Sector Antenna Number Identification for CDMA and GSM

The “unique IDs” are SID:NID:BID for CDMA, and MCC:MNC LAC:CID for GSM.

When attempting to identify base station antennas mounted on the same tower (or the same level of a tower with multiple sets of antennas), it is useful to note that the BIDs (for CDMA) or CIDs (for GSM) are typically related numerically — in groups of three, each covering a sector of 120°. The ‘sector numbers’ are often encoded in the BID or CID and typically go in clockwise order, starting with 1, from the antenna aimed closest to North or NorthEast.

Sector Number — Typical antenna pointing direction:

Omni-directional antennas — which are rare — may be assigned sector number 0. Unfortunately different carriers use different numbering schemes for related sector antennas (and sometimes a carrier may use different schemes in different parts of the country — sometimes as the result of company acquisitions and mergers). Here are some of the more commonly used schemes:

GSM 1: At least when CID < 65536, GSM CIDs are often treated as decimal numbers. One common scheme is to have the least significant decimal digit of the CID be 1, 2, or 3 for three related sector antennas. For example CIDs: 44441, 44442, and 44443. In some cases, where base station antennas of different frequencies are mounted on the same tower, the digits 4, 5, and 6 — and perhaps even 7, 8, and 9 — may be used in groups of three for the same purpose. Vodafone-UK uses this code.

GSM 5: Alternatively, when CID < 65536, GSM CIDs may be treated as decimal numbers, with the 10,000 decimal digit (fifth digit from the right) being the sector number. For example CIDs: 14444, 24444, and 34444. O2-UK uses this code. Where base station antennas of different frequencies are mounted on the same tower, a second set of three sectors may be numbered 4, 5, and 0 (i.e. what would have been a '6' wraps around to '0'). Chunghwa Telecom in Taiwan uses this code.

GSM 16: When CID > 65536 (0xFFFF) and CID < 16777216 (0xFFFFFF) GSM CIDs may be treated as hexadecimal numbers, with the last hexadecimal digit being the sector number. T-Mobile uses this scheme in places.

CDMA 1: For CDMA, the BIDs are often treated as hexadecimal numbers. One common scheme for CDMA uses the least significant hexadecimal digit as the sector number. For example, 0x4441, 0x4442, and 0x4443. U.S. Cellular uses this code — as does China Telecom in some areas.

CDMA 3: Another scheme used with CDMA systems is to instead employ the third hexadecimal digit from the right (so BIDs for related base stations are separated numerically by 256 decimal). For example, 0x4144, 0x4244, and 0x4344. Verizon Wireless typically uses this code, as does SPRINT/Nextel — and China Telecom, in some areas. (If you wish, you can think of this as due to a big-endian versus little-endian interchanging of the two bytes in the BID).

Reversing directions from the above list, we have

Sector Number — Typical rough direction to antenna:

This is only approximate, of course, since (i) sectors typically cover 120°, (ii) antennas may be aimed to best match local topography and road layout, not follow default recommendations; (iii) one is not always connected to the sector antenna aimed in a direction closest to one's location.

Sector Antenna Number Identification for LTE

The unique IDs in the case of LTE are MCC:MNC TAC:CI (although, TAC may not be needed, because it may be encoded in CI). While not essential for figuring out where the LTE base station antennas are that one might be able to connect to using a cellular repeater, it can be interesting to look more carefully at TAC, CI and PCI.

In LTE, PCI (Physical Cell Identity) is a 9-bit number between 0 and 168 * 3 = 504. It is a compact local identifier — at any given location, no two base stations should have the same PCI (and, unless a device is actively interacting with a cell, it likely only sees this 9 bit PCI code, not the full identification). PCI may at times have to be reassigned to avoid interference between LTE base stations “within ear shot” of one another. (Note that, typically, if one adds 1 to the remainder when PCI is divided by 3, one obtains the sector number — see below).

CI is a 28 bit number, the last 8 bits of which are the sector number — while the top 20 bits are the so-called eNodeB number. The last two digits of CI, when expressed as a hexadecimal number, specify a particular antenna in a group of related antennas. That number typically is 0x01, 0x02, or 0x03 (In some rare case 0x00, 0x01, 0x02 will be used instead). If there are more than three sectors, the others may be numbered 0x04, 0x05, 0x06, or 0x07, 0x08, 0x09 (or 0x11, 0x12, 0x13, or 0x19, 0x1A, 0x1B). These numbers are assigned in a similar fashion to the sector numbers for antennas used for CDMA/GSM voice. In many cases there are two (or three) groups of three sector antennas for LTE. The second group of three may be for a set of antennas aimed higher than the first set of three (to cover areas further away).

Service providers may use particular parts of the TAC for regional grouping purposes. For Verizon Wireless e.g. the low order 8 bits(last two hex digits) of TAC typically represent a “super region” (collection of related nearby TACs) that may cover a small state, or a large city.

Further, part of the TAC may be encoded in the CI as well. For example, the top 24 bits of the 32-bit CI (i.e. the eNodeB number), when divided by 1000 (decimal), may yield the "super region" part (low order 8 bits) of the TAC described above.

By the way, the partial redundancy between TAC, CI and PCI makes it easier to reject bogus LTE base station IDs that arise due to inaccurate decoding, (or due to asynchronous updating of the components of the antenna ID in the RIL).

Relationships between CDMA/GSM voice and LTE data base station antenna numbering

Antennas for LTE (data) often are on the same tower as those for CDMA or GSM (voice) (in some cases, where nearby frequencies are used for voice and data, the same antenna may even be used for both). The unique IDs for these antennas may be related. This does not mean that one has to be connected to corresponding antennas used for voice and data. One often is connected for CDMA/GSM to one base station antenna and for LTE to another antenna, which may be elsewhere.

In the case of GSM, LTE TAC:CI is often the same as the GSM LAC:CID.

Another example of a relationship between the unique identifiers is the scheme used by Verizon Wireless. To find the CDMA BID, take the LTE CI mod 256,000 (that is, divide by 256 and by 1000 and take the remainder). Express the result as a hexadecimal number — with digits numbered 0 through 5, with 0 being the lowest order digit (i.e. 0x543210). The hexadecimal digits numbered 1 and 5 should be 0s. Rearrange the remaining four digits in the order 0x4032. The result is the BID for the corresponding CDMA base station — typically on the same tower and aimed in the same direction. (This computation is more easily expressed as a program than in words!).

Knowing this relationship can make it easy to map out LTE base station antennas once CDMA base station antennas have been located.

Click here to go back to main article on cellular repeaters.
Berthold K.P. Horn,