Cellular networks
How mobile networks work: why coverage is cut into cells, the generations from 1G to 5G (and where 6G stands in late 2026), spectrum and duplexing, the parts of the network from the phone to the core, how a phone attaches and gets an IP address, handover, what 5G actually added, SIMs and eSIMs, voice and SMS today, how cell sites are built, private 5G and phones that talk to satellites. Radio basics (frequency, antennas, modulation, propagation) are in Radio fundamentals; what mobile latency and radio power states mean to a web app is in Wireless and mobile.
The cell idea
The first mobile telephone services put one powerful transmitter on a hill to cover a whole city, and could carry only a handful of calls at once: each call needs its own slice of spectrum, and spectrum is finite. The cellular idea, proposed at Bell Labs in 1947 and first commercial in 1979, flips this: many low-power base stations, each covering a small area, a cell, and the same frequencies reused in cells far enough apart that their signals have faded. Capacity then grows with the number of cells, not with the amount of spectrum.
- Cells are drawn as hexagons because hexagons tile a plane and approximate circles; real cells are blobs shaped by terrain, buildings and antenna patterns, and they overlap.
- A site usually has 3 sectors, each a separate cell covering 120° with its own antennas.
- Cell size ranges from tens of kilometers for a rural low-band tower to about a hundred meters for a small cell downtown. Small cells add capacity: the same spectrum, more often reused.
- Reuse factor. Analog and GSM networks used clusters of several cells with different frequencies. 3G (CDMA) and 4G/5G (OFDMA) reuse every frequency in every cell and handle the interference at the cell edge with scheduling, power control and coordination between base stations.
- Mobility. As a phone in a call moves, the network hands it to the next cell (handover); an idle phone simply picks the best cell itself and tells the network only when it enters a new tracking area, a group of cells. To reach an idle phone, the network pages every cell in its tracking area.
Generations
| Gen | Main standards | First commercial | How users share the radio | What changed | Typical speed | Typical RTT |
|---|---|---|---|---|---|---|
| 1G | AMPS, NMT, TACS | 1979 (Tokyo) | FDMA: a frequency per call, analog FM | mobile calls | voice only | – |
| 2G | GSM, cdmaOne (IS-95) | 1991 (GSM, Finland) | TDMA: 8 time slots per 200 kHz carrier (GSM); CDMA | digital voice, SMS, SIM cards; GPRS and EDGE data | tens to a couple of hundred kbit/s | several hundred ms |
| 3G | UMTS (WCDMA), CDMA2000 | 2001 (Japan) | CDMA: everyone at once on a 5 MHz carrier, separated by codes | mobile internet; HSPA | ≈ 1–10 Mbit/s with HSPA | 100–500 ms |
| 4G | LTE, LTE-Advanced | 2009 (Stockholm, Oslo) | OFDMA down, SC-FDMA up; MIMO | all-IP network; voice becomes VoIP (VoLTE) | tens of Mbit/s | 30–100 ms |
| 5G | NR (New Radio) | 2019 (South Korea, US) | OFDMA both ways, flexible timing, massive MIMO | new core, slicing, low-latency modes, mmWave | ≈ 100–500 Mbit/s on mid-band; 1 Gbit/s or more on mmWave | 10–40 ms |
| 6G | in standardization | ≈ 2030 target | – | – | – | – |
Speeds and latencies are rough real-world figures, not peak specs, and vary widely with the operator, band, load and signal. The latency column matches the Wireless and mobile table.
- 3GPP (3rd Generation Partnership Project), a partnership of regional standards bodies, writes the GSM, UMTS, LTE and 5G specifications in numbered Releases. 5G NR first appeared in Release 15 (2018); Release 18 (2024) and later are branded 5G-Advanced.
- FDMA, TDMA, CDMA, OFDMA are four ways to split a band among users: by frequency, by time slot, by code, or by a grid of subcarriers and time slots that a scheduler hands out every millisecond or less. Radio fundamentals covers the radio side.
- Shutdowns. Many operators switched off 3G between about 2020 and 2025 (US carriers did in 2022) to reuse the spectrum for 4G and 5G; some keep 2G alive for old IoT devices and roaming.
