.
-Afterwards the IMSI catcher was turned on, operating on the same frequency as a base station that was previously discovered.
+Afterwards the IMSI catcher was turned on, operating on ARFCN 877, the same as a base station that was previously discovered.
This was repeated several times with different configurations of the IMSI catcher.
Table \ref{tab:par_change} summarises the findings.
The configurations used can be found in Appendix \ref{sec:lac_change_test}.
@@ -333,10 +334,9 @@ The database itself has been built over the course of one week in Freiburg, Geor
Two scans were conducted per day and integrated with the \gls{icds} into the existing Local Area Database.
During this period no parameter changes were detected and the reception of base stations only varied inside a very small interval.
-After that each day for another one and a half week, two scans per day were done, on at around 11:00\,am and one around 8:00\,pm.
+After that, each day for another one and a half weeks, two scans per day were done, one at around 11:00\,am and one around 8:00\,pm.
One of them was conducted while the IMSI catcher was operating, the other without the device present.
The gap between the 5$^\text{th}$ and the 8$^\text{th}$ was due to the face the IMSI catcher was unavailable during these days.
-This was done to evaluate if false positives or negatives occurred using the prebuilt database over a larger period of time.
The results on a per day basis are summarised in Table \ref{tab:longterm_test}.
\begin{table}
@@ -367,7 +367,7 @@ Date &Time &Catcher &Detected &Detected by\\
\label{tab:longterm_test}
\end{table}
-Two different configurations for the IMSI catcher were in place each targeting one of the rules.
+Two different configurations for the IMSI catcher were in place each, targeting one of the rules.
In cases it was detected by the Local Area Database Rule a configuration was used that mirrored the base station that was replaced.
In the other cases where the Cell ID Database Rule triggered the same configuration was used, but the \gls{cid} was changed to be a new one.
The catcher and the normal base station were sending at the same frequency for these cases since the base station could not be switched off.
@@ -403,26 +403,26 @@ Local information in terms of a Local Area Database was available.
\subsubsection{IMSI Catcher as a new Cell}
The first scenario will simulate the case where the catcher opened up a new cell with a good reception and forced the \gls{ms} into normal cell selection mode by disconnecting it from the current base station via a jammer.
-First the IMSI catcher was turned on, faking a legitimate T-Mobile cell with a new \gls{cid}.
+First the IMSI catcher was turned on, faking a legitimate '23' cell with a new \gls{cid}.
Afterwards the \gls{icds} was started and a sweep scan was performed.
As soon as the cell was scanned which occurred very early since the reception was very good (-45\,dB) it was detected that this cell was not in the Local Area Database.
-After the sweep scan \glspl{cid} from Google were also fetched.
+After the sweep scan \glspl{cid}, from Google were also fetched.
Both the Local Area Database Rule and the Cell ID Database Rule indicated a \emph{Critical} status.
As a further step to simulate the case where no local information is available, the Local Area Database Rule and Cell ID Rules were turned off.
The \gls{icds} then yielded an \emph{Ok} evaluation since the configuration of the catcher cell was consistent.
-The next step was to put the \gls{icds} into \emph{User Mode} with T-Mobile as its fixed provider.
-It selected the IMSI catcher cell as its target cell because of the good reception level and since it's evaluation was \emph{Ok} an additional PCH scan was started.
+The next step was to put the \gls{icds} into \emph{User Mode} with '23' as its fixed provider.
+It selected the IMSI catcher cell as its target cell because of the good reception level and since its evaluation was \emph{Ok}, an additional PCH scan was started.
No paging messages or \glspl{ia} were caught so the end result was a \emph{Critical} status for the IMSI catcher cell.
\subsubsection{IMSI Catcher replacing an old Cell}
-The second scenario simulated the attack where the IMSI catcher replaces a base station with a bad reception in the neighbourhood of the cell the \gls{ms} is connected to.
+The second scenario simulated the attack where the IMSI catcher replaces a base station with a bad reception, in the neighbourhood of the cell the \gls{ms} is connected to.
This way the reception drastically improves on that particular frequency suggesting to the \gls{ms} that the subscriber moved into the close perimeter of that \gls{bts} and it switches its cell to the stronger one.
We used the university base station on \gls{arfcn} 877 as our target.
A sweep scan was conducted with the \gls{icds} and after the base station had been found the IMSI catcher was started on the same frequency.
-Due to its strong increase in reception and the change in the \gls{lac} the IMSI catcher cell obtained a \emph{Critical} status immediately after \gls{arfcn} 877 had been scanned a second time.
-Also due to this fact the reception level differed too much from the interval that had been measured for this \gls{cid} in the \emph{Local Area Database} also yielded a \emph{Critical} rating.
-\emph{User Mode} did not start a PCH scan since the evaluation had already been \emph{Critical}. \ No newline at end of file
+Due to its strong increase in reception and the change in the \gls{lac}, the IMSI catcher cell obtained a \emph{Critical} status immediately after \gls{arfcn} 877 had been scanned a second time by the two Scan Rules.
+Also due to the fact the reception level differed too much from the interval that had been measured for this \gls{cid} in the Local Area Database Rule also yielded a \emph{Critical} rating.
+\emph{User Mode} did not start a PCH scan since the evaluation had already been \emph{Critical}.
diff --git a/Tex/Content/Evaluation.tex~ b/Tex/Content/Evaluation.tex~
new file mode 100644
index 0000000..0658c18
--- /dev/null
+++ b/Tex/Content/Evaluation.tex~
@@ -0,0 +1,428 @@
+\chapter{Evaluation}
+The following chapter presents the results of the experiments, carried out with the \gls{icds}.
+Evaluation has been done in different areas to give a complete impression of how the \gls{icds} performs.
+In the first section, some general findings will be described that affect overall performance.
+Afterwards, the test environment and setup of the IMSI catcher is discussed.
+The last section describes the evaluation of the \gls{icds} against a configured catcher, performing different attacks.
+
+\section{Performance Evaluation}
+In order to evaluate general performance, it has to be considered that the \gls{icds} can be deployed in different environments.
+To reflect different compositions and densities of base stations from different areas, four distinct data sets will be used for the experiments in this section.
+The data sets have been taken in areas surrounding the city of Freiburg.
+For each area, three scans were made on a fixed position and the duration was averaged.
+Table \ref{tab:key_data} shows some of the data sets' key values.
+\begin{table}
+\centering
+\begin{tabular}{llrr}
+\toprule
+Name &Description &Number of BTS &Duration\\
+\midrule
+\texttt{cdb} &CBD around the area of &54 &6:13\,m \\
+ &Bertoldsbrunnen & & \\
+\texttt{airport} &Airport and university area &68 &6:25\,m \\
+ &around Georges K\"ohler Allee & & \\
+\texttt{ind\_park} &Industrial park Haid in &53 &4:52\,m \\
+ &Freiburg West, Hausener Weg & & \\
+\texttt{house\_area} &Housing area at the rim of &22 &3:59\,m \\
+ &Freiburg Z\"ahringen, Thuner Weg & & \\
+\bottomrule
+\end{tabular}
+\caption{Key values of the data sets used for performance tests.}
+\label{tab:key_data}
+\end{table}
+
+Apart from nodes of the four German \gls{gsm} providers E-Plus, T-Mobile, Vodafone and O$_2$, nodes from the Deutsche Bahn also occur in these scans.
+These nodes form a private network, used for internal communications by the Deutsche Bahn.
+They are identified by their broadcast name \emph{DB Systel GSM-R} and their frequency which is a in a range registered to the Deutsche Bahn.
+Since the distribution of these nodes is very sparse, only one node can be found in each scan.
+They yield a false positive for no neighbouring nodes can be discovered.
+These nodes are not relevant to subscribers because they are not able to connect to them.
+Therefore, they will be ignored and factored out for the remainder of this evaluation.
+
+\subsection{Scan Duration}
+\begin{figure}
+\centering
+\begin{tikzpicture}
+\begin{axis}[
+ width=\textwidth,
+ height=0.3\textheight,
+ xlabel=Total BTSs,
+ ylabel=Scan duration in s,
+ xticklabel style={/pgf/number format/1000 sep=}
+ ]
+ \addplot [mark=*, blue, only marks] plot coordinates {(68, 385)[foo]};
+ \addplot [mark=*, blue, only marks] plot coordinates {(54, 373)[foo]};
+ \addplot [mark=*, blue, only marks] plot coordinates {(53, 292)[foo]};
+ \addplot [mark=*, blue, only marks] plot coordinates {(22, 239)[foo]};
+
+\end{axis}
+\end{tikzpicture}
+\caption{Scan durations for the sample data sets. From left to right the datasets are: \texttt{house\_area}, \texttt{ind\_park}, \texttt{cbd}, \texttt{airport}}.
+\label{fig:durations}
+\end{figure}
+Table \ref{tab:key_data} shows that the time needed for a sweep scan in the Freiburg area can differ by large amounts, depending on how many base stations have been scanned.
+Generally said, it takes longer, the more dense the base station distribution is in the area.
+This is however not the only factor, as Figure \ref{fig:durations} visualises.
+If the scan duration would only depend on the number of base stations scanned, a linear growth could be expected.
+
+This is however not the case as the plot shows.
+A bad reception means that a lot of \gls{bcch} frames are rendered unusable and have to be retransmitted.
+It takes significantly longer to gather all System Information Messages for a single \gls{bts} that has a bad reception.
+Looking at the overall reception in the datasets shows that no base stations in the \texttt{house\_area} dataset had a reception of below -95\,dB.
+In the three other datasets, stations with reception levels of below -100\,dB can be found.
+Overall reception was worst in the \texttt{airport} and \texttt{cbd} datasets which explains the large jump in time although only one more base station has been scanned between the \texttt{ind\_park} and \texttt{cbd} datasets.
+
+Re-evaluation of a base station, based on its own parameters thus occurs only every seven minutes in the worst scenario we experienced.
+This is an inherent problem to the approach of scanning and updating all base stations and not only monitoring a subset belonging to a single provider.
+If an IMSI catcher replaces a base station directly after it was scanned, it could take up to seven minutes until it is discovered.
+To lessen this threat, if the \gls{icds} is used in \emph{User Mode}, the base station with the strongest reception is scanned again with a PCH scan, to eliminate the possibility of having been taken over and not being detected.
+
+\subsection{Cell ID Databases}
+The usefulness of the Cell ID Rule is subject to the completeness of the database that is used.
+That is even more so since a database with a low coverage will yield false positives, \eg legitimate base stations will be evaluated as being IMSI catchers because they are not found in the database.
+
+The coverage for the OpenCellID database and the Google Mobile Maps service evaluated against the data sets can be seen in Table \ref{tab:coverage}.
+\begin{table}
+\centering
+\begin{tabular}{lrrcrrcrrcrr}
+\toprule
+& \multicolumn{2}{c}{\texttt{cdb}} &\phantom{a}& \multicolumn{2}{c}{\texttt{airport}} &\phantom{a} & \multicolumn{2}{c}{\texttt{ind\_park}}&\phantom{a} & \multicolumn{2}{c}{\texttt{house\_area}}\\
+\cmidrule{2-3} \cmidrule{5-6} \cmidrule{8-9} \cmidrule{11-12}
+&Cov.&Time& &Cov.&Time& &Cov.&Time& &Cov.&Time\\
+\midrule
+Google& 1.00&5& &0.99&8& &1.00&5& &1.00&2\\
+OCID& 0.57&51& &0.58&68& &0.58&55& &0.41&19\\
+\bottomrule
+\end{tabular}
+\caption{Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in seconds for fetching the information.}
+\label{tab:coverage}
+\end{table}
+Google Mobile Maps service scored a complete coverage on all the data sets while OpenCellID could cover about half the nodes in the different sets.
+The Ericson and combain databases could not be evaluated since it was not possible to obtain an API key without handing out credit card details for billing.
+The reason the Google service only had a 99\% coverage on the \texttt{airport} data set is that the base station that has not been found was the one operated by the Chair of Communication Systems, therefore, this is not a problem.
+The OpenCellID database is not a good source of information for this project as is shown by its coverage scores.
+Both services also show a large difference in response time.
+The time needed to do a single lookup on OpenCellID could take up to several seconds while a single lookup on the Google service presented a result almost instantly.
+This is most probably due to the fact that Google's server infrastructure is strongly optimised for tasks like this.
+The times also show that if the \gls{icds} would be connected to the internet, the lookups on Google's database could also be done during the course of a sweep scan since they do not impose a large time overhead per base station.
+
+However, it must be said that these two services are intended for localisation and thus do not have the demand to yield a complete coverage of all the base stations in the area.
+It must be kept in mind when using this rule for analysis that false positives might still be brought forth when using online services.
+What can be said though is that a base station that has been found, may only be subject to a type of attack that replaces an existing base station and can thus be investigated more specifically on that ground.
+
+\subsection{PCH Scans}
+In order to establish a baseline on what to expect from the \gls{pch} scans, additional measurements have been done.
+Table \ref{tab:pagings} shows scans that have been done in the different areas.
+In each area, the cell with the strongest reception for each provider was chosen as a representative for the respective provider.
+The duration of each scan was set to 60\,s, while the values in the table have been averaged for 10\,s for this is the unit the \gls{icds} is using.
+
+A comparison of the results suggests that different providers also have different policies when to page.
+Vodafone has about six times the paging rate of other providers.
+This can be explained by further examining the Vodafone network structure.
+Another scan showed that for other providers, the Paging Messages were addressed to between 70 and 120 different \glspl{tmsi} whereas for Vodafone between 600 and 700 different \glspl{tmsi} were found.
+The large difference in \glspl{tmsi} is due to the fact that Vodafone's \glspl{la} are larger than the \glspl{la} other providers use.
+For the Freiburg area two different \glspl{lac} were found for each of the providers E-Plus, T-Mobile and O$_2$ while for Vodafone only one \gls{lac} was found.
+These facts were also checked against the OpenCellID database which yielded the same results for \glspl{lac} used in the Freiburg area.
+All this gives some insights into the paging policy that Vodafone might have.
+If the network is looking for a subscriber the last known \gls{la} for this subscriber is paged rather than starting with the last known cell and expanding the paging radius.
+Since the area covered by a single \gls{la} is very large, a lot of subscribers are registered for a single area.
+This theory would also be consistent with the fact that despite of the large number of Paging Messages, only an average number of \glspl{ia} were caught which are restricted to the serving cell.
+
+Another scan was also done on the IMSI catcher.
+No Paging Messages or \glspl{ia} were detected although a \gls{ms} was connected to it.
+This was to be expected as formerly discussed in Section \ref{sec:paging} because the IMSI catcher is not actually part of the providers network and thus cannot receive and forward Paging Messages.
+
+\begin{table}
+\centering
+\begin{tabular}{lrrcrrcrrcrr}
+\toprule
+& \multicolumn{2}{c}{\texttt{house\_area}} &\phantom{a}& \multicolumn{2}{c}{\texttt{cbd}} &\phantom{a} & \multicolumn{2}{c}{\texttt{airport}}&\phantom{a} & \multicolumn{2}{c}{\texttt{ind\_area}}\\
+\cmidrule{2-3} \cmidrule{5-6} \cmidrule{8-9} \cmidrule{11-12}
+&PMs.&IAs& &PMs. &IAs.& &PMs.&IAs.&&PMs.&IAs\\
+\midrule
+T-Mobile& 89&3& &75&3& &109&4&&72&1\\
+E-Plus& 119&1& &67&2& &70&1&&65&0\\
+Vodafone& 776&6& &720&5& &712&6&&743&2\\
+O$_{2}$& 117&9& &106&16& &94&11&&95&7\\
+\bottomrule
+\end{tabular}
+\caption{Number of Paging Messages and Immediate Assignments (per 10\,s) for the four German providers at different locations.}
+\label{tab:pagings}
+\end{table}
+
+\section{IMSI Catcher Detection}
+Before using an IMSI catcher for testing purpose or a launching an OpenBTS base station, it should be ensured that licenses for the specific frequencies that are used, have been obtained.
+This way, the operation of these devices does not interfere with regular radio communication.
+In case of our experiments we always used \gls{arfcn} 877, for which the university has acquired a license.
+The identification we broadcasted was '23' to not accidantly lure subscribers into trying to connect.
+
+\subsection{Open Source IMSI Catcher}
+Some of the rules cannot be tested without an active IMSI catcher.
+For this purpose the Open Source IMSI-Catcher \cite{dennis} is used.
+
+This project prototypes an IMSI catcher using only open source systems and freely available hardware, so it can be used and built by anybody.
+On the hardware side a computer running a Linux operating system is used, as well as the \gls{usrp} as the radio transmitter.
+The \gls{usrp} allows the signal processing for radio transmissions to be done in software, therefore, it can be used for a multitude of purposes and protocols.
+Some hardware modifications have to be done to the device to empower it to send and receive data on the frequency bands used for \gls{gsm} communication.
+An external clock needs to be used since \gls{gsm} operations are very time critical.
+Figure \ref{fig:setup} shows the Open Source IMSI Catcher and the \gls{icds} side by side.
+
+On the software side GNU Radio\footnote{GNU Radio Project Wiki, \url{http://gnuradio.org/redmine/projects/gnuradio/wiki} [Online; Accessed 05.2012]}, OpenBTS\footnote{OpenBTS Project Wiki, \url{http://wush.net/trac/rangepublic} [Online; Accessed 05.2012]} and Asterisk\footnote{Asterisk, \url{http://www.asterisk.org} [Online; Accessed 05.2012]} are used to achieve the functionality provided by an IMSI catcher.
+\begin{figure}
+\centering
+\includegraphics[width=.95\textwidth]{../Images/catcherICDS}
+\caption{Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}
+\label{fig:setup}
+\end{figure}
+The raw data that is received by the \gls{usrp} is sent to the GNU Radio component which works as a software side interface to the \gls{usrp}.
+This data is taken by the OpenBTS software that simulates base station behaviour and has an integrated module simulating a \gls{vlr} handing out \glspl{tmsi}.
+OpenBTS implements an open source version of the \gls{gsm} stack with the goal to provide cheap access points to the \gls{gsm} network in areas with bad coverage.
+The user accounts as well as encoding of voice data and recording of calls is handled inside the Asterisk software, basically combining the \gls{trau}, \gls{hlr} and authentication centre of a real \gls{gsm} network.
+Calls are routed from here on to the \gls{voip} network of the university.
+
+Since we do not want to actually connect to the IMSI catcher, the Asterisk part and user configuration will be omitted here.
+The parameters necessary to simulate a \gls{gsm} cell have to be set inside the \texttt{OpenBTS.conf}.
+Figure \ref{fig:openbts_parameters} shows an annotated example for a configuration which would simulate a T-Mobile cell.
+\begin{figure}
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
+#Do not let people connect
+Control.OpenRegistration 0
+
+#Basic cell parameters
+GSM.MCC 262 GSM.ARFCN 54
+GSM.MNC 01 GSM.ShortName T-Mobile
+GSM.LAC 29184
+GSM.CI 61858
+
+#Transmission strength ranging from 0 to 23
+GSM.PowerAttenDB 20
+
+#Neighbouring cell list, space separated
+GSM.Neighbours 69 53 20
+
+#Force location Updates, multiple of 6 minutes
+GSM.T3212 1
+\end{lstlisting}
+\end{minipage}
+\caption{Excerpt of a \texttt{OpenBTS.conf}.}
+\label{fig:openbts_parameters}
+\end{figure}
+\texttt{Control.OpenRegistration} is explicitly set to 0 which prevents anyone from connecting to the IMSI catcher since connections are not part of the test and we do not want to interfere with other peoples' communications in the area.
+More precisely, this will only let users connect that have been set up in the \texttt{sip.conf} of the Asterisk server.
+Only the test phone does have a valid account.
+
+As a general note, when the experiments were conducted the \gls{icds} and the Open Source IMSI-Catcher were located in the same room, therefore the IMSI catcher had always good reception levels.
+This is not a problem since an IMSI catcher operator generally wants to have high reception levels on the target phone to lure it to connect to the device.
+So if the IMSI catcher would be located farther away the operator would increase transmission power accordingly.
+
+\subsubsection{Modifications to the ICDS Configuration}
+A few small modifications have to be made to the configuration of the \gls{icds} to not instantly evaluate the university base station and the IMSI catcher as \emph{Critical}.
+
+'23' is the provider name broadcasted by the university base station.
+The configuration of the ARFCN\,/\,Provider Mapping Rule has been changed to include the \gls{arfcn} 877 as valid \gls{arfcn} for the imaginary provider '23'.
+The country 'Germany' was also added to the dictionary as a valid country for provider '23'.
+Furthermore '23' was included in the list of known providers which the Provider Known Rule uses and 4711 was included as a valid \gls{lac} for this provider.
+
+Another small change has been done to the implementation of the Neighbourhood Structure Rule to treat the provider '23' as an equivalent to E-Plus.
+This has been done because the university base station has E-Plus nodes as neighbours which would normally trigger a \emph{Critical} rating on the Neighbourhood Structure Rule.
+On the other hand this needed to be done so we could add E-Plus neighbours to the catcher cell in order to have a valid neighbouhood list when needed.
+
+\subsection{Configuration and Context Rules Evaluation}
+With the environment set up we will now evaluate the individual Rules.
+The IMSI catcher was launched with the three different configurations 2--4 shown in Table \ref{tab:err_configs}.
+\begin{table}
+\centering
+\begin{tabular}{lllll}
+\toprule
+ &Conf. 1 &Conf. 2 &Conf. 3 &Conf. 4\\
+\midrule
+ARFCN &50 &877 &877 &877 \\
+ShortName &T-Mobile &23 &23 &23 \\
+MCC &262 &262 &262 &505 \\
+MNC &01 &23 &23 &23 \\
+LAC &21010 &123 &4711 &4711 \\
+Cell ID &1 &2 &3 &19279 \\
+Neighbours &42, 44, 45 &778, 779, 780 &818, 695, 828 &977, 997, 992\\
+\bottomrule
+\end{tabular}
+\caption{Erroneous configurations for the IMSI catcher.}
+\label{tab:err_configs}
+\end{table}
+
+\begin{table}
+\centering
+\begin{tabular}{lll}
+\toprule
+Rule &Finding &Explanation \\
+\midrule
+Provider Known &\emph{Ok} &T-Mobiled is a known provider.\\
+Country\,/\,Provider Map &\emph{Ok} &MNC 262 and MNC 01 with\\
+ & &T-Mobile fit together.\\
+LAC\,/\,Provider Map &\emph{Critical}&LAC 21010 not a known LAC for\\
+ & &MNC 01 in the Freiburg area.\\
+ARFCN\,/\,Provider Map &\emph{Critical}&ARFCN 50 belongs to Vodafone.\\
+LAC Median Deviation &\emph{Critical}&LAC differs from other T-Mobile\\
+ & &stations in the area.\\
+Pure Neighbourhoods &\emph{Ok} &Only T-Mobile stations as\\
+ & & neighbours.\\
+Neighbourhood Structure &\emph{Warning} &Explanation in running text.\\
+Discovered Neighbours &\emph{Ok} &All neighbours have been\\
+ & &discovered.\\
+Cell ID Uniqueness &\emph{Ok} &No duplicate Cell ID found.\\
+\bottomrule
+\end{tabular}
+\caption{Configuration and Context Rule results for Config 1.}
+\label{tab:config_rules_eval}
+\end{table}
+
+Configuration 1 will now be used to recap the rules theoretically since we cannot actually transmit on \gls{arfcn} 50.
+Table \ref{tab:config_rules_eval} summarises and explains the findings of the different Configuration and Context Rules for this imaginary scenario.
+The Neighbourhood Structure Rule should be given a closer examination.
+Since neighbours are present and at least one neighbour has been found directly, the basic requirements for the rule to yield an \emph{Ok} have been met.
+However since its \gls{arfcn} is 50, it has no incoming edges in the neighbourhood graph from other T-Mobile nodes thus the rule only yields a \emph{Warning} result.
+
+With each of the remaining configurations, the \gls{icds} detected the catcher for various reasons.
+All rules mentioned did yield a \emph{Critical} rating unless noted otherwise.
+\begin{itemize}
+ \item Config 2: The detected errors within this configuration are that none of the neighbours mentioned was in range to be detected, which is very unlikely for a normal base station.
+ Additionally LAC 123 is not a known LAC for '23'.
+ Rules triggered: Neighbourhood Structure, LAC\,/\,Provider Map, Discovered Neighbours Rule.
+ \item Config 3: In this configuration one of the neighbours, namely 695 (O$_2$) is not consistent with the set provider ('23'\,/\,E-Plus).
+ The base station breaks up the isolated subgraph structure for E-Plus and is thus detected.\\
+ Rules triggered: Pure Neighbourhoods
+ \item Config 4: The chosen provider is not consistent with the country set.
+ Additionally another warning is thrown since the neighbourhood list only contained nodes that were found indirectly.\\
+ On top of that, the \gls{cid} was already in use by another station.
+ Rules triggered: Country\,/\,Provider Mapping, Neighbourhood Structure (\emph{Warning}), Cell ID Uniqueness.
+\end{itemize}
+
+\subsection{Scan Rules Evaluation}
+For the purpose of testing the LAC Change and rx Change Rules the procedure was as follows.
+At first the \gls{icds} was turned on and scanning commenced.
+Afterwards the IMSI catcher was turned on, operating on ARFCN 877, the same as a base station that was previously discovered.
+This was repeated several times with different configurations of the IMSI catcher.
+Table \ref{tab:par_change} summarises the findings.
+The configurations used can be found in Appendix \ref{sec:lac_change_test}.
+In all cases the \gls{icds} was able to detect the IMSI catcher after about 6 minutes which corresponds to the time that is needed to conduct a complete sweep scan.
+These times can vary however depending on the timing of the catcher being turned on and the time it takes for rescanning a base stations as described in the beginning of this chapter.
+\begin{table}
+\centering
+\begin{tabular}{lrcrrrllr}
+\toprule
+ &\multicolumn{2}{c}{rx} &\phantom{a} &\multicolumn{2}{c}{LAC} & & & \\
+ \cmidrule{2-3} \cmidrule{5-6}
+Config &Old &New & &Old &New &rx det. &LAC det. &Time\\
+\midrule
+Config 5 &-92 dB &-44dB & &4711 &666 &Yes &Yes &6:31\,m\\
+Config 6 &-91 dB &-46dB & &4711 &4711 &Yes &No &6:22\,m\\
+Config 5 &-89 dB &-44dB & &4711 &666 &Yes &Yes &5:59\,m\\
+Config 6 &-92 dB &-43dB & &4711 &4711 &Yes &No &6:35\,m\\
+\bottomrule
+\end{tabular}
+\caption{Results obtained testing the \emph{rx} and \emph{LAC Change rules}.}
+\label{tab:par_change}
+\end{table}
+
+\subsection{Database Rules Evaluation}
+To evaluate the Local Area Database Rule and Cell ID Database Rule a long-term test has been carried out.
+This has been done to find out whether base stations in the surrounding area change on a regular basis or stay the same (including their respective configurations and reception levels).
+This is essential for databases to be usable over a longer period of time.
+
+The database itself has been built over the course of one week in Freiburg, Georges K\"ohler Allee.
+Two scans were conducted per day and integrated with the \gls{icds} into the existing Local Area Database.
+During this period no parameter changes were detected and the reception of base stations only varied inside a very small interval.
+
+After that, each day for another one and a half weeks, two scans per day were done, one at around 11:00\,am and one around 8:00\,pm.
+One of them was conducted while the IMSI catcher was operating, the other without the device present.
+The gap between the 5$^\text{th}$ and the 8$^\text{th}$ was due to the face the IMSI catcher was unavailable during these days.
+The results on a per day basis are summarised in Table \ref{tab:longterm_test}.
+
+\begin{table}
+\centering
+\begin{tabular}{rrlll}
+\toprule
+Date &Time &Catcher &Detected &Detected by\\
+\midrule
+31.05.12&11:00\,am &Yes &Yes &Local Area Database \\
+31.05.12&8:00\,pm &No &No & \\
+01.06.12&11:00\,am &No &No & \\
+01.06.12&8:00\,pm &Yes &Yes &Cell ID Database \\
+02.06.12&11:00\,am &Yes &Yes &Local Area Database \\
+02.06.12&8:00\,pm &No &No & \\
+03.06.12&11:00\,am &No &No & \\
+03.06.12&8:00\,pm &Yes &Yes &Cell ID Database \\
+04.06.12&11:00\,am &Yes &Yes &Local Area Database \\
+04.06.12&8:00\,pm &No &No & \\
+05.06.12&11:00\,am &No &No & \\
+05.06.12&8:00\,pm &Yes &Yes &Cell ID Database \\
+08.06.12&11:00\,am &Yes &Yes &Local Area Database \\
+08.06.12&8:00\,pm &No &No & \\
+09.06.12&11:00\,am&No &No & \\
+09.06.12&8:00\,pm &Yes &Yes &Cell ID Database \\
+\bottomrule
+\end{tabular}
+\caption{Results of the database evaluation.}
+\label{tab:longterm_test}
+\end{table}
+
+Two different configurations for the IMSI catcher were in place each, targeting one of the rules.
+In cases it was detected by the Local Area Database Rule a configuration was used that mirrored the base station that was replaced.
+In the other cases where the Cell ID Database Rule triggered the same configuration was used, but the \gls{cid} was changed to be a new one.
+The catcher and the normal base station were sending at the same frequency for these cases since the base station could not be switched off.
+No problems occurred due to that fact since the IMSI catcher had a significantly better reception and was found in all cases instead of the regular base station.
+
+During this two and a half week time period in which the databases were built and the tests done, none of the \glspl{bts} in the surrounding area listed a significant change in reception or parameters.
+Therefore no false positives or negatives had been found.
+All cases in which the IMSI catcher was operating were found either because the reception on the frequency was exceptionally good or because the \gls{cid} used was not in the database.
+
+\subsection{Realistic Scenarios}
+Since all the rules have been tested we assume from this point on that the IMSI catcher is configured correctly, meaning that parameters like the \gls{arfcn}, \gls{lac} and provider have been set up in correct and consistent way so the respective rules will not show an alarm.
+Consistent parameters for the four providers in Germany can be found in Table \ref{tab:consistent_parameters}.
+\begin{table}
+\centering
+\begin{tabular}{lllll}
+\toprule
+Parameter &T-Mobile &Vodafone &E-Plus &O$_2$\\
+\midrule
+ARFCN &13-49, 81-102, &1-12, 50-80, &975-999, &0, 1000-1023,\\
+ &122-124, 587-611 &103-121, 725-751 &777-863 &637-723\\
+LAC &21014/21015 &793 &588/138 &50945/51903\\
+MCC &262 &262 &262 &262\\
+MNC &01 &02 &03 &07\\
+\bottomrule
+\end{tabular}
+\caption{Consistent parameter configurations in the Freiburg area for the four German providers.}
+\label{tab:consistent_parameters}
+\end{table}
+Note that the \gls{cid} can be a arbitrary value as long as it is unique in the area of reception.
+\glspl{cid} measured from different base stations do not follow any particular schema.
+The scenarios are built after the attacks described in Section \ref{sec:attacks}.
+Local information in terms of a Local Area Database was available.
+
+\subsubsection{IMSI Catcher as a new Cell}
+The first scenario will simulate the case where the catcher opened up a new cell with a good reception and forced the \gls{ms} into normal cell selection mode by disconnecting it from the current base station via a jammer.
+First the IMSI catcher was turned on, faking a legitimate '23' cell with a new \gls{cid}.
+Afterwards the \gls{icds} was started and a sweep scan was performed.
+As soon as the cell was scanned which occurred very early since the reception was very good (-45\,dB) it was detected that this cell was not in the Local Area Database.
+After the sweep scan \glspl{cid}, from Google were also fetched.
+Both the Local Area Database Rule and the Cell ID Database Rule indicated a \emph{Critical} status.
+
+As a further step to simulate the case where no local information is available, the Local Area Database Rule and Cell ID Rules were turned off.
+The \gls{icds} then yielded an \emph{Ok} evaluation since the configuration of the catcher cell was consistent.
+The next step was to put the \gls{icds} into \emph{User Mode} with '23' as its fixed provider.
+It selected the IMSI catcher cell as its target cell because of the good reception level and since its evaluation was \emph{Ok}, an additional PCH scan was started.
+No paging messages or \glspl{ia} were caught so the end result was a \emph{Critical} status for the IMSI catcher cell.
+
+
+\subsubsection{IMSI Catcher replacing an old Cell}
+The second scenario simulated the attack where the IMSI catcher replaces a base station with a bad reception, in the neighbourhood of the cell the \gls{ms} is connected to.
+This way the reception drastically improves on that particular frequency suggesting to the \gls{ms} that the subscriber moved into the close perimeter of that \gls{bts} and it switches its cell to the stronger one.
+
+We used the university base station on \gls{arfcn} 877 as our target.
+A sweep scan was conducted with the \gls{icds} and after the base station had been found the IMSI catcher was started on the same frequency.
+
+Due to its strong increase in reception and the change in the \gls{lac}, the IMSI catcher cell obtained a \emph{Critical} status immediately after \gls{arfcn} 877 had been scanned a second time by the two Scan Rules.
+Also due to the fact the reception level differed too much from the interval that had been measured for this \gls{cid} in the Local Area Database Rule also yielded a \emph{Critical} rating.
+\emph{User Mode} did not start a PCH scan since the evaluation had already been \emph{Critical}.
diff --git a/Tex/Content/GSM_short.tex b/Tex/Content/GSM_short.tex
index a9ad49c..a2b4eab 100644
--- a/Tex/Content/GSM_short.tex
+++ b/Tex/Content/GSM_short.tex
@@ -718,8 +718,9 @@ These commercial versions of catchers, produced by Rohde\,\&\,Schwarz, were pric
Regulations prohibit the use of IMSI catchers for individuals, because the frequency bands the \gls{gsm} network uses are registered to providers.
In addition to these commercial products, different projects \cite{dennis, def_catcher} have shown that such devices can be built at a very low budget.
This only intensifies the risk that is imposed by the abusive usage of such a catcher.
-Examples would be curious neighbours eavesdropping, or a jealous husband tapping into phone calls of his wife.
+Examples of malicious usage by individuals would be curious neighbours eavesdropping or a jealous husband tapping into phone calls of his wife.
On a more large scale, these devices are of great value for industrial espionage or private investigators that would not mind breaking the law to gather information.
+To uncover such abuse by individuals is the aim of this project.
Figure \ref{fig:catchers} shows a commercial model side by side with a self built catcher.
\begin{figure}
\centering
@@ -734,8 +735,8 @@ The next section will explain under which circumstances a catcher can be used in
\subsection{Mode of Operation}
\label{sec:catcher_operation}
-Basically an IMSI catcher masks itself as a base station and lures subscribers in its perimeter to connect to it without their knowledge.
-In the attack \cite{mueller} shown in Figure \ref{fig:catcher_catch} the IMSI catcher is broadcasting a new \gls{lai} with the same \gls{cid} as an formerly existing base station to the \gls{ms} at very high power.
+An IMSI catcher masks itself as a base station and lures subscribers in its perimeter to connect to it without their knowledge.
+In the attack shown in Figure \ref{fig:catcher_catch} \cite{mueller}, the IMSI catcher is broadcasting a new \gls{lai} with the same \gls{cid} as an formerly existing base station to the \gls{ms}, at very high power.
This lures the \gls{ms} to connect to the alleged base station due to stronger reception and announce itself since the \gls{lac} has changed.
\begin{figure}
@@ -750,42 +751,42 @@ This command is normally only used in case of an error \cite{fox} but can be abu
An IMSI catcher can only impersonate a base station because authentication in a \gls{gsm} network is one-sided as discussed earlier in Section \ref{sec:authentication}.
The subscriber has no way of checking the authenticity of a base station but rather has to trust the broadcasted identifier which can be easily forged by a catcher.
-At this stage, the subscriber can already be localized as being in a certain distance of the catcher.
+At this stage, the subscriber can already be localised as being in a certain distance of the catcher.
-Having the \gls{imsi} the authorities can now also query the provider for personal information about the subscriber, however criminals may use fake credentials when obtaining a \gls{sim} card.
+In case the IMSI catcher was operated by authorities, they can now query the provider for personal information about the subscriber, however, criminals may use fake credentials when obtaining a \gls{sim} card.
Since it is only possible to catch all the \glspl{imsi} in an area, the person to be observed has to be followed and the catcher has to be used multiple times.
Each time it yields a set of numbers in the area.
-The \gls{imsi} that is part of all the sets is the \gls{imsi} of the person under observation.
+The \gls{imsi}, that is part of all the sets is the \gls{imsi} of the person under observation.
More catchers can now be used to triangulate the position.
The next step is also possible because of a design decision made in the \gls{gsm} protocol.
Encryption itself or certain kinds of strong encryption are not allowed in all countries.
-Therefore it is possible for the base station to request the encryption algorithm A5/0 which means that no encryption will be used for the calls at all.
+Therefore, it is possible for the base station to request the encryption algorithm A5/0, which means that no encryption will be used for the calls at all.
Only a few mobile phones display that encryption has been disabled by the \gls{bts}.
At this point the setup for a man-in-the-middle attack \cite{mueller} on calls is completed.
-The catcher itself is connected to the mobile network with its own \gls{sim}.
-If the subscriber now initiates a call, the call can be routed by the catcher into the network and since encryption is turned of it can also be listened to or recorded.
-The subscriber doesn't notice this privacy breach except in the rare cases where the phone displays that encryption has been turned off.
-The \gls{imei} is also harvested in a similar fashion if the observed person tries to switch \gls{sim} cards on a regular basis \cite{fox}.
+The catcher is connected to the mobile network with its own \gls{sim}.
+If the subscriber now initiates a call, the call can be routed by the catcher into the network and since encryption is turned off, it can also be listened to or recorded.
+The subscriber doesn't notice this privacy breach, except in the rare cases where the phone displays that encryption has been turned off.
+The \gls{imei} is also harvested in a similar fashion, if the observed person tries to switch \gls{sim} cards on a regular basis \cite{fox}.
\subsubsection{Attacks}
\label{sec:attacks}
-When operating a catcher the first and most important step is to actually trick the \gls{ms} into connecting to the catcher.
