Network Test Solutions

Introduction to
CDMA2000
1x/1x-EV-DO

©RADCOM Ltd., August 2003

IP Notices:
© 2003 RADCOM Ltd. All rights reserved.
RADCOM is a trademark of RADCOM Ltd. in Israel and/or other countries. Microsoft ® Windows ®
and Microsoft® Windows NT ® are registered trademarks or of Microsoft Corporation in the US and/
or other countries. All other brand and product names referred to herein are either registered or
unregistered trademarks or service marks belonging to their respective owners.

This documentation contains proprietary information of RADCOM Ltd. and RADCOM Equipment
Inc. Such information is hereby supplied solely for the purpose of informing explicitly and properly
authorized persons of the documentation on the operation of RADCOM equipment. Without the
express prior written permission of RADCOM Ltd. and RADCOM Equipment Inc., no part of the
contents hereof may be used for any other purpose, disclosed to persons or firms outside the recipient
company, or reproduced by any means.

The text and drawings herein are for the purpose of illustration and reference only. The specifications
on which they are based are subject to change without notice.

Publication Date: August, 2003

Further Information
For further information contact:

US Office:

RADCOM Equipment Inc.

6 Forest Avenue, Paramus, NJ 07652, USA
Tel: (201) 518-0033 or 1-800-RADCOM-4, Fax: (201) 556-9030
E-mail: info@radcomusa.com; Internet: http://www.radcom.com

Israel Office:

RADCOM Ltd.
24 Raoul Wallenberg St., Tel Aviv, 69719, Israel
Tel: 972-3-6455055, Fax: 972-3-6474681
E-mail: info@radcom.com

China Office:

RADCOM Ltd.
Handerson Center, Office 506, Tower 3,
18 Jianguomennei Avenue, Beijing 1000005, P.R. China
Tel: +86-10-65187723, Fax: +86-10-65187721
E-mail: china@radcom.com

United Kingdom Office:

RADCOM UK
2440 The Quadrant
Aztec West, Almondsbury
Bristol, BS32 4AQ England
Tel: +44-145-487-8827, Fax: +44-145-487-8788
E-mail: uk@radcom.com
 T able of Contents

Introduction

CDMA2000 Network Structure

CDMA2000 1x and 1x-EV-DO Network Structure 2

CDMA2000 1x/1x-EV-DO Overview

Technology Evaluation Path 3
CDMA2000 Features 3
General Information 4
Data Rates 7
Changes Needed in CDMA2000 Compared to CDMA (IS-95) 7
New Entities in CDMA2000-1x Compared to CDMA (IS-95) 8
PDSN 8
AAA 8
PCF (Packet Control Function) 8
Other CDMA2000 entities (not new) compared to CDMA 9
New Entities and Features for CDMA 1x-EV-DO 9
Reference Points A, Ater, Aquinter, and Aquater 11
Interfaces Description – CDMA2000 –1x 11
Interfaces Description – CDMA2000–1x–EV-DO 12
Physical Layer Interfaces 13
MSC-BS Functional Planes 13
HRPD (High Rate packet Data) IOS Architecture Model 15
3G Packet Data Calls 15
Authentication 17
Mobility Management 17
CDMA2000 Call/Calls Flow 20
Call scenarios CDMA2000 – 1x (voice) 20
Call scenarios CDMA2000 – 1x (data) - a 21
Call scenarios CDMA2000 – 1x (data) - (b) 22
Call scenarios CDMA2000 – 1x (data) - (c) 23
AT Originates 1xEV-DO Session -Successful Authentication 24
AT Originates 1x-EV-DO Session – Unsuccessful Authentication 28
AN-AN Dormant Handoff with Successful Session info’ Retrieval 31
Data Delivery – AT Terminated 34

RADCOM’s CDMA2000 Solutions

Highlights 37
CDMA2000 Network 38
RADCOM’s CDMA2000 1x Network Coverage 38
RADCOM’s CDMA2000 1x-EV-DO Network Coverage 38
CDMA2000 Protocols Support 38
RADCOM’s PrismLite 2

CDMA2000 Protocol Analysis Applications 39

Physical Layer 39
Capture 39
Analysis 40
Traffic Generation 40
CDMA2000 Consultants 41
CDMA2000 A10/A11 Consultant highlights 41
CDMA2000 A10/A11 Consultant Screens 42
CDMA2000 A12 Consultant Highlights 44
CDMA2000 Internet Consultant 45
CDMA2000 Internet Consultant Screens 46
CDMA2000 Network Consultant 48
Cellular Expert 48
Performer Infrastructure 50
RADCOM’s GEAR 50
The GenFEP (Generic FEP) 51
Dedicated ATM features 51
Dedicated Ethernet & POS features 51
Dedicated multi E1/T1/J1 features 52
Time Stamp Synchronization 52
Summary 52

Table of Contents
I ntroduction

CDMA2000, also known as IMT-CDMA Multi-Carrier or IS-2000, is the main

route for CDMA operators to second-and-a-half (2.5G) and third generation
(3G) cellular networks. 3GPP2, the standard-setting body behind CDMA2000,
has created a set of standards that define the new air interface and Radio
Access and Core Network changes that will enhance network capacity,
improve speed and bandwidth to mobile terminals, and eventually allow end-
to-end IP services.
CDMA2000 is a technology for the evolution of cdmaOne/IS-95 to 3rd
generation services. CDMA2000 will provide enhanced services to CDMAOne
subscribers, as well as forward and backward capabilities in terminals.
CDMA2000 can be deployed in several phases. The first phase, CDMA2000 1x,
supports an average of 144 kbps packet data in a mobile environment. The
second release of 1x, called 1x-EV-DO will support data rates up to two Mbits/
sec on a dedicated data carrier. Finally, 1x-EV-DV (which probably will be
rarely deployed) will support even higher peak rates, simultaneous voice and
high-speed data, as well as improved Quality of Service mechanisms.
A key component of CDMA2000 systems will be a new Packet Core Network
(PCN) that allows the delivery of packet data services with more speed and
security. The CDMA2000 PCN is one of the first steps in the evolution of
CDMA2000 systems to All-IP and multi-media architecture.
The purpose of this document is to provide a basic understanding of the
complex CDMA2000 1x and CDMA2000 1x-EV-DO technologies. As well as
presenting RADCOM’s capabilities for supporting and testing CDMA2000 1x
and 1x-EV-DO networks.
 CDMA2000 Network Structure

CDMA2000 1x and 1x-EV-DO Network Structure

 CDMA2000 1x/1x-EV-DO Overview

Technology Evaluation Path

Operators are adopting different migration path by regions and countries for
3G deployment, considering an All-IP network as the final migration path.
The diagram below illustrates the migration path from 2G to 2.5G though 3G
of all cellular networks

CDMA2000 Features

CDMA2000 provides the following features:

• High data rates.
• Bandwidth on demand.
• Asymmetric data rates.
• Always connected (using the PCF that on the BSC).
Introduction to CDMA2000 4

