Cellular Magic

by Bootleg

Let me start out by saying this file won't be in the best of ordered content as I'll be skipping around a little quoting data from various manuals as it pops into my mind.  It will however, allow anyone that reads it thoroughly and obtains the manuals and equipment specified within, to do virtually anything regarding cellular!

• ESN:  Electronic Serial Number (every cellular has one in ROM)
• MIN:  The cellular's phone number (also stored in every cellular's ROM)
• Reverse Channel:  The channel the cellular phone broadcasts on.
• Forward Channel:  The channel the cell site broadcasts on.

Remember these key terms as they are the secret to cellulars.

Most cellulars have the ESN/MIN located in a EPROM/EEPROM located somewhere on the circuit board (older cellulars may not have a ESN).  These are usually 27C256 or 27C512 EPROMs which can be burned or changed by standard EPROM burners.  They also contain the cellulars programming which can be changed.

When you power up a cellular, it sends its ESN/MIN to the cell site on the reverse channel.  The cell site then returns the MIN with an O.K. signal if their database verifies the ESN/MIN.  Some newer cell site software will verify the ESN/MIN with the CO before allowing the call.  If everything is O.K., the cellular will then be able to place a call.

(The reverse channels ESN/MIN and related data can be captured by equipment which we'll list later.)

It seems like some scoundrels have captured other peoples ESN/MIN and burned new EPROMs enabling another cellular phone to act as the original.  Rumor has it that hackers have gone as far as actually changing the EPROMs software whereby the program jumps past the ESN/MIN address in the EPROM to an address location that can be programmed into memory via the handset!  Yet another rumor has it that some even go as far as re-programming the software to capture other cellulars ESN/MIN and automatically store the data in memory.  This naturally allows someone to place fraudulent calls while frequently changing ESN/MINs to avoid all forms of detection.  The cell sites usually use frequencies on the non-wireline A band as forward channels.  The reverse channels are usually 45 MHz below the forward channels.  These reverse channels are the ones scanned by "unsavory dogs" who steal others ESN/MINs for fraudulent use.  Note that one hacker seems to think one can use a Z80 decompiler/compiler on the EPROMs software of some cellulars.  (The shame of it all!)  Other cellulars use different but common microprocessors of which compilers/decompilers are easily available.

Now that you have the theory behind cellular phreaking.  I'll continue on to some background and tech stuff you'll need.

Cellular Overview

A cell system divides the service area into small, low power areas called cells.  A cell system has a continuous pattern of these cells, each having a 1 to 40 mile radius (usually 5-10 miles).  Within each cell is a base station which contain several transceivers and control equipment for the channels assigned to that cell.  These are all connected to a MTSO which is in turn connected to a Central Office (CO) switch.  Each cell operates on an assigned channel and may have numerous paging and voice channels assigned to it.

The cellular radio frequencies have been divided by the FCC into two equal bands to allow two different systems to co-exist and compete in the same area.  Originally there were 666 channels, but that was expanded to 832 in 1988, and with NAMPS to 2412 in 1991.

Band A - Non-Wireline Band B - Wireline Voice Channels: 001-312 355-666 Control Channels: 313-333 334-354 (395 AMPS/1185 NAMPS) (395 AMPS/1185 NAMPS)

Control channels are used to send and receive only digital data between the cellular phone and the cell base station.  The 21 control channels in each band may be dedicated to two different applications: access and paging channels.

The data on the forward control channels provides such info as the system identification number and range of channels to scan to find the access and paging channels.  Access channels are used to respond to a page or to originate a call.  The system and the cell phone will use access channels where 2-way data transfer occurs to determine the initial voice channel.  Paging channel, if used, are the holding place for an idle cell phone.  When the call is received at the central controller for a cellular phone, the paging signaling will start on a paging channel.  In many systems, both control channel functions will be served by the same access channel for a particular cell.  Multiple paging channels are only used in high density areas.

NAM:  Number Assignment Module.  This is a memory component (usually an EPROM/EEPROM) that contains a cell phones ESN/MIN/SCM, lock code, etc.  Some phones can be re-programmed via the handset so one can change their MIN several times (usually the phones software locks it up after 3 to 20 MIN changes).  This feature was used limitedly to deceive cell sites when roaming.  Newer cell site software is quickly making this trick obsolete (the problem being is that one cannot change the ESN via NAM handset programming unless one re-writes the EPROM software).

One must know, there is no distributed intelligence in the first generation of cellular systems!  At these cellular base stations there is little or no monitoring equipment of any kind.

There are a mix of 3 watt, 1.2 watt, and 600 milliwatt cellular phones in use today.  (Keep this in mind as the power of a cellular phone is stored in ROM and transmitted along with the ESN/MIN and the coding must be correct.)  3 watt = mobiles, 1.6 watt = transportables, 600 milliwatt = portables.

IS-41:  The newest standard that will let cell switches from different vendors hand-off and deliver calls and transfer subscriber data profiles (newest version is Revision B).  This document contains tons of useful info and can be found at public libraries, etc.  IS-41 Rev. B, is published by AT&T, although the original IS-41 Rev. 0 published in 1987 or IS-41 Rev. A published in 1990 may come in handy when dealing with older/smaller Mobile Telephone Switching Offices (MTSO) that haven't upgraded yet.

MTSOs typically use fiber optic links to cell sites or a 18 GHz microwave link.  A cell site in turn then probably uses a 38 GHz microwave link to a microcell transmitter.  TDMA and CDMA are both vying to become the industry standard.

SS7:  As soon as a user turns on a cell phone the MIN/ESN for that phone will be carried as an SS7 network message to a database, known as the Home Location Register (HLR), within the user's home carrier system.  The HLR will provide information for validation as well as customer profile info for advanced features as voice mail.  That info will then be be relayed to a second database, the visitor location register, maintained by the carrier that is hosting the roaming call.  They hope to reduce fraud by checking the ESN with real time validation on a per call basis.  The current system is unable to detect fraud until after a caller has made his first call.  (This system simply uses a customers calling profile to detect an unusual calling pattern.)  Those changing ESN/MINs often cannot be detected!

Cell relay uses fixed length packets - 48 bytes for the payload and 5 bytes for the header.  Two existing cell relay standards are IEEE 802.6 (DQDB) and ATM.  They differ only in content of the header.

Each cellular has two channels associated with it, the transmit (REVERSE) and the receive (FOWARD).

Reverse Freqs: 824-848 MHz Forward Freqs: 869-894 MHz Conventional Dispatch: 806-809.7 MHz and 851-854.75 MHz Trunked Dispatch: 809.75-824 MHz and 854.75-869 MHz General Reserve: 848-851 MHz and 894-902 MHz and 928-947 MHz Channel Spacing: 30 kHz AMPS or 10 kHz NAMPS

Reverse Channel Info

Voice channels are used primarily for conversation, with signaling used with quick data bursts or tones to handle cell to cell hand-offs, output power control of the cellular radio-phone and special control features.  Forward data from the cell site and reverse data from the cell phone is sent using Frequency-Shift Keying (FSK).  The data is formatted into groups of words with a distinct binary preamble that allows the receiver to synchronize to the incoming data.  With AMPS, various tones are used.  With NAMPS, the data and tones have been replaced by sub-audible digital equivalents that ride under the audio.  (See EIA-553 for AMPS or Motorola's "NAMPS Air Interface Specification" for NAMPS.)

Signaling Tone (ST) and Digital ST (DST)

In AMPS, the signaling tone is a 10 kHz signal used by the mobile on the Reverse Channel (REVC) to signal activities or to acknowledge commands from the cell site, including hand-offs, alert orders, call terminations and switch-hook operation.  Various burst lengths are used on different ST activities.  On NAMPS channels ST is replaced by a digital equivalent called Digital ST (DST) which is the compliment of the assigned DSAT.  The 10 kHz signal is sent for 50 milliseconds.

Supervisory Audio Tone (SAT) and Digital SAT (DSAT)

The Supervisory Audio Tone (SAT) is one of three frequencies (+/- 2 kHz):

SAT 0: 5970 Hz SAT 1: 6000 Hz SAT 2: 6030 Hz

These are used in AMPS signaling.  On NAMPS channels SAT is replaced by one of seven sub-audible digital equivalents or vectors called DSAT.

SAT or DSAT is generated by the cell site, checked for frequency or accuracy by the cell phone, then transponded back to the cell site on the Reverse Voice Channel (REVC).  The cellular telephone uses (D)SAT to verify that it is tuned to the correct channel after a new voice channel assignment.  When the CO signals the mobile regarding the new voice channel, it also tells the mobile of the SAT freq of the DSAT vector to expect on the new channel.  The returned (D)SAT is used at the cell site to verify the presence of the telephones signal on the designated frequency.

DSAT: +/- 700 Hz deviation Data: Transmitted at 10 kbits/sec.

Used for sending system orders and mobile identification.  In cellular the data is transmitted as FSK, where the carrier is shifted high 8 kHz in AMPS (700 Hz in NAMPS) to represent a logic high (or 1), and the carrier is shifted low 8 kHz in AMPS (700 Hz in NAMPS) to represent a logic low (or 0).  Control channels carry data only.  Voice channels carry data and other signals listed here.

Audio:  Includes all microphone audio and DTMF while in a call (maximum +/- 12 kHz deviation AMPS, +/- 5 kHz deviation NAMPS).  DTMF uses two tones (one high, one low) from a selection of seven tones (four low, three high tones) to indicate digits being dialed.  In AMPS signaling, audio and ST are accompanied by SAT.

