MCC-500 dual band GSM analyzer

Product overview
Covering the following modifications Document Nr. Date Last updated MCC-500-A (dual band GSM 900/1800 MHz) MCC-500-B (dual band GSM 850/1900 MHz) OTK-201335 June 18th, 2013 revision v. 01

Copyright 2012 Proximus LLC. All rights reserved

www.proximus.com.ua

Document number OTK-201335

Page 1

Table of contents

1. Overview 2. Acronyms and abbreviations 3. Functionality and operation 3-1. Preparing the unit for use 3-2. Creating cellular providers list 3-3. Modes of operation 3-4. Storing your files 4. Technical specifications 5. Troubleshooting
6. Notes

www.proximus.com.ua

Document number OTK-201335

Page 2

Acronyms and abbreviations

PLMN - Public Land Mobile Network IMSI - The International Mobile Subscriber Identity (IMSI) is an internationally standardized unique number to identify a mobile subscriber. The IMSI is defined in ITU-T Recommendation E.212. The IMSI consists of a Mobile Country Code (MCC), a Mobile Network Code (MNC) and a Mobile Station Identification Number (MSIN). IMEI - The International Mobile Equipment Identity (IMEI) is a unique number used to identify a mobile station. Identification is used to identify valid devices and ban devices that are lost or stolen from the network. The IMEI is 15 of 16 decimal digits long. It consists of three parts. The first 8 digits, the Type Approval Code, are used to identify the model. The next 5 digits are a unique serial number for this type of device. This is followed by either a 1 digit control code or a 2 digit software version number ARFCN - The Absolute Radio Frequency Channel Number (ARFCN) is a unique number given to each radio channel in GSM. The ARFCN can be used to calculate the exact frequency of the radio channel CRO - Cell Reselect Offset. Value range: 0~63, the corresponding level value: 0~126dB, stepped every 2dB C2 - After cell selection, MS will reselect another better cell in idle mode. It is C2 parameter that determines cell reselection. C1 parameter that indicates the quality of radio channel

www.proximus.com.ua

Document number OTK-201335

Page 3

Overview

MCC-500 is a tool aimed to perform analysis of GSM networks active in certain area and to analyze the RF environment against a number of predefined parameters. MCC-500 analyzer unit is managed over Bluetooth interface using any available Android smartphone. Max 3 dBi receiving antenna is connected to the MCC-500 unit using standard SMA male RF connector

Functionality
Collection and recording of information on all GSM cellular providers within any specific coverage area Collection of information on available BCCH channels for all or selected operators. Tracking of any selected ARFCN Analysis of 2 adjacent cells Detection of fake GSM networks in the area Displaying collected information on the map Storage of collected information in separate event-based file for further post processing

Indicators and controls

1- on/off button 2 - on/off indicator 3 - battery discharge indicator 4- power supply connector 5 - battery charging indicator

www.proximus.com.ua

Document number OTK-201335

Page 4

Functionality and operation

3-1. Preparing the unit for use

1) 2) 3) 4) 5) Switch on both MCC-500 analyzer and managing Android cellphone Run GSM MONITOR application the smartphone Activate the Bluetooth interface Activate GPS (if needed) Press CONNECT button

Main MCC-500 analyzer window

Bluetooth connection dialogue

Bluetooth and GPS are activated

3-2. Creating cellular providers list

During the first session user shall create a list of available cellular providers.

Press LIST OF AVAILABLE OPERATORS button and then press UPDATE LIST button.
The analyzer will start scanning the RF environment and log data on all available networks. As soon as the scanning in completed, the list of available networks will be displayed on a screen.

www.proximus.com.ua

Document number OTK-201335

Page 5

Functionality and operation

3-3. Modes of operation

MCC-500 analyzer supports the following operation modes: a) b) c) d) e) Search mode Surveillance mode Tracking mode Neighboring cells analysis Detection of fake networks in the area

a) Search mode
This mode is applied when user needs to find a required Base Station cell with known parameters and collect information on all available BCCH channels. All information is stored in a separate file as soon as the required Base Station cell is detected. The following info is displayed on a screen: Operator name, Channel Number, LAC, Cell ID, Received Signal Strength.

As soon as MCC-500 is logged into required cell, COLLECT BCCH INFORMATION button gets active. By pressing this button MCC-500 scans the RF environment and collects data on all neighboring cells of all aoperators in the area. This may take from 2 to 5 minutes depending on situation. In case MCC-500 loses connection to the required cell, the BTS indicators will go RED. By pressing STOP button user can terminate current session and store collected data into a separate file.

www.proximus.com.ua

Document number OTK-201335

Page 6

Functionality and operation

b) Surveillance mode
With this this mode real time data on a serving cell and neighboring cells are collected and stored into a separate file. The result list is being updated 2 times per second and contains the following information: Channel Number, LAC, Cell ID, neighboring cells power level. To initiate this mode, user shall select GSM Operator and press START button. When STOP button is pressed, all collected data are automatically stored as a separate file.

www.proximus.com.ua

Document number OTK-201335

Page 7

Functionality and operation

c) Tracking mode
This mode allows user to control the cell power level based on known ARFCN. All data are displayed on a screen and stored along with corresponding GPS coordinates. NO SIGNAL message will be displayed in case the required ARFCN is not present in the area. Collected data can also be used to mark the borders of a particular cell on the map.

www.proximus.com.ua

Document number OTK-201335

Page 8

Functionality and operation

d) Neighboring cells analysis mode

This mode provides for two neighboring cells analysis. The current location of the MCC-500 unit is shown on the map, as well as the area created by overlapping cell coverage areas. Collected data are stored in the memory in cases when MCC-500 unit receives signal from both serving and neighboring cells. Prior to running the session user needs to press relevant text fields on the managing cellphone and manually input base station sector data, then press START. Once the session is over, press STOP button.