6G, as of late 2026. 3GPP's Release 20 holds the 6G studies (use cases, requirements and scenarios) alongside 5G-Advanced work. Release 21 is the first release with normative 6G specifications: the timetable agreed in June 2026 approves the work package in March 2027, freezes the architecture in mid-2028 and the protocol details in stages through March 2029. Commercial launches are aimed at around 2030, under the ITU's IMT-2030 framework. Topics under study include new spectrum between about 7 and 15 GHz, AI-assisted radio, sensing with the network's own signals, tighter integration with satellites and lower energy use; what ends up in the standard is still open.
Spectrum, FDD and TDD
Operators buy licensed spectrum, usually at government auctions, and get exclusive use of it in a region. Different bands trade coverage against capacity: low frequencies travel far and get into buildings, high frequencies carry wide channels but fade fast and are blocked by walls, hands and leaves.
| Band class | Examples | Channel widths | Reach (typical) | Role |
|---|---|---|---|---|
| low band, below 1 GHz | 600, 700, 800, 900 MHz | 5–20 MHz | kilometers to tens of km; good indoors | coverage everywhere, rural, deep indoor |
| mid band, 1–2.7 GHz | 1.8, 2.1, 2.6 GHz; 2.5 GHz TDD (n41) | 10–100 MHz | up to a few km | the LTE workhorse, now shared with 5G |
| C-band, 3.3–4.2 GHz | n77, n78 (3.5 GHz), US C-band 3.7 GHz | 40–100 MHz | hundreds of meters to a few km | the main 5G capacity band; massive MIMO |
| mmWave, 24–71 GHz | n257, n258, n260, n261 (26, 28, 39 GHz) | 100–400 MHz per carrier | ≈ 100–300 m, needs line of sight | stadiums, dense downtowns, fixed wireless |
- 5G names its two ranges FR1 (410 MHz to 7.125 GHz) and FR2 (24.25 to 71 GHz).
- Carrier aggregation lets a phone use several bands at once, for example low band for coverage and C-band for speed.
- Dynamic spectrum sharing (DSS) lets LTE and 5G NR use the same carrier, splitting it moment to moment.
A radio link needs to carry both directions: downlink (tower to phone) and uplink (phone to tower).
- FDD (frequency-division duplex) uses a pair of bands, for example LTE band 20: downlink 791–821 MHz, uplink 832–862 MHz. Simple and symmetric; most older low and mid bands are FDD.
- TDD (time-division duplex) uses one block and alternates. The split can favor downlink, which is what people mostly use, and the same frequency in both directions helps beamforming (the tower measures the channel from what the phone sends). Most 5G mid-band and all mmWave spectrum is TDD.
- Neighboring TDD networks must use the same pattern, synchronized (usually to GPS time): one tower transmitting while the next one listens would drown it.
Architecture: phone, RAN and core
- UE (user equipment): the phone, modem or IoT device, with its SIM.
- RAN (radio access network): the base stations, eNB (eNodeB) in LTE and gNB (gNodeB) in 5G, which schedule the radio and encrypt the air link.
- Backhaul: fiber or microwave radio links from each site to the operator's network.
- Core network: the control plane decides who you are, where you are and what you may do; the user plane moves your packets to and from the internet.
| 5G Core function | Does | 4G EPC equivalent |
|---|---|---|
| AMF (access and mobility management) | registration, mobility and connection signaling with the phone (NAS), paging | MME |
| SMF (session management) | sets up data sessions, assigns IP addresses, picks and programs the UPF | MME plus S-GW/P-GW control |
| UPF (user plane function) | forwards your packets, applies QoS rules, stays put as you move, connects to the internet | S-GW and P-GW data path |
| AUSF (authentication server) | runs the SIM authentication for the AMF | part of the HSS and MME |
| UDM (unified data management) | subscriber profiles and secret keys (stored in a UDR database) | HSS |
| PCF (policy control) | QoS and charging policies | PCRF |
| NRF (repository) | directory in which functions find each other | – |
| NSSF (slice selection) | picks the network slice for a session | – |
- The 5G Core is a service-based architecture: functions are software services that call each other over HTTP/2 APIs, usually run in containers in operator or public clouds. The 4G EPC had fixed boxes with point-to-point protocols.
- GTP tunnels. Between the gNB and the UPF (interface N3) your IP packets travel wrapped in GTP-U (GPRS tunneling protocol) over UDP. When you move to another base station only the tunnel's endpoint changes, so your IP address, which belongs to the UPF's pool, stays the same.
- Phones usually get IPv6 addresses, and an IPv4 address shared through carrier-grade NAT; see UDP and NAT traversal.
