So, originally the MS sends a Packet Channel Request over PRACH and then the BSC (PCU) responds with a Packet Uplink Assignment over PAGCH. How does this PDTCH allocation get picked up by the correct MS? I know the MS sends a random value with the Packet Channel Request. Does the MS scan PAGCH continuously and look for this random value in a response?

Similarly, if the old SGSN wasn't able to verify the P-TMSI with the P-TMSI signature the MS sends in the attach request or the MS doesn't have a P-TMSI due to never having attached to the network before, then it requires that the MS send its IMSI. How does the IMSI request and the ciphering and authentication request travel to the correct MS? I think the BSC/PCU appends the CGI+RAC+LAC to the original attach request so the SGSN knows which interface to send the Identity Request to, but I'm not sure how the MS manages to pick this up. I think the BSC/PCU generates a Packet Downlink Assignment and sends it on PAGCH but how the MS knows it is addressed to it is up for debate. Perhaps the MS sends a random TLLI along with the Packet channel request or the attach request, as well as the P-TMSI, which can be used in the event that is it invalid, or in place of the P-TMSI if it doesn't have one, and the MS scans for this on the PAGCH.

It would also have to be known by the BSC which frequency PAGCH the MS is monitoring. Potentially the BSC looks at the interface and frequency it received a PRACH Packet channel request on and just selects a PAGCH on the same interface and frequency and sends it back. As for the downlink assignment for the identity request, perhaps the BSC ties the TLLI received in the packet channel request to an interface and frequency and when it receives an identity request from the SGSN with that TLLI it can send it to the correct frequency. Unless any frequency at the cell can be used? and CGI is all information that is needed (obviously TLLI still needs to be sent so MS can identify). I did think the MS can only scan one frequency at a time though i.e. wouldn't be able to tune to 2 contemporaneous receive TDMA slots on different frequencies, but it must do, because it must have the ability to monitor for other beacons of other cells so it knows when to initiate a location update.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15, 2019 at 3:05

1 Answer 1


It's pretty obvious now that a random TLLI is generated by the MS in the RLC header of the request, which has a different structure to Local and Foreign TLLIs, which the BSC will pair with the time slots, TFI and USF. If no PTMSI is provided in the actual data of the signalling packet, then the SGSN asks for an IMSI. The BSC communicates the TLLI to the SGSN in the BSSGP header and the SSGN will send the TLLI back in the BSSGP header of the identity request.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.