summaryrefslogtreecommitdiffstats
path: root/Tex
diff options
context:
space:
mode:
authorTom2012-05-31 21:29:15 +0200
committerTom2012-05-31 21:29:15 +0200
commit559006a2fc59705e68c1f8be1a6b362827be2bca (patch)
treeb32498ac73420c592053a26ae3fc6e367b472201 /Tex
parentchanged pictures (diff)
downloadimsi-catcher-detection-559006a2fc59705e68c1f8be1a6b362827be2bca.tar.gz
imsi-catcher-detection-559006a2fc59705e68c1f8be1a6b362827be2bca.tar.xz
imsi-catcher-detection-559006a2fc59705e68c1f8be1a6b362827be2bca.zip
finished suggestions on chapter 3
Diffstat (limited to 'Tex')
-rw-r--r--Tex/Content/Appendix.tex129
-rw-r--r--Tex/Content/Bibliography.bib9
-rw-r--r--Tex/Content/Detection.tex450
-rw-r--r--Tex/Content/Evaluation.tex5
-rw-r--r--Tex/Content/GSM_short.tex5
-rw-r--r--Tex/Master/Glossary.tex7
-rw-r--r--Tex/Master/Master.acn570
-rw-r--r--Tex/Master/Master.aux392
-rw-r--r--Tex/Master/Master.bbl19
-rw-r--r--Tex/Master/Master.blg69
-rw-r--r--Tex/Master/Master.ist2
-rw-r--r--Tex/Master/Master.lof75
-rw-r--r--Tex/Master/Master.log449
-rw-r--r--Tex/Master/Master.lot30
-rw-r--r--Tex/Master/Master.pdfbin14203879 -> 17995314 bytes
-rw-r--r--Tex/Master/Master.synctex.gzbin716230 -> 740261 bytes
-rw-r--r--Tex/Master/Master.tex3
-rw-r--r--Tex/Master/Master.toc111
18 files changed, 1302 insertions, 1023 deletions
diff --git a/Tex/Content/Appendix.tex b/Tex/Content/Appendix.tex
index 4dbd036..00bd29c 100644
--- a/Tex/Content/Appendix.tex
+++ b/Tex/Content/Appendix.tex
@@ -62,7 +62,6 @@ Multiframe Type &26&26&26&51&51&51&51&26&26\\
\caption{Possible mappings of channels onto Multiframes}
\end{table}
-
\chapter{OsmocomBB}
This section contains general information about how to operate and setup the OsmocomBB framework and the Motorola C123.
\section{Installation}
@@ -72,55 +71,63 @@ The instructions should work for any other distribution of the Ubuntu product pa
\begin{enumerate}
\item Build libraries must be installed on the operating system to enable compiling libraries.
- \begin{lstlisting}
-sudo apt-get install libtool shtool autoconf git-core
+\begin{verbatim}
+sudo apt-get install libtool shtool autoconf git-core
pkg-config make gcc wget
- \end{lstlisting}
+\end{verbatim}
\item The GNU Arm cross compiler toolchain needs to be installed so the firmware for the Motorola C123 can be built.
It will be added as a repository to \texttt{sources} so it can be easily removed if it is not required any more.
- \begin{lstlisting}
+ \begin{verbatim}
sudo add-apt-repository ppa:bdrung/bsprak
sudo apt-get update
sudo apt-get install arm-elf-toolchain
- \end{lstlisting}
+ \end{verbatim}
\item The source code needs to be obtained.
This can be either done by checking out the latest version of the framework from the developers, or by using the code on the CD.
- \begin{lstlisting}
+\begin{verbatim}
git clone git://git.osmocom.org/osmocom-bb.git
- \end{lstlisting}
+\end{verbatim}
\item At this point some firmwares had build errors, therefore we will compile only the firmware for the Calypso board used by the Motorola C123.
This constraint might not be necessary if a newer version of the framework is used.
In the \texttt{src} directory of the OsmocomBB framework the build process can be started.
- \begin{lstlisting}
+ \begin{verbatim}
make BOARDS=compal_e88
- \end{lstlisting}
+ \end{verbatim}
\item If a new version of OsmocomBB is used, the extra code from this project must be included in the build.
- The two files \texttt{catcher.c} and \texttt{app\_catcher.c} must be moved to \texttt{osmocom-bb/src/host/layer23/src/misc} and the \texttt{Makefile.am} must be edited to include the new code.
- \begin{lstlisting}
-bin_PROGRAMS = bcch_scan ... cbch_sniff catcher
-catcher_SOURCES = ../common/main.c app_catcher.c
- \end{lstlisting}
+ The three files \texttt{catcher.c}, \texttt{app\_catcher.c} and \texttt{pch\_scan.c}must be moved to \texttt{osmocom-bb/src/host/layer23/src/misc} and the \texttt{Makefile.am} must be edited to include the new code.
+ \begin{verbatim}
+bin_PROGRAMS = bcch_scan ... cbch_sniff catcher pch_scan
+catcher_LDADD = $(LDADD) -lm
+catcher_SOURCES = ../common/main.c app_catcher.c \
+ catcher.c ../../../gsmmap/geo.c
+pch_scan_SOURCES = ../common/main.c pch_scan.c rslms.c
+ \end{verbatim}
\end{enumerate}
\section{Usage}
\label{sec:osmo_usage}
To use a program written in the framework, the Motorola C123 needs to be flashed with the custom firmware.
This can be done with the \texttt{osmocon} application.
-\begin{lstlisting}
+\begin{verbatim}
cd src/host/osmocon
sudo ./osmocon -p /dev/ttyUSB0 -m c123xor
../../target/firmware/board/compal_e88/layer1.compalram.bin
-\end{lstlisting}
+\end{verbatim}
After \texttt{osmocon} is started and running any application can be started with root privileges.
-\begin{lstlisting}
+\begin{verbatim}
cd ../layer23/src/misc/
-sudo catcher
-\end{lstlisting}
+sudo ./catcher
+\end{verbatim}
+The \texttt{pch\_scan} program requires an ARFCN as an input.
+For example, to conduct a scan on the PCH of ARFCN 127 one would call:
+\begin{verbatim}
+sudo ./pch_scan -a 127
+\end{verbatim}
\newpage
\section{Serial Cable Schematics}
\label{sec:osmo_serial_schematics}
A T191 unlock cable used to connect the Motorola C123 can either be obtained by ordering it from one of the mentioned stores or by building it from scratch.
-These are the schematics required for building the unlock cable.
+These are the schematics required for building the unlock cable taken from a GSM Blog \footnote{GSM Box Schematics, \url{http://gsmringtonefree.blogspot.de/} [Online; Accessed 05.2012]}, which features images of many more cables for different brands.
\vfill
\begin{center}
\includegraphics[width=.9\textwidth]{../Images/t191cable}
@@ -128,13 +135,16 @@ These are the schematics required for building the unlock cable.
\vfill
\chapter{IMSI Catcher Detection System}
This section will cover some code related topics of the ICDS.
+
\section{Extextions}
\label{sec:extensions}
Rules, evaluators and filters are implemented in a way that new modules can be added quickly by way of inheritance and instantiating them in the constructor of the controller so they are known to the system.
The following example shows how to implement a new rule and add it to the system.
This exemplary process is nearly the same for filters and evaluators.
-At first this base class has to be derived.
+At first this base class has to be derived.\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
\begin{lstlisting}
class Rule:
#set whether the rule should be used by the
@@ -147,9 +157,12 @@ class Rule:
def check(self, arfcn, base_station_list):
return RuleResult.CRITICAL
\end{lstlisting}
+\end{minipage}\\\\
The new rule class needs to override the check method to do something meaningful.
-The identifier should also be set to a proper value.
+The identifier should also be set to a proper value.\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
\begin{lstlisting}
class MyRule (Rule):
identifier = 'My own Rule'
@@ -158,13 +171,15 @@ class MyRule (Rule):
#do some logic here and set result
return result
\end{lstlisting}
+\end{minipage}\\\\
\texttt{arfcn} and \texttt{base\_station\_list} are given to the check method by the controller.
The first parameter is the ARFCN of the base station to which the evaluation will be applied.
The second one is a list of all the base stations with complete information as far as it has been
obtained by the ICDS.
-
-After it has been implemented it can be instatiated and added to the list of active rules in the
-constructor of the controller.
+After it has been implemented it can be instantiated and added to the list of active rules in the
+constructor of the controller.\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
\begin{lstlisting}
class PyCatcherController:
...
@@ -175,11 +190,15 @@ class PyCatcherController:
self._rules.add(self._my_rule)
...
\end{lstlisting}
+\end{minipage}
+\newpage
\section{Example Configuration}
\label{sec:example_config}
-This example configuration has been used for the evaluation in the Freiburg area.
+This example configuration has been used for the evaluation in the Freiburg area.\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
\begin{lstlisting}
-#Core Configuration ---------------------------------------
+#Core Configuration -----------------------------------
#Settings for the Motorola C123 .
Device_settings = { 'mobile_device' : '/dev/ttyUSB0',
@@ -202,13 +221,23 @@ Commands = {'osmocon_command' : [Osmocon_lib +
+ '/layer1.compalram.bin'],
'scan_command' : [Osmocon_lib
+ '/host/layer23/src/misc/catcher'],
+ 'pch_command' : [Osmocon_lib
+ + '/host/layer23/src/misc/pch_scan'],
}
-#Rules Configuration --------------------------------------
+#Rules Configuration ------------------------------------
#A list of providers that should be taken as legitimate.
Provider_list = ['T-Mobile', 'O2', 'Vodafone', 'E-Plus']
+
+
+#-----------Continues on next page-----------------------
+\end{lstlisting}
+\end{minipage}\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
#Countries where the given providers have presence.
Provider_Country_list = {
'T-Mobile':'Germany',
@@ -229,15 +258,15 @@ LAC_mapping = {
#Frequency intervals that are registered to the
#given providers.
ARFCN_mapping = {
- 'T-Mobile' : [(13,39),(81, 102),(122,124),(587,611)],
+ 'T-Mobile' : [(13,49),(81, 102),(122,124),(587,611)],
'O2' : [(0,0),(1000,1023),(637,723)],
'Vodafone' : [(1,12),(50,80),(103,121),(725,751)],
'E-Plus' : [(975,999),(777,863)]
}
-#How much % the LAC of a base station can deviate from the
-#median before throwing an error (range 0 to 1 where 0
-#means no tolerance).
+#How much % the LAC of a base station can deviate from
+#the median before throwing an error (range 0 to 1 where
+#0 means no tolerance).
LAC_threshold = 0
#How much % the rx level is allowed to be away from the
@@ -248,7 +277,38 @@ DB_RX_threshold = 0.05
#of a scan.
CH_RX_threshold = 0.02
-#Database Configuration -----------------------------------
+#-------------Continues on next page---------------------
+
+
+\end{lstlisting}
+\end{minipage}\\\\
+\hspace*{\dimexpr\fboxsep+\fboxrule}%
+\begin{minipage}{\dimexpr\textwidth-4\fboxsep-2\fboxrule}
+\begin{lstlisting}
+#How much Pagings per 10s are required to give an Ok
+#rating
+Pagings_per_10s_threshold = 20
+
+#How many hopping assignments are required to give
+#an Ok rating
+Assignment_limit = 0
+
+#PCH Parameters -----------------------------------------
+
+#How often a failed PCH scan should retry
+PCH_retries = 5
+
+#Time the PCH is scanned during Operation in
+#User Mode
+USR_timeout = 15
+
+#Evaluator Configuration -------------------------------
+
+Rule_Groups = []
+
+Rule_Weights = {}
+
+#Database Configuration --------------------------------
#The API key for OpenCellID.
#Can be freely obtained by registering on the web site.
@@ -260,6 +320,7 @@ Open_Cell_ID_Key = 'd7a5bc3f21b44d4bf93d1ec2b3f83dc4'
Database_path = '''/home/tom/imsi-catcher-detection/Src
/PyCatcher/Databases/'''
\end{lstlisting}
+\end{minipage}
\chapter{System Information}
\label{sec:system_infos}
diff --git a/Tex/Content/Bibliography.bib b/Tex/Content/Bibliography.bib
index afec46e..9e4df2b 100644
--- a/Tex/Content/Bibliography.bib
+++ b/Tex/Content/Bibliography.bib
@@ -202,7 +202,7 @@ year = {2012},
howpublished = {\url{http://de.wikipedia.org/wiki/IMSI-Catcher}}
}
-@Misc{osmo_rationale,
+@Misc{osmo_c123,
title = {Motorola C123},
author = {OsmocomBB},
year = {2012},
@@ -237,6 +237,13 @@ year = {2010},
howpublished = {\url{http://www.heise.de/security/meldung/IMSI-Catcher-fuer-1500-Euro-im-Eigenbau-1048919.html}}
}
+@Misc{catcher_catcher,
+title = {Catcher Catcher},
+author = {OsmocomBB},
+year = {2011},
+howpublished = {\url{http://opensource.srlabs.de/projects/catcher/wiki}}
+}
+
@Misc{ITU212,
title={List of Mobile Country or Geographical Area Codes},
author={{Telecomunication standardization sector of ITU}},
diff --git a/Tex/Content/Detection.tex b/Tex/Content/Detection.tex
index cc84981..b6d4073 100644
--- a/Tex/Content/Detection.tex
+++ b/Tex/Content/Detection.tex
@@ -1,57 +1,61 @@
-\chapter{IMSI Catcher Detection}
+\chapter{IMSI Catcher Detection System}
+
+This chapter will give an overview of the \gls{icds} and the technologies and techniques used.
+The first part summarises the frameworks and hardware upon which the system has been developed.
+From this point on the second part explains how this framework can be used to harvest information and describes the process that is used by the \gls{icds} to evaluate this information.
+The last part shows how to configure and use the system to gather information from the surroundings and unveil IMSI catchers.
+
\section{Framework and Hardware}
The following section will give an overview of the OsmocomBB framework and how it works in conjunction with the Motorola C123 mobile phone to enable information harvesting for the \gls{icds}.
-OsmocomBB is one of many \gls{osmo} projects\footnote{Osmocom, \url{http://osmocom.org/} [Online; Accessed 04.2012]}. It implements the software part of a mobile phone.
-Another project is OpenBSC which implements software for configuring and operating a \gls{bsc}.
-OpenBSC was used to realise the Open Source IMSI Catcher \cite{dennis} and the base station that will be used later to evaluate the performance of the \gls{icds}.
+OsmocomBB is one of many \gls{osmo} projects\footnote{Osmocom, \url{http://osmocom.org/} [Online; Accessed 04.2012]}. It delivers an Open Source implementation for the base band chip for certain mobile phones.
+Another \gls{osmo} project is OpenBTS which delivers software for configuring and operating a \gls{bts}.
+OpenBTS was used to realise the Open Source IMSI Catcher \cite{dennis} and the base station that will be used later to evaluate the performance of the \gls{icds}.
\subsection{OsmocomBB}
-OscmocomBB implements the baseband part of \gls{gsm} as an open source project.
-Baseband part in this case means that it is an open source software to control the baseband chip inside the mobile phone.
+OscmocomBB implements the baseband part of \gls{gsm} as an Open Source project.
+Baseband part in this case means that it is an Open Source software to control the baseband chip inside the mobile phone.
+The baseband chip is the processor that manages the radio functionality of a mobile device.
The goal is to have, by using compatible hardware, a phone using free software only as opposed proprietary baseband implementations.
-Therefor the project scope is implementing \gls{gsm} layer 1-3 as well as hardware drivers for the baseband chipset.
+Therefore the project scope is implementing \gls{gsm} Layer 1--3 as well as hardware drivers for the baseband chipset.
A simple user interface on the phone is planned but not yet implemented.
At this stage a verbose user interface on the computer is used.
-This could be beneficial to multiple areas \cite{osmo_rationale}:
+The implementation being Open Source could be beneficial to multiple areas \cite{osmo_rationale}:
\begin{itemize}
\item \textbf{Security:} The software running on the baseband chips is highly proprietary and closed.
The source is often disclosed only to the mobile phone manufacturers using the specific chipset.
One cannot be sure that this software does not have bugs that could be exploited and ultimately pose a security risk to the subscriber.
- History has shown that open source projects are more secure than proprietary solutions since more people can view the source to find issues.
- If a security threat is found the bug is fixed fast and a patch is released.
- This could be a great benefit for phone users.
\item \textbf{Education:} Currently knowledge about \gls{gsm} and its layers on a technical level is not very well spread.
An open source implementation as a reference could serve to educate more developers generally interested in the subject of mobile communications and thus improve products and software.
Additionally this implementation enables universities to hold practical lab courses and interested individuals to do hands-on experiments.
\item \textbf{Research:} A free implementation can decouple research on \gls{gsm} technologies from the industry since key technologies are no longer only available to researchers employed by a specific company.
Additionally this way security holes can be uncovered more easily.
Modifications to the protocol stack can be deployed and tested in a real environment.
+ It is also possible to redirect all received and sent packages directly
\end{itemize}
\subsubsection{Project Status}
-At this point layer two and three do not actually run on the phone but rather on a computer to which the phone is connected via a serial cable
-Layer 1 runs inside the custom firmware on the \gls{me} itself, since the procedures involving layer 1 are time critical.
+At this point layer two and three do not actually run on the phone but rather on a computer to which the phone is connected via a serial cable.
+Layer 1 runs inside the custom firmware on the \gls{me} itself, since the procedures involving Layer 1 are time critical.
This has advantages as well as disadvantages.
-The disadvantage is that in order to run an application written with OsmocomBB you always have to have a notebook in addition to the phone.
+The disadvantage is that in order to run an application written using OsmocomBB you always have to have a notebook in addition to the phone.
The benefit however is that during the development process, the phone does not have to be touched after an initial deployment of the firmware.
This means code can be modified, compiled and tested locally without the need of remote debugging.
Experimenting is considerably easier this way.
-This separation however would not work in the original \gls{gsm} specification, therefore an extra interface layer between layer 1 and 2 had to be implemented to handle messaging between those two.
+This separation however would not work in the original \gls{gsm} specification, therefore an extra interface layer between Layer 1 and 2 had to be implemented to handle messaging over the serial interface between the two original layers.
It is called Layer 1 Control, L1CTL.
-The current state of the project is, according to a presentation given on the 27$^\text{th}$ chaos communication congress\footnote{27C3 public wiki (Day 3), \url{http://events.ccc.de/congress/2010/wiki/Welcome} [Online; Accessed 04.2012]} by Dieter Spaar and Harald Welte, that the network layers 1-3 are fully implemented, SIM cards can be accessed or emulated and \gls{gsm} cell selection and reselection are working.
+The current state of the project is, according to a presentation given on the 27$^\text{th}$ chaos communication congress\footnote{27C3 public wiki (Day 3), \url{http://events.ccc.de/congress/2010/wiki/Welcome} [Online; Accessed 04.2012]} by Dieter Spaar and Harald Welte, that the network Layers 1--3 are fully implemented, SIM cards can be accessed or emulated and \gls{gsm} cell selection and reselection are working.
A3/A8 as well as A5/1 and A/52, Full Rate and Enhanced Full Rate codecs are there, so it is possible to do voice calls with an OsmocomBB application written for that purpose, called \texttt{mobile}.
-It features a terminal/telnet based interface much like Cisco routers however there is no user interface for the phone so far or any implementation for Handovers since neighbourhood measurements were not implemented in the framework at that point.
-During these calls or during the operation of other programs, it is possible to receive all the frames that are being transmitted via Wireshark from the \texttt{osmocon} application.
+It features a terminal/telnet based interface much like Cisco routers however there is no user interface for the phone so far.
\subsection{Motorola C123}
\label{sec:osmo_phones}
-Since the general idea behind OsmocomBB was to become a vendor independent open source \gls{gsm} implementation for everyone to use, there were certain requirements the targeted hardware would have to meet.
+Since the general idea behind OsmocomBB was to become a vendor independent Open Source \gls{gsm} implementation for everyone to use, there were certain requirements the targeted hardware would have to meet.
For the consumer side requirements these were having a low price and a good availability.
This criterion rules out \gls{diy} approaches since the number of produced devices would be low and thus costly or a significant technical knowledge would be expected from all users to assemble the hardware.
For the developer side this would also mean implementing a lot on the lower levels of analog logic.
Therefore the Motorola C123 was chosen, an old, very cheap phone that is well spread.
-It has the advantage of being very simple on the hardware side since it is based on the well documented Texas Instruments Calypso Chipset \cite{osmo_slides}.
+It has the advantage of being very simple on the hardware side and very well documented since the technical documentation for the Texas Instruments Calypso Chipset \cite{osmo_slides} has been leaked.
Table \ref{tab:c123_specs} shows an overview of the main specifications for the phone.
\begin{table}
\centering
@@ -71,40 +75,40 @@ Table \ref{tab:c123_specs} shows an overview of the main specifications for the
\caption{Technical specifications for the Motorola C123.}
\label{tab:c123_specs}
\end{table}
-The OsmocomBB framework should work well or with small adjustments for any phone that share the same components.
-Figure \ref{fig:osmo_c123} an image of the Motorola C123 circuit board with the components mentioned before.
+The OsmocomBB framework should work well or with small adjustments for any phone that is based on the same components.
+Figure \ref{fig:osmo_c123} shows an image of the Motorola C123 circuit board with the components mentioned before.
\begin{figure}
\centering
\includegraphics[width=.9\textwidth]{../Images/c123_pcb}
\caption{Circuit board of the Motorola C123 with its components \cite{osmo_wiki_c123}.}
\label{fig:osmo_c123}
\end{figure}
-Another reason for choosing this hardware platform was that during the start of the OsmocomBB project an open source implementation of \gls{gsm} layer 1 was already available on Sourceforge (TSM30 Project) that could be used as a reference.
+Another reason for choosing this hardware platform was that during the start of the OsmocomBB project an open source implementation of \gls{gsm} Layer 1 was already available on Sourceforge (TSM30 Project) that could be used as a reference.
At this point the original project has been removed from the Sourceforge site.
-In order to use the Motorola C123 in combination with the OsmocomBB framework the custom firmware implementing layer 1 and L1CTL has to be flashed onto the board.
+In order to use the Motorola C123 in combination with the OsmocomBB framework the custom firmware implementing Layer 1 and L1CTL has to be flashed onto the board.
This has to be done using a RS332 serial cable that is connected to the 2.5\,mm audio jack.
The audio jack of the Motorola C123 and other Calypso based mobile phones typically have a 3.3 V serial port on their audio jacks.
-These cables are normally referred to as T191 unlock cables
-A variety of stores around the internet sell the cables ready made for about \$10-\$15\footnote{FoneFunShop, \url{http://www.fonefunshop.co.uk/cable_picker/773_Motorola_T191_W220_W375_OSMOCOM_etc._USB_Unlock_Cable.html} [Online; Accessed 04.2012]}.
