Reading is not enough. This workbook gives hands-on exercises with worked solutions (open the collapsible boxes after you try). Tools: the Calculators & lookup page checks your arithmetic and translates codes; the Wireshark labs in Module 36 give the traces.
How to use it: one section a day; write your answer on paper, then open the solution; if you were wrong, redo the exercise a week later.
A. Numbers and units (level: basic)
A1. dB, dBm and power
a) A base-station sector transmits 43 dBm. How many watts? b) A phone transmits 200 mW. How many dBm? c) Transmit power 40 dBm, antenna gain 17 dBi, cable and connector loss 2 dB. What is the EIRP? d) How many dB is a power ratio of 100? And +3 dB is roughly what ratio?
Solutions
a) 10^(43/10) mW = 19,953 mW ≈ 20 W (dBm → mW → W). b) 10·log₁₀(200) = 23.0 dBm (the LTE/5G phone maximum, Module 20). c) EIRP = 40 + 17 − 2 = 55 dBm. d) 10·log₁₀(100) = 20 dB; +3 dB ≈ ×2 (and −3 dB ≈ half).
A2. Path loss
Free-space path loss: FSPL (dB) = 32.45 + 20·log₁₀(d in km) + 20·log₁₀(f in MHz). a) FSPL at 1800 MHz, 2 km. b) FSPL at 3500 MHz, 0.5 km. c) By how many dB does the loss increase if you double the distance? If you double the frequency? d) FSPL at 1 km for 900 MHz and for 3500 MHz: which band loses more and by how much?
Solutions
a) 32.45 + 6.02 + 65.11 = 103.6 dB. b) 32.45 − 6.02 + 70.88 = 97.3 dB. c) +6 dB in both cases (20·log₁₀ 2). d) 900 MHz: 91.5 dB; 3500 MHz: 103.3 dB → 3.5 GHz loses about 11.8 dB more (20·log₁₀(3500/900)).
A3. Noise and capacity
a) Thermal noise floor for a 10 MHz carrier with a receiver noise figure of 7 dB: −174 dBm/Hz + 10·log₁₀(B) + NF. b) Same for 100 MHz, NF 8 dB. c) Shannon capacity C = B·log₂(1+SNR) for 20 MHz and 15 dB SNR, one stream. d) With SNR 10 dB and 5 MHz?
Solutions
a) −174 + 70 + 7 = −97 dBm. b) −174 + 80 + 8 = −86 dBm. c) 15 dB = ×31.6 → log₂(32.6) = 5.03 → ≈ 100.6 Mbit/s. d) 10 dB = ×10 → log₂(11) = 3.46 → 5 MHz × 3.46 = ≈ 17.3 Mbit/s.
A4. A link budget from scratch
LTE downlink at 1800 MHz: Tx power 46 dBm, antenna gain 18 dBi, losses 3 dB; margins: indoor penetration 15 dB, shadowing 8 dB, interference 3 dB; UE sensitivity −100 dBm. a) EIRP? b) Maximum allowed path loss (MAPL)? c) Free-space distance that MAPL allows? d) Why is the real cell radius much smaller?
Solutions
a) 46 + 18 − 3 = 61 dBm. b) MAPL = EIRP − margins − sensitivity = 61 − (15+8+3) − (−100) = 135 dB. c) 20·log₁₀ d = 135 − 32.45 − 65.11 = 37.44 → d ≈ 74.5 km in free space. d) Real paths have obstacles, higher path-loss exponents (d³–d⁴), terrain and clutter; also the uplink (phone at 23 dBm) is usually the limiting link (Module 20). The tool Calculators → link budget reproduces this.
A5. Availability and traffic
a) Yearly downtime allowed by 99.95% and 99.999%. b) With 10 Erlang of offered traffic, how many circuits keep blocking at or below 2% (Erlang B)? And 5 Erlang at 1%? c) An E1 has 32 time slots of 64 kbit/s. What is its bit rate and how many voice circuits (30 + 2 signalling/sync)?