Placing a Call From a Cellular Phone

When first turned on, the cellular scans through the forward control channels and measure the strength of each signal.  It will then tune to the strongest and attempt to decode the overhead control message.  From the overhead the phone can determine if it is in its home system and range of channels to scan for paging and access.  If paging channels are used, the phone next scans each paging channel in the specified range and tunes to the strongest one.  It's on that channel the phone will continuously receive overhead message info plus paging messages.  At this point the phone idles, continuously updating the overhead message info in its memory and monitoring the paging messages for its telephone number.

When the cellular phone user originates the call, the phone re-scans the access channels to assure that its tuned to the strongest one.  It then transmits at 10 kbits per sec on the control channel to notify the switch of its Mobile Identification Number (MIN - phone number), its ESN and the number it wants to reach.  The switch verifies the incoming data and assigns a voice channel and a SAT (or DSAT for NAMPS) to the telephone.

The phone tunes to the assigned voice channel and verifies the presence of the proper forward SAT frequency or DSAT message.  If SAT (DSAT) is correct the phone transponds SAT (DSAT) back to the cell site and unmutes the forward audio.  The cell site detects reverse SAT (DSAT) from the cellular and unmutes reverse audio.  At this point the user can hear the other end ring.  SAT (DSAT) is sent and received more or less continuously by both the base station and the phone but SAT (DSAT) is not sent during data transmissions and the phone does not transpond SAT continuously during VOX operation.  DSAT is suspended during the transmission of DST.  SAT's seven signaling tones are only used on AMPS voice channels and the signaling tone is only transmitted by the cellular phone.

Note that the number called, the ESN, MIN, etc. are transmitted four or five times and it only takes 260 milliseconds for all this data exchange.

Formulae

Call Termination: 10 kHz tone burst for 1.8 seconds Frequency (MHz) Calculation for Channels 1-799: Reverse = 825 MHz + (Channel Number * .03 MHz) Forward = 870 MHz + (Channel Number * .03 MHz) Frequency (MHz) Calculation for Channels 991-1023: Reverse = 825 MHz - (.03 MHz * [1023 - Channel Number)) Forward = 870 MHz - (.03 MHz * (1023 - Channel Number)) Duplex Spacing: 45 MHz

Station Class Mark (SCM)

SCM 666 or 832 Ch. VOX Max. Power in Watts 00 666 N 3.0 01 666 N 1.2 02 666 N 0.6 03 04 666 Y 3.0 05 666 Y 1.2 06 666 Y 0.6 07 08 832 N 3.0 09 832 N 1.2 10 832 N 0.6 11 12 832 Y 3.0 13 832 Y 1.2 14 832 Y 0.6 15

If the SCM is not set properly during programming the EPROM, it might have adverse effects on the operation of the phone.  It may also flag security software to a "Tumbled Phone."  Smart cell phreaks will only use ESN/MINs that have the same SCM as their own phone they plan on tumbling.

Cellular Phone Channel Construction

Here is a method of determining which frequencies are used in a cellular system, and which ones are in what cells.  If the system uses omnicells, as most do, you can readily find all the channels in a cell if you know just one of them, using tables constructed with the instructions below.

Cellular frequencies are assigned by channel number, and for all channel numbers, in both wireline and non-wireline systems, the formula is:

Transmit Frequency: (Channel Number * .030 MHz) + 870 MHz Receive Frequency: (Channel Number * .030 MHz) + 825 MHz

"Band A" (one of the two blocks) uses channels 1 to 333.  To construct a table showing frequency by cells, use channel 333 as the top-left corner of a table.  The next entry to the right of channel 333 is 332, the next is 331, etc., down to channel 313.  Enter channel 312 underneath 333, 311 under 332, etc.  Each channel across the top row is the first channel in each cell of the system; each channel down from the column from the the first channel is the next frequency assigned to that cell.  You may have noted that each channel down is 21 channels lower in number.  Usually the data channel used is the highest numbered channel in a cell.

"Band B" uses channels from 334 to 666.  Construct your table in a similar way, with channel 334 in the upper-left corner, 335 the next entry to the right.  The data channel should be the lowest numbered channel in each cell this time.

Cellular Phone - Band A (Channel 1 is Data)