General Information

1. CDMA2000 1x uses the same 1.25 Mhz of CDMA IS-95. A lot of service
providers may implement the CDMA2000 1x-EV-DO on a different
1.25Mhz, because the high data rate may damage the quality of the voice.
2. Because CDMA2000 is backward compatible to IS-95 and uses the same
1.25 Mhz in the 1x, operators can migrate from CDMA to CDMA2000 in
stages. Operators can decide to implement CDMA2000 initially only in
certain cities and then later deploy in other cities.
3. CDMA2000: Increases the spectral efficiency of the air interface by:
a. Improved (faster) power control compared to CDMA in the forward link.
It extends the capacity of the air by 50%. In CDMA (IS-95), the MS
informs the BTS if frames received are Good/Error. In CDMA2000, the
MS sends power control commands 16 times faster than IS-95 in order to
power down/up the forward link. The mechanism to power up and power
down, results in power saving and in increased capacity. As a result of
the power control, CDMA2000 delivers 50% more capacity than the
IS-95.
b. Transmit diversity: each antenna can transmit/receive to up to 6
different directions. The MS chooses the strongest frequency.
c. Smart antennas: these are antennas that are capable of directing the
antenna frequency’s radiation to the required direction. For example, to
direct the antennas to a crowd center in order to support better cover
and better power centralization.
d. QPSK modulation scheme: this is the modulation method in which the
CDMA technology changes the radio wave into bits. The QPSK method
actually changes the sinus of the electromagnetic wave into bits.
e. Improved digital coding techniques.
f. The 1x/1x-EV-DO/1x-EV-DV can utilize different vocoders and more
Walsh codes (up to 128) comparing to the 64 of CDMA, allowing for
higher data rates and more voice conversions compared to CDMA. The
3x enables 256 Walsh codes. The Walsh code is the mathematical
algorithm that differentiate between calls in the CDMA network. Each
signal is encoded with a Walsh code to differentiate between different
users. In CDMA2000 in each sector there can be 3*128 Walsh codes per
carrier. In CDMAOne there can be up to 64 Walsh codes
g. In CDMA2000 a new air channel, the SCH (supplemental channel) is
introduced. Up to 2 SCH for each MS (307.2kbps*2).
4. In a CDMA2000 session there can be few connections (a radio
connection is required only when needed to transfer data to or from the

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 5

network). When users only want to browse, they may have a session open
(the connected-application session is always active).
5. For the duration of the connection, CDMA2000 gives the user a dedicated
law data rate channel (FCH), Fundamental channel - 9.6 or 14.4 – the
same as for voice), and according to the user profile and traffic needs, the
user may be given 0,1 or 2 SCH channels. The SCH (Supplemental
channel) can vary both in the duration of the assignment and in the data
rate – from 9.6 up to 307.2 kbps for each channel. On the SCH, only data
(not voice or signaling) is transferred. Signaling is transferred on the law
data rate dedicated channel.
6. The BSC is responsible for negotiating (the duration and the data rate of
SCH) and signaling with the MS. The BSC is also responsible for the
efficiency allocation and de allocation of the SCH to the different users. In
addition, the BSC is responsible for detecting the rate and duration that
needs to be sent to the MS. The MS needs to request the SCH needed to
transfer data in the reverse link. In all cases the BSC is responsible for the
resources allocation.
7. In general, the SCH is large on the forward link (download) and small on
the reverse link.
8. The SCH duration is from 20 milliseconds up to 5.12 seconds for a single
data burst. The standards allow allocating and de allocating of infinite
duration of SCH.
9. Responsibilities of the BTS:
a. Assigning the Fundamental channel (FCHs) - the number of physical
resources available.
b. The FCH forward power (the power already allocated and available).
c. The Walsh codes required and those available.
d. SDU function: The SDU function (Selection/Distribution Unit function)
includes the following functions:
• Traffic Handler: This function exchanges traffic bits with the
associated vocoder or CDMA RLP function, and is directly connected to
the A5 interface.
• Signaling Layer 2: This function performs the layer 2 functionality of
the air interface signaling protocol and is responsible for the reliable
delivery of layer 3 signaling messages between the base station and the
mobile station.
• Multiplex Sublayer: This function multiplexes and demultiplexes user
traffic and signaling traffic for the air interface.
• Power Control: This function administrates the forward and reverse
link power control in a CDMA system. This function and the channel

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 6

element provide the power control function for the CDMA operation. As
part of this function, it generates or utilizes relevant power control
information that is exchanged over the air interface or with the channel
element.
• Frame Selection/Distribution: This function is responsible for
selecting the “best” incoming air interface reverse link frame from the
channel elements involved in the soft handoff. It also distributes forward
air interface frames to all channel elements involved in a call.
• Backhaul Frame Handler: This function demultiplexes the control
information and the air interface reverse frame from the frame received
over the backhaul network. It also multiplexes the control information
and the air interface frames in the forward direction.
• Control: This function provides control functions.
10. In CDMA2000, there is no need to replace the CDMA MS in order to
function in the network; but in order to receive the services of the
CDMA2000 the MS should be replaced.
11. CDMA2000 support (GSM-MAP), which can lead to harmonization and
dual system deployment with GSM in addition to WCDMA as well.
12. WCDMA and CDMA2000 have the same characteristics (roaming support,
same data rates, wide band, etc). The main difference between the
WCDMA and CDMA2000 is that the WCDMA uses only one wide band,
while CDMA2000, apart from the wide band uses several narrow bands
(low data rate channels).
13. The backhaul from the BTSs to the BSC and from the BSC to the MSC
could be via either microwave links or fixed facilities.
14. In CDMA2000 the billing is according to the data that is transferred.
15. There is 1.25 Mhz for the forward link and 1.25 for the reverse link.
16. When Asynchronous Transfer Mode (ATM) is used to provide signaling
transport, the ATM Adaptation Layer 5 (AAL5) protocol is employed.
When ATM is used to provide user traffic (voice/data) transport, the AAL2
protocol is used. Each BS has two or more ATM virtual circuits that
connect it to other BSs (regardless of whether switched or permanent
virtual circuits are used). These virtual circuits are comprised of one or
more virtual circuits using the AAL5 protocol for signaling, and one or
more virtual circuits using AAL2 for the user traffic connections. Use of
the AAL5 Permanent Virtual Circuit (PVC)/Switched Virtual Connection
(SVC) as the link layer of IP protocol stack shall follow.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 7

Data Rates

Max data Actual data

Technology Spectrum Services
rate rate

IS-95 A/B 115.2 Kbps 10-40 Kbps 1.25 Mhz Voice and circuit
switched data
services
1xRTT 614.4 Kbps 80-100 Kbps 1.25 Mhz Voice, circuit
data and packet
data
1x-EV-DO 2.48 Mbps 600K-1Mbps 1.25 Mhz Packet data
services
3xRTT 2 Mbps 3.75 Mhz Voice, circuit
and packet
services

The EV-DO and W-CDMA (UMTS) support: 2 Mbps for fixed environment, 384
for pedestrian and 144 kbps for vehicular.