How a phone attaches
1/6
Power on and sync: the phone scans its bands for a synchronization burst. PSS and SSS give it the cell's timing and physical cell ID; PBCH carries the MIB, and SIB1 names the network and says how to ask for access.
- Cell search. Every cell repeatedly transmits an SSB (synchronization signal block): the primary and secondary synchronization signals (PSS, SSS) and the broadcast channel (PBCH) with the master information block (MIB). A phone searching from scratch assumes a burst every 20 ms.
- Networks are identified by a PLMN ID: mobile country code plus mobile network code
(
310-260is one US network). When you roam, the visited network serves you but your home network's UDM still checks your SIM. - Timing advance. A phone 3 km away hears the tower about 10 µs late and its reply arrives another 10 µs late; the random-access reply tells it how much earlier to transmit so everyone's signals arrive in their slots. (GSM's timing advance capped its normal cells at ≈ 35 km.)
- Authentication (5G-AKA). The SIM and the UDM share a secret key,
K, that never leaves either. The network sends a random challenge (RAND) with a token (AUTN) that proves the network knowsKtoo; the SIM checksAUTNand answers withRES*. Authentication is mutual, unlike 2G, where a fake base station could pose as the network. 5G also encrypts the permanent identity (SUPI, the old IMSI) as a SUCI, which defeats the passive "IMSI catchers" that read IDs off the air in earlier generations. - Radio states. After a few seconds without traffic the gNB moves the phone from
RRC_CONNECTEDtoRRC_INACTIVE(5G) orRRC_IDLEto save battery; the first packet after that pays a short reconnection delay. - 4G is slightly different: LTE's attach always creates a default bearer with an IP address, so an LTE phone is online as soon as it is registered; 5G makes the data session a separate step, usually done immediately.
Moving between cells
An idle phone reselects cells on its own. A connected phone is handed over by the network, based on the phone's measurement reports: the received power of each cell's reference signals (RSRP) and their quality (RSRQ, SINR). A typical trigger is "a neighbor has been better than the serving cell by an offset for a set time", which prevents ping-pong at the border.
- The phone reports that cell A is now stronger than its serving cell B.
- B asks A, over the direct Xn link between base stations, to take the phone; A reserves resources.
- B tells the phone to switch; while it does, B forwards any data still arriving for it to A.
- The phone does a quick random access on A and is connected.
- A asks the core to switch the path: the UPF now sends the phone's downlink packets through A.
- LTE and 5G handovers are hard (break before make), with an interruption of tens of milliseconds that apps rarely notice. 3G's CDMA used soft handover, connected to several cells at once. Release 16 added conditional handover (the phone gets the command early and executes it when the target becomes good enough) and make-before-break handover.
- Handovers also happen between technologies, for example from 5G to 4G at the edge of 5G coverage.
- Moving from mobile data to Wi-Fi is not a handover: the phone gets a new IP address and TCP connections break, though QUIC can migrate (see Wireless and mobile).
5G features
- New Radio air interface. Subcarrier spacing scales from 15 to 120 kHz (or more), so slots shrink from 1 ms to 0.125 ms; carriers up to 100 MHz wide in FR1 and 400 MHz in FR2; data can start in mini-slots of a few symbols for low latency.
- Massive MIMO and beamforming. Mid-band 5G sites use antenna panels with 32 or 64 radio chains (written 32T32R, 64T64R) driving about a hundred or more antenna elements. By adjusting each element's phase, the panel forms a narrow beam toward each phone, which raises signal strength, and because beams point different ways it can serve several phones on the same frequencies at once (MU-MIMO). To find phones, the cell sweeps its SSB across several beams in turn: up to 8 in 3–6 GHz bands, up to 64 at mmWave.
| NSA (non-standalone) | SA (standalone) | |
|---|---|---|
| Core | 4G EPC | 5G Core |
| Signaling | over an LTE "anchor" carrier; NR adds capacity | over NR |
| What you get | faster downloads | lower latency, network slicing, voice over NR, better battery life |
| Where | most first-wave launches from 2019 | a growing share of networks; the basis for slicing and 5G-Advanced |
- Network slicing: one physical network carved into logical end-to-end networks, each with its own QoS, isolation and sometimes its own core functions, identified by an S-NSSAI. Uses include a private slice for a factory, a guaranteed uplink for live TV crews, or fixed wireless home internet. Commercial slicing needs SA and is still emerging.
