How your phone picks a tower

Two dozen USB modems bolted to a shelf in a room nobody walks through. None of them have moved since I screwed them down. The serving cell in my logs changes all day.

For a while I treated that as a fault and wired a monitoring check around it, on the reasoning that a stationary device hopping between towers must be broken. The check fired often enough to make the dashboard useless. The assumption was wrong at the root, and working out why turned into the whole story of how a handset attaches to anything.

The handset is a survey instrument

A handset runs a survey that never stops. It decodes the synchronisation signals of every cell within earshot, reads the identity each one broadcasts, measures it, and keeps an ordered list of neighbours with numbers attached. That happens with the screen off. It happens while the device is doing nothing at all.

Who acts on the list depends on what the phone is up to. Idle, with nothing to send, it selects for itself using thresholds the tower broadcasts to everyone in range, and the network is never consulted. In connected mode that inverts. The phone measures and reports, and the network issues the orders.

Bars are the least useful number on the screen

Three measurements matter in LTE and its 5G equivalents, and the status bar shows none of them.

RSRP is the power of the cell specific reference signal, averaged per resource element so channels of different widths compare honestly. It runs from around minus 80 dBm for something excellent down past minus 110 where things get thin. RSRQ divides that reference power by the total received power in the band, which includes every other cell on the frequency. SINR is the ratio of wanted signal to interference and noise, and it tracks throughput.

Bars usually come from RSRP or from raw received power, and the mapping to a bar count is a vendor decision with no standard behind it.

The gap shows up in practice. One of my lines sat at what any user would read as full signal and moved about 400 kilobits a second, because it was parked where three sectors overlapped at nearly equal power. Excellent RSRP, terrible RSRQ. Shifting it 80 centimetres fixed it.

Suitable, then whatever the operator prefers

3GPP does not ask a handset to find the best cell. It asks whether a cell is suitable, which is an inequality. The tower broadcasts a minimum required level, the phone subtracts that minimum and a compensation term for the transmit power it has in hand, and camps if what is left is above zero.

So most of the careful ranking gets discarded there, and what sorts the survivors is priority.

Every frequency layer carries a broadcast priority, eight levels of it. A handset is told to reselect to a higher priority layer whenever that layer is merely above a threshold, even when its current cell is considerably stronger. There is the mechanism behind behaviour that looks like a fault: the phone leaves a strong cell for a weaker one deliberately.

The reason is capacity. Low band propagates further and penetrates buildings, so everybody can hear it and it saturates. Higher bands cover less ground and carry far more traffic, so the network moves anyone who can survive up there and reserves the low band for people who need the reach. Your own signal quality is an input to that plan and never the quantity being maximised.

Handover is a transaction, and the bill comes due early

In connected mode the network hands the phone a measurement configuration: which frequencies to watch, which events to report, how long a condition has to hold.

A2 fires when the serving cell falls below a threshold, which is often the trigger for switching neighbour measurement on at all, since measuring costs battery. A3 fires when a neighbour exceeds the serving cell by an offset and holds that lead through a time to trigger window, typically between 40 and 640 milliseconds. Both the offset and the timer are brakes. Fading is violent at short range, and walking a few steps moves a measurement by several dB, so without hysteresis a handset would oscillate between two cells indefinitely.

When the event fires the phone decides nothing. It fills in a report and sends it up.

What follows is a transaction between pieces of infrastructure. The source cell decides, asks the target over X2 or Xn whether it will admit the user, and the target runs admission control and can refuse. If it agrees it prepares a configuration, which travels back and reaches the handset as an RRC reconfiguration. The phone leaves, performs random access on the target, and confirms arrival while packets in flight get forwarded between base stations. All of that because one person walked past a building.

The instruction to move is delivered over the old link, so the old link has to still work at the moment it is sent. Which is why A3 offsets get tuned to fire while the serving cell is comfortably usable. The system spends the last good moments of a fading link on the paperwork for leaving it.

