Cellular Networks: GSM to Packet Data

A cellular network is not one long radio link. It divides territory into cells, deliberately reuses scarce spectrum, and moves each active user among finite pools of time-frequency resources. Above that radio system, a mobility service remembers which region can page the subscriber, a session service arranges a path to a data network, and security binds both to a subscription. The phone can therefore remain registered while having no radio bearer at all, then reacquire radio context when packets need to move.

This separation is the key to reading every generation. GSM first made circuit-switched mobility systematic. GPRS overlaid packet nodes without removing the circuit core. UMTS changed the radio interface and increased packet capability while retaining separate circuit- and packet-switched core domains. LTE collapsed normal service onto an all-IP packet core. 5G made control functions, user-plane forwarding, and QoS flows still more explicit. The names changed, but every system must answer the same questions: Which cell can hear the device? Where should it be paged? Which path carries its packets? Who may use that path? What happens when it moves?

Why cells create capacity #

A high tower using one channel everywhere would maximize coverage but let only one transmitter use that channel at a time. A cellular layout trades some of that simplicity for spatial reuse: sufficiently separated cells or sectors use the same spectrum simultaneously. Capacity then comes from how many independent transmissions can coexist, not from the nominal radius of one transmitter.

A base-station site commonly divides azimuth into sectors. Each sector has its own antenna pattern and radio resources, so energy intended for one direction creates less interference in the others. Narrower sectors can increase reuse and antenna gain, but they also create more boundaries, neighbor relations, and handover opportunities. A sector is therefore a radio resource domain, not merely a slice drawn on a coverage map.

The limiting quantity is usually signal relative to interference plus noise. If every cell increases power, desired power rises for its own users but co-channel interference rises for neighbors. Shrinking cells, steering beams, scheduling users on different resources, coordinating interference, and adding antennas can raise spatial capacity; power alone cannot. The propagation and antenna mechanics live in radio propagation, fading and diversity, antennas, and link budgets.

Older plans often separated co-channel cells by a frequency-reuse pattern. LTE and NR permit the same carrier to be reused in neighboring cells and provide scheduling, power-control, multiple-antenna, and coordination mechanisms for the resulting interference. A reuse-one deployment gives every cell the full carrier bandwidth, but it makes cell-edge performance and neighbor configuration first-class engineering problems.

The architectural generations #

Generation names hide two independent evolutions: the radio access network and the core network. A phone displaying “5G” proves that it has an NR radio component; it does not by itself prove that the session is using a 5G Core.

The KPI radio-systems course is useful for the historical GSM/GPRS mechanisms: a BSS is BTSs plus their controller, an MSC/VLR owns the circuit mobility context, and the SGSN/GGSN pair added a tunneled packet path. Its deployment descriptions are a 2012 snapshot and are not evidence for what any operator runs now. The current Release 19 versions of 3GPP TS 23.002 and TS 23.060 still specify those architectural families, just as Release 19 specifications still cover LTE and 5G. That standards continuity must not be turned into a universal deployment claim: retirement, refarming, roaming support, and emergency-service availability are operator- and region-specific facts.

GSM circuits and the GPRS overlay #

For a GSM voice call, the BSS allocates radio traffic resources and the MSC performs circuit switching and signalling toward other fixed or mobile networks. The VLR holds serving-area subscriber state so the network need not query the home database for every local event. When the phone is idle, a location area is deliberately coarser than a cell: the phone updates less often, and an incoming call pages several cells in exchange.

GPRS did not replace this path. It added a packet domain reached through the same broad radio access. A GPRS attach told the SGSN that the device was present for packet service. A PDP context then associated packet addressing and QoS state with a tunnel toward a GGSN, which connected to the external packet data network. The SGSN tracked packet mobility and security; the GGSN routed to the current SGSN. The historical READY/STANDBY/IDLE states expressed the recurring energy–reachability trade: fine cell-level knowledge costs signalling, while coarse routing-area knowledge requires paging.

UMTS/WCDMA as the bridge #

UMTS replaced the GSM radio path with UTRAN: Node B handled radio transmission and an RNC controlled radio resources and mobility. WCDMA users overlapped in time and frequency and were distinguished by spreading and scrambling codes; the code-domain mechanics and their loss of orthogonality are developed in spread spectrum and orthogonal codes. The architectural point is more important here: UTRAN could reach the circuit core through Iu-CS and the packet core through Iu-PS. A new air interface did not instantly create an all-IP system.