Cell # 1 -------------------------------------------------- Channel 1 (333) Tx 879.990 Rx 834.990 Channel 2 (312) Tx 879.360 Rx 834.360 Channel 3 (291) Tx 878.730 Rx 833.730 Channel 4 (270) Tx 878.100 Rx 833.100 Channel 5 (249) Tx 877.470 Rx 832.470 Channel 6 (228) Tx 876.840 Rx 831.840 Channel 7 (207) Tx 876.210 Rx 831.210 Channel 8 (186) Tx 875.580 Rx 830.580 Channel 9 (165) Tx 874.950 Rx 829.950 Channel 10 (144) Tx 874.320 Rx 829.320 Channel 11 (123) Tx 873.690 Rx 828.690 Channel 12 (102) Tx 873.060 Rx 828.060 Channel 13 (81) Tx 872.430 Rx 827.430 Channel 14 (60) Tx 871.800 Rx 826.800 Channel 15 (39) Tx 871.170 Rx 826.170 Channel 16 (18) Tx 870.540 Rx 825.540 Cell # 2 -------------------------------------------------- Channel 1 (332) Tx 879.960 Rx 834.960 Channel 2 (311) Tx 879.330 Rx 834.330 Channel 3 (290) Tx 878.700 Rx 833.700 Channel 4 (269) Tx 878.070 Rx 833.070 Channel 5 (248) Tx 877.440 Rx 832.440 Channel 6 (227) Tx 876.810 Rx 831.810 Channel 7 (206) Tx 876.180 Rx 831.180 Channel 8 (185) Tx 875.550 Rx 830.550 Channel 9 (164) Tx 874.920 Rx 829.920 Channel 10 (143) Tx 874.290 Rx 829.290 Channel 11 (122) Tx 873.660 Rx 828.660 Channel 12 (101) Tx 873.030 Rx 828.030 Channel 13 (80) Tx 872.400 Rx 827.400 Channel 14 (59) Tx 871.770 Rx 826.770 Channel 15 (38) Tx 871.140 Rx 826.140 Channel 16 (17) Tx 870.510 Rx 825.510 Cell # 3 -------------------------------------------------- Channel 1 (331) Tx 879.930 Rx 834.930 Channel 2 (310) Tx 879.300 Rx 834.300 Channel 3 (289) Tx 878.670 Rx 833.670 Channel 4 (268) Tx 878.040 Rx 833.040 Channel 5 (247) Tx 877.410 Rx 832.410 Channel 6 (226) Tx 876.780 Rx 831.780 Channel 7 (205) Tx 876.150 Rx 831.150 Channel 8 (184) Tx 875.520 Rx 830.520 Channel 9 (163) Tx 874.890 Rx 829.890 Channel 10 (142) Tx 874.260 Rx 829.260 Channel 11 (121) Tx 873.630 Rx 828.630 Channel 12 (100) Tx 873.000 Rx 828.000 Channel 13 (79) Tx 872.370 Rx 827.370 Channel 14 (58) Tx 871.740 Rx 826.740 Channel 15 (37) Tx 871.110 Rx 826.110 Channel 16 (16) Tx 870.480 Rx 825.480 Cell # 4 -------------------------------------------------- Channel 1 (330) Tx 879.900 Rx 834.900 Channel 2 (309) Tx 879.270 Rx 834.270 Channel 3 (288) Tx 878.640 Rx 833.640 Channel 4 (267) Tx 878.010 Rx 833.010 Channel 5 (246) Tx 877.380 Rx 832.380 Channel 6 (225) Tx 876.750 Rx 831.750 Channel 7 (204) Tx 876.120 Rx 831.120 Channel 8 (183) Tx 875.490 Rx 830.490 Channel 9 (162) Tx 874.860 Rx 829.860 Channel 10 (141) Tx 874.230 Rx 829.230 Channel 11 (120) Tx 873.600 Rx 828.600 Channel 12 (99) Tx 872.970 Rx 827.970 Channel 13 (78) Tx 872.340 Rx 827.340 Channel 14 (57) Tx 871.710 Rx 826.710 Channel 15 (36) Tx 871.080 Rx 826.080 Channel 16 (15) Tx 870.450 Rx 825.450 Cell # 5 -------------------------------------------------- Channel 1 (329) Tx 879.870 Rx 834.870 Channel 2 (308) Tx 879.240 Rx 834.240 Channel 3 (287) Tx 878.610 Rx 833.610 Channel 4 (266) Tx 877.980 Rx 832.980 Channel 5 (245) Tx 877.350 Rx 832.350 Channel 6 (224) Tx 876.720 Rx 831.720 Channel 7 (203) Tx 876.090 Rx 831.090 Channel 8 (182) Tx 875.460 Rx 830.460 Channel 9 (161) Tx 874.830 Rx 829.830 Channel 10 (140) Tx 874.200 Rx 829.200 Channel 11 (119) Tx 873.570 Rx 828.570 Channel 12 (98) Tx 872.940 Rx 827.940 Channel 13 (77) Tx 872.310 Rx 827.310 Channel 14 (56) Tx 871.680 Rx 826.680 Channel 15 (35) Tx 871.050 Rx 826.050 Channel 16 (14) Tx 870.420 Rx 825.420 Cell # 6 -------------------------------------------------- Channel 1 (328) Tx 879.840 Rx 834.840 Channel 2 (307) Tx 879.210 Rx 834.210 Channel 3 (286) Tx 878.580 Rx 833.580 Channel 4 (265) Tx 877.950 Rx 832.950 Channel 5 (244) Tx 877.320 Rx 832.320 Channel 6 (223) Tx 876.690 Rx 831.690 Channel 7 (202) Tx 876.060 Rx 831.060 Channel 8 (181) Tx 875.430 Rx 830.430 Channel 9 (160) Tx 874.800 Rx 829.800 Channel 10 (139) Tx 874.170 Rx 829.170 Channel 11 (118) Tx 873.540 Rx 828.540 Channel 12 (97) Tx 872.910 Rx 827.910 Channel 13 (76) Tx 872.280 Rx 827.280 Channel 14 (55) Tx 871.650 Rx 826.650 Channel 15 (34) Tx 871.020 Rx 826.020 Channel 16 (13) Tx 870.390 Rx 825.390 Cell # 7 -------------------------------------------------- Channel 1 (327) Tx 879.810 Rx 834.810 Channel 2 (306) Tx 879.180 Rx 834.180 Channel 3 (285) Tx 878.550 Rx 833.550 Channel 4 (264) Tx 877.920 Rx 832.920 Channel 5 (243) Tx 877.290 Rx 832.290 Channel 6 (222) Tx 876.660 Rx 831.660 Channel 7 (201) Tx 876.030 Rx 831.030 Channel 8 (180) Tx 875.400 Rx 830.400 Channel 9 (159) Tx 874.770 Rx 829.770 Channel 10 (138) Tx 874.140 Rx 829.140 Channel 11 (117) Tx 873.510 Rx 828.510 Channel 12 (96) Tx 872.880 Rx 827.880 Channel 13 (75) Tx 872.250 Rx 827.250 Channel 14 (54) Tx 871.620 Rx 826.620 Channel 15 (33) Tx 870.990 Rx 825.990 Channel 16 (12) Tx 870.360 Rx 825.360 Cell # 8 -------------------------------------------------- Channel 1 (326) Tx 879.780 Rx 834.780 Channel 2 (305) Tx 879.150 Rx 834.150 Channel 3 (284) Tx 878.520 Rx 833.520 Channel 4 (263) Tx 877.890 Rx 832.890 Channel 5 (242) Tx 877.260 Rx 832.260 Channel 6 (221) Tx 876.630 Rx 831.630 Channel 7 (200) Tx 876.000 Rx 831.000 Channel 8 (179) Tx 875.370 Rx 830.370 Channel 9 (158) Tx 874.740 Rx 829.740 Channel 10 (137) Tx 874.110 Rx 829.110 Channel 11 (116) Tx 873.480 Rx 828.480 Channel 12 (95) Tx 872.850 Rx 827.850 Channel 13 (74) Tx 872.220 Rx 827.220 Channel 14 (53) Tx 871.590 Rx 826.590 Channel 15 (32) Tx 870.960 Rx 825.960 Channel 16 (11) Tx 870.330 Rx 825.330 Cell # 9 -------------------------------------------------- Channel 1 (325) Tx 879.750 Rx 834.750 Channel 2 (304) Tx 879.120 Rx 834.120 Channel 3 (283) Tx 878.490 Rx 833.490 Channel 4 (262) Tx 877.860 Rx 832.860 Channel 5 (241) Tx 877.230 Rx 832.230 Channel 6 (220) Tx 876.600 Rx 831.600 Channel 7 (199) Tx 875.970 Rx 830.970 Channel 8 (178) Tx 875.340 Rx 830.340 Channel 9 (157) Tx 874.710 Rx 829.710 Channel 10 (136) Tx 874.080 Rx 829.080 Channel 11 (115) Tx 873.450 Rx 828.450 Channel 12 (94) Tx 872.820 Rx 827.820 Channel 13 (73) Tx 872.190 Rx 827.190 Channel 14 (52) Tx 871.560 Rx 826.560 Channel 15 (31) Tx 870.930 Rx 825.930 Channel 16 (10) Tx 870.300 Rx 825.300 Cell # 10 -------------------------------------------------- Channel 1 (324) Tx 879.720 Rx 834.720 Channel 2 (303) Tx 879.090 Rx 834.090 Channel 3 (282) Tx 878.460 Rx 833.460 Channel 4 (261) Tx 877.830 Rx 832.830 Channel 5 (240) Tx 877.200 Rx 832.200 Channel 6 (219) Tx 876.570 Rx 831.570 Channel 7 (198) Tx 875.940 Rx 830.940 Channel 8 (177) Tx 875.310 Rx 830.310 Channel 9 (156) Tx 874.680 Rx 829.680 Channel 10 (135) Tx 874.050 Rx 829.050 Channel 11 (114) Tx 873.420 Rx 828.420 Channel 12 (93) Tx 872.790 Rx 827.790 Channel 13 (72) Tx 872.160 Rx 827.160 Channel 14 (51) Tx 871.530 Rx 826.530 Channel 15 (30) Tx 870.900 Rx 825.900 Channel 16 (9) Tx 870.270 Rx 825.270 Cell # 11 -------------------------------------------------- Channel 1 (323) Tx 879.690 Rx 834.690 Channel 2 (302) Tx 879.060 Rx 834.060 Channel 3 (281) Tx 878.430 Rx 833.430 Channel 4 (260) Tx 877.800 Rx 832.800 Channel 5 (239) Tx 877.170 Rx 832.170 Channel 6 (218) Tx 876.540 