Use of Google maps requires Internet connectivity over Wi-Fi or 3G/4G network.

www.proximus.com.ua

Document number OTK-201335

Page 9

Functionality and operation

e) Detection of fake networks in the area (AS Scanner)

MCC-500 unit can be used to detect Cellular IMSI and IMEI catchers or Active Intercept systems (AS) masquerading as normal GSM network nodes in any particular area. Prior to using this function user needs to make sure the MCC500 unit contains data on PLMN providers actual LAC values. It is recommended to update this data each time before using AS Scanner mode. Detection of the AS is performed against several criteria including LAC, C1, C2 and CRO values. To run the unit in this mode, select the Cellular provider and press START button on a screen. The analysis can be done for one particular operator at a time. Processing of one request normally takes from 7 to 10 seconds. This means that user will spend minimum 30 seconds to quickly analyze the RF environment at presence of 3 PLMN provides networks. At the same time the longer user stays within selected network, the higher detection accuracy can be achieved. After completing the analysis, user will receive one of 4 messages, listed below

1 3 5 7

2 4 6 8

1 - MCC-500 unit did not find any Active Systems. LAC values are correct and the CRO value (C1-C2) is correct 2 - User will hear a warning sound and view message indicating that possible Active System is transmitting in the area and the CRO value is greater than 20 3 - This message informs that C1 value of the frequency channel is greater than 60 and there is high probability of Active System working in the area

4 - This message indicates that another network operating under different LAC is active in the area. This could be a sign of either GSM catcher or Active Intercept system 5 - This message informs that C1 value of the frequency channel is greater than 60 and CRO is greater than 60 and this can indicate on another Active System in the area 6 - This message informs that C1 value of the frequency channel is greater than 60 and CRO is greater than 60, and LAC values is not correct, this can indicate on another Active System in the area 7 - This message informs that CRO is greater than 60, and LAC values is not correct, this can indicate on another Active System present in the area 8 - This message informs that C1 value of the frequency channel is greater than 60 and LAC value is not correct probably another Active System is operating.
www.proximus.com.ua
Document number OTK-201335

Page 10

Functionality and operation

3-4. Storing your files

All data processed by MCC-500 analyzer are stored on managing cellular phone SD card
The directory where stored files are located is SD:/GSM/ Operator.scn list of cellular providers GSM/Scan/ folder contains the following directories, separate for each mode: SD:/GSM/Scan/Exploring SD:/GSM/Scan/Find SD:/GSM/Scan/Tracking SD:/GSM/Scan/RelatedCells All files are stored in a text form for further processing in any available office program.

www.proximus.com.ua

Document number OTK-201335

Page 11

Technical specifications

Parameter
Frequency range Sensitivity Power consumption (typical values) Battery capacity Supply voltage range Extended temperature range Link interface

Value
900 / 1800 MHz 900 MHz -107 dBm (typ.) ; 1800 MHz -106 dBm (typ.) off-62uA;idle-1,5mA;dedicated mode-<240mA 1500 mA 5 V DC -20C to +40C Bluetooth (control range 5m).

Control device Dimensions

Weight Antenna connector

Android OS phone 25x70x125mm (without antenna)

120 g SMA male

Antenna requirement
Bandwidth: 80 MHz in GSM 900, 170 MHz in GSM 1800 Gain < 1,4dBi in GSM 900 and < 3,0dBi in GSM 1800 Impedance 50 Input power > 2 W peak power VSWR absolute max <= 10:1 VSWR recommended <= 2:1

www.proximus.com.ua

Document number OTK-201335

Page 12

Troubleshooting

Problem The green LED indicator does nor go GREEN when switched on Green and red indicators are on simultaneously Received is not getting connected to the managing smartphone (No Connection)

Action This means the battery is fully discharged, please connect the charging device to the mains power supply The battery power is low. Please connect the charging device Please check Bluetooth setting on the Android smartphone, in Wireless Networks section

www.proximus.com.ua

Document number OTK-201335

Page 13

Notes

Information accuracy
We have made all efforts to ensure the accuracy of the features and techniques presented in this product overview.

Restricted Rights
You may not reproduce, transmit, transcribe, store in a retrieval system, or translate into any language or computer language, in any form or by any means, electronic, mechanical, optical, magnetic, photographic, manual, or otherwise, any part of this publication without the express permission of Proximus LLC.

Limitations
This document has the following conditions and restrictions: This document contains proprietary information belonging to Proximus LLC. Such information is supplied solely for assisting explicitly and properly authorized users. No part of its contents may be used for any other purpose, disclosed to any person or firm or reproduced by any means, electronic and mechanical, without the express prior written permission of Proximus LLC. No part or parts of this document shall be copied, used for commercial purposes or passed to any third party for any use, without approval of Proximus LLC. The text and graphics are for the purpose of illustration and reference only. The specifications on which they are based are subject to change without notice.

www.proximus.com.ua

Document number OTK-201335

Page 14