+These cables are normally referred to as T191 unlock cables.
+A variety of stores around the internet sell the cables ready made for about \$10--\$15\footnote{FoneFunShop, \url{http://www.fonefunshop.co.uk/cable_picker/773_Motorola_T191_W220_W375_OSMOCOM_etc._USB_Unlock_Cable.html} [Online; Accessed 04.2012]}.
One must be careful when using the PC's serial port to communicate with the phone though.
Since the phone's serial operates at 3.3\,V and is internally connected to the 2.8\,V IO-pins of the baseband processor, directly connecting it to the computers 12\,V serial port will destroy the hardware.
Therefore it is recommended to use a USB serial cable.
-Schematics for such an unlock cable, along with a few instructions on how to build one are given in Appendix \ref{sec:osmo_serial_schematics}.
-
-Another issue is virtualisation.
-The bootloader and the firmware can fail to be deployed correctly if a virtual machine is used as development system.
-This is because the protocol used by Motorola to do the actual flashing process is \emph{very} time critical and thus timeouts can occur that are caused by the overhead the virtual machine imposes on the hardware/software communication.
+Schematics for such an unlock cable are given in Appendix \ref{sec:osmo_serial_schematics}.
\subsection{OsmocomBB and ICDS}
The setup that is used for the \gls{icds} project can be seen in Figure \ref{fig:osmo_setup}.
-It was build and tested in a Xubuntu 11.10 environment \footnote{Xubuntu, \url{http://xubuntu.org/} [Online; Accessed 04.2012]} which is a more lightweight variant of the popular Debian based Ubuntu Linux distribution.
+It was build and tested in a Xubuntu 11.10 environment\footnote{Xubuntu, \url{http://xubuntu.org/} [Online; Accessed 04.2012]} which is a more lightweight variant of the popular Debian based Ubuntu Linux distribution.
The process of acquiring, compiling and running the OsmocomBB framework itself in this environment is explained in Appendix \ref{sec:osmo_install}.
-As can be seen in the diagram, layer 1 of the OsmocomBB \gls{gsm} stack runs on the phone.
-It is connected via a serial cable to the computer running the \gls{icds}.
+
+When setting up the system it is recommended \emph{not} to use a virtual machine.
+The bootloader and the firmware can fail to be deployed correctly if a virtual machine is used as development system.
+This is because the protocol used by Motorola to do the actual flashing process is \emph{very} time critical and thus timeouts can occur that are caused by the overhead the virtual machine imposes on the hardware/software communication.
+
+As can be seen in the figure, Layer 1 of the OsmocomBB \gls{gsm} stack runs on the phone which is connected via a serial cable to the computer running the \gls{icds}.
On the computer side the \texttt{osmocon} program provides a general interface to the phone.
-\texttt{Osmocon} is also used to download the firmware to the Motorola C123.
-Other software can communicate with \texttt{osmocon} and subsequently with the phone using unix sockets.
+\texttt{Osmocon} is also used to load the firmware up to the Motorola C123.
+Other software can communicate with \texttt{osmocon} and subsequently with the phone using Unix sockets.
\begin{figure}
\centering
\includegraphics{../Images/OsmoStructure}
@@ -112,23 +116,24 @@ Other software can communicate with \texttt{osmocon} and subsequently with the p
\label{fig:osmo_setup}
\end{figure}
-\texttt{Catcher} is a modified version of the \texttt{cell\_log} program by Andreas Eversberg that interfaces with \texttt{osmocon} to harvest information from \glspl{bts} and forward it to the \gls{icds}.
-It can be seen as a layer 3 program that scans through available frequencies and reads information from the \gls{bcch} whenever one such channel is available on the frequency at hand.
+The program \texttt{Catcher}, the OsmocomBB part of the \gls{icds}, is a modified version of the \texttt{cell\_log} by Andreas Eversberg that interfaces with \texttt{osmocon} to harvest information from \glspl{bts} and forward it to the core \gls{icds}.
+It can be seen as a Layer 3 program that scans through available frequencies and reads information from the \gls{bcch} whenever one such channel is available on the frequency at hand.
The forwarding is done directly via \texttt{stdout} since it runs as a child process of the \gls{icds}.
-The functionality of \texttt{catcher} will be explained in detail in Section \ref{sec:info_gathering} while the implementation and operation of the \gls{icds} will be discussed in Section \ref{sec:icds}.
+In a similar way, \texttt{pch\_scan} gathers information on the \gls{pch} of a specific base station.
+The functionality of \texttt{catcher} and \texttt{pch\_scan} will be explained in detail in Section \ref{sec:info_gathering} while the implementation and operation of the \gls{icds} will be discussed in Section \ref{sec:icds}.
\section{Procedure}
The main goal of the \gls{icds} is to reach a conclusion on whether it is safe to initiate a phone call or not, in other words if the base station our mobile phone will connect to is trustworthy.
-As mentioned before as soon as a subscriber connects to an IMSI Catcher it automatically gives up information on his/her location.
+As mentioned before, as soon as a subscriber connects to an IMSI catcher it automatically gives up information on his/her location.
Therefore this project will use a passive approach on information harvesting, meaning we will only use information that is broadcasted or freely available as to not give up any hints of the \gls{icds} being active.
To that end a four-step process is taken.
First the information is gathered.
This process is explained in detail in Section \ref{sec:info_gathering}.
After information on the surrounding \glspl{bts} is ready in the \gls{icds}, a set of checks is evaluated on each base station individually, with each yielding a specific result for the station.
-These checks are called \emph{rules} and discussed further along with the next two steps in Section \ref{sec:info_evaluation}.
-Afterwards the results the rules yielded for each base station have to be aggregated into one single result for each \gls{bts}.
-At last, after every \gls{bts} has its evaluation it can be decided whether to tell the subscriber it is safe to initiate a phone call or not.
+These checks are called \emph{Rules} and discussed further along with the next two steps in Section \ref{sec:info_evaluation}.
+Afterwards the results the Rules yielded for each base station have to be aggregated into one single result for each \gls{bts}.
+At last, after every \gls{bts} has its evaluation it can be decided whether to tell the subscriber if it is safe to initiate a phone call or not.
\subsection{Information Gathering}
\label{sec:info_gathering}
@@ -156,28 +161,29 @@ TC &System Information Type\\
\caption{Type Codes and the corresponding System Information Types \cite{GSM2009}.}
\label{tab:tc_mapping}
\end{table}
-For this project the System Information Type 1-4 are of interest because these are available to all \glspl{ms} that tune in to the particular \gls{bcch} of the respective \gls{bts} without actively connecting to it.
+For this project the System Information Type 1--4 are of interest because these are available to all \glspl{ms} that tune in to the particular \gls{bcch} of the respective \gls{bts} without actively connecting to it.
The information contained inside the System Information Messages is harvested via the \texttt{catcher} program.
\texttt{Catcher} is implemented inside the OsmocomBB framework and connects over the \texttt{osmocon} application to the Motorola C123.
At first a sweep scan is done over all the \glspl{arfcn} to measure their reception levels in order to determine where base stations and thus \glspl{bcch} are located.
-Afterwards \texttt{catcher} tunes the phone to those specific frequencies where a \gls{bts} was found
+Afterwards \texttt{catcher} tunes the phone to those specific frequencies where a \gls{bts} was found.
At each such frequency it waits until all the System Information Messages are gathered and extracts parameters where possible.
The parameters along with the raw data are forwarded to the main \gls{icds} application for further evaluation.
-An example of a fully parsed System Information Type 1 can be seen in Figure \ref{fig:si1} \cite{protocols1999}.
+An example of a fully parsed System Information Type 2 can be seen in Figure \ref{fig:si1} \cite{protocols1999}.
+The Neighbouring Cell List which is a very valuable source of information is located in the middle of the message.
\begin{figure}
\centering
-\includegraphics[width=.9\textwidth]{../Images/sysinfo1}
-\caption{System Information 1 Message \cite{protocols1999}.}
+\includegraphics[width=.9\textwidth]{../Images/sysinfo2}
+\caption{System Information 2 Message \cite{protocols1999}.}
\label{fig:si1}
\end{figure}
Examples for all the System Information Messages used, along with an interpretation are located in Appendix \ref{sec:system_infos}.
As long as scanning mode is active all the available stations are scanned repeatedly and changes in the \glspl{bts} will continuously update the data model inside the \gls{icds} software.
-The parameters harvested are:
+The parameters harvested so far are:
\begin{itemize}
- \item Country: The interpreted country code the base station is broadcasting.
- \item Provider: The interpreted provider code the base station is broadcasting.
+ \item MCC: The Mobile Country Code the base station is broadcasting.
+ \item MNC: The Mobile Network Code the base station is broadcasting.
\item ARFCN: The \gls{arfcn} on which the base station is located.
\item rxlev: Receiving strength in db.
This parameter is measured by the Motorola C123 and not part of the System Information Messages.
@@ -189,28 +195,48 @@ The parameters harvested are:
\item LAC: This is the last part of the \gls{lai} (that consists of \gls{mcc} + \gls{mnc} + \gls{lac}) and is a hierarchical identifier for a given base station.
The hierarchy is provider wide, meaning two different providers may use \glspl{lac} with a completely different numbering system.
The \gls{lac} is used by the provider to tell the \gls{me} that it entered a new area and has to announce itself.
- \item Cell ID: The Cell ID is a globally unique identifier for the cell the \gls{ms} is connected to.
+ \item Cell ID: The Cell ID is a unique identifier for the cell the \gls{ms} is connected to.
+ Unique in this case means unique in a large area so that a mobile phone should never receive the same Cell ID for different base stations.
\item Neighbouring Cells: Each base station keeps a list of other base stations in the perimeter for the \gls{ms} to scan and determine if there is a \gls{bts} with a better reception in the area.
- \item Encryption: The encryption algorithm used to encrypt the voice data.
\end{itemize}
Note that there are different formats for the Neighbouring Cell List since the original number of 17 bytes could only present a bit mask for 124 neighbouring \glspl{arfcn}.
This works for the 900 MHz band, but for the extended 900\MHz and the 1800\MHz band the System Information Type 2bis and System Information Type 2ter have to be harvested additionally to construct the Neighbouring Cell List.
-%TODO:finish encryption
-Encryption cannot actually be read passively from a base station since the encryption algorithm is determined when a connection is established (finish paragraph on encryption when feature is finished).
+The \texttt{pch\_scan} tool does not rely on the \gls{bcch} but rather on information available on the \gls{pch} as the name implies.
+If a mobile phone is connected to a base station and not actively participating in a communication process, it is in a passive mode to save battery waiting for either the user to initiate communication or the network to contact it.
+As mentioned in Section \ref{sec:common_channels} the network contacts the \gls{ms} on the \gls{pch} if there is a text message or a call waiting to be delivered.
+\begin{figure}
+\centering
+\includegraphics{../Images/Paging}
+\caption{Procedure taken when the network has a call/text waiting for a passive subscriber.}
+\label{fig:paging}
+\end{figure}
+The procedure is outlined in Figure \ref{fig:paging}.
+A paging request by the network is answered by the \gls{ms} by requesting a dedicated channel, which is assigned by the network in turn with an \gls{ia}.
+From this point on the connection can be set up.
+
+The \texttt{pch\_scan} listens for activity on this channel and harvests the following information:
+\begin{itemize}
+ \item Pagings: Informs the \gls{icds} about every Paging Message that has been caught.
+ \item Immediate Assignment: If an \gls{ia} is caught, it is logged and parsed.
+ The \gls{tmsi} that got the \gls{ia} as well as the assigned channel number and whether it is a frequency hopping channel or not is forwarded to the \gls{icds}.
+\end{itemize}
\subsection{Information Evaluation}
\label{sec:info_evaluation}
Each base station is evaluated the moment the data completely arrived at the \gls{icds} application.
Additionally when a new \gls{bts} has been found and added all formerly discovered stations are also re-evaluated since new discoveries can have an impact on the rules that evaluate the context surrounding an old base station.
-As mentioned above, evaluation is done based on constructs called rules.
-Each rule represents one check that can be performed on a base station and yields a result based on its findings.
-A \emph{Critical} result means that the base station evaluated has a critical configuration error or critical settings that are not found on normal base stations, \eg unknown provider names or encryption that is turned off.
+As mentioned above, evaluation is done based on constructs called Rules.
+Each Rule represents one check that can be performed on a base station and yields a result based on its findings.
+A Rule can also be seen as a mapping from a set of input parameters to one of the values \emph{Critical}, \emph{Warning}, \emph{Ok}, \emph{Ignore}.
+\[\lbrace \text{Base station parameters}\rbrace \mapsto \lbrace \text{Ok}\lvert\text{Warning}\lvert\text{Critical}\lvert\text{Ignore}\rbrace\]
+
+A \emph{Critical} result means that the base station evaluated has a critical configuration error or critical settings that are not found on normal base stations, \eg unknown provider names or empty neighbourhood lists.
This station should not be trusted.
-If a \emph{Warning} status is yielded the \gls{bts} at hand has some concerning features but it could not be said whether it really is an IMSI catcher or sheer coincidence.
-An example would be a base station having a neighbouring cell list of which none of the cells therein have actually been found up to that point.
+If a \emph{Warning} status is yielded the \gls{bts} at hand has some concerning features but it could not be said whether it really is an IMSI catcher or sheer coincidence.
+An example would be a base station having a Neighbouring Cell List of which none of the cells therein have actually been found up to that point.
The list could either be a fake or it could simply be coincidence that the scan has not found any.
They could have been out of range for example.
@@ -220,9 +246,11 @@ This is the case for example when trying to find whether the base station uses e
If everything went as expected, \emph{Ok} is returned.
-These rules can be divided into two different categories depending on how they work and which situations they are tailored to.
+The Rules can be divided into four different categories depending on how they work and which situations they are tailored to.
Most of the rules are parametrised so they can be tweaked to different environments and standards.
+The different Rule categories are \emph{Configuration Rules}, \emph{Context Rules}, \emph{Databse Rules} and \emph{Scan Rules}.
+\subsubsection{Configuration Rules}
The first set of rules called \emph{Configuration Rules} targets the base station itself.
Rules in this category are meant to check parameters that concern the \gls{bts} for integrity and configuration mistakes that could have been made by an IMSI catcher operator.
An overview of which Configuration Rules are currently implemented inside the \gls{icds} is given in Table \ref{tab:config_rules}.
@@ -234,26 +262,31 @@ Rule &Functionality\\
\midrule
Provider Known &Checks whether the provider is in a list of known \\
&providers.\\
-Country/Provider Map &Checks whether the given provider is a valid provider\\
+Country\,/\,Provider Map &Checks whether the given provider is a valid provider\\
&for the given country.\\
-LAC/Provider Map &Checks whether the LAC of the station is in the normal\\
+LAC\,/\,Provider Map &Checks whether the LAC of the station is in the normal\\
&LAC range for that provider given the area.\\
-ARFCN/Provider Map &Checks whether the ARFCN is in the officially registered\\
+ARFCN\,/\,Provider Map &Checks whether the ARFCN is in the officially registered\\
&range of the provider.\\
-Encryption Algorithm &Checks which encryption algorithm is used.\\
\bottomrule
\end{tabular}
\caption{Configuration Rules implemented inside the ICDS.}
\label{tab:config_rules}
\end{table}
+
+A few things have to be noted when configuring these rules.
Since there is no official listing or rule how the \gls{lac} is derived the LAC/Provider Mapping Rule needs knowledge of the area in which the \gls{icds} is used.
The \gls{icds} itself can be used to gather that knowledge but it has to be done prior to using the rule for base station evaluation.
-The \gls{arfcn} range each provider has registered in Germany can be looked up at the website of the Bundesnetzagentur\footnote{Bundesnetzagentur Vergabeverfahren, \url{http://www.bundesnetzagentur.de/cln_1911/DE/Sachgebiete/Telekommunikation/RegulierungTelekommunikation/Frequenzordnung/OeffentlicherMobilfunk/VergabeVerfahrenDrahtlosNetzzugang/vergabeVerfahrenDrahtlosNetzzugang_node.html} [Online, Accessed 04.2012]} which is needed for the ARFCN /Provider Mapping Rule.
+The \gls{arfcn} range each provider has registered in Germany can be looked up at the website of the Bundesnetzagentur\footnote{Bundesnetzagentur Vergabeverfahren, \url{http://www.bundesnetzagentur.de/cln_1911/DE/Sachgebiete/Telekommunikation/RegulierungTelekommunikation/Frequenzordnung/OeffentlicherMobilfunk/VergabeVerfahrenDrahtlosNetzzugang/vergabeVerfahrenDrahtlosNetzzugang_node.html} [Online, Accessed 04.2012]} which is needed for the ARFCN\,/\,Provider Mapping Rule.
+
+The main problem at this point is that all the parameters that can be checked by these rules can also be set by the operator of the IMSI catcher.
+If these are set in a consistent way this set of rules is not sufficient to identify a catcher.
+Therefore another set of rules has to be added that incorporates information of the surrounding nodes.
-The second set of rules is called \emph{Context Rules}.
-As the name suggests these rules serve the purpose of checking how well a given \gls{bts} fits into its neighbourhood.
-Table \ref{tab:context_rules} shows which rules have been implemented.
-The Neighbourhood Structure Rule will be explained in a bit more detail in the next section.
+\subsubsection{Context Rules}
+The second set of Rules is called \emph{Context Rules}.
+As the name suggests these Rules serve the purpose of checking how well a given \gls{bts} fits into its neighbourhood.
+Table \ref{tab:context_rules} shows which Rules have been implemented.
\begin{table}
\centering
\begin{tabular}{ll}
@@ -271,38 +304,45 @@ Fully Discovered Nbhds. &Checks whether all the cells in the Neighbouring Cell\\
&List have actually been found.\\
Cell ID Uniqueness &Checks whether there are other cells with the same\\
&Cell ID.\\
-LAC Change &Checks whether the LAC changes in the course of a scan\\
-rx Change &Checks whether the reception level changed significantly\\
- &during the course of a scan\\
\bottomrule
\end{tabular}
\caption{Context Rules implemented inside the ICDS.}
\label{tab:context_rules}
\end{table}
-For the LAC the median was chosen over the average since if an extreme value (ill configured IMSI catcher) exists it would have a too strong impact on the average to which all the \gls{bts} are compared.
-It could even have such a strong effect on the average that legitimate base stations would fall below the threshold and be recognised as catchers.
-\subsubsection{Neighbourhood Structure}
-The neighbourhood structure is the graph that is described by the Neighbouring Cell List located in the System Inforamtion 2/bis/ter constructs.
-Figure \ref{fig:neighbourhood_example} shows an example of the neighbourhood graphs at the Technische Fakult\"at of the University of Freiburg\footnote{Georges Koehler Allee, Freiburg}.
+For the LAC Median Deviation the median was chosen over the average since an extreme value (ill configured IMSI catcher) would have too strong an impact on the average to which all the \gls{bts} are compared.
+It could even have such a strong effect on the average that legitimate base stations would fall below the threshold and be recognised as catchers.
+The threshold when a deviation is evaluated as being 'Critical' can be set in the configuration section for the Rule.
+A value of 0 would mean that no deviation from the median is allowed.
+This could lead to problems as some experimental scans have shown.
+However in none of the scans more than two different Location Areas have been found per provider and since these were neighbouring areas, the difference in the code was only 1.
+For the Freiburg area a 1\% threshold for the deviation yielded good results.
+
+\paragraph{Neighbourhood Structure}
+The neighbourhood structure is the graph that is described by the Neighbouring Cell List located in the System Inforamtion 2\,/\,2bis\,/\,2ter constructs.
+Figure \ref{fig:neighbourhood_example} shows an example of the neighbourhood graphs at the Faculty of Engineering of the University of Freiburg\footnote{Georges Koehler Allee, Freiburg}.
\begin{figure}
\centering
\includegraphics[width=.9\textwidth]{../Images/neighbourhoods_fak}
-\caption{Base stations and their neighbourhood connections at the Technische Fakult\"at.}
+\caption{Base stations and their neighbourhood connections at the Faculty of Engineering.}
\label{fig:neighbourhood_example}
\end{figure}
It can be seen that for each provider, the neighbourhood forms an isolated, nearly fully connected subgraph.
+Nodes with a green background have an \emph{Ok} rating, while the red node has a \emph{Critical} rating.
The bordering white nodes have not yet been discovered therefore they have no outgoing edges.
This could be the case because they are too far away for the Motorola to receive or because of signal damping due to shadowing and reflection effects.
In the \gls{icds} the aspect of isolated subgraphs for neighbourhoods is captured inside the \emph{Pure Neighbourhoods Rule}.
-An interesting fact is that one node inside the E-Plus subgraph on the upper right is marked red.
-This is because it is the \gls{bts} of the universities own \gls{gsm} network.
+
+An interesting fact is that one node inside the E-Plus subgraph on the upper right is marked \emph{Critical}.
+This is because it is a \gls{bts} of the universities own \gls{gsm} network.
It was set up to be in a E-Plus neighbourhood but is not consistent with the E-Plus nodes surrounding it.
Therefore it is marked by the \gls{icds}.
+The node was set up inside the E-Plus neighbourhood for another Master project\footnote{Cite Richy} at the Chair of Communication Systems where the goal was to estimate the most probably position of a subscriber given his\,/\,her reception strengths.
Some of the attacks discussed in Section \ref{sec:attacks} imply a certain structure of the neighbourhood graph.
-Since the IMSI catcher tries keep \glspl{ms} that have connected from switching back to a normal cell the neighbourhood list of such a catcher cell would either be empty or would only host neighbour cells that have a lower reception than itself.
-An empty neighbourhood list is represented in the graph by a node that has been discovered and has no outgoing edges.
+Since the IMSI catcher tries lock in \glspl{ms} that have connected from switching back to a normal cell, the neighbourhood list of such a catcher cell would either be empty or would only host neighbour cells that have a lower reception strength than itself.
+An empty Neighbouring Cell List is represented in the graph by a node that has been discovered and has no outgoing edges.
+A Neighbouring Cell list containing only imaginary nodes serves the same purpose.
\begin{figure}
\centering
\subfigure[Normal neighbourhood]{
@@ -328,8 +368,8 @@ An empty neighbourhood list is represented in the graph by a node that has been
\node[main node] (1) {A};
\node[main node] (2) [below left of=1] {B};
- \node[main node] (3) [below right of=1] {C};
- \node[main node] (4) [right of=1] {D};
+ \node[main node, fill=orange!20] (3) [below right of=1] {C};
+ \node[main node, fill=orange!20] (4) [right of=1] {D};
\path[every node/.style={font=\sffamily\small}]
(1) edge node {} (2)
@@ -345,74 +385,60 @@ An empty neighbourhood list is represented in the graph by a node that has been
\end{figure}
Figure \ref{fig:structure_comparison} shows a simplified regular neighbourhood graph compared to a graph with two catcher nodes inside.
