This glossary covers 127 technical terms used in mobile network diagnostics, from 2G (GSM) to 5G NR. Each term includes a practical field-oriented definition, operational thresholds where applicable, and a link to an in-depth guide. This is the reference used by RF engineers working with HiCellTek daily.
Telecom Glossary 2G/3G/4G/5G
Essential technical terms for mobile network diagnostics, from 2G to 5G. Each definition links to an in-depth article when available.
127 terms Β· 8 categories Β· Updated March 2026
KPI Thresholds. Quick Reference
The most commonly used operational thresholds in the field, from 2G to 5G.
| KPI | Technology | Excellent | Good | Weak |
|---|---|---|---|---|
| RSRP | 4G / 5G | > -80 dBm | -80 to -100 | < -110 |
| SINR | 4G / 5G | > 20 dB | 10 to 20 | < 0 |
| RSRQ | 4G / 5G | > -10 dB | -10 to -15 | < -15 |
| RSCP | 3G | > -85 dBm | -85 to -105 | < -105 |
| Ec/No | 3G | > -8 dB | -8 to -14 | < -14 |
| RxLev | 2G | > -75 dBm | -75 to -95 | < -95 |
| MOS | Voice | > 4.0 | 3.0 to 4.0 | < 3.0 |
These thresholds are indicative values. Exact thresholds vary by operator and context (indoor/outdoor, dense/rural). Complete RSRP/RSRQ/SINR guide β
5G NR
24 termsQoS identifier in 5G NR, equivalent to QCI in LTE. Each 5QI defines resource type (GBR/non-GBR), priority, latency budget, and error rate. 5QI 1 = conversational VoNR.
Learn more β5G core function that handles NAS signaling, registration, mobility, and UE security. Equivalent to the MME in LTE.
Learn more β5G NR mechanism where the gNB transmits SSBs sequentially in different directions to cover the entire cell. The UE measures SSB-RSRP of each beam to select the best one.
Learn more βAntenna processing technique that concentrates radio energy in a precise direction using an antenna array (massive MIMO). Essential in 5G NR, especially in mmWave.
Learn more βConfigurable portion of the total 5G NR carrier bandwidth. Allows dynamic UE bandwidth adaptation to save power or increase capacity.
Learn more β5G NR reference signal used for channel estimation, CSI reporting (CQI, RI, PMI), and mobility management. More flexible than the LTE CRS.
Learn more βReference signal used for coherent demodulation of data and control channels in 5G NR. Transmitted alongside data in the same PRBs.
Learn more βNSA mode where the UE is simultaneously connected to an eNB (LTE, anchor) and a gNB (NR, secondary). First 5G deployment mode.
Learn more β5G NR sub-6 GHz bands (410 MHz to 7,125 MHz). Coverage similar to LTE with higher throughput. Dominant deployment in Europe and Africa.
Learn more β5G NR mmWave bands (24.25 GHz to 52.6 GHz). Very high throughput but limited range. Primarily used in dense indoor environments (stadiums, airports).
Learn more β5G NR base station. Equivalent of eNodeB in LTE. Manages the radio layer and UE RRC connections.
Learn more βMillimeter waves (24 to 100 GHz) used in 5G NR FR2. Deliver very high throughput (multi-Gbps) but limited propagation, requiring beamforming and dense deployment.
Learn more βSimultaneous LTE + NR dual connectivity. The UE uses an LTE PCell (anchor) and an NR PSCell. Foundation of NSA (Non-Standalone) mode.
Learn more βRadio frequency channel number in 5G NR. Identifies the carrier frequency on FR1 (sub-6 GHz) and FR2 (mmWave) bands. Range: 0 to 3,279,165.
Set of identifiers (S-NSSAI) sent by the UE to select the appropriate network slice. Each S-NSSAI contains an SST (service type) and an SD (differentiator).
Learn more βPhysical broadcast channel in 5G NR, embedded within the SSB. Carries the MIB (Master Information Block) with essential system parameters for initial cell access.
Learn more βData session between the UE and the 5G network, equivalent to the EPS bearer in LTE. Each PDU session has a type (IPv4, IPv6, Ethernet) and can contain multiple QoS flows.
Learn more βPhysical random access channel used by the UE to initiate a connection with the network. In 5G NR, PRACH format is adapted to the band (FR1/FR2) and cell radius.