-A lot of phones save the frequency they were tuned to last and upon connecting to the mobile network this is the first frequency they try.
-Therefore a \gls{ms} has to be set to \emph{normal cell selection} mode which means it starts scanning for the best base station available.
-Three ways of luring a subscriber to the forged cell were presented by Wehrle for the 'Open Source IMSI-catcher' project \cite{dennis}.
+When operating a catcher, the first and most important step is to actually trick the \gls{ms} into connecting to the catcher.
+A lot of phones save the frequency they were tuned to last and upon connecting to the mobile network, this is the first frequency they try.
+Therefore, a \gls{ms} has to be set to \emph{normal cell selection} mode, which means it starts scanning for the best base station available.
+Three ways of luring a subscriber to the forged cell were presented by Wehrle for the 'Open Source IMSI-Catcher' project \cite{dennis}.
These methods differ on whether the \gls{ms} already is in normal cell selection mode or not.
\paragraph{MS is in normal cell selection mode:}
-The IMSI catcher has to fake a cell configuration consistent with the provider the target \gls{ms} is looking for broadcasting at any frequency.
-The \gls{ms} will choose the base station with the strongest reception levels so the catcher has to make sure that no other available station has a better reception than itself.
-Some IMSI catchers even broadcast at a higher power than it would be allowed for normal \gls{bts} \cite{imsi_wiki}.
+The IMSI catcher has to fake a cell configuration consistent with the provider, the target \gls{ms} is looking for, broadcasting at any frequency.
+The \gls{ms} will choose the base station with the strongest reception levels, so the catcher has to make sure that no other available station has a better reception than itself.
+Some IMSI catchers even broadcast at a higher power than it would be allowed by law for legitimate \gls{bts} \cite{imsi_wiki}.
\paragraph{MS is already connected to a network:}
-If this is the case then the connection to the current cell needs to be broken or the \gls{ms} has to be convinced to switch the cell to the catcher's.
-A \gls{ms} that is in passive mode, meaning no active calls are conducted will do quality measurements on the neighbouring cells of the cell it is connected to.
+If this is the case then the connection to the current cell needs to be broken or the \gls{ms} has to be stimulated to switch the cell to the catcher's.
+A \gls{ms} that is in passive mode, meaning no active calls are conducted, will do quality measurements on the neighbouring cells of the cell it is connected to.
It will not scan for \emph{new} base stations.
-Therefore the IMSI catcher has to replace an existing base station that already is part of the neighbourhood of the current cell, so the \gls{ms} will do power measurements on its frequencies.
+Therefore, the IMSI catcher has to replace an existing base station that is already part of the neighbourhood of the current cell, so the \gls{ms} will do power measurements on its frequency.
\begin{figure}
\centering
\includegraphics{../Images/replace_attack}
@@ -795,49 +796,55 @@ Therefore the IMSI catcher has to replace an existing base station that already
Figure \ref{fig:takeover_attack} illustrates the procedure.
In the beginning the \gls{ms} is connected to \gls{arfcn} 23 since its the strongest station in the perimeter.
It will nevertheless conduct power measurements on \gls{arfcn} 42 and \gls{arfcn} 61 since these are neighbours.
-The IMSI catcher is switched on sending also on \gls{arfcn} 42.
+The IMSI catcher is switched on, sending also on \gls{arfcn} 42.
When the \gls{ms} does its next power measurement on this \gls{arfcn} it will notice that the reception changed from -95\,dB to -52\,dB which is even better than the reception of the station it is currently connected to.
-Therefore it will change the cell to the catcher's.
-Since the catcher broadcasts a different \gls{lac} the \gls{ms} announces itself by sending a Location Update.
+Therefore, it will change the cell to the catcher's.
+Since the catcher broadcasts a different \gls{lac}, the \gls{ms} announces itself by sending a Location Update.
This method will not work when a call is in progress.
-In that case the only way to immediately disconnect the subscriber from the \gls{bts} and force normal cell selection mode is by jamming the frequency that belongs to the \gls{bts}.
+In that case, the only way to immediately disconnect the subscriber from the \gls{bts} and force normal cell selection mode is by jamming the frequency that belongs to the \gls{bts}.
-It is important to note that from these three approaches of luring a \gls{ms} to connect to a fake base station two types of attack configurations for the IMSI catcher side can be distinguished.
-To mimic a cell of a certain provider the IMSI catcher has either to open up a cell with a new \gls{cid} or to replace a cell.
-In case of opening up a new cell, the IMSI catcher has to choose a consistent configuration that blends into the environment of the respective provider while in case of replacing a cell, the whole configuration has to be copied as to not raise suspicion.
+It is important to note that from these three approaches of luring a \gls{ms} to connect to a fake base station, two types of attack configurations for the IMSI catcher can be distinguished.
+To mimic a cell of a certain provider, the IMSI catcher has either to open up a cell with a new \gls{cid} or to replace a cell.
+In case of opening up a new cell, the IMSI catcher has to choose a consistent configuration that blends into the environment of the respective provider, while in case of replacing a cell, the whole configuration has to be copied as to not raise any suspicion.
This fundamental distinction of IMSI catcher configurations will be of help later when trying to uncover these devices.
\subsubsection{Risks and Irregularities}
An IMSI catcher cannot target an individual subscriber, it always targets an area thus breaching the privacy of uninvolved subjects.
Apart from that, a catcher that does not relay calls takes away the possibility for all connected people in the area to initiate calls.
-Even if the the catcher routes calls into the network, since it only has one \gls{sim} card, it can only route a single call.
-This can be very dangerous because no emergency calls can be submitted in that area during the time of operation which can be as long as five to ten minutes \cite{fox}.
+Even if the the catcher routes calls into the network, it only has one \gls{sim} card and thus can only route a single call.
+This can be very dangerous because no emergency calls can be submitted in that area during the time of operation which can be as long as five to ten minutes \cite{fox} when used by authorities.
-Another irregularity apart from using no encryption is that people caught in this area cannot be reached on their mobile phones since they are not registered on the main network.
-As a consequence of the proxy functionality of the IMSI catcher, when a call is routed into the network the recipient can only see the number the catcher is registered with or 'Number Withheld' however not the original number.
+Another irregularity apart from using no encryption is that people caught in this area cannot be reached on their mobile phones, for they are not registered on the main network.
+As a consequence of the proxy functionality of the IMSI catcher, when a call is routed into the network the recipient can only see the number the catcher is registered with or 'Number Withheld', however, not the original number.
\subsection{Law Situation in Germany}
\label{sec:catcher_law}
First reports of an IMSI catcher used by authorities in Germany dates back to 1997.
-Until November 2001 35 cases of use were officially confirmed by the \gls{bmi} \cite{fox}.
-It was used to fight organised and serious crime like hostage-takings or drug traffic by the \gls{bka} and \gls{bgs}.
-Attempts have been made by the government to move the catcher out of the legal grey zone and use the \emph{GA 900} with its capabilities of tapping in to calls for crime prosecution.
+Until November 2001, 35 cases of use were officially confirmed by the \gls{bmi} \cite{fox}.
+It was used to fight organised and serious crime, like hostage-takings or drug traffic by the \gls{bka} and \gls{bgs}.
+Attempts have been made by the government, to move the catcher out of the legal grey zone and use the \emph{GA 900} with its capabilities of tapping in to calls for crime prosecution.
At that time however the attempt was dismissed.
-On 14$^\text{th}$ of August 2002 with Section §100i of the Strafprozessordnung (Code of Criminal Procedure) a law basis was given to the device.
-Afterwards on 22$^\text{nd}$ of August 2006 this section and its accordance with the Grundgesetz (Constitution) was affirmed.
-The use of an IMSI catcher with prior authorisation by a judge does not affect peoples' right to privacy nor does it contradict the Datenschutzbestimmungen (Secrecy of Confidential Data) or the Fernmeldegeheimnis (Secrecy of Confidential Communication).
+On 14$^\text{th}$ of August 2002, with Section §100i of the Strafprozessordnung (Code of Criminal Procedure), a law basis was given to the device.
+Afterwards, on 22$^\text{nd}$ of August 2006 this section and its accordance with the Grundgesetz (Constitution) was affirmed.
+The use of an IMSI catcher with prior authorisation by a judge does not affect peoples' right to privacy, nor does it contradict the Datenschutzbestimmungen (Secrecy of Confidential Data) or the Fernmeldegeheimnis (Secrecy of Confidential Communication).
In Austria the need for a prior authorisation by a judge was removed in January 2008.
During the first four months of 2008, 3800 cases of catcher use were reported in Austria \cite{imsi_wiki}.
Gradually, starting with §100i it has become easier for the police and agencies to use electronic surveillance.
-Although on 2004 it was decided by the Federal Court of Saxony, that electronic surveillance is not to be used in the substantially intimate sphere of private premises.
-This regulation can be overthrown if linked to the field of serious crimes and terrorism.
-Section §100a(1) describes that the police merely needs to show certain evidence underpinning a suspicion that a criminal act was committed \cite{criminal_justice}.
-This threshold can often be overcome easily, since it is hard for courts to check evidence for sufficiency thoroughly given the short time frame of response.
-Technically it would even be possible for the authorities to use a catcher without prior authentication by a judge since it is hard to proof that a catcher was used at a specific point in time.
-This fact makes is hard to prosecute or even unveil the illegal operation of an IMSI Catcher used by third parties or criminals.
-
-These loose regulations, the hardness of detection together with the fact that third parties can buy or build catchers poses a grave threat to privacy of each individual person. \ No newline at end of file
+Although in 2004, it was decided by the Federal Court of Saxony that electronic surveillance is not to be used in the substantially intimate sphere of private premises.
+This regulation can be overthrown, if linked to the field of serious crimes and terrorism.
+Section §100a(1) describes that the police merely needs to show certain evidence, underpinning a suspicion that a criminal act was committed.
+This threshold can often be overcome easily, since it is hard for courts to check evidence for sufficiency thoroughly given the short time frame of response \cite{criminal_justice}.
+\newpage
+In contrast, the law situation considering non-authorative use in Germany is clearly laid out.
+The law is breached in several points when an individual operates a chatcher.
+One breach is sending on frequency bands that are registered to different providers thus interfereng with regular communications.
+However, it is very hard to prove in retrospect that an IMSI catcher has been operated in a particular area.
+The easiness of obtaining a self-built device and the fact that illegal operation is near impossible to prove shows the immediate risk that comes from these devices.
+
+
+
+
diff --git a/Tex/Content/GSM_short.tex~ b/Tex/Content/GSM_short.tex~
new file mode 100644
index 0000000..a2b4eab
--- /dev/null
+++ b/Tex/Content/GSM_short.tex~
@@ -0,0 +1,850 @@
+\chapter{GSM}
+\label{ch:gsm}
+This chapter will give a short overview of some important aspects of \gls{gsm} networks and protocols.
+The first section presents a brief historical summary on the evolution of \gls{gsm} and how it came to be what it is today.
+In Section \ref{sec:network} the system architecture with its components and some essential protocol basics will be explained as far as it is necessary to understand which place in the network an IMSI catcher tries to take over.
+The $U_m$ interface will be described in detail in Section \ref{sec:Um} since this is our main source for gathering information from IMSI catchers.
+Section \ref{sec:catcher} will finally explain how an IMSI catcher works and how it replaces the system components, as well as state from a technical and law perspective why these devices have become a threat to all-day privacy.
+
+\section{A Historical Perspective}
+The acronym GSM was originally derived from \emph{Group Sp\'{e}ciale Mobile}.
+This committee was part of the \gls{cept}, 1982, with the task of developing a pan-Eurpean digital cellular mobile radio standard in the 900\MHz band.
+In 1986, the frequency range was officially licensed.
+The foundation of this task group was a direct answer to the development of independent and incompatible analog radio networks during the 1980's.
+Examples of such networks were the C-Netz in Germany, the \gls{tacs} in the UK and \gls{nmt} in Scandinavia.
+
+In February 1987, the committee submitted the basic parameters of GSM.
+Not long after, in September, the \gls{MoU} was signed in Copenhagen by 15 members of 13 countries that were dedicated to deploy GSM in their respective home countries.
+This agreement was the foundation for allowing international operation of mobile stations using the standard interfaces agreed upon earlier that year.
+\gls{cept} itself was around since 1959 and its members founded the \gls{etsi} in 1988.
+In the same year the committee submitted the first detailed specification for the new communications standard.
+The acronym was reinterpreted in 1991, after the committee became a part of the \gls{etsi} in 1989, to \emph{Global System for Mobile Communications}.
+The very same year, the specifications for the \gls{dcs1800} were submitted.
+These were essentially the same specifications translated to the 1800\MHz band and the basis for the USA's 1900\MHz band.
+Under the umbrella of the \gls{etsi}, many \glspl{stc} began to work on different aspects of mobile communication, like network aspects (SMG 03) or security aspects (SMG 10).
+SMG 05 dealt with future networks and especially with UMTS specifications which eventually became an independent body inside the \gls{etsi}.
+
+In 1992, many European countries had operational mobile telephone networks.
+These networks were a huge success and as early as 1993, they already counted more than one million subscribers \cite{GSM2009}.
+Many networks on different frequency bands (900\MHz, 1800\MHz, 1900\MHz) were started outside Europe in countries like the US or Australia with Telstra as the first non European provider.
+The rapid growth of mobile subscribers worldwide until today can be seen in Figure \ref{fig:gsm_growth}.
+Three of the main reasons for this rapid growth are explained by Heine \cite{protocols1999} as:
+\begin{itemize}
+ \item Liberalisation of the mobile market in Europe which allowed for competition and thus resulting in lower prices and enhanced development.
+ \item Expertise within the Groupe Sp\'{e}ciale Mobile and their collaboration with industry.
+ \item The lack of competitive technologies.
+\end{itemize}
+
+\begin{figure}
+\centering
+\begin{tikzpicture}
+\begin{axis}[
+ width=\textwidth,
+ height=0.3\textheight,
+ xlabel=Year,
+ ylabel=Subscribers,
+ xticklabel style={/pgf/number format/1000 sep=}
+ ]
+ \addplot [smooth,mark=*,blue] plot coordinates {
+ (1994, 1e6)
+ (1995, 10e6)
+ (1996, 50e6)
+ (1998, 100e6)
+ (2001, 500e6)
+ (2005, 1.5e9)
+ (2007, 2.5e9)
+ (2008, 3e9)
+ (2009, 3.5e9)
+ (2010, 3.7e9)
+ (2011, 4e9)
+ };
+\end{axis}
+\end{tikzpicture}
+\caption{Growth of mobile GSM subscriptions. Compiled from \cite{GSM2009,GSM_history2011,GSM_stats2011}}
+\label{fig:gsm_growth}
+\end{figure}
+
+%\begin{figure}
+%\centering
+%\includegraphics[width=.5\textwidth]{../Images/3gpp.jpg}
+%\caption{The 3GPP Logo}
+%\end{figure}
+
+In 1998, the \gls{3gpp} was founded by five organisational partners.
+Their goal was standardisation of mobile communications with focus on developing specifications for a third generation mobile radio system.
+These partners were the \gls{arib}, the \gls{etsi}, the \gls{atis}, the \gls{tta} and the \gls{ttc}.
+The focus was later expanded in the light of the \emph{International Mobile Communications-2000}-project \cite{3gpp_Proposal2000} by the \gls{itu} to:
+\begin{itemize}
+ \item Development and maintenance of \gls{gsm} and \gls{gprs}, including \gls{edge}, which are standards for high speed packet oriented data transmission via \gls{gsm}.
+ \item Development of a third generation mobile communication system on the basis of the old \gls{gsm} protocol. This standard is called \gls{umts}.
+ \item An IP based multimedia system.
+\end{itemize}
+Up to now, the \gls{3gpp} has enhanced mobile standards.
+In 2005 the first \gls{hsdpa} network went online.
+\gls{hsdpa} \cite{hsdpa} is a protocol that enables mobile users to download data with speeds of up to 84\,MBit\,/\,s since release 9.
+\gls{hsupa} \cite{hsupa} is a related protocol in the \gls{hspa} family that provides similar functionality for uploading data.
+These and other specification are published on the \gls{3gpp} website\footnote{3GPP - Specification Groups, \url{http://www.3gpp.org/Specification-Groups} [Online; Accessed 04.2012]}.
+
+\section{The GSM Network}
+\label{sec:network}
+
+The \gls{gsm} network is a distributed, star shaped network that is built on top of existing telephony infrastructure to additionally connect mobile users.
+The telephony network is not only used to connect mobile subscribers to landline phones but also to connect the different components of the mobile network.
+The main components of a \gls{gsm} network can be seen in Figure \ref{fig:gsm_network} as well as the interfaces that are used to connect them.
+\begin{figure}
+\centering
+\includegraphics{../Images/Architecture}
+\caption{The main components of a GSM network.}
+\label{fig:gsm_network}
+\end{figure}
+There are different notions of how to distribute these components into functional entities.
+In the following, the classification by Sauter \cite{kommsys2006} will be used.
+It describes the main parts as:
+\begin{itemize}
+ \item \gls{bss}: this part is also called radio network and contains all the technology necessary for connecting mobile subscribers to the telephone network and routing their calls.
+ These calls originate from the \gls{ms} that will be explained in Section \ref{sec:ms} and travel over the air interface to the receiver stations for further processing.
+ The air interface or $U_m$ interface will be explained in Section \ref{sec:Um}, whereas the rest of the subsystem will be discussed in Section \ref{sec:bss}.
+ \item \gls{nss}: the core network, as it is sometimes called, consists of several entities that are used to establish and route a connection.
+ This is not only limited to calls within the provider's network but also into other providers' networks or the \gls{pstn}.
+ The databases that contain subscriber information and location information for connected users are located here.
+ \item \gls{in}: this part of the network augments the core network with \gls{vas} \cite{ITU1200}.
+ In order to provide extra functionality, the \gls{in} consists of several \gls{scp} databases.
+ Some of the most widely used services are in fact services of the \gls{in} and not core services.
+ Examples are prepaid cards, home areas\footnote{This service defines a geographical area, in which lower rates are calculated for mobile calls.} or telephone number portability.
+\end{itemize}
+Other sources define the \gls{oms} \cite{GSM2009} or limit the \gls{bss} entity to the provider part and define an additional entity for the \gls{ms} \cite{overview1994, overview1996}.
+The system presented in this project works inside the base station subsystem, acting the part of a passive, information gathering \gls{ms}.
+Therefore, the following theory section will focus mainly on this part, including the radio interface between the phone and the base station to establish a basic understanding of how the system is able to passively harvest information.
+
+The \gls{nss} will only be discussed as far as it is relevant to understanding how an IMSI catcher operates.
+Since the \gls{in} is not involved in any procedure concerning this project, further explanation will be omitted.
+
+\subsection{Mobile Station}
+\label{sec:ms}
+With the advent of portable microprocessors in the 1980's mobile phones became technically possible.
+Advances in technology up to today yielded ever smaller mobile phones with ever more functionality.
+Year by year, this process continued until not the technology itself was the constraining factor for size but the user interface, \eg button and display sizes.
+This trend changed with the upcoming of so called smart phones.
+With weight being the driving factor and not size, resolution and display sizes started to increase again but the devices became ever thinner.
+What hasn't changed is the basic distinction between \gls{me} and \gls{sim}, the parts of which a \gls{ms} consists.
+
+It is hard to deliver a consistent definition for what a \gls{me} is.
+GSM Recommendation 02.07 \cite{GSM0207} summarizes the mandatory and optional features of a \gls{ms}.
+Some of the most important mandatory features are \cite{protocols1999}:
+\begin{itemize}
+ \item \gls{dtmf} signalling capability.
+ \item \gls{sms} capability.
+ \item The ciphering algorithms A5/1 and A5/2 need to be implemented.
+ \item Display capability for short messages and dialled numbers, as well as available \glspl{plmn}.
+ \item A ciphering indicator that shows the user whether encryption is activated on the current connection or not.
+ This feature is disabled in most devices as not to confuse the user.
+ \item Machine fixed \gls{imei}.
+ In a strict sense this disqualifies many modern mobile phones since the \gls{imei} is not fixed onto the device itself but is rather part of the software or firmware.
+ Tools like \emph{ZiPhone}\footnote{Unlock iPhone 4, Jailbreak iPhone, \url{http://www.ziphone.org/} [Online; Accessed 04.2012]} for iOS devices\footnote{Apple iOS5, \url{http://www.apple.com/ios/} [Online; Accessed 04.2012]}, especially iPhone, can change this supposedly unchangeable identifier.
+\end{itemize}
+
+A common way to categorise different phones was to group them by the band they support.
+However, it is more common nowadays that \glspl{me} support two bands, three bands or even all four bands.
+These are called dual-band, tri-band and quad-band devices respectively.
+
+As the name suggests, the \gls{sim} card is essentially a data storage that holds user specific data.
+This separation is interesting for the \gls{gsm} user since it allows him\,/\,her to exchange the \gls{me} without having to contact the provider.
+Thus the same \gls{sim} card can be used on different frequency bands which is one of the preconditions for roaming.
+It card can either be in plug-in format or ID-1 SIM format.
+The latter one is normally used for telephone cards, credit cards or car installed \glspl{me}.
+
+A subset of parameters stored on the \gls{eeprom} of the card can be seen in Table \ref{tab:simdata}.
+The most important information stored on a \gls{sim} card are the \gls{imsi} and the \gls{ki}.
+
+\begin{table}
+\centering
+\begin{tabular}{@{}l>{\raggedright\arraybackslash}p{.8\textwidth}@{}}
+\toprule
+Parameter &Description\\
+\midrule
+\multicolumn{2}{l}{Security Related}\\
+\midrule
+A3/A8 &Algorithms required for authentication and generation of the session key\\
+Ki &Secret key\\
+Kc &Session key, generated from a random number and Ki via A8\\
+PIN &Secret numeric password to use the SIM card\\
+PUK &Secret numeric password to unlock the SIM card\\
+\midrule
+\multicolumn{2}{l}{Subscriber Data}\\
+\midrule
+IMSI &Subscriber identification\\
+MSISDN &Telephone number\\
+\midrule
+\multicolumn{2}{l}{Network Related}\\
+\midrule
+LAI &Identifier of the current Location Area\\
+TMSI &Temporary IMSI\\
+Home PLMN &Multiple entries to identify the home PLMN\\
+\bottomrule
+\end{tabular}
+\caption{Subset of data stored on a SIM card. Adopted \cite{protocols1999}}
+\label{tab:simdata}
+\end{table}
+
+This key is used to generate the \gls{kc}, as will be explained in Section \ref{sec:nss}.
+Most of this data, although not the security relevant \gls{ki} and \gls{kc}, can be read via a USB \gls{sim} card reader which can be bought for around \$10 on the web.
+Since \gls{ki} never leaves the card, \gls{kc} has to be dynamically generated on the card.
+This can be done since the card itself has a microprocessor that manages the security relevant data.
+Key functions, like running the \gls{gsm} key algorithm, verifying a \gls{pin} or reading a file can be accessed through the microprocessor via a communication protocol.
+A brief description of the protocol and functionalities can be found in Sauter's book \cite{kommsys2006}.
+
+The \gls{imsi} as described in GSM 23.003 \cite{GSM23003} uniquely identifies a subscriber.
+It has at most 15 digits and is divided into three parts, \gls{mcc}, \gls{mnc} and \gls{msin} of which only the last part is the personal identification number of the subscriber.
+\[\underbrace{262}_{\text{MCC (Germany)}} \underbrace{01}_{\text{\phantom{aa}MNC (T-Mobile)\phantom{aa}}} \underbrace{9876543210}_{MSIN}\]
+The first two groups together are called \gls{hni}.
+The three digit \gls{mcc} describes the country, the area of domicile of the mobile subscriber.
+The \gls{mnc} is an identification number for the home \gls{plmn}.
+It can either have two or three digits depending on the \gls{mcc}.
+It is not recommended by the specification and thus not defined to mix two and three digit \gls{mnc}s for a single \gls{mcc}.
+These country codes are assigned by the \gls{itu} in ITU E.212 \cite{ITU212}.
+An excerpt can be found in Table \ref{tab:countrycodes}.
+The third part, the \gls{msin} is a number consisting of up to ten digits, which is used for authenticating the mobile subscriber against the network.
+\gls{mnc} and \gls{msin} together are called \gls{nmsi}.
+\begin{table}
+\centering
+\subtable{
+\begin{tabular}{ll}
+\toprule
+Country &MCC\\
+\midrule
+Germany &262\\
+Australia &505\\
+USA &310 - 316\\
+UK &234 - 235\\
+Switzerland &228\\
+Austria &232\\
+France &208\\
+\bottomrule
+\end{tabular}
+}
+\hspace{.5cm}
+\subtable{
+\begin{tabular}{lll}
+\toprule
+Provider &Country &MNC\\
+\midrule
+T-Mobile &Germany &01, 06(R)\\
+Vodafone &Germany &02, 04(R), 09(R)\\
+E-Plus &Germany &03, 05(R), 77(T)\\
+O$_2$ &Germany &07, 08(R), 11(R)\\
+Orange &France &00, 01, 02\\
+Swisscom &Switzerland &01\\
+A1 &Austria &01, 09\\
+\bottomrule
+\end{tabular}
+}
+\caption{Mobile Country and Network Codes. (R) denotes that the MCC is reserved but not operational as of yet, whereas (T) denotes a operational test network.}
+\label{tab:countrycodes}
+\end{table}
+
+\subsection{Network Subsystem}
+\label{sec:nss}
+The most important task of the Network Subsystem, or Network Switching Subsystem, is to establish connections and route calls between different locations.
+This is done by the so called \gls{msc} that can route a call either to another \gls{msc}, into the \gls{pstn} or into another provider's network.
+Apart from routing, the \gls{nss} also provides the means to administer subscribers inside the network.
+Facilities to support this task are the \gls{hlr}, the \gls{vlr} and the \gls{ac}.
+These will now be described in further detail.
+A possible arrangement of these components is displayed in Figure \ref{fig:gsm_network}.
+The \gls{eir} shown in the picture can be thought of as a database containing lists with information on whether to allow a particular \gls{imsi} access to the network or not.
+
+\subsubsection{Mobile Switching Center}
+The \gls{msc} is the component that does the actual routing of calls and therefore is the core component of the \gls{nss}.
+It basically works like any other \gls{isdn} exchange device with additional functionality to manage mobility.
+Since the amount of signalling inside a \gls{plmn} would be far too much for a single \gls{msc} there is one for every \gls{la}.
+Amongst others, its most important tasks are \gls{cc} and \gls{mm}.
+
+\gls{cc} entrails registration when the subscriber connects to the network as well as routing the calls or text messages from one registered subscriber to another.
+This routing can include transmission of calls to landlines or to networks of other providers.
+\glspl{msc} that bind the provider's networks to other providers' networks or the \gls{pstn} are called Gateway \glspl{msc}.
+
+The above part is also true for pure landline switching centres.
+What sets a mobile switching centre apart from these is called \gls{mm}.
+Since the participants can freely move around the network and thus cannot be identified the same way as a fixed landline participant, authentication before using the offered services is important.
+Another consequence of mobility is that the network has to keep track of where a subscriber is and through which \gls{msc} it can be reached.
+This is done via \emph{Location Updates}, which update the current location in the databases for other \glspl{msc} to look up.
+Also during active calls, if the subscriber leaves the respective service area of the switching centre, the call needs to be transferred to the new switching centre without being interrupted.
+A procedure called \emph{Handover} achieves just that.
+
+For this central role to work it is necessary to be connected to all the other components of the \gls{nss}.
+This is done via different connections called interfaces.
+A brief description of what the different interfaces in a \gls{gsm} network are and what their respective function is can be seen in Appendix \ref{sec:interfaces}.
+
+\subsubsection{Home Location Register}
+The \gls{hlr} is the central database in which all subscriber related data is stored.
+The entries can be divided into two classes, permanent administrative and temporary data.
+Part of this administrative data is, which services a subscriber has access to and which are prohibited (\eg roaming in certain networks).
+The data itself is indexed with the customer's \gls{imsi} to which multiple telephone numbers can be registered.
+Since these \glspl{msisdn} are independent from the \gls{imsi} a subscriber can change his telephone number and also take the telephone number along should he\,/\,she decide to switch to a new provider.
+
+Access to basic services is stored inside the \gls{hlr}.
+Examples of such services are the ability to receive and initiate telephone calls, use data services or send text messages.
+Additional services called Supplementary Services like call forwarding or display of phone numbers during calls can also be set or unset in this database.
+It is up to the provider if these services are available freely or are bound to a fee.
+The temporary data enfolds the current \gls{vlr} and \gls{msc} address as well as the \gls{msrn}, which is essentially a temporary location dependent ISDN number.
+
+\subsubsection{Visitor Location Register}
+As can be seen in Figure \ref{fig:gsm_network} there can be multiple \glspl{vlr}, one for each area in a network.
+These registers can be seen as caches for data located in the \gls{hlr}.
+They are intended to reduce signalling between the \gls{msc} and the \gls{hlr}.
+Each time a subscriber enters a new area that is serviced by a new \gls{msc}, data for this subscriber is transferred to the respective \gls{vlr} from the central \gls{hlr}.
+Such data includes the \gls{imsi} and the \gls{msisdn} as well as information on which services are available to that particular subscriber.
+Additionally, the subscriber is assigned a temporary replacement \gls{imsi} called \gls{tmsi} and the \gls{la} in which the \gls{ms} was registered last is transmitted.
+In this way, the regular \gls{imsi} is not used and as a result can not be harvested by tapping into the radio channel.
+While it is possible to operate the \gls{vlr} as a standalone entity, in most cases it is implemented as a software component of the \gls{msc} \cite{kommsys2006}.
+
+\begin{figure}
+\centering
+\includegraphics{../Images/Authentication}
+\caption{Authentication procedure.}
+\label{fig:authentication}
+\end{figure}
+
+\subsubsection{Authentication Center}
+\label{sec:authentication}
+The \gls{ac} is the network component responsible for authenticating mobile subscribers.
+It is a part of the \gls{hlr} and the only place apart form the customer's \gls{sim} card where the secret key \gls{ki} is stored.
+The authentication is not only done once when the subscriber connects to the network but rather on many occasions, \eg the start of a call or other significant events to avoid misuse by a third party.
+This authentication routine is a key based challenge-response procedure\footnote{A procedure where one party poses a question, a so called challenge and the party to be authenticated has to provide a valid answer.} outlined in Figure \ref{fig:authentication}.
+The steps of the procedure can be summarized as follows:
+\begin{enumerate}
+ \item The user connects to the network or triggers an event that needs authentication at the \gls{msc}.
+ There are two possible scenarios from here on.
+
+ In the first case the \gls{imsi} is part of the authentication request and the \gls{ac} starts with searching for the corresponding \gls{ki} and authentication algorithm A3.
+ An authentication triplet is built using \gls{ki} which consists of the components:
+ \begin{itemize}
+ \item RAND: a 128 bit random number.
+ \item SRES: a 32 bit number, called signed response, which is generated by A3 with \gls{ki} and RAND as inputs.
+ \item Kc: the ciphering key that is used to cipher the data during transmission.
+ It is also generated with \gls{ki} and RAND using the algorithm A8.
+ \end{itemize}
+ To save signalling bandwidth usually more than one authentication triplet is generated and returned to the \gls{msc} by the \gls{ac}.
+ It should be noted that, since a separate ciphering key \gls{kc} is used, the secret key never leaves the \gls{ac}.
+
+ In the second case either a previously generated authentication triplet is used or new authentication triplets are requested.
+ \item RAND is transmitted to the \gls{ms} by the \gls{msc} where the signed response SRES* is created by the \gls{sim} card using A3, \gls{ki} and RAND.
+
+ \item An authentication response containing SRES* is sent back to the \gls{msc}.
+
+ \item If SRES and SRES* match, the subscriber is authenticated.
+\end{enumerate}
+
+Remarkable properties of this procedure are that by using a ciphering key that is generated by a random number and a secret key, the secret key itself never leaves the \gls{ac}.
+Apart from that, the use of a random number prevents replay attacks on SRES.
+It should also be noted that this way of authenticating only works for authenticating the subscriber to the network.
+It is a one way authentication.
+The subscriber needs to trust the network.
+This is the basic design flaw that IMSI catchers abuse.
+In \gls{umts} networks that flaw was fixed and the authentication procedure was made mutual \cite{kommsys2006}.
+However since it will take considerable time until all areas are services by \gls{umts}, phones still have a fallback mechanism to use \gls{gsm} if no \gls{umts} station is available.
+
+\subsection{Base Station Subsystem}
+\label{sec:bss}
+The \gls{bss} is the part of the network that provides the hard- and software for physically connecting \glspl{ms} to the provider's network.
+Its main components are the \gls{bsc}, the \gls{bts} and the \gls{trau}.
+Connecting a mobile subscriber works via radio which is why this subsystem is sometimes also called the radio network \cite{kommsys2006}.
+Inside the radio network of a certain area, there is one \gls{bsc} that connects to multiple \glspl{bts} and one more \glspl{trau} depending on whether the \gls{trau} is attached to the \gls{bsc} or to all the \glspl{bts}.
+While the transceiver station acts as receiver for radio signals the controller coordinates the different receivers and relays the incoming signals to the core network.
+Since signals inside the core network are transmitted at other rates than in the radio network, rates need to be adapted which is done by the \gls{trau}.
+
+Before discussing the individual components of this subsystem it is important to understand how the frequencies of the radio network are used and what architectural impacts this sparse resource has on the network and the components itself.
+
+\subsubsection{Frequencies and the Cellular Principle}
+\begin{figure}
+\centering
+\includegraphics{../Images/Mapping}
+\caption{Mapping of functional entities on the 900\MHz band.}
+\label{fig:frequency}
+\end{figure}
+
+A frequency band as shown in Figure \ref{fig:frequency} is distributed into different functional entities.
+The band is divided into a range for the uplink, the part that is used by the \gls{ms} to upload data into the network and the downlink that is utilised by the network to send data back.
+In the 900\MHz band each of these has a width of 25\MHz.
+These bands themselves are furthermore divided into channels, each spanning 200\,kHz, which accounts for 125 channels on 25\MHz.
+
+\begin{table}
+\centering
+\begin{tabular}{lllll}
+\toprule
+Band &ARFCN &Uplink (MHz) &Downlink (MHz) &Offset (MHz)\\
+\midrule
+GSM 900 &0-124 &890-915 &935-960 &45\\
+(Primary) & & & &\\
+GSM 900 &0-124 &880-915 &925-960 &45\\
+(Extended) &975-1023 & & &\\
+GSM 1800 &512-885 &1710-1785 &1805-1880 &95\\
+GSM 1900 &512-810 &1850-1910 &1930-1990 &80\\
+(North America) & & & &\\
+GSM 850 &128-251 &824-849 &869-894 &45\\
+(North America) & & & &\\
+\bottomrule
+\end{tabular}
+\caption{Frequencies in the different bands \cite{kommsys2006}.}
+\label{tab:frequencies}
+\end{table}
+
+Each of which is identified by its \gls{arfcn}.
+This is a simple numbering scheme, given to those 200\,kHz channels.
+The frequencies and \glspl{arfcn} are connected as follows:
+\begin{align}
+F_\text{Uplink} &= \text{Band}_\text{Start} + 0.2\,\text{MHz} \cdot (\text{ARFCN} -\text{ARFCN}_\text{Start})\\
+F_\text{Downlink} &= F_\text{Uplink} + \text{Band}_\text{Offset}
+\end{align}
+In case of the 900 MHz Band this would be:
+\begin{align}
+F_\text{Uplink} &=890 + 0.2 \cdot (\text{ARFCN} - 0)\\
+ &=890 + 0.2 \cdot \text{ARFCN}\\
+F_\text{Downlink} &=F_\text{Uplink} + 45
+\end{align}
+
+For other bands the numbers differ but the functionality is the same.
+They can be seen in Table \ref{tab:frequencies} along with their respective \gls{arfcn} numbers
+
+An additional method called time multiplexing, which will be explained in further detail in Section \ref{sec:Um}, makes is possible to map $125 \cdot 8 = 1000$ channels onto that band that could be used for voice transmission.
+Some of these channels need to be used for signalling.
+Even though the number by itself seems high, it would never suffice to service a large urban area.
+This is one of the reasons why another frequency band in the 1800\MHz range has been opened with 75\MHz up- and downlink supporting 375 channels.
+That by itself would also never suffice to service the huge number of subscribers, therefore, the \gls{gsm} network like any other modern mobile radio network is based on a cellular architecture which makes it possible to reuse frequencies.
+The range of one receiver station is drastically reduced to service only a small area.
+This is called the cell of the \gls{bts} which in theory can be approximated by a hexagon, each of which has its own \glspl{cid}.
+Each of these cells is assigned a different frequency to avoid interference.
+However, after a certain distance, the \emph{frequency reuse distance} $D$, is covered the exact same frequency can be used again by another \gls{bts}.
+$D$ is chosen large enough, so that interference does not have an impact on overall call quality.
+Figure \ref{fig:cells} shows such an arrangement.
+Also, a comparison with realistic cells can be seen which differ in their appearance from the optimized hexagon model.
+The borders are blurred because of interference, reflection- and shadowing effects and cells in the more urban areas are smaller than cells on the countryside, where the density of subscribers is less and thus can be handled by fewer \glspl{bts}.
+The band has been divided into seven frequencies which are only reused (cells with the same number) after distance $D$ is covered.
+For an arbitrary division of the frequency band into $k$ partitions and a cell radius of $R$ geometric derivations from the hexagon model yield for the frequency reuse distance $D$ \cite{GSM2009}:
+\begin{align}
+D &=R\cdot\sqrt{3k}
+\end{align}
+
+This procedure raises the number of effectively usable frequencies by a large factor.
+However certain disadvantages come with this procedure as well \cite{protocols1999}.
+Increasing the amount of receivers automatically increases the cost of infrastructure for the provider.
+Due to the nature of the mobility of subscribers this increases the amount of Handovers needed since it is more likely that a subscriber leaves a small cell during an active call.
+These inflict increased signalling load on the network itself.