In this case catcher C chose the attack where it replaces a previously existent \gls{bts} whereas catcher D opened up a new cell.
-Replacing has several advantages, one being already integrated in the neighbourhood of other nodes and thus being able to catch subscribers by handover.
+Replacing has several advantages, one being already integrated in the neighbourhood of other nodes.
+Mobile phones will constantly monitor the reception strength of all neighbouring nodes and thus also the reception strength of the IMSI catcher.
For catcher D it is the other way around, it has only outgoing edges.
This means that this cell is not known by any other node of the same provider (of course the catchers provider is fake!).
Nevertheless it has some outgoing edges to nodes with significantly less transmission strength to not stick out too much as a completely isolated node.
Combinations of these two approaches are also possible.
These thoughts are basically what is captured inside the \emph{Neighbourhood Structure Rule}.
-\subsubsection{Base Station Evaluation}
-As mentioned at the beginning, all the rules are evaluated for each base station.
-Aggregation of these rule results into a single result is done by modules called \emph{Evaluators}.
-Currently there are three different evaluators implemented inside the \gls{icds}, with varying degrees of customisability.
-\begin{itemize}
- \item Conservative Evaluator: This is a worst-case evaluator.
- It iterates over all the rule findings and yields the most concerning finding as its result.
- By default this evaluator is enabled in the system.
- \item Weighted Evaluator: Using this evaluator the user can give a weight to each rule.
- This way rules that are more important to the user can have a higher impact on overall evaluation.
- \item Grouped Evaluator: With this evaluator rules can be grouped together.
- Inside each group the result for the group is found by majority vote whereas the final result is conservatively found by comparing all the group results.
-\end{itemize}
-The different kinds of evaluators can be used to tweak the whole system more to a specific environment or purpose, if specific rules or groups of rules are given more weight.
-After a finding has been determined for each station, all the results are again aggregated into a final result.
-The overall result depends on which mode the \gls{icds} is used it.
-If it is used as analysis tool the final result will be a conservatively aggregated result over all the stations in the list.
-If the \gls{icds} is run in user mode, which is the mode an end user would use the system, the \gls{icds} looks up the provider the user has provided, filter out the base station with the best reception for that provider and yield its evaluation as final evaluation.
-This reflects the fact that a subscriber cannot choose the \gls{bts} it connects to but the \gls{me} will rather connect to the best base station available for its given provider.
-
-\subsection{Forged Parameters}
-\label{sec:fake_parameters}
-All of the parameters that have been looked at in this project so far are parameters that can directly be set by the operator of the \gls{bts} or IMSI catcher.
-This is a major problem since how can an IMSI catcher be found that sends exactly the same information as a regular base station?
-To further investigate this issue we will analyse based on the three attack types presented in Section \ref{sec:attacks} which parameters can be forged and which cannot.
-
-For all three attack types presented it is possible to find a parameter configuration that does not raise suspicion, if the operator chooses a compatible \gls{arfcn}, \etc for the mimicked provider.
-However if the IMSI catcher does not have a different \gls{lac} it will not notice that a subscriber has just connected to it, as long as the subscriber stays passive.
+\subsubsection{Database Rules}
+Let us do a quick summary of the situation so far.
+To investigate the current possibilities unveiling a catcher we will look over the parameters with the two attack types presented in Section \ref{sec:attacks} in mind.
+For both attack types presented it is possible to find a parameter configuration that does not raise suspicion, if the operator chooses a compatible \gls{arfcn}, \etc for the mimicked provider.
+Therefore the Configuration Rules and most of the Context Rules will yield an \emph{Ok} result.
The Neighbouring Cell List is a bit different.
Since the catcher wants to keep lured subscribers it will normally have an empty list or a list pointing only to \glspl{bts} that have a lower reception level.
Both of these cases can be detected.
However the operator \emph{may} also choose to set a list consistent with the neighbouring cells.
This would lower the chances of success for the catcher but also make it blend better in its environment and thus harder to detect.
-
-A sure criterion is the absence of an encryption algorithm which is needed by the catcher to record and monitor phone calls.
-The main problem here is that it cannot be guaranteed that this parameter can be harvested.
-Since this is a semi passive approach to harvesting it needs another subscriber to connect to the base station in question during the time the \gls{icds} is scanning it.
-Also if the IMSI catcher is only set up to do localisation, the encryption can be enabled.
-
-For the Cell ID there are basically two possibilities depending on which attack is used.
-The first possibility is that the IMSI catcher replaces a formerly existent cell and the second one is that it opens up a new cell.
-In the second case parameters can be chosen in a consistent way although a new Cell ID has to be chosen, as the Cell ID needs to be unique.
-In the first case all parameters can be copied from the original cell.
+
+For the \gls{cid} there are basically two possibilities depending on which attack is used.
+The first possibility is that the IMSI catcher opens up a new cell and the second one is that it replaces a formerly existent cell.
+In the first case parameters can be chosen in a consistent way although a new \gls{cid} has to be chosen, as the \gls{cid} needs to be unique.
+In the second case all parameters can be copied from the original cell.
Both possibilities can be resolved by adding outside knowledge to the \gls{icds} thus circumventing the problem of other parameters being forged.
This is done by rules called \emph{Database Rules}.
-\subsubsection{Database Rules}
-There are to different rules that each handles one of these cases.
+\begin{table}
+\centering
+\begin{tabular}{ll}
+\toprule
+Rule &Functionality\\
+\midrule
+Cell ID Database &Checks all CIDs in the area against a datbase.\\
+Local Area Databse &Checks whether the LAC of the given BTS deviates.\\
+\bottomrule
+\end{tabular}
+\caption{Database Rules implemented inside the ICDS.}
+\label{tab:database_rules}
+\end{table}
+
+Table \ref{tab:database_rules} rules that each handles one of these cases.
The first case is the easier of both.
-We know that the catcher cell has a new Cell ID that has not been there before.
-Therefore the \emph{Cell ID Databse Rule} has two different means to exploit this fact:
+We know that the catcher cell has a new \gls{cid} that has not been there before.
+Therefore the \emph{Cell ID Database Rule} has two different means to exploit this fact:
\begin{itemize}
- \item A database of Cell IDs can be learned by the \gls{icds} beforehand.
- This can be used to detect new Cell IDs that have not been seen before.
- \item A commercial Cell ID databse can be used to compare against the Cell IDs found by the \gls{icds}.
+ \item A database of \glspl{cid} can be learned by the \gls{icds} beforehand.
+ This can be used to detect new \glspl{cid} that have not been seen before.
+ \item A commercial \gls{cid} database can be used to compare against the \glspl{cid} found by the \gls{icds}.
A web service also offered by most providers of Cell ID databases.
\end{itemize}
The three largest Cell ID databases are the two commercial ones by Ericson\footnote{Ericson Labs, \url{https://labs.ericsson.com/apis/mobile-location/} [Online; Accessed 04.2012]} and combain\footnote{Mobile Positioning Solutions, \url{http://location-api.com/} [Online; Accessed 04.2012]} as well as the free alternative OpenCellID\footnote{OpenCellID, \url{http://www.opencellid.org/} [Online; Accessed 04.2012]} \cite{wiki_cells}.
Ericson and combain have trial modes, where the first 1000 requests are free for developers afterwards a subscription or a fee per request must be paid.
-Another free alternative with a large coverage is Google Mobile Maps, that also offers a web service where CellIDs and their respecitve \glspl{lai} can be checked against their database to obtain localisation information (or simply check if they are part of the database).
+Another free alternative with a large coverage is Google Mobile Maps, that also offers a web service where \glspl{cid} and their respective \glspl{lai} can be checked against their database to obtain localisation information (or simply check if they are part of the database).
By adding this information new cells can be identified.
The second where an existing cell is replaced is a bit more complicated since its parameters are an exact copy of the old cell.
@@ -422,49 +448,85 @@ The difference in reception can be used to identify this kind of attack.
In general the reception cannot be well used as a parameter because shadowing and reflection can substantially change the reception from one moment to the other.
However when reception intervals are logged for a fixed location like an office and important calls made from that specific location can be protected against this kind of attack.
To that end the \gls{icds} can monitor reception levels to build up databases with information about the reception intervals of the particular cells in different locations.
-The\emph{Location Area Databse Rule} then checks if reception levels differ significantly for a given location.
-If no database has been build beforehand but the \gls{icds} is stationary the \emph{rx Level Rule} can watch the reception level during the course of a scan and ensure that no change occured suddenly.
+The \emph{Local Area Database Rule} then checks if reception levels differ significantly for a given location.
+If no database has been build beforehand but the \gls{icds} is stationary the \emph{rx Level Rule} can watch the reception level during the course of a scan and ensure that no change occurred suddenly.
+
+\subsubsection{Scan Rules}
+\begin{table}
+\centering
+\begin{tabular}{ll}
+\toprule
+Rule &Functionality\\
+\midrule
+rx Change &Watches out for changes in reception.\\
+LAC Change &Watches out for changes in LACs.\\
+\bottomrule
+\end{tabular}
+\caption{Scan Rules implemented inside the ICDS.}
+\label{tab:scan_rules}
+\end{table}
+At this stage, if local information is present, an IMSI catcher should be identified with a high probability.
+However if local information has not been gethered in advance, the main idea of Database Rules can still be applied.
+In contrast to the other three categories of Rules mentioned before \emph{Scan Rules} evaluate parameters or better, parameter changes over time.
+This means parameters are being monitored over the duration of one or multiple sweep scans and changes are noted.
+The \emph{rx Change Rule} is basically the the same as the \emph{Local Area Database Rule} on a scan to scan basis.
+Changes in reception are evaluated against the last known reception level for each base station.
+
+When watching for parameter changes the \gls{lac} is another interesting parameter.
+If a mobile phone connects to an IMSI catcher due to its better reception level the mobile phone will not immediately announce itself thus the IMSI catcher has no knowledge that a new subscriber connected to it.
+A mobile phone announces itself by sending Location Updates to the network, this is only done when a certain timeout is reached or when the phone enters a new \gls{la}.
+Since this timeout can be very large (the lowest value possible is 6 minutes) an IMSI catcher usually sends another \gls{lac} than the original cell to force the \gls{ms} to announce itself by sending a Location Update.
+IMSI catchers showing this kind of behaviour are filtered out by the \emph{LAC Change Rule}
\subsubsection{Remaining Issues and Paging}
\label{sec:paging}
-At this stage, if local information is given an IMSI catcher should be identified with a high probability.
-However some issues still remain.
-If a catcher is configured in a consistent way, replaces a cell and by chance has an \emph{appropriate distance} from the subscriber that is its target, the \gls{icds} will not unveil it up to now.
-'Appropriate distance' in this case means that the distance is chosen in a way that the reception of the catcher on the \gls{icds} side resides inside the same bounds that were established for the base station it replaced.
-To identify such devices an extra source of information has to be added.
-
-If a mobile phone is connected to a base station and not actively participating in a communication process, it is in a passive mode to save battery waiting for either the user to initiate communication or the network to contact it.
-As mentioned in Section \ref{sec:log_channels} the network contacts the \gls{ms} on the \gls{pch} if there is a text message or a call waiting to be delivered.
-\begin{figure}
-\centering
-\includegraphics{../Images/Paging}
-\caption{Procedure taken when the network has a call/text waiting for a passive subscriber.}
-\label{fig:paging}
-\end{figure}
-The procedure is outlined in Figure \ref{fig:paging}.
-A paging request by the network is answered by the \gls{ms} by requesting a dedicated channel, which is assigned by the network in turn with an Immediate Assignment message.
-From this point on the connection can be set up.
+If a catcher is configured in a consistent way, replaces a cell and by chance has an \emph{appropriate distance} from the subscriber that is its target, the \gls{icds} will not unveil it up to now if it also chooses to maintain a non-suspicious neighbourhood list and shows the patience to wait for the \gls{ms} to announce itself, \eg not changing the \gls{lac}.
+\emph{Appropriate distance} in this case means that the distance is chosen in a way that the reception of the catcher does not differ significantly from the reception of the original base station.
-An IMSI catcher however is not part of a provider's network, it is merely a proxy for a base station.
+An IMSI catcher is not part of a provider's network, it is merely a proxy for a base station.
At best it can route calls into a network but it cannot take calls that are intended for a subscriber and route them.
-Therefore an IMSI catcher will not page connected subscribers while a normal base station will have a very high number of pagings depending on the number of subscribers that are connected.
+Therefore an IMSI catcher will not page connected subscribers while a normal base station will have a very high number of Pagings depending on the number of subscribers that are connected.
This is a significant difference between a catcher and a regular base station.
-Since the \gls{pch} can be accessed publicly the \gls{icds} can use it as a source for information.
-The \gls{pch} scan feature uses this finding, it tunes in to the \gls{pch} of a particular base station and scans the channel for a given amount of time, watching out for subscribers being paged and assigned channels.
-This is an additional feature that can be used to identify an IMSI catcher.
-It has not been implemented as a regular rule since each given base station needs some time to be scanned.
+This is an additional information that can be used to identify an IMSI catcher.
+\emph{PCH Scan} tunes the Motorola C123 to the \gls{pch} of a particular base station and gathers Paging Messages and \glspl{ia}.
+If no Paging Messages could be collected during longer period of scanning it is a strong indicator towards being confronted with an IMSI catcher.
+Additionally when \glspl{ia} are found the scan extracts whether the assigned channel is a frequency hopping channel or not.
+Since frequency hopping is considered a security feature by providers, all German providers always assign frequency hopping channels.
+An IMSI catcher however may not support hopping since it does not have multiple frequencies at hand.
+
+The \emph{PCH Scan} feature has not been implemented as a regular rule since each given base station needs some time to be scanned.
If that would be done on a regular basis for every station that has been discovered it would delay the whole scan by a large amount and the time difference between re-evaluations would be very high.
Therefore it was implemented as an extra feature to be used when needed.
-The \gls{icds} also uses this method on particularly filtered base stations in User Mode as will be explained later.
+The \gls{icds} also uses this method on particularly filtered base stations in \emph{User Mode} as will be explained in Section \ref{sec:user_mode}.
+\subsection{Base Station Evaluation}
+\label{sec:evaluators}
+All the rules are evaluated for each base station.
+Aggregation of these rule results into a single result is done by modules called \emph{Evaluators}.
+Currently there are three different evaluators implemented inside the \gls{icds}, with varying degrees of customisability.
+\begin{itemize}
+ \item Conservative Evaluator: This is a worst-case evaluator.
+ It iterates over all the rule findings and yields the most concerning finding as its result.
+ By default this evaluator is enabled in the system.
+ \item Weighted Evaluator: Using this evaluator the user can give a weight to each rule.
+ This way rules that are more important to the user can have a higher impact on overall evaluation.
+ \item Grouped Evaluator: With this evaluator rules can be grouped together.
+ Inside each group the result for the group is found by majority vote whereas the final result is conservatively found by comparing all the group results.
+\end{itemize}
+The different kinds of evaluators can be used to tweak the whole system more to a specific environment or purpose, if specific rules or groups of rules are given more weight.
+After a result has been determined for each station, all the results are again aggregated into a final result.
+The overall result depends on which mode the \gls{icds} is used in.
+If it is used as analysis tool the final result will be a conservatively aggregated result over all the stations in the list.
+If the \gls{icds} is run in \emph{User Mode}, which is the mode an end user would use the system in, the \gls{icds} looks up the provider the user has entered, filter out the base station with the best reception for that provider and yield its evaluation as final evaluation.
+This reflects the fact that a subscriber cannot choose the \gls{bts} it connects to, since the \gls{me} will always connect to the best base station available for its given provider.
-\section{IMSI Catcher Detection System}
+\section{Implementation}
\label{sec:icds}
This section will discuss some technical aspects of the \gls{icds} software itself.
The first section focuses on architectural aspects and how the architecture can be extended whereas the second and third section will then explain how to configure and operate the application.
-\subsection{Implemetation}
+\subsection{Architecture}
\begin{figure}
\centering
\includegraphics{../Images/Architecture_software}
@@ -473,11 +535,11 @@ The first section focuses on architectural aspects and how the architecture can
\end{figure}
Figure \ref{fig:architecture} shows a diagram describing the system architecture, the modules in light blue have been implemented for this project.
The application consists of two main parts.
-One part, the \texttt{catcher}, is implemented inside the OscmocomBB framework, the other part, \texttt{PyCatcher}, is a Python application that uses \texttt{catcher} to harvest information and evaluate it afterwards.
+One part, the \texttt{catcher}, is implemented inside the OsmocomBB framework, the other part, \texttt{PyCatcher}, is a Python application that uses \texttt{catcher} to harvest information and evaluate it afterwards.
Since the way \texttt{catcher} works has already been described in Section \ref{sec:info_gathering} this section will focus on the Python application part.
As mentioned before layer 1 of the \gls{gsm} stack is implemented in the firmware running on the Motorola C123.
-Layer 2 and 3 are implemented on the computer and are used by the \texttt{catcher} software to harvest information from the \gls{bcch}.
+Layer 2 and 3 are implemented on the computer and are used by the \texttt{catcher} and \texttt{pch\_scan} software to harvest information from the \gls{bcch}.
The \texttt{PyCatcher} application was designed with a \gls{mvc} approach in mind to make it easy to implement new functionality.
The \gls{mvc} pattern is used to separate the data model of an application from the logic as well as from the way it is presented to the user.
@@ -487,6 +549,7 @@ It takes the output back in and transforms it into an object oriented representa
These are then handed over and update the data model.
This way it can be ensured that only coherent and complete information is incorporated in the data model.
Another benefit is that the parsing module is isolated from the main program logic.
+\texttt{OsmoConnector} is also the module that spawns \texttt{pch\_scan} when requested by the \texttt{Controller}.
The \texttt{Controller} is the main part of the program and instantiates all the other modules.
It loads data from the model, triggers the evaluation and sends the results to the view to be displayed.
@@ -523,20 +586,21 @@ The configuration of the system is done in the file \texttt{settings.py}.
All configuration is done with python dictionaries, where each module has its own dictionary inside which it can have an arbitrary number of parameters with their respective values.
Figure \ref{fig:python_dict} shows an example with the two common cases used for parameters in this project.
-The file consists of three main sections.
+The file consists of five main sections.
The first one contains parameters that are needed for the correct operation of the \gls{icds} system and have to be edited:
\begin{itemize}
\item \texttt{Device\_settings}: The setting for the mobile phone that is used.
In case the Motorola C123 is used, this section does not need to be edited.
\item \texttt{Osmocom\_lib}: The path to the folder that contains the OsmocomBB framework.
- \item \texttt{Commands}: This is only to be edited when a newer version of the framework is used and the folder structure has changed since the release used in this project.s
+ \item \texttt{Commands}: This is only to be edited when a newer version of the framework is used and the folder structure has changed since the release used in this project.
\end{itemize}
-The second and last sections are parameters for the different rules and evaluators.
+The second and third sections contain parameters for the different rules and evaluators.
+This is followed by a section to set some general parameters for the \texttt{pch\_scan} tool and a section where the locations of the different databases can be changed.
A completely documented configuration file with all the rules and evaluator parameters can be found in Appendix \ref{sec:example_config}.
The file is read in as a python file.
This way python code can also be used to change settings dynamically depending on the environment or how the \gls{icds} is started.
-\subsection{Operation}
+\subsection{Graphical User Interface}
\label{sec:icds_operation}
The \gls{icds} main application has to be started with root privileges since it needs to work with Unix sockets and open up connections to the Motorola C123.
This should be done by starting up the \texttt{main} class that initialises everything else.
@@ -571,24 +635,25 @@ Available filters are:
These two filters can arbitrarily be combined together.
Filters are designed the same way as rules and evaluators, a new filter can be implemented by derivation of the base class.
-\item Rules Window: All the rules implemented inside the \gls{icds} will be brought up with a check box to enable or disable these rules.
+\item Rules Window: All the Rules implemented inside the \gls{icds} will be brought up with a check box to enable or disable these Rules.
Disabling means that they will not be considered for the evaluation of a base station.
A screenshot can be seen in Figure \ref{fig:rules_window}.
+If Rules are changed during a sweep scan, everything will be re-evaluated according to the new Rules set without interrupting the scan.
-\item Evaluator Window: This window will let the user choose which evaluator to use for \gls{bts} evaluation.
+\item Evaluator Window: This window will let the user choose which evaluator already discussed in Section \ref{sec:evaluators} to use for \gls{bts} evaluation.
Choosing a new evaluator will also trigger a re-evaluation of all the data collected so far.
\item Evaluation: This button brings up a separate window showing only the final evaluation of the scan.
The final evaluation shown in this dialog \emph{will} be affected by the filters set.
Base stations that are filtered out are not considered.
-\item Databases Window: The window shown in Figure \ref{fig:databases} contains settings for all the databases the \gls{icds} uses.
-These settings are mandatory if the Local Area Database Rule or the CellID Rule is going to be used.
-It is also possible here to export the current scan as a \gls{csv} file or sqlite database to be used in other programs.
+\item Databases Window: The window shown in Figure \ref{fig:databases_window} contains settings for all the databases the \gls{icds} uses.
+These settings are mandatory if the Local Area Database Rule or the Cell ID Rule is going to be used.
+It is also possible here to export the current scan as a \gls{csv} file or a Sqlite database to be used in other programs.
-\item Encryption Window: This button brings up a dialog in which an \gls{arfcn} or a list of \glspl{arfcn} can be scanned to discover which encryption is used by the \gls{bts}.
-A timeout for this operation can also be set here.
-The longer the timeout the more likely another subscriber will connect to the base station in the given time frame.
+\item PCH Scan Window: This button brings up a dialog in which an \gls{arfcn} or a list of \glspl{arfcn} can be scanned to discover Paging Messages and \glspl{ia} on the \glspl{pch}.
+The timeout sets the duration of a scan.
+Results of the scan will be shows in a list in the lower part of the window after the scan is finished.
\item Save/Load Project: The current state of the application can be saved as or loaded from a \texttt{.cpf} file.
This enables the user to continue a scan at a later time or to compare different data sets scanned at different points in time or locations with one another.
@@ -619,10 +684,15 @@ Zooming can also be done with the mouse wheel and it is possible to drag the gra
\subfigure[Filters window.]{\includegraphics[width=.4\textwidth]{../Images/filter_window}\label{fig:filters_window}}
\subfigure[PCH scan window.]{\includegraphics[width=.4\textwidth]{../Images/pch_window}\label{fig:pch_window}}
\caption{Dialogs for different settings.}
+\label{fig:dialogs}
\end{figure}
-The procedure of operation differs depending on the purpose.