Changes Needed in CDMA2000 Compared to CDMA (IS-95)

1. The MSC-VLR and HLR (All the circuit switched Core networks) need to
software upgrades in order to support the authentication and
authorization of the packet data network. Note, that it is still the CS-CN
(Circuit Switched Core Network), which authenticates and authorizes the
wireless access of the user during packet session initiation.
The MSC-VLR/HLR are updated with the Packet data user profile
information. The information is then downloaded from the HLR to the
VLR of the associated network switch during the successful registration
process.
2. HW upgrade in the BTS – A new digital processing HW “CDMA200
Chipset” which is a Multimode Channel Element card + SW upgrade.
3. New MS with new digital processing (“CDMA2000 Chipset”) that supports
radio channels to carry voice, Circuit switched data along with the packet
data services that requires low and high data rates.
4. SW update in the BSC in order to support IP routing.
5. Apart from routing the Time division multiplexing (TDM) traffic to the
circuit switched platform, the BSC routes the packet to and from the
PDSN.
6. A new Core network for CDMA2000 – PS-CN.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 8

New Entities in CDMA2000-1x Compared to CDMA (IS-95)

PDSN
1. Establishes, maintains and terminates Point-to-Point protocol (PPP)
session with the MS.
2. Establishes, maintains and terminates the logical link to the Radio
network across the radio-packet (R-P) interface.
3. Initiates Authentication, Authorization and Accounting (AAA) for the MS
to the packet data network (Internet) via the AAA Server.
4. Receives service parameters for the MS from the AAA.
5. Routes packet data between the RAN and the Internet (like NAS in the
Internet).
6. Collects usage data that is related to the AAA Server.
7. Supports both Simple and Mobile IP.
8. For Mobile IP the FA (foreign agent) should be implemented on the PDSN
(also a HA (home agent) is needed).
9. One BSC can interconnect to a few PDSNs for load balancing.

AAA
The AAA server, also called the RADIUS server, authenticates only the user
Internet access and not a user wireless access (same entity used in the
Internet). RADIUS – Remote Access Dial-In User Service, communicates with
the PDSN via IP. Authentication associated with PPP and Mobile IP
connection.

PCF (Packet Control Function)

An entity in the radio access network that manages the relay of packets
between the BS and the PDSN.
The PCF is generally part of the BSC. In order to provide the feel of “always
connected”, if there are packets from the Internet to a certain MS that
currently doesn’t have radio resources allocated, the packet is held on the
PCF until the user is allocated a channel. The PDSN does not hold the
packets but the PCF. The PCF may be HW and/or SW.
10. The CDMA2000 may introduce firewalls to protect the network and
application servers to support packet services.
11. The PDSNs, AAA and the connection to the RAN (BSCs) are via a private
IP network for security and for providing different QoS levels.
12. Mobile IP (not an entity)- supports moving between two different PDSNs
without needing to reconnect. It is the PDSN’s responsibility to either
update the IP of the user when they move to another PDSN area (it is

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 9

implying the packet sessions need to turn down and restart), or to

implement the Mobile IP mechanism for a transparent move. In the Mobile
IP mechanism the FA and HA are required. Simple IP (not an entity) –
does not support mobility between different PDSNs. The PDSN is the
owner of the User IP (DHCP). If in the middle of a page loading the MS
moves between two different PDSNs, the MS will have to reconnect.
13. Normal Vendor/Organization Specific Extension (NVSE) - (not an entity):
This element may be present in the A11-Registration Request or A11-
Registration Reply messages to convey information between the PCF and
the PDSN. Any new Application types or Application Sub-Types supported
after IOS v4.0 will be added to this element.
This element uses the A11-Registration Request message to convey the
Previous and Current Access Network Identifiers (PANID, CANID) and
fast handoff information to the PDSN. If the PCF initiates the setup of the
A10 connection due to dormant handoff, the PCF includes a Mobility Event
Indicator and the Current and Previous Network Identifiers (CANID and
PANID) in the A11-Registration Request message. In the case of Dormant
Handoff, the PCF initiates the setup of an A10 connection and include a
Mobility Event Indicator as a CVSE and the PANID and CANID as an
NVSE in the A11- Registration message.

Other CDMA2000 entities (not new) compared to CDMA

14. HA - One of the tasks of the HA is to track the location of the Mobile IP
subscriber as it moves from one packet zone to another. In tracking the
Mobile, the HA ensures that the packets are forwarded to the mobile itself.
An HA is a router on the Mobile node’s home network. It uses a tunneling
mechanism to forward Internet traffic so that the device’s IP address does
not have to be changed each time it connects from a different location. The
HA works in conjunction with the FA, which is the router on the visited
network. The HA identifies the IPv4 address of the PDSN that terminates
the A10 connection.
15. FA – works in conjunction with the HA in order to perform internet traffic
forwarding to a device connecting to the Internet from any location other
than it’s home network.
The HA tunnels datagram packets intended for the mobile node to either
the IP address for the FA, or to an IP address acquired through DHCP.
The FA de-tunnels the packets and delivers them to the mobile node. In
general, Mobile IPv6 (MIPv6) minimizes the use of FA.

New Entities and Features for CDMA 1x-EV-DO

Access Network - The network equipment providing data connectivity

between a packet switched data network (typically the Internet) and the

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 10

access terminals. An access network is equivalent to a base station in

CDMA2000 systems.
Access Terminal - A device providing data connectivity to a user. An access
terminal may be connected to a computing device such as a laptop or it may be
a self-contained data device such as a personal digital assistant. An access
terminal is equivalent to a mobile station in CDMA2000 systems.
AN AAA - An entity that performs terminal authentication and authorization
functions for the Access Network.
Connection - A connection is a particular state of the air-link in which the
access terminal is assigned a Forward Traffic Channel, a Reverse Traffic
Channel and associated Medium Access Control (MAC) Channels. During a
single HRPD session the access terminal and the access network can open and
can close a connection multiple times.
Hybrid MS/AT - A device capable of operating on both CDMA2000 and HRPD
access networks.
Service Stream - The HRPD stream used when exchanging data between the
access terminal and the PDSN.
HRPD session - An HRPD (High Rate Packet Data (1xEV-DO)) session refers
to a shared state between the access terminal and the Access network. This
shared state stores the protocols and protocol configurations that were
negotiated and are used for communications between the access terminal and
the access network. Other than to open a session, an access terminal cannot
communicate with an access network without having an open session. Note,
that it is possible that the A10/A11 connection is not established even though
the HRPD session is established.
PCF - The PCF enhancement for EV-DO logically contains the SC/MM
function and is capable of HRPD specific operation. The original PCF function
and procedure may also be optimized or enhanced using information obtained
from these additional functions.
Packet Data Session - An instance of the use of packet data service by a
mobile user. A packet data session begins when the user invokes a packet data
service. A packet data session ends when the user or the network terminates
the packet data service. During a particular packet data session, the user may
change locations but the same IP address is maintained.
SC/MM function: SC/MM (Session Control and Mobility Management) is
logically located in the PCF and includes the following functions:
• Storage of HRPD session related information: This function keeps HRPD
session related information (e.g., Keep Alive timer, MNID, mapping between
MNID and UATI, etc.) for dormant ATs.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 11

• Assignment of UATI (Unicast AT identifier): This function assigns a new

UATI to an AT.
• Terminal Authentication: This function performs the terminal
authentication procedure. This function judges whether an AT (access
terminal) should be authenticated or not when the AT is accessing the
HRPD RAN. The SC/MM performs PPP procedures for terminal
authentication.
• Mobility Management: This function manages the location of an AT. The
location information of the AT is obtained via distance-based registration.
This function may perform a paging procedure based on the information.
Terminal Authentication: A procedure in which the AT is authenticated by
the AN-AAA.

