mwiacek.comColorColor | Mobile  
NetMonitor in Nokia DCT1-DCT3 phones (part 2/7) (2002)
Submitted by marcin on Mon 07-Oct-2002

English article

[Part 1][Part 2][Part 3][Part 4][Part 5][Part 6][Part 7]

  1. What is it ?
  2. Do I need it ?
  3. Does my phone use more power with NetMonitor enabled ?
  4. How to activate it ?
  5. Which NetMonitor version can be activated in my phone ?
  6. Does NetMonitor activation void warranty ?
  7. NetMonitor menu in my phone has different number than 10. Is it normal ?
  8. NetMonitor menu in my phone has 11 number, hovewer previous position has 9 number. Is it normal ?
  9. How to use it ?
  10. Can I damage my phone ?
  11. Glossary
  12. Description of the individual tests
  13. You can also use a program...
  14. Can I use NetMonitor without SIM card inserted, without PIN number entered or when SIM card is not active ?
  15. How can I disable NetMonitor ?
  16. Do I need to disable NetMonitor before sending my phone to the service ?
  17. Is it possible to re-activate NetMonitor after disabling it ?
  18. Is NetMonitor available in analog Nokia phones ?
  19. Does NetMonitor allow to use phone like broadcast station ?
  20. I don't have all described tests in my phone. Why ? Can I increase their number ?
  21. Does NetMonitor allow to identify place, where is my interlocutor ?
  22. Does NetMonitor allow to identify place, where am I ?
  23. What are NetMonitor codes ?
  24. Is it the truth, that in phones with additional hardware changing frequency band NetMonitor doesn't work correct ?
  25. Where can I find description of FBUS/MBUS protocol and commands connected with NetMonitor ?
  26. I have non existing networks on the list of forbidden networks...
  27. How to check frequency band (900 or 1800 Mhz), where phone work in this moment ?
  28. Can I use DLR-2/DLR-3 cables for activating netmonitor ?
  29. Can I activate netmonitor using Init File Editor (Nokia 9110) ?
  30. Can I force phone to use one frequency band (900 or 1800 Mhz) only ?
  31. How to change settings in tests ?
  32. My phone has very short snandby time - it is possible to see the reason of it ?
  33. Is netmonitor available in English version only ?
  34. Information sources
  35. Additional information
  36. Does using/activating netmonitor cost anything ?
  37. Does using netmonitor is legall ?
  38. Which entries on SIM card are used in netmonitor tests ?
  39. Can I activate netmonitor in 3310 using soft working with 3210 ?
  40. After activating netmonitor/BTS TEST my phone can't find network...
  41. Netmonitor shows different battery capacity than info on it...
  42. NetMonitor in Nokia 6310, 8310,...

11. Glossary

Here you can find explanation to some terms, which can be found in this FAQ:

ACCH (Analog Control Channel) (TDMA 800/TDMA 1900)

AMPS (Advanced Mobile Phone Service)
Analogue cellular system working in 800 Mhz used, for example, in North America.

ASIC (Application Specific Integrated Circuit)
Electronic chips designed for some concrete purposes (for example, in phone it controlls communication between MCU and DSP) They're designed and produced by the companies which use them.

AVCH (Analog Voice Channel) (TDMA 800/TDMA 1900)

BCC (Base-station Color Code) (GSM/DCS/PCS)
3-bit number (from 0-7 range) used to distinguish neighbor cells of the same operator, transmitting using BCCH in the same FDMA channel. Such distinguish is not needed when the cells belong to different operators (they use different channels and their BCCH are in different FDMA channels). It is given in BSIC of each BTS (you can check it for example in
test 2).

BSC (Base Station Controller) (GSM/DCS/PCS)
It controls and supervises one or more BTSes.

BSIC (Base Station Identity Code or Base transceiver Station Identity Code) (GSM/DCS/PCS)
Unique ID number of each BTS. If we code this value binary, first three digits (in decimal format) are NCC and next three are BCC. These values range from 0 - 63. BSIC values can be found among others in test 2.

BTS (Base Transceiver Station) (GSM/DCS/PCS)
This device allows communication between phones and cellular network (many parameters, like current communication channel, distance to BTS and signal quality can be found, for example, in test 1).

And here are another classes with maximum power of BTS:

GSM 900
GSM 1800
320 W (55 dBm)
160 W (52 dBm)
80 W (49 dBm)
40 W (46 dBm)



20 W (43 dBm)
10 W (40 dBm)
5 W (37 dBm)
2,5 W (34 dBm)

In Polish version of this FAQ I give many links to WWW pages with BTS lists, their descriptions, pictures (in Poland).