+
+\begin{figure}
+\centering
+\includegraphics{../Images/Cells}
+\hspace{1cm}
+\includegraphics[scale=.21]{../Images/real_Cells}
+\caption{Theoretical arrangement of radio cells compared to a realistic alignment. Cells with the same number share the same frequency \cite{GSM2009}.}
+\label{fig:cells}
+\end{figure}
+
+\subsubsection{Base Transceiver Station}
+They are also called base stations and are the entry points to the network for subscribers.
+Theoretically, a \gls{bts} can serve a cell of 35\,km radius, however, this is decreased by interference, reflection- and shadowing effects.
+This is the theoretical limit for a cell on the 900\MHz band.
+A cell on the 1800\MHz band has a lower coverage since the signal falloff is greater due to the shorter wavelength.
+The limiting factor here are the number of subscribers itself.
+A single station can only serve a limited number of users which yields a radius as low as 100\,m for a single \gls{bts} in urban housing areas \cite{kommsys2006} with high population density.
+On the countryside where population is less dense, the constraining factor can be the transmission power of the \gls{me}.
+Therefore, cells with a radius of above 15\,km are seldom seen.
+
+\glspl{bts} and their corresponding cells can have different configurations depending on load or morph structure of the surroundings.
+In a \emph{standard configuration} every base station has its own \gls{cid}, it is a one to one mapping of cells to \gls{bts}.
+This is a cost effective way of providing service to a rural or sparse settled area, since only one \gls{bts} is used to cover a large area.
+For urban densely settled areas, the \emph{sectorised configuration} has become the de facto standard.
+The main idea is to not have a $360^\circ$ coverage for a base station handling a cell but rather split the cell into multiple sectors, each with its own \gls{bts} covering $120^\circ$ for example.
+This way the amount of subscribers in the cell will be divided over three \glspl{bts} instead of one.
+
+\subsubsection{Base Station Controller}
+The \gls{bsc} is the central unit in the \gls{bss}.
+It can be compared to a digital exchange in a standard telephone network with additional mobile extensions.
+The design idea was to remove all radio related load from the \gls{msc} into the radio subsystem.
+Therefore a \gls{bsc} manages the multitude of \glspl{bts} in the \gls{bss}.
+
+First and foremost, it is a switching centre.
+This means it has to switch incoming traffic channels from the \gls{msc} over the A-interface to channels on the outgoing A$_\text{bis}$-interface, which leads over the \gls{bts} and thus the air interface to different \glspl{ms}.
+As a result, the initialisation and maintenance of signalling and voice channels are its main tasks.
+What channels are and how they are established is explained in Section \ref{sec:channels}.
+For the sake of functional explanation of the \gls{bsc} it will suffice to regard channels as a communication line for a particular purpose, like receiving or sending voice data or for sending broadcast information.
+Due to the nature of a mobile network certain other tasks have to be performed here as well, such as Handovers and power management \cite{kommsys2006}.
+
+A \emph{signalling channel} is needed when a subscriber wants to start a call or send a text message.
+The \gls{ms} sends a channel request message to the \gls{bsc} which needs to check if any \glspl{sdcch} are free.
+If there are free channels, one of those channels is activated via the \gls{bts} and an \gls{ia} is sent via the \gls{agch} containing the number of the assigned channel.
+From this point on the \gls{ms} can sent data on the assigned channel that reach the \gls{msc}.
+For incoming calls a prior step has to be taken.
+The \gls{msc} sends a message to the \gls{bsc} that contains the \gls{imsi}, \gls{tmsi} and \gls{la} of the subscriber that is being called or texted.
+This message is forwarded to and broadcasted by all cells in that \gls{la} on the \gls{pch}.
+As soon as this message arrives at the respective \gls{ms} it requests a channel with the procedure outlined above.
+
+After a signalling channel is found that way, a \emph{voice channel} can be initialised.
+The \gls{msc} sends an assignment request message to the \gls{bsc} after the start of the call has been determined on the previously assigned \gls{sdcch} between the \gls{msc} and the \gls{ms}.
+A free \gls{tch} is assigned and the \gls{ms} can tune in to this channel and send an acknowledgement to the \gls{bsc}, which in turn sends an acknowledgement that the assignment has been completed to the \gls{ms} and the \gls{msc}.
+
+Since the voice data is sensitive it is encrypted before it is sent to the \gls{nss}.
+Voice data is a continuous stream originating at the mobile phone and accordingly has to be encrypted using a stream cipher.
+The stream cipher key $K_c$ is generated by the authentication centre.
+It is generated by the A8 algorithm on the \gls{sim} card with a random number (RAND) and the secret key \gls{ki} as input.
+Since the transmission of voice data is split into frames it suffices to encode the data on a per frame basis.
+\gls{kc} and the current frame number are the inputs for the algorithm A5 which generates a 114 bit ciphering sequence that can be XORed with the frame.
+This sequence changes every frame since it uses the current frame number as input.
+The complete procedure is outlined in Figure \ref{fig:cypher}.
+\begin{figure}
+\centering
+\includegraphics{../Images/Cipher}
+\caption{Ciphering procedure for one frame of voice data. Adopted from \cite{kommsys2006}.}
+\label{fig:cypher}
+\end{figure}
+Some strong ciphering algorithms are not permitted in certain countries so there is a variety of algorithms called A5/0, A5/1 and A5/2 from which one needs to be chosen upon connecting to the network.
+However, the encryption is only optional and not mandatory.
+The use of A5/0 indicates that no encryption is used.
+If the network does not offer such encryption, the \gls{me} sends its data unencrypted without giving notice to the user in most cases.
+A ciphering indicator is part of most mobile phones but on normally it is disabled by the operator as to not confuse the customers.
+The other weakness is the locality of encryption.
+The procedure only affects the transmission from the \gls{me} to the \gls{bts}, everything after that is unencrypted voice data.
+This is especially a problem if providers use point-to-point radio systems to connect their base stations to the \gls{msc}.
+
+A \emph{Handover} is necessary when a subscriber leaves the area of a cell and needs to be assigned to another one while conducting a call.
+First of all a \gls{tch} in the target cell has to be activated since the call is still in progress.
+Once this is done, the new cell address and frequency is sent to the \gls{ms} over the \gls{facch} along with a command that triggers the Handover.
+After synchronising with the new cell, an acknowledgement is sent by the base station to the controller to switch the voice connection to the new cell.
+What remains is freeing the old \gls{tch} for further use by other subscribers.
+
+\section{The $U_m$ Interface}
+\label{sec:Um}
+As with all radio based networks, the efficiency of the wireless interface, the interface between the \gls{ms} and the \gls{bts}, is of utmost importance to the overall performance of the network.
+The main reason is that resources on the air interface are scarce.
+Maximising efficiency in this case can be seen as maximizing the quotient of transmission rate over bandwidth used \cite{protocols1999}.
+
+The first section will explain how transmission in a \gls{gsm} network is handled on the physical level and what techniques are used to maximize throughput.
+Afterwards, the notion of logical channels, virtual channels that are mapped on top of the actual transmission, will be discussed.
+It will be carved out which channels are of importance for this project.
+The last section outlines the network layers of the \gls{gsm} stack, to give a basis for understanding where the framework employed in the practical part is situated in that hierarchy.
+
+\subsection{Radio Transmission}
+\label{sec:radio}
+Without additional techniques, the \gls{bts} would only be able to serve a single caller at a time.
+Therefore, even in older radio networks, like the C-Netz in Germany, \gls{fdma} is used.
+With \gls{fdma}, a specific frequency of the broad frequency band of the \gls{bts} is allocated to a specific subscriber for a call, leaving other frequencies open to be used by other subscribers connected to the same base station.
+Essentially this means that every \gls{bts} can serve multiple frequencies at the same time.
+This comes at the cost of additional hardware, since all the frequencies need their own transceivers and need to be amplified accordingly to guarantee transmission quality.
+Additional hardware for each channel is also required to enable duplex transmission, meaning that sending and receiving can be done at the same time.
+
+That number of available frequencies would not suffice to meet the demand, more communication channels were needed.
+To that end, another technique has been introduced, called \gls{tdma}.
+In \gls{gsm} networks, each of these sub-bands yielded by the \gls{fdma} procedure has a width of 200\,kHz.
+Onto this smaller carrier frequency, \gls{tdma} frames are transmitted that contain eight time slots.
+These frames have a transmission length of 4.615\,ms.
+Each of these timeslots can host the data of a different subscriber, although the first two are usually used for signalling procedures.
+An illustration of how these multiplexing methods work together can be seen in Figure \ref{fig:fdma_tdma}.
+
+\begin{figure}
+ \centering
+ \includegraphics{../Images/TDMAFDMA}
+ \caption{The combination of FDMA and TDMA.}
+ \label{fig:fdma_tdma}
+\end{figure}
+
+\subsubsection{Frame Numbering}
+Another important aspect is the frame hierarchy and the resulting frame numbering, since it is used for ciphering as well as channel mapping and synchronisation.
+The frame number is one of the inputs required to generate the ciphering key and is broadcasted frequently on the \gls{sch} to keep mobile subscribers in sync.
+
+An overview of the numbering hierarchy is illustrated in Figure \ref{fig:frame_hierarchy}.
+The timeslots on the lowest level of the hierarchy have a length of $4.615\text{\,ms} \div 8 = 577~\mu\text{s}$ and are also known as \emph{Bursts}, numbered from 0 to 7.
+Depending on what the Burst is used for, the internal structure can differ but the duration is always the same.
+Every new \gls{tdma} frame, the sequence number is increased by one.
+Since this number cannot be increased endlessly it is repeated every 3\,h 28\,m 53\,s and 760\,ms.
+This is the largest chunk in the frame hierarchy and it is called Hyperframe.
+Superframes and Multiframes are layers between the Hyperframe and the \gls{tdma} frame which can occur in different configurations.
+The 51-Multiframe consists of 51 TDMA frames and carries only signalling data whereas the 26-Multiframe contains 26 TDMA frames and carries traffic and control channels.
+Superframes can be seen as packages to wrap these different Multiframes in one packages of consistent lengths.
+
+\begin{figure}
+ \centering
+ \includegraphics{../Images/Frames}
+ \caption{Hierarchical composition of the different frames.}
+ \label{fig:frame_hierarchy}
+\end{figure}
+
+When a \gls{ms} and \gls{bts} start to communicate the frame number has to be obtained by the \gls{ms} through the \gls{sch} before it can ask for a channel.
+This is important since the frame number is a vital information, indicating the chronological order of control channels.
+If the \gls{ms} asks for a channel assignment in frame $n$ and a channel is assigned to the \gls{ms}, the assigned channels refers back to the frame $n$ and thus the \gls{ms} can find its channel amongst the others.
+
+\begin{figure}
+ \centering
+ \includegraphics{../Images/Bursts}
+ \caption{Structural Comparison of different Burst types. After \cite{GSM2009}.}
+ \label{fig:burst_types}
+\end{figure}
+
+\subsubsection{Burst Types}
+As suggested by the paragraph above there are different kinds of Bursts which are shown in Figure \ref{fig:burst_types} \cite{GSM2009}.
+
+In addition to \emph{data bits} and known fixed bit sequences every frame has \emph{tail bits}, which mark the beginning and the end of a frame.
+The fixed bit sequence is called \emph{training sequence} and appears in conjunction with the data bit sequences.
+During a radio transmission procedure the signal can be distorted by shadowing, reflection or other factors which would result in a loss of data.
+But since the training sequence is known, it is possible to reconstruct the original signal by comparing the incoming training sequence with the expected one and thus conserving the data bits.
+
+All Bursts also contain \emph{guard times} which separate them from the next Burst.
+This is necessary because subscribers can move around and thus slight variations in timing may occur.
+These variations could result in the collision of data from several different sources, rendering it unusable.
+For subscribers that move at considerable speeds, \eg in a car, this is not sufficient and an extra mechanism called \emph{Timing Advance} is used.
+Basically, the farther a subscriber is away from a base station the earlier a burst has to be sent, to compensate for the distance.
+The value for the Timing Advance is determined by the \gls{bsc} after receiving a channel request message from the mobile station and afterwards constantly updated by the respective \gls{bts}.
+The different Burst types are:
+\begin{itemize}
+ \item Normal Burst: The basic information transmitting Burst.
+ All information on traffic and control channels is transmitted by this Burst except for the \gls{rach}.
+ Furthermore, this Burst contains \glspl{sf}.
+ If these are set, the Burst contains important signalling data that has to travel fast over the \gls{facch}, however, no normal data can be transmitted in this case.
+ \item Frequency Correction Burst: This Burst is sent frequently and is used by \glspl{ms} to fine tune to the frequency of the \gls{bts}.
+ It may also be used by the \gls{ms} to do time synchronisation for \gls{tdma} frames.
+ The periodic broadcasting of this Burst forms the \gls{fcch} and shares a frequency with the \gls{bcch} as will be shown in the next section.
+ \item Synchronisation Burst: This Burst contains time synchronisation information from the \gls{bts} for the \gls{ms} as well as the running \gls{tdma} frame number.
+ Periodic broadcasting of this Burst forms the \gls{sch}.
+ \item Dummy Burst: When no other Bursts are sent on the frequency carrying the \gls{bcch}, this one is transmitted to fill the gap.
+ This way the \gls{ms} can keep up doing quality measurements even if no data needs to be transmitted.
+ \item Access Burst: The Burst that is used to transmit data on the \gls{rach}.
+ Since everyone can sent on the \gls{rach} without being given a timeslot via Slotted Aloha\footnote{Slotted Aloha is a medium access procedure in which each participant can send data in predefined timeslots. If collisions occur the data is discarded and each participant has to wait a random time interval before sending again.} procedure, the guard times of this Burst are high as to reduce the probability of data collisions.
+\end{itemize}
+
+The information in this section described the physical properties of the Air Interface. also called Layer 1 when referring to the standard ISO\,/\,OSI model.
+A short description of the other layers will be presented in Section \ref{sec:layers}.
+
+\subsection{Logical Channels}
+\label{sec:channels}
+A logical channel is a virtual construct on top of the physical construct of frames to group similar information together.
+Since not all information has to be sent all the time, these different information channels, \eg broadcast information about the respective base station, can be multiplexed and sent together.
+\begin{figure}
+ \centering
+ \includegraphics{../Images/Channels}
+ \caption{Mapping of virtual channels on time slots.}
+ \label{fig:channels}
+\end{figure}
+
+Mapping of these channels on the physical interface works in two dimensions.
+The first dimension is the frequency and the second is the time slot.
+Figure \ref{fig:channels} shows this mapping of channels onto time slots over the course of multiple \gls{tdma} frames for one fixed frequency.
+This way each timeslot over the course of multiple frames can be regarded as a virtual channel.
+These resulting virtual channels can now be used by a multitude of logical channels to transmit information.
+
+There are two main categories of logical channels, distinguished by their usage \cite{kommsys2006}, dedicated channels and common channels.
+Dedicated channels transport data meant for a single subscriber whereas common channels contain information interesting to all subscribers.
+
+\subsubsection{Dedicated Channels}
+As mentioned above, these channels wrap the communication of a single user with the network.
+These are point to point channels.
+\begin{itemize}
+ \item \gls{tch}: A data channels that is used to transmit voice data or data service packages.
+ \item \gls{facch}: A channel for transmission of urgent signalling data, \eg Handover signalling.
+ This data doesn't have to be send often, so it shares a timeslot with the \gls{tch} and uses the stealing flags to insert its own data.
+ \item \gls{sacch}: The uplink of this channel is used by the \gls{ms} to transmit quality measurements of the cell and neighbouring cells to the base station, so the network can do Handover decisions accordingly.
+ The downlink is used for Timing Advance data and power management data for the \gls{ms}.
+ \item \gls{sdcch}: On this channel signalling information is sent to a subscriber as long as no \gls{tch} has been assigned during the initialisation of a call.
+ Text messages and Location Updates are also transmitted on this channel.
+\end{itemize}
+
+\subsubsection{Common Channels}
+\label{sec:common_channels}
+The common channels contain data interesting to all subscribers, thus having a broadcast nature.
+These channels are the main source of information gathered by the \gls{icds}.
+They are point to multi-point channels.
+\begin{itemize}
+ \item \gls{sch}: When the \gls{ms} is looking for a cell to connect, this synchronisation channel is used.
+ \item \gls{fcch}: It is used by \glspl{ms} to fine tune to the frequency of a certain base station and helps to find the start of a 51-Multiframe.
+ \item \gls{bcch}: This channel is used to transmit information about the network and the base station itself through different \emph{System Information Messages}.
+ These contain the network name and cell identification as well as neighbourhood information on cells in the area and much more.
+ This channel will be the main source of information for this project, since it allows harvesting information without actively participating in the network and will thus be discussed in further detail in Chapter \ref{sec:info_gathering}.
+ \item \gls{pch}: If a subscriber is not assigned a dedicated channel yet, \ie he\,/\,she is not active, they are notified on this channel if there is an incoming call or text.
+ The subscribers are identified by their \gls{tmsi} which has been previously assigned upon entering the network.
+ This channel will be used as an additional source of information for the \gls{icds}.
+ \item \gls{rach}: A subscriber that has been notified over the \gls{pch} can contact the network and request a \gls{sdcch}.
+ Since this is a channel used by all connected and idle \glspl{ms}, access has to be regulated.
+ As the name implies, access is random thus it can happen that two or more \gls{ms} try to send at the same time.
+ Slotted Aloha is used to handle access.
+ \item \gls{agch}: This is the channel used to respond to a \gls{ms} if a request has been made on the \gls{rach}.
+ The acknowledgement message also contains information on which \gls{sdcch} to use.
+\end{itemize}
+
+\subsubsection{Combinations}
+These channels cannot arbitrarily be mapped onto Multiframes.
+There is a complex multiplexing scheme defined in GSM 05.02 \cite{gsm0502} that explains which channel combinations can occur inside a Multiframe.
+A table containing the possible combinations can be found in Appendix \ref{sec:combinations}.
+The mapping of these specific Multiframe-configurations onto timeslots is not arbitrary either.
+Normally TS-0 and TS-1, the first two time slots, are used to handle channels with signalling information.
+The \gls{bcch} for example, which we will use to harvest information uses TS-0 on the carrier frequency.
+
+\subsection{Layers}
+\label{sec:layers}
+Design-wise the layers of the $U_m$ interface resemble the layers of the ISO\,/\,OSI reference model.
+This section will give a short overview over the first three layers with respect to the air interface \cite{protocols1999}, since these are the ones that the employed framework works on.
+
+\paragraph{Physical Layer (Layer 1):} This layer provides the facilities for the actual transmission of data.
+In case of the $U_m$ interface, this is the actual radio equipment.
+On this layer no differentiation between data types like user or signalling data is done.
+The data that it receives from Layer 2 is either single bit data or an arrays of bits.
+\gls{gmsk} modulation is used to encode the data a Burst contains into radio signals.
+
+\paragraph{Data Link (Layer 2):} On Layer 2 packaging is done.
+The notion of data frames is introduced to have chunks of information on which error checking and potential retransmission of corrupted data can be performed.
+The Layer 2 protocol \gls{hdlc} is used as a basis for \gls{ss7} as well as for \gls{lapd}, which are the basic protocols a classical telephone network operates upon.
+\gls{hdlc} and its derivatives use start\,/\,stop markers and checksums to form data frames.
+The Layer 2 format changes through the course of the network while the data packages of Layer 3 may stay the same.
+When a transmission from a \gls{ms} to the \gls{bts} is done, \gls{lapdm} is used, which is essentially the same as the Layer 2 \gls{isdn} protocol with a few simplifications.
+From the \gls{bts} to the \gls{bsc}, \gls{lapdm} converts to \gls{lapd} and afterwards is exchanged to \gls{mtp2}.
+For the air interface \gls{lapdm}, along with channel coding and Burst formatting form Layer 2.
+More information about these Layer 2 protocols can be found in the respective Technical Specifications of the \gls{3gpp} \cite{GSM0405,GSM0406}.
+
+\paragraph{Network (Layer 3):} Layer 3 headers have to provide all the information necessary for the packet to be routed towards its recipient.
+As with Layer 2 information, it may be the case that this header needs to be partially rewritten during the transmission of a package.
+Between the \gls{ms}, \gls{bts}, \gls{bsc} and \gls{msc} the \gls{rr} protocol and the information needed to route a call into the \gls{ss7} subsystem are part of Layer 3.
+This protocol handles configuration and allocation of radio channels as well as managing the dedicated channels to the subscribers.
+
+\section{IMSI Catcher}
+\label{sec:catcher}
+An IMSI catcher is a device that is used to capture the \gls{imsi} and \gls{imei} numbers of mobile subscribers.
+The knowledge of the \gls{imsi} and \gls{imei} numbers can be exploited to either tap into the participant's calls or pinpoint the location of the subscriber \cite{fox}.
+Another less known functionality is that if catchers do not relay intercepted calls they can be used to suppress mobile communication in a certain area, \eg during a police operation \cite{imsi_wiki}.
+
+This topic came up in conjunction with crime fighting and prevention with the advent of mobile telephones.
+A mobile phone cannot be tapped in the same way as a landline phone, since the subscriber can change places and also phones thus there is no designated line associated with him\,/\,her.
+This has proven to be a challenge to the authorities.
+
+In 1996, Rohde\,\&\,Schwarz a company based in Munich, Germany has developed a device called \emph{GA 090} which was the first IMSI catcher.
+Its was capable of yielding a list with all the \gls{imsi} numbers in the perimeter as well as pinpointing the location of a subscriber given the \gls{imsi}.
+Short thereafter, the \emph{GA 900} was presented, which had the additional capability of tapping into calls that originated from a particular \gls{imsi}.
+These commercial versions of catchers, produced by Rohde\,\&\,Schwarz, were priced between 200.000\,\euro{} and 300.000\,\euro{} in 2001 \cite{fox}.
+Regulations prohibit the use of IMSI catchers for individuals, because the frequency bands the \gls{gsm} network uses are registered to providers.
+In addition to these commercial products, different projects \cite{dennis, def_catcher} have shown that such devices can be built at a very low budget.
+This only intensifies the risk that is imposed by the abusive usage of such a catcher.
+Examples of malicious usage by individuals would be curious neighbours eavesdropping or a jealous husband tapping into phone calls of his wife.
+On a more large scale, these devices are of great value for industrial espionage or private investigators that would not mind breaking the law to gather information.
+To uncover such abuse by individuals is the aim of this project.
+Figure \ref{fig:catchers} shows a commercial model side by side with a self built catcher.
+\begin{figure}
+\centering
+\includegraphics[width=0.45\textwidth]{../Images/imsi_catcher}\hspace{1cm}\includegraphics[width=.45\textwidth]{../Images/usrp}
+\caption{A commercial catcher by Rhode\,\&\,Schwarz \cite{fox} and a self built catcher introduced at Defcon 2010 \cite{def_catcher}.}
+\label{fig:catchers}
+\end{figure}
+
+Section \ref{sec:catcher_operation} will show how an \gls{imsi} catcher works and how subscribers can be caught.
+In addition the potency of these attacks will be evaluated and what risks these impose from a technical perspective.
+The next section will explain under which circumstances a catcher can be used in Germany from a legal perspective and show that this handling poses the risk of privacy breach to citizens.
+
+\subsection{Mode of Operation}
+\label{sec:catcher_operation}
+An IMSI catcher masks itself as a base station and lures subscribers in its perimeter to connect to it without their knowledge.
+In the attack shown in Figure \ref{fig:catcher_catch} \cite{mueller}, the IMSI catcher is broadcasting a new \gls{lai} with the same \gls{cid} as an formerly existing base station to the \gls{ms}, at very high power.
+This lures the \gls{ms} to connect to the alleged base station due to stronger reception and announce itself since the \gls{lac} has changed.
+
+\begin{figure}
+ \centering
+ \includegraphics{../Images/catcher_attack}
+ \caption{IMSI catching procedure. Adopted and simplified from \cite{mueller}.}
+ \label{fig:catcher_catch}
+\end{figure}
+
+Once a subscriber connects to the device, a command is sent to the \gls{ms} which asks for the \gls{sim}'s \gls{imsi}.
+This command is normally only used in case of an error \cite{fox} but can be abused this way.
+
+An IMSI catcher can only impersonate a base station because authentication in a \gls{gsm} network is one-sided as discussed earlier in Section \ref{sec:authentication}.
+The subscriber has no way of checking the authenticity of a base station but rather has to trust the broadcasted identifier which can be easily forged by a catcher.
+At this stage, the subscriber can already be localised as being in a certain distance of the catcher.
+
+In case the IMSI catcher was operated by authorities, they can now query the provider for personal information about the subscriber, however, criminals may use fake credentials when obtaining a \gls{sim} card.
+Since it is only possible to catch all the \glspl{imsi} in an area, the person to be observed has to be followed and the catcher has to be used multiple times.
+Each time it yields a set of numbers in the area.
+The \gls{imsi}, that is part of all the sets is the \gls{imsi} of the person under observation.
+More catchers can now be used to triangulate the position.
+The next step is also possible because of a design decision made in the \gls{gsm} protocol.
+Encryption itself or certain kinds of strong encryption are not allowed in all countries.
+Therefore, it is possible for the base station to request the encryption algorithm A5/0, which means that no encryption will be used for the calls at all.
+Only a few mobile phones display that encryption has been disabled by the \gls{bts}.
+
+At this point the setup for a man-in-the-middle attack \cite{mueller} on calls is completed.
+The catcher is connected to the mobile network with its own \gls{sim}.
+If the subscriber now initiates a call, the call can be routed by the catcher into the network and since encryption is turned off, it can also be listened to or recorded.
+The subscriber doesn't notice this privacy breach, except in the rare cases where the phone displays that encryption has been turned off.
+The \gls{imei} is also harvested in a similar fashion, if the observed person tries to switch \gls{sim} cards on a regular basis \cite{fox}.
+
+\subsubsection{Attacks}
+\label{sec:attacks}
+When operating a catcher, the first and most important step is to actually trick the \gls{ms} into connecting to the catcher.
+A lot of phones save the frequency they were tuned to last and upon connecting to the mobile network, this is the first frequency they try.
+Therefore, a \gls{ms} has to be set to \emph{normal cell selection} mode, which means it starts scanning for the best base station available.
+Three ways of luring a subscriber to the forged cell were presented by Wehrle for the 'Open Source IMSI-Catcher' project \cite{dennis}.
+These methods differ on whether the \gls{ms} already is in normal cell selection mode or not.
+
+\paragraph{MS is in normal cell selection mode:}
+The IMSI catcher has to fake a cell configuration consistent with the provider, the target \gls{ms} is looking for, broadcasting at any frequency.
+The \gls{ms} will choose the base station with the strongest reception levels, so the catcher has to make sure that no other available station has a better reception than itself.
+Some IMSI catchers even broadcast at a higher power than it would be allowed by law for legitimate \gls{bts} \cite{imsi_wiki}.
+
+\paragraph{MS is already connected to a network:}
+If this is the case then the connection to the current cell needs to be broken or the \gls{ms} has to be stimulated to switch the cell to the catcher's.
+A \gls{ms} that is in passive mode, meaning no active calls are conducted, will do quality measurements on the neighbouring cells of the cell it is connected to.
+It will not scan for \emph{new} base stations.
+Therefore, the IMSI catcher has to replace an existing base station that is already part of the neighbourhood of the current cell, so the \gls{ms} will do power measurements on its frequency.
+\begin{figure}
+\centering
+\includegraphics{../Images/replace_attack}
+\caption{Takeover attack of an IMSI catcher on a base station.}
+\label{fig:takeover_attack}
+\end{figure}
+Figure \ref{fig:takeover_attack} illustrates the procedure.
+In the beginning the \gls{ms} is connected to \gls{arfcn} 23 since its the strongest station in the perimeter.
+It will nevertheless conduct power measurements on \gls{arfcn} 42 and \gls{arfcn} 61 since these are neighbours.
+The IMSI catcher is switched on, sending also on \gls{arfcn} 42.
+When the \gls{ms} does its next power measurement on this \gls{arfcn} it will notice that the reception changed from -95\,dB to -52\,dB which is even better than the reception of the station it is currently connected to.
+Therefore, it will change the cell to the catcher's.
+Since the catcher broadcasts a different \gls{lac}, the \gls{ms} announces itself by sending a Location Update.
+
+This method will not work when a call is in progress.
+In that case, the only way to immediately disconnect the subscriber from the \gls{bts} and force normal cell selection mode is by jamming the frequency that belongs to the \gls{bts}.
+
+It is important to note that from these three approaches of luring a \gls{ms} to connect to a fake base station, two types of attack configurations for the IMSI catcher can be distinguished.
+To mimic a cell of a certain provider, the IMSI catcher has either to open up a cell with a new \gls{cid} or to replace a cell.
+In case of opening up a new cell, the IMSI catcher has to choose a consistent configuration that blends into the environment of the respective provider, while in case of replacing a cell, the whole configuration has to be copied as to not raise any suspicion.
+This fundamental distinction of IMSI catcher configurations will be of help later when trying to uncover these devices.
+
+\subsubsection{Risks and Irregularities}
+An IMSI catcher cannot target an individual subscriber, it always targets an area thus breaching the privacy of uninvolved subjects.
+Apart from that, a catcher that does not relay calls takes away the possibility for all connected people in the area to initiate calls.
+Even if the the catcher routes calls into the network, it only has one \gls{sim} card and thus can only route a single call.
+This can be very dangerous because no emergency calls can be submitted in that area during the time of operation which can be as long as five to ten minutes \cite{fox} when used by authorities.
+
+Another irregularity apart from using no encryption is that people caught in this area cannot be reached on their mobile phones, for they are not registered on the main network.
+As a consequence of the proxy functionality of the IMSI catcher, when a call is routed into the network the recipient can only see the number the catcher is registered with or 'Number Withheld', however, not the original number.
+
+\subsection{Law Situation in Germany}
+\label{sec:catcher_law}
+
+First reports of an IMSI catcher used by authorities in Germany dates back to 1997.
+Until November 2001, 35 cases of use were officially confirmed by the \gls{bmi} \cite{fox}.
+It was used to fight organised and serious crime, like hostage-takings or drug traffic by the \gls{bka} and \gls{bgs}.
+Attempts have been made by the government, to move the catcher out of the legal grey zone and use the \emph{GA 900} with its capabilities of tapping in to calls for crime prosecution.
+At that time however the attempt was dismissed.
+
+On 14$^\text{th}$ of August 2002, with Section §100i of the Strafprozessordnung (Code of Criminal Procedure), a law basis was given to the device.
+Afterwards, on 22$^\text{nd}$ of August 2006 this section and its accordance with the Grundgesetz (Constitution) was affirmed.
+The use of an IMSI catcher with prior authorisation by a judge does not affect peoples' right to privacy, nor does it contradict the Datenschutzbestimmungen (Secrecy of Confidential Data) or the Fernmeldegeheimnis (Secrecy of Confidential Communication).
+In Austria the need for a prior authorisation by a judge was removed in January 2008.
+During the first four months of 2008, 3800 cases of catcher use were reported in Austria \cite{imsi_wiki}.
+
+Gradually, starting with §100i it has become easier for the police and agencies to use electronic surveillance.
+Although in 2004, it was decided by the Federal Court of Saxony that electronic surveillance is not to be used in the substantially intimate sphere of private premises.
+This regulation can be overthrown, if linked to the field of serious crimes and terrorism.
+Section §100a(1) describes that the police merely needs to show certain evidence, underpinning a suspicion that a criminal act was committed.
+This threshold can often be overcome easily, since it is hard for courts to check evidence for sufficiency thoroughly given the short time frame of response \cite{criminal_justice}.
+\newpage
+In contrast, the law situation considering non-authorative use in Germany is clearly laid out.
+The law is breached in several points when an individual operates a chatcher.
+One breach is sending on frequency bands that are registered to different providers thus interfereng with regular communications.
+However, it is very hard to prove in retrospect that an IMSI catcher has been operated in a particular area.
+The easiness of obtaining a self-built device and the fact that illegal operation is near impossible to prove shows the immediate risk that comes from these devices.