Reference Points A, Ater, Aquinter, and Aquater

The Network Reference Model contains the following reference points A, Ater,
Aquinter, and Aquater.
• The A reference point is implemented by A1, A2, A5.
• The Ater reference point is implemented by A3 and A7.
• The Aquinter reference point is implemented by A8 and A9.
• The Aquater reference point is implemented by A10 and A11.

Interfaces Description – CDMA2000 –1x

A1 The A1 interface carries signaling information between the Call Control

(CC) and Mobility Management (MM) functions of the MSC and the call
control component of the BS (BSC).
A2 The A2 interface carries 64/56 kbps PCM information or 64 kbps
Unrestricted Digital Information (UDI, for ISDN) between the Switch
component of the MSC and the Selection/Distribution Unit (SDU) function of
the BS.
A3 The A3 interface carries coded user information (voice/data) and signaling
information between the source BS SDU function and the channel element
component (BTS) of the target BS. This is a logical description of the endpoints
of the A3 interface. The A3 interface is composed of two parts: signaling and
user traffic. The signaling information is carried across a separate logical
channel from the user traffic channel, and controls the allocation and use of
channels for transporting user traffic.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 12

A5 The A5 interface carries a full duplex stream of bytes between the MSC
and the SDU function of the BSC.
A7 The A7 interface carries signaling information between a source BS and a
target BS.
A8 The A8 interface carries user traffic between the BS and the PCF.
A9 The A9 interface carries signaling information between the BS and the
PCF.
A10 The A10 interface carries user traffic between the PCF and the PDSN.
A11 The A11 interface carries signaling information between the PCF and the
PDSN.

Interfaces Description – CDMA2000–1x–EV-DO

A8 The A8 interface carries user traffic between the Access Network (AN) and
the Packet Control Function (PCF).
A9 The A9 interface carries signaling information between the AN and the
PCF.
A10 The A10 interface carries user traffic between the PCF and the PDSN.
A11 The A11 interface carries signaling information between the PCF and the
PDSN.
A12 The A12 interface carries signaling information related to terminal
authentication between the SC/MM function in the PCF and the AN AAA
(Authentication, Authorization and Accounting entity for 1x-EV-DO).
A13 The A13 interface carries signaling information between the SC/MM
function in the source PCF and the SC/MM function in the target PCF.
A14 The A14 interface carries signaling information between the SC/MM
function in the PCF and the AN.
A15 The A15 interface carries signaling information between ANs when inter-
AN paging is used.
Ax The Ax interface carries user traffic between the SC/MM function in the
PCF and the AN.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 13

Physical Layer Interfaces

The A1, A2, A3, A5 and A7 interfaces are based on the use of:
1. T1 digital transmission system interfaces. Each 1.544 Mbps interface
provides 24*56 Kbps or 24*64 kbps channels, which can be used for traffic
or signaling as the operator requires.
2. E1 digital transmission interfaces consisting of 30*64 kbps user channels
can also be used for traffic or signaling, as the operator requires, and as
applicable to the network. As a BS/MSC agreed option, dedicated DS0
signaling link[s] may be used instead of the T1/E1 interface.
3. T3 digital transmission interfaces supporting transmission rates of 43.232
Mbps.
4. OC3 digital transmission interfaces supporting transmission rates of
155.52 Mbps.
The A8 to A15 interfaces are based on the use of the Internet Protocol, which
can operate across various physical layer media.

MSC-BS Functional Planes

The functions provided by the network elements on either side of the MSC-BS
interface define the functions that the MSC-BS interface supports. The figure
below depicts a model of the MSC-BS Interface functional planes. The four
functional planes embody all of the functions that the MSC-BS Interface
supports.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 14

The transmission facilities management plane is the basis for the MSC-BS
interface telecommunications services. It manages the transmission means for
the communication needs of the subscribers as well as the required
information transfer between the BS and MSC. The radio resource
management plane manages stable links between the MSs and the MSC and
supports the movement of subscribers during calls (i.e., handoff control). The
mobility management plane manages subscriber location data. The call-
processing plane manages call control and telecommunications services for the
subscribers.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 15

HRPD (HIGH RATE PACKET DATA) IOS ARCHITECTURE MODEL

3G Packet Data Calls

Packet data calls allow users to exchange data between the MS and an IP data
network. For all calls supporting packet data services, a Packet Data Serving
Node (PDSN) exists that interfaces between the transmission of the data in
the fixed network and the transmission of the data over the air interface. The
PDSN interfaces to the BS through a Packet Control Function (PCF), which
may or may not be co-located with the BS.
There are three packet data service states:
Active/Connected, Dormant, and Null/Inactive.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 16

• In the Active/Connected State, a physical traffic channel exists between the

MS and the BS, and either side may send data.
• In the Dormant State, no physical traffic channel exists between the MS and
the BS, but the PPP link between the MS and the PDSN is maintained.
• In the Null/Inactive State, there is no traffic channel between the MS and
the BS and no PPP link between the MS and the PDSN.

Figure 3-1: Packet data service transitions

The mobile may cross Packet Zone boundaries while in the Dormant State.
This is referred to as Dormant Handoff. The Dormant handoff procedures
allow the A10 connections between the PCF and PDSN to be moved (or
established) for the mobile when it enters a new packet zone.
The mobile may re-enter Active state (e.g., if the user has data to send) at any
time. This transition is referred to as Re-Activation from Dormant, and is not
related to Dormant Handoff (i.e., Re-Activation from Dormant is not related to
a mobility event).
Packet data is typically transmitted over the air on dedicated traffic channels.
Mechanisms also exist for transmitting data over the common channels. Short
Data Burst (SDB) is a part of the 3G Packet Data feature that enables small
amounts of data to be transmitted over the common channels. Common
Channel Packet Data is a mode of 3G Packet Data where all data is
transmitted using Short Data Bursts. A1 and A8 connections are maintained
during the Active / Connected State and released during transition to
Dormant or Null/Inactive State. The A10 connection is maintained during the
Active/Connected and the Dormant State.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 17

Authentication

1. The first part is the MSC-VLR with the help of the HLR to authenticate
the user (handshaking, etc).
2. The MS and the RAN as part of coding of the information in the air encrypt
the data (voice and data).
3. Above those two steps, in order to authenticate the user to the Private IP
network and to the Internet, the PDSN with the help of the AAA server
authenticates and authorizes the user through password verification and
handshaking.
4. Above those 3 steps it is possible in the data core network (none wireless)
after the PDSN (AAA) authentication to implement IPSec. It is optional to
implement the IPSec on the PDSN.
5. Once connected to the application required, there may be also the
application’s own security mechanisms (such as banking, etc.).

