Question
What are the four phases a mobile phone goes through from power-on to being able to send data?
Answer
Power on → network and frequency selection → registration (Location Update) → data channel setup.
* Power-on to data in four phases. *
The pipeline:
| Phase | What happens |
|---|---|
| 1. Telefon einschalten | The phone boots, reads the SIM |
| 2. Netz- und Frequenzwahl | Scan frequencies, find cells, decode their broadcasts, pick a network |
| 3. Einbuchung (Location Update) | Register with the network — authenticate and let it know where you are |
| 4. Aufbau Datenkanal | Set up the data path (for 2.5G+: GPRS attach + PDP context to reach the internet) |
Why this matters: Most people have a good mental model of what happens when a laptop joins Wi-Fi or opens a TCP connection — but almost nobody knows the equivalent story for mobile networks, even though we carry these devices everywhere. This sequence is that story for 2G/3G.
Going deeper: The classic walkthrough of this whole sequence is Harald Welte's CCC talk "What happens on a protocol level when I switch on my phone?" (Easterhegg 2018, 62 min, freely available at https://media.ccc.de/v/ARMP3D) — step by step through the real protocol messages, aimed at people who know TCP/ARP but not mobile.
Go deeper:
Harald Welte — What happens on a protocol level when I switch on my phone? (CCC, 2018) — the canonical 62-min live walkthrough of exactly these four phases in real protocol messages, for people who know TCP/ARP but not mobile.
OsmocomBB (Wikipedia) — Welte's free GSM baseband (L1–L3 phone-side stack) that lets you actually run and trace this power-on sequence on a real handset.
Note saved — thanks!
Question
How does a 2G phone find and select a network after power-on (network selection)?
Answer
The phone scans all frequencies for energy (RF Power Scan), sorts the hits by signal strength, synchronizes to the strongest carriers, decodes each cell's broadcast channel (BCCH) to learn MCC, MNC, and Cell-ID — then picks a network manually or automatically.
* From scanning for energy to picking an operator. *
Step by step:
- RF Power Scan — "where is energy?" The phone sweeps the frequency bands looking for active carriers (conceptually like a WLAN scan)
- Sort by signal/energy strength — strongest candidates first
- Synchronization (Freq + Sync Burst Detection) — lock onto the carrier: Where am I in the time multiplex? Where does the frame start (clocking)? Aided by the known training sequence
- Decode the System Information Block on the BCCH (Broadcast Control Channel — the cell's general broadcast channel) → learns MCC (country), MNC (operator), and Cell-ID
- Network selection — either manual (user picks from a list) or automatic, based on:
- the SIM card's priority list of preferred networks
- forbidden networks (also stored on the SIM)
- preference for the home network
Key insight: Until step 4, the phone knows only "there is energy on this frequency." Only the BCCH decode turns an anonymous carrier into "this is Salt, cell #12345" — everything identity-related comes from that broadcast.
Go deeper:
Broadcast control channel (Wikipedia) — the downlink beacon the phone decodes in step 4: it carries the System Information (cell identity, config, neighbour list) and must transmit continuously at full power.- GSM logical, physical, broadcast & control channels (Electronics Notes) — how BCCH, RACH and SDCCH fit together, so you can see where the scan-and-decode step sits among GSM's channel zoo.
Note saved — thanks!