From English pages I recommend site - it's about networks and BTSes in North America.

Another links connected with it:

C1 (path loss-criterium) (GSM/DCS/PCS)
This is a parameter (ranging from -99 to 99 dBm) calculated by the phone to decide which cells to use (it uses the cell only if its C1 is positive). This value is based on:

  • RX
    Strength of signal received in BCCH channel. If it is equal or less than RxLevAm, the phone searches for next BCCH channel. It is shown in test 1 (for current channel) and also in test 3, test 4 and test 5 (for neighbor channels). The amount of measurements of the quality of transmission with BCCH channels in neighbor cells is given in test 62
  • RxLevAm (Rx Level Access minimum)
    Min. level of the received signal (usually from -100 dBm to -110 dBm) needed by the phone to use particular cell.
  • MSTxPwr
    Max power, which can be transmitted by phone to get access to RACH channel (i.e. max power allowed by current cell). Actually, it is lower in towns (where cells are small) and higher outside them.
  • MSMaxTxPwr
    Max permissible transmission power of the phone (its classes are described in TX description).

It is calculated using following formula: C1 = (RX - RxLevAm - MAX ( ( MSTxPwr - MSMaxTxPwr ), 0) ) , where MAX(x,y) is obviously a mathematical
function giving the bigger one of the discussed numbers. The phone shows C1 value in test 1 (for current channel) and in test 3, test 4
and test 5 (for neighbor channels).

C2 (cell-reselection criterion) (GSM/DCS/PCS)
This parameter (-99 to 99 dBm) is calculated with following formula: C2 = C1 + Cell reselect offset - Temporary offset * H (Penalty time - T). If this value for some other cell (C2 for neighbor channels can be found in test 3, test 4 and test 5) is higher than this value for current cell (shown in test 1 and test 3) for a period of time longer than 5 seconds, the phone switches cells. There are two exceptions to the rule:

  • if the new cell is located on different 'Location Area (this parameter for current cell can be checked in
    test 11), C2 for this cell must be (during more than 5 seconds)
    higher than C2+CELL_RESELECT_HYSTERESIS for old cell (where CELL_RESELECT_HYSTERESIS is a
    special parameter sent in BCCH channel).
  • if the phone switched cells during last 15 seconds, C2 for a new cell must be higher at least 5 dBm from
    C2 value of the old cell.

H(x) function for currently not used cells is 0 (if x<0) or 1 (if x>=0). For current cell H(x) is always equal 0.
By a skillful manipulation of this parameter (through CELL_RESELECT_HYSTERESIS), operators can direct connections to specific cells (thus lightening load of the network).

CDMA (Code Division Multiple Access; also known as IS-95)
One of the newer digital technologies in 800 or 1900 Mhz. Used in North America, Australia and some southeastern Asian countries (e.g. Hong Kong and South Korea). It doesn't divide the radio frequency spectrum into separate user channels by frequency slices or time slots, but separates users by assigning them digital codes within the same broad spectrum.

DCCH (Digital Control Channel) (TDMA 800/TDMA 1900)

DCS (Digital Cellular System)

Cellular communication system working in 1800 MHz frequency band (currently more often called GSM 1800) - a changed version of GSM (900 MHz) system. Its new features allowed to increase network capacity (that's why this system is used in urban areas with huge number of subscribers) at the cost of thick net of the base stations (BTSes) and to provide roaming within one country. GSM 1800 has different channel numbers (see test 17), different phone (see RX description) and BTSes transmission power and also different max speed of the user, at which he can use his phone (250 km/h in GSM and 130 km/h in DCS).

DSP (Digital Signal Processor)
Signal processor (digital signals processing chip - controls radio interface and speech coding/decoding). Its version can be checked in test 88.

DTCH (Digital Traffic Channel) (TDMA 800/TDMA 1900)

DTX (Discontinous Transmission Exchange)
Some phones and networks "care" ;-) about battery life using so called discontinuous transmission (DTX), which turns off phone's transmitter when we don't talk (but - for example - listen to the calling party). During that period the phone generates a so called comfortable :-) noise, because if our interlocutor heard the silence, he could think that the connection was broken.

DTX must be supported by the phone (Nokia does - see test 78) and BTS - you can check and (sometimes) change this in test 12 and test 13.