Mobility Management

The responsibility for keeping the MS connected while moving on the network
(between different MSCs, etc.) is divided into two different cases: While in
active session, the RAN is responsible for the Handoff (in general for the Low
data rate channel we will always have SHO (Soft hand off), and as much as
the data increases in the SCH the SHO for SCH will decrease (the SHO for
SCH is limited).
While the mobile moves between BTSs but not in a session, and than between
BSCs and MSCs and PDSNs (while idle) it is the mobile’s responsibility to
update the network that it has moved by registering to a new MSC or PDSN.
It is important that the MS updates the system in the CS in order for the
system to be able to route the circuit voice calls to the mobile.
In idle mode the MS runs the mobility management procedure, and in active
the MS assists the RAN.
• The A8/A9 interfaces supports mobility between BSCs under the same PCF.
• The A10/A11 interfaces supports mobility between PCFs under the same
PDSN.
• Mobile IP supports mobility between PDSN/FA under the same Home
Agent.
• Hard handoff and soft handoff procedures realize the mobility between
BTSs.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 18

Packet Data Micro-Mobility and Macro-Mobility Concepts - CDMA2000 1x

The figure below provides a conceptual view of levels of packet data mobility.

Figure 3-2: Levels of packet data mobility

• The A8/A9 interfaces support mobility between BSCs under the same PCFs.
• The A10/A11 interfaces support mobility between PCFs under the same
PDSN.
• Mobile IP supports mobility between PDSN/FA under the same Home
Agent.
• Hard handoff and soft handoff procedures realize the mobility between
BTSs.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 19

HRPD Micro-Mobility and Macro-Mobility Concepts - CDMA2000 1x-EV-DO

The figure below provides a conceptual view of levels of HRPD packet data
mobility.

Figure 3-3: HRPD Packet data mobility

• The A8/A9/A14 interfaces support mobility between ANs under the same
PCF.
• The A10/A11/A13 interfaces support mobility between PCFs under the same
PDSN.
• Mobile IP supports mobility between PDSNs under the same Home Agent.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 20

CDMA2000 Call/Calls Flow

Call scenarios CDMA2000 – 1x (voice)

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 21

Call scenarios CDMA2000 – 1x (data) - a

The mobile station initiates the session by sending an origination message

that includes an indication that this is a packet data session. The RAN
informs the MSC, and the MSC performs an authentication procedure similar
to the circuit switched authentication process. Finally, the BSC and BTS
allocate radio resources and establish a low data rate dedicated channel. In
contrast to the radio channel used for voice calls, this low rate data channel
uses the Radio Link Protocol (RLP) to provide better error performance. The
next step is to allocate resources in the new packet switched core network
domain.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 22

Call scenarios CDMA2000 – 1x (data) - (b)

The next step in establishing the packet data session is to allocate resources
on the Radio – Packet (R-P) interface. Once resources have been established,
the mobile communicates with the PDSN over the allocated channels in order
to set up a Point-to-Point Protocol (PPP) connection. During this process, the
packet switched core network, specifically the PDSN, assigns an Internet
Protocol (IP) address to the mobile station.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 23

Call scenarios CDMA2000 – 1x (data) - (c)

Before completing the PPP connection, there is another level of

authentication. Authentication has already been performed from a wireless
access perspective, now it will be performed based on the Internet service. The
PDSN talks to the AAA server using the Remote Access Dial-In User Service
(RADIUS) protocol to authenticate the user. Authorization to access the
requested service is based on the subscriber profile stored in the AAA. If
authorization is successful, the mobile is granted access to the IP network. In
our example, the mobile is accessing a web server.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 24

AT Originates 1xEV-DO Session -Successful Authentication

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 25

A The AT sends a UATI-Request message to request that a Unicast

Access Terminal Identifier (UATI) be assigned to it by the AN.

B The AN sends a UATI-Assignment message to assign a UATI to the

AT.
C The AT sends a UATI-Complete message to notify the AN that it
has received the UATI-Assignment message.
D If no session exists between the AT and AN, a session is established
where protocols and protocol configurations are negotiated, stored
and used for communications between the AT and the AN.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 26

E The AT indicates that it is ready to exchange data on the access

stream (e.g., the flow control protocol for the default packet
application bound to the AN is in the open state).
F The AT and the AN initiate Point-to-Point Protocol (PPP) and Link
Control Protocol (LCP) negotiations for access authentication.
G The AN generates a random challenge and sends it to the AT in a
Challenge Handshake Authentication Protocol (CHAP) Challenge
packet.
H When the AN receives the CHAP response packet from the AT, it
sends a RADIUS Access-Request message packet on the A12
interface to the AN Authentication, Authorization and Accounting
(AAA) entity (which acts as a RADIUS server).
I The AN-AAA looks up a password based on the User-name attribute
in the A12 Access-Request and if the authentication passes, the AN
AAA sends an Access-Accept packet on the A12 interface. The A12
Access-Accept contains a RADIUS attribute with Type set to 20
(Callback-Id).
J The AN returns an indication of CHAP authentication success, to
the AT.
K The AT indicates that it is ready to exchange data on the packet
data stream. (e.g., the flow control protocol for the default packet
application bound to the packet data network is in the open state).
L The AN sends an A9-Setup-A8 message to the Packet Control
Function (PCF) and starts timer TA8-setup, to establish the A8-
Connection. The A9-Setup-A8 message is not sent before the AT
indicates that it is ready to exchange data on the access stream, as
identified in step 5.
M The PCF recognizes that no A10 connection associated with the AT
is available and selects a PDSN. The PCF sends an A11-
Registration Request message to the PDSN, which includes the
Mobility Event Indicator (MEI) within the Vendor/Organization
Specific Extension. The PCF starts timer Tregreq.
N The A11-Registration Request is validated and the PDSN accepts
the connection by returning an A11-Registration Reply with an
accept indication and Lifetime set to the configured Trp. Both the
PDSN and the PCF create a binding record for the A10 connection.
The PCF stops timer Tregreq.
O When the AN receives the A9-Connect-A8 message it stops timer
TA8-setup.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 27

P PPP connection establishment procedure and optional Mobile IP

Registration on the PPP connection are performed between the AT
and the PDSN.
Q At this point the connection is established and packet data can flow
between the AT and the PDSN.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 28

AT Originates 1x-EV-DO Session – Unsuccessful Authentication

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 29

A The AT sends a UATI-Request message to request that a UATI be

assigned to it by the AN.
B The AN sends a UATI-Assignment message to assign a UATI to the
AT.
C The AT sends a UATI-Complete message to notify the AN that it has
received the UATI-Assignment message.
D If no session exists between the AT and AN, a session is established
where protocols and protocol configurations are negotiated, stored and
used for communications between the AT and the AN.
E The AT indicates that it is ready to exchange data on the access
stream (e.g., the flow control protocol for the default packet
application bound to the AN is in the open state).
F The AT and the AN initiate PPP and LCP negotiations for access
authentication.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 30

G The AN generates a random challenge and sends it to the AT in a

CHAP Challenge Handshake Authentication Protocol (CHAP)
Challenge packet.
H When the AN receives the CHAP response packet from the AT, it
sends a RADIUS Access-Request message packet on the A12 interface
to the AN AAA (which acts as a RADIUS server).
I The AN-AAA looks up a password, based on the User-name attribute
in the A12 Access-Request and if the authentication fails, the AN AAA
sends an Access-Reject packet on the A12 interface.
Note: For ANs that perform access authentication, the network
requires that no use of a dedicated resource, such as access to a PDSN,
be allowed if authentication fails.
J The AN returns an indication of CHAP authentication failure, to the
AT.
K The AN sends a SessionClose message to the AT, to close the session.
L The AT responds with a SessionClose message.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 31

AN-AN Dormant Handoff with Successful Session info’ Retrieval

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 32

A The target AN receives a UATI-Request from the AT.

