Introduction

The cellular networks do not broadcast network names as a name that we would directly recognise ourselves. Instead it broadcasts two codes which when put together can be used to look up and identify the network with its name.

They are:

• Mobile Country Code, MCC
• Mobile Network Code, MNC

These fields are captured and displayed by the SNYPER in every network survey report. Within the SNYPER there is a database which is used to lookup the MCC+MNC codes to find the network name to display. This network name is also shown in the survey report.

So, for example, MCC=234 and MNC=15 shows the network as Vodafone in the UK.

MCC (Mobile Country Code)

The MCC field is coded as in ITU-T Rec. E212, Annex A. This is a list created and maintained by the International Telecommunications Union and is published on their web site. It always consists of 3 numbers, the first digit of which indicates the geographic region in which it is to be used:

• 0: Test networks
• 2: Europe
• 3: North America and the Caribbean Islands
• 4: Asia and the Middle East
• 5: Australia and the Pacific Islands
• 6: Africa
• 7: South and Central America
• 9: Worldwide (Generally on aircraft/ships, private networks and Antarctica)

Most countries have just one MCC assigned to them. But some countries (India, the United Kingdom and the USA) have 2 or more MCC codes assigned to them.

While generally static, this list has been updated a few times during its life. New countries have been added such as North Macedonia and Kosovo which results in new MCC codes being added, and some have been withdrawn such as Guam which now uses the MCC of the USA.

The MCC list covers all countries, regardless of their membership of the ITU. Any changes to the list are published in Operational Bulletins that are published by the ITU bi-weekly.

MNC (Mobile Network Code)

The MNC field is coded as in ITU-T Rec. E212, Annex B. The latest published version of Annex B is dated 15 December 2018. This is a list maintained by the International Telecommunications Union and is published on their web site. However, it differs from the MCC list in a number of ways:

• MNC codes are assigned by the appropriate regulator in each country, not by the ITU.
• The ITUs list is a list of ITU members MNC codes. Not every country is a member (although most are). Notable exceptions are disputed countries/regions, of which Taiwan would be the most recognisable.
• It is the responsibility of each country to report changes in their MNC assignments to the ITU within 90 days. Not all countries do this in a timely manner. Some seem to struggle to do this at all.

The ITU publish changes to the MNC list every 2 weeks in their Operational Bulletins. So to get a definitive list of all MNCs that are active, you need to take the formal published list dated 15 Dec 2018 and then apply all the updates from the 2 weekly Operational Bulletins published since then. This gives the official list.

But the official list does not always reflect reality. Name changes can often go unreported, as can new assignments. Additionally, the names on the list are the official network name owners. These owners may be unfamiliar to many people as they often trade under completely different names. For instance, in the UK it is Telefonica that is listed in the MNC list, but they trade as O2.

The MNC code is always either 2 or 3 digits long. Where the assigned network number is a single figure, it is prefixed with a leading zero to make it 2 digits.

PLMN (Public Land Mobile Network)

The PLMN is another term that is used. This is simply the concatenation of the MCC and the MNC. The resulting PLMN is therefore 5 or 6 digits long. The PLMN will uniquely identify any cellular network worldwide.

MCC

+

MNC

=

PLMN

The PLMN list that Siretta uses is the ITU MCC & MNC lists, augmented with the unreported (to the ITU) networks and using the trading names that would be familiar to those using the networks. The latest version of the SNYPER firmware always contains the latest PLMN list maintained by Siretta. This PLMN list contains over 2800 entries.

Explanation of SNYPER operation

The SNYPER determines the network operator of any radio cells by examining the Broadcast Control Channel (BCCH) of the cells in view. The BCCH is a channel that is always broadcast at full power to advertise the cells availability and operational parameters to all cellular end points within range. The operational parameters are sent as numbered system Information messages. The System Information type 3 message within the BCCH (1 p. 246) contains a Location Area Identification field (2 pp. 492-493)  which contains the PLMN. This is extracted from the BCCH by the Snyper. The PLMN is broken down into MCC and MNC in the reports provided by the Snyper, and the network operator represented by the PLMN is displayed.