+
+
+
+
diff --git a/Tex/Images/databases_window.png b/Tex/Images/databases_window.png
index 2a18bbb..000d55d 100644
--- a/Tex/Images/databases_window.png
+++ b/Tex/Images/databases_window.png
Binary files differ
diff --git a/Tex/Images/filter_window.png b/Tex/Images/filter_window.png
index 02ce166..ca2365d 100644
--- a/Tex/Images/filter_window.png
+++ b/Tex/Images/filter_window.png
Binary files differ
diff --git a/Tex/Images/pch_window.png b/Tex/Images/pch_window.png
index ebd870a..e24e9d7 100644
--- a/Tex/Images/pch_window.png
+++ b/Tex/Images/pch_window.png
Binary files differ
diff --git a/Tex/Images/rules_window.png b/Tex/Images/rules_window.png
index c20a80b..9b0b96d 100644
--- a/Tex/Images/rules_window.png
+++ b/Tex/Images/rules_window.png
Binary files differ
diff --git a/Tex/Master/Master.acn b/Tex/Master/Master.acn
index 5033f5b..97e15b1 100644
--- a/Tex/Master/Master.acn
+++ b/Tex/Master/Master.acn
@@ -1,706 +1,703 @@
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{1}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{1}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{1}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{1}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{1}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{1}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{2}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{2}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{2}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{3}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{3}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{CEPT?\glossaryentryfield{cept}{\glsnamefont{CEPT}}{Conf\'{e}rence Europ\'{e}enne des Administrations des Postes et des T\'{e}l\'{e}communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{TACS?\glossaryentryfield{tacs}{\glsnamefont{TACS}}{Total Access Communication System}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{NMT?\glossaryentryfield{nmt}{\glsnamefont{NMT}}{Northern Telecomunication}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{MoU?\glossaryentryfield{MoU}{\glsnamefont{MoU}}{Memorandum of Understanding}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{CEPT?\glossaryentryfield{cept}{\glsnamefont{CEPT}}{Conf\'{e}rence Europ\'{e}enne des Administrations des Postes et des T\'{e}l\'{e}communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{DCS1800?\glossaryentryfield{dcs1800}{\glsnamefont{DCS1800}}{Digital Cellular System 1800}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{STC?\glossaryentryfield{stc}{\glsnamefont{STC}}{Sub Technical Committee}{\relax }|setentrycounter[]{page}\glsnumberformat}{5}
-\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter[]{page}\glsnumberformat}{6}
-\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter[]{page}\glsnumberformat}{6}
-\glossaryentry{ARIB?\glossaryentryfield{arib}{\glsnamefont{ARIB}}{Association of Radio Industries and Businesses}{\relax }|setentrycounter[]{page}\glsnumberformat}{6}
-\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter[]{page}\glsnumberformat}{6}
-\glossaryentry{ATIS?\glossaryentryfield{atis}{\glsnamefont{ATIS}}{Alliance for Telecommunications Industry Solutions}{\relax }|setentrycounter[]{page}\glsnumberformat}{6}
-\glossaryentry{TTA?\glossaryentryfield{tta}{\glsnamefont{TTA}}{Telecommunications Technology Association}{\relax }|setentrycounter[]{page}\glsnumberformat}{6}
-\glossaryentry{TTC?\glossaryentryfield{ttc}{\glsnamefont{TTC}}{Telecommunications Technology Committee}{\relax }|setentrycounter[]{page}\glsnumberformat}{6}
-\glossaryentry{ITU?\glossaryentryfield{itu}{\glsnamefont{ITU}}{International Telecomunication Union}{\relax }|setentrycounter[]{page}\glsnumberformat}{6}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{GPRS?\glossaryentryfield{gprs}{\glsnamefont{GPRS}}{General Packet Radio Service}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{EDGE?\glossaryentryfield{edge}{\glsnamefont{EDGE}}{Enhanced Data Rates for GSM Evolution}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{HSDPA?\glossaryentryfield{hsdpa}{\glsnamefont{HSDPA}}{High Speed Downlink Packet Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{HSDPA?\glossaryentryfield{hsdpa}{\glsnamefont{HSDPA}}{High Speed Downlink Packet Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{HSUPA?\glossaryentryfield{hsupa}{\glsnamefont{HSUPA}}{High Speed Uplink Packet Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{HSPA?\glossaryentryfield{hspa}{\glsnamefont{HSPA}}{High Speed Packet Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{PSTN?\glossaryentryfield{pstn}{\glsnamefont{PSTN}}{Public Standard Telephone Network}{\relax }|setentrycounter[]{page}\glsnumberformat}{7}
-\glossaryentry{IN?\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{VAS?\glossaryentryfield{vas}{\glsnamefont{VAS}}{value-added service}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{IN?\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{SCP?\glossaryentryfield{scp}{\glsnamefont{SCP}}{Service Control Point}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{IN?\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{OMS?\glossaryentryfield{oms}{\glsnamefont{OMS}}{Operation and Maintainance Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{IN?\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{8}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{DTMF?\glossaryentryfield{dtmf}{\glsnamefont{DTMF}}{Dual Tone Multi Frequency}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{SMS?\glossaryentryfield{sms}{\glsnamefont{SMS}}{Short Message Service}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{9}
-\glossaryentry{EEPROM?\glossaryentryfield{eeprom}{\glsnamefont{EEPROM}}{Electrically Erasable Programmable Read-Only Memory}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{PIN?\glossaryentryfield{pin}{\glsnamefont{PIN}}{Personal Identification Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{MSIN?\glossaryentryfield{msin}{\glsnamefont{MSIN}}{Mobile Subscriber Identification Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{HNI?\glossaryentryfield{hni}{\glsnamefont{HNI}}{Home Network Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{10}
-\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{ITU?\glossaryentryfield{itu}{\glsnamefont{ITU}}{International Telecomunication Union}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MSIN?\glossaryentryfield{msin}{\glsnamefont{MSIN}}{Mobile Subscriber Identification Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MSIN?\glossaryentryfield{msin}{\glsnamefont{MSIN}}{Mobile Subscriber Identification Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{NMSI?\glossaryentryfield{nmsi}{\glsnamefont{NMSI}}{National Mobile Subscriber Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{PSTN?\glossaryentryfield{pstn}{\glsnamefont{PSTN}}{Public Standard Telephone Network}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{EIR?\glossaryentryfield{eir}{\glsnamefont{EIR}}{Equipment Identity Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{ISDN?\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{11}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{CC?\glossaryentryfield{cc}{\glsnamefont{CC}}{Call Control}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{MM?\glossaryentryfield{mm}{\glsnamefont{MM}}{Mobility Management}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{CC?\glossaryentryfield{cc}{\glsnamefont{CC}}{Call Control}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{PSTN?\glossaryentryfield{pstn}{\glsnamefont{PSTN}}{Public Standard Telephone Network}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{MM?\glossaryentryfield{mm}{\glsnamefont{MM}}{Mobility Management}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{MSISDN?\glossaryentryfield{msisdn}{\glsnamefont{MSISDN}}{Mobile Subscriber Integrated Services Digital Network Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{MSRN?\glossaryentryfield{msrn}{\glsnamefont{MSRN}}{Mobile Station Roaming Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{12}
-\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{MSISDN?\glossaryentryfield{msisdn}{\glsnamefont{MSISDN}}{Mobile Subscriber Integrated Services Digital Network Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{13}
-\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter[]{page}\glsnumberformat}{14}
-\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{15}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{16}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{16}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{16}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{16}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{16}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{16}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{17}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{17}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{17}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{17}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{AGCH?\glossaryentryfield{agch}{\glsnamefont{AGCH}}{Access Grand Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{18}
-\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{19}
-\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{20}
-\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{21}
-\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{21}
-\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{21}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{21}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{21}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{21}
-\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{21}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{21}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{21}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{21}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{SF?\glossaryentryfield{sf}{\glsnamefont{SF}}{Stealing Flag}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{FCCH?\glossaryentryfield{fcch}{\glsnamefont{FCCH}}{Frequency Correction Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{23}
-\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{24}
-\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter[]{page}\glsnumberformat}{24}
-\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{SACCH?\glossaryentryfield{sacch}{\glsnamefont{SACCH}}{Slow Access Control Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{FCCH?\glossaryentryfield{fcch}{\glsnamefont{FCCH}}{Frequency Correction Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{25}
-\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{AGCH?\glossaryentryfield{agch}{\glsnamefont{AGCH}}{Access Grand Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{GMSK?\glossaryentryfield{gmsk}{\glsnamefont{GMSK}}{Gaussian Minimum Shift Keying}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{HDLC?\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{SS-7?\glossaryentryfield{ss7}{\glsnamefont{SS-7}}{Signaling System 7}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{HDLC?\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{26}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{ISDN?\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{MTP 2/SS7?\glossaryentryfield{mtp2}{\glsnamefont{MTP 2/SS7}}{Message Transfer Part 2/SS7}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{RR?\glossaryentryfield{rr}{\glsnamefont{RR}}{Radio Resource}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{SS-7?\glossaryentryfield{ss7}{\glsnamefont{SS-7}}{Signaling System 7}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{MM?\glossaryentryfield{mm}{\glsnamefont{MM}}{Mobility Management}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{CC?\glossaryentryfield{cc}{\glsnamefont{CC}}{Call Control}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{RR?\glossaryentryfield{rr}{\glsnamefont{RR}}{Radio Resource}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{27}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{28}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{31}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter[]{page}\glsnumberformat}{32}
-\glossaryentry{BMI?\glossaryentryfield{bmi}{\glsnamefont{BMI}}{Bundesministerium des Inneren}{\relax }|setentrycounter[]{page}\glsnumberformat}{32}
-\glossaryentry{BKA?\glossaryentryfield{bka}{\glsnamefont{BKA}}{Bundeskriminalamt}{\relax }|setentrycounter[]{page}\glsnumberformat}{32}
-\glossaryentry{BGS?\glossaryentryfield{bgs}{\glsnamefont{BGS}}{Bundesgrenzschutz}{\relax }|setentrycounter[]{page}\glsnumberformat}{32}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{35}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{35}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{35}
-\glossaryentry{Osmocom?\glossaryentryfield{osmo}{\glsnamefont{Osmocom}}{Open source mobile communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{35}
-\glossaryentry{Osmocom?\glossaryentryfield{osmo}{\glsnamefont{Osmocom}}{Open source mobile communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{35}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{35}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{35}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{35}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{35}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{36}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{36}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{36}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{36}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{36}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{37}
-\glossaryentry{DIY?\glossaryentryfield{diy}{\glsnamefont{DIY}}{do-it-yourself}{\relax }|setentrycounter[]{page}\glsnumberformat}{37}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{37}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{38}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{38}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{38}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{39}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{FCCH?\glossaryentryfield{fcch}{\glsnamefont{FCCH}}{Frequency Correction Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{TC?\glossaryentryfield{tc}{\glsnamefont{TC}}{Type Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{FN?\glossaryentryfield{fn}{\glsnamefont{FN}}{Frame Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{TC?\glossaryentryfield{tc}{\glsnamefont{TC}}{Type Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{40}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{BSIC?\glossaryentryfield{bsic}{\glsnamefont{BSIC}}{Base Station Identification Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{NCC?\glossaryentryfield{ncc}{\glsnamefont{NCC}}{Network Color Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{BCC?\glossaryentryfield{bcc}{\glsnamefont{BCC}}{Base Station Color Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{42}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{43}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{43}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter[]{page}\glsnumberformat}{43}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{43}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{43}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{43}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{43}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{43}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{44}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{44}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{44}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{44}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{44}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{44}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{45}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{45}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter[]{page}\glsnumberformat}{45}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{46}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{46}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{46}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{46}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{46}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{46}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{48}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{48}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{49}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{50}
-\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{50}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{50}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{51}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{52}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{52}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{52}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{52}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{52}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{52}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter[]{page}\glsnumberformat}{52}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{52}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{53}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{53}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{53}
-\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{53}
-\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter[]{page}\glsnumberformat}{53}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{54}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{55}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{55}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{55}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{CSV?\glossaryentryfield{csv}{\glsnamefont{CSV}}{Comma Separated Value}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{57}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{58}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{58}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{58}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{58}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{58}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{58}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{60}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{60}
-\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{60}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{60}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{60}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{60}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{60}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{60}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{60}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{60}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{61}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{61}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{61}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{61}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{61}
-\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter[]{page}\glsnumberformat}{62}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{62}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{63}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{63}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{63}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{63}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{63}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{64}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{64}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{65}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{65}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{66}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{VoIP?\glossaryentryfield{voip}{\glsnamefont{VoIP}}{Voice over IP}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{67}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{69}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{69}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{69}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{69}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{69}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{69}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{69}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{71}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{71}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{71}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{71}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{71}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{72}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{72}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{72}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{72}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{72}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{72}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{72}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter[]{page}\glsnumberformat}{74}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{75}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{75}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{75}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{75}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{75}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{75}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{75}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{75}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter[]{page}\glsnumberformat}{77}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{78}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{78}
-\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter[]{page}\glsnumberformat}{78}
-\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter[]{page}\glsnumberformat}{78}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{78}
-\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter[]{page}\glsnumberformat}{78}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter[]{page}\glsnumberformat}{78}
-\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter[]{page}\glsnumberformat}{78}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter[]{page}\glsnumberformat}{78}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter[]{page}\glsnumberformat}{78}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{1}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{1}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{1}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{1}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{1}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{1}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{2}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{2}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{2}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{3}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{3}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{CEPT?\glossaryentryfield{cept}{\glsnamefont{CEPT}}{Conf\'{e}rence Europ\'{e}enne des Administrations des Postes et des T\'{e}l\'{e}communications}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{TACS?\glossaryentryfield{tacs}{\glsnamefont{TACS}}{Total Access Communication System}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{NMT?\glossaryentryfield{nmt}{\glsnamefont{NMT}}{Northern Telecomunication}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{MoU?\glossaryentryfield{MoU}{\glsnamefont{MoU}}{Memorandum of Understanding}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{CEPT?\glossaryentryfield{cept}{\glsnamefont{CEPT}}{Conf\'{e}rence Europ\'{e}enne des Administrations des Postes et des T\'{e}l\'{e}communications}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{DCS1800?\glossaryentryfield{dcs1800}{\glsnamefont{DCS1800}}{Digital Cellular System 1800}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{STC?\glossaryentryfield{stc}{\glsnamefont{STC}}{Sub Technical Committee}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter{page}\glsnumberformat}{6}
+\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter{page}\glsnumberformat}{6}
+\glossaryentry{ARIB?\glossaryentryfield{arib}{\glsnamefont{ARIB}}{Association of Radio Industries and Businesses}{\relax }|setentrycounter{page}\glsnumberformat}{6}
+\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter{page}\glsnumberformat}{6}
+\glossaryentry{ATIS?\glossaryentryfield{atis}{\glsnamefont{ATIS}}{Alliance for Telecommunications Industry Solutions}{\relax }|setentrycounter{page}\glsnumberformat}{6}
+\glossaryentry{TTA?\glossaryentryfield{tta}{\glsnamefont{TTA}}{Telecommunications Technology Association}{\relax }|setentrycounter{page}\glsnumberformat}{6}
+\glossaryentry{TTC?\glossaryentryfield{ttc}{\glsnamefont{TTC}}{Telecommunications Technology Committee}{\relax }|setentrycounter{page}\glsnumberformat}{6}
+\glossaryentry{ITU?\glossaryentryfield{itu}{\glsnamefont{ITU}}{International Telecomunication Union}{\relax }|setentrycounter{page}\glsnumberformat}{6}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{GPRS?\glossaryentryfield{gprs}{\glsnamefont{GPRS}}{General Packet Radio Service}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{EDGE?\glossaryentryfield{edge}{\glsnamefont{EDGE}}{Enhanced Data Rates for GSM Evolution}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{HSDPA?\glossaryentryfield{hsdpa}{\glsnamefont{HSDPA}}{High Speed Downlink Packet Access}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{HSDPA?\glossaryentryfield{hsdpa}{\glsnamefont{HSDPA}}{High Speed Downlink Packet Access}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{HSUPA?\glossaryentryfield{hsupa}{\glsnamefont{HSUPA}}{High Speed Uplink Packet Access}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{HSPA?\glossaryentryfield{hspa}{\glsnamefont{HSPA}}{High Speed Packet Access}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{PSTN?\glossaryentryfield{pstn}{\glsnamefont{PSTN}}{Public Standard Telephone Network}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{IN?\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{VAS?\glossaryentryfield{vas}{\glsnamefont{VAS}}{value-added service}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{IN?\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{SCP?\glossaryentryfield{scp}{\glsnamefont{SCP}}{Service Control Point}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{IN?\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{OMS?\glossaryentryfield{oms}{\glsnamefont{OMS}}{Operation and Maintainance Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{IN?\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{DTMF?\glossaryentryfield{dtmf}{\glsnamefont{DTMF}}{Dual Tone Multi Frequency}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{SMS?\glossaryentryfield{sms}{\glsnamefont{SMS}}{Short Message Service}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{EEPROM?\glossaryentryfield{eeprom}{\glsnamefont{EEPROM}}{Electrically Erasable Programmable Read-Only Memory}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{PIN?\glossaryentryfield{pin}{\glsnamefont{PIN}}{Personal Identification Number}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{MSIN?\glossaryentryfield{msin}{\glsnamefont{MSIN}}{Mobile Subscriber Identification Number}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{HNI?\glossaryentryfield{hni}{\glsnamefont{HNI}}{Home Network Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{ITU?\glossaryentryfield{itu}{\glsnamefont{ITU}}{International Telecomunication Union}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MSIN?\glossaryentryfield{msin}{\glsnamefont{MSIN}}{Mobile Subscriber Identification Number}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MSIN?\glossaryentryfield{msin}{\glsnamefont{MSIN}}{Mobile Subscriber Identification Number}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{NMSI?\glossaryentryfield{nmsi}{\glsnamefont{NMSI}}{National Mobile Subscriber Identity}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{PSTN?\glossaryentryfield{pstn}{\glsnamefont{PSTN}}{Public Standard Telephone Network}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{EIR?\glossaryentryfield{eir}{\glsnamefont{EIR}}{Equipment Identity Register}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{ISDN?\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{CC?\glossaryentryfield{cc}{\glsnamefont{CC}}{Call Control}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MM?\glossaryentryfield{mm}{\glsnamefont{MM}}{Mobility Management}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{CC?\glossaryentryfield{cc}{\glsnamefont{CC}}{Call Control}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{PSTN?\glossaryentryfield{pstn}{\glsnamefont{PSTN}}{Public Standard Telephone Network}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MM?\glossaryentryfield{mm}{\glsnamefont{MM}}{Mobility Management}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MSISDN?\glossaryentryfield{msisdn}{\glsnamefont{MSISDN}}{Mobile Subscriber Integrated Services Digital Network Number}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MSRN?\glossaryentryfield{msrn}{\glsnamefont{MSRN}}{Mobile Station Roaming Number}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{MSISDN?\glossaryentryfield{msisdn}{\glsnamefont{MSISDN}}{Mobile Subscriber Integrated Services Digital Network Number}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{16}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{16}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{16}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{16}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{16}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{16}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{17}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{17}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{17}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{17}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{AGCH?\glossaryentryfield{agch}{\glsnamefont{AGCH}}{Access Grand Channel}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{SF?\glossaryentryfield{sf}{\glsnamefont{SF}}{Stealing Flag}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{FCCH?\glossaryentryfield{fcch}{\glsnamefont{FCCH}}{Frequency Correction Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{24}
+\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{24}
+\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{SACCH?\glossaryentryfield{sacch}{\glsnamefont{SACCH}}{Slow Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{FCCH?\glossaryentryfield{fcch}{\glsnamefont{FCCH}}{Frequency Correction Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{AGCH?\glossaryentryfield{agch}{\glsnamefont{AGCH}}{Access Grand Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{GMSK?\glossaryentryfield{gmsk}{\glsnamefont{GMSK}}{Gaussian Minimum Shift Keying}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{HDLC?\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{SS-7?\glossaryentryfield{ss7}{\glsnamefont{SS-7}}{Signaling System 7}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{HDLC?\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{ISDN?\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{MTP 2/SS7?\glossaryentryfield{mtp2}{\glsnamefont{MTP 2/SS7}}{Message Transfer Part 2/SS7}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{RR?\glossaryentryfield{rr}{\glsnamefont{RR}}{Radio Resource}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{SS-7?\glossaryentryfield{ss7}{\glsnamefont{SS-7}}{Signaling System 7}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{32}
+\glossaryentry{BMI?\glossaryentryfield{bmi}{\glsnamefont{BMI}}{Bundesministerium des Inneren}{\relax }|setentrycounter{page}\glsnumberformat}{32}
+\glossaryentry{BKA?\glossaryentryfield{bka}{\glsnamefont{BKA}}{Bundeskriminalamt}{\relax }|setentrycounter{page}\glsnumberformat}{32}
+\glossaryentry{BGS?\glossaryentryfield{bgs}{\glsnamefont{BGS}}{Bundesgrenzschutz}{\relax }|setentrycounter{page}\glsnumberformat}{32}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{35}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{35}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{35}
+\glossaryentry{Osmocom?\glossaryentryfield{osmo}{\glsnamefont{Osmocom}}{Open source mobile communications}{\relax }|setentrycounter{page}\glsnumberformat}{35}
+\glossaryentry{Osmocom?\glossaryentryfield{osmo}{\glsnamefont{Osmocom}}{Open source mobile communications}{\relax }|setentrycounter{page}\glsnumberformat}{35}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{35}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{35}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{35}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{35}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{36}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{36}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{36}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{36}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{36}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{37}
+\glossaryentry{DIY?\glossaryentryfield{diy}{\glsnamefont{DIY}}{do-it-yourself}{\relax }|setentrycounter{page}\glsnumberformat}{37}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{37}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{38}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{38}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{38}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{FCCH?\glossaryentryfield{fcch}{\glsnamefont{FCCH}}{Frequency Correction Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{TC?\glossaryentryfield{tc}{\glsnamefont{TC}}{Type Code}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{FN?\glossaryentryfield{fn}{\glsnamefont{FN}}{Frame Number}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{TC?\glossaryentryfield{tc}{\glsnamefont{TC}}{Type Code}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{BSIC?\glossaryentryfield{bsic}{\glsnamefont{BSIC}}{Base Station Identification Code}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{NCC?\glossaryentryfield{ncc}{\glsnamefont{NCC}}{Network Color Code}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{BCC?\glossaryentryfield{bcc}{\glsnamefont{BCC}}{Base Station Color Code}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{45}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{45}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{45}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{45}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{45}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{CSV?\glossaryentryfield{csv}{\glsnamefont{CSV}}{Comma Separated Value}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{60}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{60}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{60}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{60}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{60}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{62}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{62}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{62}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{62}
+\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{62}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{62}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{67}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{67}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{68}
+\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{VoIP?\glossaryentryfield{voip}{\glsnamefont{VoIP}}{Voice over IP}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{73}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{74}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{74}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{74}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{74}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{74}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{74}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{74}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{74}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{76}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{77}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{77}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{77}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{77}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{77}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{77}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{77}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{77}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{77}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{79}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{80}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{80}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{80}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{80}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{80}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{80}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{80}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{80}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{80}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{80}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{80}
diff --git a/Tex/Master/Master.acr b/Tex/Master/Master.acr
index 131d58c..c8ed95e 100644
--- a/Tex/Master/Master.acr
+++ b/Tex/Master/Master.acr
@@ -3,78 +3,94 @@
\glsgroupheading{glssymbols}\relax \glsresetentrylist %
\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{6\delimN 7}\delimN
- \setentrycounter{page}\glsnumberformat{28}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{27}}}\glsgroupskip
\glsgroupheading{A}\relax \glsresetentrylist %
-\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{11}\delimN
- \setentrycounter{page}\glsnumberformat{14}\delimN
- \setentrycounter{page}\glsnumberformat{16}}}%
\glossaryentryfield{agch}{\glsnamefont{AGCH}}{Access Grand Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{20}\delimN
- \setentrycounter{page}\glsnumberformat{27}}}%
+ \setentrycounter{page}\glsnumberformat{18}\delimN
+ \setentrycounter{page}\glsnumberformat{26}}}%
\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{17\delimN 18}\delimN
+ \setentrycounter{page}\glsnumberformat{16}\delimN
+ \setentrycounter{page}\glsnumberformat{31}\delimN
\setentrycounter{page}\glsnumberformat{40}\delimN
\setentrycounter{page}\glsnumberformat{42}\delimN
- \setentrycounter{page}\glsnumberformat{44}\delimN
- \setentrycounter{page}\glsnumberformat{47}\delimN
- \setentrycounter{page}\glsnumberformat{54\delimN 55}\delimN
- \setentrycounter{page}\glsnumberformat{57}\delimN
- \setentrycounter{page}\glsnumberformat{67}\delimN
- \setentrycounter{page}\glsnumberformat{69\delimN 70}}}%
+ \setentrycounter{page}\glsnumberformat{45}\delimN
+ \setentrycounter{page}\glsnumberformat{48\delimN 49}\delimN
+ \setentrycounter{page}\glsnumberformat{57\delimN 58}\delimN
+ \setentrycounter{page}\glsnumberformat{61}\delimN
+ \setentrycounter{page}\glsnumberformat{69}\delimN
+ \setentrycounter{page}\glsnumberformat{71}\delimN
+ \setentrycounter{page}\glsnumberformat{74}\delimN
+ \setentrycounter{page}\glsnumberformat{76}}}%
\glossaryentryfield{arib}{\glsnamefont{ARIB}}{Association of Radio Industries and Businesses}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{6}}}%
\glossaryentryfield{atis}{\glsnamefont{ATIS}}{Alliance for Telecommunications Industry Solutions}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{6}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{6}}}%
+\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }{\glossaryentrynumbers{\relax
+ \setentrycounter{page}\glsnumberformat{11}\delimN
+ \setentrycounter{page}\glsnumberformat{14}}}\glsgroupskip
\glsgroupheading{B}\relax \glsresetentrylist %
\glossaryentryfield{bcc}{\glsnamefont{BCC}}{Base Station Color Code}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{42}}}%
\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{25\delimR 27}\delimN
+ \setentrycounter{page}\glsnumberformat{23}\delimN
+ \setentrycounter{page}\glsnumberformat{25\delimN 26}\delimN
\setentrycounter{page}\glsnumberformat{39\delimN 40}\delimN
- \setentrycounter{page}\glsnumberformat{51}}}%
+ \setentrycounter{page}\glsnumberformat{42}\delimN
+ \setentrycounter{page}\glsnumberformat{53}\delimN
+ \setentrycounter{page}\glsnumberformat{66}\delimN
+ \setentrycounter{page}\glsnumberformat{77}\delimN
+ \setentrycounter{page}\glsnumberformat{79}}}%
\glossaryentryfield{bgs}{\glsnamefont{BGS}}{Bundesgrenzschutz}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{32}}}%
\glossaryentryfield{bka}{\glsnamefont{BKA}}{Bundeskriminalamt}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{32}}}%
-\glossaryentryfield{bmi}{\glsnamefont{BMI}}{Bundesminiterium des Inneren}{\relax }{\glossaryentrynumbers{\relax
+\glossaryentryfield{bmi}{\glsnamefont{BMI}}{Bundesministerium des Inneren}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{32}}}%
\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{16}\delimN
- \setentrycounter{page}\glsnumberformat{19\delimN 20}\delimN
- \setentrycounter{page}\glsnumberformat{24}\delimN
- \setentrycounter{page}\glsnumberformat{28}\delimN
- \setentrycounter{page}\glsnumberformat{35}\delimN
+ \setentrycounter{page}\glsnumberformat{15}\delimN
+ \setentrycounter{page}\glsnumberformat{18\delimN 19}\delimN
+ \setentrycounter{page}\glsnumberformat{23}\delimN
+ \setentrycounter{page}\glsnumberformat{27}\delimN
\setentrycounter{page}\glsnumberformat{40}}}%
\glossaryentryfield{bsic}{\glsnamefont{BSIC}}{Base Station Identification Code}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{42}}}%
\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{7\delimN 8}\delimN
- \setentrycounter{page}\glsnumberformat{16}\delimN
- \setentrycounter{page}\glsnumberformat{19}}}%
-\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{16}\delimN
- \setentrycounter{page}\glsnumberformat{18\delimR 25}\delimN
- \setentrycounter{page}\glsnumberformat{28}\delimN
- \setentrycounter{page}\glsnumberformat{31}\delimN
+ \setentrycounter{page}\glsnumberformat{15}\delimN
+ \setentrycounter{page}\glsnumberformat{18}}}%
+\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }{\glossaryentrynumbers{\relax
+ \setentrycounter{page}\glsnumberformat{15\delimR 21}\delimN
+ \setentrycounter{page}\glsnumberformat{23}\delimN
+ \setentrycounter{page}\glsnumberformat{27}\delimN
+ \setentrycounter{page}\glsnumberformat{30\delimN 31}\delimN
+ \setentrycounter{page}\glsnumberformat{35}\delimN
\setentrycounter{page}\glsnumberformat{39\delimN 40}\delimN
- \setentrycounter{page}\glsnumberformat{42\delimR 45}\delimN
- \setentrycounter{page}\glsnumberformat{47}\delimN
+ \setentrycounter{page}\glsnumberformat{42\delimR 46}\delimN
+ \setentrycounter{page}\glsnumberformat{49}\delimN
\setentrycounter{page}\glsnumberformat{52}\delimN
- \setentrycounter{page}\glsnumberformat{54\delimN 55}\delimN
- \setentrycounter{page}\glsnumberformat{57}\delimN
- \setentrycounter{page}\glsnumberformat{62}\delimN
- \setentrycounter{page}\glsnumberformat{70}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{57\delimN 58}\delimN
+ \setentrycounter{page}\glsnumberformat{60\delimN 61}\delimN
+ \setentrycounter{page}\glsnumberformat{66}\delimN
+ \setentrycounter{page}\glsnumberformat{74}\delimN
+ \setentrycounter{page}\glsnumberformat{76}\delimN
+ \setentrycounter{page}\glsnumberformat{79}}}\glsgroupskip
\glsgroupheading{C}\relax \glsresetentrylist %
\glossaryentryfield{cc}{\glsnamefont{CC}}{Call Control}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{12}\delimN
- \setentrycounter{page}\glsnumberformat{28}}}%
+ \setentrycounter{page}\glsnumberformat{12}}}%
\glossaryentryfield{cept}{\glsnamefont{CEPT}}{Conf\'{e}rence Europ\'{e}enne des Administrations des Postes et des T\'{e}l\'{e}communications}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{5}}}%
-\glossaryentryfield{ci}{\glsnamefont{CI}}{Cell Identity}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{18\delimN 19}}}%
+\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }{\glossaryentrynumbers{\relax
+ \setentrycounter{page}\glsnumberformat{16}\delimN
+ \setentrycounter{page}\glsnumberformat{18}\delimN
+ \setentrycounter{page}\glsnumberformat{28}\delimN
+ \setentrycounter{page}\glsnumberformat{31}\delimN
+ \setentrycounter{page}\glsnumberformat{42}\delimN
+ \setentrycounter{page}\glsnumberformat{49\delimN 50}\delimN
+ \setentrycounter{page}\glsnumberformat{60}\delimN
+ \setentrycounter{page}\glsnumberformat{73\delimN 74}\delimN
+ \setentrycounter{page}\glsnumberformat{76}}}%
\glossaryentryfield{csv}{\glsnamefont{CSV}}{Comma Separated Value}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{54}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{57}}}\glsgroupskip
\glsgroupheading{D}\relax \glsresetentrylist %
\glossaryentryfield{dcs1800}{\glsnamefont{DCS1800}}{Digital Cellular System 1800}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{5}}}%
@@ -93,19 +109,20 @@
\setentrycounter{page}\glsnumberformat{5\delimN 6}}}\glsgroupskip
\glsgroupheading{F}\relax \glsresetentrylist %
\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{21}\delimN
- \setentrycounter{page}\glsnumberformat{24}\delimN
- \setentrycounter{page}\glsnumberformat{26}}}%
+ \setentrycounter{page}\glsnumberformat{19}\delimN
+ \setentrycounter{page}\glsnumberformat{23}\delimN
+ \setentrycounter{page}\glsnumberformat{25}}}%
\glossaryentryfield{fcch}{\glsnamefont{FCCH}}{Frequency Correction Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{25\delimN 26}\delimN
+ \setentrycounter{page}\glsnumberformat{23}\delimN
+ \setentrycounter{page}\glsnumberformat{25}\delimN
\setentrycounter{page}\glsnumberformat{40}}}%
\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{21\delimN 22}}}%
+ \setentrycounter{page}\glsnumberformat{20}}}%
\glossaryentryfield{fn}{\glsnamefont{FN}}{Frame Number}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{40}}}\glsgroupskip
\glsgroupheading{G}\relax \glsresetentrylist %
\glossaryentryfield{gmsk}{\glsnamefont{GMSK}}{Gaussian Minimum Shift Keying}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{28}}}%
+ \setentrycounter{page}\glsnumberformat{26}}}%
\glossaryentryfield{gprs}{\glsnamefont{GPRS}}{General Packet Radio Service}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{7}}}%
\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }{\glossaryentrynumbers{\relax
@@ -113,23 +130,26 @@
\setentrycounter{page}\glsnumberformat{5}\delimN
\setentrycounter{page}\glsnumberformat{7}\delimN
\setentrycounter{page}\glsnumberformat{9\delimN 10}\delimN
- \setentrycounter{page}\glsnumberformat{18}\delimN
- \setentrycounter{page}\glsnumberformat{21\delimN 22}\delimN
- \setentrycounter{page}\glsnumberformat{29\delimN 30}\delimN
+ \setentrycounter{page}\glsnumberformat{12}\delimN
+ \setentrycounter{page}\glsnumberformat{15\delimN 16}\delimN
+ \setentrycounter{page}\glsnumberformat{20}\delimN
+ \setentrycounter{page}\glsnumberformat{27\delimN 28}\delimN
+ \setentrycounter{page}\glsnumberformat{30}\delimN
\setentrycounter{page}\glsnumberformat{35\delimR 38}\delimN
- \setentrycounter{page}\glsnumberformat{45}\delimN
- \setentrycounter{page}\glsnumberformat{51}\delimN
- \setentrycounter{page}\glsnumberformat{61}\delimN