Rx 831.540 Channel 7 (197) Tx 875.910 Rx 830.910 Channel 8 (176) Tx 875.280 Rx 830.280 Channel 9 (155) Tx 874.650 Rx 829.650 Channel 10 (134) Tx 874.020 Rx 829.020 Channel 11 (113) Tx 873.390 Rx 828.390 Channel 12 (92) Tx 872.760 Rx 827.760 Channel 13 (71) Tx 872.130 Rx 827.130 Channel 14 (50) Tx 871.500 Rx 826.500 Channel 15 (29) Tx 870.870 Rx 825.870 Channel 16 (8) Tx 870.240 Rx 825.240 Cell # 12 -------------------------------------------------- Channel 1 (322) Tx 879.660 Rx 834.660 Channel 2 (301) Tx 879.030 Rx 834.030 Channel 3 (280) Tx 878.400 Rx 833.400 Channel 4 (259) Tx 877.770 Rx 832.770 Channel 5 (238) Tx 877.140 Rx 832.140 Channel 6 (217) Tx 876.510 Rx 831.510 Channel 7 (196) Tx 875.880 Rx 830.880 Channel 8 (175) Tx 875.250 Rx 830.250 Channel 9 (154) Tx 874.620 Rx 829.620 Channel 10 (133) Tx 873.990 Rx 828.990 Channel 11 (112) Tx 873.360 Rx 828.360 Channel 12 (91) Tx 872.730 Rx 827.730 Channel 13 (70) Tx 872.100 Rx 827.100 Channel 14 (49) Tx 871.470 Rx 826.470 Channel 15 (28) Tx 870.840 Rx 825.840 Channel 16 (7) Tx 870.210 Rx 825.210 Cell # 13 -------------------------------------------------- Channel 1 (321) Tx 879.630 Rx 834.630 Channel 2 (300) Tx 879.000 Rx 834.000 Channel 3 (279) Tx 878.370 Rx 833.370 Channel 4 (258) Tx 877.740 Rx 832.740 Channel 5 (237) Tx 877.110 Rx 832.110 Channel 6 (216) Tx 876.480 Rx 831.480 Channel 7 (195) Tx 875.850 Rx 830.850 Channel 8 (174) Tx 875.220 Rx 830.220 Channel 9 (153) Tx 874.590 Rx 829.590 Channel 10 (132) Tx 873.960 Rx 828.960 Channel 11 (111) Tx 873.330 Rx 828.330 Channel 12 (90) Tx 872.700 Rx 827.700 Channel 13 (69) Tx 872.070 Rx 827.070 Channel 14 (48) Tx 871.440 Rx 826.440 Channel 15 (27) Tx 870.810 Rx 825.810 Channel 16 (6) Tx 870.180 Rx 825.180 Cell # 14 -------------------------------------------------- Channel 1 (320) Tx 879.600 Rx 834.600 Channel 2 (299) Tx 878.970 Rx 833.970 Channel 3 (278) Tx 878.340 Rx 833.340 Channel 4 (257) Tx 877.710 Rx 832.710 Channel 5 (236) Tx 877.080 Rx 832.080 Channel 6 (215) Tx 876.450 Rx 831.450 Channel 7 (194) Tx 875.820 Rx 830.820 Channel 8 (173) Tx 875.190 Rx 830.190 Channel 9 (152) Tx 874.560 Rx 829.560 Channel 10 (131) Tx 873.930 Rx 828.930 Channel 11 (110) Tx 873.300 Rx 828.300 Channel 12 (89) Tx 872.670 Rx 827.670 Channel 13 (68) Tx 872.040 Rx 827.040 Channel 14 (47) Tx 871.410 Rx 826.410 Channel 15 (26) Tx 870.780 Rx 825.780 Channel 16 (5) Tx 870.150 Rx 825.150 Cell # 15 -------------------------------------------------- Channel 1 (319) Tx 879.570 Rx 834.570 Channel 2 (298) Tx 878.940 Rx 833.940 Channel 3 (277) Tx 878.310 Rx 833.310 Channel 4 (256) Tx 877.680 Rx 832.680 Channel 5 (235) Tx 877.050 Rx 832.050 Channel 6 (214) Tx 876.420 Rx 831.420 Channel 7 (193) Tx 875.790 Rx 830.790 Channel 8 (172) Tx 875.160 Rx 830.160 Channel 9 (151) Tx 874.530 Rx 829.530 Channel 10 (130) Tx 873.900 Rx 828.900 Channel 11 (109) Tx 873.270 Rx 828.270 Channel 12 (88) Tx 872.640 Rx 827.640 Channel 13 (67) Tx 872.010 Rx 827.010 Channel 14 (46) Tx 871.380 Rx 826.380 Channel 15 (25) Tx 870.750 Rx 825.750 Channel 16 (4) Tx 870.120 Rx 825.120 Cell # 16 -------------------------------------------------- Channel 1 (318) Tx 879.540 Rx 834.540 Channel 2 (297) Tx 878.910 Rx 833.910 Channel 3 (276) Tx 878.280 Rx 833.280 Channel 4 (255) Tx 877.650 Rx 832.650 Channel 5 (234) Tx 877.020 Rx 832.020 Channel 6 (213) Tx 876.390 Rx 831.390 Channel 7 (192) Tx 875.760 Rx 830.760 Channel 8 (171) Tx 875.130 Rx 830.130 Channel 9 (150) Tx 874.500 Rx 829.500 Channel 10 (129) Tx 873.870 Rx 828.870 Channel 11 (108) Tx 873.240 Rx 828.240 Channel 12 (87) Tx 872.610 Rx 827.610 Channel 13 (66) Tx 871.980 Rx 826.980 Channel 14 (45) Tx 871.350 Rx 826.350 Channel 15 (24) Tx 870.720 Rx 825.720 Channel 16 (3) Tx 870.090 Rx 825.090 Cell # 17 -------------------------------------------------- Channel 1 (317) Tx 879.510 Rx 834.510 Channel 2 (296) Tx 878.880 Rx 833.880 Channel 3 (275) Tx 878.250 Rx 833.250 Channel 4 (254) Tx 877.620 Rx 832.620 Channel 5 (233) Tx 876.990 Rx 831.990 Channel 6 (212) Tx 876.360 Rx 831.360 Channel 7 (191) Tx 875.730 Rx 830.730 Channel 8 (170) Tx 875.100 Rx 830.100 Channel 9 (149) Tx 874.470 Rx 829.470 Channel 10 (128) Tx 873.840 Rx 828.840 Channel 11 (107) Tx 873.210 Rx 828.210 Channel 12 (86) Tx 872.580 Rx 827.580 Channel 13 (65) Tx 871.950 Rx 826.950 Channel 14 (44) Tx 871.320 Rx 826.320 Channel 15 (23) Tx 870.690 Rx 825.690 Channel 16 (2) Tx 870.060 Rx 825.060 Cell # 18 -------------------------------------------------- Channel 1 (316) Tx 879.480 Rx 834.480 Channel 2 (295) Tx 878.850 Rx 833.850 Channel 3 (274) Tx 878.220 Rx 833.220 Channel 4 (253) Tx 877.590 Rx 832.590 Channel 5 (232) Tx 876.960 Rx 831.960 Channel 6 (211) Tx 876.330 Rx 831.330 Channel 7 (190) Tx 875.700 Rx 830.700 Channel 8 (169) Tx 875.070 Rx 830.070 Channel 9 (148) Tx 874.440 Rx 829.440 Channel 10 (127) Tx 873.810 Rx 828.810 Channel 11 (106) Tx 873.180 Rx 828.180 Channel 12 (85) Tx 872.550 Rx 827.550 Channel 13 (64) Tx 871.920 Rx 826.920 Channel 14 (43) Tx 871.290 Rx 826.290 Channel 15 (22) Tx 870.660 Rx 825.660 Channel 16 (1) Tx 870.030 Rx 825.030 Cell # 19 -------------------------------------------------- Channel 1 (315) Tx 879.450 Rx 834.450 Channel 2 (294) Tx 878.820 Rx 833.820 Channel 3 (273) Tx 878.190 Rx 833.190 Channel 4 (252) Tx 877.560 Rx 832.560 Channel 5 (231) Tx 876.930 Rx 831.930 Channel 6 (210) Tx 876.300 Rx 831.300 Channel 7 (189) Tx 875.670 Rx 830.670 Channel 8 (168) Tx 875.040 Rx 830.040 Channel 9 (147) Tx 874.410 Rx 829.410 Channel 10 (126) Tx 873.780 Rx 828.780 Channel 11 (105) Tx 873.150 Rx 828.150 Channel 12 (84) Tx 872.520 Rx 827.520 Channel 13 (63) Tx 871.890 Rx 826.890 Channel 14 (42) Tx 871.260 Rx 826.260 Channel 15 (21) Tx 870.630 Rx 825.630 Cell # 20 -------------------------------------------------- Channel 1 (314) Tx 879.420 Rx 834.420 Channel 2 (293) Tx 878.790 Rx 833.790 Channel 3 (272) Tx 878.160 Rx 833.160 Channel 4 (251) Tx 877.530 Rx 832.530 Channel 5 (230) Tx 876.900 Rx 831.900 Channel 6 (209) Tx 876.270 Rx 831.270 Channel 7 (188) Tx 875.640 Rx 830.640 Channel 8 (167) Tx 875.010 Rx 830.010 Channel 9 (146) Tx 874.380 Rx 829.380 Channel 10 (125) Tx 873.750 Rx 828.750 Channel 11 (104) Tx 873.120 Rx 828.120 Channel 12 (83) Tx 872.490 Rx 827.490 Channel 13 (62) Tx 871.860 Rx 826.860 Channel 14 (41) Tx 871.230 Rx 826.230 Channel 15 (20) Tx 870.600 Rx 825.600 Cell # 21 -------------------------------------------------- Channel 1 (313) Tx 879.390 Rx 834.390 Channel 2 (292) Tx 878.760 Rx 833.760 Channel 3 (271) Tx 878.130 Rx 833.130 Channel 4 (250) Tx 877.500 Rx 832.500 Channel 5 (229) Tx 876.870 Rx 831.870 Channel 6 (208) Tx 876.240 Rx 831.240 Channel 7 (187) Tx 875.610 Rx 830.610 Channel 8 (166) Tx 874.980 Rx 829.980 Channel 9 (145) Tx 874.350 Rx 829.350 Channel 10 (124) Tx 873.720 Rx 828.720 Channel 11 (103) Tx 873.090 Rx 828.090 Channel 12 (82) Tx 872.460 Rx 827.460 Channel 13 (61) Tx 871.830 Rx 826.830 Channel 14 (40) Tx 871.200 Rx 826.200 Channel 15 (19) Tx 870.570 Rx 825.570