Where cell sharing occurs, the cell may broadcast up to four additional PLMNs. This is indicated in the optional system information type 22 message broadcast in the BCCH (1 pp. 167, 256-257). Cell sharing may take 2 forms. In one, the cell is shared with another network operator. In the other, the network operator sends additional PLMNs that are also owned by that operator. Both cases require further explanation.

One network sending multiple PLMNs

This survey, conducted at Dover Harbour in the UK, shows examples of two networks sending out two PLMNs from the same cell.

There is EE in the UK on cells 2 & 3, 5 & 6, 13 & 14; and Free Mobile in France on cells 7 & 8. In each of these cases the CellID (and indeed all other measured parameters) are the same, and the only difference is the MNC reported.

There are several reasons why this may occur, but the background for each is to be found in the history books. For EE, this stems from a deal made between One2One (which later became T-Mobile before becoming EE) and Virgin Mobile. Virgin Mobile used MNC=32 (While T-Mobile used MNC=30) (3). For Free Mobile, this seems to stem from a roaming agreement with Orange (4).

Where one network sends multiple PLMNs it is important to recognise this and to interpret the results presented as the number of cells seen, not the number of apparent networks. This is why the summary results at the bottom of the survey report breaks the reported number of networks down by the ID (=PLMN) and not network name.

Cell Sharing with additional operators

This can be seen by careful inspection of survey results from a SNYPER. Generally, this only occurs with LTE cells as sharing was built into the LTE standards right from the beginning and is therefore easy to implement operationally. This can be seen in the results provided by a SNYPER. Look carefully at the survey report below (which was conducted at the Siretta offices, which are in a rural location):

You will see that cells 1 and 2 have the same CellID (and so are physically the same Cell), but that the MNCs are from different network operators. It is important to recognise and understand when cells are shared in this manner. If that cell fails and goes offline for any reason, all the networks supported on that cell fail. So if you were going to install a dual SIM router, at this location it would be a poor decision to choose both O2 and Vodafone as network providers since the only O2 cell is linked with Vodafone. In this case, Vodafone and EE would be the best choices for a dual SIM router as EE coverage is both reasonable and there is plenty of redundancy in the local EE network at this location. As an aside, an installer might also note that an antenna that gives good performance at 800 MHz would be the best choice in this location, regardless of network chosen.

References

1. 3GPP. TS 144 018 – V15.4.0 – Digital cellular telecommunications system (Phase 2+) (GSM); Mobile radio interface layer 3 specification; GSM/EDGE Radio Resource Control (RRC) protocol (3GPP TS 44.018 version 15.4.0 Release 15). ETSI. [Online] 04 2019. [Cited: 13 10 2020.] https://www.etsi.org/deliver/etsi_ts/144000_144099/144018/15.04.00_60/ts_144018v150400p.pdf. ETSI TS 144 018 V15.4.0 (2019-04).
2. —. TS 124 008 – V16.5.0 – Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; 5G; Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 (3GPP TS 24.008 version 16.5.0 R. ETSI. [Online] 07 2020. [Cited: 13 10 2020.] https://www.etsi.org/deliver/etsi_ts/124000_124099/124008/16.05.00_60/ts_124008v160500p.pdf. ETSI TS 124 008 V16.5.0 (2020-07).
3. Wikipedia. Virgin Mobile (UK). Wikipedia. [Online] 08 21 2020. [Cited: 14 10 2020.] https://en.wikipedia.org/wiki/Virgin_Mobile_(UK).
4. Rozier, Ulrich. Free Mobile and the mysterious 208-16 network: why Orange roaming will improve. Frandroid. [Online] 09 07 2019. [Cited: 14 10 2020.] https://www.frandroid.com/telecom/607663_free-mobile-et-208-16.