B The target AN sends an A13-Session Information Request message to
the source AN to request the session information for the AT. The A13-
Session Information Request message includes the received UATI, the
Security Layer Packet and Sector ID. The target AN starts timer
TA13req.
C The source AN validates the A13-Session Information Request and
sends the requested session information of the AT to the target AN in
an A13-Session Information Response message.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 33

D The AN sends a UATI-Assignment to the AT. The AT confirms the

receipt of the UATI with a UATI-Complete. The UATI-Assignment
may contain a new UATI or use the UATI received in the UATI-
Request message. This step can occur anytime after receipt of the
UATI-Request message.
E The Location Update procedures may be used to retrieve the PANID
information for sending to the PCF / PDSN.
F The target AN sends an A13-Session Information Confirm to the
source AN to indicate that the target AN has received the session
information. The target AN stops timer TA13req. Upon receipt of the
A13 Session Information Confirm message the source AN deletes the
AT session information in question.
G The target AN sends an A9-Setup-A8 message, with Data Ready
Indicator set to 0, to the target PCF and starts timer TA8-setup.
H The target PCF selects the PDSN to connect to using the PDSN
address provided in the A13-Session Information Response message or
using the PDSN selection algorithm, and sends an A11-Registration
Request message to the PDSN. The A11-Registration Request
message includes the Mobility Event Indicator (MEI) within the
Vendor/Organization Specific Extension. The target PCF starts timer
Tregreq. Inter-PCF Dormant Handoff - Mobile Continues to be served
by the Serving PDSN.
I The A11-Registration Request is validated and the PDSN accepts the
connection by returning an A11-Registration Reply with an accept
indication and the Lifetime set to the configured Trp value. If the
PDSN has data to send, it includes the Data Available Indicator
within the Vendor/Organization Specific Extension. The A10
connection binding information at the PDSN is updated to point to the
target PCF. The target PCF stops timer Tregreq.
J The PDSN initiates closure of the A10 connection with the source PCF
by sending an A11-Registration Update message. The PDSN starts
timer Tregupd.
K The source PCF responds with an A11-Registration Acknowledge
message. The PDSN stops timer Tregupd.
L The source PCF sends an A11-Registration Request message with
Lifetime set to zero, to the PDSN. The source AN/PCF starts timer
Tregreq.
M The PDSN sends an A11-Registration Reply message to the source
PCF. The source PCF closes the A10 connection for the AT and stops
timer Tregreq.
N The target PCF responds to the target AN with an A9-Release-A8-
complete message. The AN stops timer TA8-setup.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 34

Data Delivery – AT Terminated

A The PCF determines that packet data is available for delivery to the
AT.
B The PCF sends an A9-BS Service Request message to the AN in order
to request packet service, and starts timer Tbsreq9.
C The AN responds with an A9-BS Service Response. The PCF stops
timer Tbsreq9 upon receipt of the A9-BS Service Response message.
D The AN sends a Page Message to the AT, on the control channel.

CDMA2000 1x/1x-EV-DO Overview

Introduction to CDMA2000 35

E If the AT has data to send, the AT initiates connection establishment

procedures with the AN. The AN assigns a Forward Traffic Channel,
Reverse Power Control Channel and Reverse Traffic Channel.
F After the traffic channel is established, the AN sends an A9-Setup-A8
to the PCF and starts timer TA8-setup, to establish the A8-
Connection.
G When the AN receives the A9-Connect-A8 message it stops timer TA8-
setup.
H At this point, the connection is established and packet data can flow
between the AT and the PDSN.

CDMA2000 1x/1x-EV-DO Overview

R ADCOM’s CDMA2000 Solutions

CDMA2000 1x/1x-EV-DO are complex networks. Many service providers

around the world are now adopting CDMA2000 1x/1x-EV-DO networks as a
migration path from CDMA. A sophisticated testing tool is required to
troubleshoot and maintain such networks.
The combination of the Performer's hardware capabilities, complete IOS 3.x to
4.x protocol support for A1, A3, A7, A8, A9, A10, A11, A12, A13, A14 and A15
including mms services (H324M) and the set of Consultants provides an
attractive solution for CDMA2000 1x (2.5G) and CDMA2000 1x-EV-DO vendor
R&D, QA and integration labs, as well as for CDMA2000 operators during
network setup, integration and operation, thus providing a testing and
analysis tool for all aspects of these complex networks. RADCOM’s
CDMA2000 Consultants include the A10/A11 Consultant, which analyzes the
connection of the Packet Core Network to the Circuit CDMA2000 network for
data tunnel/session, launched by mobile users; the A12 Consultant, which
analyzes the signaling information between the SC/MM function in the PCF
and the AN AAA; the PI (Internet) Consultant, which analyzes the connection
of the PDSN to the Internet and the Network Consultant, which tracks the
session as it moves between the different interfaces of the PCN - A10/A11,
A12, PI (Internet).
Based on the field-proven Performer platform, the Cellular Performer
Analyzer integrates RADCOM's proprietary GEAR (generic analyzer
processor chip) which provides hardware-based full line rate analysis
capabilities at up to 2.5 Gbps. The Cellular Performer Analyzer can analyze
and troubleshoot CDMA2000 Network conditions at all seven
telecommunication layers, from basic physical and link layer tests to complex
tracing of NAS layer voice and IP session signaling and Data/voice QoS
validation. This makes it the ideal tool for debugging, troubleshooting,
maintaining and monitoring performance of CDMA2000 networks.
Targeted at the convergence of datacom and telecom, RADCOM's Cellular
Performer provides a complete solution to test the CDMA2000 interworking of
BTS, BSC/PCF, and PDSN. Additionally, RADCOM constantly updates its
protocol support to provide customers with up-to-date tools in the ever-
changing 3G Standard environment.
Introduction to CDMA2000 37

Highlights

• Protocol analysis for all major CDMA2000 interfaces including A1, A3, A7,
A8, A9, A10, A11, A12, A13, A14, and A15.
• A10/A11 online/offline sessions tracing
• A10/A11 online/offline sessions abnormal tracing
• A10 Connection Setup SDB (Short Data Burst information) Air link Record
• SDB (Short Data Burst information) Air link Record
• A10 Packet Accounting Procedures
• Supports Asynchronous PPP, Mobile IP and RADIUS.
• Monitors user-plane signaling and traffic such as PPP, ICMP, TCP, UDP,
HTTP, WAP, etc.
• GRE Traffic analysis
• Session flow, session analysis and error detection of the following Internet
protocols (PDSN to Internet connection): HTTP, FTP, POP-3, SMTP, Telnet,
TCP/IP, PPP, PAP, CCP, IPCP, CHAP, L2TP, LCP, WAP, WTP, WSP.
• Provides online and offline A12 network error tracing
• Automatically discovers, displays and monitors thousands of active and
closed PCF to AN AAA sessions.
• Analyzes signaling information related to terminal authentication between
the SC/MM function in the PCF and the AN AAA (Authentication,
Authorization and Accounting entity for 1x-EV-DO).
• Analyzes the AN-level authentication of the MS/AT device by authenticating
the results of a CHAP challenge/response operation invoked by the AN.
• Analyzes RADIUS protocol procedures as it flows between the AN and the
different RADIUS servers, e.g., RADIUS Home, RADIUS Visited and
RADIUS Broker.
• Analyzes the transition of MN ID, also used on the A8/A9 and A10/A11
interfaces. The MN ID identifier permits handoffs of PDSN packet data
sessions between ANs and between 1xEV-DO and IS-2000 systems.
• Automatically discovers, displays and monitors thousands of active and
closed CDMA2000 A10/A11, A12 and PI (Internet) sessions.
• Full PCN (Packet Core Network) call tracing from a single point including
A10/A11, A12 and Internet (PI) using the Network Consultant.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 38