Miss that window and the sequence collapses into something worse. The link fails before the reconfiguration arrives, the handset declares radio link failure, and a planned move becomes RRC re-establishment: find a cell, request reinstatement, hope the context survived. Tens of milliseconds in the good case, a dropped session in the bad one.

The boundary moves, so a parked phone moves

Distance to the mast is one input. Load is another, and load is adjustable while the network is running. Base stations exchange load information over X2 and Xn, and mobility load balancing adjusts the cell individual offset applied to specific neighbour pairs. Raise the offset and handsets near the edge of a congested cell start reporting the neighbour as better than it physically is, then drift out. Lower it elsewhere and they get pulled in. A cell boundary is a configured quantity that moves with the crowd through the day.

Which is why my stationary modems hop. Reflections change when a truck parks outside or a roller shutter comes down. Humidity and ducting change how signals propagate over water, which is noticeable in Singapore and stronger at night. Operators reconfigure at 3am. And cells rebalance, so a device that has not moved in fourteen months gets reassigned to make room for people who are actually walking around. That last cause accounts for more of it than I expected.

What all of that writes down

The network has to know the exact serving cell of any transmitting device, because that is where the packets are being delivered. Approximation is unavailable at this layer.

So every session, every handover and every reattachment writes a row: cell identity, subscriber identity, timestamp. Handover records are the rich ones, since a handover is by definition a transition and the pair of cell IDs on it encodes a direction.

Resolution is finer than the cell, too. Timing advance, the correction a tower issues so uplink bursts from different distances arrive aligned, is quantised in units working out to roughly 78 metres per step on LTE. Sectors add azimuth, since a typical macro site is split into three 120 degree faces and the record names which face answered. Put those together and the geometry is a wedge with a distance band across it, considerably tighter than a circle drawn around a mast.

One qualification is owed. An idle handset reselects without informing anybody, and signals only when it crosses into a new tracking area or when the periodic timer expires, commonly configured just under an hour. Tracking area knowledge, though, is not optional. Incoming calls are delivered by paging every cell in the area where the subscriber was last registered, so a network that has lost your area cannot make your phone ring.

The floor is therefore a coarse area, refreshed at every boundary crossing and at least hourly, for as long as the device is powered on. The ceiling is an exact cell and sector plus a distance band, every time the phone is used for anything.

The record is complete because it is load bearing

Nothing here was built for observation. Measurement reports exist so calls survive mobility. Cell identity exists in the record so packets arrive. Timing advance exists so uplink transmissions from different distances do not collide at the receiver.

A surveillance system designed as one would have holes, because somebody would have chosen what to collect and got parts of it wrong. A record generated as a by-product of routing has no holes, because a hole in it would be an outage.

Completeness is a property of the wiring. Nobody selected it.

Courts have been working through the consequences. Carpenter v. United States, decided in 2018, held that acquiring historical cell site location information needs a warrant. The government had obtained 127 days of records without one, arguing the subscriber conveyed it voluntarily by using the phone, which is technically accurate and which the majority found beside the point. The same records answer which handsets were registered to a given cell during a given hour, because the data was never organised around any one person.

There is no toggle for this layer

App location permissions sit above the operating system and govern what applications are told. All of this happens below that, in the baseband processor, separate silicon running its own firmware and answering to the network. Switching off location services changes none of it, and neither does a fresh install or a different browser.

The only variable that moves the record is which subscriber identity is attached to it, because the row is written against the SIM. That is roughly why my business exists in the shape it does, and I am not going to present it as a privacy answer for an ordinary person. It is an operational tool that runs about ten dollars a month per line before hardware.

The honest formulation is that a phone capable of receiving a call is a phone continuously telling a network approximately where it is. Those are the same statement. You can separate them by switching the radio off, at which point you own a small computer with no phone in it.

More on the machinery running underneath the ordinary internet at The Hidden Internet.

Get new guides and videos first — join the Telegram channel.