Solutions
a) 99.95% → 262.8 min (4.38 h); 99.999% → 5.26 min. b) 10 Erlang at 2% → 17 circuits (blocking 1.29%); 5 Erlang at 1% → 11 circuits (0.83%). c) 32 × 64 kbit/s = 2.048 Mbit/s; 30 voice circuits plus 2 for framing/signalling.
A6. SMS arithmetic
How many segments (and which encoding) for each message? a) 400 plain GSM-7 characters. b) 100 characters with one Croatian "č". c) 160 characters of plain text plus one emoji. d) 161 GSM-7 characters.
Solutions
Single-segment limits: 160 GSM-7 / 70 UCS-2; concatenated: 153 / 67 per part. a) 400/153 → 3 segments (GSM-7). b) "č" is not in the GSM-7 basic set → UCS-2; 100/67 → 2 segments. c) One emoji forces UCS-2 for the whole message: 161 units/67 → 3 segments. d) 161 > 160 → concatenation, 153 per part → 2 segments. Check with the SMS segment counter tool (Module 1).
A7. Transfer time and codec rates
a) How long does a 1 GB file take at 100 Mbit/s? b) The AMR 12.2 kbit/s codec sends a frame every 20 ms: how many bytes of speech per frame? c) Why is the UDP payload of an RTP speech frame larger than that? (Module 36, Lab 4.)
Solutions
a) 1000 MB × 8 / 100 = 80 s ≈ 1.3 min. b) 12,200 bit/s × 0.02 s = 244 bits ≈ 30.5 bytes (31 bytes in the codec's frame format). c) Headers: RTP (12 bytes), UDP (8), IP (20) and the codec/payload header add overhead — in the lab the speech packets have UDP length 55 bytes.
B. Numbers and identities (level: basic–medium)
B1. Normalise to E.164
Write the E.164 form (use the table in Module 35):
a) Croatia: 091 234 5678 b) Croatia: +385 (0)91 234 5678 c) Croatia: 00385 91 234 5678
d) Germany: 0049 30 1234567 e) Italy: 02 1234 5678 f) Hungary: 06 20 123 4567 g) US: (201) 555-0123
Solutions
a) +385912345678 (drop the trunk 0, add country code). b) +385912345678 (the "(0)" must not be kept). c) +385912345678 (00 is the international prefix, replaced by +). d) +49301234567. e) +390212345678 — Italian fixed numbers keep the 0. f) +36201234567 (trunk prefix is 06). g) +12015550123 (trunk prefix 1 is not used in E.164). Verify with the Phone number normaliser tool.
B2. TON and NPI
Which TON / NPI would you set in SMPP for: a) sender MyBank b) destination +385921234567 c) a shortcode 12345?
Solutions
a) TON 5 (alphanumeric), NPI 0 (unknown). b) TON 1 (international), NPI 1 (ISDN/E.164). c) A short code is usually sent as TON 3 (network specific) or 6 (abbreviated) with NPI 0 or 1 — it depends on the operator; check its SMPP guide (general knowledge, Module 35).
B3. Read an IMSI
219 xx 1234567890: what is the MCC, which country is it, and what is the MSIN's role? Why should an IMSI never be shown to a customer-facing app?
Solutions
MCC 219 = Croatia (ITU E.212). MNC (2 or 3 digits depending on the plan) identifies the operator; MSIN is the subscriber number within it. The IMSI is the permanent SIM identity: with it an attacker can target location tracking or interception (Module 25), so it is hidden by TMSI/GUTI/SUCI and home routing.
