So, originally the MS sends a Packet Channel Request over PRACH and then the BSC (PCU) responds with a Packet Uplink Assignment over PAGCH. How does this PDTCH allocation get picked up by the correct MS? I know the MS sends a random value with the Packet Channel Request. Does the MS scan PAGCH continuously and look for this random value in a response?
Similarly, if the old SGSN wasn't able to verify the P-TMSI with the P-TMSI signature the MS sends in the attach request or the MS doesn't have a P-TMSI due to never having attached to the network before, then it requires that the MS send its IMSI. How does the IMSI request and the ciphering and authentication request travel to the correct MS? I think the BSC/PCU appends the CGI+RAC+LAC to the original attach request so the SGSN knows which interface to send the Identity Request to, but I'm not sure how the MS manages to pick this up. I think the BSC/PCU generates a Packet Downlink Assignment and sends it on PAGCH but how the MS knows it is addressed to it is up for debate. Perhaps the MS sends a random TLLI along with the Packet channel request or the attach request, as well as the P-TMSI, which can be used in the event that is it invalid, or in place of the P-TMSI if it doesn't have one, and the MS scans for this on the PAGCH.
It would also have to be known by the BSC which frequency PAGCH the MS is monitoring. Potentially the BSC looks at the interface and frequency it received a PRACH Packet channel request on and just selects a PAGCH on the same interface and frequency and sends it back. As for the downlink assignment for the identity request, perhaps the BSC ties the TLLI received in the packet channel request to an interface and frequency and when it receives an identity request from the SGSN with that TLLI it can send it to the correct frequency. Unless any frequency at the cell can be used? and CGI is all information that is needed (obviously TLLI still needs to be sent so MS can identify). I did think the MS can only scan one frequency at a time though i.e. wouldn't be able to tune to 2 contemporaneous receive TDMA slots on different frequencies, but it must do, because it must have the ability to monitor for other beacons of other cells so it knows when to initiate a location update.