Learn more βEnd-to-end logical 5G network instance, isolated and dedicated to a service type (eMBB, URLLC, mMTC). Enables guaranteed QoS levels per use case.
Learn more β5G core function responsible for PDU session management, IP allocation, and user plane (UPF) control. Separates signaling from data transport.
Learn more βUplink reference signal transmitted by the UE to allow the network to estimate uplink channel quality. Used for uplink scheduling and reciprocal beamforming in TDD.
Learn more β5G NR synchronization block containing PSS, SSS, and PBCH. Each SSB corresponds to a beam. Up to 8 SSBs in sub-6 GHz, 64 in mmWave.
Learn more βReference signal power measured on SSBs in 5G NR. Equivalent of LTE RSRP but measured per beam. Key for multi-beam mobility management.
Learn more β5G core function that handles the user plane: routing, GTP-U encapsulation, QoS rule enforcement, and packet inspection. Data traffic anchor point.
Learn more β4G LTE
21 termsLTE/NR measurement event triggered when a neighbor cell's RSRP exceeds the serving cell's by a configured offset. Primary trigger for intra-frequency handover.
Learn more βInter-RAT measurement event triggered when a cell on another technology (e.g. NR) exceeds an absolute threshold. Used for LTE to NR handovers (EN-DC).
Learn more βBlock error rate on the transport channel. Target: 10% under normal operation. High BLER triggers HARQ retransmissions and MCS reduction.
Learn more βCarrier aggregation: combining multiple frequency bands to increase throughput. PCell + SCell(s). Up to 5 CCs in LTE, more in NR.
Learn more βChannel quality indicator (0 to 15) reported by the UE to the network. Determines the MCS and modulation to apply. A high CQI enables 256QAM modulation and higher throughput.
Learn more βFallback procedure to 2G/3G network for circuit-switched voice calls when VoLTE is not available. The UE leaves LTE during the call and returns when it ends.
Learn more βLTE base station. Manages radio resources, scheduling, handover, and bearers for connected UEs.
Learn more βTransfer of a connection from one cell to another without service interruption. Triggered by measurement events (A3, B1). Critical for mobility.
Learn more βHybrid retransmission mechanism combining FEC (forward error correction) and ARQ (retransmission). Up to 8 parallel processes in LTE. HARQ retransmissions increase the effective BLER.
Learn more βIndex defining the modulation (QPSK, 16QAM, 64QAM, 256QAM) and coding rate. Dynamically adapted based on SINR (AMC).
Learn more βPhysical cell identifier (0-503 in LTE, 0-1007 in NR). Used to distinguish cells during measurements and handovers.
Learn more βPrecoding matrix indicator reported by the UE for closed-loop beamforming. Selects the optimal matrix from the codebook to maximize MIMO throughput.
Learn more βQoS class identifier in LTE (1 to 9+). Each QCI defines a priority profile, maximum latency, and error rate. QCI 1 = VoLTE, QCI 9 = best-effort data.
Learn more βMIMO rank indicator reported by the UE. Indicates the number of usable spatial layers (1 to 4 in LTE, up to 8 in NR). A high RI means good MIMO propagation conditions.
Learn more βRadio link failure detected when the T310 timer expires without recovery. Triggers an RRC re-establishment procedure or return to idle state. Key network quality indicator.
Learn more βReference signal power received by the UE, measured in dBm. Primary coverage indicator in LTE and 5G NR. Typical thresholds: > -80 dBm (excellent), -80 to -100 (good), < -110 (weak).
Learn more βReference signal quality, measured in dB. Combines RSRP and interference. Thresholds: > -10 dB (good), -10 to -15 (moderate), < -15 (degraded).
Learn more βTotal received power across the entire bandwidth, including useful signal + interference + thermal noise.
Learn more βSignal-to-interference-plus-noise ratio, in dB. Directly determines MCS and achievable throughput. Thresholds: > 20 dB (excellent), 10-20 (good), < 0 (critical).
Learn more βRRC timer triggered upon radio problem detection (N310 consecutive out-of-sync). If T310 expires before recovery (N311 in-sync), an RLF is declared. Typical value: 1000 to 2000 ms.
Learn more βDuration for which the handover condition (A3 event, B1 event, etc.) must remain true before triggering a MeasurementReport. Values: 0 to 5120 ms. A TTT that is too long can cause late handovers.