Cellular Phone - Band B (Channel 1 is Data)

Cell # 1 -------------------------------------------------- Channel 1 (334) Tx 880.020 Rx 835.020 Channel 2 (355) Tx 880.650 Rx 835.650 Channel 3 (376) Tx 881.280 Rx 836.280 Channel 4 (397) Tx 881.910 Rx 836.910 Channel 5 (418) Tx 882.540 Rx 837.540 Channel 6 (439) Tx 883.170 Rx 838.170 Channel 7 (460) Tx 883.800 Rx 838.800 Channel 8 (481) Tx 884.430 Rx 839.430 Channel 9 (502) Tx 885.060 Rx 840.060 Channel 10 (523) Tx 885.690 Rx 840.690 Channel 11 (544) Tx 886.320 Rx 841.320 Channel 12 (565) Tx 886.950 Rx 841.950 Channel 13 (586) Tx 887.580 Rx 842.580 Channel 14 (607) Tx 888.210 Rx 843.210 Channel 15 (628) Tx 888.840 Rx 843.840 Channel 16 (649) Tx 889.470 Rx 844.470 Cell # 2 -------------------------------------------------- Channel 1 (335) Tx 880.050 Rx 835.050 Channel 2 (356) Tx 880.680 Rx 835.680 Channel 3 (377) Tx 881.310 Rx 836.310 Channel 4 (398) Tx 881.940 Rx 836.940 Channel 5 (419) Tx 882.570 Rx 837.570 Channel 6 (440) Tx 883.200 Rx 838.200 Channel 7 (461) Tx 883.830 Rx 838.830 Channel 8 (482) Tx 884.460 Rx 839.460 Channel 9 (503) Tx 885.090 Rx 840.090 Channel 10 (524) Tx 885.720 Rx 840.720 Channel 11 (545) Tx 886.350 Rx 841.350 Channel 12 (566) Tx 886.980 Rx 841.980 Channel 13 (587) Tx 887.610 Rx 842.610 Channel 14 (608) Tx 888.240 Rx 843.240 Channel 15 (629) Tx 888.870 Rx 843.870 Channel 16 (650) Tx 889.500 Rx 844.500 Cell # 3 -------------------------------------------------- Channel 1 (336) Tx 880.080 Rx 835.080 Channel 2 (357) Tx 880.710 Rx 835.710 Channel 3 (378) Tx 881.340 Rx 836.340 Channel 4 (399) Tx 881.970 Rx 836.970 Channel 5 (420) Tx 882.600 Rx 837.600 Channel 6 (441) Tx 883.230 Rx 838.230 Channel 7 (462) Tx 883.860 Rx 838.860 Channel 8 (483) Tx 884.490 Rx 839.490 Channel 9 (504) Tx 885.120 Rx 840.120 Channel 10 (525) Tx 885.750 Rx 840.750 Channel 11 (546) Tx 886.380 Rx 841.380 Channel 12 (567) Tx 887.010 Rx 842.010 Channel 13 (588) Tx 887.640 Rx 842.640 Channel 14 (609) Tx 888.270 Rx 843.270 Channel 15 (630) Tx 888.900 Rx 843.900 Channel 16 (651) Tx 889.530 Rx 844.530 Cell # 4 -------------------------------------------------- Channel 1 (337) Tx 880.110 Rx 835.110 Channel 2 (358) Tx 880.740 Rx 835.740 Channel 3 (379) Tx 881.370 Rx 836.370 Channel 4 (400) Tx 882.000 Rx 837.000 Channel 5 (421) Tx 882.630 Rx 837.630 Channel 6 (442) Tx 883.260 Rx 838.260 Channel 7 (463) Tx 883.890 Rx 838.890 Channel 8 (484) Tx 884.520 Rx 839.520 Channel 9 (505) Tx 885.150 Rx 840.150 Channel 10 (526) Tx 885.780 Rx 840.780 Channel 11 (547) Tx 886.410 Rx 841.410 Channel 12 (568) Tx 887.040 Rx 842.040 Channel 13 (589) Tx 887.670 Rx 842.670 Channel 14 (610) Tx 888.300 Rx 843.300 Channel 15 (631) Tx 888.930 Rx 843.930 Channel 16 (652) Tx 889.560 Rx 844.560 Cell # 5 -------------------------------------------------- Channel 1 (338) Tx 880.140 Rx 835.140 Channel 2 (359) Tx 880.770 Rx 835.770 Channel 3 (380) Tx 881.400 Rx 836.400 Channel 4 (401) Tx 882.030 Rx 837.030 Channel 5 (422) Tx 882.660 Rx 837.660 Channel 6 (443) Tx 883.290 Rx 838.290 Channel 7 (464) Tx 883.920 Rx 838.920 Channel 8 (485) Tx 884.550 Rx 839.550 Channel 9 (506) Tx 885.180 Rx 840.180 Channel 10 (527) Tx 885.810 Rx 840.810 Channel 11 (548) Tx 886.440 Rx 841.440 Channel 12 (569) Tx 887.070 Rx 842.070 Channel 13 (590) Tx 887.700 Rx 842.700 Channel 14 (611) Tx 888.330 Rx 843.330 Channel 15 (632) Tx 888.960 Rx 843.960 Channel 16 (653) Tx 889.590 Rx 844.590 Cell # 6 -------------------------------------------------- Channel 1 (339) Tx 880.170 Rx 835.170 Channel 2 (360) Tx 880.800 Rx 835.800 Channel 3 (381) Tx 881.430 Rx 836.430 Channel 4 (402) Tx 882.060 Rx 837.060 Channel 5 (423) Tx 882.690 Rx 837.690 Channel 6 (444) Tx 883.320 Rx 838.320 Channel 7 (465) Tx 883.950 Rx 838.950 Channel 8 (486) Tx 884.580 Rx 839.580 Channel 9 (507) Tx 885.210 Rx 840.210 Channel 10 (528) Tx 885.840 Rx 840.840 Channel 11 (549) Tx 886.470 Rx 841.470 Channel 12 (570) Tx 887.100 Rx 842.100 Channel 13 (591) Tx 887.730 Rx 842.730 Channel 14 (612) Tx 888.360 Rx 843.360 Channel 15 (633) Tx 888.990 Rx 843.990 Channel 16 (654) Tx 889.620 Rx 844.620 Cell # 7 -------------------------------------------------- Channel 1 (340) Tx 880.200 Rx 835.200 Channel 2 (361) Tx 880.830 Rx 835.830 Channel 3 (382) Tx 881.460 Rx 836.460 Channel 4 (403) Tx 882.090 Rx 837.090 Channel 5 (424) Tx 882.720 Rx 837.720 Channel 6 (445) Tx 883.350 Rx 838.350 Channel 7 (466) Tx 883.980 Rx 838.980 Channel 8 (487) Tx 884.610 Rx 839.610 Channel 9 (508) Tx 885.240 Rx 840.240 Channel 10 (529) Tx 885.870 Rx 840.870 Channel 11 (550) Tx 886.500 Rx 841.500 Channel 12 (571) Tx 887.130 Rx 842.130 Channel 13 (592) Tx 887.760 Rx 842.760 Channel 14 (613) Tx 888.390 Rx 843.390 Channel 15 (634) Tx 889.020 Rx 844.020 Channel 16 (655) Tx 889.650 Rx 844.650 Cell # 8 -------------------------------------------------- Channel 1 (341) Tx 880.230 Rx 835.230 Channel 2 (362) Tx 880.860 Rx 835.860 Channel 3 (383) Tx 881.490 Rx 836.490 Channel 4 (404) Tx 882.120 Rx 837.120 Channel 5 (425) Tx 882.750 Rx 837.750 Channel 6 (446) Tx 883.380 Rx 838.380 Channel 7 (467) Tx 884.010 Rx 839.010 Channel 8 (488) Tx 884.640 Rx 839.640 Channel 9 (509) Tx 885.270 Rx 840.270 Channel 10 (530) Tx 885.900 Rx 840.900 Channel 11 (551) Tx 886.530 Rx 841.530 Channel 12 (572) Tx 887.160 Rx 842.160 Channel 13 (593) Tx 887.790 Rx 842.790 Channel 14 (614) Tx 888.420 Rx 843.420 Channel 15 (635) Tx 889.050 Rx 844.050 Channel 16 (656) Tx 889.680 Rx 844.680 Cell # 9 -------------------------------------------------- Channel 1 (342) Tx 880.260 Rx 835.260 Channel 2 (363) Tx 880.890 Rx 835.890 Channel 3 (384) Tx 881.520 Rx 836.520 Channel 4 (405) Tx 882.150 Rx 837.150 Channel 5 (426) Tx 882.780 Rx 837.780 Channel 6 (447) Tx 883.410 Rx 838.410 Channel 7 (468) Tx 884.040 Rx 839.040 Channel 8 (489) Tx 884.670 Rx 839.670 Channel 9 (510) Tx 885.300 Rx 840.300 Channel 10 (531) Tx 885.930 Rx 840.930 Channel 11 (552) Tx 886.560 Rx 841.560 Channel 12 (573) Tx 887.190 Rx 842.190 Channel 13 (594) Tx 887.820 Rx 842.820 Channel 14 (615) Tx 888.450 Rx 843.450 Channel 15 (636) Tx 889.080 Rx 844.080 Channel 16 (657) Tx 889.710 Rx 844.710 Cell # 10 -------------------------------------------------- Channel 1 (343) Tx 880.290 Rx 835.290 Channel 2 (364) Tx 880.920 Rx 835.920 Channel 3 (385) Tx 881.550 Rx 836.550 Channel 4 (406) Tx 882.180 Rx 837.180 Channel 5 (427) Tx 882.810 Rx 837.810 Channel 6 (448) Tx 883.440 Rx 838.440 Channel 7 (469) Tx 884.070 Rx 839.070 Channel 8 (490) Tx 884.700 Rx 839.700 Channel 9 (511) Tx 885.330 Rx 840.330 Channel 10 (532) Tx 885.960 Rx 840.960 Channel 11 (553) Tx 886.590 Rx 841.590 Channel 12 (574) Tx 887.220 Rx 842.220 Channel 13 (595) Tx 887.850 Rx 842.850 Channel 14 (616) Tx 888.480 Rx 843.480 Channel 15 (637) Tx 889.110 Rx 844.110 Channel 16 (658) Tx 889.740 Rx 844.740 Cell # 11 -------------------------------------------------- Channel 1 (344) Tx 880.320 Rx 835.320 Channel 2 (365) Tx 880.950 Rx 835.950 Channel 3 (386) Tx 881.580 Rx 836.580 Channel 4 (407) Tx 882.210 Rx 837.210 Channel 5 (428) Tx 882.840 Rx 837.840 Channel 6 (449) Tx 883.470 Rx 838.470 Channel 7 (470) Tx 884.100 Rx 839.100 Channel 8 (491) Tx 884.730 Rx 839.730 Channel 9 (512) Tx 885.360 Rx 840.360 Channel 10 (533) Tx 885.990 Rx 840.990 Channel 11 (554) Tx 886.620 Rx 841.620 Channel 12 (575) Tx 887.250 Rx 842.250 Channel 13 (596) Tx 887.880 Rx 842.880 Channel 14 (617) Tx 888.510 Rx 843.510 Channel 15 (638) Tx 889.140 Rx 844.140 Channel 16 (659) Tx 889.770 Rx 844.770 Cell # 12 -------------------------------------------------- Channel 1 (345) Tx 880.350 Rx 835.350 Channel 2 (366) Tx 880.980 Rx 835.980 Channel 3 (387) Tx 881.610 Rx 836.610 Channel 4 (408) Tx 882.240 Rx 837.240 Channel 5 (429) Tx 882.870 Rx 837.870 Channel 6 (450) Tx 883.500 Rx 838.500 Channel 7 (471) Tx 884.130 Rx 839.130 Channel 8 (492) Tx 884.760 Rx 839.760 Channel 9 (513) Tx 885.390 Rx 840.390 Channel 10 (534) Tx 886.020 Rx 841.020 Channel 11 (555) Tx 886.650 Rx 841.650 Channel 12 (576) Tx 887.280 Rx 842.280 Channel 13 (597) Tx 887.910 Rx 842.910 Channel 14 (618) Tx 888.540 Rx 843.540 Channel 15 (639) Tx 889.170 Rx 844.170 Channel 16 (660) Tx 889.800 Rx 844.800 Cell # 13 -------------------------------------------------- Channel 1 (346) Tx 880.380 Rx 835.380 Channel 2 (367) Tx 881.010 Rx 836.010 Channel 3 (388) Tx 881.640 Rx 836.640 Channel 4 (409) Tx 882.270 Rx 837.270 Channel 5 (430) Tx 882.900 Rx 837.900 Channel 6 (451) Tx 883.530 Rx 838.530 Channel 7 (472) Tx 884.160 Rx 839.160 Channel 8 (493) Tx 884.790 Rx 839.790 Channel 9 (514) Tx 885.420 Rx 840.420 Channel 10 (535) Tx 886.050 Rx 841.050 Channel 11 (556) Tx 886.680 Rx 841.680 Channel 12 (577) Tx 887.310 Rx 842.310 Channel 13 (598) Tx 887.940 Rx 842.940 Channel 14 (619) Tx 888.570 Rx 843.570 Channel 15 (640) Tx 889.200 Rx 844.200 Channel 16 (661) Tx 889.830 Rx 844.830 Cell # 14 -------------------------------------------------- Channel 1 (347) Tx 880.410 Rx 835.410 Channel 2 (368) Tx 881.040 Rx 836.040 Channel 3 (389) Tx 881.670 Rx 836.670 Channel 4 (410) Tx 882.300 Rx 837.300 Channel 5 (431) Tx 882.930 Rx 837.930 Channel 6 (452) Tx 883.560 Rx 838.560 Channel 7 (473) Tx 884.190 Rx 839.190 Channel 8 (494) Tx 884.820 Rx 839.820 Channel 9 (515) Tx 885.450 Rx 840.450 Channel 10 (536) Tx 886.080 Rx 841.080 Channel 11 (557) Tx 886.710 Rx 841.710 Channel 12 (578) Tx 887.340 Rx 842.340 Channel 13 (599) Tx 887.970 Rx 842.970 Channel 14 (620) Tx 888.600 Rx 843.600 Channel 15 (641) Tx 889.230 Rx 844.230 Channel 16 (662) Tx 889.860 Rx 844.860 Cell # 15 -------------------------------------------------- Channel 1 (348) Tx 880.440 Rx 835.440 Channel 2 (369) Tx 881.070 Rx 836.070 Channel 3 (390) Tx 881.700 Rx 836.700 Channel 4 (411) Tx 882.330 Rx 837.330 Channel 5 (432) Tx 882.960 Rx 837.960 Channel 6 (453) Tx 883.590 Rx 838.590 Channel 7 (474) Tx 884.220 Rx 839.220 Channel 8 (495) Tx 884.850 Rx 839.850 Channel 9 (516) Tx 885.480 Rx 840.480 Channel 10 (537) Tx 886.110 Rx 841.110 Channel 11 (558) Tx 886.740 Rx 841.740 Channel 12 (579) Tx 887.370 Rx 842.370 Channel 13 (600) Tx 888.000 Rx 843.000 Channel 14 (621) Tx 888.630 Rx 843.630 Channel 15 (642) Tx 889.260 Rx 844.260 Channel 16 (663) Tx 889.890 Rx 844.890 Cell # 16 -------------------------------------------------- Channel 1 (349) Tx 880.470 Rx 835.470 Channel 2 (370) Tx 881.100 Rx 836.100 Channel 3 (391) Tx 881.730 Rx 836.730 Channel 4 (412) Tx 882.360 Rx 837.360 Channel 5 (433) Tx 882.990 Rx 837.990 Channel 6 (454) Tx 883.620 Rx 838.620 Channel 7 (475) Tx 884.250 Rx 839.250 Channel 8 (496) Tx 884.880 Rx 839.880 Channel 9 (517) Tx 885.510 Rx 840.510 Channel 10 (538) Tx 886.140 Rx 841.140 Channel 11 (559) Tx 886.770 Rx 841.770 Channel 12 (580) Tx 887.400 Rx 842.400 Channel 13 (601) Tx 888.030 Rx 843.030 Channel 14 (622) Tx 888.660 Rx 843.660 Channel 15 (643) Tx 889.290 Rx 844.290 Channel 16 (664) Tx 889.920 Rx 844.920 Cell # 17 -------------------------------------------------- Channel 1 (350) Tx 880.500 Rx 835.500 Channel 2 (371) Tx 881.130 Rx 836.130 Channel 3 (392) Tx 881.760 Rx 836.760 Channel 4 (413) Tx 882.390 Rx 837.390 Channel 5 (434) Tx 883.020 Rx 838.020 Channel 6 (455) Tx 883.650 Rx 838.650 Channel 7 (476) Tx 884.280 Rx 839.280 Channel 8 (497) Tx 884.910 Rx 839.910 Channel 9 (518) Tx 885.540 Rx 840.540 Channel 10 (539) Tx 886.170 Rx 841.170 Channel 11 (560) Tx 886.800 Rx 841.800 Channel 12 (581) Tx 887.430 Rx 842.430 Channel 13 (602) Tx 888.060 Rx 843.060 Channel 14 (623) Tx 888.690 Rx 843.690 Channel 15 (644) Tx 889.320 Rx 844.320 Channel 16 (665) Tx 889.950 Rx 844.950 Cell # 18 -------------------------------------------------- Channel 1 (351) Tx 880.530 Rx 835.530 Channel 2 (372) Tx 881.160 Rx 836.160 Channel 3 (393) Tx 881.790 Rx 836.790 Channel 4 (414) Tx 882.420 Rx 837.420 Channel 5 (435) Tx 883.050 Rx 838.050 Channel 6 (456) Tx 883.680 Rx 838.680 Channel 7 (477) Tx 884.310 Rx 839.310 Channel 8 (498) Tx 884.940 Rx 839.940 Channel 9 (519) Tx 885.570 Rx 840.570 Channel 10 (540) Tx 886.200 Rx 841.200 Channel 11 (561) Tx 886.830 Rx 841.830 Channel 12 (582) Tx 887.460 Rx 842.460 Channel 13 (603) Tx 888.090 Rx 843.090 Channel 14 (624) Tx 888.720 Rx 843.720 Channel 15 (645) Tx 889.350 Rx 844.350 Channel 16 (666) Tx 889.980 Rx 844.980 Cell # 19 -------------------------------------------------- Channel 1 (352) Tx 880.560 Rx 835.560 Channel 2 (373) Tx 881.190 Rx 836.190 Channel 3 (394) Tx 881.820 Rx 836.820 Channel 4 (415) Tx 882.450 Rx 837.450 Channel 5 (436) Tx 883.080 Rx 838.080 Channel 6 (457) Tx 883.710 Rx 838.710 Channel 7 (478) Tx 884.340 Rx 839.340 Channel 8 (499) Tx 884.970 Rx 839.970 Channel 9 (520) Tx 885.600 Rx 840.600 Channel 10 (541) Tx 886.230 Rx 841.230 Channel 11 (562) Tx 886.860 Rx 841.860 Channel 12 (583) Tx 887.490 Rx 842.490 Channel 13 (604) Tx 888.120 Rx 843.120 Channel 14 (625) Tx 888.750 Rx 843.750 Channel 15 (646) Tx 889.380 Rx 844.380 Cell # 20 -------------------------------------------------- Channel 1 (353) Tx 880.590 Rx 835.590 Channel 2 (374) Tx 881.220 Rx 836.220 Channel 3 (395) Tx 881.850 Rx 836.850 Channel 4 (416) Tx 882.480 Rx 837.480 Channel 5 (437) Tx 883.110 Rx 838.110 Channel 6 (458) Tx 883.740 Rx 838.740 Channel 7 (479) Tx 884.370 Rx 839.370 Channel 8 (500) Tx 885.000 Rx 840.000 Channel 9 (521) Tx 885.630 Rx 840.630 Channel 10 (542) Tx 886.260 Rx 841.260 Channel 11 (563) Tx 886.890 Rx 841.890 Channel 12 (584) Tx 887.520 Rx 842.520 Channel 13 (605) Tx 888.150 Rx 843.150 Channel 14 (626) Tx 888.780 Rx 843.780 Channel 15 (647) Tx 889.410 Rx 844.410 Cell # 21 -------------------------------------------------- Channel 1 (354) Tx 880.620 Rx 835.620 Channel 2 (375) Tx 881.250 Rx 836.250 Channel 3 (396) Tx 881.880 Rx 836.880 Channel 4 (417) Tx 882.510 Rx 837.510 Channel 5 (438) Tx 883.140 Rx 838.140 Channel 6 (459) Tx 883.770 Rx 838.770 Channel 7 (480) Tx 884.400 Rx 839.400 Channel 8 (501) Tx 885.030 Rx 840.030 Channel 9 (522) Tx 885.660 Rx 840.660 Channel 10 (543) Tx 886.290 Rx 841.290 Channel 11 (564) Tx 886.920 Rx 841.920 Channel 12 (585) Tx 887.550 Rx 842.550 Channel 13 (606) Tx 888.180 Rx 843.180 Channel 14 (627) Tx 888.810 Rx 843.810 Channel 15 (648) Tx 889.440 Rx 844.440