LTE/EPS removes the normal circuit path #

E-UTRAN flattened much of the RNC role into the eNodeB. The Mobility Management Entity (MME) handled NAS signalling, authentication, mobility, gateway selection, and bearer control. User packets bypassed the MME: the eNodeB sent them over S1-U to a Serving Gateway (S-GW), then through a PDN Gateway (P-GW) to an IP network. The S-GW acted as a mobility anchor; the P-GW allocated the device's packet address and enforced packet and QoS policy.

An EPS bearer was the unit of QoS treatment. End to end inside EPS it comprised a radio bearer, an S1 bearer, and an S5/S8 core bearer. One default bearer existed for a PDN connection, with dedicated bearers available for different treatment. Voice over LTE therefore became an IP multimedia service carried on packet bearers rather than a hidden GSM-style circuit inside LTE.

5G control plane and user plane #

The 5G architecture is easiest to understand as two paths sharing the UE and gNB. The control plane proves identity, records reachability, creates policy, and programs forwarding. The user plane carries application packets.

flowchart LR
    UE["UE"] -->|"Uu: RRC + radio bearers"| GNB["gNB"]
    GNB -->|"N2: NGAP control"| AMF["AMF"]
    UE -.->|"N1: NAS, carried through gNB"| AMF
    AMF -->|"session request"| SMF["SMF"]
    SMF -->|"N4 forwarding rules"| UPF["UPF"]
    GNB -->|"N3: GTP-U packets"| UPF
    UPF -->|"N6"| DN["Data network"]

The dotted N1 line is logical: NAS messages are between UE and AMF, but over radio they are payload inside RRC and are forwarded by the gNB in NGAP. The gNB terminates access-stratum radio protocols. The AMF terminates NAS access and mobility signalling. The SMF selects and controls a UPF, allocates or arranges addressing, and controls PDU-session QoS. The UPF routes and forwards packets; it can anchor mobility, buffer downlink traffic, and enforce traffic rules. Control-plane success and user-plane success are therefore distinct claims.

From power-on to the first packet #

The following sequence is simplified but preserves the boundaries that matter operationally.

1. Search, select, and camp. The UE searches supported carriers for synchronization-signal blocks, obtains timing and physical cell identity, decodes broadcast system information, chooses an allowed PLMN and suitable cell, and camps. While idle it performs cell reselection from serving and neighbor measurements and network priorities.
2. Acquire an RRC connection. Random access gives the UE an uplink timing relationship and an initial scheduled opportunity. RRC setup creates signalling radio bearers and a UE context at the gNB. RRC is a radio-access relationship, not yet proof of registration or packet service.
3. Register with the 5G Core. A NAS Registration Request is relayed to an AMF. Initial registration authorizes service, enables mobility tracking, and makes the UE reachable. Authentication proves the subscription and serving network; NAS security is established; the network returns allowed service information and a temporary identity.
4. Establish a PDU session. The UE requests connectivity to a data network name and slice. The AMF selects or reaches an SMF. The SMF selects a UPF, obtains policy and subscription data, creates N4 forwarding rules, and asks the RAN to establish the required user-plane resources. The UE receives the resulting session parameters and address information.
5. Map QoS to radio bearers. A PDU session contains one or more QoS flows, each identified by a QFI. The gNB maps those flows onto data radio bearers (DRBs). A default QoS rule keeps at least one flow available for the session; additional flows can receive different delay, loss, priority, or guaranteed-rate treatment.
6. Schedule each transmission. The gNB chooses physical resource blocks, layers, power-related parameters, and an MCS for each transmission interval. It sends downlink assignments or uplink grants. HARQ feedback quickly requests retransmission when a transport block fails.
7. Release radio context when idle. Registration and the PDU session can survive loss of an active user-plane radio connection. In CM-IDLE there is no N2/N3 connection for the UE, so network-originated traffic causes core-to-RAN paging. A Service Request restores signalling and user-plane resources. RRC_INACTIVE is a third radio state: the core connection and UE context are retained while the RAN, rather than the core, manages paging within a RAN notification area.

Registration answers who and where at tracking-area granularity. A PDU session answers which data network and policy. RRC answers whether this RAN currently holds active radio context. A DRB answers which access-stratum bearer carries a set of QoS flows. Keeping these nouns separate makes packet traces much easier to interpret.

Idle reselection, paging, and connected handover #

Mobility uses different mechanisms depending on state.