- The three usage scenarios from the ITU's IMT-2020 targets: eMBB (enhanced mobile broadband, peak target 20 Gbit/s downlink), URLLC (ultra-reliable low-latency communication, 1 ms user-plane latency target) and mMTC (massive machine-type communication, 1 million devices per km²). These are design targets, not what a phone sees.
- Cellular IoT: LTE-M and NB-IoT are narrow, low-power modes for meters and trackers; RedCap (reduced capability, Release 17) is a cheaper 5G for wearables and sensors. Unlicensed options such as LoRa are in Mesh & IoT networks.
- Fixed wireless access: 5G home routers have become one of 5G's biggest uses.
- Edge computing: putting a UPF and servers near the base stations shortens the path for latency-sensitive apps.
SIM, eSIM and iSIM
A SIM is a tiny smart card (a UICC) running the operator's SIM application. It stores your
subscriber identity (IMSI/SUPI), the secret key K and the operator's public key for SUCI, and it runs
the authentication math itself, so K never leaves the card.
| Form | What it is | Where |
|---|---|---|
| mini-SIM (2FF) | 25 × 15 mm card | old phones |
| micro-SIM (3FF) | 15 × 12 mm | early-2010s phones |
| nano-SIM (4FF) | 12.3 × 8.8 mm | most phones with a SIM tray |
| embedded (MFF2) | a soldered chip | IoT devices, cars |
| eSIM | a soldered eUICC chip that downloads operator profiles over the internet | most recent phones, watches, laptops |
| iSIM | the SIM function inside the device's main chip, in a secure area | IoT and wearables, early adoption |
- eSIM profiles are installed by scanning a QR code or through the operator's app, using the GSMA's remote SIM provisioning standards; a device stores several and can run one or two at once. US iPhones have been eSIM-only since the iPhone 14 (2022).
- SIM swap fraud: an attacker talks an operator into moving your number to their SIM and then receives your SMS login codes. Use an authenticator app or a hardware key for important accounts and set a port-out PIN with your operator.
Voice and SMS today
- 2G and 3G carried calls over circuit-switched connections: a dedicated channel for the whole call. LTE and 5G are all-IP, so a call is VoIP.
- VoLTE (voice over LTE, from 2012) is a SIP call handled by the operator's IMS (IP Multimedia Subsystem), with a dedicated bearer that guarantees its QoS, and wideband codecs (AMR-WB, "HD voice", and EVS). Before VoLTE, LTE phones dropped back to 3G or 2G for calls (circuit-switched fallback); on networks that have retired 3G, a phone without VoLTE can't make ordinary calls.
- 5G SA carries calls as VoNR (voice over NR) through the same IMS, or moves the phone to LTE for the call (EPS fallback).
- Wi-Fi calling (VoWiFi) makes the same IMS calls over any internet connection; the phone reaches the operator through an IPsec tunnel to a gateway called the ePDG.
- SMS started as 160-character messages squeezed into 2G signaling. Today it travels over IMS or core signaling. RCS (Rich Communication Services) is its IP replacement with typing indicators, read receipts and media; Android's messaging app supports it, and iPhones since iOS 18 (2024).
How cell sites are built
| Type | Covers | Where | Notes |
|---|---|---|---|
| macro site | ≈ 1 km in cities to tens of km in the country | towers, rooftops, masts | 3 sectors, several bands, the backbone of coverage |
| small cell | tens to a few hundred meters | lampposts, walls, ceilings | capacity hot spots; mmWave depends on them |
| DAS (distributed antenna system) | a building, stadium or tunnel | inside venues | one set of base stations feeds many antennas, often shared by several operators |
| femtocell | a home or small office | indoors | plugs into a broadband line |
A macro site, from the top down:
- Antennas: panels per sector and band, tilted down (mechanically or electrically) to shape the cell. 5G mid-band uses an AAU (active antenna unit) that combines the massive MIMO array and the radios.
- Radio units (RU, also called RRU or RRH) mounted next to the antennas, so the lossy coaxial cables stay short.
- Fronthaul: fiber from the radio units to the baseband, carrying digitized radio samples (CPRI or eCPRI); very high bandwidth and tight latency limits.
- Baseband: in 5G split into a DU (distributed unit, real-time scheduling) and a CU (central unit, higher protocol layers), at the site or in a hub.