Cellular Phone Frequency and Cell Construction

__ __ \__/C \__/D \__ \__/G \__/A \__/ _/D \__/E \__/F \__ \__/B \__/C \__/ _/F \__/G \__/A \__ \__/D \__/E \__/ _/A \__/B \__/C \__ \__/ \__/ \__/

This represents how a cellular system might be laid out.

Cells A and B never share a common border.  Neither do B and C, A, and G, etc.  Cells that are next to each other are never assigned adjacent frequencies.  They always differ by at least 60 kHz.

To track a mobile phone as it changes cells, let's put the mobile in a B cell.  When the mobile switches frequencies, you know that he could only go to an D, E, F, or G cell because A and C have adjacent frequencies.

The two tables below will help you determine which channel cells can go next to each other.  You can contact your local cellular phone company and see if they have any maps of the cells available.  This is not a sure thing, but it couldn't hurt to try.

Cells that can go next to each other:

Cell Compatible Cells A C, D, E, F B D, E, F, G C E, F, G, A D F, G, A, B E G, A, B, C F A, B, C, D G B, C, D, E

Here is a frequency/cell layout chart.  The cell frequencies are used by the cell site towers, and the mobile frequencies are the input frequencies used by the cars.

Wireline Company Cell Frequencies (Band B)

CELL A CELL B CELL C CELL D CELL E CELL F CELL G ======= ======= ======= ======= ======= ======= ======= 889.890 889.920 889.950 889.980 889.680 889.710 889.740 889.770 889.800 889.830 889.860 889.470 889.500 889.530 889.560 889.590 889.620 889.650 889.260 889.290 889.320 889.350 889.380 889.410 889.440 889.050 889.080 889.110 889.140 889.170 889.200 889.230 888.840 888.870 888.900 888.930 888.960 888.990 889.020 888.630 888.660 888.690 888.720 888.750 888.780 888.810 888.420 888.450 888.480 888.510 888.540 888.570 888.600 888.210 888.240 888.270 888.300 888.330 888.360 888.390 888.000 888.030 888.060 888.090 888.120 888.150 888.180 887.790 887.820 887.850 887.880 887.910 887.940 887.970 887.580 887.610 887.640 887.670 887.700 887.730 887.760 887.370 887.400 887.430 887.460 887.490 887.520 887.550 887.160 887.190 887.220 887.250 887.280 887.310 887.340 886.950 886.980 887.010 887.040 887.070 887.100 887.130 886.740 886.770 886.800 886.830 886.860 886.890 886.920 886.530 886.560 886.590 886.620 886.650 886.680 886.710 886.320 886.350 886.380 886.410 886.440 886.470 886.500 Voice 886.110 886.140 886.170 886.200 886.230 886.260 886.290 885.900 885.930 885.960 885.990 886.020 886.050 886.080 885.690 885.720 885.750 885.780 885.810 885.840 885.870 885.480 885.510 885.540 885.570 885.600 885.630 885.660 885.270 885.300 885.330 885.360 885.390 885.420 885.450 885.060 885.090 885.120 885.150 885.180 885.210 885.240 884.850 884.880 884.910 884.940 884.970 885.000 885.030 884.640 884.670 884.700 884.730 884.760 884.790 884.820 884.430 884.460 884.490 884.520 884.550 884.580 884.610 884.220 884.250 884.280 884.310 884.340 884.370 884.400 884.010 884.040 884.070 884.100 884.130 884.160 884.190 Channels 883.800 883.830 883.860 883.890 883.920 883.950 883.980 883.590 883.620 883.650 883.680 883.710 883.740 883.770 883.380 883.410 883.440 883.470 883.500 883.530 883.560 883.170 883.200 883.230 883.260 883.290 883.320 883.350 882.960 882.990 883.020 883.050 883.080 883.110 883.140 882.750 882.780 882.810 882.840 882.870 882.900 882.930 882.540 882.570 882.600 882.630 882.660 882.690 882.720 882.330 882.360 882.390 882.420 882.450 882.480 882.510 882.120 882.150 882.180 882.210 882.240 882.270 882.300 881.910 881.940 881.970 882.000 882.030 882.060 882.090 881.700 881.730 881.760 881.790 881.820 881.850 881.880 881.490 881.520 881.550 881.580 881.610 881.640 881.670 881.280 881.310 881.340 881.370 881.400 881.430 881.460 881.070 881.100 881.130 881.160 881.190 881.220 881.250 880.860 880.890 880.920 880.950 880.980 881.010 881.040 880.650 880.680 880.710 880.740 880.770 880.800 880.830 ------------------------------------------------------------------- 880.440 880.470 880.500 880.530 880.560 880.590 880.620 Digital 880.230 880.260 880.290 880.320 880.350 880.380 880.410 Control 880.020 880.050 880.080 880.110 880.140 880.170 880.200 Channels

Wireline Company Mobile Frequencies (Band B)

CELL A CELL B CELL C CELL D CELL E CELL F CELL G ======= ======= ======= ======= ======= ======= ======= 844.890 844.920 844.950 844.980 844.680 844.710 844.740 844.770 844.800 844.830 844.860 844.470 844.500 844.530 844.560 844.590 844.620 844.650 844.260 844.290 844.320 844.350 844.380 844.410 844.440 844.050 844.080 844.110 844.140 844.170 844.200 844.230 843.840 843.870 843.900 843.930 843.960 843.990 844.020 843.630 843.660 843.690 843.720 843.750 843.780 843.810 843.420 843.450 843.480 843.510 843.540 843.570 843.600 843.210 843.240 843.270 843.300 843.330 843.360 843.390 843.000 843.030 843.060 843.090 843.120 843.150 843.180 842.790 842.820 842.850 842.880 842.910 842.940 842.970 842.580 842.610 842.640 842.670 842.700 842.730 842.760 842.370 842.400 842.430 842.460 842.490 842.520 842.550 842.160 842.190 842.220 842.250 842.280 842.310 842.340 841.950 841.980 842.010 842.040 842.070 842.100 842.130 841.740 841.770 841.800 841.830 841.860 841.890 841.920 841.530 841.560 841.590 841.620 841.650 841.680 841.710 841.320 841.350 841.380 841.410 841.440 841.470 841.500 Voice 841.110 841.140 841.170 841.200 841.230 841.260 841.290 840.900 840.930 840.960 840.990 841.020 841.050 841.080 840.690 840.720 840.750 840.780 840.810 840.840 840.870 840.480 840.510 840.540 840.570 840.600 840.630 840.660 840.270 840.300 840.330 840.360 840.390 840.420 840.450 840.060 840.090 840.120 840.150 840.180 840.210 840.240 839.850 839.880 839.910 839.940 839.970 840.000 840.030 839.640 839.670 839.700 839.730 839.760 839.790 839.820 839.430 839.460 839.490 839.520 839.550 839.580 839.610 839.220 839.250 839.280 839.310 839.340 839.370 839.400 839.010 839.040 839.070 839.100 839.130 839.160 839.190 Channels 838.800 838.830 838.860 838.890 838.920 838.950 838.980 838.590 838.620 838.650 838.680 838.710 838.740 838.770 838.380 838.410 838.440 838.470 838.500 838.530 838.560 838.170 838.200 838.230 838.260 838.290 838.320 838.350 837.960 837.990 838.020 838.050 838.080 838.110 838.140 837.750 837.780 837.810 837.840 837.870 837.900 837.930 837.540 837.570 837.600 837.630 837.660 837.690 837.720 837.330 837.360 837.390 837.420 837.450 837.480 837.510 837.120 837.150 837.180 837.210 837.240 837.270 837.300 836.910 836.940 836.970 837.000 837.030 837.060 837.090 836.700 836.730 836.760 836.790 836.820 836.850 836.880 836.490 836.520 836.550 836.580 836.610 836.640 836.670 836.280 836.310 836.340 836.370 836.400 836.430 836.460 836.070 836.100 836.130 836.160 836.190 836.220 836.250 835.860 835.890 835.920 835.950 835.980 836.010 836.040 835.650 835.680 835.710 835.740 835.770 835.800 835.830 ------------------------------------------------------------------- 835.440 835.470 835.500 835.530 835.560 835.590 835.620 Digital 835.230 835.260 835.290 835.320 835.350 835.380 835.410 Control 835.020 835.050 835.080 835.110 835.140 835.170 835.200 Channels

Non-Wireline Company Cell Frequencies (Band A)

CELL A CELL B CELL C CELL D CELL E CELL F CELL G ======= ======= ======= ======= ======= ======= ======= 879.900 879.930 879.960 879.990 Digital 879.690 879.720 879.750 879.780 879.810 879.840 879.870 Control 879.480 879.510 879.540 879.570 879.600 879.630 879.660 Channels ------------------------------------- 879.390 879.420 879.450 879.270 879.300 879.330 879.360 --------------------------- 879.060 879.090 879.120 879.150 879.180 879.210 879.240 878.850 878.880 878.910 878.940 878.970 879.000 879.030 878.640 878.670 878.700 878.730 878.760 878.790 878.820 878.430 878.460 878.490 878.520 878.550 878.580 878.610 878.220 878.250 878.280 878.310 878.340 878.370 878.400 878.010 878.040 878.070 878.100 878.130 878.160 878.190 877.800 877.830 877.860 877.890 877.920 877.950 877.980 877.590 877.620 877.650 877.680 877.710 877.740 877.770 877.380 877.410 877.440 877.470 877.500 877.530 877.560 877.170 877.200 877.230 877.260 877.290 877.320 877.350 876.960 876.990 877.020 877.050 877.080 877.110 877.140 876.750 876.780 876.810 876.840 876.870 876.900 876.930 876.540 876.570 876.600 876.630 876.660 876.690 876.720 876.330 876.360 876.390 876.420 876.450 876.480 876.510 876.120 876.150 876.180 876.210 876.240 876.270 876.300 875.910 875.940 875.970 876.000 876.030 876.060 876.090 875.700 875.730 875.760 875.790 875.820 875.850 875.880 Voice 875.490 875.520 875.550 875.580 875.610 875.640 875.670 875.280 875.310 875.340 875.370 875.400 875.430 875.460 875.070 875.100 875.130 875.160 875.190 875.220 875.250 874.860 874.890 874.920 874.950 874.980 875.010 875.040 874.650 874.680 874.710 874.740 874.770 874.800 874.830 874.440 874.470 874.500 874.530 874.560 874.590 874.620 874.230 874.260 874.290 874.320 874.350 874.380 874.410 874.020 874.050 874.080 874.110 874.140 874.170 874.200 873.810 873.840 873.870 873.900 873.930 873.960 873.990 873.600 873.630 873.660 873.690 873.720 873.750 873.780 873.390 873.420 873.450 873.480 873.510 873.540 873.570 Channels 873.180 873.210 873.240 873.270 873.300 873.330 873.360 872.970 873.000 873.030 873.060 873.090 873.120 873.150 872.760 872.790 872.820 872.850 872.880 872.910 872.940 872.550 872.580 872.610 872.640 872.670 872.700 872.730 872.340 872.370 872.400 872.430 872.460 872.490 872.520 872.130 872.160 872.190 872.220 872.250 872.280 872.310 871.920 871.950 871.980 872.010 872.040 872.070 872.100 871.710 871.740 871.770 871.800 871.830 871.860 871.890 871.500 871.530 871.560 871.590 871.620 871.650 871.680 871.290 871.320 871.350 871.380 871.410 871.440 871.470 871.080 871.110 871.140 871.170 871.200 871.230 871.260 870.870 870.900 870.930 870.960 870.990 871.020 871.050 870.660 870.690 870.720 870.750 870.780 870.810 870.840 870.450 870.480 870.510 870.540 870.570 870.600 870.630 870.240 870.270 870.300 870.330 870.360 870.390 870.420 870.030 870.060 870.090 870.120 870.150 870.180 870.210