-\paragraph{Sweep scans:} This is the normal mode of operation, scanning and evaluating all base stations in the perimeter.
+\subsection{Usage}
+\label{sec:user_mode}
+This section will list some common use cases and explain how to setup and operate the system to achieve the desired result.
+Button numbering refers back to Figure \ref{fig:icds} and Figure \ref{fig:dialogs}.
+
+\paragraph{Conducting sweep scans:} This is the normal mode of operation, scanning and evaluating all base stations in the perimeter.
This is also used for gathering various kinds of information to be used for analysis later.
At first the firmware needs to be flashed onto the device by pressing (1).
After the flashing process is finished the scan can be started by pressing (2).
@@ -632,37 +702,44 @@ Resuming the scan will renew the information in the Base Station List.
The scan will continue renewing information until it is terminated by the user.
The number of times a specific \gls{bts} has been scanned is shown in the \emph{Sightings} column of the Base Station List.
-\paragraph{CellID Information:} CellID information can be obtained through several different means.
-The Databases window shown in Figure \ref{fig:databases} can be brought up by pressing (7).
-In the upper part settings concerning the acquisition of CellIDs can be found.
+\paragraph{Using and obtaining Cell ID Information:} \gls{cid} information can be obtained through several different means.
+The Databases window shown in Figure \ref{fig:databases_window} can be brought up by pressing (7).
+In the upper part settings concerning the acquisition of \gls{cid} can be found.
The operator has the choice between three different methods which can also be used in combination.
\emph{Google Mobile Maps Service} compares the station's CellIDs and \glspl{lai} to the ones in the Google database.
If they are found they are marked as such and additionally their location information will be set.
\emph{OpenCellID Web Service} performs the same task if activated.
As of now OpenCellID has a very low coverage compared to Google's service but it has been included since it is an open source approach that is actively developed and updated constantly.
-The \emph{Use Local Databse} feature allows to use a previously build Location Area Database as CellID Database for lookups.
+The \emph{Use Local Databse} feature allows to use a previously build Location Area Database as \gls{cid} Database for lookups.
For this purpose the location to be used as database has to be entered in the textfield.
Offline lookups can be done that way, which are considerably faster that online lookups, the raw data used by the OpenCellID project can also be downloaded and used as a offline version for reference that way.
Since these lookups take some time if performed using webservices, this is not done while the scan is taking place, to not delay the acquisition of information from new base stations.
-Pressing the button below the checkboxes will add the CellID Database information from the selected sources to all the stations currently in the base station list.
+Pressing the button below the checkboxes will add the \gls{cid} Database information from the selected sources to all the stations currently in the base station list.
If more than one service is activated lookups will be done starting with the Google service, if active and using the next one in line only if the previous lookup failed.
-Having at least one service activated and run on the base station list is a precondition for the CellID Rule to work.
+Having at least one service activated and run on the base station list is a precondition for the \gls{cid} Rule to work.
-\paragraph{Location Area Database:} Having set up the correct location in the \emph{Current Location} field of the databases window and having a valid database for that location are preconditions for the Location Are Database Rule to work.
+\paragraph{Building or using a Local Area Database:} Having set up the correct location in the \emph{Current Location} field of the databases window and having a valid database for that location are preconditions for the Location Are Database Rule to work.
To build up a database for a specific location a sweep scan for this location has to be done.
After the sweep scan is finished, the current location has to be set in the dialog and the button for adding/updating the database has to be pressed.
If there was no existing database for that location it will be created, otherwise the database will be updated with the new information acquired by the sweep scan.
To raise the quality of a Location Area Database it is recommended to do multiple sweep scans and integrate them rather than to only rely on a single scan.
This raises the probability that all \gls{bts} in the perimeter are found is higher and it solidifies the interval in which the base station signal strength varies.
-\paragraph{PCH Scan:} A \gls{pch} scan can be conducted in addition to a sweep scan or as a standalone method therefore no scan data needs to be present.
+\paragraph{Conducting a PCH Scan:} A \gls{pch} scan can be conducted in addition to a sweep scan or as a standalone method therefore no scan data needs to be present.
If scan data is present however this feature will automatically augment the present data with its findings.
The first parameter is a comma separated list of \glspl{arfcn} that will be scanned.
The second parameter is the timeout.
A scan for a particular \gls{arfcn} will tune in on the \gls{pch} of each \gls{arfcn} given and wait there until the timeout is reached gathering all paging messages that occur during the time period.
In the lower part of the dialog, after the scan has finished, a number will be given for each base station of how many pagings occured on average in five seconds.
-\paragraph{User Mode:} Data needs to be present inside the \gls{icds} either by loading a project file for the corresponding location the system is used in or by having performed a sweep scan in advance.
+\begin{figure}
+\centering
+\includegraphics[width=.4\textwidth]{../Images/user_window}
+\caption{The User Mode window.}
+\label{fig:user_mode}
+\end{figure}
+
+\paragraph{Utilising User Mode:} Data needs to be present inside the \gls{icds} either by loading a project file for the corresponding location the system is used in or by having performed a sweep scan in advance.
There is only one input field in the dialog as Figure \ref{fig:user_mode} illustrates.
The user has to enter the provider name in this field and push the \emph{Start Evaluation} button.
From the scan data, the \gls{icds} extracts the base station with the highest reception for the given provider since this would be the station a \gls{ms} would connect to if started up.
@@ -697,8 +774,7 @@ Features that are already implemented are\cite{catcher_catcher}:
\end{itemize}
As one can see, missing encryption and reception of a silent text message are very strong indicators of being connected to a catcher.
This however comes at the cost of being discovered oneself.
-Additionally if the IMSI catcher is configured only to allow specific IMSI numbers an active approach cannot be used to evaluate it.
-A list of all the features that are planned can be found in Appendix \ref{sec:catcher_features}.
+Additionally if the IMSI catcher is configured only to allow specific IMSI numbers an active approach cannot be used to evaluate it.g
It is not clear whether the project has been abandoned since December 2012 or whether it is developed further.
Activity on the wiki has seized after December 2012. \ No newline at end of file
diff --git a/Tex/Content/Evaluation.tex b/Tex/Content/Evaluation.tex
index dd8464b..6651fda 100644
--- a/Tex/Content/Evaluation.tex
+++ b/Tex/Content/Evaluation.tex
@@ -118,6 +118,7 @@ Vodafone has about six times the paging rate O$_{2}$ has but only half the Immed
Another scan was also done on the IMSI catcher.
No Paging Messages or Immediate Assignments were detected although \glspl{ms} were connected to it.
That was to be expected as formerly discussed in Section \ref{sec:paging} because the IMSI catcher is not actually part of the providers network and thus cannot receive and forward paging requests.
+
\begin{table}
\centering
\begin{tabular}{lrrcrrcrr}
@@ -156,6 +157,8 @@ Figure \ref{fig:setup} shows the Open Source IMSI Catcher and the \gls{icds} sid
On the software side GNU Radio\footnote{GNU Radio Project Wiki, \url{http://gnuradio.org/redmine/projects/gnuradio/wiki} [Online; Accessed 05.2012]}, OpenBTS\footnote{OpenBTS Project Wiki, \url{http://wush.net/trac/rangepublic} [Online; Accessed 05.2012]} and Asterisk\footnote{Asterisk, \url{http://www.asterisk.org} [Online; Accessed 05.2012]} are used to achieve the functionality provided by a IMSI catcher.
\begin{figure}
+\centering
+\includegraphics[width=.95\textwidth]{../Images/catcherICDS}
\caption{Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}
\label{fig:setup}
\end{figure}
@@ -208,7 +211,7 @@ Only the test phone does have a valid account.
\subsubsection{Nokia 3310}
To get feedback on whether the IMSI catcher is working as intended or see if an attack succeeded a Nokia 3310 phone can be used.
-Nikia has a software called NetMonitor\footnote{ofo} that can be used to measure base stations in the perimeter and gives feedback when the \gls{ms} is going to switch to a new cell.
+Nikia has a software called NetMonitor\footnote{Nokia Net Monitor Manual, \url{www.nobbi.com/download/nmmanual.pdf} [Online; Accessed 05.2012]} that can be used to measure base stations in the perimeter and gives feedback when the \gls{ms} is going to switch to a new cell.
This NetMonitor consists of several pages, of which the first shows the active cell that the phone is connected to.
On the following pages neighbouring cell measurements can be seen ordered by a score that is used by the phone to determine when and if to change the cell.
Figure \ref{fig:netmonitor} shows the home screen with information on the connected cell (a) as well as the first page of the neighbouring cell measurements (b).
diff --git a/Tex/Content/GSM_short.tex b/Tex/Content/GSM_short.tex
index 6330dd2..1cf898b 100644
--- a/Tex/Content/GSM_short.tex
+++ b/Tex/Content/GSM_short.tex
@@ -405,7 +405,7 @@ Even though the number by itself seems high it would never suffice to service a
This is one of the reasons why another frequency band in the 1800\MHz range has been opened with 75\MHz up- and downlink supporting 375 channels.
That by itself would also never suffice to service the huge number of subscribers therefore the \gls{gsm} network like any other modern mobile radio network is based on a cellular architecture which makes it possible to reuse frequencies.
The range of one receiver station is drastically reduced to service only a small area.
-This is called the cell of the \gls{bts} which in theory can be approximated by a hexagon, each of which has its own \glspl{ci}.
+This is called the cell of the \gls{bts} which in theory can be approximated by a hexagon, each of which has its own \glspl{cid}.
Each of these cells is assigned a different frequency to avoid interference.
However after a certain distance, the frequency reuse distance $D$, is covered the exact same frequency can be used again by another \gls{bts}.
$D$ is chosen large enough so that interference doesn't have an impact on overall call quality.
@@ -444,7 +444,7 @@ On the countryside where population is less dense the constraining factor can al
Therefore cells with a radius of above 15\,km are seldom seen.
\glspl{bts} and their corresponding cells can have different configurations depending on load or morph structure of the surroundings.
-In a \emph{standard configuration} every base station has its own \gls{ci}, it is a one to one mapping of cells to \gls{bts}.
+In a \emph{standard configuration} every base station has its own \gls{cid}, it is a one to one mapping of cells to \gls{bts}.
This is a cost effective way of providing service to a rural or sparse settled area since only one \gls{bts} is used to cover a large area.
For urban, densely settled areas the \emph{sectorised configuration} has become the de facto standard.
The main idea is to not have a $360^\circ$ coverage for a base station handling a cell but rather split the cell in multiple sectors, each with its own \gls{bts} covering $120^\circ$ for example.
@@ -646,6 +646,7 @@ These are point to multi-point channels.
This channel will be the main source of information for this project since it allows harvesting information without actively participating in the network and will thus be discussed in further detail in Chapter \ref{sec:info_gathering}.
\item \gls{pch}: If a subscriber is not assigned a dedicated channel yet, \ie he/she is not active, they are notified on this channel if there is an incoming call or text.
The subscribers are identified by their \gls{tmsi} which has been previously assigned upon entering the network so the \gls{imsi} does not have to be broadcasted.
+ This channel will be used as an additional source of information for the \gls{icds}.
\item \gls{rach}: A subscriber that has been notified over the \gls{pch} can contact the network and request a \gls{sdcch}.
Since this is a channel used by all connected and idle \glspl{ms}, access has to be regulated.
As the name implies access is random thus it can happen that two or more \gls{ms} try to send at the same time.
diff --git a/Tex/Master/Glossary.tex b/Tex/Master/Glossary.tex
index b69843c..db7215c 100644
--- a/Tex/Master/Glossary.tex
+++ b/Tex/Master/Glossary.tex
@@ -35,7 +35,7 @@
\newacronym{pda}{PDA}{Personal Digital Assistant}
\newacronym{ki}{Ki}{Secret Key}
\newacronym{imsi}{IMSI}{International Mobile Subscriber Identification}
-\newacronym{kc}{Kc}{Cyphering Key}
+\newacronym{kc}{Kc}{Ciphering Key}
\newacronym{pin}{PIN}{Personal Identification Number}
\newacronym{eeprom}{EEPROM}{Electrically Erasable Programmable Read-Only Memory}
\newacronym{mcc}{MCC}{Mobile Country Code}
@@ -64,7 +64,7 @@
\newacronym{bts}{BTS}{Base Station Transceiver}
\newacronym{trau}{TRAU}{Transcoding Rate and Adaption Unit}
\newacronym{arfcn}{ARFCN}{Absolute Radio Frequency Number}
-\newacronym{ci}{CI}{Cell Identity}
+\newacronym{cid}{CID}{Cell Identity}
\newacronym{sdcch}{SDCCH}{Standalone Dedicated Control Channel}
\newacronym{agch}{AGCH}{Access Grand Channel}
\newacronym{pch}{PCH}{Paging Channel}
@@ -101,4 +101,5 @@
\newacronym{mvc}{MVC}{Model View Controller}
\newacronym{csv}{CSV}{Comma Separated Value}
\newacronym{usrp}{USRP}{Universal Software Radio Peripheral}
-\newacronym{voip}{VoIP}{Voice over IP} \ No newline at end of file
+\newacronym{voip}{VoIP}{Voice over IP}
+\newacronym{ia}{IA}{Immediate Assignment Message} \ No newline at end of file
diff --git a/Tex/Master/Master.acn b/Tex/Master/Master.acn
index 347cfc0..492e0fc 100644
--- a/Tex/Master/Master.acn
+++ b/Tex/Master/Master.acn
@@ -14,8 +14,8 @@
\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter{page}\glsnumberformat}{5}
\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter{page}\glsnumberformat}{5}
\glossaryentry{DCS1800?\glossaryentryfield{dcs1800}{\glsnamefont{DCS1800}}{Digital Cellular System 1800}{\relax }|setentrycounter{page}\glsnumberformat}{5}
-\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter{page}\glsnumberformat}{6}
-\glossaryentry{STC?\glossaryentryfield{stc}{\glsnamefont{STC}}{Sub Technical Committee}{\relax }|setentrycounter{page}\glsnumberformat}{6}
+\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter{page}\glsnumberformat}{5}
+\glossaryentry{STC?\glossaryentryfield{stc}{\glsnamefont{STC}}{Sub Technical Committee}{\relax }|setentrycounter{page}\glsnumberformat}{5}
\glossaryentry{ETSI?\glossaryentryfield{etsi}{\glsnamefont{ETSI}}{European Communication Standards Institute}{\relax }|setentrycounter{page}\glsnumberformat}{6}
\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter{page}\glsnumberformat}{6}
\glossaryentry{ARIB?\glossaryentryfield{arib}{\glsnamefont{ARIB}}{Association of Radio Industries and Businesses}{\relax }|setentrycounter{page}\glsnumberformat}{6}
@@ -23,7 +23,7 @@
\glossaryentry{ATIS?\glossaryentryfield{atis}{\glsnamefont{ATIS}}{Alliance for Telecommunications Industry Solutions}{\relax }|setentrycounter{page}\glsnumberformat}{6}
\glossaryentry{TTA?\glossaryentryfield{tta}{\glsnamefont{TTA}}{Telecommunications Technology Association}{\relax }|setentrycounter{page}\glsnumberformat}{6}
\glossaryentry{TTC?\glossaryentryfield{ttc}{\glsnamefont{TTC}}{Telecommunications Technology Committee}{\relax }|setentrycounter{page}\glsnumberformat}{6}
-\glossaryentry{ITU?\glossaryentryfield{itu}{\glsnamefont{ITU}}{International Telecomunication Union}{\relax }|setentrycounter{page}\glsnumberformat}{7}
+\glossaryentry{ITU?\glossaryentryfield{itu}{\glsnamefont{ITU}}{International Telecomunication Union}{\relax }|setentrycounter{page}\glsnumberformat}{6}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{7}
\glossaryentry{GPRS?\glossaryentryfield{gprs}{\glsnamefont{GPRS}}{General Packet Radio Service}{\relax }|setentrycounter{page}\glsnumberformat}{7}
\glossaryentry{EDGE?\glossaryentryfield{edge}{\glsnamefont{EDGE}}{Enhanced Data Rates for GSM Evolution}{\relax }|setentrycounter{page}\glsnumberformat}{7}
@@ -41,7 +41,7 @@
\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{7}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{7}
\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{7}
-\glossaryentry{PSTN?\glossaryentryfield{pstn}{\glsnamefont{PSTN}}{Public Standard Telephone Network}{\relax }|setentrycounter{page}\glsnumberformat}{8}
+\glossaryentry{PSTN?\glossaryentryfield{pstn}{\glsnamefont{PSTN}}{Public Standard Telephone Network}{\relax }|setentrycounter{page}\glsnumberformat}{7}
\glossaryentry{IN?\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{8}
\glossaryentry{VAS?\glossaryentryfield{vas}{\glsnamefont{VAS}}{value-added service}{\relax }|setentrycounter{page}\glsnumberformat}{8}
\glossaryentry{IN?\glossaryentryfield{in}{\glsnamefont{IN}}{Intelligent Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{8}
@@ -68,26 +68,26 @@
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{9}
\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{9}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{9}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{10}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{10}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{10}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{9}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{9}
\glossaryentry{EEPROM?\glossaryentryfield{eeprom}{\glsnamefont{EEPROM}}{Electrically Erasable Programmable Read-Only Memory}{\relax }|setentrycounter{page}\glsnumberformat}{10}
-\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Cyphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
-\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Cyphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
-\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Cyphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{PIN?\glossaryentryfield{pin}{\glsnamefont{PIN}}{Personal Identification Number}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{MSIN?\glossaryentryfield{msin}{\glsnamefont{MSIN}}{Mobile Subscriber Identification Number}{\relax }|setentrycounter{page}\glsnumberformat}{10}
-\glossaryentry{HNI?\glossaryentryfield{hni}{\glsnamefont{HNI}}{Home Network Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{11}
-\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
-\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{HNI?\glossaryentryfield{hni}{\glsnamefont{HNI}}{Home Network Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{10}
+\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
@@ -107,11 +107,11 @@
\glossaryentry{SMSC?\glossaryentryfield{smsc}{\glsnamefont{SMSC}}{Short Message Service Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{EIR?\glossaryentryfield{eir}{\glsnamefont{EIR}}{Equipment Identity Register}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{11}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{12}
-\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{12}
-\glossaryentry{ISDN?\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }|setentrycounter{page}\glsnumberformat}{12}
-\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter{page}\glsnumberformat}{12}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{ISDN?\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{12}
\glossaryentry{CC?\glossaryentryfield{cc}{\glsnamefont{CC}}{Call Control}{\relax }|setentrycounter{page}\glsnumberformat}{12}
\glossaryentry{MM?\glossaryentryfield{mm}{\glsnamefont{MM}}{Mobility Management}{\relax }|setentrycounter{page}\glsnumberformat}{12}
@@ -128,9 +128,9 @@
\glossaryentry{MSISDN?\glossaryentryfield{msisdn}{\glsnamefont{MSISDN}}{Mobile Subscriber Integrated Services Digital Network Number}{\relax }|setentrycounter{page}\glsnumberformat}{12}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{12}
\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{12}
-\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{MSRN?\glossaryentryfield{msrn}{\glsnamefont{MSRN}}{Mobile Station Roaming Number}{\relax }|setentrycounter{page}\glsnumberformat}{13}
+\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{MSRN?\glossaryentryfield{msrn}{\glsnamefont{MSRN}}{Mobile Station Roaming Number}{\relax }|setentrycounter{page}\glsnumberformat}{12}
\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{13}
@@ -147,29 +147,29 @@
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{13}
\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Cyphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{15}
@@ -183,19 +183,19 @@
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{16}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{16}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{17}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{17}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{17}
-\glossaryentry{CI?\glossaryentryfield{ci}{\glsnamefont{CI}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{17}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{16}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{16}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{16}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{16}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{17}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{17}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{17}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{CI?\glossaryentryfield{ci}{\glsnamefont{CI}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
@@ -210,26 +210,26 @@
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{AGCH?\glossaryentryfield{agch}{\glsnamefont{AGCH}}{Access Grand Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{AGCH?\glossaryentryfield{agch}{\glsnamefont{AGCH}}{Access Grand Channel}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{19}
@@ -238,14 +238,14 @@
\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Cyphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{20}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
-\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{20}
@@ -254,22 +254,22 @@
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{21}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{21}
-\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{21}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{21}
-\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{21}
-\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{21}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{22}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{22}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{22}
-\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{22}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{22}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{22}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{22}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
@@ -287,12 +287,12 @@
\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
-\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{24}
-\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{24}
+\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{24}
-\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
-\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
-\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{24}
+\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{24}
+\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{24}
\glossaryentry{SACCH?\glossaryentryfield{sacch}{\glsnamefont{SACCH}}{Slow Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
@@ -306,35 +306,36 @@
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{25}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{25}
-\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{AGCH?\glossaryentryfield{agch}{\glsnamefont{AGCH}}{Access Grand Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{AGCH?\glossaryentryfield{agch}{\glsnamefont{AGCH}}{Access Grand Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
\glossaryentry{ITU?\glossaryentryfield{itu}{\glsnamefont{ITU}}{International Telecomunication Union}{\relax }|setentrycounter{page}\glsnumberformat}{26}
\glossaryentry{GMSK?\glossaryentryfield{gmsk}{\glsnamefont{GMSK}}{Gaussian Minimum Shift Keying}{\relax }|setentrycounter{page}\glsnumberformat}{26}
\glossaryentry{HDLC?\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{SS-7?\glossaryentryfield{ss7}{\glsnamefont{SS-7}}{Signaling System 7}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{HDLC?\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{ISDN?\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{MTP 2/SS7?\glossaryentryfield{mtp2}{\glsnamefont{MTP 2/SS7}}{Message Transfer Part 2/SS7}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{SS-7?\glossaryentryfield{ss7}{\glsnamefont{SS-7}}{Signaling System 7}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{HDLC?\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{ISDN?\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{MTP 2/SS7?\glossaryentryfield{mtp2}{\glsnamefont{MTP 2/SS7}}{Message Transfer Part 2/SS7}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter{page}\glsnumberformat}{26}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{27}
@@ -356,8 +357,8 @@