C. Codes in context (use the lookup page)
Decode each, then say what the engineer does next.
| # | Observation |
|---|---|
| C1 | LTE attach rejected, EMM cause 7 |
| C2 | PDN connectivity rejected, ESM cause 27 |
| C3 | 5G registration reject, 5GMM cause 62 |
| C4 | MAP returnError 6 to an SRI-SM |
| C5 | SMPP submit_sm_resp with 0x58 |
| C6 | SMPP submit_sm_resp with 0x0B |
| C7 | GTPv2 Create Session Response, cause 93 |
| C8 | ISUP release with cause 18, and another with cause 19 |
| C9 | SIP 488, and SIP 480 |
| C10 | Diameter Result-Code 3002 on an S6a request |
Solutions
C1. EPS services not allowed → the subscriber has no LTE subscription/profile → check the HSS subscription (Module 11, 28). C2. Missing or unknown APN → wrong APN in the phone or not provisioned → check APN settings and the HSS APN list. C3. No network slices available → requested S-NSSAI not allowed → check UDM subscription and NSSF policy (Module 12). C4. MAP error 6 absentSubscriberSM → phone off/out of coverage → the SMSC keeps the message and retries after ReadyForSM/AlertServiceCentre (Module 28 §7a). C5. 0x58 = throttling error (you exceeded allowed message limits) → slow down, respect the TPS limit, retry with back-off. C6. 0x0B = invalid destination address → normalise to E.164, check TON/NPI (Module 35). C7. 93 = APN access denied – no subscription → the PGW denied the APN (roaming/subscription) → check APN rights and roaming agreement. (Note: 92 = user authentication failed.) C8. 18 = no user responding, 19 = no answer from user (user alerted); 17 = user busy. C9. 488 Not Acceptable Here = codec/SDP mismatch; 480 Temporarily Unavailable = callee unreachable or not registered. C10. DIAMETER_UNABLE_TO_DELIVER → no route to the destination realm → check DRA/DEA routing and peer status.
D. Order the steps (sequence exercises)
Put each list in the correct order and say why the order matters.
D1. LTE attach (shuffled): (a) Create Session Request/Response (b) Authentication (c) Attach Request (d) Update Location Request/Answer (e) Security Mode (f) Attach Accept (g) Modify Bearer. D2. SIP call (shuffled): (a) 200 OK (b) 180 Ringing (c) INVITE (d) ACK (e) 100 Trying (f) BYE (g) 183 Session Progress. D3. SMPP session (shuffled): (a) submit_sm (b) bind_transceiver (c) unbind (d) enquire_link (e) submit_sm_resp (f) bind_transceiver_resp. D4. 2G/3G mobile-terminated call (shuffled): (a) PRN (b) SRI (c) Paging (d) ISUP IAM from GMSC to the serving MSC (e) ISUP IAM into the GMSC (f) ANM.
Solutions
D1: c → b → e → d → a → f → g (identity/authentication first, security on, HSS location update, session creation, accept, then Modify Bearer after Attach Complete — TS 23.401 §5.3.2.1). D2: c → e → g → b → a → d → f (INVITE, Trying, Session Progress (early media), Ringing, answer, ACK, … BYE; 183 may be absent). D3: b → f → d → a → e → c (bind, bind response, keep-alive, submit, response, unbind — as in Lab 1). D4: e → b → a → d → c → f (IAM arrives at the GMSC; SRI asks the HLR; PRN asks the VLR; second IAM towards the serving MSC; paging; answer — Module 28 §3b; paging is done by the serving MSC after it receives the call).
E. Scenarios (diagnose it)
For each scenario write: layer, likely cause, next check.
E1. A bank's OTP SMS is "submitted OK" to the aggregator (submit_sm_resp status 0) but customers say it never arrives. No delivery receipt.
E2. A softphone registers (200 OK) but outgoing calls get 407, then 403. Incoming calls work.
E3. A user in roaming sees "registered" but no data; IMS voice works.
E4. After a software change at 02:00, 5% of LTE attach attempts fail with EMM cause 17 (network failure) for an hour.
E5. One-way audio on VoLTE calls only between two specific operators; SIP signalling looks normal.
E6. A flood of SRI-SM requests from a foreign GT, no MT-ForwardSM follows.