Non-Wireline Company Mobile Frequencies (Band A)

CELL A CELL B CELL C CELL D CELL E CELL F CELL G ======= ======= ======= ======= ======= ======= ======= 834.900 834.930 834.960 834.990 Digital 834.690 834.720 834.750 834.780 834.810 834.840 834.870 Control 834.480 834.510 834.540 834.570 834.600 834.630 834.660 Channels ------------------------------------- 834.390 834.420 834.450 834.270 834.300 834.330 834.360 --------------------------- 834.060 834.090 834.120 834.150 834.180 834.210 834.240 833.850 833.880 833.910 833.940 833.970 834.000 834.030 833.640 833.670 833.700 833.730 833.760 833.790 833.820 833.430 833.460 833.490 833.520 833.550 833.580 833.610 833.220 833.250 833.280 833.310 833.340 833.370 833.400 833.010 833.040 833.070 833.100 833.130 833.160 833.190 832.800 832.830 832.860 832.890 832.920 832.950 832.980 832.590 832.620 832.650 832.680 832.710 832.740 832.770 832.380 832.410 832.440 832.470 832.500 832.530 832.560 832.170 832.200 832.230 832.260 832.290 832.320 832.350 831.960 831.990 832.020 832.050 832.080 832.110 832.140 831.750 831.780 831.810 831.840 831.870 831.900 831.930 831.540 831.570 831.600 831.630 831.660 831.690 831.720 831.330 831.360 831.390 831.420 831.450 831.480 831.510 831.120 831.150 831.180 831.210 831.240 831.270 831.300 830.910 830.940 830.970 831.000 831.030 831.060 831.090 830.700 830.730 830.760 830.790 830.820 830.850 830.880 Voice 830.490 830.520 830.550 830.580 830.610 830.640 830.670 830.280 830.310 830.340 830.370 830.400 830.430 830.460 830.070 830.100 830.130 830.160 830.190 830.220 830.250 829.860 829.890 829.920 829.950 829.980 830.010 830.040 829.650 829.680 829.710 829.740 829.770 829.800 829.830 829.440 829.470 829.500 829.530 829.560 829.590 829.620 829.230 829.260 829.290 829.320 829.350 829.380 829.410 829.020 829.050 829.080 829.110 829.140 829.170 829.200 828.810 828.840 828.870 828.900 828.930 828.960 828.990 828.600 828.630 828.660 828.690 828.720 828.750 828.780 828.390 828.420 828.450 828.480 828.510 828.540 828.570 Channels 828.180 828.210 828.240 828.270 828.300 828.330 828.360 827.970 828.000 828.030 828.060 828.090 828.120 828.150 827.760 827.790 827.820 827.850 827.880 827.910 827.940 827.550 827.580 827.610 827.640 827.670 827.700 827.730 827.340 827.370 827.400 827.430 827.460 827.490 827.520 827.130 827.160 827.190 827.220 827.250 827.280 827.310 826.920 826.950 826.980 827.010 827.040 827.070 827.100 826.710 826.740 826.770 826.800 826.830 826.860 826.890 826.500 826.530 826.560 826.590 826.620 826.650 826.680 826.290 826.320 826.350 826.380 826.410 826.440 826.470 826.080 826.110 826.140 826.170 826.200 826.230 826.260 825.870 825.900 825.930 825.960 825.990 826.020 826.050 825.660 825.690 825.720 825.750 825.780 825.810 825.840 825.450 825.480 825.510 825.540 825.570 825.600 825.630 825.240 825.270 825.300 825.330 825.360 825.390 825.420 825.030 825.060 825.090 825.120 825.150 825.180 825.210

Monitoring of the base sites is obviously going to be easier than monitoring the mobiles.  The cell base sites are towers (usually blue) with a triangle shaped "head" on top, and sporting a couple of what appear to be vertical antennas.  These base sites have a range of 3-5 miles.  If you take a look at the honeycomb diagram, you can see how they are laid out.

The cell transmitter is in the middle of the cell.  It is possible to hear many, most, or all of the cells in your city, depending on your location.  The closer you live to a boundary, the greater the chances of your being able to receive more cells.  Due to the nature of radio signals, the actual cell shape is more or less round.

However, the hexagon shape lends itself better to show how the system is laid out.  With a circular coverage area, there will be some overlapping between adjacent cells.

__ __ \__/C \__/D \__ \__/G \__/A \__/ _/D \__/E \__/F \__ \__/B \__*C \__/ _/F \__/G \__/A \__ \__/D \__/E \__/ _/A \__/B \__/C \__ \__/ \__/ \__/

If, for example, you live near the asterisk (*) in the above diagram, you will be able go easily hear the G, C, E, and A cells you're near.  Since the maximum practical range of a cell is 3-5 miles, you'll be able to hear them a bit farther away.

However, due to the nature of the FM transceivers at the cell sites (they capture only the strongest signal), you should be able to hear all seven cells.  Which one of each cell you hear will depend on your location and the strength of the received signal.  In the above diagram, you'll most likely hear the F cell in the upper-right, rather than the one on the left.

Mobile reception is almost a waste of time unless you have an outdoor antenna.  And, since the mobile will be repeated on the cell site, it's better to listen to the cell frequencies.  You may not be able to hear both sides of the conversation if you listen only to the mobile frequencies!  It is useful, however, for determining which channel cell you're in.  If you use the antenna that came with the scanner, mobile range will be decreased down to 1 or 2 miles.  By checking the scanner readout against the cell list above (825.03-844.98 MHz), you can tell what cell the mobile is in.  This is also useful on the cell site frequencies.

If you hear someone say, "I'm at the corner of Highway FF and 37," and you know where the cell site antenna is in that area, you can check the frequency listing above and determine what cell that antenna belongs to.

Where to Get What You Need!

Obviously, a device is needed to download all those ESN/MINs, etc. off the cellular airwaves.  Here's the stuff I found so far that is under $2000 (this ain't a cheap hobby).

CCS Company, P.O. Box 11191, Milwaukee, WI 53211 (414-781-2482)  They sell everything ya need for $300 to $400.  Kits are cheaper.  Their device interfaces between a 800 MHz capable scanner and your computer.  Make sure you tell them you want the REVERSE model DDI.  (This is what I use.)

Curtis Electro Devices, 1235 Pear Ave., Mountain View, CA 94043 (800-332-2790)  They sell an ESN reader for $1295 that can read ESN/MIN, etc. but only from a short distance (maximum is 30 feet).  They also sell a security model for $1595 and a NAM programmer for $1195.  They publish a book called NAMFAX for $179 that tells you how to re-program hundreds of different cellulars through the keypad on the handset.  (Note:  You can't reprogram ESNs through the keypad unless you re-write the phones software.)

    

Wavetek Communications Div., 5808 Churchman Bypass, Indianapolis, IN 46203-6109 (800-245-6356 or 317-788-5965)  They sell a "Cellular I.D. Tester" that's real similar to Curtis's ESN reader but supposedly has a longer range.  Price: $1495.

Needham Electronics, 4539 Orange Grove Ave., Sacramento, CA 95841 (916-924-8037)  They sell EPROM burners for $139.95.  (I bought one myself).

Motorola (800-433-5202)  They sell a cellular service manual that's used in their cellular service classes for $30.  Ask for the Order Fulfillment Dept.: Item 68-093-00A60.  This manual tells it all!  An absolute must to have.

Bishop Company (800-829-0572)  They publish books similar to Curtis's NAMFAX.  Send for catalog.

Cellular Security

Well we know a properly cloned cell phone is virtually impossible to detect.  Or is it?  Security companies rely on matching call patterns of subscribers historys to current use (i.e., when 200 calls to Egypt show up in a day or 80 long distance calls to Culman, Alabama show up in a short period, all kinds of flags and whistles go off!)

The security companies will even keep records of people that call numbers that have been previously called by tumbled phones and flag the phone calling that number as a potential fraudulent phone.  These flags can be set go go off by a number of parameters: number of long distance calls per hour/day/month, etc.

Another method they use is when the real phone places a call and the tumbled phone places another call soon afterwards, but from a distance from the first call that's impossible to travel in such a short period of time.

Example:  At 5 p.m. Friday, Phone A calls from Manhattan and completes call at 5.10 p.m.  At 5.12 p.m., Cloned Phone B calls from Queens.  No one can travel those distances in two minutes, thus that ESN/MIN is tagged as a "clone" by the phone company.  These databases are just now starting to be used in larger cities.  Some software will track a flagged cell phone from cell site to cell site.

Commonly used discrepancies cell co software looks for are different ESNs, manufacturer, model, SCMs, etc. that are broadcast by the cellular phone on its reverse channel.  (If one captures all that data off the reverse channel and incorporates it in the cloned phone, detection via this method becomes nearly impossible.)

Some daring souls have been known to use fake ID and cards to even subscribe to a cellular service, then burn out the phone before the first months bill arrives to the unsuspecting real person.

Conclusion

The future for cellular fraud is wide open.  As the secret software of the over 300 brands of cellular phones in existence becomes "cracked" and re-written and spread via the underground, fraud will increase like wildfire.  Virtually nothing can be done to stop the informed phone phreak as he will change ESN/MINs, etc. easily and frequently.  A new era not seen since the 2600 Hz tone was discovered is just now dawning via cellular phreaking.

Since I'm letting the cat out of the bag for the first time here, I hereby dub the box needed to read reverse channels the BOO Box!  (Shit - after 12 years I finally get to name a box.)