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{28}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{28}
@@ -366,13 +367,13 @@
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{28}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
-\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{30}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
@@ -389,15 +390,15 @@
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{31}
@@ -408,8 +409,11 @@
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{32}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{33}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{33}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{33}
\glossaryentry{Osmocom?\glossaryentryfield{osmo}{\glsnamefont{Osmocom}}{Open source mobile communications}{\relax }|setentrycounter{page}\glsnumberformat}{33}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{33}
+\glossaryentry{Osmocom?\glossaryentryfield{osmo}{\glsnamefont{Osmocom}}{Open source mobile communications}{\relax }|setentrycounter{page}\glsnumberformat}{33}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{33}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{33}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{33}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{33}
@@ -424,10 +428,12 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{36}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{36}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{36}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{37}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{37}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{37}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{37}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{37}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{37}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{37}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{37}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{37}
@@ -435,8 +441,8 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{37}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{37}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{37}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{37}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{37}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{38}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{38}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{38}
\glossaryentry{FCCH?\glossaryentryfield{fcch}{\glsnamefont{FCCH}}{Frequency Correction Channel}{\relax }|setentrycounter{page}\glsnumberformat}{38}
\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{38}
@@ -455,7 +461,7 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{38}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{38}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{38}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{38}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{BSIC?\glossaryentryfield{bsic}{\glsnamefont{BSIC}}{Base Station Identification Code}{\relax }|setentrycounter{page}\glsnumberformat}{40}
@@ -473,167 +479,191 @@
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{40}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{40}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{40}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{41}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{41}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{41}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{41}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{41}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{41}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{41}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{41}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{41}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{41}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{41}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{42}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{42}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{42}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{43}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{43}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{43}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{43}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{43}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{43}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{45}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{46}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{47}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{47}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{47}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{47}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{47}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{47}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{47}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{47}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{48}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{48}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{48}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{48}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{49}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{49}
-\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{49}
-\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{49}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{50}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{50}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{50}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{52}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{51}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
-\glossaryentry{CSV?\glossaryentryfield{csv}{\glsnamefont{CSV}}{Comma Separated Value}{\relax }|setentrycounter{page}\glsnumberformat}{52}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{52}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{52}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{52}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{53}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{53}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{53}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{53}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{53}
-\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{55}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{55}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{55}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{55}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{55}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{55}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{55}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{56}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{57}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{59}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{59}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{59}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{59}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{59}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{60}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{60}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{60}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{CSV?\glossaryentryfield{csv}{\glsnamefont{CSV}}{Comma Separated Value}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{53}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{56}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{56}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{56}
+\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{56}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{56}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{56}
+\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{56}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{61}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{62}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{62}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{62}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{62}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{62}
-\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{62}
-\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{62}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{63}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{63}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{VoIP?\glossaryentryfield{voip}{\glsnamefont{VoIP}}{Voice over IP}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{63}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{65}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{65}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{65}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{65}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{65}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{65}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{66}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{64}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{64}
+\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{64}
+\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{64}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{64}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{64}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{64}
+\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{USRP?\glossaryentryfield{usrp}{\glsnamefont{USRP}}{Universal Software Radio Peripheral}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{VoIP?\glossaryentryfield{voip}{\glsnamefont{VoIP}}{Voice over IP}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{65}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{66}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{67}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{67}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{67}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{67}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{67}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{67}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{67}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{67}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{68}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{68}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{71}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{71}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{71}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{71}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{71}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{71}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{71}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{71}
-\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{73}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{69}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{70}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{71}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{71}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{73}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{73}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{73}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
-\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{73}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{73}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{73}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{73}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{75}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{75}
diff --git a/Tex/Master/Master.aux b/Tex/Master/Master.aux
index 33b9104..2d4ca48 100644
--- a/Tex/Master/Master.aux
+++ b/Tex/Master/Master.aux
@@ -74,101 +74,101 @@
\citation{hsdpa}
\citation{hsupa}
\citation{kommsys2006}
+\citation{ITU1200}
\FN@pp@footnote@aux{1}{7}
\@writefile{toc}{\contentsline {section}{\numberline {2.2}The GSM Network}{7}}
\newlabel{sec:network}{{2.2}{7}}
-\citation{ITU1200}
\citation{GSM2009}
\citation{overview1994}
\citation{overview1996}
\@writefile{lof}{\contentsline {figure}{\numberline {2.2}{\ignorespaces The main components of a GSM network.}}{8}}
\newlabel{fig:gsm_network}{{2.2}{8}}
\FN@pp@footnote@aux{2}{8}
+\@writefile{toc}{\contentsline {subsection}{\numberline {2.2.1}Mobile Station}{8}}
+\newlabel{sec:ms}{{2.2.1}{8}}
\citation{GSM0207}
\citation{protocols1999}
\citation{ISO7810}
-\@writefile{toc}{\contentsline {subsection}{\numberline {2.2.1}Mobile Station}{9}}
-\newlabel{sec:ms}{{2.2.1}{9}}
-\FN@pp@footnote@aux{3}{9}
-\FN@pp@footnote@aux{4}{9}
\citation{protocols1999}
\citation{protocols1999}
+\FN@pp@footnote@aux{3}{9}
+\FN@pp@footnote@aux{4}{9}
\citation{kommsys2006}
\citation{GSM23003}
+\citation{ITU212}
\@writefile{lot}{\contentsline {table}{\numberline {2.1}{\ignorespaces Subset of data stored on a SIM card. Adopted from \cite {protocols1999}}}{10}}
\newlabel{tab:simdata}{{2.1}{10}}
-\citation{ITU212}
\@writefile{lot}{\contentsline {table}{\numberline {2.2}{\ignorespaces Mobile Country and Network Codes. (R) denotes that the MCC is reserved but not operational as of yet, whereas (T) denotes a operational test network.}}{11}}
\newlabel{tab:countrycodes}{{2.2}{11}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2.2}Network Subsystem}{11}}
\newlabel{sec:nss}{{2.2.2}{11}}
-\@writefile{toc}{\contentsline {subsubsection}{Mobile Switching Center}{12}}
+\@writefile{toc}{\contentsline {subsubsection}{Mobile Switching Center}{11}}
\@writefile{toc}{\contentsline {subsubsection}{Home Location Register}{12}}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.3}{\ignorespaces Authentication procedure.}}{13}}
+\newlabel{fig:authentication}{{2.3}{13}}
\@writefile{toc}{\contentsline {subsubsection}{Visitor Location Register}{13}}
-\@writefile{toc}{\contentsline {subsubsection}{Authentication Center}{13}}
-\newlabel{sec:authentication}{{2.2.2}{13}}
-\FN@pp@footnote@aux{5}{13}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.3}{\ignorespaces Authentication procedure.}}{14}}
-\newlabel{fig:authentication}{{2.3}{14}}
\citation{kommsys2006}
\citation{kommsys2006}
+\@writefile{toc}{\contentsline {subsubsection}{Authentication Center}{14}}
+\newlabel{sec:authentication}{{2.2.2}{14}}
+\FN@pp@footnote@aux{5}{14}
+\citation{kommsys2006}
+\citation{kommsys2006}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.4}{\ignorespaces Mapping of functional entities on the 900\tmspace +\thinmuskip {.1667em}MHz\ band.}}{15}}
+\newlabel{fig:frequency}{{2.4}{15}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2.3}Base Station Subsystem}{15}}
\newlabel{sec:bss}{{2.2.3}{15}}
\@writefile{toc}{\contentsline {subsubsection}{Frequencies and the Cellular Principle}{15}}
-\citation{kommsys2006}
-\citation{kommsys2006}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.4}{\ignorespaces Mapping of functional entities on the 900\tmspace +\thinmuskip {.1667em}MHz\ band.}}{16}}
-\newlabel{fig:frequency}{{2.4}{16}}
+\citation{GSM2009}
\@writefile{lot}{\contentsline {table}{\numberline {2.3}{\ignorespaces Frequencies in the different bands \cite {kommsys2006}.}}{16}}
\newlabel{tab:frequencies}{{2.3}{16}}
-\citation{GSM2009}
\citation{protocols1999}
\citation{GSM2009}
\citation{GSM2009}
\citation{kommsys2006}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.5}{\ignorespaces Theoretical arrangement of radio cells compared to a realistic alignment. Cells with the same number share the same frequency \cite {GSM2009}.}}{17}}
+\newlabel{fig:cells}{{2.5}{17}}
\@writefile{toc}{\contentsline {subsubsection}{Base Transceiver Station}{17}}
\citation{kommsys2006}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.5}{\ignorespaces Theoretical arrangement of radio cells compared to a realistic alignment. Cells with the same number share the same frequency \cite {GSM2009}.}}{18}}
-\newlabel{fig:cells}{{2.5}{18}}
\@writefile{toc}{\contentsline {subsubsection}{Base Station Controller}{18}}
\citation{kommsys2006}
\citation{kommsys2006}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.6}{\ignorespaces Ciphering procedure for one frame of voice data. Adopted from \cite {kommsys2006}.}}{19}}
+\newlabel{fig:cypher}{{2.6}{19}}
\citation{protocols1999}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.6}{\ignorespaces Ciphering procedure for one frame of voice data. Adopted from \cite {kommsys2006}.}}{20}}
-\newlabel{fig:cypher}{{2.6}{20}}
\@writefile{toc}{\contentsline {section}{\numberline {2.3}The $U_m$ Interface}{20}}
\newlabel{sec:Um}{{2.3}{20}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3.1}Radio Transmission}{20}}
\newlabel{sec:radio}{{2.3.1}{20}}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.7}{\ignorespaces The combination of FDMA and TDMA.}}{21}}
-\newlabel{fig:fdma_tdma}{{2.7}{21}}
-\@writefile{toc}{\contentsline {subsubsection}{Frame Numbering}{21}}
\citation{GSM2009}
\citation{GSM2009}
\citation{GSM2009}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.7}{\ignorespaces The combination of FDMA and TDMA.}}{21}}
+\newlabel{fig:fdma_tdma}{{2.7}{21}}
+\@writefile{toc}{\contentsline {subsubsection}{Frame Numbering}{21}}
+\@writefile{toc}{\contentsline {subsubsection}{Burst Types}{21}}
\@writefile{lof}{\contentsline {figure}{\numberline {2.8}{\ignorespaces Hierarchical composition of the different frames.}}{22}}
\newlabel{fig:frame_hierarchy}{{2.8}{22}}
-\@writefile{toc}{\contentsline {subsubsection}{Burst Types}{22}}
-\@writefile{lof}{\contentsline {figure}{\numberline {2.9}{\ignorespaces Structural Comparison of different Burst types. After \cite {GSM2009}.}}{23}}
-\newlabel{fig:burst_types}{{2.9}{23}}
+\@writefile{lof}{\contentsline {figure}{\numberline {2.9}{\ignorespaces Structural Comparison of different Burst types. After \cite {GSM2009}.}}{22}}
+\newlabel{fig:burst_types}{{2.9}{22}}
\citation{kommsys2006}
\@writefile{lof}{\contentsline {figure}{\numberline {2.10}{\ignorespaces Mapping of virtual channels on time slots.}}{24}}
\newlabel{fig:channels}{{2.10}{24}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3.2}Logical Channels}{24}}
\newlabel{sec:channels}{{2.3.2}{24}}
-\@writefile{toc}{\contentsline {subsubsection}{Dedicated Channels}{25}}
+\@writefile{toc}{\contentsline {subsubsection}{Dedicated Channels}{24}}
+\citation{gsm0502}
\@writefile{toc}{\contentsline {subsubsection}{Common Channels}{25}}
\newlabel{sec:common_channels}{{2.3.2}{25}}
-\citation{gsm0502}
\citation{protocols1999}
\citation{GSM0405}
\citation{GSM0406}
+\citation{protocols1999}
\@writefile{toc}{\contentsline {subsubsection}{Combinations}{26}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3.3}Layers}{26}}
\newlabel{sec:layers}{{2.3.3}{26}}
\@writefile{toc}{\contentsline {paragraph}{Physical Layer (Layer 1):}{26}}
\@writefile{toc}{\contentsline {paragraph}{Data Link (Layer 2):}{26}}
-\citation{protocols1999}
\citation{fox}
\citation{imsi_wiki}
\citation{fox}
@@ -178,11 +178,13 @@
\citation{def_catcher}
\citation{fox}
\citation{def_catcher}
+\citation{mueller}
\@writefile{toc}{\contentsline {paragraph}{Network (Layer 3):}{27}}
\@writefile{toc}{\contentsline {section}{\numberline {2.4}IMSI-Catcher}{27}}
\newlabel{sec:catcher}{{2.4}{27}}
\citation{mueller}
\citation{mueller}
+\citation{fox}
\citation{mueller}
\citation{fox}
\@writefile{lof}{\contentsline {figure}{\numberline {2.11}{\ignorespaces A commercial catcher by Rhode \& Schwarz \cite {fox} and a self built catcher introduced at Defcon 2010 \cite {def_catcher}.}}{28}}
@@ -191,26 +193,24 @@
\newlabel{sec:catcher_operation}{{2.4.1}{28}}
\@writefile{lof}{\contentsline {figure}{\numberline {2.12}{\ignorespaces IMSI catching procedure. Adopted and simplified from \cite {mueller}.}}{29}}
\newlabel{fig:catcher_catch}{{2.12}{29}}
-\citation{mueller}
-\citation{fox}
\citation{dennis}
\citation{imsi_wiki}
+\citation{fox}
\@writefile{toc}{\contentsline {subsubsection}{Attacks}{30}}
\newlabel{sec:attacks}{{2.4.1}{30}}
\@writefile{toc}{\contentsline {paragraph}{MS is in normal cell selection mode:}{30}}
\@writefile{toc}{\contentsline {paragraph}{MS is already connected to a network:}{30}}
\citation{fox}
-\citation{fox}
\citation{imsi_wiki}
+\citation{criminal_justice}
\@writefile{toc}{\contentsline {subsubsection}{Risks and Irregularities}{31}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.4.2}Law Situation in Germany}{31}}
\newlabel{sec:catcher_law}{{2.4.2}{31}}
-\citation{criminal_justice}
\FN@pp@footnotehinttrue
\citation{dennis}
\citation{osmo_rationale}
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {3}IMSI Catcher Detection}{33}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {3}IMSI Catcher Detection System}{33}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
@@ -235,8 +235,6 @@
\@writefile{lof}{\contentsline {figure}{\numberline {3.2}{\ignorespaces Interaction of the OsmocomBB components with the ICDS software.}}{37}}
\newlabel{fig:osmo_setup}{{3.2}{37}}
\@writefile{toc}{\contentsline {section}{\numberline {3.2}Procedure}{37}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{37}}
-\newlabel{sec:info_gathering}{{3.2.1}{37}}
\citation{GSM2009}
\citation{GSM2009}
\citation{protocols1999}
@@ -244,128 +242,144 @@
\citation{protocols1999}
\@writefile{lot}{\contentsline {table}{\numberline {3.2}{\ignorespaces Type Codes and the corresponding System Information Types \cite {GSM2009}.}}{38}}
\newlabel{tab:tc_mapping}{{3.2}{38}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 1 Message \cite {protocols1999}.}}{39}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{38}}
+\newlabel{sec:info_gathering}{{3.2.1}{38}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 2 Message \cite {protocols1999}.}}{39}}
\newlabel{fig:si1}{{3.3}{39}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{40}}
-\newlabel{sec:info_evaluation}{{3.2.2}{40}}
-\@writefile{lot}{\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{41}}
-\newlabel{tab:config_rules}{{3.3}{41}}
-\@writefile{lot}{\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{42}}
-\newlabel{tab:context_rules}{{3.4}{42}}
-\FN@pp@footnote@aux{10}{42}
-\@writefile{toc}{\contentsline {subsubsection}{Neighbourhood Structure}{42}}
-\FN@pp@footnote@aux{11}{43}
-\@writefile{toc}{\contentsline {subsubsection}{Base Station Evaluation}{43}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.4}{\ignorespaces Base stations and their neighbourhood connections at the Technische Fakult\"at.}}{44}}
-\newlabel{fig:neighbourhood_example}{{3.4}{44}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.5}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{44}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Normal neighbourhood}}}{44}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Tainted neighbourhood}}}{44}}
-\newlabel{fig:structure_comparison}{{3.5}{44}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Forged Parameters}{45}}
-\newlabel{sec:fake_parameters}{{3.2.3}{45}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.4}{\ignorespaces Procedure taken when the network has a call/text waiting for a passive subscriber.}}{41}}
+\newlabel{fig:paging}{{3.4}{41}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{41}}
+\newlabel{sec:info_evaluation}{{3.2.2}{41}}
+\@writefile{lot}{\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{42}}
+\newlabel{tab:config_rules}{{3.3}{42}}
+\@writefile{toc}{\contentsline {subsubsection}{Configuration Rules}{42}}
+\@writefile{lot}{\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{43}}
+\newlabel{tab:context_rules}{{3.4}{43}}
+\FN@pp@footnote@aux{10}{43}
+\@writefile{toc}{\contentsline {subsubsection}{Context Rules}{43}}
+\@writefile{toc}{\contentsline {paragraph}{Neighbourhood Structure}{44}}
+\FN@pp@footnote@aux{11}{44}
+\FN@pp@footnote@aux{12}{44}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.5}{\ignorespaces Base stations and their neighbourhood connections at the Faculty of Engineering.}}{45}}
+\newlabel{fig:neighbourhood_example}{{3.5}{45}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.6}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{45}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Normal neighbourhood}}}{45}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Tainted neighbourhood}}}{45}}
+\newlabel{fig:structure_comparison}{{3.6}{45}}
\citation{wiki_cells}
+\@writefile{lot}{\contentsline {table}{\numberline {3.5}{\ignorespaces Database Rules implemented inside the ICDS.}}{46}}
+\newlabel{tab:database_rules}{{3.5}{46}}
\@writefile{toc}{\contentsline {subsubsection}{Database Rules}{46}}
-\FN@pp@footnote@aux{12}{46}
\FN@pp@footnote@aux{13}{46}
-\FN@pp@footnote@aux{14}{46}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.6}{\ignorespaces Procedure taken when the network has a call/text waiting for a passive subscriber.}}{47}}
-\newlabel{fig:paging}{{3.6}{47}}
-\@writefile{toc}{\contentsline {subsubsection}{Remaining Issues and Paging}{47}}
-\newlabel{sec:paging}{{3.2.3}{47}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{48}}
-\newlabel{fig:architecture}{{3.7}{48}}
-\@writefile{toc}{\contentsline {section}{\numberline {3.3}IMSI Catcher Detection System}{48}}
-\newlabel{sec:icds}{{3.3}{48}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Implemetation}{48}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{49}}
-\newlabel{sec:configuration}{{3.3.2}{49}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{50}}
-\newlabel{fig:python_dict}{{3.8}{50}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Operation}{50}}
-\newlabel{sec:icds_operation}{{3.3.3}{50}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{51}}
-\newlabel{fig:icds}{{3.9}{51}}
-\@writefile{toc}{\contentsline {paragraph}{Sweep scans:}{53}}
-\newlabel{fig:databases_window}{{3.10(a)}{54}}
-\newlabel{sub@fig:databases_window}{{(a)}{54}}
-\newlabel{fig:rules_window}{{3.10(b)}{54}}
-\newlabel{sub@fig:rules_window}{{(b)}{54}}
-\newlabel{fig:filters_window}{{3.10(c)}{54}}
-\newlabel{sub@fig:filters_window}{{(c)}{54}}
-\newlabel{fig:pch_window}{{3.10(d)}{54}}
-\newlabel{sub@fig:pch_window}{{(d)}{54}}
-\@writefile{lof}{\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{54}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Databases window.}}}{54}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Rules window.}}}{54}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Filters window.}}}{54}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {PCH scan window.}}}{54}}