• In RRC_IDLE, the UE selects and reselects cells from broadcast rules and measurements. The core knows a registration area, not a continuously updated serving cell. When traffic arrives, the AMF pages through the relevant RAN area and the UE answers with a Service Request.
• In RRC_INACTIVE, the UE still reselects cells, but the RAN retains context. It updates when it leaves its RAN notification area, and RAN paging can retrieve the stored context without a full fresh setup.
• In RRC_CONNECTED, mobility is network controlled. The serving gNB configures measurements; the UE reports triggered results; the network prepares a target; and an RRC reconfiguration tells the UE to move. The UE synchronizes and performs random access at the target, confirms completion, and the network switches the user-plane path.

A successful radio move and a successful packet-path move are separate milestones. An inter-gNB handover can fail during target admission, delivery of the command, target synchronization/random access, context retrieval, or the later path switch. A trace that ends at “measurement report sent” has not demonstrated a handover. A trace that reaches target RRC completion but never restores N3 packets points beyond raw coverage.

NSA is a core-network fact, not an icon #

Non-standalone (NSA) and standalone (SA) describe deployment architecture, not two modulation modes.

The EPC-based NSA arrangement E-UTRA–NR Dual Connectivity (EN-DC) connects the UE to an LTE eNB that acts as the Master Node and an NR en-gNB that acts as the Secondary Node. The eNB has the control-plane connection to the EPC; the en-gNB contributes additional radio resources and may also have a user-plane path to the EPC. Removing LTE coverage can therefore remove the anchor even if an NR carrier is detectable.

In SA, a gNB is an NG-RAN node connected to a 5G Core: N2 reaches an AMF and N3 reaches a UPF. The UE uses 5GS registration and PDU sessions. 3GPP also defines dual-connectivity variants on 5GC—NGEN-DC, NE-DC, and NR-DC—so “two radios” does not automatically mean EPC-based NSA. The decisive evidence is the master node, core registration type, and observed core interfaces, not the status-bar label.

Scheduling turns radio quality into capacity #

LTE uses conventional OFDM in the downlink and SC-FDMA (DFT-spread OFDM) in the uplink. NR uses CP-OFDM in the downlink and supports CP-OFDM with optional transform precoding in the uplink. Those waveform choices are explained in multiplexing and synchronization and ISI. At the network level, the important fact is that a scheduler makes a new resource decision repeatedly rather than assigning one permanent frequency to each user.

The scheduler combines several kinds of evidence:

• Buffer status says which users have data waiting.
• CQI is the UE's report of the highest standardized channel-quality index whose reference transport block it estimates can meet the configured error-probability target. It is an input, not an order.
• MCS is the modulation-and-coding choice actually signalled for a transport block. The gNB may select it more conservatively than the latest CQI because reports are delayed, the channel has changed, interference is uncertain, or retransmission state matters.
• HARQ supplies fast ACK/NACK feedback and soft-combining retransmissions. It repairs occasional block failures, but repeated HARQ consumes resources and exposes an overly ambitious link adaptation or a rapidly changing channel.
• QoS and priority decide which eligible packet should be served first or protected from delay. In 5GS the QoS flow is the finest core QoS granularity; the gNB maps flows to DRBs and then schedules their logical-channel data onto physical resources.

The scheduler allocates physical resource blocks (PRBs), but PRB percentage is not throughput. Two users consuming the same PRB count may carry very different useful bits because their MCS, spatial layers, retransmissions, control overhead, and direction differ. Likewise, a higher MCS is not always success: if BLER and HARQ repetitions rise, delivered throughput can fall.

Identities and security needed to follow one connection #

Cellular traces contain several identifiers because no single identifier should be exposed everywhere or used for every scope.

• The SUPI is the permanent subscription identifier. In normal 5G initial access it is represented by a SUCI, a concealed, one-time-use subscription identifier carrying enough clear routing information to reach the home network. The specification also permits a null concealment scheme under defined provisioning or emergency conditions, so “SUCI” must not be assumed to mean public-key concealment occurred.
• The AMF assigns a 5G-GUTI, a temporary identifier that lets later access find the serving AMF and UE context without exposing the SUPI. The shorter 5G-S-TMSI is used in efficient radio procedures such as paging and access.
• RAN-local identifiers—such as a C-RNTI on the radio interface and AMF/RAN UE NGAP IDs on N2—identify a context, not the subscription globally. Tunnel endpoint identifiers identify a user-plane tunnel, not a person.
• PLMN, tracking area, NR cell identity, physical cell identity, and carrier identify where and on which radio the event occurred. Physical cell identity alone is deliberately reused and is not globally unique.