FDMA (Frequency Division Multiple Access) (GSM/DCS/PCS)
This name means multiaccess on frequency field: transmission proceeds on different frequencies at the same time (this is a "full duplex" connection): there is a "down-link" from BTS to the phone and "up-link" - from the phone to BTS (this is called "up" and "down" because BTS antennas are usually higher than phone ones, so the signal from BTS to the phone really must go down (and vice versa)).

Frequency hopping (channel hopping) (GSM/DCS/PCS)
During connection your phone can continuously change used frequency (used channel) in communication with cell. It's used, when some channel is still troubled - without channel hopping communication with phone could not be possible, with it it's - only this part of transmition, which is made on this frequency, is lost (so, if gives less number of signal loss, but doesn't change sound quality - methods of coding it are always the same). You can check (during a call) if your phone uses this function in test 1. test 12 informs if it is allowed by the cell (these values are updated only during a call). Channel hopping requires Hopping Sequence Number (frenquencies are changed according to known for phone and network sequence) - see test 2.

GSM (Global System for Mobile Communication
Cellular telecommunication system working at 900 MHz. It also has a 1800 MHz (DCS) and 1900 MHz (PCS) version.

HLR (Home Location Register)
Network register containing information about subscribers (i.e. about their subscribed services, tariff, last network they were logged in, etc.).

IMEI (International Mobile Equipment Identification code) (GSM/DCS/PCS)
Unique 15-digit identification number of every GSM phone on the world. It can be checked using *#06# code (all phones) or in service menu (Nokia), which can be activated by typing a code *#WAR0ANTY# or *#WARRANTY# (Nokia 6130). In Nokia 3110 after entering service menu (*#WAR0ANTY#) you have to additionally enter a code 9268. IMEI contains information about the manufacturer, place of production and serial number (check for such list for Motorola phones, here is my list for Nokia phones). Operators can restrict network access for particular phones - for example the stolen ones (identified using IMEI number). Different operators can exchange such lists too.

IMSI (International Mobile Subscriber Identify) (GSM/DCS/PCS)
Unique (max 15-digit) number given to the phone:

  • first three digits are MCC
  • next three digits are MNC
  • the rest is a unique number

It's saved on SIM card

It is a procedure executed after each power on. The phone informs network that it is active (and is ready for communication - receiving waiting SMS, etc.) and then it receives the TMSI number assigned to IMSI from SIM card. The counter connected with IMSI attach is located in test 64, test 7 informs whether this is allowed by the current cell.

The phone informs network that it is going to switch off and the communication won't be possible (its IMSI expires). The counter connected with IMSI detach is located in test 64. test 7 informs whether this is allowed by the current cell.

Location Update (GSM/DCS/PCS)
Every GSM phone periodically informs network about its current location. This function is called Location Update. It is executed after changing Location Area (phone makes it "intelligent" - when it's moved out of network coverage and the logs again to the network, makes Location Update only when current BTS has different LAC than previous one - before losing the signal) or PLMN (after leaving the range of one network and trying to log in to another). Then information about Location Update is transferred to a new MSC/VLR, which in turn passes this information to HLR. When the phone works in new MSC/VLR, HLR doesn't identify the user by the number received from old MSC/VLR anymore. Location Update has a couple of varieties: PLU, IMSI attach and IMSI detach (they're distinquished in test 64). Current Location Area code can be checked in test 11.

MCU (Master Control Unit processor)
Main processor in phone.

MSC (Mobile Switching Center) (GSM/DCS/PCS)
Part of the system responsible for communication between subscribers and other users (also from other networks).

NCC (National Color Code or Network Color Code) (GSM/DCS/PCS)
3-bit number (from 0-7 range) used to differentiate cells of the operators from different countries (for example near the border, where the phone is in range of several different networks) transmitting using BCCH in the same FDMA channel. This number is constant within PLMN. It is given in BSIC of every BTS (you can check it in test 2).

PLMN (Public Land Mobile Network) (GSM/DCS/PCS)
Area covered by one operator (one network). After changing this area, the phone executes Location Update.

PLU (Periodic Location Update)
The phone informs network, on which country area (in the range of which cells) it is located. This procedure is executed periodically (depending on the network, for example in Polish Era GSM and Plus GSM networks every 3rd hour, in Idea every 2th hour) - this can be checked in test 10. This period is counted from the last "contact" with network (the counter doesn't stop even if the phone loses network signal!) - from the last call, sending/receiving SMS, requesting some services (for example enabling call diverting), because the network is then informed about phone's location (but this is not registered in test 64). The counter connected with PLU is in test 64.