-\@writefile{toc}{\contentsline {paragraph}{CellID Information:}{55}}
-\@writefile{toc}{\contentsline {paragraph}{Location Area Database:}{55}}
-\@writefile{toc}{\contentsline {paragraph}{PCH Scan:}{55}}
+\@writefile{lot}{\contentsline {table}{\numberline {3.6}{\ignorespaces Scan Rules implemented inside the ICDS.}}{47}}
+\newlabel{tab:scan_rules}{{3.6}{47}}
+\FN@pp@footnote@aux{14}{47}
+\FN@pp@footnote@aux{15}{47}
+\@writefile{toc}{\contentsline {subsubsection}{Scan Rules}{47}}
+\@writefile{toc}{\contentsline {subsubsection}{Remaining Issues and Paging}{48}}
+\newlabel{sec:paging}{{3.2.2}{48}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Base Station Evaluation}{49}}
+\newlabel{sec:evaluators}{{3.2.3}{49}}
+\@writefile{toc}{\contentsline {section}{\numberline {3.3}Implementation}{49}}
+\newlabel{sec:icds}{{3.3}{49}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Architecture}{49}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{50}}
+\newlabel{fig:architecture}{{3.7}{50}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{51}}
+\newlabel{fig:python_dict}{{3.8}{51}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{51}}
+\newlabel{sec:configuration}{{3.3.2}{51}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{52}}
+\newlabel{fig:icds}{{3.9}{52}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Graphical User Interface}{52}}
+\newlabel{sec:icds_operation}{{3.3.3}{52}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.4}Usage}{54}}
+\newlabel{sec:user_mode}{{3.3.4}{54}}
+\newlabel{fig:databases_window}{{3.10(a)}{55}}
+\newlabel{sub@fig:databases_window}{{(a)}{55}}
+\newlabel{fig:rules_window}{{3.10(b)}{55}}
+\newlabel{sub@fig:rules_window}{{(b)}{55}}
+\newlabel{fig:filters_window}{{3.10(c)}{55}}
+\newlabel{sub@fig:filters_window}{{(c)}{55}}
+\newlabel{fig:pch_window}{{3.10(d)}{55}}
+\newlabel{sub@fig:pch_window}{{(d)}{55}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{55}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Databases window.}}}{55}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Rules window.}}}{55}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(c)}{\ignorespaces {Filters window.}}}{55}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(d)}{\ignorespaces {PCH scan window.}}}{55}}
+\newlabel{fig:dialogs}{{3.10}{55}}
+\@writefile{toc}{\contentsline {paragraph}{Conducting sweep scans:}{56}}
+\@writefile{toc}{\contentsline {paragraph}{Using and obtaining Cell ID Information:}{56}}
+\@writefile{toc}{\contentsline {paragraph}{Building or using a Local Area Database:}{56}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.11}{\ignorespaces The User Mode window.}}{57}}
+\newlabel{fig:user_mode}{{3.11}{57}}
+\@writefile{toc}{\contentsline {paragraph}{Conducting a PCH Scan:}{57}}
+\@writefile{toc}{\contentsline {paragraph}{Utilising User Mode:}{57}}
\citation{catcher_catcher}
-\@writefile{toc}{\contentsline {paragraph}{User Mode:}{56}}
-\@writefile{toc}{\contentsline {section}{\numberline {3.4}Related Projects}{56}}
-\FN@pp@footnote@aux{15}{56}
+\@writefile{toc}{\contentsline {section}{\numberline {3.4}Related Projects}{58}}
+\FN@pp@footnote@aux{16}{58}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{59}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{61}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {4.1}Performance Evaluation}{59}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{59}}
-\newlabel{tab:key_data}{{4.1}{59}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{60}}
-\newlabel{fig:durations}{{4.1}{60}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{60}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in s for fetching the information.}}{61}}
-\newlabel{tab:coverage}{{4.2}{61}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{61}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{61}}
+\@writefile{toc}{\contentsline {section}{\numberline {4.1}Performance Evaluation}{61}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{61}}
+\newlabel{tab:key_data}{{4.1}{61}}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{62}}
+\newlabel{fig:durations}{{4.1}{62}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{62}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in s for fetching the information.}}{63}}
+\newlabel{tab:coverage}{{4.2}{63}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{63}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{63}}
\citation{dennis}
-\@writefile{lot}{\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Pagings and Immediate Assignments (per 10\tmspace +\thickmuskip {.2777em}s) for the four German providers at different locations.}}{62}}
-\newlabel{tab:pagings}{{4.3}{62}}
-\@writefile{toc}{\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{62}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{62}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{63}}
-\newlabel{fig:setup}{{4.2}{63}}
-\FN@pp@footnote@aux{16}{63}
-\FN@pp@footnote@aux{17}{63}
-\FN@pp@footnote@aux{18}{63}
-\@writefile{toc}{\contentsline {subsubsection}{Nokia 3310}{63}}
-\FN@pp@footnote@aux{19}{63}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{64}}
-\newlabel{fig:openbts_parameters}{{4.3}{64}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.4}{\ignorespaces Nokia 3310 NetMonitor screenshots.}}{64}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Connected cell information.}}}{64}}
-\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Neighbouring cell measurements.}}}{64}}
-\newlabel{fig:netmonitor}{{4.4}{64}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{65}}
-\newlabel{tab:err_configs}{{4.4}{65}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{65}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces failzor}}{66}}
-\newlabel{tab:par_change}{{4.5}{66}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{66}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long term evaluation.}}{67}}
-\newlabel{tab:longterm_test}{{4.6}{67}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{67}}
-\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher as a new Cell}{67}}
-\@writefile{lot}{\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{68}}
-\newlabel{tab:consistent_parameters}{{4.7}{68}}
-\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{68}}
-\@writefile{lof}{\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{69}}
-\newlabel{fig:takeover_attack}{{4.5}{69}}
-\FN@pp@footnotehinttrue
-\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{71}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Pagings and Immediate Assignments (per 10\tmspace +\thickmuskip {.2777em}s) for the four German providers at different locations.}}{64}}
+\newlabel{tab:pagings}{{4.3}{64}}
+\@writefile{toc}{\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{64}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{64}}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{65}}
+\newlabel{fig:setup}{{4.2}{65}}
+\FN@pp@footnote@aux{17}{65}
+\FN@pp@footnote@aux{18}{65}
+\FN@pp@footnote@aux{19}{65}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{66}}
+\newlabel{fig:openbts_parameters}{{4.3}{66}}
+\@writefile{toc}{\contentsline {subsubsection}{Nokia 3310}{66}}
+\FN@pp@footnote@aux{20}{66}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.4}{\ignorespaces Nokia 3310 NetMonitor screenshots.}}{67}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Connected cell information.}}}{67}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Neighbouring cell measurements.}}}{67}}
+\newlabel{fig:netmonitor}{{4.4}{67}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{67}}
+\newlabel{tab:err_configs}{{4.4}{67}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{67}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.5}{\ignorespaces failzor}}{68}}
+\newlabel{tab:par_change}{{4.5}{68}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{68}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long term evaluation.}}{69}}
+\newlabel{tab:longterm_test}{{4.6}{69}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{69}}
+\@writefile{lot}{\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{70}}
+\newlabel{tab:consistent_parameters}{{4.7}{70}}
+\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher as a new Cell}{70}}
+\@writefile{toc}{\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{70}}
+\@writefile{lof}{\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{71}}
+\newlabel{fig:takeover_attack}{{4.5}{71}}
+\FN@pp@footnotehinttrue
+\FN@pp@footnotehinttrue
+\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{73}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {5.1}Summary}{71}}
-\@writefile{lof}{\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{72}}
-\newlabel{fig:decision_process}{{5.1}{72}}
-\@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{73}}
+\@writefile{toc}{\contentsline {section}{\numberline {5.1}Summary}{73}}
+\@writefile{lof}{\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{74}}
+\newlabel{fig:decision_process}{{5.1}{74}}
+\@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{75}}
+\FN@pp@footnotehinttrue
+\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\bibstyle{acm}
\citation{*}
@@ -384,9 +398,7 @@
\bibcite{fox}{12}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\FN@pp@footnotehinttrue
-\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{Bibliography}{75}}
+\@writefile{toc}{\contentsline {chapter}{Bibliography}{77}}
\bibcite{GSM_stats2011}{13}
\bibcite{GSM_history2011}{14}
\bibcite{osmo_slides}{15}
@@ -394,76 +406,78 @@
\bibcite{protocols1999}{17}
\bibcite{hsdpa}{18}
\bibcite{hsupa}{19}
-\bibcite{osmo_rationale}{20}
+\bibcite{osmo_c123}{20}
\bibcite{osmo_wiki_c123}{21}
-\bibcite{criminal_justice}{22}
-\bibcite{kommsys2006}{23}
-\bibcite{overview1996}{24}
-\bibcite{def_catcher}{25}
-\bibcite{ITU1200}{26}
-\bibcite{ITU212}{27}
-\bibcite{dennis}{28}
-\bibcite{wiki_cells}{29}
-\bibcite{blacklisting}{30}
+\bibcite{osmo_rationale}{22}
+\bibcite{criminal_justice}{23}
+\bibcite{kommsys2006}{24}
+\bibcite{overview1996}{25}
+\bibcite{def_catcher}{26}
+\bibcite{ITU1200}{27}
+\bibcite{ITU212}{28}
+\bibcite{dennis}{29}
+\bibcite{wiki_cells}{30}
\bibcite{imsi_wiki}{31}
+\bibcite{blacklisting}{32}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {A}GSM}{79}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {A}GSM}{81}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {A.1}Interfaces}{79}}
-\newlabel{sec:interfaces}{{A.1}{79}}
-\@writefile{lot}{\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{79}}
-\@writefile{toc}{\contentsline {section}{\numberline {A.2}Channel Combinations}{80}}
-\newlabel{sec:combinations}{{A.2}{80}}
-\@writefile{lot}{\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{80}}
+\@writefile{toc}{\contentsline {section}{\numberline {A.1}Interfaces}{81}}
+\newlabel{sec:interfaces}{{A.1}{81}}
+\@writefile{lot}{\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{81}}
+\@writefile{toc}{\contentsline {section}{\numberline {A.2}Channel Combinations}{82}}
+\newlabel{sec:combinations}{{A.2}{82}}
+\@writefile{lot}{\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{82}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {B}OsmocomBB}{81}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {B}OsmocomBB}{83}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {B.1}Installation}{81}}
-\newlabel{sec:osmo_install}{{B.1}{81}}
-\@writefile{toc}{\contentsline {section}{\numberline {B.2}Usage}{82}}
-\newlabel{sec:osmo_usage}{{B.2}{82}}
-\@writefile{toc}{\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{83}}
-\newlabel{sec:osmo_serial_schematics}{{B.3}{83}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.1}Installation}{83}}
+\newlabel{sec:osmo_install}{{B.1}{83}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.2}Usage}{84}}
+\newlabel{sec:osmo_usage}{{B.2}{84}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{85}}
+\newlabel{sec:osmo_serial_schematics}{{B.3}{85}}
+\FN@pp@footnote@aux{21}{85}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{85}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{87}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {C.1}Extextions}{85}}
-\newlabel{sec:extensions}{{C.1}{85}}
-\@writefile{toc}{\contentsline {section}{\numberline {C.2}Example Configuration}{86}}
-\newlabel{sec:example_config}{{C.2}{86}}
+\@writefile{toc}{\contentsline {section}{\numberline {C.1}Extextions}{87}}
+\newlabel{sec:extensions}{{C.1}{87}}
+\@writefile{toc}{\contentsline {section}{\numberline {C.2}Example Configuration}{89}}
+\newlabel{sec:example_config}{{C.2}{89}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {D}System Information}{89}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {D}System Information}{93}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\newlabel{sec:system_infos}{{D}{89}}
+\newlabel{sec:system_infos}{{D}{93}}
\FN@pp@footnotehinttrue
-\@writefile{lof}{\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{90}}
-\@writefile{lof}{\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{91}}
-\@writefile{lof}{\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{92}}
-\@writefile{lof}{\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{93}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{94}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{95}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{96}}
+\@writefile{lof}{\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{97}}
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {E}Evaluation Data}{95}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {E}Evaluation Data}{99}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{95}}
-\newlabel{sec_lac_change_test}{{E.1}{95}}
-\@writefile{toc}{\contentsline {section}{\numberline {E.2}Long Term Test}{95}}
-\newlabel{sec:long_term_test}{{E.2}{95}}
+\@writefile{toc}{\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{99}}
+\newlabel{sec_lac_change_test}{{E.1}{99}}
+\@writefile{toc}{\contentsline {section}{\numberline {E.2}Long Term Test}{99}}
+\newlabel{sec:long_term_test}{{E.2}{99}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{Acronyms}{97}}
+\@writefile{toc}{\contentsline {chapter}{Acronyms}{101}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\gdef \LT@i {\LT@entry
diff --git a/Tex/Master/Master.bbl b/Tex/Master/Master.bbl
index 82d9772..b3d29f3 100644
--- a/Tex/Master/Master.bbl
+++ b/Tex/Master/Master.bbl
@@ -107,12 +107,17 @@ Medium access control (mac) protocol specification.
\newblock 3GPP TS 25.321,
\url{http://www.3gpp.org/ftp/Specs/html-info/25321.htm}, 2011.
-\bibitem{osmo_rationale}
+\bibitem{osmo_c123}
+{\sc OsmocomBB}.
+\newblock Motorola c123.
+\newblock \url{http://en.wikipedia.org/wiki/Cell_ID}, 2012.
+
+\bibitem{osmo_wiki_c123}
{\sc OsmocomBB}.
\newblock Project rationale.
\newblock \url{http://bb.osmocom.org/trac/wiki/ProjectRationale}, 2012.
-\bibitem{osmo_wiki_c123}
+\bibitem{osmo_rationale}
{\sc OsmocomBB}.
\newblock Project rationale.
\newblock \url{http://bb.osmocom.org/trac/wiki/ProjectRationale}, 2012.
@@ -159,15 +164,15 @@ enbau-1048919.html}, 2010.
\newblock Cell id.
\newblock \url{http://bb.osmocom.org/trac/wiki/MotorolaC123}, 2012.
-\bibitem{blacklisting}
+\bibitem{imsi_wiki}
{\sc Wikipedia}.
\newblock Equipment identity register.
-\newblock
- \url{http://en.wikipedia.org/wiki/Central_Equipment_Identity_Register}, 2012.
+\newblock \url{http://de.wikipedia.org/wiki/IMSI-Catcher}, 2012.
-\bibitem{imsi_wiki}
+\bibitem{blacklisting}
{\sc Wikipedia}.
\newblock Equipment identity register.
-\newblock \url{http://de.wikipedia.org/wiki/IMSI-Catcher}, 2012.
+\newblock
+ \url{http://en.wikipedia.org/wiki/Central_Equipment_Identity_Register}, 2012.
\end{thebibliography}
diff --git a/Tex/Master/Master.blg b/Tex/Master/Master.blg
index c64dd09..c95e783 100644
--- a/Tex/Master/Master.blg
+++ b/Tex/Master/Master.blg
@@ -2,60 +2,57 @@ This is BibTeX, Version 0.99c (TeX Live 2009/Debian)
The top-level auxiliary file: Master.aux
The style file: acm.bst
Database file #1: ../Content/Bibliography.bib
-Repeated entry---line 205 of file ../Content/Bibliography.bib
- : @misc{osmo_rationale
- : ,
-I'm skipping whatever remains of this entry
+Warning--I didn't find a database entry for "catcher_catcher"
Warning--to sort, need author or key in GSM0207
-Warning--to sort, need author or key in GSM0505
Warning--to sort, need author or key in ISO7810
Warning--to sort, need author or key in GSM23003
-Warning--to sort, need author or key in GSM23078
Warning--to sort, need author or key in gsm0502
Warning--to sort, need author or key in GSM0405
Warning--to sort, need author or key in GSM0406
+Warning--to sort, need author or key in GSM0505
+Warning--to sort, need author or key in GSM23078
Warning--can't use both author and editor fields in GSM2009
Warning--empty journal in mueller
Warning--empty journal in dennis
-You've used 31 entries,
+You've used 32 entries,
2253 wiz_defined-function locations,
- 686 strings with 7735 characters,
-and the built_in function-call counts, 6426 in all, are:
-= -- 615
-> -- 170
+ 690 strings with 7814 characters,
+and the built_in function-call counts, 6640 in all, are:
+= -- 635
+> -- 177
< -- 0
-+ -- 80
-- -- 48
-* -- 328
-:= -- 973
-add.period$ -- 80
-call.type$ -- 31
-change.case$ -- 118
++ -- 83
+- -- 50
+* -- 336
+:= -- 1008
+add.period$ -- 83
+call.type$ -- 32
+change.case$ -- 122
chr.to.int$ -- 0
-cite$ -- 42
-duplicate$ -- 257
-empty$ -- 699
-format.name$ -- 48
-if$ -- 1424
+cite$ -- 43
+duplicate$ -- 265
+empty$ -- 722
+format.name$ -- 50
+if$ -- 1471
int.to.chr$ -- 0
-int.to.str$ -- 31
+int.to.str$ -- 32
missing$ -- 14
-newline$ -- 145
-num.names$ -- 38
-pop$ -- 207
+newline$ -- 150
+num.names$ -- 40
+pop$ -- 215
preamble$ -- 1
-purify$ -- 90
+purify$ -- 93
quote$ -- 0
-skip$ -- 201
+skip$ -- 208
stack$ -- 0
-substring$ -- 247
-swap$ -- 49
+substring$ -- 252
+swap$ -- 51
text.length$ -- 0
text.prefix$ -- 0
top$ -- 0
-type$ -- 118
+type$ -- 122
warning$ -- 11
-while$ -- 46
-width$ -- 33
-write$ -- 282
-(There was 1 error message)
+while$ -- 48
+width$ -- 34
+write$ -- 292
+(There were 12 warnings)
diff --git a/Tex/Master/Master.ist b/Tex/Master/Master.ist
index b6c1147..4153d4d 100644
--- a/Tex/Master/Master.ist
+++ b/Tex/Master/Master.ist
@@ -1,5 +1,5 @@
% makeindex style file created by the glossaries package
-% for document 'Master' on 2012-5-30
+% for document 'Master' on 2012-5-31
actual '?'
encap '|'
level '!'
diff --git a/Tex/Master/Master.lof b/Tex/Master/Master.lof
index b78bf5d..e3fcc68 100644
--- a/Tex/Master/Master.lof
+++ b/Tex/Master/Master.lof
@@ -3,49 +3,50 @@
\addvspace {10\p@ }
\contentsline {figure}{\numberline {2.1}{\ignorespaces Growth of mobile GSM subscriptions. Compiled from \cite {GSM2009,GSM_history2011,GSM_stats2011}}}{6}
\contentsline {figure}{\numberline {2.2}{\ignorespaces The main components of a GSM network.}}{8}
-\contentsline {figure}{\numberline {2.3}{\ignorespaces Authentication procedure.}}{14}
-\contentsline {figure}{\numberline {2.4}{\ignorespaces Mapping of functional entities on the 900\tmspace +\thinmuskip {.1667em}MHz\ band.}}{16}
-\contentsline {figure}{\numberline {2.5}{\ignorespaces Theoretical arrangement of radio cells compared to a realistic alignment. Cells with the same number share the same frequency \cite {GSM2009}.}}{18}
-\contentsline {figure}{\numberline {2.6}{\ignorespaces Ciphering procedure for one frame of voice data. Adopted from \cite {kommsys2006}.}}{20}
+\contentsline {figure}{\numberline {2.3}{\ignorespaces Authentication procedure.}}{13}
+\contentsline {figure}{\numberline {2.4}{\ignorespaces Mapping of functional entities on the 900\tmspace +\thinmuskip {.1667em}MHz\ band.}}{15}
+\contentsline {figure}{\numberline {2.5}{\ignorespaces Theoretical arrangement of radio cells compared to a realistic alignment. Cells with the same number share the same frequency \cite {GSM2009}.}}{17}
+\contentsline {figure}{\numberline {2.6}{\ignorespaces Ciphering procedure for one frame of voice data. Adopted from \cite {kommsys2006}.}}{19}
\contentsline {figure}{\numberline {2.7}{\ignorespaces The combination of FDMA and TDMA.}}{21}
\contentsline {figure}{\numberline {2.8}{\ignorespaces Hierarchical composition of the different frames.}}{22}
-\contentsline {figure}{\numberline {2.9}{\ignorespaces Structural Comparison of different Burst types. After \cite {GSM2009}.}}{23}
+\contentsline {figure}{\numberline {2.9}{\ignorespaces Structural Comparison of different Burst types. After \cite {GSM2009}.}}{22}
\contentsline {figure}{\numberline {2.10}{\ignorespaces Mapping of virtual channels on time slots.}}{24}
\contentsline {figure}{\numberline {2.11}{\ignorespaces A commercial catcher by Rhode \& Schwarz \cite {fox} and a self built catcher introduced at Defcon 2010 \cite {def_catcher}.}}{28}
\contentsline {figure}{\numberline {2.12}{\ignorespaces IMSI catching procedure. Adopted and simplified from \cite {mueller}.}}{29}
\addvspace {10\p@ }
\contentsline {figure}{\numberline {3.1}{\ignorespaces Circuit board of the Motorola C123 with its components \cite {osmo_wiki_c123}.}}{36}
\contentsline {figure}{\numberline {3.2}{\ignorespaces Interaction of the OsmocomBB components with the ICDS software.}}{37}
-\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 1 Message \cite {protocols1999}.}}{39}
-\contentsline {figure}{\numberline {3.4}{\ignorespaces Base stations and their neighbourhood connections at the Technische Fakult\"at.}}{44}
-\contentsline {figure}{\numberline {3.5}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{44}
-\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Normal neighbourhood}}}{44}
-\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Tainted neighbourhood}}}{44}
-\contentsline {figure}{\numberline {3.6}{\ignorespaces Procedure taken when the network has a call/text waiting for a passive subscriber.}}{47}
-\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{48}
-\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{50}
-\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{51}
-\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{54}
-\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Databases window.}}}{54}
-\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Rules window.}}}{54}
-\contentsline {subfigure}{\numberline {(c)}{\ignorespaces {Filters window.}}}{54}
-\contentsline {subfigure}{\numberline {(d)}{\ignorespaces {PCH scan window.}}}{54}
-\addvspace {10\p@ }
-\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{60}
-\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{63}
-\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{64}
-\contentsline {figure}{\numberline {4.4}{\ignorespaces Nokia 3310 NetMonitor screenshots.}}{64}
-\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Connected cell information.}}}{64}
-\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Neighbouring cell measurements.}}}{64}
-\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{69}
-\addvspace {10\p@ }
-\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{72}
-\addvspace {10\p@ }
-\addvspace {10\p@ }
-\addvspace {10\p@ }
-\addvspace {10\p@ }
-\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{90}
-\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{91}
-\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{92}
-\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{93}
+\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 2 Message \cite {protocols1999}.}}{39}
+\contentsline {figure}{\numberline {3.4}{\ignorespaces Procedure taken when the network has a call/text waiting for a passive subscriber.}}{41}
+\contentsline {figure}{\numberline {3.5}{\ignorespaces Base stations and their neighbourhood connections at the Faculty of Engineering.}}{45}
+\contentsline {figure}{\numberline {3.6}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{45}
+\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Normal neighbourhood}}}{45}
+\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Tainted neighbourhood}}}{45}
+\contentsline {figure}{\numberline {3.7}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{50}
+\contentsline {figure}{\numberline {3.8}{\ignorespaces Configuration Dictionary in the settings file.}}{51}
+\contentsline {figure}{\numberline {3.9}{\ignorespaces The ICDS main window.}}{52}
+\contentsline {figure}{\numberline {3.10}{\ignorespaces Dialogs for different settings.}}{55}
+\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Databases window.}}}{55}
+\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Rules window.}}}{55}
+\contentsline {subfigure}{\numberline {(c)}{\ignorespaces {Filters window.}}}{55}
+\contentsline {subfigure}{\numberline {(d)}{\ignorespaces {PCH scan window.}}}{55}
+\contentsline {figure}{\numberline {3.11}{\ignorespaces The User Mode window.}}{57}
+\addvspace {10\p@ }
+\contentsline {figure}{\numberline {4.1}{\ignorespaces Scan durations for the sample data sets.}}{62}
+\contentsline {figure}{\numberline {4.2}{\ignorespaces Open Source IMSI Catcher (left) with USRP (black) and external clock (blue) and the ICDS (right) with the Motorola C123 connected.}}{65}
+\contentsline {figure}{\numberline {4.3}{\ignorespaces Excerpt of a \texttt {OpenBTS.conf}.}}{66}
+\contentsline {figure}{\numberline {4.4}{\ignorespaces Nokia 3310 NetMonitor screenshots.}}{67}
+\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Connected cell information.}}}{67}
+\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Neighbouring cell measurements.}}}{67}
+\contentsline {figure}{\numberline {4.5}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{71}
+\addvspace {10\p@ }
+\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{74}
+\addvspace {10\p@ }
+\addvspace {10\p@ }
+\addvspace {10\p@ }
+\addvspace {10\p@ }
+\contentsline {figure}{\numberline {D.1}{\ignorespaces System Information 1 Message}}{94}
+\contentsline {figure}{\numberline {D.2}{\ignorespaces System Information 2 Message}}{95}
+\contentsline {figure}{\numberline {D.3}{\ignorespaces System Information 3 Message}}{96}
+\contentsline {figure}{\numberline {D.4}{\ignorespaces System Information 4 Message}}{97}
\addvspace {10\p@ }
diff --git a/Tex/Master/Master.log b/Tex/Master/Master.log
index 01f3a03..199423c 100644
--- a/Tex/Master/Master.log
+++ b/Tex/Master/Master.log
@@ -1,4 +1,4 @@
-This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 30 MAY 2012 16:18
+This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 31 MAY 2012 21:15
entering extended mode
%&-line parsing enabled.