- \setentrycounter{page}\glsnumberformat{65}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{46}\delimN
+ \setentrycounter{page}\glsnumberformat{53}\delimN
+ \setentrycounter{page}\glsnumberformat{65}\delimN
+ \setentrycounter{page}\glsnumberformat{69}\delimN
+ \setentrycounter{page}\glsnumberformat{77}\delimN
+ \setentrycounter{page}\glsnumberformat{79\delimN 80}}}\glsgroupskip
\glsgroupheading{H}\relax \glsresetentrylist %
\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{28}}}%
+ \setentrycounter{page}\glsnumberformat{26}}}%
\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{11\delimN 12}\delimN
- \setentrycounter{page}\glsnumberformat{14}\delimN
- \setentrycounter{page}\glsnumberformat{65}}}%
+ \setentrycounter{page}\glsnumberformat{11\delimR 14}\delimN
+ \setentrycounter{page}\glsnumberformat{69}}}%
\glossaryentryfield{hni}{\glsnamefont{HNI}}{Home Network Identifier}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{11}}}%
+ \setentrycounter{page}\glsnumberformat{10}}}%
\glossaryentryfield{hsdpa}{\glsnamefont{HSDPA}}{High Speed Downlink Packet Access}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{7}}}%
\glossaryentryfield{hspa}{\glsnamefont{HSPA}}{High Speed Packet Access}{\relax }{\glossaryentrynumbers{\relax
@@ -137,79 +157,94 @@
\glossaryentryfield{hsupa}{\glsnamefont{HSUPA}}{High Speed Uplink Packet Access}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{7}}}\glsgroupskip
\glsgroupheading{I}\relax \glsresetentrylist %
+\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }{\glossaryentrynumbers{\relax
+ \setentrycounter{page}\glsnumberformat{18}\delimN
+ \setentrycounter{page}\glsnumberformat{43}\delimN
+ \setentrycounter{page}\glsnumberformat{51\delimN 52}\delimN
+ \setentrycounter{page}\glsnumberformat{57}\delimN
+ \setentrycounter{page}\glsnumberformat{61}\delimN
+ \setentrycounter{page}\glsnumberformat{68}\delimN
+ \setentrycounter{page}\glsnumberformat{76}\delimN
+ \setentrycounter{page}\glsnumberformat{79\delimN 80}}}%
\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }{\glossaryentrynumbers{\relax
+ \setentrycounter{page}\glsnumberformat{2\delimN 3}\delimN
+ \setentrycounter{page}\glsnumberformat{25}\delimN
\setentrycounter{page}\glsnumberformat{35}\delimN
\setentrycounter{page}\glsnumberformat{38\delimR 40}\delimN
- \setentrycounter{page}\glsnumberformat{42\delimN 43}\delimN
- \setentrycounter{page}\glsnumberformat{45}\delimN
- \setentrycounter{page}\glsnumberformat{47\delimR 52}\delimN
- \setentrycounter{page}\glsnumberformat{54\delimN 55}\delimN
- \setentrycounter{page}\glsnumberformat{58}\delimN
- \setentrycounter{page}\glsnumberformat{61\delimR 65}\delimN
- \setentrycounter{page}\glsnumberformat{67\delimR 70}\delimN
- \setentrycounter{page}\glsnumberformat{73}}}%
+ \setentrycounter{page}\glsnumberformat{42\delimR 46}\delimN
+ \setentrycounter{page}\glsnumberformat{48\delimR 55}\delimN
+ \setentrycounter{page}\glsnumberformat{57\delimN 58}\delimN
+ \setentrycounter{page}\glsnumberformat{62}\delimN
+ \setentrycounter{page}\glsnumberformat{65\delimR 69}\delimN
+ \setentrycounter{page}\glsnumberformat{71}\delimN
+ \setentrycounter{page}\glsnumberformat{73}\delimN
+ \setentrycounter{page}\glsnumberformat{76\delimN 77}\delimN
+ \setentrycounter{page}\glsnumberformat{79\delimN 80}}}%
\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{9}\delimN
- \setentrycounter{page}\glsnumberformat{28}\delimN
- \setentrycounter{page}\glsnumberformat{31}\delimN
- \setentrycounter{page}\glsnumberformat{58}}}%
+ \setentrycounter{page}\glsnumberformat{27}\delimN
+ \setentrycounter{page}\glsnumberformat{30}\delimN
+ \setentrycounter{page}\glsnumberformat{62}}}%
\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{10\delimR 12}\delimN
- \setentrycounter{page}\glsnumberformat{14}\delimN
- \setentrycounter{page}\glsnumberformat{20}\delimN
- \setentrycounter{page}\glsnumberformat{27\delimR 33}}}%
+ \setentrycounter{page}\glsnumberformat{1}\delimN
+ \setentrycounter{page}\glsnumberformat{10\delimR 14}\delimN
+ \setentrycounter{page}\glsnumberformat{18}\delimN
+ \setentrycounter{page}\glsnumberformat{27\delimN 28}\delimN
+ \setentrycounter{page}\glsnumberformat{30}}}%
\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{8}}}%
\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{12}\delimN
- \setentrycounter{page}\glsnumberformat{28}}}%
-\glossaryentryfield{itu}{\glsnamefont{ITU}}{International Telecomunication Union}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{7}\delimN
\setentrycounter{page}\glsnumberformat{11}\delimN
- \setentrycounter{page}\glsnumberformat{27}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{27}}}%
+\glossaryentryfield{itu}{\glsnamefont{ITU}}{International Telecomunication Union}{\relax }{\glossaryentrynumbers{\relax
+ \setentrycounter{page}\glsnumberformat{6}\delimN
+ \setentrycounter{page}\glsnumberformat{11}}}\glsgroupskip
\glsgroupheading{K}\relax \glsresetentrylist %
-\glossaryentryfield{kc}{\glsnamefont{Kc}}{Cyphering Key}{\relax }{\glossaryentrynumbers{\relax
+\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{10}\delimN
- \setentrycounter{page}\glsnumberformat{16}\delimN
- \setentrycounter{page}\glsnumberformat{20}}}%
+ \setentrycounter{page}\glsnumberformat{14}\delimN
+ \setentrycounter{page}\glsnumberformat{19}}}%
\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{10}\delimN
\setentrycounter{page}\glsnumberformat{14}\delimN
- \setentrycounter{page}\glsnumberformat{16}\delimN
- \setentrycounter{page}\glsnumberformat{20}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{19}}}\glsgroupskip
\glsgroupheading{L}\relax \glsresetentrylist %
\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{12}\delimN
- \setentrycounter{page}\glsnumberformat{14}\delimN
- \setentrycounter{page}\glsnumberformat{20}}}%
+ \setentrycounter{page}\glsnumberformat{12\delimN 13}\delimN
+ \setentrycounter{page}\glsnumberformat{18}\delimN
+ \setentrycounter{page}\glsnumberformat{46}\delimN
+ \setentrycounter{page}\glsnumberformat{51}\delimN
+ \setentrycounter{page}\glsnumberformat{68}}}%
\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{42\delimN 43}\delimN
- \setentrycounter{page}\glsnumberformat{47}\delimN
- \setentrycounter{page}\glsnumberformat{59}\delimN
- \setentrycounter{page}\glsnumberformat{67}\delimN
- \setentrycounter{page}\glsnumberformat{69\delimN 70}}}%
-\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{29}\delimN
+ \setentrycounter{page}\glsnumberformat{28}\delimN
+ \setentrycounter{page}\glsnumberformat{31}\delimN
\setentrycounter{page}\glsnumberformat{42}\delimN
- \setentrycounter{page}\glsnumberformat{48}\delimN
- \setentrycounter{page}\glsnumberformat{57}}}%
+ \setentrycounter{page}\glsnumberformat{44}\delimN
+ \setentrycounter{page}\glsnumberformat{50\delimN 51}\delimN
+ \setentrycounter{page}\glsnumberformat{60}\delimN
+ \setentrycounter{page}\glsnumberformat{62}\delimN
+ \setentrycounter{page}\glsnumberformat{68}\delimN
+ \setentrycounter{page}\glsnumberformat{71}\delimN
+ \setentrycounter{page}\glsnumberformat{74}\delimN
+ \setentrycounter{page}\glsnumberformat{76}\delimN
+ \setentrycounter{page}\glsnumberformat{79}}}%
+\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }{\glossaryentrynumbers{\relax
+ \setentrycounter{page}\glsnumberformat{28}\delimN
+ \setentrycounter{page}\glsnumberformat{42}}}%
\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{28}}}%
+ \setentrycounter{page}\glsnumberformat{26\delimN 27}}}%
\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{28}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{27}}}\glsgroupskip
\glsgroupheading{M}\relax \glsresetentrylist %
\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{10\delimN 11}\delimN
\setentrycounter{page}\glsnumberformat{42}}}%
\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{9\delimN 10}\delimN
- \setentrycounter{page}\glsnumberformat{19\delimN 20}\delimN
- \setentrycounter{page}\glsnumberformat{36}\delimN
- \setentrycounter{page}\glsnumberformat{42}\delimN
- \setentrycounter{page}\glsnumberformat{47}}}%
+ \setentrycounter{page}\glsnumberformat{9}\delimN
+ \setentrycounter{page}\glsnumberformat{18\delimN 19}\delimN
+ \setentrycounter{page}\glsnumberformat{36}}}%
\glossaryentryfield{mm}{\glsnamefont{MM}}{Mobility Management}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{12}\delimN
- \setentrycounter{page}\glsnumberformat{28}}}%
+ \setentrycounter{page}\glsnumberformat{12}}}%
\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{10\delimN 11}\delimN
\setentrycounter{page}\glsnumberformat{42}}}%
@@ -217,35 +252,33 @@
\setentrycounter{page}\glsnumberformat{5}}}%
\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{7\delimR 9}\delimN
- \setentrycounter{page}\glsnumberformat{14}\delimN
- \setentrycounter{page}\glsnumberformat{16}\delimN
- \setentrycounter{page}\glsnumberformat{19\delimR 21}\delimN
+ \setentrycounter{page}\glsnumberformat{13\delimR 15}\delimN
+ \setentrycounter{page}\glsnumberformat{18\delimR 21}\delimN
\setentrycounter{page}\glsnumberformat{23}\delimN
- \setentrycounter{page}\glsnumberformat{25\delimR 32}\delimN
+ \setentrycounter{page}\glsnumberformat{25\delimR 28}\delimN
+ \setentrycounter{page}\glsnumberformat{30\delimN 31}\delimN
\setentrycounter{page}\glsnumberformat{40}\delimN
- \setentrycounter{page}\glsnumberformat{42}\delimN
- \setentrycounter{page}\glsnumberformat{45}\delimN
- \setentrycounter{page}\glsnumberformat{49}\delimN
- \setentrycounter{page}\glsnumberformat{58}\delimN
- \setentrycounter{page}\glsnumberformat{64\delimN 65}\delimN
- \setentrycounter{page}\glsnumberformat{69\delimN 70}}}%
+ \setentrycounter{page}\glsnumberformat{42\delimN 43}\delimN
+ \setentrycounter{page}\glsnumberformat{46}\delimN
+ \setentrycounter{page}\glsnumberformat{51\delimN 52}\delimN
+ \setentrycounter{page}\glsnumberformat{62}\delimN
+ \setentrycounter{page}\glsnumberformat{68}\delimN
+ \setentrycounter{page}\glsnumberformat{76}\delimN
+ \setentrycounter{page}\glsnumberformat{79\delimN 80}}}%
\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{11\delimN 12}\delimN
- \setentrycounter{page}\glsnumberformat{14}\delimN
- \setentrycounter{page}\glsnumberformat{16}\delimN
- \setentrycounter{page}\glsnumberformat{19\delimN 20}\delimN
- \setentrycounter{page}\glsnumberformat{28}}}%
+ \setentrycounter{page}\glsnumberformat{11\delimR 14}\delimN
+ \setentrycounter{page}\glsnumberformat{18\delimN 19}\delimN
+ \setentrycounter{page}\glsnumberformat{27}}}%
\glossaryentryfield{msin}{\glsnamefont{MSIN}}{Mobile Subscriber Identification Number}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{10\delimN 11}}}%
\glossaryentryfield{msisdn}{\glsnamefont{MSISDN}}{Mobile Subscriber Integrated Services Digital Network Number}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{12}\delimN
- \setentrycounter{page}\glsnumberformat{14}}}%
+ \setentrycounter{page}\glsnumberformat{12\delimN 13}}}%
\glossaryentryfield{msrn}{\glsnamefont{MSRN}}{Mobile Station Roaming Number}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{14}}}%
+ \setentrycounter{page}\glsnumberformat{12}}}%
\glossaryentryfield{mtp2}{\glsnamefont{MTP 2/SS7}}{Message Transfer Part 2/SS7}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{28}}}%
+ \setentrycounter{page}\glsnumberformat{27}}}%
\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{51}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{53}}}\glsgroupskip
\glsgroupheading{N}\relax \glsresetentrylist %
\glossaryentryfield{ncc}{\glsnamefont{NCC}}{Network Color Code}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{42}}}%
@@ -256,8 +289,7 @@
\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{7\delimN 8}\delimN
\setentrycounter{page}\glsnumberformat{11\delimN 12}\delimN
- \setentrycounter{page}\glsnumberformat{20}\delimN
- \setentrycounter{page}\glsnumberformat{28}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{19}}}\glsgroupskip
\glsgroupheading{O}\relax \glsresetentrylist %
\glossaryentryfield{oms}{\glsnamefont{OMS}}{Operation and Maintainance Subsystem}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{8}}}%
@@ -265,72 +297,80 @@
\setentrycounter{page}\glsnumberformat{35}}}\glsgroupskip
\glsgroupheading{P}\relax \glsresetentrylist %
\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{20}\delimN
- \setentrycounter{page}\glsnumberformat{27}\delimN
- \setentrycounter{page}\glsnumberformat{49}\delimN
- \setentrycounter{page}\glsnumberformat{57\delimN 58}\delimN
- \setentrycounter{page}\glsnumberformat{63}}}%
+ \setentrycounter{page}\glsnumberformat{18}\delimN
+ \setentrycounter{page}\glsnumberformat{25\delimN 26}\delimN
+ \setentrycounter{page}\glsnumberformat{39}\delimN
+ \setentrycounter{page}\glsnumberformat{42\delimN 43}\delimN
+ \setentrycounter{page}\glsnumberformat{51}\delimN
+ \setentrycounter{page}\glsnumberformat{53}\delimN
+ \setentrycounter{page}\glsnumberformat{57}\delimN
+ \setentrycounter{page}\glsnumberformat{61\delimN 62}\delimN
+ \setentrycounter{page}\glsnumberformat{68}\delimN
+ \setentrycounter{page}\glsnumberformat{77}\delimN
+ \setentrycounter{page}\glsnumberformat{79\delimN 80}}}%
\glossaryentryfield{pin}{\glsnamefont{PIN}}{Personal Identification Number}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{10}}}%
\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{9}\delimN
- \setentrycounter{page}\glsnumberformat{11\delimN 12}}}%
+ \setentrycounter{page}\glsnumberformat{11}}}%
\glossaryentryfield{pstn}{\glsnamefont{PSTN}}{Public Standard Telephone Network}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{8}\delimN
+ \setentrycounter{page}\glsnumberformat{7}\delimN
\setentrycounter{page}\glsnumberformat{11\delimN 12}}}\glsgroupskip
\glsgroupheading{R}\relax \glsresetentrylist %
\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{24\delimN 25}\delimN
- \setentrycounter{page}\glsnumberformat{27}}}%
+ \setentrycounter{page}\glsnumberformat{23\delimN 24}\delimN
+ \setentrycounter{page}\glsnumberformat{26}}}%
\glossaryentryfield{rr}{\glsnamefont{RR}}{Radio Resource}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{28}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{27}}}\glsgroupskip
\glsgroupheading{S}\relax \glsresetentrylist %
\glossaryentryfield{sacch}{\glsnamefont{SACCH}}{Slow Access Control Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{26}}}%
+ \setentrycounter{page}\glsnumberformat{25}}}%
\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{22\delimN 23}\delimN
- \setentrycounter{page}\glsnumberformat{25\delimN 26}\delimN
+ \setentrycounter{page}\glsnumberformat{21}\delimN
+ \setentrycounter{page}\glsnumberformat{23}\delimN
+ \setentrycounter{page}\glsnumberformat{25}\delimN
\setentrycounter{page}\glsnumberformat{40}}}%
\glossaryentryfield{scp}{\glsnamefont{SCP}}{Service Control Point}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{8}}}%
\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{20}\delimN
- \setentrycounter{page}\glsnumberformat{26\delimN 27}}}%
+ \setentrycounter{page}\glsnumberformat{18\delimN 19}\delimN
+ \setentrycounter{page}\glsnumberformat{25\delimN 26}}}%
\glossaryentryfield{sf}{\glsnamefont{SF}}{Stealing Flag}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{24}}}%
+ \setentrycounter{page}\glsnumberformat{23}}}%
\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{9\delimN 10}\delimN
\setentrycounter{page}\glsnumberformat{14}\delimN
- \setentrycounter{page}\glsnumberformat{16}\delimN
- \setentrycounter{page}\glsnumberformat{20}\delimN
- \setentrycounter{page}\glsnumberformat{30\delimR 32}}}%
+ \setentrycounter{page}\glsnumberformat{19}\delimN
+ \setentrycounter{page}\glsnumberformat{28}\delimN
+ \setentrycounter{page}\glsnumberformat{30}\delimN
+ \setentrycounter{page}\glsnumberformat{32}}}%
\glossaryentryfield{sms}{\glsnamefont{SMS}}{Short Message Service}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{9}}}%
-\glossaryentryfield{smsc}{\glsnamefont{SMSC}}{Short Message Service Center}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{11}}}%
\glossaryentryfield{ss7}{\glsnamefont{SS-7}}{Signaling System 7}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{28}}}%
+ \setentrycounter{page}\glsnumberformat{26\delimN 27}}}%
\glossaryentryfield{stc}{\glsnamefont{STC}}{Sub Technical Committee}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{6}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{5}}}\glsgroupskip
\glsgroupheading{T}\relax \glsresetentrylist %
\glossaryentryfield{tacs}{\glsnamefont{TACS}}{Total Access Communication System}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{5}}}%
\glossaryentryfield{tc}{\glsnamefont{TC}}{Type Code}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{40}}}%
\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{20\delimN 21}\delimN
- \setentrycounter{page}\glsnumberformat{26}}}%
-\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{22\delimN 23}\delimN
+ \setentrycounter{page}\glsnumberformat{19\delimN 20}\delimN
\setentrycounter{page}\glsnumberformat{25}}}%
+\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }{\glossaryentrynumbers{\relax
+ \setentrycounter{page}\glsnumberformat{20\delimN 21}\delimN
+ \setentrycounter{page}\glsnumberformat{23\delimN 24}}}%
\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{14}\delimN
- \setentrycounter{page}\glsnumberformat{20}\delimN
- \setentrycounter{page}\glsnumberformat{27}\delimN
- \setentrycounter{page}\glsnumberformat{65}}}%
+ \setentrycounter{page}\glsnumberformat{13}\delimN
+ \setentrycounter{page}\glsnumberformat{18}\delimN
+ \setentrycounter{page}\glsnumberformat{25}\delimN
+ \setentrycounter{page}\glsnumberformat{43}\delimN
+ \setentrycounter{page}\glsnumberformat{68\delimN 69}\delimN
+ \setentrycounter{page}\glsnumberformat{79}}}%
\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{16}\delimN
- \setentrycounter{page}\glsnumberformat{65}}}%
+ \setentrycounter{page}\glsnumberformat{15}\delimN
+ \setentrycounter{page}\glsnumberformat{69}}}%
\glossaryentryfield{tta}{\glsnamefont{TTA}}{Telecommunications Technology Association}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{6}}}%
\glossaryentryfield{ttc}{\glsnamefont{TTC}}{Telecommunications Technology Committee}{\relax }{\glossaryentrynumbers{\relax
@@ -338,16 +378,16 @@
\glsgroupheading{U}\relax \glsresetentrylist %
\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{7}\delimN
- \setentrycounter{page}\glsnumberformat{16}}}%
+ \setentrycounter{page}\glsnumberformat{14\delimN 15}\delimN
+ \setentrycounter{page}\glsnumberformat{80}}}%
\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{64\delimN 65}}}\glsgroupskip
+ \setentrycounter{page}\glsnumberformat{69}}}\glsgroupskip
\glsgroupheading{V}\relax \glsresetentrylist %
\glossaryentryfield{vas}{\glsnamefont{VAS}}{value-added service}{\relax }{\glossaryentrynumbers{\relax
\setentrycounter{page}\glsnumberformat{8}}}%
\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{11}\delimN
- \setentrycounter{page}\glsnumberformat{14}\delimN
- \setentrycounter{page}\glsnumberformat{65}}}%
+ \setentrycounter{page}\glsnumberformat{11\delimR 13}\delimN
+ \setentrycounter{page}\glsnumberformat{69}}}%
\glossaryentryfield{voip}{\glsnamefont{VoIP}}{Voice over IP}{\relax }{\glossaryentrynumbers{\relax
- \setentrycounter{page}\glsnumberformat{65}}}%
+ \setentrycounter{page}\glsnumberformat{69}}}%
\end{theglossary}\glossarypostamble
diff --git a/Tex/Master/Master.alg b/Tex/Master/Master.alg
index d6565a4..c83fcee 100644
--- a/Tex/Master/Master.alg
+++ b/Tex/Master/Master.alg
@@ -1,7 +1,7 @@
This is makeindex, version 2.15 [TeX Live 2009] (kpathsea + Thai support).
Scanning style file ./Master.ist...........................done (27 attributes redefined, 0 ignored).
-Scanning input file Master.acn....done (617 entries accepted, 0 rejected).
-Sorting entries........done (6295 comparisons).
-Generating output file Master.acr....done (353 lines written, 0 warnings).
+Scanning input file Master.acn....done (703 entries accepted, 0 rejected).
+Sorting entries........done (7328 comparisons).
+Generating output file Master.acr....done (393 lines written, 0 warnings).
Output written in Master.acr.
Transcript written in Master.alg.
diff --git a/Tex/Master/Master.aux b/Tex/Master/Master.aux
index 5231165..0d204ab 100644
--- a/Tex/Master/Master.aux
+++ b/Tex/Master/Master.aux
@@ -154,7 +154,6 @@
\newlabel{sec:layers}{{2.3.3}{26}}
\@writefile{toc}{\contentsline {paragraph}{Physical Layer (Layer 1):}{26}}
\@writefile{toc}{\contentsline {paragraph}{Data Link (Layer 2):}{26}}
-\citation{protocols1999}
\citation{fox}
\citation{imsi_wiki}
\citation{fox}
@@ -223,8 +222,6 @@
\@writefile{lof}{\contentsline {figure}{\numberline {3.2}{\ignorespaces Interaction of the OsmocomBB components with the ICDS software.}}{39}}
\newlabel{fig:osmo_setup}{{3.2}{39}}
\@writefile{toc}{\contentsline {section}{\numberline {3.2}Procedure}{39}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{39}}
-\newlabel{sec:info_gathering}{{3.2.1}{39}}
\citation{GSM2009}
\citation{GSM2009}
\citation{protocols1999}
@@ -233,6 +230,8 @@
\citation{sysinfos}
\@writefile{lot}{\contentsline {table}{\numberline {3.2}{\ignorespaces Type Codes and the corresponding System Information Types \cite {GSM2009}.}}{40}}
\newlabel{tab:tc_mapping}{{3.2}{40}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{40}}
+\newlabel{sec:info_gathering}{{3.2.1}{40}}
\@writefile{lof}{\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 2 Message \cite {protocols1999}.}}{41}}
\newlabel{fig:si1}{{3.3}{41}}
\@writefile{lof}{\contentsline {figure}{\numberline {3.4}{\ignorespaces Procedure taken when the network has a call\tmspace +\thinmuskip {.1667em}/\tmspace +\thinmuskip {.1667em}text waiting for a passive subscriber.}}{43}}
@@ -264,30 +263,26 @@
\FN@pp@footnote@aux{13}{50}
\FN@pp@footnote@aux{14}{50}
\FN@pp@footnote@aux{15}{50}
-\@writefile{toc}{\contentsline {subsubsection}{Scan Rules}{50}}
+\@writefile{toc}{\contentsline {subsubsection}{Scan Rules}{51}}
\@writefile{toc}{\contentsline {subsubsection}{Remaining Issues and Paging}{51}}
\newlabel{sec:paging}{{3.2.2}{51}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Base Station Evaluation}{52}}
\newlabel{sec:evaluators}{{3.2.3}{52}}
-\@writefile{toc}{\contentsline {section}{\numberline {3.3}Implementation}{52}}
-\newlabel{sec:icds}{{3.3}{52}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Architecture}{52}}
\@writefile{lof}{\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{53}}
\newlabel{fig:architecture}{{3.7}{53}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{54}}
-\newlabel{fig:python_dict}{{3.8}{54}}
+\@writefile{toc}{\contentsline {section}{\numberline {3.3}Implementation}{53}}
+\newlabel{sec:icds}{{3.3}{53}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Architecture}{53}}
\FN@pp@footnote@aux{16}{54}
\FN@pp@footnote@aux{17}{54}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{54}}
\newlabel{sec:configuration}{{3.3.2}{54}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{55}}
+\newlabel{fig:python_dict}{{3.8}{55}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Graphical User Interface}{55}}
\newlabel{sec:icds_operation}{{3.3.3}{55}}
\@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{56}}
\newlabel{fig:icds}{{3.9}{56}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.4}Usage}{58}}
-\newlabel{sec:user_mode}{{3.3.4}{58}}
-\@writefile{toc}{\contentsline {paragraph}{Conducting sweep scans:}{58}}
-\@writefile{toc}{\contentsline {paragraph}{Using and obtaining Cell ID Information:}{58}}
\newlabel{fig:databases_window}{{3.10(a)}{59}}
\newlabel{sub@fig:databases_window}{{(a)}{59}}
\newlabel{fig:rules_window}{{3.10(b)}{59}}
@@ -302,73 +297,76 @@
\@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Filters window.}}}{59}}
\@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {PCH scan window.}}}{59}}
\newlabel{fig:dialogs}{{3.10}{59}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.4}Usage}{60}}
+\newlabel{sec:user_mode}{{3.3.4}{60}}
+\@writefile{toc}{\contentsline {paragraph}{Conducting sweep scans:}{60}}
+\@writefile{toc}{\contentsline {paragraph}{Using and obtaining CID Information:}{60}}
\@writefile{toc}{\contentsline {paragraph}{Building or using a Local Area Database:}{60}}
-\@writefile{toc}{\contentsline {paragraph}{Conducting a PCH Scan:}{60}}
\@writefile{lof}{\contentsline {figure}{\numberline {3.11}{\ignorespaces The User Mode window.}}{61}}
\newlabel{fig:user_mode}{{3.11}{61}}
-\@writefile{toc}{\contentsline {paragraph}{Utilising User Mode:}{61}}
+\@writefile{toc}{\contentsline {paragraph}{Conducting a PCH Scan:}{61}}
\citation{catcher_catcher}
+\@writefile{toc}{\contentsline {paragraph}{Utilising User Mode:}{62}}
\@writefile{toc}{\contentsline {section}{\numberline {3.4}Related Projects}{62}}
\FN@pp@footnote@aux{18}{62}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{63}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{65}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {4.1}Performance Evaluation}{63}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{63}}
-\newlabel{tab:key_data}{{4.1}{63}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{64}}
-\newlabel{fig:durations}{{4.1}{64}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{64}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in seconds for fetching the information.}}{65}}
-\newlabel{tab:coverage}{{4.2}{65}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{65}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Paging Messages and Immediate Assignments (per 10 seconds) for the four German providers at different locations.}}{66}}
-\newlabel{tab:pagings}{{4.3}{66}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{66}}
+\@writefile{toc}{\contentsline {section}{\numberline {4.1}Performance Evaluation}{65}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{65}}
+\newlabel{tab:key_data}{{4.1}{65}}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets. From left to right the datasets are: \texttt {house\_area}, \texttt {ind\_park}, \texttt {cbd}, \texttt {airport}}}{66}}
+\newlabel{fig:durations}{{4.1}{66}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{66}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in seconds for fetching the information.}}{67}}
+\newlabel{tab:coverage}{{4.2}{67}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{67}}
\citation{dennis}
-\@writefile{toc}{\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{67}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{67}}
-\FN@pp@footnote@aux{19}{67}
-\FN@pp@footnote@aux{20}{67}
-\FN@pp@footnote@aux{21}{67}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{68}}
-\newlabel{fig:setup}{{4.2}{68}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{68}}
-\newlabel{fig:openbts_parameters}{{4.3}{68}}
-\@writefile{toc}{\contentsline {subsubsection}{Modifications to the ICDS Configuration}{69}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Configuration and Context Rules Evaluation}{69}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{70}}
-\newlabel{tab:err_configs}{{4.4}{70}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces Configuration and Context Rule results for Config 1.}}{70}}
-\newlabel{tab:config_rules_eval}{{4.5}{70}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Scan Rules Evaluation}{71}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Database Rules Evaluation}{71}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Results obtained testing the \emph {rx} and \emph {LAC Change rules}.}}{72}}
-\newlabel{tab:par_change}{{4.6}{72}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.5}Realistic Scenarios}{72}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.7}{\ignorespaces Results of the database evaluation.}}{73}}
-\newlabel{tab:longterm_test}{{4.7}{73}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.8}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{73}}
-\newlabel{tab:consistent_parameters}{{4.8}{73}}
-\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher as a new Cell}{74}}
-\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{74}}
-\FN@pp@footnotehinttrue
-\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{75}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{68}}
+\@writefile{toc}{\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{68}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Paging Messages and Immediate Assignments (per 10\tmspace +\thinmuskip {.1667em}s) for the four German providers at different locations.}}{69}}
+\newlabel{tab:pagings}{{4.3}{69}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{69}}
+\FN@pp@footnote@aux{19}{69}
+\FN@pp@footnote@aux{20}{69}
+\FN@pp@footnote@aux{21}{69}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{70}}
+\newlabel{fig:setup}{{4.2}{70}}
+\@writefile{toc}{\contentsline {subsubsection}{Modifications to the ICDS Configuration}{70}}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{71}}
+\newlabel{fig:openbts_parameters}{{4.3}{71}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Configuration and Context Rules Evaluation}{71}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{72}}
+\newlabel{tab:err_configs}{{4.4}{72}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces Configuration and Context Rule results for Config 1.}}{72}}
+\newlabel{tab:config_rules_eval}{{4.5}{72}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Scan Rules Evaluation}{73}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Database Rules Evaluation}{73}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Results obtained testing the \emph {rx} and \emph {LAC Change rules}.}}{74}}
+\newlabel{tab:par_change}{{4.6}{74}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.5}Realistic Scenarios}{74}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.7}{\ignorespaces Results of the database evaluation.}}{75}}
+\newlabel{tab:longterm_test}{{4.7}{75}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.8}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{75}}
+\newlabel{tab:consistent_parameters}{{4.8}{75}}
+\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher as a new Cell}{76}}
+\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{76}}
+\FN@pp@footnotehinttrue
+\FN@pp@footnotehinttrue
+\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{77}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {5.1}Summary}{75}}
-\@writefile{lof}{\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{76}}
-\newlabel{fig:decision_process}{{5.1}{76}}
-\@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{77}}
-\@writefile{toc}{\contentsline {paragraph}{}{78}}
+\@writefile{toc}{\contentsline {section}{\numberline {5.1}Summary}{77}}
+\@writefile{lof}{\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{78}}
+\newlabel{fig:decision_process}{{5.1}{78}}
+\@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{79}}
+\@writefile{toc}{\contentsline {paragraph}{}{80}}
\FN@pp@footnotehinttrue
\bibstyle{acm}
-\citation{*}
\bibdata{../Content/Bibliography}
\bibcite{GSM23003}{1}
\bibcite{GSM0405}{2}
@@ -383,7 +381,7 @@
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{Bibliography}{79}}
+\@writefile{toc}{\contentsline {chapter}{Bibliography}{81}}
\bibcite{GSM2009}{10}
\bibcite{GSM0207}{11}
\bibcite{mueller}{12}
@@ -427,67 +425,67 @@
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {A}GSM}{87}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {A}GSM}{89}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {A.1}Interfaces}{87}}
-\newlabel{sec:interfaces}{{A.1}{87}}
-\@writefile{lot}{\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{87}}
-\@writefile{toc}{\contentsline {section}{\numberline {A.2}Channel Combinations}{88}}
-\newlabel{sec:combinations}{{A.2}{88}}
-\@writefile{lot}{\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{88}}
+\@writefile{toc}{\contentsline {section}{\numberline {A.1}Interfaces}{89}}
+\newlabel{sec:interfaces}{{A.1}{89}}
+\@writefile{lot}{\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{89}}
+\@writefile{toc}{\contentsline {section}{\numberline {A.2}Channel Combinations}{90}}
+\newlabel{sec:combinations}{{A.2}{90}}
+\@writefile{lot}{\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{90}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {B}OsmocomBB}{89}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {B}OsmocomBB}{91}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {B.1}Installation}{89}}
-\newlabel{sec:osmo_install}{{B.1}{89}}
-\@writefile{toc}{\contentsline {section}{\numberline {B.2}Usage}{90}}
-\newlabel{sec:osmo_usage}{{B.2}{90}}
-\@writefile{toc}{\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{91}}
-\newlabel{sec:osmo_serial_schematics}{{B.3}{91}}
-\FN@pp@footnote@aux{22}{91}
-\@writefile{lof}{\contentsline {figure}{\numberline {B.1}{\ignorespaces Serial cable schematics.}}{91}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.1}Installation}{91}}
+\newlabel{sec:osmo_install}{{B.1}{91}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.2}Usage}{92}}
+\newlabel{sec:osmo_usage}{{B.2}{92}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{93}}
+\newlabel{sec:osmo_serial_schematics}{{B.3}{93}}
+\FN@pp@footnote@aux{22}{93}
+\@writefile{lof}{\contentsline {figure}{\numberline {B.1}{\ignorespaces Serial cable schematics.}}{93}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{93}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{95}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {C.1}Extextions}{93}}
-\newlabel{sec:extensions}{{C.1}{93}}
-\@writefile{toc}{\contentsline {section}{\numberline {C.2}Example Configuration}{95}}
-\newlabel{sec:example_config}{{C.2}{95}}
+\@writefile{toc}{\contentsline {section}{\numberline {C.1}Extextions}{95}}
+\newlabel{sec:extensions}{{C.1}{95}}
+\@writefile{toc}{\contentsline {section}{\numberline {C.2}Example Configuration}{97}}
+\newlabel{sec:example_config}{{C.2}{97}}
\FN@pp@footnotehinttrue
\citation{protocols1999}
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {D}System Information}{99}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {D}System Information}{101}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\newlabel{sec:system_infos}{{D}{99}}
+\newlabel{sec:system_infos}{{D}{101}}
\FN@pp@footnotehinttrue
-\@writefile{lof}{\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{100}}
-\@writefile{lof}{\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{101}}
-\@writefile{lof}{\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{102}}
-\@writefile{lof}{\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{103}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{102}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{103}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{104}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{105}}
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {E}Evaluation Data}{105}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {E}Evaluation Data}{107}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{105}}
-\newlabel{sec:lac_change_test}{{E.1}{105}}
-\@writefile{lot}{\contentsline {table}{\numberline {E.1}{\ignorespaces Configurations used for the rx\tmspace +\thinmuskip {.1667em}/\tmspace +\thinmuskip {.1667em}LAC Change Rules test.}}{105}}
-\@writefile{toc}{\contentsline {section}{\numberline {E.2}Database Rules Test}{106}}
-\newlabel{sec:long_term_test}{{E.2}{106}}
-\@writefile{lot}{\contentsline {table}{\numberline {E.2}{\ignorespaces Configurations used for the Database Rules test.}}{106}}
+\@writefile{toc}{\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{107}}
+\newlabel{sec:lac_change_test}{{E.1}{107}}
+\@writefile{lot}{\contentsline {table}{\numberline {E.1}{\ignorespaces Configurations used for the rx\tmspace +\thinmuskip {.1667em}/\tmspace +\thinmuskip {.1667em}LAC Change Rules test.}}{107}}
+\@writefile{toc}{\contentsline {section}{\numberline {E.2}Database Rules Test}{108}}
+\newlabel{sec:long_term_test}{{E.2}{108}}
+\@writefile{lot}{\contentsline {table}{\numberline {E.2}{\ignorespaces Configurations used for the Database Rules test.}}{108}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{Acronyms}{107}}
+\@writefile{toc}{\contentsline {chapter}{Acronyms}{109}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\gdef \LT@i {\LT@entry
diff --git a/Tex/Master/Master.lof b/Tex/Master/Master.lof
index 97c492b..d394a08 100644
--- a/Tex/Master/Master.lof
+++ b/Tex/Master/Master.lof
@@ -24,7 +24,7 @@
\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Normal neighbourhood}}}{48}
\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Tainted neighbourhood}}}{48}
\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{53}
-\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{54}
+\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{55}
\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{56}
\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{59}
\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Databases window.}}}{59}
@@ -33,18 +33,18 @@
\contentsline {subfigure}{\numberline {(d)}{\ignorespaces {PCH scan window.}}}{59}
\contentsline {figure}{\numberline {3.11}{\ignorespaces The User Mode window.}}{61}
\addvspace {10\p@ }
-\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{64}
-\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{68}
-\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{68}
+\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets. From left to right the datasets are: \texttt {house\_area}, \texttt {ind\_park}, \texttt {cbd}, \texttt {airport}}}{66}
+\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{70}
+\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{71}
\addvspace {10\p@ }
-\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{76}
+\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{78}
\addvspace {10\p@ }
\addvspace {10\p@ }
-\contentsline {figure}{\numberline {B.1}{\ignorespaces Serial cable schematics.}}{91}
+\contentsline {figure}{\numberline {B.1}{\ignorespaces Serial cable schematics.}}{93}
\addvspace {10\p@ }
\addvspace {10\p@ }
-\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{100}
-\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{101}
-\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{102}
-\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{103}
+\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{102}
+\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{103}
+\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{104}
+\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{105}
\addvspace {10\p@ }
diff --git a/Tex/Master/Master.log b/Tex/Master/Master.log
index 987f4bd..b9a6fdf 100644
--- a/Tex/Master/Master.log
+++ b/Tex/Master/Master.log
@@ -1,40 +1,39 @@
-This is pdfTeX, Version 3.1415926-2.3-1.40.12 (MiKTeX 2.9 64-bit) (preloaded format=pdflatex 2012.1.30) 11 JUN 2012 01:35
+This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 11 JUN 2012 07:47
entering extended mode
+ %&-line parsing enabled.
**Master.tex
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\Master.tex
-LaTeX2e <2011/06/27>
-Babel <v3.8m> and hyphenation patterns for english, afrikaans, ancientgreek, ar
-abic, armenian, assamese, basque, bengali, bokmal, bulgarian, catalan, coptic,
-croatian, czech, danish, dutch, esperanto, estonian, farsi, finnish, french, ga
-lician, german, german-x-2009-06-19, greek, gujarati, hindi, hungarian, iceland
-ic, indonesian, interlingua, irish, italian, kannada, kurmanji, lao, latin, lat
-vian, lithuanian, malayalam, marathi, mongolian, mongolianlmc, monogreek, ngerm
-an, ngerman-x-2009-06-19, nynorsk, oriya, panjabi, pinyin, polish, portuguese,
-romanian, russian, sanskrit, serbian, slovak, slovenian, spanish, swedish, swis
-sgerman, tamil, telugu, turkish, turkmen, ukenglish, ukrainian, uppersorbian, u
-senglishmax, welsh, loaded.
-("C:\Program Files\MiKTeX 2.9\tex\latex\koma-script\scrbook.cls"
-Document Class: scrbook 2011/06/16 v3.09a KOMA-Script document class (book)
-("C:\Program Files\MiKTeX 2.9\tex\latex\koma-script\scrkbase.sty"
-Package: scrkbase 2011/06/16 v3.09a KOMA-Script package (KOMA-Script-dependent
+(./Master.tex
+LaTeX2e <2009/09/24>
+Babel <v3.8l> and hyphenation patterns for english, usenglishmax, dumylang, noh
+yphenation, farsi, arabic, croatian, bulgarian, ukrainian, russian, czech, slov
+ak, danish, dutch, finnish, french, basque, ngerman, german, german-x-2009-06-1
+9, ngerman-x-2009-06-19, ibycus, monogreek, greek, ancientgreek, hungarian, san
+skrit, italian, latin, latvian, lithuanian, mongolian2a, mongolian, bokmal, nyn
+orsk, romanian, irish, coptic, serbian, turkish, welsh, esperanto, uppersorbian
+, estonian, indonesian, interlingua, icelandic, kurmanji, slovenian, polish, po
+rtuguese, spanish, galician, catalan, swedish, ukenglish, pinyin, loaded.
+(/usr/share/texmf-texlive/tex/latex/koma-script/scrbook.cls
+Document Class: scrbook 2009/07/24 v3.04a KOMA-Script document class (book)
+(/usr/share/texmf-texlive/tex/latex/koma-script/scrkbase.sty
+Package: scrkbase 2009/07/24 v3.04a KOMA-Script package (KOMA-Script-dependent
basics and keyval usage)
-("C:\Program Files\MiKTeX 2.9\tex\latex\koma-script\scrbase.sty"
-Package: scrbase 2011/06/16 v3.09a KOMA-Script package (KOMA-Script-independent
+(/usr/share/texmf-texlive/tex/latex/koma-script/scrbase.sty
+Package: scrbase 2009/07/24 v3.04a KOMA-Script package (KOMA-Script-independent
basics and keyval usage)
-("C:\Program Files\MiKTeX 2.9\tex\latex\graphics\keyval.sty"
+(/usr/share/texmf-texlive/tex/latex/graphics/keyval.sty
Package: keyval 1999/03/16 v1.13 key=value parser (DPC)
\KV@toks@=\toks14
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\koma-script\scrlfile.sty"
-Package: scrlfile 2011/03/09 v3.09 KOMA-Script package (loading files)
+(/usr/share/texmf-texlive/tex/latex/koma-script/scrlfile.sty
+Package: scrlfile 2009/03/25 v3.03 KOMA-Script package (loading files)
-Package scrlfile, 2011/03/09 v3.09 KOMA-Script package (loading files)
+Package scrlfile, 2009/03/25 v3.03 KOMA-Script package (loading files)
Copyright (C) Markus Kohm
-))) ("C:\Program Files\MiKTeX 2.9\tex\latex\koma-script\tocbasic.sty"
-Package: tocbasic 2011/05/30 v3.09a KOMA-Script package (handling toc-files)
+))) (/usr/share/texmf-texlive/tex/latex/koma-script/tocbasic.sty
+Package: tocbasic 2009/06/08 v3.03b KOMA-Script package (handling toc-files)
)
Package tocbasic Info: omitting babel extension for `toc'
(tocbasic) because of feature `nobabel' available
@@ -57,15 +56,15 @@ lain'.
Class scrbook Info: Switching compatibility level to `first'.
Class scrbook Info: File `scrsize11pt.clo' used to setup font sizes on input li
-ne 1348.
-("C:\Program Files\MiKTeX 2.9\tex\latex\koma-script\scrsize11pt.clo"
-File: scrsize11pt.clo 2011/06/16 v3.09a KOMA-Script font size class option (11p
+ne 1272.
+(/usr/share/texmf-texlive/tex/latex/koma-script/scrsize11pt.clo
+File: scrsize11pt.clo 2009/07/24 v3.04a KOMA-Script font size class option (11p
t)
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\koma-script\typearea.sty"
-Package: typearea 2011/06/16 v3.09a KOMA-Script package (type area)
+(/usr/share/texmf-texlive/tex/latex/koma-script/typearea.sty
+Package: typearea 2009/07/24 v3.04a KOMA-Script package (type area)
-Package typearea, 2011/06/16 v3.09a KOMA-Script package (type area)
+Package typearea, 2009/07/24 v3.04a KOMA-Script package (type area)
Copyright (C) Frank Neukam, 1992-1994
Copyright (C) Markus Kohm, 1994-
@@ -73,7 +72,7 @@ Package typearea, 2011/06/16 v3.09a KOMA-Script package (type area)
\ta@div=\count79
Package typearea Info: You've used standard option `a4paper'.
(typearea) This is correct!
-(typearea) Internally I'm using `paper=a4'.
+(typearea) Internaly I'm using `paper=a4'.
(typearea) If you'd like to set the option with \KOMAoptions,
(typearea) you'd have to use `paper=a4' there
(typearea) instead of `a4paper', too.
@@ -96,7 +95,7 @@ Package typearea Info: These are the values describing the layout:
(typearea) \topskip = 11.0pt
(typearea) \footskip = 47.60002pt
(typearea) \baselineskip = 13.6pt
-(typearea) on input line 1139.
+(typearea) on input line 1115.
)
\c@part=\count80
\c@chapter=\count81
@@ -112,38 +111,40 @@ Package typearea Info: These are the values describing the layout:
\c@table=\count88
\bibindent=\dimen102
)
-Package scrkbase Info: You've told me to extend the font selection of the
-(scrkbase) element `sectioning' that is an alias of element
-(scrkbase) `disposition' on input line 11.
- (C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\titlepage.sty
+Class scrbook Info: You've told me to extend the font selection of the
+(scrbook) element `sectioning' that is an alias of element
+(scrbook) `disposition' on input line 11.
+ (./titlepage.sty
Package: titlepage 2011/06/07 v0.2 KOMA presents the title page project
+
+
+LaTeX Warning: You have requested, on input line 34, version
+ `2011/06/07' of package scrbase,
+ but only version
+ `2009/07/24 v3.04a KOMA-Script package (KOMA-Script-independent
+basics and keyval usage)'
+ is available.
+
\c@titlepage=\count89
\titlebox=\box27
-)
-("C:\Program Files\MiKTeX 2.9\tex\latex\eurosym\eurosym.sty"
+) (/usr/share/texmf-texlive/tex/latex/eurosym/eurosym.sty
Package: eurosym 1998/08/06 v1.1 European currency symbol ``Euro''
\@eurobox=\box28
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\appendix\appendix.sty"
+(/usr/share/texmf-texlive/tex/latex/appendix/appendix.sty
Package: appendix 2009/09/02 v1.2b extra appendix facilities
\c@@pps=\count90
\c@@ppsavesec=\count91
\c@@ppsaveapp=\count92
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\babel\babel.sty"
-Package: babel 2008/07/08 v3.8m The Babel package
+(/var/lib/texmf/tex/generic/babel/babel.sty
+Package: babel 2008/07/06 v3.8l The Babel package
-*************************************
-* Local config file bblopts.cfg used
-*
-("C:\Program Files\MiKTeX 2.9\tex\latex\00miktex\bblopts.cfg"
-File: bblopts.cfg 2006/07/31 v1.0 MiKTeX 'babel' configuration
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\babel\english.ldf"
+(/usr/share/texmf-texlive/tex/generic/babel/english.ldf
Language: english 2005/03/30 v3.3o English support from the babel system
-("C:\Program Files\MiKTeX 2.9\tex\generic\babel\babel.def"
-File: babel.def 2008/07/08 v3.8m Babel common definitions
+(/usr/share/texmf-texlive/tex/generic/babel/babel.def
+File: babel.def 2008/07/06 v3.8l Babel common definitions
\babel@savecnt=\count93
\U@D=\dimen103
)
@@ -151,18 +152,18 @@ File: babel.def 2008/07/08 v3.8m Babel common definitions
\l@australian = a dialect from \language\l@british
\l@newzealand = a dialect from \language\l@british
))
-("C:\Program Files\MiKTeX 2.9\tex\latex\base\inputenc.sty"
+(/usr/share/texmf-texlive/tex/latex/base/inputenc.sty
Package: inputenc 2008/03/30 v1.1d Input encoding file
\inpenc@prehook=\toks15
\inpenc@posthook=\toks16
-("C:\Program Files\MiKTeX 2.9\tex\latex\unicode\utf8x.def"
+(/usr/share/texmf-texlive/tex/latex/ucs/utf8x.def
File: utf8x.def 2004/10/17 UCS: Input encoding UTF-8
))
-("C:\Program Files\MiKTeX 2.9\tex\latex\unicode\ucs.sty"
+(/usr/share/texmf-texlive/tex/latex/ucs/ucs.sty
Package: ucs 2004/10/17 UCS: Unicode input support
-("C:\Program Files\MiKTeX 2.9\tex\latex\unicode\data\uni-global.def"
+(/usr/share/texmf-texlive/tex/latex/ucs/data/uni-global.def
File: uni-global.def 2004/10/17 UCS: Unicode global data
)
\uc@secondtry=\count94
@@ -170,29 +171,22 @@ File: uni-global.def 2004/10/17 UCS: Unicode global data
\uc@combtoksb=\toks18
\uc@temptokena=\toks19
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\xcolor\xcolor.sty"
+(/usr/share/texmf/tex/latex/xcolor/xcolor.sty
Package: xcolor 2007/01/21 v2.11 LaTeX color extensions (UK)
-("C:\Program Files\MiKTeX 2.9\tex\latex\00miktex\color.cfg"
+(/etc/texmf/tex/latex/config/color.cfg
File: color.cfg 2007/01/18 v1.5 color configuration of teTeX/TeXLive
)
Package xcolor Info: Driver file: pdftex.def on input line 225.
