Hi Jesse, > When the mobile phone makes a communication with the base tower, it emitts the TMSI right?
No. It emits very short access burst that contains a cause for channel establishment (e.g. call, answer to paging, etc.) and some random reference (see TS 04.18 section 9.1.8). The BS then addresses the phone for which the dedicated channel has been allocated by a cause, random reference and frame number at which the access burst has been sent. > Is the TMSI emission form the phone encrypted? The message that contains TMSI (e.g. Paging Response, Location Updating Request) is sent over mobile on uplink SDCCH, but usually replayed on downlink SDCCH unencrypted. This means that you in principle can intercept the TMSI/IMSI on the downlink, but you have to listen to SDCCH which may hop in the general case. Vadim. 2010/11/24 Jesse Wang <[email protected]> > Hi > > When the mobile phone makes a communication with the base tower, it emitts > the TMSI right? Is the TMSI emission form the phone encrypted? Can we > capture it without decryption? > > Regards, > > Jesse Wang > > > _______________________________________________ > A51 mailing list > [email protected] > http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 > >
_______________________________________________ A51 mailing list [email protected] http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