**Master.tex
@@ -875,7 +875,20 @@ File: pgflibraryarrows.code.tex 2008/10/27 v2.10 (rcs-revision 1.9)
\Urlmuskip=\muskip11
Package: url 2006/04/12 ver 3.3 Verb mode for urls, etc.
)
-(/usr/share/texmf-texlive/tex/latex/booktabs/booktabs.sty
+(/usr/share/texmf-texlive/tex/latex/breakurl/breakurl.sty
+Package: breakurl 2009/01/24 v1.30 Breakable hyperref URLs
+
+(/usr/share/texmf-texlive/tex/generic/oberdiek/ifpdf.sty
+Package: ifpdf 2009/04/10 v2.0 Provides the ifpdf switch (HO)
+Package ifpdf Info: pdfTeX in pdf mode detected.
+)
+
+Package breakurl Warning: You are using breakurl while processing via pdflatex.
+
+(breakurl) \burl will be just a synonym of \url.
+(breakurl) on input line 47.
+
+) (/usr/share/texmf-texlive/tex/latex/booktabs/booktabs.sty
Package: booktabs 2005/04/14 v1.61803 publication quality tables
\heavyrulewidth=\dimen207
\lightrulewidth=\dimen208
@@ -926,35 +939,35 @@ File: lstlang1.sty 2004/09/05 1.3 listings language file
\glo@main@file=\write6
\openout6 = `Master.glo'.
-Package glossaries Info: Writing glossary file Master.glo on input line 97.
+Package glossaries Info: Writing glossary file Master.glo on input line 98.
\glo@acronym@file=\write7
\openout7 = `Master.acn'.
-Package glossaries Info: Writing glossary file Master.acn on input line 97.
+Package glossaries Info: Writing glossary file Master.acn on input line 98.
(./Glossary.tex)
(./Master.aux)
\openout1 = `Master.aux'.
-LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 114.
-LaTeX Font Info: ... okay on input line 114.
-LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 114.
-LaTeX Font Info: ... okay on input line 114.
-LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 114.
-LaTeX Font Info: ... okay on input line 114.
-LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 114.
-LaTeX Font Info: ... okay on input line 114.
-LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 114.
-LaTeX Font Info: ... okay on input line 114.
-LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 114.
-LaTeX Font Info: ... okay on input line 114.
-LaTeX Font Info: Try loading font information for T1+ptm on input line 114.
+LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 115.
+LaTeX Font Info: ... okay on input line 115.
+LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 115.
+LaTeX Font Info: ... okay on input line 115.
+LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 115.
+LaTeX Font Info: ... okay on input line 115.
+LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 115.
+LaTeX Font Info: ... okay on input line 115.
+LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 115.
+LaTeX Font Info: ... okay on input line 115.
+LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 115.
+LaTeX Font Info: ... okay on input line 115.
+LaTeX Font Info: Try loading font information for T1+ptm on input line 115.
(/usr/share/texmf-texlive/tex/latex/psnfss/t1ptm.fd
File: t1ptm.fd 2001/06/04 font definitions for T1/ptm.
)
Package scrbase Info: No captions found for `german'
-(scrbase) --> skipped on input line 114.
+(scrbase) --> skipped on input line 115.
Package scrbase Info: No captions found for `ngerman'
-(scrbase) --> skipped on input line 114.
+(scrbase) --> skipped on input line 115.
(/usr/share/texmf-texlive/tex/latex/ucs/ucsencs.def
File: ucsencs.def 2003/11/29 Fixes to fontencodings LGR, T3
@@ -1037,20 +1050,16 @@ LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <10.95> not available
]
-LaTeX Font Info: Try loading font information for T1+phv on input line 148.
+LaTeX Font Info: Try loading font information for T1+phv on input line 149.
(/usr/share/texmf-texlive/tex/latex/psnfss/t1phv.fd
File: t1phv.fd 2001/06/04 scalable font definitions for T1/phv.
)
LaTeX Font Info: Font shape `T1/phv/bx/n' in size <10.95> not available
-(Font) Font shape `T1/phv/b/n' tried instead on input line 148.
+(Font) Font shape `T1/phv/b/n' tried instead on input line 149.
(./Master.lof
-Overfull \hbox (7.0206pt too wide) in paragraph at lines 20--20
- [][] []\T1/ptm/m/n/10.95 Base sta-tions and their neigh-bour-hood con-nec-tion
-s at the Tech-nis-che Fakultät. [][]
- []
+LaTeX Font Info: Try loading font information for T1+pcr on input line 37.
-LaTeX Font Info: Try loading font information for T1+pcr on input line 36.
(/usr/share/texmf-texlive/tex/latex/psnfss/t1pcr.fd
File: t1pcr.fd 2001/06/04 font definitions for T1/pcr.
) [5
@@ -1084,31 +1093,31 @@ Class scrbook Info: You've told me to use the font selection of the element
[9]
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 63.
-Class scrbook Info: You've told me to use the font selection of the element
-(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 76.
+(scrbook) on input line 66.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
(scrbook) on input line 79.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 80.
+(scrbook) on input line 82.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
(scrbook) on input line 83.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 87.
+(scrbook) on input line 86.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
(scrbook) on input line 90.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 91.
+(scrbook) on input line 93.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
(scrbook) on input line 94.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 97.
)
\tf@toc=\write10
\openout10 = `Master.toc'.
@@ -1138,7 +1147,11 @@ Underfull \hbox (badness 10000) in paragraph at lines 54--66
[]
-[2]) (../Content/GSM_short.tex [3] [4
+
+Underfull \vbox (badness 4403) has occurred while \output is active []
+
+ [2])
+(../Content/GSM_short.tex [3] [4
]
@@ -1157,18 +1170,24 @@ File: ../Images/Architecture.png Graphic file (type png)
<use ../Images/Architecture.png> [7]
LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <12> not available
(Font) Font shape `T1/ptm/b/n' tried instead on input line 121.
- [8 <../Images/Architecture.png (PNG copy)>] [9]
-Underfull \vbox (badness 10000) has occurred while \output is active []
+ [8 <../Images/Architecture.png (PNG copy)>] [9] [10] [11]
+Underfull \vbox (badness 6808) has occurred while \output is active []
- [10]
-[11] [12] <../Images/Authentication.png, id=97, 359.1819pt x 323.0469pt>
+ [12]
+<../Images/Authentication.png, id=97, 359.1819pt x 323.0469pt>
File: ../Images/Authentication.png Graphic file (type png)
-<use ../Images/Authentication.png> [13] [14 <../Images/Authentication.png (PNG
-copy)>] <../Images/Mapping.png, id=105, 337.28409pt x 115.19838pt>
+<use ../Images/Authentication.png>
+Underfull \vbox (badness 6808) has occurred while \output is active []
+
+ [13 <../Images/Authentication.png (PNG copy)>] [14]
+<../Images/Mapping.png, id=105, 337.28409pt x 115.19838pt>
File: ../Images/Mapping.png Graphic file (type png)
-<use ../Images/Mapping.png> [15] [16 <../Images/Mapping.png (PNG copy)>]
+<use ../Images/Mapping.png>
+Underfull \vbox (badness 1960) has occurred while \output is active []
+
+ [15 <../Images/Mapping.png (PNG copy)>] [16]
<../Images/Cells.png, id=112, 98.72083pt x 88.8921pt>
File: ../Images/Cells.png Graphic file (type png)
@@ -1176,30 +1195,33 @@ File: ../Images/Cells.png Graphic file (type png)
<../Images/real_Cells.PNG, id=113, 743.02594pt x 496.10344pt>
File: ../Images/real_Cells.PNG Graphic file (type png)
-<use ../Images/real_Cells.PNG> [17] [18 <../Images/Cells.png (PNG copy)> <../Im
-ages/real_Cells.PNG>]
+<use ../Images/real_Cells.PNG> [17 <../Images/Cells.png (PNG copy)> <../Images/
+real_Cells.PNG>] [18]
<../Images/Cipher.png, id=123, 387.72855pt x 131.02551pt>
File: ../Images/Cipher.png Graphic file (type png)
-<use ../Images/Cipher.png> [19] [20 <../Images/Cipher.png (PNG copy)>]
-<../Images/TDMAFDMA.png, id=132, 254.53494pt x 133.33815pt>
+<use ../Images/Cipher.png>
+Underfull \vbox (badness 2495) has occurred while \output is active []
+
+ [19 <../Images/Cipher.png (PNG copy)>]
+<../Images/TDMAFDMA.png, id=128, 254.53494pt x 133.33815pt>
File: ../Images/TDMAFDMA.png Graphic file (type png)
-<use ../Images/TDMAFDMA.png> [21 <../Images/TDMAFDMA.png (PNG copy)>]
-<../Images/Frames.png, id=136, 367.42068pt x 252.29457pt>
+<use ../Images/TDMAFDMA.png> [20]
+<../Images/Frames.png, id=133, 331.28568pt x 291.39264pt>
File: ../Images/Frames.png Graphic file (type png)
<use ../Images/Frames.png>
-<../Images/Bursts.png, id=137, 371.9737pt x 91.92744pt>
+<../Images/Bursts.png, id=134, 371.90141pt x 134.78355pt>
File: ../Images/Bursts.png Graphic file (type png)
-<use ../Images/Bursts.png> [22 <../Images/Frames.png (PNG copy)>] [23 <../Image
-s/Bursts.png (PNG copy)>]
-<../Images/Channels.png, id=144, 272.60245pt x 169.47314pt>
+<use ../Images/Bursts.png> [21 <../Images/TDMAFDMA.png (PNG copy)>] [22 <../Ima
+ges/Frames.png (PNG copy)> <../Images/Bursts.png (PNG copy)>]
+<../Images/Channels.png, id=141, 272.60245pt x 169.47314pt>
File: ../Images/Channels.png Graphic file (type png)
-<use ../Images/Channels.png> [24 <../Images/Channels.png (PNG copy)>] [25]
-[26] <../Images/imsi_catcher.jpg, id=155, 280.15778pt x 225.73222pt>
+<use ../Images/Channels.png> [23] [24 <../Images/Channels.png (PNG copy)>]
+[25] [26] <../Images/imsi_catcher.jpg, id=155, 280.15778pt x 225.73222pt>
File: ../Images/imsi_catcher.jpg Graphic file (type jpg)
<use ../Images/imsi_catcher.jpg>
@@ -1219,101 +1241,83 @@ Chapter 3.
[33
-] <../Images/c123_pcb.jpg, id=181, 1284.8pt x 856.19875pt>
-File: ../Images/c123_pcb.jpg Graphic file (type jpg)
+] <../Images/c123_pcb.png, id=181, 1284.8pt x 790.955pt>
+File: ../Images/c123_pcb.png Graphic file (type png)
-<use ../Images/c123_pcb.jpg> [34] [35]
+<use ../Images/c123_pcb.png> [34] [35]
<../Images/OsmoStructure.png, id=188, 387.00584pt x 79.13565pt>
File: ../Images/OsmoStructure.png Graphic file (type png)
-<use ../Images/OsmoStructure.png> [36 <../Images/c123_pcb.jpg>] [37 <../Images/
-OsmoStructure.png (PNG copy)>]
-<../Images/sysinfo1.png, id=196, 260.172pt x 393.1488pt>
-File: ../Images/sysinfo1.png Graphic file (type png)
+<use ../Images/OsmoStructure.png> [36 <../Images/c123_pcb.png (PNG copy)>]
+Underfull \vbox (badness 1694) has occurred while \output is active []
-<use ../Images/sysinfo1.png>
+ [37 <../Images/OsmoStructure.png (PNG copy)>]
+<../Images/sysinfo2.png, id=196, 261.32832pt x 440.55792pt>
+File: ../Images/sysinfo2.png Graphic file (type png)
+
+<use ../Images/sysinfo2.png>
-LaTeX Warning: Float too large for page by 0.9002pt on input line 174.
+LaTeX Warning: Float too large for page by 61.98238pt on input line 180.
-[38] [39 <../Images/sysinfo1.png (PNG copy)>] [40] [41]
-<../Images/neighbourhoods_fak.png, id=209, 907.39pt x 941.5175pt>
+[38] [39 <../Images/sysinfo2.png (PNG copy)>]
+
+LaTeX Warning: Reference `sec:fake_parameters' on page 40 undefined on input li
+ne 191.
+
+<../Images/Paging.png, id=203, 167.95547pt x 144.61227pt>
+File: ../Images/Paging.png Graphic file (type png)
+
+<use ../Images/Paging.png> [40] [41 <../Images/Paging.png (PNG copy)>] [42]
+[43] <../Images/neighbourhoods_fak.png, id=217, 907.39pt x 941.5175pt>
File: ../Images/neighbourhoods_fak.png Graphic file (type png)
<use ../Images/neighbourhoods_fak.png>
-Underfull \hbox (badness 1629) in paragraph at lines 291--291
+Underfull \hbox (badness 1675) in paragraph at lines 327--327
[]\T1/ptm/m/n/10.95 Base sta-tions and their neigh-bour-hood con-nec-tions at t
-he Tech-nis-che
+he Fac-ulty of
[]
-[42]
LaTeX Font Info: Font shape `T1/phv/bx/n' in size <14.4> not available
-(Font) Font shape `T1/phv/b/n' tried instead on input line 324.
- [43] [44 <../Images/neighbourhoods_fak.png>] [45] [46]
-
-LaTeX Warning: Reference `sec:log_channels' on page 47 undefined on input line
-437.
-
-<../Images/Paging.png, id=228, 167.95547pt x 144.61227pt>
-File: ../Images/Paging.png Graphic file (type png)
-
-<use ../Images/Paging.png> [47 <../Images/Paging.png (PNG copy)>]
-<../Images/Architecture_software.png, id=232, 341.76483pt x 182.91537pt>
+(Font) Font shape `T1/phv/b/n' tried instead on input line 364.
+[44] [45 <../Images/neighbourhoods_fak.png>] [46] [47] [48]
+<../Images/Architecture_software.png, id=235, 341.76483pt x 182.91537pt>
File: ../Images/Architecture_software.png Graphic file (type png)
-<use ../Images/Architecture_software.png> [48 <../Images/Architecture_software.
-png (PNG copy)>]
+<use ../Images/Architecture_software.png> [49] [50 <../Images/Architecture_soft
+ware.png (PNG copy)>]
LaTeX Font Info: Font shape `T1/pcr/m/it' in size <10.95> not available
-(Font) Font shape `T1/pcr/m/sl' tried instead on input line 514.
- [49] <../Images/ICDS.png, id=240, 1287.81125pt x 881.2925pt>
+(Font) Font shape `T1/pcr/m/sl' tried instead on input line 577.
+ [51]
+<../Images/ICDS.png, id=247, 1287.81125pt x 881.2925pt>
File: ../Images/ICDS.png Graphic file (type png)
-<use ../Images/ICDS.png> [50] [51 <../Images/ICDS.png>]
-
-LaTeX Warning: Reference `fig:databases' on page 52 undefined on input line 585
-.
-
-[52] <../Images/databases_window.png, id=252, 366.36874pt x 459.7175pt>
+<use ../Images/ICDS.png> [52 <../Images/ICDS.png>] [53]
+<../Images/databases_window.png, id=255, 366.36874pt x 459.7175pt>
File: ../Images/databases_window.png Graphic file (type png)
<use ../Images/databases_window.png>
-<../Images/rules_window.png, id=253, 284.06125pt x 568.1225pt>
+<../Images/rules_window.png, id=256, 284.06125pt x 568.1225pt>
File: ../Images/rules_window.png Graphic file (type png)
<use ../Images/rules_window.png>
-<../Images/filter_window.png, id=254, 332.24126pt x 293.095pt>
+<../Images/filter_window.png, id=257, 332.24126pt x 293.095pt>
File: ../Images/filter_window.png Graphic file (type png)
<use ../Images/filter_window.png>
-<../Images/pch_window.png, id=255, 270.00874pt x 273.02pt>
+<../Images/pch_window.png, id=258, 270.00874pt x 273.02pt>
File: ../Images/pch_window.png Graphic file (type png)
-<use ../Images/pch_window.png>
-
-LaTeX Warning: Reference `fig:databases' on page 53 undefined on input line 636
-.
-
-
-Overfull \hbox (10.40205pt too wide) in paragraph at lines 635--650
-[] \T1/ptm/b/n/10.95 Cel-lID In-for-ma-tion:[][] \T1/ptm/m/n/10.95 Cel-lID in-f
-or-ma-tion can be ob-tained through sev-eral dif-fer-ent means.
- []
-
-[53] [54 <../Images/databases_window.png> <../Images/rules_window.png> <../Imag
-es/filter_window.png (PNG copy)> <../Images/pch_window.png>] [55]
-
-LaTeX Warning: Reference `fig:user_mode' on page 56 undefined on input line 666
-.
-
+<use ../Images/pch_window.png> [54] [55 <../Images/databases_window.png> <../Im
+ages/rules_window.png> <../Images/filter_window.png (PNG copy)> <../Images/pch_
+window.png>] [56] <../Images/user_window.png, id=272, 368.37625pt x 469.755pt>
+File: ../Images/user_window.png Graphic file (type png)
-LaTeX Warning: Citation `catcher_catcher' on page 56 undefined on input line 68
-9.
+<use ../Images/user_window.png> [57 <../Images/user_window.png>]
-[56]
+LaTeX Warning: Citation `catcher_catcher' on page 58 undefined on input line 76
+6.
-LaTeX Warning: Reference `sec:catcher_features' on page 57 undefined on input l
-ine 701.
-
-) (../Content/Evaluation.tex [57] [58
+[58]) (../Content/Evaluation.tex [59] [60
]
@@ -1323,111 +1327,125 @@ Overfull \hbox (3.33815pt too wide) in paragraph at lines 16--30
[][]
[]
-[59] [60] [61] [62]
-Overfull \hbox (9.98987pt too wide) in paragraph at lines 203--203
+[61] [62] [63] <../Images/catcherICDS.jpg, id=296, 3474.9825pt x 1906.12125pt>
+File: ../Images/catcherICDS.jpg Graphic file (type jpg)
+
+<use ../Images/catcherICDS.jpg> [64] [65 <../Images/catcherICDS.jpg>]
+Overfull \hbox (9.98987pt too wide) in paragraph at lines 206--206
[]\T1/ptm/m/n/9 (a)
[]
-Overfull \hbox (17.9999pt too wide) in paragraph at lines 203--203
+Overfull \hbox (17.9999pt too wide) in paragraph at lines 206--206
\T1/ptm/m/n/9 Con-
[]
-Overfull \hbox (23.48973pt too wide) in paragraph at lines 203--203
+Overfull \hbox (23.48973pt too wide) in paragraph at lines 206--206
\T1/ptm/m/n/9 nected
[]
-Overfull \hbox (12.9957pt too wide) in paragraph at lines 203--203
+Overfull \hbox (12.9957pt too wide) in paragraph at lines 206--206
\T1/ptm/m/n/9 cell
[]
-Overfull \hbox (9.99887pt too wide) in paragraph at lines 203--203
+Overfull \hbox (9.99887pt too wide) in paragraph at lines 206--206
\T1/ptm/m/n/9 in-
[]
-Overfull \hbox (13.31093pt too wide) in paragraph at lines 203--203
+Overfull \hbox (13.31093pt too wide) in paragraph at lines 206--206
\T1/ptm/m/n/9 for-
[]
-Overfull \hbox (13.99481pt too wide) in paragraph at lines 203--203
+Overfull \hbox (13.99481pt too wide) in paragraph at lines 206--206
\T1/ptm/m/n/9 ma-
[]
-Overfull \hbox (16.25381pt too wide) in paragraph at lines 203--203
+Overfull \hbox (16.25381pt too wide) in paragraph at lines 206--206
\T1/ptm/m/n/9 tion.
[]
-Overfull \hbox (10.49393pt too wide) in paragraph at lines 204--204
+Overfull \hbox (10.49393pt too wide) in paragraph at lines 207--207
[]\T1/ptm/m/n/9 (b)
[]
-Overfull \hbox (24.99278pt too wide) in paragraph at lines 204--204
+Overfull \hbox (24.99278pt too wide) in paragraph at lines 207--207
\T1/ptm/m/n/9 Neigh-
[]
-Overfull \hbox (19.31396pt too wide) in paragraph at lines 204--204
+Overfull \hbox (19.31396pt too wide) in paragraph at lines 207--207
\T1/ptm/m/n/9 bour-
[]
-Overfull \hbox (11.5019pt too wide) in paragraph at lines 204--204
+Overfull \hbox (11.5019pt too wide) in paragraph at lines 207--207
\T1/ptm/m/n/9 ing
[]
-Overfull \hbox (12.9957pt too wide) in paragraph at lines 204--204
+Overfull \hbox (12.9957pt too wide) in paragraph at lines 207--207
\T1/ptm/m/n/9 cell
[]
-Overfull \hbox (17.99075pt too wide) in paragraph at lines 204--204
+Overfull \hbox (17.99075pt too wide) in paragraph at lines 207--207
\T1/ptm/m/n/9 mea-
[]
-Overfull \hbox (17.99077pt too wide) in paragraph at lines 204--204
+Overfull \hbox (17.99077pt too wide) in paragraph at lines 207--207
\T1/ptm/m/n/9 sure-
[]
-Overfull \hbox (23.75066pt too wide) in paragraph at lines 204--204
+Overfull \hbox (23.75066pt too wide) in paragraph at lines 207--207
\T1/ptm/m/n/9 ments.
[]
-[63] [64]
-Overfull \hbox (13.2843pt too wide) in paragraph at lines 239--245
+
+Underfull \vbox (badness 10000) has occurred while \output is active []
+
+ [66]
+Overfull \hbox (13.2843pt too wide) in paragraph at lines 242--248
\T1/ptm/m/n/10.95 Rules trig-gered: LAC/Provider Map-ping, Neigh-bour-hood Stru
c-ture, AR-FC-N/Provider
[]
-[65]
+[67]
+
+LaTeX Warning: Reference `sec:config_data' on page 68 undefined on input line 2
+63.
-LaTeX Warning: Reference `sec:config_data' on page 66 undefined on input line 2
-60.
+[68]
+Underfull \vbox (badness 10000) has occurred while \output is active []
-[66] [67] <../Images/replace_attack.png, id=307, 356.94153pt x 162.67976pt>
+ [69]
+<../Images/replace_attack.png, id=316, 356.94153pt x 162.67976pt>
File: ../Images/replace_attack.png Graphic file (type png)
-<use ../Images/replace_attack.png>) (../Content/Conclusion.tex [68] [69 <../Ima
-ges/replace_attack.png (PNG copy)>] [70
+<use ../Images/replace_attack.png> [70]) (../Content/Conclusion.tex [71 <../Ima
+ges/replace_attack.png (PNG copy)>] [72
]
Chapter 5.