-("C:\Program Files\MiKTeX 2.9\tex\latex\pdftex-def\pdftex.def"
-File: pdftex.def 2011/05/27 v0.06d Graphics/color for pdfTeX
-
-("C:\Program Files\MiKTeX 2.9\tex\generic\oberdiek\infwarerr.sty"
-Package: infwarerr 2010/04/08 v1.3 Providing info/warning/message (HO)
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\oberdiek\ltxcmds.sty"
-Package: ltxcmds 2011/04/18 v1.20 LaTeX kernel commands for general use (HO)
-)
+(/usr/share/texmf-texlive/tex/latex/pdftex-def/pdftex.def
+File: pdftex.def 2010/03/12 v0.04p Graphics/color for pdfTeX
\Gread@gobject=\count95
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\colortbl\colortbl.sty"
+(/usr/share/texmf-texlive/tex/latex/colortbl/colortbl.sty
Package: colortbl 2001/02/13 v0.1j Color table columns (DPC)
-("C:\Program Files\MiKTeX 2.9\tex\latex\tools\array.sty"
+(/usr/share/texmf-texlive/tex/latex/tools/array.sty
Package: array 2008/09/09 v2.4c Tabular extension package (FMi)
\col@sep=\dimen104
\extrarowheight=\dimen105
@@ -214,10 +208,10 @@ Package xcolor Info: Model `HSB' substituted by `hsb' on input line 1358.
Package xcolor Info: Model `Gray' substituted by `gray' on input line 1359.
Package xcolor Info: Model `wave' substituted by `hsb' on input line 1360.
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\amsfonts\amssymb.sty"
+(/usr/share/texmf-texlive/tex/latex/amsfonts/amssymb.sty
Package: amssymb 2009/06/22 v3.00
-("C:\Program Files\MiKTeX 2.9\tex\latex\amsfonts\amsfonts.sty"
+(/usr/share/texmf-texlive/tex/latex/amsfonts/amsfonts.sty
Package: amsfonts 2009/06/22 v3.00 Basic AMSFonts support
\@emptytoks=\toks22
\symAMSa=\mathgroup4
@@ -225,24 +219,24 @@ Package: amsfonts 2009/06/22 v3.00 Basic AMSFonts support
LaTeX Font Info: Overwriting math alphabet `\mathfrak' in version `bold'
(Font) U/euf/m/n --> U/euf/b/n on input line 96.
))
-("C:\Program Files\MiKTeX 2.9\tex\latex\ams\math\amsmath.sty"
+(/usr/share/texmf-texlive/tex/latex/amsmath/amsmath.sty
Package: amsmath 2000/07/18 v2.13 AMS math features
\@mathmargin=\skip50
For additional information on amsmath, use the `?' option.
-("C:\Program Files\MiKTeX 2.9\tex\latex\ams\math\amstext.sty"
+(/usr/share/texmf-texlive/tex/latex/amsmath/amstext.sty
Package: amstext 2000/06/29 v2.01
-("C:\Program Files\MiKTeX 2.9\tex\latex\ams\math\amsgen.sty"
+(/usr/share/texmf-texlive/tex/latex/amsmath/amsgen.sty
File: amsgen.sty 1999/11/30 v2.0
\@emptytoks=\toks23
\ex@=\dimen106
))
-("C:\Program Files\MiKTeX 2.9\tex\latex\ams\math\amsbsy.sty"
+(/usr/share/texmf-texlive/tex/latex/amsmath/amsbsy.sty
Package: amsbsy 1999/11/29 v1.2d
\pmbraise@=\dimen107
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\ams\math\amsopn.sty"
+(/usr/share/texmf-texlive/tex/latex/amsmath/amsopn.sty
Package: amsopn 1999/12/14 v2.01 operator names
)
\inf@bad=\count97
@@ -283,71 +277,76 @@ LaTeX Font Info: Redeclaring font encoding OMS on input line 568.
LaTeX Info: Redefining \[ on input line 2666.
LaTeX Info: Redefining \] on input line 2667.
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\graphics\graphicx.sty"
+(/usr/share/texmf-texlive/tex/latex/graphics/graphicx.sty
Package: graphicx 1999/02/16 v1.0f Enhanced LaTeX Graphics (DPC,SPQR)
-("C:\Program Files\MiKTeX 2.9\tex\latex\graphics\graphics.sty"
+(/usr/share/texmf-texlive/tex/latex/graphics/graphics.sty
Package: graphics 2009/02/05 v1.0o Standard LaTeX Graphics (DPC,SPQR)
-("C:\Program Files\MiKTeX 2.9\tex\latex\graphics\trig.sty"
+(/usr/share/texmf-texlive/tex/latex/graphics/trig.sty
Package: trig 1999/03/16 v1.09 sin cos tan (DPC)
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\00miktex\graphics.cfg"
-File: graphics.cfg 2007/01/18 v1.5 graphics configuration of teTeX/TeXLive
+(/etc/texmf/tex/latex/config/graphics.cfg
+File: graphics.cfg 2009/08/28 v1.8 graphics configuration of TeX Live
)
Package graphics Info: Driver file: pdftex.def on input line 91.
)
\Gin@req@height=\dimen115
\Gin@req@width=\dimen116
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\oberdiek\epstopdf.sty"
-Package: epstopdf 2010/02/09 v2.5 Conversion with epstopdf on the fly (HO)
-
-("C:\Program Files\MiKTeX 2.9\tex\latex\oberdiek\epstopdf-base.sty"
-Package: epstopdf-base 2010/02/09 v2.5 Base part for package epstopdf
+(/usr/share/texmf-texlive/tex/latex/oberdiek/epstopdf.sty
+Package: epstopdf 2009/10/17 v2.4 Conversion with epstopdf on the fly (HO)
-("C:\Program Files\MiKTeX 2.9\tex\latex\oberdiek\grfext.sty"
-Package: grfext 2010/08/19 v1.1 Managing graphics extensions (HO)
+(/usr/share/texmf-texlive/tex/latex/oberdiek/epstopdf-base.sty
+Package: epstopdf-base 2009/10/17 v2.4 Base part for package epstopdf
-("C:\Program Files\MiKTeX 2.9\tex\generic\oberdiek\kvdefinekeys.sty"
-Package: kvdefinekeys 2011/04/07 v1.3 Defining keys (HO)
-))
-("C:\Program Files\MiKTeX 2.9\tex\latex\oberdiek\kvoptions.sty"
-Package: kvoptions 2010/12/23 v3.10 Keyval support for LaTeX options (HO)
-
-("C:\Program Files\MiKTeX 2.9\tex\generic\oberdiek\kvsetkeys.sty"
-Package: kvsetkeys 2011/04/07 v1.13 Key value parser (HO)
+(/usr/share/texmf-texlive/tex/generic/oberdiek/infwarerr.sty
+Package: infwarerr 2007/09/09 v1.2 Providing info/warning/message (HO)
+)
+(/usr/share/texmf-texlive/tex/latex/oberdiek/grfext.sty
+Package: grfext 2007/09/30 v1.0 Managing graphics extensions (HO)
+)
+(/usr/share/texmf-texlive/tex/latex/oberdiek/kvoptions.sty
+Package: kvoptions 2009/08/13 v3.4 Keyval support for LaTeX options (HO)
-("C:\Program Files\MiKTeX 2.9\tex\generic\oberdiek\etexcmds.sty"
-Package: etexcmds 2011/02/16 v1.5 Prefix for e-TeX command names (HO)
+(/usr/share/texmf-texlive/tex/generic/oberdiek/kvsetkeys.sty
+Package: kvsetkeys 2009/07/30 v1.5 Key value parser with default handler suppor
+t (HO)
-("C:\Program Files\MiKTeX 2.9\tex\generic\oberdiek\ifluatex.sty"
-Package: ifluatex 2010/03/01 v1.3 Provides the ifluatex switch (HO)
-Package ifluatex Info: LuaTeX not detected.
-)
+(/usr/share/texmf-texlive/tex/generic/oberdiek/etexcmds.sty
+Package: etexcmds 2007/12/12 v1.2 Prefix for e-TeX command names (HO)
Package etexcmds Info: Could not find \expanded.
(etexcmds) That can mean that you are not using pdfTeX 1.50 or
(etexcmds) that some package has redefined \expanded.
(etexcmds) In the latter case, load this package earlier.
)))
-("C:\Program Files\MiKTeX 2.9\tex\generic\oberdiek\pdftexcmds.sty"
-Package: pdftexcmds 2011/04/22 v0.16 Utilities of pdfTeX for LuaTeX (HO)
+(/usr/share/texmf-texlive/tex/generic/oberdiek/pdftexcmds.sty
+Package: pdftexcmds 2009/09/23 v0.6 LuaTeX support for pdfTeX utility functions
+ (HO)
-("C:\Program Files\MiKTeX 2.9\tex\generic\oberdiek\ifpdf.sty"
-Package: ifpdf 2011/01/30 v2.3 Provides the ifpdf switch (HO)
-Package ifpdf Info: pdfTeX in PDF mode is detected.
+(/usr/share/texmf-texlive/tex/generic/oberdiek/ifluatex.sty
+Package: ifluatex 2009/04/17 v1.2 Provides the ifluatex switch (HO)
+Package ifluatex Info: LuaTeX not detected.
+)
+(/usr/share/texmf-texlive/tex/generic/oberdiek/ltxcmds.sty
+Package: ltxcmds 2009/08/05 v1.0 Some LaTeX kernel commands for general use (HO
+)
)
Package pdftexcmds Info: LuaTeX not detected.
Package pdftexcmds Info: \pdf@primitive is available.
Package pdftexcmds Info: \pdf@ifprimitive is available.
-Package pdftexcmds Info: \pdfdraftmode found.
)
+
+Package epstopdf Warning: Shell escape feature is not enabled.
+
Package grfext Info: Graphics extension search list:
(grfext) [.png,.pdf,.jpg,.mps,.jpeg,.jbig2,.jb2,.PNG,.PDF,.JPG,.JPE
G,.JBIG2,.JB2,.eps]
-(grfext) \AppendGraphicsExtensions on input line 452.
-))
-("C:\Program Files\MiKTeX 2.9\tex\latex\listings\listings.sty"
+(grfext) \AppendGraphicsExtensions on input line 433.
+(/usr/share/texmf-texlive/tex/latex/latexconfig/epstopdf-sys.cfg
+File: epstopdf-sys.cfg 2009/10/26 v1.1 Configuration of epstopdf for TeX Live
+)))
+(/usr/share/texmf-texlive/tex/latex/listings/listings.sty
\lst@mode=\count109
\lst@gtempboxa=\box31
\lst@token=\toks28
@@ -361,39 +360,39 @@ G,.JBIG2,.JB2,.eps]
\lst@lineno=\count114
\lst@maxwidth=\dimen120
-("C:\Program Files\MiKTeX 2.9\tex\latex\listings\lstmisc.sty"
+(/usr/share/texmf-texlive/tex/latex/listings/lstmisc.sty
File: lstmisc.sty 2007/02/22 1.4 (Carsten Heinz)
\c@lstnumber=\count115
\lst@skipnumbers=\count116
\lst@framebox=\box32
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\listings\listings.cfg"
+(/usr/share/texmf-texlive/tex/latex/listings/listings.cfg
File: listings.cfg 2007/02/22 1.4 listings configuration
))
Package: listings 2007/02/22 1.4 (Carsten Heinz)
-("C:\Program Files\MiKTeX 2.9\tex\latex\psnfss\times.sty"
+(/usr/share/texmf-texlive/tex/latex/psnfss/times.sty
Package: times 2005/04/12 PSNFSS-v9.2a (SPQR)
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\psnfss\helvet.sty"
+(/usr/share/texmf-texlive/tex/latex/psnfss/helvet.sty
Package: helvet 2005/04/12 PSNFSS-v9.2a (WaS)
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\psnfss\courier.sty"
+(/usr/share/texmf-texlive/tex/latex/psnfss/courier.sty
Package: courier 2005/04/12 PSNFSS-v9.2a (WaS)
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\esvect\esvect.sty"
+(/usr/share/texmf-texlive/tex/latex/esvect/esvect.sty
Package: esvect
\symesvector=\mathgroup6
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\base\fontenc.sty"
+(/usr/share/texmf-texlive/tex/latex/base/fontenc.sty
Package: fontenc 2005/09/27 v1.99g Standard LaTeX package
-("C:\Program Files\MiKTeX 2.9\tex\latex\base\t1enc.def"
+(/usr/share/texmf-texlive/tex/latex/base/t1enc.def
File: t1enc.def 2005/09/27 v1.99g Standard LaTeX file
LaTeX Font Info: Redeclaring font encoding T1 on input line 43.
))
-("C:\Program Files\MiKTeX 2.9\tex\latex\footmisc\footmisc.sty"
-Package: footmisc 2011/06/06 v5.5b a miscellany of footnote facilities
+(/usr/share/texmf-texlive/tex/latex/footmisc/footmisc.sty
+Package: footmisc 2009/09/15 v5.5a a miscellany of footnote facilities
\FN@temptoken=\toks29
\footnotemargin=\dimen121
\c@pp@next@reset=\count117
@@ -407,106 +406,90 @@ Package footmisc Info: Declaring symbol style lamport* on input line 903.
Package footmisc Info: Declaring symbol style lamport*-robust on input line 924
.
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\listing\listing.sty"
+(/usr/share/texmf-texlive/tex/latex/ltxmisc/listing.sty
Package: listing 1999/05/25
Package `listing', V1.2, <1999/05/25>
\c@listing=\count119
-) (C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\multido.sty
+) (./multido.sty
Package: multido 2004/05/17 package wrapper for PSTricks `multido.tex', (HV/RN)
-
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\multido.tex
- v1.41, 2004/05/18 <tvz>
+ (./multido.tex v1.41, 2004/05/18 <tvz>
\multido@count=\count120
\multidocount=\count121
\multido@stuff=\toks30
)
File: multido.tex 2004/05/18 v1.41 `multido' (tvz)
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\glossaries\base\glossaries.sty"
-Package: glossaries 2011/04/12 v3.01 (NLCT)
+(/usr/share/texmf-texlive/tex/latex/glossaries/base/glossaries.sty
+Package: glossaries 2009/09/23 v2.03 (NLCT)
-("C:\Program Files\MiKTeX 2.9\tex\latex\base\ifthen.sty"
+(/usr/share/texmf-texlive/tex/latex/base/ifthen.sty
Package: ifthen 2001/05/26 v1.1c Standard LaTeX ifthen package (DPC)
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\xkeyval\xkeyval.sty"
+(/usr/share/texmf-texlive/tex/latex/xkeyval/xkeyval.sty
Package: xkeyval 2008/08/13 v2.6a package option processing (HA)
-("C:\Program Files\MiKTeX 2.9\tex\generic\xkeyval\xkeyval.tex"
+(/usr/share/texmf-texlive/tex/generic/xkeyval/xkeyval.tex
\XKV@toks=\toks31
\XKV@tempa@toks=\toks32
\XKV@depth=\count122
File: xkeyval.tex 2008/08/13 v2.6a key=value parser (HA)
))
-("C:\Program Files\MiKTeX 2.9\tex\latex\glossaries\base\mfirstuc.sty"
-Package: mfirstuc 2011/04/02 v1.05 (NLCT)
-\@glsmfirst=\toks33
-\@glsmrest=\toks34
+(/usr/share/texmf-texlive/tex/latex/glossaries/base/mfirstuc.sty
+Package: mfirstuc 2008/12/22 v1.03 (NLCT)
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\xfor\xfor.sty"
+(/usr/share/texmf-texlive/tex/latex/xfor/xfor.sty
Package: xfor 2009/02/05 v1.05 (NLCT)
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\etoolbox\etoolbox.sty"
-Package: etoolbox 2011/01/03 v2.1 e-TeX tools for LaTeX
-
-("C:\Program Files\MiKTeX 2.9\tex\latex\misc\etex.sty"
-Package: etex 1998/03/26 v2.0 eTeX basic definition package (PEB)
-\et@xins=\count123
-)
-\etb@tempcnta=\count124
-)
-("C:\Program Files\MiKTeX 2.9\tex\latex\beamer\base\translator\translator.sty"
+(/usr/share/texmf/tex/latex/beamer/base/translator/translator.sty
Package: translator 2010/06/12 ver 1.10
-("C:\Program Files\MiKTeX 2.9\tex\latex\beamer\base\translator\translator-langu
-age-mappings.tex"))
-\gls@level=\count125
-\@gls@tmpb=\toks35
+(/usr/share/texmf/tex/latex/beamer/base/translator/translator-language-mappings
+.tex))
+\gls@level=\count123
+\@gls@tmpb=\toks33
\gls@tmplen=\skip53
-\glswrite=\write3
-\glskeylisttok=\toks36
-\glslabeltok=\toks37
-\glsshorttok=\toks38
-\glslongtok=\toks39
-
-("C:\Program Files\MiKTeX 2.9\tex\latex\glossaries\styles\glossary-hypernav.sty
-"
+\istfile=\write3
+
+(/usr/share/texmf-texlive/tex/latex/glossaries/styles/glossary-hypernav.sty
Package: glossary-hypernav 2007/07/04 v1.01 (NLCT)
-) ("C:\Program Files\MiKTeX 2.9\tex\latex\glossaries\styles\glossary-list.sty"
-Package: glossary-list 2011/03/28 v3.0 (NLCT)
+)
+(/usr/share/texmf-texlive/tex/latex/glossaries/styles/glossary-list.sty
+Package: glossary-list 2009/05/30 v2.01 (NLCT)
\glslistdottedwidth=\skip54
-) ("C:\Program Files\MiKTeX 2.9\tex\latex\glossaries\styles\glossary-long.sty"
-Package: glossary-long 2011/03/28 v3.0 (NLCT)
+)
+(/usr/share/texmf-texlive/tex/latex/glossaries/styles/glossary-long.sty
+Package: glossary-long 2009/05/30 v2.01 (NLCT)
-("C:\Program Files\MiKTeX 2.9\tex\latex\tools\longtable.sty"
+(/usr/share/texmf-texlive/tex/latex/tools/longtable.sty
Package: longtable 2004/02/01 v4.11 Multi-page Table package (DPC)
\LTleft=\skip55
\LTright=\skip56
\LTpre=\skip57
\LTpost=\skip58
-\LTchunksize=\count126
+\LTchunksize=\count124
\LTcapwidth=\dimen122
\LT@head=\box33
\LT@firsthead=\box34
\LT@foot=\box35
\LT@lastfoot=\box36
-\LT@cols=\count127
-\LT@rows=\count128
-\c@LT@tables=\count129
-\c@LT@chunks=\count130
-\LT@p@ftn=\toks40
+\LT@cols=\count125
+\LT@rows=\count126
+\c@LT@tables=\count127
+\c@LT@chunks=\count128
+\LT@p@ftn=\toks34
)
Class scrbook Info: longtable captions redefined on input line 43.
\glsdescwidth=\skip59
\glspagelistwidth=\skip60
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\glossaries\styles\glossary-super.sty"
-Package: glossary-super 2011/03/28 v3.0 (NLCT)
+(/usr/share/texmf-texlive/tex/latex/glossaries/styles/glossary-super.sty
+Package: glossary-super 2009/05/30 v2.01 (NLCT)
-("C:\Program Files\MiKTeX 2.9\tex\latex\supertabular\supertabular.sty"
+(/usr/share/texmf-texlive/tex/latex/supertabular/supertabular.sty
Package: supertabular 2004/02/20 v4.1e the supertabular environment
-\c@tracingst=\count131
+\c@tracingst=\count129
\ST@wd=\dimen123
\ST@rightskip=\skip61
\ST@leftskip=\skip62
@@ -523,534 +506,448 @@ Package: supertabular 2004/02/20 v4.1e the supertabular environment
\ST@dimen=\dimen133
\ST@pbox=\box37
))
-("C:\Program Files\MiKTeX 2.9\tex\latex\glossaries\styles\glossary-tree.sty"
-Package: glossary-tree 2011/03/28 v3.0 (NLCT)
+(/usr/share/texmf-texlive/tex/latex/glossaries/styles/glossary-tree.sty
+Package: glossary-tree 2009/01/14 v1.01 (NLCT)
\glstreeindent=\skip64
))
-("C:\Program Files\MiKTeX 2.9\tex\latex\pstricks\pstricks.sty"
-Package: pstricks 2011/10/31 v0.52 LaTeX wrapper for `PSTricks' (RN,HV)
-
-("C:\Program Files\MiKTeX 2.9\tex\generic\pstricks\base\pstricks.tex"
-("C:\Program Files\MiKTeX 2.9\tex\generic\xkeyval\pst-xkey.tex"
-File: pst-xkey.tex 2005/11/25 v1.6 PSTricks specialization of xkeyval (HA)
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pstricks\base\pst-fp.tex"
-`pst-fp' v0.05, 2010/01/17 (hv)
-\pstFP@xs=\count132
-\pstFP@xia=\count133
-\pstFP@xib=\count134
-\pstFP@xfa=\count135
-\pstFP@xfb=\count136
-\pstFP@rega=\count137
-\pstFP@regb=\count138
-\pstFP@regs=\count139
-\pstFP@times=\count140
-)
-\psLoopIndex=\count141
-
-`PSTricks' v2.23 <2011/09/04> (tvz)
+(/usr/share/texmf-texlive/tex/latex/pstricks/pstricks.sty
+Package: pstricks 2008/11/26 v0.40 LaTeX wrapper for `PSTricks' (RN,HV)
+
+(/usr/share/texmf-texlive/tex/generic/pstricks/pstricks.tex
+`PSTricks' v1.29 <2009/05/19> (tvz)
\pst@dima=\dimen134
\pst@dimb=\dimen135
\pst@dimc=\dimen136
\pst@dimd=\dimen137
\pst@dimg=\dimen138
\pst@dimh=\dimen139
-\pst@dimm=\dimen140
-\pst@dimn=\dimen141
-\pst@dimo=\dimen142
-\pst@dimp=\dimen143
\pst@hbox=\box38
-\pst@ibox=\box39
-\pst@boxg=\box40
-\pst@cnta=\count142
-\pst@cntb=\count143
-\pst@cntc=\count144
-\pst@cntd=\count145
-\pst@cntg=\count146
-\pst@cnth=\count147
-\pst@cntm=\count148
-\pst@cntn=\count149
-\pst@cnto=\count150
-\pst@cntp=\count151
-\@zero=\count152
-\pst@toks=\toks41
-("C:\Program Files\MiKTeX 2.9\tex\generic\pstricks\base\pstricks.con")
-\psunit=\dimen144
-\psxunit=\dimen145
-\psyunit=\dimen146
-\pst@C@@rType=\count153
-\pslinewidth=\dimen147
-\psk@startLW=\dimen148
-\psk@endLW=\dimen149
-\pst@customdefs=\toks42
-\pslinearc=\dimen150
-\pst@symbolStep=\dimen151
-\pst@symbolWidth=\dimen152
-\everypsbox=\toks43
-\psframesep=\dimen153
-\pslabelsep=\dimen154
-\pst@shift=\dimen155
-\theoverlaybox=\box41
-)
-File: pstricks.tex 2011/09/04 v2.23 `PSTricks' (tvz,hv)
-
-("C:\Program Files\MiKTeX 2.9\tex\generic\pstricks\base\pst-fp.tex")
-File: pst-fp.tex 2011/09/04 v2.23 `PST-fp' (hv)
-)
-("C:\Program Files\MiKTeX 2.9\tex\latex\lipsum\lipsum.sty"
-Package: lipsum 2011/04/14 v1.2 150 paragraphs of Lorem Ipsum dummy text
-\c@lips@count=\count154
-)
-("C:\Program Files\MiKTeX 2.9\tex\latex\pgf\frontendlayer\tikz.sty"
-("C:\Program Files\MiKTeX 2.9\tex\latex\pgf\basiclayer\pgf.sty"
-("C:\Program Files\MiKTeX 2.9\tex\latex\pgf\utilities\pgfrcs.sty"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\utilities\pgfutil-common.tex"
-\pgfutil@everybye=\toks44
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\utilities\pgfutil-latex.def"
-\pgfutil@abb=\box42
-
-("C:\Program Files\MiKTeX 2.9\tex\latex\ms\everyshi.sty"
+\pst@boxg=\box39
+\pst@cnta=\count130
+\pst@cntb=\count131
+\pst@cntc=\count132
+\pst@cntd=\count133
+\pst@cntg=\count134
+\pst@cnth=\count135
+\pst@toks=\toks35
+(/usr/share/texmf-texlive/tex/generic/pstricks/pstricks.con)
+\psunit=\dimen140
+\psxunit=\dimen141
+\psyunit=\dimen142
+\pslinewidth=\dimen143
+\pst@customdefs=\toks36
+\pslinearc=\dimen144
+\everypsbox=\toks37
+\psframesep=\dimen145
+\pslabelsep=\dimen146
+\pst@shift=\dimen147
+\theoverlaybox=\box40
+)
+File: pstricks.tex 2009/05/19 v1.29 `PSTricks' (tvz,hv)
+)
+(/usr/share/texmf-texlive/tex/latex/lipsum/lipsum.sty
+Package: lipsum 2005/01/26 v1.0 150 paragraphs of Lorem Ipsum dummy text
+File: lipsum.dtx 2005/01/26 v1.0 150 paragraphs of Lorem Ipsum dummy text
+\c@lips@count=\count136
+)
+(/usr/share/texmf/tex/latex/pgf/frontendlayer/tikz.sty
+(/usr/share/texmf/tex/latex/pgf/basiclayer/pgf.sty
+(/usr/share/texmf/tex/latex/pgf/utilities/pgfrcs.sty
+(/usr/share/texmf/tex/generic/pgf/utilities/pgfutil-common.tex
+\pgfutil@everybye=\toks38
+)
+(/usr/share/texmf/tex/generic/pgf/utilities/pgfutil-latex.def
+\pgfutil@abb=\box41
+
+(/usr/share/texmf-texlive/tex/latex/ms/everyshi.sty
Package: everyshi 2001/05/15 v3.00 EveryShipout Package (MS)
))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\utilities\pgfrcs.code.tex"
+(/usr/share/texmf/tex/generic/pgf/utilities/pgfrcs.code.tex
Package: pgfrcs 2010/10/25 v2.10 (rcs-revision 1.24)
))
Package: pgf 2008/01/15 v2.10 (rcs-revision 1.12)
-("C:\Program Files\MiKTeX 2.9\tex\latex\pgf\basiclayer\pgfcore.sty"
-("C:\Program Files\MiKTeX 2.9\tex\latex\pgf\systemlayer\pgfsys.sty"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\systemlayer\pgfsys.code.tex"
+(/usr/share/texmf/tex/latex/pgf/basiclayer/pgfcore.sty
+(/usr/share/texmf/tex/latex/pgf/systemlayer/pgfsys.sty
+(/usr/share/texmf/tex/generic/pgf/systemlayer/pgfsys.code.tex
Package: pgfsys 2010/06/30 v2.10 (rcs-revision 1.37)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\utilities\pgfkeys.code.tex"
-\pgfkeys@pathtoks=\toks45
-\pgfkeys@temptoks=\toks46
+(/usr/share/texmf/tex/generic/pgf/utilities/pgfkeys.code.tex
+\pgfkeys@pathtoks=\toks39
+\pgfkeys@temptoks=\toks40
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\utilities\pgfkeysfiltered.code.te
-x"
-\pgfkeys@tmptoks=\toks47
+(/usr/share/texmf/tex/generic/pgf/utilities/pgfkeysfiltered.code.tex
+\pgfkeys@tmptoks=\toks41
))
-\pgf@x=\dimen156
-\pgf@y=\dimen157
-\pgf@xa=\dimen158
-\pgf@ya=\dimen159
-\pgf@xb=\dimen160
-\pgf@yb=\dimen161
-\pgf@xc=\dimen162
-\pgf@yc=\dimen163
+\pgf@x=\dimen148
+\pgf@y=\dimen149
+\pgf@xa=\dimen150
+\pgf@ya=\dimen151
+\pgf@xb=\dimen152
+\pgf@yb=\dimen153
+\pgf@xc=\dimen154
+\pgf@yc=\dimen155
\w@pgf@writea=\write4
\r@pgf@reada=\read1
-\c@pgf@counta=\count155
-\c@pgf@countb=\count156
-\c@pgf@countc=\count157
-\c@pgf@countd=\count158
- ("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\systemlayer\pgf.cfg"
+\c@pgf@counta=\count137
+\c@pgf@countb=\count138
+\c@pgf@countc=\count139
+\c@pgf@countd=\count140
+
+(/usr/share/texmf/tex/generic/pgf/systemlayer/pgf.cfg
File: pgf.cfg 2008/05/14 (rcs-revision 1.7)
)
Package pgfsys Info: Driver file for pgf: pgfsys-pdftex.def on input line 900.
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\systemlayer\pgfsys-pdftex.def"
+(/usr/share/texmf/tex/generic/pgf/systemlayer/pgfsys-pdftex.def
File: pgfsys-pdftex.def 2009/05/22 (rcs-revision 1.26)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\systemlayer\pgfsys-common-pdf.def
-"
+(/usr/share/texmf/tex/generic/pgf/systemlayer/pgfsys-common-pdf.def
File: pgfsys-common-pdf.def 2008/05/19 (rcs-revision 1.10)
)))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\systemlayer\pgfsyssoftpath.code.t
-ex"
+(/usr/share/texmf/tex/generic/pgf/systemlayer/pgfsyssoftpath.code.tex
File: pgfsyssoftpath.code.tex 2008/07/18 (rcs-revision 1.7)
-\pgfsyssoftpath@smallbuffer@items=\count159
-\pgfsyssoftpath@bigbuffer@items=\count160
+\pgfsyssoftpath@smallbuffer@items=\count141
+\pgfsyssoftpath@bigbuffer@items=\count142
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\systemlayer\pgfsysprotocol.code.t
-ex"
+(/usr/share/texmf/tex/generic/pgf/systemlayer/pgfsysprotocol.code.tex
File: pgfsysprotocol.code.tex 2006/10/16 (rcs-revision 1.4)
-)) ("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcore.code.tex"
+))
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcore.code.tex
Package: pgfcore 2010/04/11 v2.10 (rcs-revision 1.7)
- ("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmath.code.tex"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathcalc.code.tex"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathutil.code.tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathparser.code.tex"
-\pgfmath@dimen=\dimen164
-\pgfmath@count=\count161
-\pgfmath@box=\box43
-\pgfmath@toks=\toks48
-\pgfmath@stack@operand=\toks49
-\pgfmath@stack@operation=\toks50
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathfunctions.code.tex"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathfunctions.basic.code.
-tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathfunctions.trigonometr
-ic.code.tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathfunctions.random.code
-.tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathfunctions.comparison.
-code.tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathfunctions.base.code.t
-ex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathfunctions.round.code.
-tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathfunctions.misc.code.t
-ex"))) ("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\math\pgfmathfloat.code.tex
-"
-\c@pgfmathroundto@lastzeros=\count162
+
+(/usr/share/texmf/tex/generic/pgf/math/pgfmath.code.tex
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathcalc.code.tex
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathutil.code.tex)
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathparser.code.tex
+\pgfmath@dimen=\dimen156
+\pgfmath@count=\count143
+\pgfmath@box=\box42
+\pgfmath@toks=\toks42
+\pgfmath@stack@operand=\toks43
+\pgfmath@stack@operation=\toks44
+)
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathfunctions.code.tex
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathfunctions.basic.code.tex)
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathfunctions.trigonometric.code.tex)
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathfunctions.random.code.tex)
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathfunctions.comparison.code.tex)
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathfunctions.base.code.tex)
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathfunctions.round.code.tex)
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathfunctions.misc.code.tex)))
+(/usr/share/texmf/tex/generic/pgf/math/pgfmathfloat.code.tex
+\c@pgfmathroundto@lastzeros=\count144
))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcorepoints.code.tex
-"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcorepoints.code.tex
File: pgfcorepoints.code.tex 2010/04/09 (rcs-revision 1.20)
-\pgf@picminx=\dimen165
-\pgf@picmaxx=\dimen166
-\pgf@picminy=\dimen167
-\pgf@picmaxy=\dimen168
-\pgf@pathminx=\dimen169
-\pgf@pathmaxx=\dimen170
-\pgf@pathminy=\dimen171
-\pgf@pathmaxy=\dimen172
-\pgf@xx=\dimen173
-\pgf@xy=\dimen174
-\pgf@yx=\dimen175
-\pgf@yy=\dimen176
-\pgf@zx=\dimen177
-\pgf@zy=\dimen178
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcorepathconstruct.c
-ode.tex"
+\pgf@picminx=\dimen157
+\pgf@picmaxx=\dimen158
+\pgf@picminy=\dimen159
+\pgf@picmaxy=\dimen160
+\pgf@pathminx=\dimen161
+\pgf@pathmaxx=\dimen162
+\pgf@pathminy=\dimen163
+\pgf@pathmaxy=\dimen164
+\pgf@xx=\dimen165
+\pgf@xy=\dimen166
+\pgf@yx=\dimen167
+\pgf@yy=\dimen168
+\pgf@zx=\dimen169
+\pgf@zy=\dimen170
+)
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcorepathconstruct.code.tex
File: pgfcorepathconstruct.code.tex 2010/08/03 (rcs-revision 1.24)
-\pgf@path@lastx=\dimen179
-\pgf@path@lasty=\dimen180
+\pgf@path@lastx=\dimen171
+\pgf@path@lasty=\dimen172
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcorepathusage.code.
-tex"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcorepathusage.code.tex
File: pgfcorepathusage.code.tex 2008/04/22 (rcs-revision 1.12)
-\pgf@shorten@end@additional=\dimen181
-\pgf@shorten@start@additional=\dimen182
+\pgf@shorten@end@additional=\dimen173
+\pgf@shorten@start@additional=\dimen174
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcorescopes.code.tex
-"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcorescopes.code.tex
File: pgfcorescopes.code.tex 2010/09/08 (rcs-revision 1.34)
-\pgfpic=\box44
-\pgf@hbox=\box45
-\pgf@layerbox@main=\box46
-\pgf@picture@serial@count=\count163
+\pgfpic=\box43
+\pgf@hbox=\box44
+\pgf@layerbox@main=\box45
+\pgf@picture@serial@count=\count145
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcoregraphicstate.co
-de.tex"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcoregraphicstate.code.tex
File: pgfcoregraphicstate.code.tex 2008/04/22 (rcs-revision 1.9)
-\pgflinewidth=\dimen183
+\pgflinewidth=\dimen175
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcoretransformations
-.code.tex"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcoretransformations.code.tex
File: pgfcoretransformations.code.tex 2009/06/10 (rcs-revision 1.11)
-\pgf@pt@x=\dimen184
-\pgf@pt@y=\dimen185
-\pgf@pt@temp=\dimen186
+\pgf@pt@x=\dimen176
+\pgf@pt@y=\dimen177
+\pgf@pt@temp=\dimen178
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcorequick.code.tex"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcorequick.code.tex
File: pgfcorequick.code.tex 2008/10/09 (rcs-revision 1.3)
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcoreobjects.code.te
-x"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcoreobjects.code.tex
File: pgfcoreobjects.code.tex 2006/10/11 (rcs-revision 1.2)
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcorepathprocessing.
-code.tex"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcorepathprocessing.code.tex
File: pgfcorepathprocessing.code.tex 2008/10/09 (rcs-revision 1.8)
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcorearrows.code.tex
-"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcorearrows.code.tex
File: pgfcorearrows.code.tex 2008/04/23 (rcs-revision 1.11)
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcoreshade.code.tex"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcoreshade.code.tex
File: pgfcoreshade.code.tex 2008/11/23 (rcs-revision 1.13)
-\pgf@max=\dimen187
-\pgf@sys@shading@range@num=\count164
-) ("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcoreimage.code.te
-x"
+\pgf@max=\dimen179
+\pgf@sys@shading@range@num=\count146
+)
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcoreimage.code.tex
File: pgfcoreimage.code.tex 2010/03/25 (rcs-revision 1.16)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcoreexternal.code.t
-ex"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcoreexternal.code.tex
File: pgfcoreexternal.code.tex 2010/09/01 (rcs-revision 1.17)
-\pgfexternal@startupbox=\box47
+\pgfexternal@startupbox=\box46
))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcorelayers.code.tex
-"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcorelayers.code.tex
File: pgfcorelayers.code.tex 2010/08/27 (rcs-revision 1.2)
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcoretransparency.co
-de.tex"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcoretransparency.code.tex
File: pgfcoretransparency.code.tex 2008/01/17 (rcs-revision 1.2)
)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\basiclayer\pgfcorepatterns.code.t
-ex"
+(/usr/share/texmf/tex/generic/pgf/basiclayer/pgfcorepatterns.code.tex
File: pgfcorepatterns.code.tex 2009/07/02 (rcs-revision 1.3)
)))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\modules\pgfmoduleshapes.code.tex"
+(/usr/share/texmf/tex/generic/pgf/modules/pgfmoduleshapes.code.tex
File: pgfmoduleshapes.code.tex 2010/09/09 (rcs-revision 1.13)
-\pgfnodeparttextbox=\box48
-) ("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\modules\pgfmoduleplot.code.tex"
+\pgfnodeparttextbox=\box47
+)
+(/usr/share/texmf/tex/generic/pgf/modules/pgfmoduleplot.code.tex
File: pgfmoduleplot.code.tex 2010/10/22 (rcs-revision 1.8)
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\pgf\compatibility\pgfcomp-version-0-65.