E7. OTP messages to Germany work, to Austria fail with UNDELIV.
E8. An attach with a new eSIM profile is rejected with EMM cause 3.
Solutions
E1. Layer: messaging/routing. "Accepted" ≠ delivered (Lab 1). Likely: route to a poor/grey or filtered path, throttling downstream, wrong format or sender ID blocked, destination SMS firewall. Next: request the DLR, test with another route and a known phone, check TON/NPI and sender registration (Modules 26, 35).
E2. Layer: SIP authentication. REGISTER uses one realm/credential, the INVITE goes to a proxy with different credentials or domain (407 = proxy auth), 403 = wrong password/domain (Lab 5). Next: compare realm, username, Authorization vs Proxy-Authorization.
E3. Layer: user plane/roaming. IMS works (S8HR) but data fails: data roaming off, wrong APN, S8/GTP issue, home PGW or policy (Module 28 §6). Next: GTP Create Session on S8, APN, roaming settings, DNS.
E4. Layer: core control after change. Cause 17 = network failure: overloaded or failing MME/HSS link or a bad configuration. Next: roll back the change (Module 29 §8), check S6a/S11 timeouts, SCTP/Diameter peer state.
E5. Layer: media path/SBC/NAT — RTP blocked or wrong SDP address between the operators' SBCs (Module 24). Next: capture RTP both sides (-z rtp,streams), compare SDP c= and ports.
E6. Layer: signalling security: reconnaissance/tracking attempt (Module 25 §1.1). Action: block/throttle the GT, enable SMS home routing, alert the SOC.
E7. Layer: routing/destination: a specific route to Austria is down or filtering (wrong sender, content or ported-number lookup error). Next: DLR error codes, MNP lookup, alternate route (Module 29 §2).
E8. EMM 3 = Illegal UE → the IMSI/IMEI is barred or subscription invalid in the HSS (profile not activated, wrong IMSI range) → check provisioning (Module 29 §1) and the EIR.
F. Short design tasks (open answers)
F1. Design the database fields for storing a customer's phone number so that OTP, billing and fraud checks all work (Module 35). F2. Write five rules for an SMS firewall that protects subscribers from location tracking and OTP interception (Modules 25–26). F3. Make a checklist for switching off a 3G network in a country (Modules 24, 32, 33).
Model answers
F1. e164 (text, +385…), input_original, region_code, number_type (mobile/fixed/…), valid_format (bool), verified_at (timestamp from OTP), last_hlr_check + status (active/absent/unknown), carrier_ported_to (optional), consent/purpose, created_at. Rules: store as text, unique constraint on e164, re-verify after SIM-swap signals, minimise retention (GDPR).
F2. (1) Block ATI/PSI/ISD/CAMEL data from external GTs (Cat 1). (2) UpdateLocation consistency check (impossible travel; known roaming partner GTs only). (3) SMS home routing: answer SRI-SM with the home SMS router and masked IMSI. (4) Correlate MT-ForwardSM with an earlier SRI-SM from the same GT; otherwise block. (5) Rate-limit per source GT/IMSI and alert on many SRI-SM without follow-up.
F3. Inventory of 3G-only devices (alarms, meters, cars); voice/emergency fallback (VoLTE for all phones; 112 tested); roaming partners' needs; customer notifications and SIM/phone upgrades; regulator notification and spectrum re-use plan; staged switch-off by region with rollback; monitoring of drops and complaints; decommissioning of core elements; post-implementation review (lesson: Australia 2024).
G. Where to go next
- Re-run Module 36 labs on your own machine and write the "story" of each capture in 5 lines.
- Take the quizzes for each topic; mistakes are free there.
- Use the flashcards for the acronyms behind the codes.
- Build a personal cheat sheet of ten codes you meet most (from the lookup page) and update it as you learn.
Remember this: the three habits behind every exercise are (1) say the layer first, (2) read the first failure, (3) check the format of every identifier. Practise them until they are automatic.