CDMA2000 Network

RADCOM’s CDMA2000 1x Network Coverage

RADCOM’s CDMA2000 1x-EV-DO Network Coverage

CDMA2000 Protocols Support

RADCOM provides support for the following CDMA2000 protocols:
• A1: A1 Signaling, SCCP, MTP3, MTP2, MTP1
• A3: A3 Signaling, TCP, IP, AAL5, ATM
• A7: A7 Signaling, TCP, IP, AAL5, ATM
• A8: GRE, IP, PPP
• A9: A9 signaling, TCP, UDP, IP
• A10: GRE, IP, PPP
• A11: A11 signaling, UDP, IP , PPP, Mobile IP

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 39

• A12: RADIUS, UDP, IP, PPP

• A13: A13 Signaling, TCP/UDP, IP
• A14: A14 Signaling, TCP/UDP, IP
• A15: A15 Signaling, TCP/UDP, IP
Other Protocols: PPP in HDLC-like Framing, IPCP, Diameter, IKE

CDMA2000 Protocol Analysis Applications

The Performer analyzer provides a number of applications that can be used to

view various sections of a CDMA2000 network. These include the Physical
Layer application, the Capture application, the Analysis application and the
Traffic Generation.

Physical Layer
The Physical layer application offers a display of all significant counters per
technology. The user can define event thresholds and later view them in a log
screen in addition there is a status LED for each counter.

Capture
The Capture application provides full line rate capture (up to 2.5 Gbps). The
data is captured to a 256 Mbyte hardware buffer or to the Performer Server’s
hard disk. Both online and offline filters and analyses are available.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 40

Furthermore, the Capture application offers support of more then 550

protocols including full CDMA2000 1x/1x-EV-DO protocol analysis.

Analysis
The Analysis application provides full line rate analysis (up to 2.5 Gbps) in
addition to full line rate analysis’ filters. It also provides an extensive set of
analyses per technology as well as flexible alarms

Traffic Generation
The Traffic Generator uses RADCOM’s protocol decode database & engine to
build and simulate CDMA2000 1x/1x-EV-DO protocols. It simulates pre-
captured CDMA2000 1x/1x-EV-DO protocols.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 41

CDMA2000 Consultants

RADCOM manufactures the CDMA2000 1x/1x-EV-DO Consultant which can

be connected to a network such as that below.

CDMA2000 A10/A11 Consultant highlights

RADCOM’s A10/A11 Consultant offers the following highlights
• A10/A11 online/offline sessions tracing
• A10/A11 online/offline network error tracing
• A10/A11 online/offline sessions abnormal tracing
• A10/A11 procedures time and behavior (Attached/Detached, etc.)
• A10/A11 Sessions statistics
• Full Protocols analysis and conformance
• A10 Connection Setup Air link Record
• SDB (Short Data Burst information) Air link Record

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 42

• A10 Packet Accounting Procedures

• PPP Session analysis
• GRE Traffic analysis; Uplink/downlink
• Identifier analysis; IMSI, Host IP, PCF Session ID, Etc.
• Entities analysis; PCF, PDSN, HA, FA

CDMA2000 A10/A11 Consultant Screens

The CDMA2000 A10/A11 Consultant screens below demonstrate how the user
can trace the progress of a message through the network entities.

Figure 1-1: A11 Signaling details

The user can analyze the registration and validate the network functionality
opening the 1x and 1x-Ev-DO data channel between the PCF and PDSN. In
addition, the GRE details can be displayed.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 43

Figure 1-2: GRE Details

Figure 1-3: Session Details

The Performance and Signaling behavior of MIP and PPP can be analyzed.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 44

Figure 1-4: Upper Protocol Flow details

CDMA2000 A12 Consultant Highlights

• Provides online and offline A12 network error tracing.
• Automatically discovers, displays and monitors thousands of active and
closed PCF to AN AAA sessions.
• Analyzes signaling information related to terminal authentication between
the SC/MM function in the PCF and the AN AAA (Authentication,
Authorization and Accounting entity for 1x-EV-DO).
• Analyzes the AN-level authentication of the MS/AT device by authenticating
the results of a CHAP challenge/response operation invoked by the AN.
• Analyzes RADIUS protocol procedures as it flows between the AN and the
different RADIUS servers, e.g., RADIUS Home, RADIUS Visited and
RADIUS Broker.
• Analyzes the transition of MN ID, also used on the A8/A9 and A10/A11
interfaces. The MN ID identifier permits handoffs of PDSN packet data
sessions between ANs and between 1xEV-DO and IS-2000 systems.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 45

CDMA2000 Internet Consultant

In addition, the CDMA2000 network can be examined using the CDMA2000

Internet Consultant. The Internet Consultant features the following
highlights:
• Session level overview of PDSN to Internet connection
• TCP, HTTP and WAP transactions statistics
• Full Protocols analysis and conformance of all Internet protocols
• Session flow, session analysis and error detection of the following Internet
protocols:
• HTTP
• FTP
• POP-3
• SMTP
• Telnet
• TCP/IP
• PPP; PAP, CCP, IPCP, CHAP, L2TP, LCP
• WAP; WTP, WSP

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 46

CDMA2000 Internet Consultant Screens

The CDMA2000 Consultant allows the user to follow a CDMA2000 message
through all its stages on all network layers, and view both signaling and data
messages.

Figure 1-5: General Connection Statistics

The user can analyze the important application layer protocols such as HTTP,
WAP etc and view and analyze session details.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 47

Figure 1-6: Session Details

Figure 1-7: Signaling Flow

In addition, they can analyze and troubleshoot the Internet Session flow.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 48

CDMA2000 Network Consultant

The CDMA2000 Network Consultant provides full PCN session level analysis
from a single point -A10/A11, A12, Internet (PI) and allows the user to analyze
the user experience when accessing the 1x/1x-EV-DO data services. In
addition it provides online PCN error tracing as well as full PCN
calls/sessions abnormal. The Networks Consultant enables correlation of
information from multi links on a specific interface. Running both in online
and offline modes and allowing full PCN call tracing from a single point, it
completes RADCOM’s range of Consultants for troubleshooting and
maintaining CDMA2000 1x/1x-EV-DO systems.