5G authentication binds the subscription and serving network and derives keys. NAS security protects signalling between UE and AMF; access-stratum security protects RRC and, according to policy, user-plane traffic between UE and gNB. A useful trace therefore follows identity translation: temporary radio identity → NGAP UE context → AMF registration context → PDU session → QFI/DRB → N3 tunnel. Logging a permanent subscriber identity in every layer is neither necessary nor desirable.

Follow one application packet #

Assume the UE is registered, a PDU session exists, and the application emits an uplink IP packet.

1. The UE matches the packet against its QoS rules and assigns a QFI.
2. SDAP maps that QoS flow onto a DRB. PDCP, RLC, and MAC apply the configured access-stratum processing; their detailed reliability and ordering roles are separate from the core session.
3. If the UE has no uplink grant, it reports that data is buffered and requests scheduling resources. Timing advance keeps its uplink arrival aligned with the gNB's receive window.
4. The scheduler selects PRBs and an MCS, and the UE transmits a transport block on the granted uplink resources. HARQ feedback determines whether a rapid retransmission is needed.
5. The gNB removes the radio protocols and sends the packet in the appropriate N3 GTP-U tunnel to the UPF. The tunnel and QFI identify the PDU session path and treatment.
6. The UPF applies SMF-installed forwarding and policy rules and sends the packet over N6 toward the data network. The return packet follows the reverse user-plane path.

If downlink data arrives while the UE is CM-IDLE, the packet cannot simply appear at the gNB because its N2/N3 UE connection is absent. The UPF reports or buffers according to its rules; session management reaches mobility management; the AMF pages the registration area; and the responding UE re-establishes access with a Service Request. Only after the user-plane resources are activated does packet forwarding resume.

Troubleshooting by evidence, not by generation label #

First define the failure: no suitable cell, registration rejected, session establishment rejected, radio connected with no packets, low throughput, or interruption during mobility. Then correlate UE, RAN, and core timestamps. Radio metrics without procedure messages cannot diagnose a core rejection; core success without packet counters cannot prove a working user plane.

Useful diagnostic patterns:

• No cell: check carrier/band support, synchronization and system-information decode, barred/allowed PLMN and cell status, then RSRP. An empty registration trace is expected if access never reached NAS.
• Cell selected, registration fails: read the Registration Reject or authentication/security procedure and the AMF's corresponding cause. Repeatedly adjusting RF thresholds cannot fix an unknown subscriber, forbidden PLMN, or authorization failure.
• Registered, no PDU session: follow the DNN, slice, SMF selection, address allocation, policy, and PDU Session Establishment Reject/Accept. Do not call this an RRC failure merely because the app has no data.
• Session exists, no traffic: map PDU session → QFI → DRB → N3 tunnel → UPF forwarding rule → N6 route. Confirm packets at each boundary in both directions.
• Strong RSRP, poor throughput: compare RSRQ/SINR, CQI, scheduled MCS, first-transmission BLER, HARQ retransmissions, rank/layers, queued bytes, and PRB occupancy. This separates interference, a bad link-adaptation loop, and scheduler congestion.
• Mobility interruption: align measurement event, handover request/acknowledgement, RRC command, target random access, completion, path switch, and first resumed user packet. The gap between the last two is often invisible in a radio-only trace.

A minimal connection evidence bundle #

When one case must survive handoff between radio and core teams, capture enough state to join the layers:

1. UTC timestamps and a synchronized time base;
2. PLMN, carrier, bandwidth part where relevant, cell identity, physical cell identity, tracking area, serving/neighbor measurements, and RRC state;
3. temporary UE identities and RAN/AMF UE context identifiers—redacted consistently, not independently;
4. registration type and result, authentication/security outcome, and explicit cause values;
5. PDU session ID, DNN, slice, address, QFIs, DRBs, and N3 tunnel identifiers;
6. per-direction buffered bytes, grants, PRBs, MCS, layers, BLER, HARQ outcomes, and packet counters;
7. for mobility, source/target cells and every preparation, execution, path-switch, and release milestone;
8. packet evidence at UE, gNB, UPF, and N6 when the complaint is end-to-end data.

The identifiers are join keys, not the diagnosis. The diagnosis comes from the first boundary at which expected state or packets disappear.

Boundaries with neighboring topics #

This entry explains the system that selects, schedules, moves, and accounts for radio links. It deliberately leaves constellation geometry and error probability to digital modulation, redundancy to channel coding, frequency/time/code resource construction to multiplexing, waveform timing to synchronization and ISI, and propagation margins to link budgets. Those mechanisms determine what one scheduled transmission can carry; the cellular architecture determines which transmission is attempted, where its state lives, and how its packets continue when the UE moves.