- Backhaul to the core over fiber, or microwave radio links (including 70–80 GHz E-band) where fiber doesn't reach; plus power, batteries or a generator, cooling and GPS for timing.
C-RAN (centralized RAN) pools the baseband of many sites in one hub, linked by fiber fronthaul. vRAN runs the baseband as software on ordinary servers. Open RAN (the O-RAN Alliance specifications) standardizes the interfaces between RU, DU and CU, including the 7.2x fronthaul split, so operators can mix vendors and run optimization apps on a RAN Intelligent Controller (RIC). Many towers belong to tower companies that rent space to several operators.
Private 5G and satellite direct-to-cell
Private LTE and 5G networks are run by a company for its own site: a factory, port, mine, airport or campus, with its own small core (on a server or in the cloud) and SIM-based security. They suit large outdoor areas, moving machines and scheduled, predictable radio access; Wi-Fi stays cheaper and simpler indoors. Spectrum comes from shared or local licenses, for example CBRS in the US (3.55–3.7 GHz, shared in three tiers managed by spectrum access systems), local 3.7–3.8 GHz licenses in Germany and shared-access licenses in the UK, or as a slice of an operator's network.
Phones and satellites. 3GPP added non-terrestrial networks (NTN) in Release 17, letting standard modems talk to satellites. Two approaches are in service or being built:
- Direct to cell with ordinary phones: low-orbit satellites act as cell towers in space using an operator's own spectrum. Starlink's service with T-Mobile in the US started with texting in 2025; AST SpaceMobile is building a broadband constellation with AT&T, Verizon and Vodafone. Capacity per beam is small and you need open sky.
- Satellite bands with chip support: Apple's emergency and messaging service over Globalstar (iPhone 14 and later), and NTN-capable modems in some Android phones and IoT devices.
Orbits, latency and satellite internet are covered in Satellite networks.
Try it
| Metric | What it measures | Good | Edge of coverage |
|---|---|---|---|
| RSRP | received power of the cell's reference signals | above −90 dBm | below −110 dBm |
| RSRQ | signal quality, including load and interference | above −10 dB | below −15 dB |
| SINR | signal to interference plus noise | above 13 dB | below 0 dB |
These are rough rules of thumb; operators and phones differ.
- iPhone: dial
*3001#12345#*and press call for Field Test Mode, which shows the serving cell and its RSRP. - Android: Settings → About phone → SIM status shows signal strength in dBm; on many phones dialing
*#*#4636#*#*opens a testing menu with the network type and cell details. - Linux with a USB or M.2 modem (ModemManager):
# List modems, then operator, access technology, signal
mmcli -L
mmcli -m 0
# Detailed radio metrics (RSRP, RSRQ, SINR), every 10 s
mmcli -m 0 --signal-setup=10
mmcli -m 0 --signal-get
# Serving cell: country and network codes, area, cell ID
mmcli -m 0 --location-enable-3gpp
mmcli -m 0 --location-getWalk around with any of these open: RSRP drops by tens of dB as you go indoors or behind buildings, and the cell ID changes when you are handed over.
References
- 3GPP: 5G System overview (opens in a new tab): the 5G architecture and core functions from the standards body
- 3GPP Release 20 (opens in a new tab): 5G-Advanced and the 6G studies
- 3GPP Release 21 (opens in a new tab): the first normative 6G release and its timetable
- 3GPP: NTN overview (opens in a new tab): non-terrestrial networks, phones and satellites
- 3GPP: VoLTE (opens in a new tab): voice over LTE and the IMS
- ITU-R IMT-2030 (opens in a new tab): the ITU's framework for 6G
- O-RAN Alliance (opens in a new tab): open RAN interfaces and the RAN Intelligent Controller
- 5G NR (Wikipedia) (opens in a new tab): bands, numerology and frame structure
- Cellular network (Wikipedia) (opens in a new tab): cells, reuse and history
- Frequency reuse (Wikipedia) (opens in a new tab): reuse patterns and cluster sizes
- IP Multimedia Subsystem (Wikipedia) (opens in a new tab): how VoLTE, VoNR and Wi-Fi calling work
- eSIM (Wikipedia) (opens in a new tab): eUICC, remote provisioning and adoption
- Citizens Broadband Radio Service (Wikipedia) (opens in a new tab): the US shared band used for private LTE and 5G
- mmcli manual (opens in a new tab): ModemManager's command-line tool