Figure 1-8: CDMA2000 Network Consultant connected to a network

Cellular Expert

RADCOM's Cellular Expert system provides service providers and vendors

with a comprehensive solution for troubleshooting, maintaining and
monitoring the UMTS/GPRS and CDMA2000 networks. This exclusive
solution enables service providers and vendors to pinpoint sources of quality
degradation.
The Cellular Expert system facilitates management of quality throughout the
network efficiently and cost-effectively, detecting faults before customers
experience problems. It provides web-based analyses and reporting modules
and generates real-time alarms, granting service providers and vendors
preemptive power to maintain quality levels using resource allocation, load-
balancing, rerouting calls, and other fine-tuning network devices.
The Cellular Expert system is an ideal tool for troubleshooting, network
internal quality management, SLA management and rollout of new services.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 49

A vendor independent, interoperable solution, it enables connecting to other

management systems using SNMP Trap.

Cellular Expert Highlights

• Automatically discovers, displays, monitors and troubleshoots thousands of
active and closed UMTS/GPRS IP sessions, voice and video calls and
CDMA2000 IP sessions.
• Extensive and flexible KPI analysis.
• Locates sources of quality degradation, and reports potential problems
before they adversely affect the customer experience.
• Provides UMTS/GPRS network coverage, including Iub, Iu-CS, Iu-PS, Gb,
Gn, Gp, Gi, Core Signaling.
• CDMA2000 1x/1x-EV-DO, A1, A10-A11, A12, PI and Core Signaling.
• Hand over and roaming analysis.
• Optimizes utilization of network resources.
• Provides the data necessary to maintain differentiated customer services.
• Generates reports with historical data for trending and network planning
purposes, and enables the use of external reporting tools.
• Detects network errors and abnormal session/call scenarios.
• Filters and traces by the following network subsets Cell, APN server, IMSI,
MSISDN, P-TMSI, IP, etc.
• Facilitates identification and fast resolution of network problems,
decreasing troubleshooting time and expenses.
• Response time analysis.

Cellular Expert Main Applications

Network Installation: The Cellular Expert is an ideal tool for vendors
developing and installing UMTS, GPRS and CDMA2000 equipment, wireless
operators testing and deploying cellular networks, network integrators, QA
and interworking labs.
Network Maintenance (troubleshooting): The Cellular Expert monitors the
service supported by today's complex cellular networks. It detects problems
before they are felt by customers, isolates the sources of degradation and
troubleshoots their possible causes.
Network Optimization: Using the Cellular Expert, vendors and operators are
able to analyze and optimize the functionality of the different components in
the Radio Access Network, Core Signaling and Core IP of the UMTS, GPRS
and CDMA2000 networks.
The Cellular Expert is comprised of the QConsole and the QExpert.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 50

Qconsole
Remote user GUI module providing remote access from any desktop to the
QManager server, and allowing the connection of multiple users to the
QManager simultaneously (from different terminals).

QExpert
Web-based analysis and reporting module, allowing authorized users to log
into their accounts and view the level of service provided to any traffic pattern,
destination or source.

Performer Infrastructure

The CDMA2000 and the Internet Consultant run on the Cellular Performer.
The cutting-edge infrastructure of the Cellular Performer provides users with
the following features:
• Full line rate
• Multi technology
• Multi port
• Large set of protocols decode
• Synchronized solution
• GEAR, analyzer on chip
• Independent filters’ engines supporting up to 2.5 Gbps

RADCOM’s GEAR
The GEAR is RADCOM’s proprietary, full-custom ASIC chip. It supports 2.5
Gbps (STM16; OC-48) and has 3 Independent filters’ engines, one for use with
the Capture application, one for the Analysis application and a third for use
with various online applications. The Capture buffer on the GEAR itself is up
to 1 Gigabyte. The GEAR supports an extensive set of analyses per technology.
In addition, as a result of utilizing a chip it provides high performance online
applications’ including CDMA2000, UMTS & GPRS Consultants, MediaPro,
UDDs, and many others.

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 51

The GenFEP (Generic FEP)

RADCOM’s GenFEP is a new all-in-one concept. The GenFEP offers the user
one FEP for all technologies, while utilizing a different LIM (Line Interface
Module) for technology. It provides a 256 Mbyte Capture buffer and has a huge
set of sophisticated and high speed hardware resources which include the
GEAR, Programmable logic, Memory devices and FIFOs.

Dedicated ATM features

The Performer supports ATM interfaces. It supports ATM STM1/4/16 (OC3/
12/48) and provides AAL5/2/1 auto detection of 64,000 different VPI/VCIs and
online AAL5/2 (data & voice) re-assembly of 8,000 VPI/VCIs. In addition, it
supports the ATM over E1/T1 interface, providing AAL5/2/1 Auto detection of
64,000 different VPI/VCIs and online AAL5/2 (data & voice) re-assembly of
8,000 VPI/VCIs.

Dedicated Ethernet & POS features

The Performer also provides dedicated Ethernet and Packet over SONET/SDH
features. It provides a FastLAN LIM and a Gigabit Ethernet LIM. The Gigabit
Ethernet LIM features plug-able transceivers. The Packet over SONET LIM
supports STM1/4/16 (OC3/12/48).

RADCOM’s CDMA2000 Solutions

Introduction to CDMA2000 52

Dedicated multi E1/T1/J1 features

The Performer provides the following dedicated multi E1/T1/J1 features: six
full duplex ports (12 half duplex ports), use of 256 channels simultaneously
and supports HDLC, Transparent, Abis and Unframed (Unchannelized)
channels. In addition, the Performer provides GPRS Deciphering. The GPRS
deciphering is online at full line rate; hardware based and can deal with
128,000 calls simultaneously.
The performers future hardware plans include support of ATM over IMA

Time Stamp Synchronization

A unique feature of the Performer is the Time Stamp Synchronization. Using
the SynCard all FEPs within the same Performer are synchronized. In-lab
synchronization is performed through a sync cable, while Global
synchronization is done through a built-in GPS. The configuration is wizard-
based and very simple. The resolution of the time stamp synchronization is 20
Nano-sec for in-lab synchronization and 150 Nano-sec for global
synchronization. The diagram below shows a setup of four Performers linked
using the special Sync cables.

Summary

RADCOM’s Performer with its collection of unique features and multiple

interface support can now offer support for decoding and analyzing all layers
of the new CDMA2000 based networks. Use of the various Performer
components facilitates the work of network engineers in managing the
complex CDMA2000 networks.

RADCOM’s CDMA2000 Solutions

US Office:
RADCOM Equipment Inc.
6 Forest Avenue, Paramus, NJ 07652, USA
Tel: (201) 518-0033 or 1-800-RADCOM-4, Fax: (201) 556-9030
E-mail: info@radcomusa.com

Israel Office:
RADCOM Ltd.
24 Raoul Wallenberg St., Tel Aviv, 69719, Israel
Tel: 972-3-6455055, Fax: 972-3-6474681
E-mail: info@radcom.com

China Office:
RADCOM Ltd.
Handerson Center, Office 506, Tower 3,
18 Jianguomennei Avenue, Beijing 1000005, P.R. China
Tel: +86-10-65187723, Fax: +86-10-65187721
E-mail: china@radcom.com

United Kingdom Office:

RADCOM UK
2440 The Quadrant
Aztec West, Almondsbury
Bristol, BS32 4AQ England
Tel: +44-145-487-8827, Fax: +44-145-487-8788
E-mail: uk@radcom.com

Web Site:
http://www.radcom.com

©RADCOM, 2003