-sty"
+(/usr/share/texmf/tex/latex/pgf/compatibility/pgfcomp-version-0-65.sty
Package: pgfcomp-version-0-65 2007/07/03 v2.10 (rcs-revision 1.7)
-\pgf@nodesepstart=\dimen188
-\pgf@nodesepend=\dimen189
+\pgf@nodesepstart=\dimen180
+\pgf@nodesepend=\dimen181
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\pgf\compatibility\pgfcomp-version-1-18.
-sty"
+(/usr/share/texmf/tex/latex/pgf/compatibility/pgfcomp-version-1-18.sty
Package: pgfcomp-version-1-18 2007/07/23 v2.10 (rcs-revision 1.1)
-)) ("C:\Program Files\MiKTeX 2.9\tex\latex\pgf\utilities\pgffor.sty"
-("C:\Program Files\MiKTeX 2.9\tex\latex\pgf\utilities\pgfkeys.sty"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\utilities\pgfkeys.code.tex"))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\utilities\pgffor.code.tex"
+))
+(/usr/share/texmf/tex/latex/pgf/utilities/pgffor.sty
+(/usr/share/texmf/tex/latex/pgf/utilities/pgfkeys.sty
+(/usr/share/texmf/tex/generic/pgf/utilities/pgfkeys.code.tex))
+(/usr/share/texmf/tex/generic/pgf/utilities/pgffor.code.tex
Package: pgffor 2010/03/23 v2.10 (rcs-revision 1.18)
-\pgffor@iter=\dimen190
-\pgffor@skip=\dimen191
-\pgffor@stack=\toks51
-\pgffor@toks=\toks52
+\pgffor@iter=\dimen182
+\pgffor@skip=\dimen183
+\pgffor@stack=\toks45
+\pgffor@toks=\toks46
))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\frontendlayer\tikz\tikz.code.tex"
+(/usr/share/texmf/tex/generic/pgf/frontendlayer/tikz/tikz.code.tex
Package: tikz 2010/10/13 v2.10 (rcs-revision 1.76)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\libraries\pgflibraryplothandlers.
-code.tex"
+(/usr/share/texmf/tex/generic/pgf/libraries/pgflibraryplothandlers.code.tex
File: pgflibraryplothandlers.code.tex 2010/05/31 v2.10 (rcs-revision 1.15)
-\pgf@plot@mark@count=\count165
-\pgfplotmarksize=\dimen192
-)
-\tikz@lastx=\dimen193
-\tikz@lasty=\dimen194
-\tikz@lastxsaved=\dimen195
-\tikz@lastysaved=\dimen196
-\tikzleveldistance=\dimen197
-\tikzsiblingdistance=\dimen198
-\tikz@figbox=\box49
-\tikz@tempbox=\box50
-\tikztreelevel=\count166
-\tikznumberofchildren=\count167
-\tikznumberofcurrentchild=\count168
-\tikz@fig@count=\count169
-
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\modules\pgfmodulematrix.code.tex"
+\pgf@plot@mark@count=\count147
+\pgfplotmarksize=\dimen184
+)
+\tikz@lastx=\dimen185
+\tikz@lasty=\dimen186
+\tikz@lastxsaved=\dimen187
+\tikz@lastysaved=\dimen188
+\tikzleveldistance=\dimen189
+\tikzsiblingdistance=\dimen190
+\tikz@figbox=\box48
+\tikz@tempbox=\box49
+\tikztreelevel=\count148
+\tikznumberofchildren=\count149
+\tikznumberofcurrentchild=\count150
+\tikz@fig@count=\count151
+
+(/usr/share/texmf/tex/generic/pgf/modules/pgfmodulematrix.code.tex
File: pgfmodulematrix.code.tex 2010/08/24 (rcs-revision 1.4)
-\pgfmatrixcurrentrow=\count170
-\pgfmatrixcurrentcolumn=\count171
-\pgf@matrix@numberofcolumns=\count172
+\pgfmatrixcurrentrow=\count152
+\pgfmatrixcurrentcolumn=\count153
+\pgf@matrix@numberofcolumns=\count154
)
-\tikz@expandcount=\count173
+\tikz@expandcount=\count155
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\frontendlayer\tikz\libraries\tikz
-librarytopaths.code.tex"
+(/usr/share/texmf/tex/generic/pgf/frontendlayer/tikz/libraries/tikzlibrarytopat
+hs.code.tex
File: tikzlibrarytopaths.code.tex 2008/06/17 v2.10 (rcs-revision 1.2)
-)))
-("C:\Program Files\MiKTeX 2.9\tex\latex\pgfplots\pgfplots.sty"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\pgfplots.revision.tex")
-Package: pgfplots 2011/12/29 v1.5.1 (git show 1.5.1-4-g53e640f )
-
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\pgfplots.code.tex"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\pgfplotscore.code.tex"
-\t@pgfplots@toka=\toks53
-\t@pgfplots@tokb=\toks54
-\t@pgfplots@tokc=\toks55
-\pgfplots@tmpa=\dimen199
-\c@pgfplots@coordindex=\count174
-\c@pgfplots@scanlineindex=\count175
-
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\sys\pgfplotssysgeneric.code.
-tex"))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\libs\pgfplotslibrary.code.te
-x")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\oldpgfcompatib\pgfplotsoldpg
-fsupp_loader.code.tex"
+))) (/usr/share/texmf-texlive/tex/latex/pgfplots/pgfplots.sty
+Package: pgfplots 2009/02/14 Version 1.2.2
+
+(/usr/share/texmf-texlive/tex/generic/pgfplots/pgfplots.code.tex
+(/usr/share/texmf-texlive/tex/generic/pgfplots/pgfplotscore.code.tex
+\t@pgfplots@toka=\toks47
+\t@pgfplots@tokb=\toks48
+\t@pgfplots@tokc=\toks49
+\pgfplots@tmpa=\dimen191
+)
+(/usr/share/texmf-texlive/tex/generic/pgfplots/oldpgfcompatib/pgfplotsoldpgfsup
+p_loader.code.tex
Package pgfplots: loading complementary code for your PGF version...
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\oldpgfcompatib\pgfplotsoldpg
-fsupp_misc.code.tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\oldpgfcompatib\pgfplotsoldpg
-fsupp_pgfkeys.code.tex"
-\pgfkeys@pathtoks=\toks56
-\pgfkeys@temptoks=\toks57
-
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\oldpgfcompatib\pgfplotsoldpg
-fsupp_pgfkeysfiltered.code.tex"
-\pgfkeys@tmptoks=\toks58
-))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\oldpgfcompatib\pgfplotsoldpg
-fsupp_pgfmathfloat.code.tex"
-\c@pgfmathroundto@lastzeros=\count176
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\oldpgfcompatib\pgfplotsoldpg
-fsupp_pgflibraryplothandlers.code.tex"
-File: pgflibraryplothandlers.code.tex 2011/12/28 v2.10 (rcs-revision 1.16)
-\pgf@plot@mark@count=\count177
-\pgfplotmarksize=\dimen200
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\oldpgfcompatib\pgfplotsoldpg
-fsupp_pgflibraryfpu.code.tex"))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\util\pgfplotsutil.code.tex"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\liststructure\pgfplotslistst
-ructure.code.tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\liststructure\pgfplotslistst
-ructureext.code.tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\liststructure\pgfplotsarray.
-code.tex"
-\c@pgfplotsarray@tmp=\count178
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\liststructure\pgfplotsmatrix
-.code.tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\numtable\pgfplotstableshared
-.code.tex"
-\c@pgfplotstable@counta=\count179
-\t@pgfplotstable@a=\toks59
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\liststructure\pgfplotsdeque.
-code.tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\util\pgfplotsbinary.code.tex
-")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\util\pgfplotsutil.verb.code.
-tex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\libs\pgflibrarypgfplots.surf
-shading.code.tex"
-\c@pgfplotslibrarysurf@no=\count180
-
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\sys\pgflibrarypgfplots.surfs
-hading.pgfsys-pdftex.def")))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\util\pgfplotscolormap.code.t
-ex")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\pgfplotsstackedplots.code.te
-x")
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\pgfplotsplothandlers.code.te
-x"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\pgfplotsmeshplothandler.code
-.tex"))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\pgfplotscoordprocessing.code
-.tex") ("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\pgfplotsticks.code.te
-x") ("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\pgfplots.paths.code.tex"
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\frontendlayer\tikz\libraries\tikz
-librarydecorations.code.tex"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\modules\pgfmoduledecorations.code
-.tex"
-\pgfdecoratedcompleteddistance=\dimen201
-\pgfdecoratedremainingdistance=\dimen202
-\pgfdecoratedinputsegmentcompleteddistance=\dimen203
-\pgfdecoratedinputsegmentremainingdistance=\dimen204
-\pgf@decorate@distancetomove=\dimen205
-\pgf@decorate@repeatstate=\count181
-\pgfdecorationsegmentamplitude=\dimen206
-\pgfdecorationsegmentlength=\dimen207
-)
-\tikz@lib@dec@box=\box51
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\frontendlayer\tikz\libraries\tikz
-librarydecorations.pathmorphing.code.tex"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\libraries\decorations\pgflibraryd
-ecorations.pathmorphing.code.tex"))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\frontendlayer\tikz\libraries\tikz
-librarydecorations.pathreplacing.code.tex"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\libraries\decorations\pgflibraryd
-ecorations.pathreplacing.code.tex"))
-\pgfplots@numplots=\count182
-\pgfplots@xmin@reg=\dimen208
-\pgfplots@xmax@reg=\dimen209
-\pgfplots@ymin@reg=\dimen210
-\pgfplots@ymax@reg=\dimen211
-\pgfplots@zmin@reg=\dimen212
-\pgfplots@zmax@reg=\dimen213
-)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\frontendlayer\tikz\libraries\tikz
-libraryplotmarks.code.tex"
+(/usr/share/texmf-texlive/tex/generic/pgfplots/oldpgfcompatib/pgfplotsoldpgfsup
+p_misc.code.tex)
+(/usr/share/texmf-texlive/tex/generic/pgfplots/oldpgfcompatib/pgfplotsoldpgfsup
+p_pgfkeysfiltered.code.tex
+\pgfkeys@tmptoks=\toks50
+)
+(/usr/share/texmf-texlive/tex/generic/pgfplots/oldpgfcompatib/pgfplotsoldpgfsup
+p_pgfmathfloat.code.tex
+\c@pgfmathroundto@lastzeros=\count156
+)
+(/usr/share/texmf-texlive/tex/generic/pgfplots/oldpgfcompatib/pgfplotsoldpgfsup
+p_pgflibraryplothandlers.code.tex
+File: pgfplotsoldpgfsupp_pgflibraryplothandlers.code.tex 2009/02/13 v2.10 (rcs-
+revision 1.7)
+\pgf@plot@mark@count=\count157
+\pgfplotmarksize=\dimen192
+)
+(/usr/share/texmf/tex/generic/pgf/libraries/pgflibraryfpu.code.tex))
+(/usr/share/texmf-texlive/tex/generic/pgfplots/util/pgfplotsutil.code.tex
+(/usr/share/texmf-texlive/tex/generic/pgfplots/liststructure/pgfplotsliststruct
+ure.code.tex)
+(/usr/share/texmf-texlive/tex/generic/pgfplots/liststructure/pgfplotsliststruct
+ureext.code.tex)
+(/usr/share/texmf-texlive/tex/generic/pgfplots/liststructure/pgfplotsarray.code
+.tex
+\c@pgfplotsarray@tmp=\count158
+)
+(/usr/share/texmf-texlive/tex/generic/pgfplots/numtable/pgfplotstable.code.tex
+\c@pgfplotstable@counta=\count159
+\pgfplotstable@outfile=\write5
+
+(/usr/share/texmf-texlive/tex/generic/pgfplots/numtable/pgfplotstable.coltype.c
+ode.tex)))
+(/usr/share/texmf-texlive/tex/generic/pgfplots/util/pgfplotscolormap.code.tex)
+(/usr/share/texmf-texlive/tex/generic/pgfplots/pgfplots.stackedplots.code.tex)
+(/usr/share/texmf-texlive/tex/generic/pgfplots/pgfplotscoordprocessing.code.tex
+) (/usr/share/texmf-texlive/tex/generic/pgfplots/pgfplotsticks.code.tex)
+(/usr/share/texmf/tex/generic/pgf/frontendlayer/tikz/libraries/tikzlibrarydecor
+ations.code.tex
+(/usr/share/texmf/tex/generic/pgf/modules/pgfmoduledecorations.code.tex
+\pgfdecoratedcompleteddistance=\dimen193
+\pgfdecoratedremainingdistance=\dimen194
+\pgfdecoratedinputsegmentcompleteddistance=\dimen195
+\pgfdecoratedinputsegmentremainingdistance=\dimen196
+\pgf@decorate@distancetomove=\dimen197
+\pgf@decorate@repeatstate=\count160
+\pgfdecorationsegmentamplitude=\dimen198
+\pgfdecorationsegmentlength=\dimen199
+)
+\tikz@lib@dec@box=\box50
+)
+(/usr/share/texmf/tex/generic/pgf/frontendlayer/tikz/libraries/tikzlibrarydecor
+ations.pathmorphing.code.tex
+(/usr/share/texmf/tex/generic/pgf/libraries/decorations/pgflibrarydecorations.p
+athmorphing.code.tex))
+(/usr/share/texmf/tex/generic/pgf/frontendlayer/tikz/libraries/tikzlibrarydecor
+ations.pathreplacing.code.tex
+(/usr/share/texmf/tex/generic/pgf/libraries/decorations/pgflibrarydecorations.p
+athreplacing.code.tex))
+\pgfplots@numplots=\count161
+\pgfplots@xmin@reg=\dimen200
+\pgfplots@xmax@reg=\dimen201
+\pgfplots@ymin@reg=\dimen202
+\pgfplots@ymax@reg=\dimen203
+\pgfplots@zmin@reg=\dimen204
+\pgfplots@zmax@reg=\dimen205
+)
+(/usr/share/texmf/tex/generic/pgf/frontendlayer/tikz/libraries/tikzlibraryplotm
+arks.code.tex
File: tikzlibraryplotmarks.code.tex 2008/01/09 v2.10 (rcs-revision 1.1)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\libraries\pgflibraryplotmarks.cod
-e.tex"
+(/usr/share/texmf/tex/generic/pgf/libraries/pgflibraryplotmarks.code.tex
File: pgflibraryplotmarks.code.tex 2010/10/15 v2.10 (rcs-revision 1.12)
-))) ("C:\Program Files\MiKTeX 2.9\tex\latex\pgfplots\pgfplotstable.sty"
-Package: pgfplotstable 2011/12/19 Part of pgfplots
-
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\numtable\pgfplotstable.code.
-tex"
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgfplots\numtable\pgfplotstable.colty
-pe.code.tex")))
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\frontendlayer\tikz\libraries\tikz
-libraryarrows.code.tex"
+)))
+(/usr/share/texmf-texlive/tex/latex/pgfplots/pgfplotstable.sty
+Package: pgfplotstable 2008/02/14
+)
+(/usr/share/texmf/tex/generic/pgf/frontendlayer/tikz/libraries/tikzlibraryarrow
+s.code.tex
File: tikzlibraryarrows.code.tex 2008/01/09 v2.10 (rcs-revision 1.1)
-("C:\Program Files\MiKTeX 2.9\tex\generic\pgf\libraries\pgflibraryarrows.code.t
-ex"
+(/usr/share/texmf/tex/generic/pgf/libraries/pgflibraryarrows.code.tex
File: pgflibraryarrows.code.tex 2008/10/27 v2.10 (rcs-revision 1.9)
-\arrowsize=\dimen214
-)) ("C:\Program Files\MiKTeX 2.9\tex\latex\ltxmisc\url.sty"
+\arrowsize=\dimen206
+))
+(/usr/share/texmf-texlive/tex/latex/ltxmisc/url.sty
\Urlmuskip=\muskip11
Package: url 2006/04/12 ver 3.3 Verb mode for urls, etc.
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\breakurl\breakurl.sty"
+(/usr/share/texmf-texlive/tex/latex/breakurl/breakurl.sty
Package: breakurl 2009/01/24 v1.30 Breakable hyperref URLs
+(/usr/share/texmf-texlive/tex/generic/oberdiek/ifpdf.sty
+Package: ifpdf 2009/04/10 v2.0 Provides the ifpdf switch (HO)
+Package ifpdf Info: pdfTeX in pdf mode detected.
+)
Package breakurl Warning: You are using breakurl while processing via pdflatex.
(breakurl) \burl will be just a synonym of \url.
(breakurl) on input line 47.
-) ("C:\Program Files\MiKTeX 2.9\tex\latex\booktabs\booktabs.sty"
+) (/usr/share/texmf-texlive/tex/latex/booktabs/booktabs.sty
Package: booktabs 2005/04/14 v1.61803 publication quality tables
-\heavyrulewidth=\dimen215
-\lightrulewidth=\dimen216
-\cmidrulewidth=\dimen217
-\belowrulesep=\dimen218
-\belowbottomsep=\dimen219
-\aboverulesep=\dimen220
-\abovetopsep=\dimen221
-\cmidrulesep=\dimen222
-\cmidrulekern=\dimen223
-\defaultaddspace=\dimen224
-\@cmidla=\count183
-\@cmidlb=\count184
-\@aboverulesep=\dimen225
-\@belowrulesep=\dimen226
-\@thisruleclass=\count185
-\@lastruleclass=\count186
-\@thisrulewidth=\dimen227
-)
-("C:\Program Files\MiKTeX 2.9\tex\latex\subfigure\subfigure.sty"
-Package: subfigure 2002/07/30 v2.1.4 subfigure package
+\heavyrulewidth=\dimen207
+\lightrulewidth=\dimen208
+\cmidrulewidth=\dimen209
+\belowrulesep=\dimen210
+\belowbottomsep=\dimen211
+\aboverulesep=\dimen212
+\abovetopsep=\dimen213
+\cmidrulesep=\dimen214
+\cmidrulekern=\dimen215
+\defaultaddspace=\dimen216
+\@cmidla=\count162
+\@cmidlb=\count163
+\@aboverulesep=\dimen217
+\@belowrulesep=\dimen218
+\@thisruleclass=\count164
+\@lastruleclass=\count165
+\@thisrulewidth=\dimen219
+)
+(/usr/share/texmf-texlive/tex/latex/subfigure/subfigure.sty
+Package: subfigure 2002/03/15 v2.1.5 subfigure package
\subfigtopskip=\skip65
\subfigcapskip=\skip66
-\subfigcaptopadj=\dimen228
+\subfigcaptopadj=\dimen220
\subfigbottomskip=\skip67
-\subfigcapmargin=\dimen229
+\subfigcapmargin=\dimen221
\subfiglabelskip=\skip68
-\c@subfigure=\count187
-\c@lofdepth=\count188
-\c@subtable=\count189
-\c@lotdepth=\count190
+\c@subfigure=\count166
+\c@lofdepth=\count167
+\c@subtable=\count168
+\c@lotdepth=\count169
****************************************
* Local config file subfigure.cfg used *
****************************************
-("C:\Program Files\MiKTeX 2.9\tex\latex\subfigure\subfigure.cfg")
+(/usr/share/texmf-texlive/tex/latex/subfigure/subfigure.cfg)
\subfig@top=\skip69
\subfig@bottom=\skip70
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\koma-script\scrpage2.sty"
-Package: scrpage2 2010/04/22 v2.5 LaTeX2e KOMA-Script package
+(/usr/share/texmf-texlive/tex/latex/koma-script/scrpage2.sty
+Package: scrpage2 2008/12/08 v2.3 LaTeX2e KOMA-Script package
LaTeX Info: Redefining \pagemark on input line 176.
)
-("C:\Program Files\MiKTeX 2.9\tex\latex\listings\lstlang1.sty"
+(/usr/share/texmf-texlive/tex/latex/listings/lstlang1.sty
File: lstlang1.sty 2004/09/05 1.3 listings language file
)
-\c@example=\count191
-\glo@main@file=\write5
+\c@example=\count170
+\glo@main@file=\write6
+\openout6 = `Master.glo'.
+
Package glossaries Info: Writing glossary file Master.glo on input line 98.
-\glo@acronym@file=\write6
+\glo@acronym@file=\write7
+\openout7 = `Master.acn'.
+
Package glossaries Info: Writing glossary file Master.acn on input line 98.
+ (./Glossary.tex)
+(./Master.aux)
+\openout1 = `Master.aux'.
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\Glossary.tex)
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\Master.aux)
LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 115.
LaTeX Font Info: ... okay on input line 115.
LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 115.
@@ -1064,8 +961,7 @@ LaTeX Font Info: ... okay on input line 115.
LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 115.
LaTeX Font Info: ... okay on input line 115.
LaTeX Font Info: Try loading font information for T1+ptm on input line 115.
-
-("C:\Program Files\MiKTeX 2.9\tex\latex\psnfss\t1ptm.fd"
+ (/usr/share/texmf-texlive/tex/latex/psnfss/t1ptm.fd
File: t1ptm.fd 2001/06/04 font definitions for T1/ptm.
)
Package scrbase Info: No captions found for `german'
@@ -1073,66 +969,62 @@ Package scrbase Info: No captions found for `german'
Package scrbase Info: No captions found for `ngerman'
(scrbase) --> skipped on input line 115.
-("C:\Program Files\MiKTeX 2.9\tex\latex\unicode\ucsencs.def"
+(/usr/share/texmf-texlive/tex/latex/ucs/ucsencs.def
File: ucsencs.def 2003/11/29 Fixes to fontencodings LGR, T3
)
-("C:\Program Files\MiKTeX 2.9\tex\context\base\supp-pdf.mkii"
+(/usr/share/texmf-texlive/tex/context/base/supp-pdf.mkii
[Loading MPS to PDF converter (version 2006.09.02).]
-\scratchcounter=\count192
-\scratchdimen=\dimen230
-\scratchbox=\box52
-\nofMPsegments=\count193
-\nofMParguments=\count194
-\everyMPshowfont=\toks60
-\MPscratchCnt=\count195
-\MPscratchDim=\dimen231
-\MPnumerator=\count196
-\makeMPintoPDFobject=\count197
-\everyMPtoPDFconversion=\toks61
-)
-\c@lstlisting=\count198
-
-("C:\Program Files\MiKTeX 2.9\tex\latex\glossaries\dict\glossaries-dictionary-E
-nglish.dict"
+\scratchcounter=\count171
+\scratchdimen=\dimen222
+\scratchbox=\box51
+\nofMPsegments=\count172
+\nofMParguments=\count173
+\everyMPshowfont=\toks51
+\MPscratchCnt=\count174
+\MPscratchDim=\dimen223
+\MPnumerator=\count175
+\everyMPtoPDFconversion=\toks52
+)
+\c@lstlisting=\count176
+
+(/usr/share/texmf-texlive/tex/latex/glossaries/dict/glossaries-dictionary-Engli
+sh.dict
Dictionary: glossaries-dictionary, Language: English
-) ABD: EveryShipout initializing macros
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\Titlepage.tex
+) ABD: EveryShipout initializing macros (./Titlepage.tex
+
+pdfTeX warning: pdflatex (file ../Images/unisiegel.pdf): PDF inclusion: found P
+DF version <1.5>, but at most version <1.4> allowed
<../Images/unisiegel.pdf, id=4, 527.57097pt x 616.70403pt>
File: ../Images/unisiegel.pdf Graphic file (type pdf)
<use ../Images/unisiegel.pdf>
-Package pdftex.def Info: ../Images/unisiegel.pdf used on input line 10.
-(pdftex.def) Requested size: 277.4144pt x 324.28261pt.
LaTeX Font Info: Font shape `T1/ptm/bx/sc' in size <20.74> not available
(Font) Font shape `T1/ptm/b/sc' tried instead on input line 18.
LaTeX Font Info: Try loading font information for U+msa on input line 28.
-("C:\Program Files\MiKTeX 2.9\tex\latex\amsfonts\umsa.fd"
+(/usr/share/texmf-texlive/tex/latex/amsfonts/umsa.fd
File: umsa.fd 2009/06/22 v3.00 AMS symbols A
)
LaTeX Font Info: Try loading font information for U+msb on input line 28.
-("C:\Program Files\MiKTeX 2.9\tex\latex\amsfonts\umsb.fd"
+(/usr/share/texmf-texlive/tex/latex/amsfonts/umsb.fd
File: umsb.fd 2009/06/22 v3.00 AMS symbols B
)
LaTeX Font Info: Try loading font information for U+esvect on input line 28.
-("C:\Program Files\MiKTeX 2.9\tex\latex\esvect\uesvect.fd"
+(/usr/share/texmf-texlive/tex/latex/esvect/uesvect.fd
File: uesvect.fd
) [1
Non-PDF special ignored!
Non-PDF special ignored!
Non-PDF special ignored!
-Non-PDF special ignored!
+\openout3 = `Master.ist'.
-Non-PDF special ignored!
-Non-PDF special ignored!
-{C:/ProgramData/MiKTeX/2.9/pdftex/config/pdftex.map} <C:/Users/Tom/Desktop/imsi
--catcher-detection/Tex/Images/unisiegel.pdf>]) [2]
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Content\Declaration.tex
+{/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map} <../Images/unisiegel.pdf>])
+ [2] (../Content/Declaration.tex
LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <20.74> not available
(Font) Font shape `T1/ptm/b/n' tried instead on input line 1.
@@ -1145,20 +1037,18 @@ Underfull \hbox (badness 10000) in paragraph at lines 1--5
[]
-) [1] (C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Content\Abstract.tex
+) [1] (../Content/Abstract.tex
LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <10.95> not available
(Font) Font shape `T1/ptm/b/n' tried instead on input line 2.
+ [2
-[2
-
-] ("C:\Program Files\MiKTeX 2.9\tex\latex\unicode\data\uni-0.def"
+]
+(/usr/share/texmf-texlive/tex/latex/ucs/data/uni-0.def
File: uni-0.def 2004/10/17 UCS: Unicode data U+0000..U+00FF
)) [3]
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Content\Acknowledgements.tex)
-[4
+(../Content/Acknowledgements.tex) [4
-] (C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Content\Dedication.tex)
-[5
+] (../Content/Dedication.tex) [5
] [6
@@ -1167,19 +1057,59 @@ File: uni-0.def 2004/10/17 UCS: Unicode data U+0000..U+00FF
]
LaTeX Font Info: Try loading font information for T1+phv on input line 140.
- ("C:\Program Files\MiKTeX 2.9\tex\latex\psnfss\t1phv.fd"
+
+(/usr/share/texmf-texlive/tex/latex/psnfss/t1phv.fd
File: t1phv.fd 2001/06/04 scalable font definitions for T1/phv.
)
LaTeX Font Info: Font shape `T1/phv/bx/n' in size <10.95> not available
(Font) Font shape `T1/phv/b/n' tried instead on input line 140.
+ (./Master.toc
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 2.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 7.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 39.
+ [7
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\Master.toc [7
-
-])
-\tf@toc=\write7
-
-[8] (C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Content\Motivation.tex
+]
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 66.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 80.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 84.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 85.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 88.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 92.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 95.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 96.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 99.
+)
+\tf@toc=\write8
+\openout8 = `Master.toc'.
+
+
+[8] (../Content/Motivation.tex
Chapter 1.
Class scrbook Warning: \float@addtolists detected!
@@ -1198,7 +1128,7 @@ LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <14.4> not available
] [2]
LaTeX Font Info: Try loading font information for T1+pcr on input line 62.
- ("C:\Program Files\MiKTeX 2.9\tex\latex\psnfss\t1pcr.fd"
+ (/usr/share/texmf-texlive/tex/latex/psnfss/t1pcr.fd
File: t1pcr.fd 2001/06/04 font definitions for T1/pcr.
)
LaTeX Font Info: Font shape `T1/pcr/bx/n' in size <10.95> not available
@@ -1208,15 +1138,14 @@ Underfull \hbox (badness 10000) in paragraph at lines 60--72
[]
-) (C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Content\GSM_short.tex
-[3] [4
+) (../Content/GSM_short.tex [3] [4
]
Chapter 2.
[5]
LaTeX Font Info: Try loading font information for OMS+ptm on input line 33.
- ("C:\Program Files\MiKTeX 2.9\tex\latex\psnfss\omsptm.fd"
+ (/usr/share/texmf-texlive/tex/latex/psnfss/omsptm.fd
File: omsptm.fd
)
LaTeX Font Info: Font shape `OMS/ptm/m/n' in size <10.95> not available
@@ -1225,14 +1154,10 @@ LaTeX Font Info: Font shape `OMS/ptm/m/n' in size <10.95> not available
<../Images/Architecture.png, id=70, 370.45602pt x 204.81319pt>
File: ../Images/Architecture.png Graphic file (type png)
-<use ../Images/Architecture.png>
-Package pdftex.def Info: ../Images/Architecture.png used on input line 96.
-(pdftex.def) Requested size: 370.45511pt x 204.81267pt.
- [7]
+<use ../Images/Architecture.png> [7]
LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <12> not available
(Font) Font shape `T1/ptm/b/n' tried instead on input line 122.
- [8 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/Architecture.png>]
-[9] [10] [11]
+ [8 <../Images/Architecture.png (PNG copy)>] [9] [10] [11]
Underfull \vbox (badness 1755) has occurred while \output is active []
[12]
@@ -1240,112 +1165,66 @@ Underfull \vbox (badness 1755) has occurred while \output is active []
File: ../Images/Authentication.png Graphic file (type png)
<use ../Images/Authentication.png>
-Package pdftex.def Info: ../Images/Authentication.png used on input line 302.
-(pdftex.def) Requested size: 359.18102pt x 323.04611pt.
-
Underfull \vbox (badness 6808) has occurred while \output is active []
- [13 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/Authentication.png
->] [14]
+ [13 <../Images/Authentication.png (PNG copy)>] [14]
<../Images/Mapping.png, id=98, 337.28409pt x 115.19838pt>
File: ../Images/Mapping.png Graphic file (type png)
-<use ../Images/Mapping.png>
-Package pdftex.def Info: ../Images/Mapping.png used on input line 360.
-(pdftex.def) Requested size: 337.28326pt x 115.19809pt.
- [15 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/Mapping.png>] [16]
-
+<use ../Images/Mapping.png> [15 <../Images/Mapping.png (PNG copy)>] [16]
<../Images/Cells.png, id=106, 98.72083pt x 88.8921pt>
File: ../Images/Cells.png Graphic file (type png)
<use ../Images/Cells.png>
-Package pdftex.def Info: ../Images/Cells.png used on input line 435.
-(pdftex.def) Requested size: 98.72057pt x 88.89188pt.
-
-<../Images/real_Cells.png, id=107, 743.02594pt x 496.10344pt>
-File: ../Images/real_Cells.png Graphic file (type png)
+<../Images/real_Cells.PNG, id=107, 743.02594pt x 496.10344pt>
+File: ../Images/real_Cells.PNG Graphic file (type png)
-<use ../Images/real_Cells.png>
-Package pdftex.def Info: ../Images/real_Cells.png used on input line 437.
-(pdftex.def) Requested size: 156.04005pt x 104.18478pt.
- [17 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/Cells.png> <C:/Use
-rs/Tom/Desktop/imsi-catcher-detection/Tex/Images/real_Cells.png>] [18]
+<use ../Images/real_Cells.PNG> [17 <../Images/Cells.png (PNG copy)> <../Images/
+real_Cells.PNG>] [18]
<../Images/Cipher.png, id=117, 387.72855pt x 131.02551pt>
File: ../Images/Cipher.png Graphic file (type png)
<use ../Images/Cipher.png>
-Package pdftex.def Info: ../Images/Cipher.png used on input line 495.
-(pdftex.def) Requested size: 387.72758pt x 131.02518pt.
-
Underfull \vbox (badness 2495) has occurred while \output is active []
- [19 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/Cipher.png>]
+ [19 <../Images/Cipher.png (PNG copy)>]
<../Images/TDMAFDMA.png, id=121, 254.53494pt x 133.33815pt>
File: ../Images/TDMAFDMA.png Graphic file (type png)
-<use ../Images/TDMAFDMA.png>
-Package pdftex.def Info: ../Images/TDMAFDMA.png used on input line 544.
-(pdftex.def) Requested size: 254.5343pt x 133.33781pt.
- [20]
+<use ../Images/TDMAFDMA.png> [20]
<../Images/Frames.png, id=126, 331.28568pt x 291.39264pt>
File: ../Images/Frames.png Graphic file (type png)
<use ../Images/Frames.png>
-Package pdftex.def Info: ../Images/Frames.png used on input line 565.
-(pdftex.def) Requested size: 331.28487pt x 291.3919pt.
-
<../Images/Bursts.png, id=127, 371.90141pt x 134.78355pt>
File: ../Images/Bursts.png Graphic file (type png)
<use ../Images/Bursts.png>
-Package pdftex.def Info: ../Images/Bursts.png used on input line 576.
-(pdftex.def) Requested size: 371.9005pt x 134.78322pt.
-
Underfull \vbox (badness 10000) has occurred while \output is active []
- [21 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/TDMAFDMA.png>] [22
- <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/Frames.png> <C:/Users/
-Tom/Desktop/imsi-catcher-detection/Tex/Images/Bursts.png>] [23]
+ [21 <../Images/TDMAFDMA.png (PNG copy)>] [22 <../Images/Frames.png (PNG copy)>
+ <../Images/Bursts.png (PNG copy)>] [23]
<../Images/Channels.png, id=138, 272.60245pt x 169.47314pt>
File: ../Images/Channels.png Graphic file (type png)
-<use ../Images/Channels.png>
-Package pdftex.def Info: ../Images/Channels.png used on input line 621.
-(pdftex.def) Requested size: 272.60178pt x 169.47273pt.
- [24 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/Channels.png>] [25
-] [26]
-<../Images/imsi_catcher.jpg, id=148, 280.15778pt x 225.73222pt>
+<use ../Images/Channels.png> [24 <../Images/Channels.png (PNG copy)>] [25]
+[26] <../Images/imsi_catcher.jpg, id=148, 280.15778pt x 225.73222pt>
File: ../Images/imsi_catcher.jpg Graphic file (type jpg)
<use ../Images/imsi_catcher.jpg>
-Package pdftex.def Info: ../Images/imsi_catcher.jpg used on input line 728.
-(pdftex.def) Requested size: 174.76988pt x 140.81706pt.
-
<../Images/usrp.jpg, id=149, 1204.5pt x 844.65562pt>
File: ../Images/usrp.jpg Graphic file (type jpg)
<use ../Images/usrp.jpg>
-Package pdftex.def Info: ../Images/usrp.jpg used on input line 728.
-(pdftex.def) Requested size: 174.76988pt x 122.5557pt.
-
[27] <../Images/catcher_attack.png, id=155, 322.25192pt x 277.08318pt>
File: ../Images/catcher_attack.png Graphic file (type png)
-<use ../Images/catcher_attack.png>
-Package pdftex.def Info: ../Images/catcher_attack.png used on input line 745.
-(pdftex.def) Requested size: 322.25113pt x 277.08249pt.
- [28 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/imsi_catcher.jpg>
-<C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/usrp.jpg>] [29 <C:/User
-s/Tom/Desktop/imsi-catcher-detection/Tex/Images/catcher_attack.png>]
+<use ../Images/catcher_attack.png> [28 <../Images/imsi_catcher.jpg> <../Images/
+usrp.jpg>] [29 <../Images/catcher_attack.png (PNG copy)>]
<../Images/replace_attack.png, id=162, 356.86926pt x 178.43463pt>
File: ../Images/replace_attack.png Graphic file (type png)
-<use ../Images/replace_attack.png>
-Package pdftex.def Info: ../Images/replace_attack.png used on input line 793.
-(pdftex.def) Requested size: 356.8684pt x 178.43419pt.
- [30] [31 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/replace_attac
-k.png>])
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Content\Detection.tex [32]
-[33] [34
+<use ../Images/replace_attack.png> [30] [31 <../Images/replace_attack.png (PNG
+copy)>] [32]) (../Content/Detection.tex [33] [34
]
@@ -1353,146 +1232,90 @@ Chapter 3.
[35] <../Images/c123_pcb.png, id=182, 1284.8pt x 790.955pt>
File: ../Images/c123_pcb.png Graphic file (type png)
-<use ../Images/c123_pcb.png>
-Package pdftex.def Info: ../Images/c123_pcb.png used on input line 82.
-(pdftex.def) Requested size: 349.53978pt x 215.17795pt.
- [36] [37]
+<use ../Images/c123_pcb.png> [36] [37]
<../Images/OsmoStructure.png, id=189, 387.00584pt x 79.13565pt>
File: ../Images/OsmoStructure.png Graphic file (type png)
-<use ../Images/OsmoStructure.png>
-Package pdftex.def Info: ../Images/OsmoStructure.png used on input line 114.
-(pdftex.def) Requested size: 387.00488pt x 79.13544pt.
- [38 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/c123_pcb.png (PNG
-copy)>] [39 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/OsmoStructu
-re.png>]
+<use ../Images/OsmoStructure.png> [38 <../Images/c123_pcb.png (PNG copy)>]
+Underfull \vbox (badness 10000) has occurred while \output is active []
+
+ [39 <../Images/OsmoStructure.png (PNG copy)>]
<../Images/sysinfo2marked.png, id=197, 261.32832pt x 440.55792pt>
File: ../Images/sysinfo2marked.png Graphic file (type png)
-<use ../Images/sysinfo2marked.png>
-Package pdftex.def Info: ../Images/sysinfo2marked.png used on input line 177.