TCH (Traffic Channels) (GSM/DCS/PCS)
Two way user data (computer data or digitized voice) channels. They can be divided to:

  • HR (Half Rate Traffic): max data transfer rate is 6.5 kbit/sec (introduced in GSM phase 2). HR channels offer worse sound quality but also longer phone standby time (even up to 30%), because the phone using HR uses less power. The main advantage of this kind of channels is that they enable the network to double its capacity (the number of subscribers able to make a call at the same time - see TS parameter description for more details) or to double the max range of the BTS. Using these channels must be allowed and supported by the network (this can be checked in test 7) and the phone. Activation code is
    *HRC0#, deactivation code is #HRC0#. Unfortunately, not all Nokia phones accept these codes (the phone should reset itself after entering them) - in older models they're not supported, in never they're deactivated, when the phone is directed to countries with networks, which doesn't support it. Interesting fact is that in Nokia 6110 (firmware 5.24) you can decide whether the phone can use this channel or not by modifying following EEPROM memory cells values:
    enabling disabling
    cell 0070 value for 78

    cell 011F value for 84
    cell 0070 value for 70

    cell 011F value for 7C
  • FR (Full Rate Traffic):transmission at 13 kbit/sec, coding using LPC-RPE (Linear Prediction Coding with Regular Pulse Excitation) algorithm
  • EFR (Enhanced Full Rate): 13 kbit/sek, coding algorithm different than in FR (ASELP (AlgebraicCode Excitation Linear Prediction) created by Nokia and Sherbrooke University; recognized as an industrial standard for GSM). EFR provides better sound quality at the same data transmission rate (and up to 5% faster battery drain compared to FR). This mode can be enabled using *EFR0# code (the phone then tries to use TCH channels in following order: EFR, FR, (HR)) and disabled with #EFR0# (order: FR, (HR)). These codes may be not recognized by some models (for example 6110 with some firmware versions) - if your phone accepts them, it should reset itself right after typing them (if this doesn't happen, you won't be able to enable/disable EFR using a keyboard code). This channel is not supported in all older models (for example, 2110). The type of channel used by your phone can be checked only during connection.

When you network doesn't support one of these channel and phone recognizes its activation code, you may see "Not ready" message.

You can check this in test 1.
The sequence of TCH channels can be freely set using some of the service programs (for example WinTesla - in Software/Product Profile menu) - it can be only possibility to enable HR channel in phone.

TDMA (Time Division Multiple Access) (GSM/DCS/PCS)
This means multiaccess in time: several phones can transmit signal (either digitized voice or computer data) in the same time on the same channel (its number can be checked in test 1) - actually, this period of time is divided into very small parts (see TS description), invisible for us, so we can assume it happens simultaneously).

TMSI (Temporary Mobile Subscriber Identity): (GSM/DCS/PCS)
During signalization procedures encrypted on radio channel (for example, during location update) this number is assigned by MSC to phone. In the moment, when network wants to contact with concrete phone and transmission on radio channel is not encrypted, it's send instead of IMSI and allows phone to indentify, that concrete call concern on it. It doesn't have global meaning and it's structure is definited by network administrator. Actual TMSI you can check in test 10.

TS (Time Slot)
Each radio channel used in communication between phone and BTS is divided into 8 parts (called TS - time slots). If in all BTSes (available for your phone) all time slots are in use, you won't be able to make/receive a call and you'll get a 'Network busy' message (information about reason of connection failure is given among others in test 39). Unfortunately, each type of connection has the same priority in networks not supporting GSM Phase 2+ (it isn't available in older GSM Phases) - so if you want to dial emergency number 112 and the network is busy, no other call will be interrupted and you won't get connected. This problem can also be solved by adding more BTSes (for example in dual GSM 900/1800 MHz network) or by modifying current stations to allow the use of HR channels (FR and EFR transmission uses whole assigned time slot, while HR (defined in GSM Phase 2) only half of it). Max data transmission speed using one TS is 9.6 kbit/sec (or 14.4 kbit/sec, but only in some additional conditions). There are new systems allowing higher transmission speeds (for example GPRS (Generic Packet Radio Services) or HSCSD (High Speed Circuit Switched Data), but they achieve this using several time slots at the same time (which decreases network capacity). Actual used TS can be checked in test 1, in phones with HSCSD (like Nokia 6210) use also test 8 for it...

VLR (Visitor Location Register) (GSM/DCS/PCS)
This register contains the same data as HLR, but for roaming guests (their data are taken from their home network HLR).

Back to the top

[Part 1][Part 2][Part 3][Part 4][Part 5][Part 6][Part 7]