-<../Images/flowchart.png, id=317, 340.31943pt x 407.31372pt>
+<../Images/flowchart.png, id=326, 340.31943pt x 407.31372pt>
File: ../Images/flowchart.png Graphic file (type png)
-<use ../Images/flowchart.png> [71] [72 <../Images/flowchart.png (PNG copy)>])
-[73] [74] (./Master.bbl
+<use ../Images/flowchart.png> [73] [74 <../Images/flowchart.png (PNG copy)>])
+[75] [76
+
+
+
+] (./Master.bbl
Underfull \hbox (badness 2818) in paragraph at lines 17--21
[]\T1/ptm/m/n/10.95 Radio ac-cess net-work: Ra-dio trans-mis-sion and re-cep-ti
on. GSM 05.05,
@@ -1469,10 +1487,7 @@ Underfull \hbox (badness 10000) in paragraph at lines 48--52
[]a30 . zip$\T1/ptm/m/n/10.95 ,
[]
-[75
-
-
-
+[77
]
@@ -1494,93 +1509,155 @@ Underfull \hbox (badness 1454) in paragraph at lines 83--88
[]
-Underfull \hbox (badness 10000) in paragraph at lines 138--143
+Underfull \hbox (badness 10000) in paragraph at lines 143--148
[]\T1/ptm/m/sc/10.95 Security, H. \T1/ptm/m/n/10.95 Imsi-catcher für 1500 euro
im eigen-
[]
-Underfull \hbox (badness 10000) in paragraph at lines 138--143
+Underfull \hbox (badness 10000) in paragraph at lines 143--148
\T1/ptm/m/n/10.95 bau. $\T1/pcr/m/n/10.95 http : / / www . heise . de / securi
ty / meldung /
[]
-Underfull \hbox (badness 10000) in paragraph at lines 138--143
+Underfull \hbox (badness 10000) in paragraph at lines 143--148
\T1/pcr/m/n/10.95 IMSI-[]Catcher-[]fuer-[]1500-[]Euro-[]im-[]Eigenbau-[]1048919
. html$\T1/ptm/m/n/10.95 ,
[]
-[76]
-Underfull \hbox (badness 10000) in paragraph at lines 158--161
+[78]
+Underfull \hbox (badness 10000) in paragraph at lines 163--166
[]\T1/ptm/m/sc/10.95 Wikipedia\T1/ptm/m/n/10.95 . Cell id. $\T1/pcr/m/n/10.95
http : / / bb . osmocom . org / trac / wiki /
[]
-) [77] (../Content/Appendix.tex [78
+) [79] (../Content/Appendix.tex [80
]
Appendix A.
-[79] [80]
+[81] [82]
Appendix B.
-[81
+[83
]
-Overfull \hbox (25.37581pt too wide) in paragraph at lines 97--99
-\T1/ptm/m/n/10.95 moved to \T1/pcr/m/n/10.95 osmocom-bb/src/host/layer23/src/mi
-sc \T1/ptm/m/n/10.95 and the \T1/pcr/m/n/10.95 Makefile.am
+Overfull \hbox (19.167pt too wide) in paragraph at lines 96--98
+\T1/pcr/m/n/10.95 pch_scan.c\T1/ptm/m/n/10.95 must be moved to \T1/pcr/m/n/10.9
+5 osmocom-bb/src/host/layer23/src/misc
[]
-Overfull \hbox (5.82301pt too wide) in paragraph at lines 112--113
-[][][][][][][][][][][][][][][][][]
+Overfull \hbox (6.91444pt too wide) in paragraph at lines 104--104
+ []\T1/pcr/m/n/10.95 bin_PROGRAMS = bcch_scan ... cbch_sniff catcher pch_scan[]
+
[]
-[82] <../Images/t191cable.jpg, id=356, 702.625pt x 609.27625pt>
+
+Overfull \hbox (5.81935pt too wide) in paragraph at lines 115--115
+[] \T1/pcr/m/n/10.95 ../../target/firmware/board/compal_e88/layer1.compalram.bi
+n[]
+ []
+
+[84] <../Images/t191cable.jpg, id=365, 702.625pt x 609.27625pt>
File: ../Images/t191cable.jpg Graphic file (type jpg)
-<use ../Images/t191cable.jpg> [83 <../Images/t191cable.jpg>] [84
+<use ../Images/t191cable.jpg> [85 <../Images/t191cable.jpg>] [86
]
Appendix C.
-[85] [86]
-Underfull \vbox (badness 10000) has occurred while \output is active []
+
+Underfull \hbox (badness 10000) in paragraph at lines 145--161
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 145--161
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 145--161
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 162--194
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 162--194
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 162--194
+
+ []
+
+
+Underfull \vbox (badness 7981) has occurred while \output is active []
[87]
[88]
+Overfull \hbox (5.4829pt too wide) in paragraph at lines 318--319
+[][][][][][][][][][][][][][][][][][][][][][][][][][]
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 197--324
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 197--324
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 197--324
+
+ []
+
+
+Underfull \vbox (badness 10000) has occurred while \output is active []
+
+ [89]
+[90] [91] [92
+
+
+]
Appendix D.
+<../Images/sysinfo1.png, id=392, 260.172pt x 393.1488pt>
File: ../Images/sysinfo1.png Graphic file (type png)
+
<use ../Images/sysinfo1.png>
-LaTeX Warning: Float too large for page by 0.9002pt on input line 271.
+LaTeX Warning: Float too large for page by 0.9002pt on input line 332.
-<../Images/sysinfo2.png, id=376, 261.32832pt x 440.55792pt>
File: ../Images/sysinfo2.png Graphic file (type png)
-
<use ../Images/sysinfo2.png>
-LaTeX Warning: Float too large for page by 61.98238pt on input line 276.
+LaTeX Warning: Float too large for page by 61.98238pt on input line 337.
-<../Images/sysinfo3.png, id=377, 284.45473pt x 373.49136pt>
+<../Images/sysinfo3.png, id=393, 284.45473pt x 373.49136pt>
File: ../Images/sysinfo3.png Graphic file (type png)
<use ../Images/sysinfo3.png>
-<../Images/sysinfo4.png, id=378, 252.07776pt x 370.0224pt>
+<../Images/sysinfo4.png, id=394, 252.07776pt x 370.0224pt>
File: ../Images/sysinfo4.png Graphic file (type png)
-<use ../Images/sysinfo4.png> [89
-
-
-] [90] [91 <../Images/sysinfo2.png (PNG copy)>] [92 <../Images/sysinfo3.png (PN
-G copy)>] [93 <../Images/sysinfo4.png (PNG copy)>] [94
+<use ../Images/sysinfo4.png> [93] [94 <../Images/sysinfo1.png (PNG copy)>]
+[95] [96 <../Images/sysinfo3.png (PNG copy)>] [97 <../Images/sysinfo4.png (PNG
+copy)>] [98
]
Appendix E.
-[95]) (./Master.acr [96]
+[99]) (./Master.acr [100]
Underfull \hbox (badness 2626) in paragraph at lines 73--74
[]|\T1/ptm/m/n/10.95 Conférence Eu-ropéenne des Ad-min-is-tra-tions des
[]
@@ -1590,24 +1667,24 @@ Underfull \hbox (badness 10000) in paragraph at lines 89--90
[]|\T1/ptm/m/n/10.95 Electrically Erasable Pro-grammable Read-Only
[]
-[97
+[101
-] [98] [99]) [100] (./Master.aux)
+] [102] [103]) [104] (./Master.aux)
LaTeX Warning: There were undefined references.
)
Here is how much of TeX's memory you used:
- 25006 strings out of 493848
- 467992 string characters out of 1152824
- 689005 words of memory out of 3000000
- 27618 multiletter control sequences out of 15000+50000
+ 25032 strings out of 493848
+ 468954 string characters out of 1152824
+ 738813 words of memory out of 3000000
+ 27635 multiletter control sequences out of 15000+50000
83343 words of font info for 111 fonts, out of 3000000 for 9000
714 hyphenation exceptions out of 8191
- 61i,13n,72p,1076b,1689s stack positions out of 5000i,500n,10000p,200000b,50000s
+ 61i,13n,72p,1076b,1344s stack positions out of 5000i,500n,10000p,200000b,50000s
{/usr/share/texmf-texlive/fonts/enc/dvips/base/8r.enc}</usr/share/texmf-texli
ve/fonts/type1/public/amsfonts/cm/cmex10.pfb></usr/share/texmf-texlive/fonts/ty
pe1/public/amsfonts/cm/cmmi10.pfb></usr/share/texmf-texlive/fonts/type1/public/
@@ -1624,9 +1701,9 @@ nts/type1/urw/helvetic/uhvb8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/tim
es/utmb8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/
share/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/share/texmf-texlive/
fonts/type1/urw/times/utmri8a.pfb>
-Output written on Master.pdf (112 pages, 14203879 bytes).
+Output written on Master.pdf (116 pages, 17995314 bytes).
PDF statistics:
- 478 PDF objects out of 1000 (max. 8388607)
+ 494 PDF objects out of 1000 (max. 8388607)
0 named destinations out of 1000 (max. 500000)
- 168 words of extra memory for PDF output out of 10000 (max. 10000000)
+ 178 words of extra memory for PDF output out of 10000 (max. 10000000)
diff --git a/Tex/Master/Master.lot b/Tex/Master/Master.lot
index c266260..f20b78b 100644
--- a/Tex/Master/Master.lot
+++ b/Tex/Master/Master.lot
@@ -7,20 +7,22 @@
\addvspace {10\p@ }
\contentsline {table}{\numberline {3.1}{\ignorespaces Technical specifications for the Motorola C123.}}{35}
\contentsline {table}{\numberline {3.2}{\ignorespaces Type Codes and the corresponding System Information Types \cite {GSM2009}.}}{38}
-\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{41}
-\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{42}
-\addvspace {10\p@ }
-\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{59}
-\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in s for fetching the information.}}{61}
-\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Pagings and Immediate Assignments (per 10\tmspace +\thickmuskip {.2777em}s) for the four German providers at different locations.}}{62}
-\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{65}
-\contentsline {table}{\numberline {4.5}{\ignorespaces failzor}}{66}
-\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long term evaluation.}}{67}
-\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{68}
-\addvspace {10\p@ }
-\addvspace {10\p@ }
-\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{79}
-\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{80}
+\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{42}
+\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{43}
+\contentsline {table}{\numberline {3.5}{\ignorespaces Database Rules implemented inside the ICDS.}}{46}
+\contentsline {table}{\numberline {3.6}{\ignorespaces Scan Rules implemented inside the ICDS.}}{47}
+\addvspace {10\p@ }
+\contentsline {table}{\numberline {4.1}{\ignorespaces Key values of the data sets used for performance tests.}}{61}
+\contentsline {table}{\numberline {4.2}{\ignorespaces Coverage for Google Mobile Maps and OpenCellID on the data sets with the time needed in s for fetching the information.}}{63}
+\contentsline {table}{\numberline {4.3}{\ignorespaces Number of Pagings and Immediate Assignments (per 10\tmspace +\thickmuskip {.2777em}s) for the four German providers at different locations.}}{64}
+\contentsline {table}{\numberline {4.4}{\ignorespaces Erroneous configurations for the IMSI catcher.}}{67}
+\contentsline {table}{\numberline {4.5}{\ignorespaces failzor}}{68}
+\contentsline {table}{\numberline {4.6}{\ignorespaces Results of the long term evaluation.}}{69}
+\contentsline {table}{\numberline {4.7}{\ignorespaces Consistent parameter configurations in the Freiburg area for the four German providers.}}{70}
+\addvspace {10\p@ }
+\addvspace {10\p@ }
+\contentsline {table}{\numberline {A.1}{\ignorespaces Interface found in the GSM network.}}{81}
+\contentsline {table}{\numberline {A.2}{\ignorespaces Possible mappings of channels onto Multiframes}}{82}
\addvspace {10\p@ }
\addvspace {10\p@ }
\addvspace {10\p@ }
diff --git a/Tex/Master/Master.pdf b/Tex/Master/Master.pdf
index f439bbe..05bd7d7 100644
--- a/Tex/Master/Master.pdf
+++ b/Tex/Master/Master.pdf
Binary files differ
diff --git a/Tex/Master/Master.synctex.gz b/Tex/Master/Master.synctex.gz
index 4993c76..a62a4cc 100644
--- a/Tex/Master/Master.synctex.gz
+++ b/Tex/Master/Master.synctex.gz
Binary files differ
diff --git a/Tex/Master/Master.tex b/Tex/Master/Master.tex
index 4c59ac0..0f4e241 100644
--- a/Tex/Master/Master.tex
+++ b/Tex/Master/Master.tex
@@ -3,7 +3,7 @@
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentclass[a4paper,twoside, DIV=10,fontsize=11pt,bibliography=totoc, BCOR=15mm, headinclude=true,
- footinclude=false, cleardoubleplain,chapterprefix=true,appendixprefix=true]{scrbook}
+ footinclude=false, cleardoubleplain,chapterprefix=false,appendixprefix=true]{scrbook}
%chapterprefix=true/false
%appendixprefix=true/false
@@ -49,6 +49,7 @@
\usepackage{pgfplotstable}
\usetikzlibrary{arrows}
\usepackage{url}
+\usepackage{breakurl}
\usepackage{booktabs}
\usepackage{subfigure}
\usepackage{xcolor}
diff --git a/Tex/Master/Master.toc b/Tex/Master/Master.toc
index b206b1e..08bfdfb 100644
--- a/Tex/Master/Master.toc
+++ b/Tex/Master/Master.toc
@@ -7,12 +7,12 @@
\contentsline {chapter}{\numberline {2}GSM}{5}
\contentsline {section}{\numberline {2.1}A Historical Perspective}{5}
\contentsline {section}{\numberline {2.2}The GSM Network}{7}
-\contentsline {subsection}{\numberline {2.2.1}Mobile Station}{9}
+\contentsline {subsection}{\numberline {2.2.1}Mobile Station}{8}
\contentsline {subsection}{\numberline {2.2.2}Network Subsystem}{11}
-\contentsline {subsubsection}{Mobile Switching Center}{12}
+\contentsline {subsubsection}{Mobile Switching Center}{11}
\contentsline {subsubsection}{Home Location Register}{12}
\contentsline {subsubsection}{Visitor Location Register}{13}
-\contentsline {subsubsection}{Authentication Center}{13}
+\contentsline {subsubsection}{Authentication Center}{14}
\contentsline {subsection}{\numberline {2.2.3}Base Station Subsystem}{15}
\contentsline {subsubsection}{Frequencies and the Cellular Principle}{15}
\contentsline {subsubsection}{Base Transceiver Station}{17}
@@ -20,9 +20,9 @@
\contentsline {section}{\numberline {2.3}The $U_m$ Interface}{20}
\contentsline {subsection}{\numberline {2.3.1}Radio Transmission}{20}
\contentsline {subsubsection}{Frame Numbering}{21}
-\contentsline {subsubsection}{Burst Types}{22}
+\contentsline {subsubsection}{Burst Types}{21}
\contentsline {subsection}{\numberline {2.3.2}Logical Channels}{24}
-\contentsline {subsubsection}{Dedicated Channels}{25}
+\contentsline {subsubsection}{Dedicated Channels}{24}
\contentsline {subsubsection}{Common Channels}{25}
\contentsline {subsubsection}{Combinations}{26}
\contentsline {subsection}{\numberline {2.3.3}Layers}{26}
@@ -36,59 +36,62 @@
\contentsline {paragraph}{MS is already connected to a network:}{30}
\contentsline {subsubsection}{Risks and Irregularities}{31}
\contentsline {subsection}{\numberline {2.4.2}Law Situation in Germany}{31}
-\contentsline {chapter}{\numberline {3}IMSI Catcher Detection}{33}
+\contentsline {chapter}{\numberline {3}IMSI Catcher Detection System}{33}
\contentsline {section}{\numberline {3.1}Framework and Hardware}{33}
\contentsline {subsection}{\numberline {3.1.1}OsmocomBB}{33}
\contentsline {subsubsection}{Project Status}{34}
\contentsline {subsection}{\numberline {3.1.2}Motorola C123}{35}
\contentsline {subsection}{\numberline {3.1.3}OsmocomBB and ICDS}{36}
\contentsline {section}{\numberline {3.2}Procedure}{37}
-\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{37}
-\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{40}
-\contentsline {subsubsection}{Neighbourhood Structure}{42}
-\contentsline {subsubsection}{Base Station Evaluation}{43}
-\contentsline {subsection}{\numberline {3.2.3}Forged Parameters}{45}
+\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{38}
+\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{41}
+\contentsline {subsubsection}{Configuration Rules}{42}
+\contentsline {subsubsection}{Context Rules}{43}
+\contentsline {paragraph}{Neighbourhood Structure}{44}
\contentsline {subsubsection}{Database Rules}{46}
-\contentsline {subsubsection}{Remaining Issues and Paging}{47}
-\contentsline {section}{\numberline {3.3}IMSI Catcher Detection System}{48}
-\contentsline {subsection}{\numberline {3.3.1}Implemetation}{48}
-\contentsline {subsection}{\numberline {3.3.2}Configuration}{49}
-\contentsline {subsection}{\numberline {3.3.3}Operation}{50}
-\contentsline {paragraph}{Sweep scans:}{53}
-\contentsline {paragraph}{CellID Information:}{55}
-\contentsline {paragraph}{Location Area Database:}{55}
-\contentsline {paragraph}{PCH Scan:}{55}
-\contentsline {paragraph}{User Mode:}{56}
-\contentsline {section}{\numberline {3.4}Related Projects}{56}
-\contentsline {chapter}{\numberline {4}Evaluation}{59}
-\contentsline {section}{\numberline {4.1}Performance Evaluation}{59}
-\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{60}
-\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{61}
-\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{61}
-\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{62}
-\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{62}
-\contentsline {subsubsection}{Nokia 3310}{63}
-\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{65}
-\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{66}
-\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{67}
-\contentsline {subsubsection}{IMSI Catcher as a new Cell}{67}
-\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{68}
-\contentsline {chapter}{\numberline {5}Conclusion}{71}
-\contentsline {section}{\numberline {5.1}Summary}{71}
-\contentsline {section}{\numberline {5.2}Future Work}{73}
-\contentsline {chapter}{Bibliography}{75}
-\contentsline {chapter}{\numberline {A}GSM}{79}
-\contentsline {section}{\numberline {A.1}Interfaces}{79}
-\contentsline {section}{\numberline {A.2}Channel Combinations}{80}
-\contentsline {chapter}{\numberline {B}OsmocomBB}{81}
-\contentsline {section}{\numberline {B.1}Installation}{81}
-\contentsline {section}{\numberline {B.2}Usage}{82}
-\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{83}
-\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{85}
-\contentsline {section}{\numberline {C.1}Extextions}{85}
-\contentsline {section}{\numberline {C.2}Example Configuration}{86}
-\contentsline {chapter}{\numberline {D}System Information}{89}
-\contentsline {chapter}{\numberline {E}Evaluation Data}{95}
-\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{95}
-\contentsline {section}{\numberline {E.2}Long Term Test}{95}
-\contentsline {chapter}{Acronyms}{97}
+\contentsline {subsubsection}{Scan Rules}{47}
+\contentsline {subsubsection}{Remaining Issues and Paging}{48}
+\contentsline {subsection}{\numberline {3.2.3}Base Station Evaluation}{49}
+\contentsline {section}{\numberline {3.3}Implementation}{49}
+\contentsline {subsection}{\numberline {3.3.1}Architecture}{49}
+\contentsline {subsection}{\numberline {3.3.2}Configuration}{51}
+\contentsline {subsection}{\numberline {3.3.3}Graphical User Interface}{52}
+\contentsline {subsection}{\numberline {3.3.4}Usage}{54}
+\contentsline {paragraph}{Conducting sweep scans:}{56}
+\contentsline {paragraph}{Using and obtaining Cell ID Information:}{56}
+\contentsline {paragraph}{Building or using a Local Area Database:}{56}
+\contentsline {paragraph}{Conducting a PCH Scan:}{57}
+\contentsline {paragraph}{Utilising User Mode:}{57}
+\contentsline {section}{\numberline {3.4}Related Projects}{58}
+\contentsline {chapter}{\numberline {4}Evaluation}{61}
+\contentsline {section}{\numberline {4.1}Performance Evaluation}{61}
+\contentsline {subsection}{\numberline {4.1.1}Scan Duration}{62}
+\contentsline {subsection}{\numberline {4.1.2}Cell ID Databases}{63}
+\contentsline {subsection}{\numberline {4.1.3}PCH Scans}{63}
+\contentsline {section}{\numberline {4.2}IMSI Catcher Detection}{64}
+\contentsline {subsection}{\numberline {4.2.1}Open Source IMSI Catcher}{64}
+\contentsline {subsubsection}{Nokia 3310}{66}
+\contentsline {subsection}{\numberline {4.2.2}Rule Evaluation}{67}
+\contentsline {subsection}{\numberline {4.2.3}Long Term Test}{68}
+\contentsline {subsection}{\numberline {4.2.4}Attack Scenarios}{69}
+\contentsline {subsubsection}{IMSI Catcher as a new Cell}{70}
+\contentsline {subsubsection}{IMSI Catcher replacing an old Cell}{70}
+\contentsline {chapter}{\numberline {5}Conclusion}{73}
+\contentsline {section}{\numberline {5.1}Summary}{73}
+\contentsline {section}{\numberline {5.2}Future Work}{75}
+\contentsline {chapter}{Bibliography}{77}
+\contentsline {chapter}{\numberline {A}GSM}{81}
+\contentsline {section}{\numberline {A.1}Interfaces}{81}
+\contentsline {section}{\numberline {A.2}Channel Combinations}{82}
+\contentsline {chapter}{\numberline {B}OsmocomBB}{83}
+\contentsline {section}{\numberline {B.1}Installation}{83}
+\contentsline {section}{\numberline {B.2}Usage}{84}
+\contentsline {section}{\numberline {B.3}Serial Cable Schematics}{85}
+\contentsline {chapter}{\numberline {C}IMSI Catcher Detection System}{87}
+\contentsline {section}{\numberline {C.1}Extextions}{87}
+\contentsline {section}{\numberline {C.2}Example Configuration}{89}
+\contentsline {chapter}{\numberline {D}System Information}{93}
+\contentsline {chapter}{\numberline {E}Evaluation Data}{99}
+\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{99}
+\contentsline {section}{\numberline {E.2}Long Term Test}{99}
+\contentsline {chapter}{Acronyms}{101}