-(pdftex.def) Requested size: 310.70532pt x 523.82675pt.
- [40] [41 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/sysinfo2marke
-d.png>]
-<../Images/Paging.png, id=204, 169.47314pt x 153.64603pt>
+<use ../Images/sysinfo2marked.png> [40] [41 <../Images/sysinfo2marked.png (PNG
+copy)>] <../Images/Paging.png, id=204, 169.47314pt x 153.64603pt>
File: ../Images/Paging.png Graphic file (type png)
-<use ../Images/Paging.png>
-Package pdftex.def Info: ../Images/Paging.png used on input line 209.
-(pdftex.def) Requested size: 169.47273pt x 153.64563pt.
- [42] [43 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/Paging.png>]
-[44] [45]
-<../Images/neighbourhoods_fak.png, id=218, 1829.83624pt x 2708.1175pt>
+<use ../Images/Paging.png> [42] [43 <../Images/Paging.png (PNG copy)>] [44]
+[45] <../Images/neighbourhoods_fak.png, id=218, 1829.83624pt x 2708.1175pt>
File: ../Images/neighbourhoods_fak.png Graphic file (type png)
<use ../Images/neighbourhoods_fak.png>
-Package pdftex.def Info: ../Images/neighbourhoods_fak.png used on input line 32
-6.
-(pdftex.def) Requested size: 349.53978pt x 517.31628pt.
-
-LaTeX Warning: Float too large for page by 3.59608pt on input line 329.
+LaTeX Warning: Float too large for page by 3.59608pt on input line 331.
LaTeX Font Info: Font shape `T1/phv/bx/n' in size <14.4> not available
-(Font) Font shape `T1/phv/b/n' tried instead on input line 366.
-[46] [47 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/neighbourhoods
-_fak.png (PNG copy)>] [48] [49] [50] [51]
-<../Images/Architecture_software.png, id=239, 341.76483pt x 182.91537pt>
+(Font) Font shape `T1/phv/b/n' tried instead on input line 369.
+[46] [47 <../Images/neighbourhoods_fak.png (PNG copy)>] [48] [49]
+Underfull \vbox (badness 10000) has occurred while \output is active []
+
+ [50]
+[51] [52]
+<../Images/Architecture_software.png, id=242, 341.76483pt x 182.91537pt>
File: ../Images/Architecture_software.png Graphic file (type png)
-<use ../Images/Architecture_software.png>
-Package pdftex.def Info: ../Images/Architecture_software.png used on input line
- 555.
-(pdftex.def) Requested size: 341.76399pt x 182.91492pt.
- [52] [53 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/Architecture_
-software.png>]
+<use ../Images/Architecture_software.png> [53 <../Images/Architecture_software.
+png (PNG copy)>]
LaTeX Font Info: Font shape `T1/pcr/m/it' in size <10.95> not available
-(Font) Font shape `T1/pcr/m/sl' tried instead on input line 600.
- [54]
-<../Images/ICDS.png, id=250, 1325.95375pt x 864.22874pt>
+(Font) Font shape `T1/pcr/m/sl' tried instead on input line 605.
+ [54] <../Images/ICDS.png, id=249, 1325.95375pt x 864.22874pt>
File: ../Images/ICDS.png Graphic file (type png)
-<use ../Images/ICDS.png>
-Package pdftex.def Info: ../Images/ICDS.png used on input line 638.
-(pdftex.def) Requested size: 388.38017pt x 253.13864pt.
- [55] [56 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/ICDS.png (PNG
- copy)>] [57]
-<../Images/databases_window.png, id=261, 366.36874pt x 459.7175pt>
+<use ../Images/ICDS.png> [55] [56 <../Images/ICDS.png (PNG copy)>] [57]
+<../Images/databases_window.png, id=261, 355.3275pt x 452.69125pt>
File: ../Images/databases_window.png Graphic file (type png)
<use ../Images/databases_window.png>
-Package pdftex.def Info: ../Images/databases_window.png used on input line 708.
-
-(pdftex.def) Requested size: 155.34969pt x 194.93192pt.
-
-<../Images/rules_window.png, id=262, 284.06125pt x 568.1225pt>
+<../Images/rules_window.png, id=262, 231.86626pt x 559.08875pt>
File: ../Images/rules_window.png Graphic file (type png)
<use ../Images/rules_window.png>
-Package pdftex.def Info: ../Images/rules_window.png used on input line 709.
-(pdftex.def) Requested size: 155.34969pt x 310.70856pt.
-
-<../Images/filter_window.png, id=263, 332.24126pt x 293.095pt>
+<../Images/filter_window.png, id=263, 294.09875pt x 269.005pt>
File: ../Images/filter_window.png Graphic file (type png)
<use ../Images/filter_window.png>
-Package pdftex.def Info: ../Images/filter_window.png used on input line 710.
-(pdftex.def) Requested size: 155.34969pt x 137.04803pt.
-
-<../Images/pch_window.png, id=264, 270.00874pt x 273.02pt>
+<../Images/pch_window.png, id=264, 272.01625pt x 294.09875pt>
File: ../Images/pch_window.png Graphic file (type png)
-<use ../Images/pch_window.png>
-Package pdftex.def Info: ../Images/pch_window.png used on input line 711.
-(pdftex.def) Requested size: 155.34969pt x 157.08525pt.
- [58] [59 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/databases_win
-dow.png> <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/rules_window.p
-ng> <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/filter_window.png>
-<C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/pch_window.png>] [60]
-<../Images/user_window.png, id=277, 368.37625pt x 469.755pt>
+<use ../Images/pch_window.png> [58] [59 <../Images/databases_window.png> <../Im
+ages/rules_window.png> <../Images/filter_window.png> <../Images/pch_window.png>
+] [60] <../Images/user_window.png, id=278, 368.37625pt x 469.755pt>
File: ../Images/user_window.png Graphic file (type png)
<use ../Images/user_window.png>
-Package pdftex.def Info: ../Images/user_window.png used on input line 765.
-(pdftex.def) Requested size: 155.34969pt x 198.09856pt.
+Underfull \vbox (badness 2809) has occurred while \output is active []
-Underfull \vbox (badness 10000) has occurred while \output is active []
+ [61 <../Images/user_window.png>] [62]) (../Content/Evaluation.tex [63] [64
- [61 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/user_window.png>])
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Content\Evaluation.tex
-[62]
+]
Chapter 4.
-[63
-
-
-] [64] [65]
-Underfull \vbox (badness 7944) has occurred while \output is active []
-
- [66]
-<../Images/catcherICDS.jpg, id=298, 3474.9825pt x 1906.12125pt>
+[65] [66] [67] [68]
+<../Images/catcherICDS.jpg, id=305, 3474.9825pt x 1906.12125pt>
File: ../Images/catcherICDS.jpg Graphic file (type jpg)
-<use ../Images/catcherICDS.jpg>
-Package pdftex.def Info: ../Images/catcherICDS.jpg used on input line 175.
-(pdftex.def) Requested size: 368.95998pt x 202.37364pt.
- [67] [68 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/catcherICDS.j
-pg>] [69] [70] [71] [72] [73])
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Content\Conclusion.tex
-[74]
+<use ../Images/catcherICDS.jpg> [69] [70 <../Images/catcherICDS.jpg>] [71]
+[72] [73] [74] [75]) (../Content/Conclusion.tex [76]
Chapter 5.
-<../Images/flowchart.png, id=324, 340.31943pt x 407.31372pt>
+<../Images/flowchart.png, id=332, 340.31943pt x 407.31372pt>
File: ../Images/flowchart.png Graphic file (type png)
-<use ../Images/flowchart.png>
-Package pdftex.def Info: ../Images/flowchart.png used on input line 26.
-(pdftex.def) Requested size: 340.31859pt x 407.31273pt.
- [75
+<use ../Images/flowchart.png> [77
-] [76 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/flowchart.png>] [
-77]) [78]
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\Master.bbl
+] [78 <../Images/flowchart.png (PNG copy)>]
+[79]) [80] (./Master.bbl
Underfull \hbox (badness 3179) in paragraph at lines 4--9
[]\T1/ptm/m/sc/10.95 3GPP Tech-ni-cal Spec-i-fi-ca-tion Group Core Net-work and
Ter-
@@ -1500,8 +1323,8 @@ Underfull \hbox (badness 3179) in paragraph at lines 4--9
Underfull \hbox (badness 10000) in paragraph at lines 4--9
-$\T1/pcr/m/n/10.95 http : / / www . 3gpp . org / ftp / Specs / archive / 23 _ s
-eries / 23 . 003 /$
+\T1/pcr/m/n/10.95 http : / / www . 3gpp . org / ftp / Specs / archive / 23 _ se
+ries / 23 . 003 /
[]
@@ -1519,31 +1342,31 @@ as-pects. \T1/ptm/m/it/10.95 TS 04.05\T1/ptm/m/n/10.95 ,
Underfull \hbox (badness 1112) in paragraph at lines 11--16
\T1/ptm/m/it/10.95 DOC file $\T1/pcr/m/n/10.95 http : / / www . 3gpp . org / ft
-p / Specs / archive / 04 _ series /$
+p / Specs / archive / 04 _ series /
[]
Underfull \hbox (badness 1112) in paragraph at lines 18--23
\T1/ptm/m/it/10.95 DOC file $\T1/pcr/m/n/10.95 http : / / www . 3gpp . org / ft
-p / Specs / archive / 05 _ series /$
+p / Specs / archive / 05 _ series /
[]
-[79
+[81
-] ("C:\Program Files\MiKTeX 2.9\tex\latex\unicode\data\uni-32.def"
+] (/usr/share/texmf-texlive/tex/latex/ucs/data/uni-32.def
File: uni-32.def 2004/10/17 UCS: Unicode data U+2000..U+20FF
)
Underfull \hbox (badness 1210) in paragraph at lines 112--117
[]\T1/ptm/m/sc/10.95 OsmocomBB\T1/ptm/m/n/10.95 . Catcher Catcher. \T1/ptm/m/
it/10.95 Project Wiki\T1/ptm/m/n/10.95 , $\T1/pcr/m/n/10.95 http : / / opensour
-ce .$
+ce .
[]
-[80]
+[82]
Underfull \hbox (badness 1783) in paragraph at lines 162--167
[]\T1/ptm/m/sc/10.95 Telecomunication stan-dard-iza-tion sec-tor of ITU\T1/ptm/
m/n/10.95 . List of Mo-
@@ -1557,41 +1380,39 @@ Underfull \hbox (badness 1259) in paragraph at lines 162--167
Underfull \hbox (badness 10000) in paragraph at lines 194--199
-$\T1/pcr/m/n/10.95 wikipedia . org / wiki / Central _ Equipment _ Identity _ Re
-gister$\T1/ptm/m/n/10.95 ,
+\T1/pcr/m/n/10.95 wikipedia . org / wiki / Central _ Equipment _ Identity _ Reg
+ister$\T1/ptm/m/n/10.95 ,
[]
-) [81] [82
+) [83] [84
+
+] (./Master.lof [85])
+\tf@lof=\write9
+\openout9 = `Master.lof'.
-] (C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\Master.lof
-[83])
-\tf@lof=\write8
- [84] (C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\Master.lot)
-\tf@lot=\write9
+ [86] (./Master.lot)
+\tf@lot=\write10
+\openout10 = `Master.lot'.
-[85
+ [87
-] (C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Content\Appendix.tex
-[86
+]
+(../Content/Appendix.tex [88
]
Appendix A.
-[87] [88]
+[89] [90]
Appendix B.
-[89
+[91
-] [90] <../Images/t191cable.jpg, id=376, 702.625pt x 609.27625pt>
+] [92] <../Images/t191cable.jpg, id=383, 702.625pt x 609.27625pt>
File: ../Images/t191cable.jpg Graphic file (type jpg)
-<use ../Images/t191cable.jpg>
-Package pdftex.def Info: ../Images/t191cable.jpg used on input line 136.
-(pdftex.def) Requested size: 349.53978pt x 303.11269pt.
- [91 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/t191cable.jpg>] [9
-2
+<use ../Images/t191cable.jpg> [93 <../Images/t191cable.jpg>] [94
]
@@ -1629,128 +1450,111 @@ Underfull \hbox (badness 10000) in paragraph at lines 166--198
Underfull \vbox (badness 7981) has occurred while \output is active []
- [93]
-[94]
-Underfull \hbox (badness 10000) in paragraph at lines 201--348
+ [95]
+[96]
+Underfull \hbox (badness 10000) in paragraph at lines 201--345
[]
-Underfull \hbox (badness 10000) in paragraph at lines 201--348
+Underfull \hbox (badness 10000) in paragraph at lines 201--345
[]
-Underfull \hbox (badness 10000) in paragraph at lines 201--348
+Underfull \hbox (badness 10000) in paragraph at lines 201--345
[]
-Underfull \hbox (badness 10000) in paragraph at lines 201--348
+Underfull \hbox (badness 10000) in paragraph at lines 201--345
[]
Underfull \vbox (badness 10000) has occurred while \output is active []
- [95]
-[96]
-Underfull \vbox (badness 10000) has occurred while \output is active []
-
[97]
[98]
+Underfull \vbox (badness 10000) has occurred while \output is active []
+
+ [99]
+[100]
Appendix D.
-<../Images/sysinfo1.png, id=402, 260.172pt x 393.1488pt>
+<../Images/sysinfo1.png, id=410, 260.172pt x 393.1488pt>
File: ../Images/sysinfo1.png Graphic file (type png)
<use ../Images/sysinfo1.png>
-Package pdftex.def Info: ../Images/sysinfo1.png used on input line 354.
-(pdftex.def) Requested size: 349.53978pt x 528.22041pt.
-
-LaTeX Warning: Float too large for page by 0.9002pt on input line 356.
+LaTeX Warning: Float too large for page by 0.9002pt on input line 353.
-<../Images/sysinfo2.png, id=403, 261.32832pt x 440.55792pt>
+<../Images/sysinfo2.png, id=411, 261.32832pt x 440.55792pt>
File: ../Images/sysinfo2.png Graphic file (type png)
<use ../Images/sysinfo2.png>
-Package pdftex.def Info: ../Images/sysinfo2.png used on input line 359.
-(pdftex.def) Requested size: 349.53978pt x 589.30258pt.
+LaTeX Warning: Float too large for page by 61.98238pt on input line 358.
-LaTeX Warning: Float too large for page by 61.98238pt on input line 361.
-
-<../Images/sysinfo3.png, id=404, 284.45473pt x 373.49136pt>
+<../Images/sysinfo3.png, id=412, 284.45473pt x 373.49136pt>
File: ../Images/sysinfo3.png Graphic file (type png)
<use ../Images/sysinfo3.png>
-Package pdftex.def Info: ../Images/sysinfo3.png used on input line 364.
-(pdftex.def) Requested size: 349.53978pt x 458.96992pt.
-
-<../Images/sysinfo4.png, id=405, 252.07776pt x 370.0224pt>
+<../Images/sysinfo4.png, id=413, 252.07776pt x 370.0224pt>
File: ../Images/sysinfo4.png Graphic file (type png)
-<use ../Images/sysinfo4.png>
-Package pdftex.def Info: ../Images/sysinfo4.png used on input line 369.
-(pdftex.def) Requested size: 349.53978pt x 513.11008pt.
- [99
+<use ../Images/sysinfo4.png> [101
-] [100 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/sysinfo1.png>] [
-101 <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/sysinfo2.png>] [102
- <C:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/sysinfo3.png>] [103 <C
-:/Users/Tom/Desktop/imsi-catcher-detection/Tex/Images/sysinfo4.png>] [104
+] [102 <../Images/sysinfo1.png (PNG copy)>]
+[103 <../Images/sysinfo2.png (PNG copy)>] [104 <../Images/sysinfo3.png (PNG cop
+y)>] [105 <../Images/sysinfo4.png (PNG copy)>] [106
]
Appendix E.
-[105]) (C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\Master.acr
-[106]
-Underfull \hbox (badness 2626) in paragraph at lines 73--74
+[107]) (./Master.acr [108]
+Underfull \hbox (badness 2626) in paragraph at lines 81--82
[]|\T1/ptm/m/n/10.95 Conférence Eu-ropéenne des Ad-min-is-tra-tions des
[]
-Underfull \hbox (badness 10000) in paragraph at lines 89--90
+Underfull \hbox (badness 10000) in paragraph at lines 105--106
[]|\T1/ptm/m/n/10.95 Electrically Erasable Pro-grammable Read-Only
[]
-[107
+[109
-] [108] [109]) [110]
-(C:\Users\Tom\Desktop\imsi-catcher-detection\Tex\Master\Master.aux) )
+] [110] [111]) [112] (./Master.aux) )
Here is how much of TeX's memory you used:
- 31262 strings out of 494045
- 623461 string characters out of 3148393
- 943412 words of memory out of 3000000
- 33817 multiletter control sequences out of 15000+200000
+ 25288 strings out of 493848
+ 471970 string characters out of 1152824
+ 751960 words of memory out of 3000000
+ 27887 multiletter control sequences out of 15000+50000
83343 words of font info for 111 fonts, out of 3000000 for 9000
- 715 hyphenation exceptions out of 8191
- 65i,13n,83p,1323b,1590s stack positions out of 5000i,500n,10000p,200000b,50000s
-{C:/Progra
-m Files/MiKTeX 2.9/fonts/enc/dvips/fontname/8r.enc}<C:/Program Files/MiKTeX 2.9
-/fonts/type1/public/amsfonts/cm/cmex10.pfb><C:/Program Files/MiKTeX 2.9/fonts/t
-ype1/public/amsfonts/cm/cmmi10.pfb><C:/Program Files/MiKTeX 2.9/fonts/type1/pub
-lic/amsfonts/cm/cmmi12.pfb><C:/Program Files/MiKTeX 2.9/fonts/type1/public/amsf
-onts/cm/cmmi8.pfb><C:/Program Files/MiKTeX 2.9/fonts/type1/public/amsfonts/cm/c
-mr10.pfb><C:/Program Files/MiKTeX 2.9/fonts/type1/public/amsfonts/cm/cmr8.pfb><
-C:/Program Files/MiKTeX 2.9/fonts/type1/public/amsfonts/cm/cmsy10.pfb><C:/Progr
-am Files/MiKTeX 2.9/fonts/type1/public/amsfonts/cm/cmsy8.pfb><C:/Program Files/
-MiKTeX 2.9/fonts/type1/public/eurosym/feymr10.pfb><C:/Program Files/MiKTeX 2.9/
-fonts/type1/public/amsfonts/latxfont/lcircle1.pfb><C:/Program Files/MiKTeX 2.9/
-fonts/type1/urw/courier/ucrb8a.pfb><C:/Program Files/MiKTeX 2.9/fonts/type1/urw
-/courier/ucrr8a.pfb><C:/Program Files/MiKTeX 2.9/fonts/type1/urw/courier/ucrro8
-a.pfb><C:/Program Files/MiKTeX 2.9/fonts/type1/urw/helvetic/uhvb8a.pfb><C:/Prog
-ram Files/MiKTeX 2.9/fonts/type1/urw/times/utmb8a.pfb><C:/Program Files/MiKTeX
-2.9/fonts/type1/urw/times/utmr8a.pfb><C:/Program Files/MiKTeX 2.9/fonts/type1/u
-rw/times/utmr8a.pfb><C:/Program Files/MiKTeX 2.9/fonts/type1/urw/times/utmri8a.
-pfb>
-Output written on Master.pdf (120 pages, 16646364 bytes).
+ 714 hyphenation exceptions out of 8191
+ 61i,13n,72p,1076b,1344s stack positions out of 5000i,500n,10000p,200000b,50000s
+{/usr/share/texmf-texlive/fonts/enc/dvips/
+base/8r.enc}</usr/share/texmf-texlive/fonts/type1/public/amsfonts/cm/cmex10.pfb
+></usr/share/texmf-texlive/fonts/type1/public/amsfonts/cm/cmmi10.pfb></usr/shar
+e/texmf-texlive/fonts/type1/public/amsfonts/cm/cmmi12.pfb></usr/share/texmf-tex
+live/fonts/type1/public/amsfonts/cm/cmmi8.pfb></usr/share/texmf-texlive/fonts/t
+ype1/public/amsfonts/cm/cmr10.pfb></usr/share/texmf-texlive/fonts/type1/public/
+amsfonts/cm/cmr8.pfb></usr/share/texmf-texlive/fonts/type1/public/amsfonts/cm/c
+msy10.pfb></usr/share/texmf-texlive/fonts/type1/public/amsfonts/cm/cmsy8.pfb></
+usr/share/texmf-texlive/fonts/type1/public/eurosym/feymr10.pfb></usr/share/texm
+f-texlive/fonts/type1/public/amsfonts/latxfont/lcircle1.pfb></usr/share/texmf-t
+exlive/fonts/type1/urw/courier/ucrb8a.pfb></usr/share/texmf-texlive/fonts/type1
+/urw/courier/ucrr8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/courier/ucrro
+8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/helvetic/uhvb8a.pfb></usr/shar
+e/texmf-texlive/fonts/type1/urw/times/utmb8a.pfb></usr/share/texmf-texlive/font
+s/type1/urw/times/utmr8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/times/ut
+mr8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/times/utmri8a.pfb>
+Output written on Master.pdf (122 pages, 20418983 bytes).
PDF statistics:
- 505 PDF objects out of 1000 (max. 8388607)
+ 513 PDF objects out of 1000 (max. 8388607)
0 named destinations out of 1000 (max. 500000)
183 words of extra memory for PDF output out of 10000 (max. 10000000)
diff --git a/Tex/Master/Master.lot b/Tex/Master/Master.lot
index e0e4666..7d14a14 100644
--- a/Tex/Master/Master.lot
+++ b/Tex/Master/Master.lot
@@ -12,21 +12,21 @@
\contentsline {table}{\numberline {3.5}{\ignorespaces Database Rules implemented inside the ICDS.}}{49}
\contentsline {table}{\numberline {3.6}{\ignorespaces Scan Rules implemented inside the ICDS.}}{50}
\addvspace {10\p@ }
-\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{63}
-\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in seconds for fetching the information.}}{65}
-\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Paging Messages and Immediate Assignments (per 10 seconds) for the four German providers at different locations.}}{66}
-\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{70}
-\contentsline {table}{\numberline {4.5}{\ignorespaces Configuration and Context Rule results for Config 1.}}{70}
-\contentsline {table}{\numberline {4.6}{\ignorespaces Results obtained testing the \emph {rx} and \emph {LAC Change rules}.}}{72}
-\contentsline {table}{\numberline {4.7}{\ignorespaces Results of the database evaluation.}}{73}
-\contentsline {table}{\numberline {4.8}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{73}
+\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{65}
+\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in seconds for fetching the information.}}{67}
+\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Paging Messages and Immediate Assignments (per 10\tmspace +\thinmuskip {.1667em}s) for the four German providers at different locations.}}{69}
+\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{72}
+\contentsline {table}{\numberline {4.5}{\ignorespaces Configuration and Context Rule results for Config 1.}}{72}
+\contentsline {table}{\numberline {4.6}{\ignorespaces Results obtained testing the \emph {rx} and \emph {LAC Change rules}.}}{74}
+\contentsline {table}{\numberline {4.7}{\ignorespaces Results of the database evaluation.}}{75}
+\contentsline {table}{\numberline {4.8}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{75}
\addvspace {10\p@ }
\addvspace {10\p@ }
-\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{87}
-\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{88}
+\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{89}
+\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{90}
\addvspace {10\p@ }
\addvspace {10\p@ }
\addvspace {10\p@ }
\addvspace {10\p@ }
-\contentsline {table}{\numberline {E.1}{\ignorespaces Configurations used for the rx\tmspace +\thinmuskip {.1667em}/\tmspace +\thinmuskip {.1667em}LAC Change Rules test.}}{105}
-\contentsline {table}{\numberline {E.2}{\ignorespaces Configurations used for the Database Rules test.}}{106}
+\contentsline {table}{\numberline {E.1}{\ignorespaces Configurations used for the rx\tmspace +\thinmuskip {.1667em}/\tmspace +\thinmuskip {.1667em}LAC Change Rules test.}}{107}
+\contentsline {table}{\numberline {E.2}{\ignorespaces Configurations used for the Database Rules test.}}{108}
diff --git a/Tex/Master/Master.pdf b/Tex/Master/Master.pdf
index 065306e..5666f89 100644
--- a/Tex/Master/Master.pdf
+++ b/Tex/Master/Master.pdf
Binary files differ
diff --git a/Tex/Master/Master.tex b/Tex/Master/Master.tex
index e32ea6c..e45a5d5 100644
--- a/Tex/Master/Master.tex
+++ b/Tex/Master/Master.tex
@@ -165,7 +165,7 @@
\bibliographystyle{acm}
%always remove nocite before compiling final version ***************************************************
-\nocite{*}
+%\nocite{*}
%*******************************************************************************************************
\bibliography{../Content/Bibliography}
\listoffigures
diff --git a/Tex/Master/Master.tex~ b/Tex/Master/Master.tex~
index 1bf9653..e45a5d5 100644
--- a/Tex/Master/Master.tex~
+++ b/Tex/Master/Master.tex~
@@ -2,12 +2,22 @@
% Document Class %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-\documentclass[a4paper, twoside, 11pt]{book}
+\documentclass[a4paper,twoside, DIV=10,fontsize=11pt,bibliography=totoc, BCOR=15mm, headinclude=true,
+ footinclude=false, cleardoubleplain,chapterprefix=false,appendixprefix=true]{scrbook}
+%chapterprefix=true/false
+%appendixprefix=true/false
+
+%fix ugly koma headings
+\addtokomafont{sectioning}{\rmfamily\bfseries}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Includes %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+\usepackage{titlepage}
+\usepackage{eurosym}
+%\usepackage{a4wide}
+%\usepackage{caption}
\usepackage{appendix}
%\usepackage{ngerman}
\usepackage[english]{babel}
@@ -20,6 +30,7 @@
\usepackage{listings}
%\usepackage{apacite}
%\usepackage{apacite-deutsch}
+%\usepackage{tablex}
\usepackage{times, helvet,courier}
\usepackage{esvect}
\usepackage[T1]{fontenc}
@@ -28,17 +39,21 @@
\usepackage{multido}
\usepackage[acronym=true,toc=true]{glossaries}
%\usepackage{vaucanson-g}
-%\usepackage{a4wide}
\usepackage{pstricks}
-%\usepackage{makeidx}
+%\usepackage{makeidx}\begin{axis}
\usepackage{courier, helvet}
\usepackage{lipsum}
-\usepackage[
-nonumberlist, %do not show page numbers
-acronym, %generate acronym listing
-toc, %show listings as entries in table of contents
-section] %use section level for toc entries
-{glossaries}
+\usepackage{glossaries}
+\usepackage{tikz}
+\usepackage{pgfplots}
+\usepackage{pgfplotstable}
+\usetikzlibrary{arrows}
+\usepackage{url}
+\usepackage{breakurl}
+\usepackage{booktabs}
+\usepackage{subfigure}
+\usepackage{xcolor}
+\usepackage[headsepline, automark]{scrpage2}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Styles for Programming Language Highlighting %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -50,29 +65,20 @@ section] %use section level for toc entries
frameround=ftff,
frame=shadowbox,
%keywordstyle=\color{red},
- numbers=left,
+ %numbers=left,
aboveskip=7pt}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Selfdefined Commands %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-% example environment
\newtheorem{example}{Example}
-% python need to be followed by lstlisting env
-%\newcommand{pyhton}{\lstset{language=Python}}
-
-
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-% Information %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-
-%this is not used atm sincee a template for the titlepage has been inclluded and is used
-\author{Thomas Mayer}
-\title{Master Thesis:\\ IMSI Catcher Detection}
-\date{\today}
-
+\newcommand{\eg}{e.g.\ }
+\newcommand{\ie}{i.e.\ }
+\newcommand{\cf}{cf.\ }
+\newcommand{\etc}{etc.\ }
+\newcommand{\MHz}{\,MHz\ }
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Glossary and Listings Style %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -91,100 +97,95 @@ section] %use section level for toc entries
%Activate glossary commands
\makeglossaries
-%\input{Glossary}
-
-%Some acronyms
-\newacronym{MS}{MS}{Microsoft}
-\newacronym{CD}{CD}{Compact Disc}
-%An acronym with a glossary entry
-\newacronym{AD}{AD}{Active Directory\protect\glsadd{glos:AD}}
-
-%Some glossary terms
-\newglossaryentry{glos:AD}{
-name=Active Directory,
-description={Active Directory is the directory service for
-Windows based networks, that allows central organization and
-administration of any network resource.
-It allows a single-sign-on concept independent from network
-topologies or network protocols. As a prerequisite you need
-a Windows Server acting as Domain Controller. This computer
-stores all necessary data, e.\,g.~usernames and corresponding
-passwords.}
-}
-\newglossaryentry{glos:RespF}{name={response file}, description={A file
-that allows unattended software installation.}}
+\input{Glossary}
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+% Information %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%this is not used atm sincee a template for the titlepage has been inclluded and is used
+\author{Thomas Mayer}
+\title{Master Thesis:\\ IMSI Catcher Detection}
+\date{\today}
+
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Titlepage %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{document}
-
\input{Titlepage}
-\pagestyle{empty}
-
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-% Abstract %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+% Stuff that has to be there %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-
-\begin{center}
- \textbf{Abstract:}
-\end{center}
+\newpage
+\pagestyle{empty}
+\phantom{a}
+\newpage
+\pagenumbering{roman}
+\input{../Content/Declaration}
+\clearpage
\input{../Content/Abstract}
-
-
+\clearpage
+\input{../Content/Acknowledgements}
+\clearpage
+\input{../Content/Dedication}
+\clearpage
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Create ListOfTables and ListOfFigures %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-\clearpage{\pagestyle{empty}\cleardoublepage}
-\pagestyle{headings}
-\pagenumbering{roman}
-\listoffigures
-%\listoftables
+\clearpage{\thispagestyle{scrplain}\cleardoublepage}
\tableofcontents
-\clearpage{\pagestyle{empty}\cleardoublepage}
+\clearpage{\thispagestyle{scrplain}\cleardoublepage}
\pagenumbering{arabic}
-
+\pagestyle{scrheadings}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Content %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-\chapter{blah}
-\section{General information}
-Our network uses \gls{AD}. By using \gls{AD} with \gls{MS} bases clients that
-have been installed using a \gls{glos:RespF} from \gls{CD}, we can expect a
-high level of standardization.
-\section{blubb}
-\chapter{moo}
-\section{mah}
+\input{../Content/Motivation}
+\input{../Content/GSM_short}
+\input{../Content/Detection}
+\input{../Content/Evaluation}
+\input{../Content/Conclusion}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-% Create Glossary and Index %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+% Finish Content %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\clearpage{\pagestyle{empty}\cleardoublepage}
-\pagenumbering{Roman}
-
-%Print list of acronyms
-\printglossary[type=\acronymtype,style=long]
-
-%Print the glossary
-\printglossary[style=altlist,title=Glossary]
+%\pagenumbering{Roman}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Bibliography %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\bibliographystyle{acm}
-
-% % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %
-% Appendix % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %
-% % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %
+%always remove nocite before compiling final version ***************************************************
+%\nocite{*}
+%*******************************************************************************************************
+\bibliography{../Content/Bibliography}
+\listoffigures
+\listoftables
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+% Appendix %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%\listoffigures
+%\listoftables
+\newpage
\appendix
-\chapter{foo}
-\section{blah}
+\input{../Content/Appendix}
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+% Create Glossary and Index %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%Print list of acronyms
+\printglossary[type=\acronymtype,style=long]
+
+%Print the glossary
+%\printglossary[style=altlist,title=Glossary]
\end{document}
diff --git a/Tex/Master/Master.toc b/Tex/Master/Master.toc
index aed6e60..41e9ae0 100644
--- a/Tex/Master/Master.toc
+++ b/Tex/Master/Master.toc
@@ -43,57 +43,57 @@
\contentsline {subsection}{\numberline {3.1.2}Motorola C123}{37}
\contentsline {subsection}{\numberline {3.1.3}OsmocomBB and ICDS}{38}
\contentsline {section}{\numberline {3.2}Procedure}{39}
-\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{39}
+\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{40}
\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{43}
\contentsline {subsubsection}{Configuration Rules}{44}
\contentsline {subsubsection}{Context Rules}{45}
\contentsline {paragraph}{Neighbourhood Structure}{46}
\contentsline {subsubsection}{Database Rules}{49}
-\contentsline {subsubsection}{Scan Rules}{50}
+\contentsline {subsubsection}{Scan Rules}{51}
\contentsline {subsubsection}{Remaining Issues and Paging}{51}
\contentsline {subsection}{\numberline {3.2.3}Base Station Evaluation}{52}
-\contentsline {section}{\numberline {3.3}Implementation}{52}
-\contentsline {subsection}{\numberline {3.3.1}Architecture}{52}
+\contentsline {section}{\numberline {3.3}Implementation}{53}
+\contentsline {subsection}{\numberline {3.3.1}Architecture}{53}
\contentsline {subsection}{\numberline {3.3.2}Configuration}{54}
\contentsline {subsection}{\numberline {3.3.3}Graphical User Interface}{55}
-\contentsline {subsection}{\numberline {3.3.4}Usage}{58}
-\contentsline {paragraph}{Conducting sweep scans:}{58}
-\contentsline {paragraph}{Using and obtaining Cell ID Information:}{58}
+\contentsline {subsection}{\numberline {3.3.4}Usage}{60}
+\contentsline {paragraph}{Conducting sweep scans:}{60}
+\contentsline {paragraph}{Using and obtaining CID Information:}{60}
\contentsline {paragraph}{Building or using a Local Area Database:}{60}
-\contentsline {paragraph}{Conducting a PCH Scan:}{60}
-\contentsline {paragraph}{Utilising User Mode:}{61}
+\contentsline {paragraph}{Conducting a PCH Scan:}{61}
+\contentsline {paragraph}{Utilising User Mode:}{62}
\contentsline {section}{\numberline {3.4}Related Projects}{62}
-\contentsline {chapter}{\numberline {4}Evaluation}{63}
-\contentsline {section}{\numberline {4.1}Performance Evaluation}{63}
-\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{64}
-\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{65}
-\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{66}
-\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{67}
-\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{67}
-\contentsline {subsubsection}{Modifications to the ICDS Configuration}{69}
-\contentsline {subsection}{\numberline {4.2.2}Configuration and Context Rules Evaluation}{69}
-\contentsline {subsection}{\numberline {4.2.3}Scan Rules Evaluation}{71}
-\contentsline {subsection}{\numberline {4.2.4}Database Rules Evaluation}{71}
-\contentsline {subsection}{\numberline {4.2.5}Realistic Scenarios}{72}
-\contentsline {subsubsection}{IMSI Catcher as a new Cell}{74}
-\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{74}
-\contentsline {chapter}{\numberline {5}Conclusion}{75}
-\contentsline {section}{\numberline {5.1}Summary}{75}
-\contentsline {section}{\numberline {5.2}Future Work}{77}
-\contentsline {paragraph}{}{78}
-\contentsline {chapter}{Bibliography}{79}
-\contentsline {chapter}{\numberline {A}GSM}{87}
-\contentsline {section}{\numberline {A.1}Interfaces}{87}
-\contentsline {section}{\numberline {A.2}Channel Combinations}{88}
-\contentsline {chapter}{\numberline {B}OsmocomBB}{89}
-\contentsline {section}{\numberline {B.1}Installation}{89}
-\contentsline {section}{\numberline {B.2}Usage}{90}
-\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{91}
-\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{93}
-\contentsline {section}{\numberline {C.1}Extextions}{93}
-\contentsline {section}{\numberline {C.2}Example Configuration}{95}
-\contentsline {chapter}{\numberline {D}System Information}{99}
-\contentsline {chapter}{\numberline {E}Evaluation Data}{105}
-\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{105}
-\contentsline {section}{\numberline {E.2}Database Rules Test}{106}
-\contentsline {chapter}{Acronyms}{107}
+\contentsline {chapter}{\numberline {4}Evaluation}{65}
+\contentsline {section}{\numberline {4.1}Performance Evaluation}{65}
+\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{66}
+\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{67}
+\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{68}
+\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{68}
+\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{69}
+\contentsline {subsubsection}{Modifications to the ICDS Configuration}{70}
+\contentsline {subsection}{\numberline {4.2.2}Configuration and Context Rules Evaluation}{71}
+\contentsline {subsection}{\numberline {4.2.3}Scan Rules Evaluation}{73}
+\contentsline {subsection}{\numberline {4.2.4}Database Rules Evaluation}{73}
+\contentsline {subsection}{\numberline {4.2.5}Realistic Scenarios}{74}
+\contentsline {subsubsection}{IMSI Catcher as a new Cell}{76}
+\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{76}
+\contentsline {chapter}{\numberline {5}Conclusion}{77}
+\contentsline {section}{\numberline {5.1}Summary}{77}
+\contentsline {section}{\numberline {5.2}Future Work}{79}
+\contentsline {paragraph}{}{80}
+\contentsline {chapter}{Bibliography}{81}
+\contentsline {chapter}{\numberline {A}GSM}{89}
+\contentsline {section}{\numberline {A.1}Interfaces}{89}
+\contentsline {section}{\numberline {A.2}Channel Combinations}{90}
+\contentsline {chapter}{\numberline {B}OsmocomBB}{91}
+\contentsline {section}{\numberline {B.1}Installation}{91}
+\contentsline {section}{\numberline {B.2}Usage}{92}
+\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{93}
+\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{95}
+\contentsline {section}{\numberline {C.1}Extextions}{95}
+\contentsline {section}{\numberline {C.2}Example Configuration}{97}
+\contentsline {chapter}{\numberline {D}System Information}{101}
+\contentsline {chapter}{\numberline {E}Evaluation Data}{107}
+\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{107}
+\contentsline {section}{\numberline {E.2}Database Rules Test}{108}
+\contentsline {chapter}{Acronyms}{109}