Learn more β3G UMTS
8 termsChip energy to noise ratio in 3G, equivalent to SINR in LTE. Measured in dB. Thresholds: > -8 dB (good), < -14 dB (degraded). Determines achievable throughput.
Learn more β3G evolution comprising HSDPA (downlink, up to 42 Mbps) and HSUPA (uplink). Uses advanced modulations (16QAM, 64QAM) and fast scheduling (2ms TTI).
3G (UMTS) base station. Manages the WCDMA radio interface. Controlled by an RNC (Radio Network Controller). Evolution: Home NodeB (femtocell).
Primary scrambling code in 3G (0-511). Uniquely identifies a WCDMA cell, equivalent to PCI in LTE.
Radio access bearer in 3G. Defines connection characteristics (throughput, delay, error rate). Types: CS voice, PS data, simultaneous CS+PS.
Learn more βReceived signal power in 3G (WCDMA), equivalent to RSRP in LTE. Measured in dBm on the CPICH. Thresholds: > -85 dBm (good), < -105 dBm (weak).
Learn more β3G mobile standard based on WCDMA. Main bands: 2100 MHz (B1), 900 MHz (B8). Supports simultaneous CS voice and PS data.
3G radio access technique using spread spectrum over 5 MHz bandwidth. Each user is identified by a unique scrambling code.
2G GSM
8 termsRadio frequency channel number in GSM/2G. Identifies the carrier frequency used. Each GSM band (900, 1800, etc.) has its ARFCN range.
2G broadcast control channel. Transmits system information (ARFCN, LAC, CI, BSIC) needed for cell selection and reselection.
2G base station identity code, composed of NCC (3 bits) and BCC (3 bits). Used to distinguish cells on the same ARFCN.
2G (GSM) base station. Manages the radio interface with mobile devices. Controlled by a BSC (Base Station Controller).
2G mobile standard. Uses TDMA on 900/1800 MHz bands (Europe) or 850/1900 MHz (Americas). Foundation for circuit-switched (CS) voice and SMS.
Location area code in 2G/3G. Identifies a group of cells for mobility management and incoming call paging.
Received signal level in 2G (GSM), equivalent to RSRP in LTE. Measured in dBm, from -110 to -47 dBm. Thresholds: > -75 dBm (good), < -95 dBm (weak).
Learn more β2G signal quality indicator, from 0 (best) to 7 (worst). Based on bit error rate (BER). RxQual > 5 indicates degraded quality.
QoE / Voice
8 termsEnhanced version of SRVCC with faster transfer and reduced audio interruption during VoLTE to CS handover. Supports midcall transfer to 3G WCDMA in addition to 2G.
Learn more βNetwork infrastructure for IP multimedia services (VoLTE, ViLTE, RCS). Uses SIP for signaling and RTP for media.
Learn more βObjective perceived quality score, from 1 (poor) to 5 (excellent). Used for voice (ViSQOL) and video (ITU-T P.1204.3). A MOS > 4.0 is considered HD quality.
Learn more βQuality of experience as perceived by the end user. Objectively measured via voice MOS, video MOS, latency, jitter. Goes beyond radio KPIs.
Learn more βNetwork quality of service defined by technical KPIs: throughput, latency, packet loss, availability. QCI/5QI define QoS levels.
Learn more βVoLTE to CS (2G/3G) call handover procedure when LTE coverage is insufficient. Essential for call continuity in rural areas.
Learn more βObjective voice quality measurement algorithm developed by Google. Produces a MOS score without listener panels. Used by HiCellTek for field VoLTE scoring.
Learn more βVoice calls carried over the LTE network using the IMS protocol and a dedicated QCI 1 bearer. Codecs: AMR-NB, AMR-WB (HD Voice), EVS.
Learn more βProtocols
7 termsStandard notation for defining data structures in telecom protocols. LTE and NR RRC messages are encoded in ASN.1 (PER/UPER).
Learn more βProprietary Qualcomm protocol for accessing internal modem chipset logs (L1, L2, L3 layers, radio KPIs). Foundation of network diagnostics on Android smartphones with Qualcomm chipsets.
Learn more βTunneling protocol used in the mobile core network to transport user data (GTP-U) and signaling (GTP-C) between network nodes.
Learn more βNetwork signaling layer comprising RRC (radio), NAS (core), and IMS (services). Layer 3 decoding reveals network decisions.
Learn more βProtocol between the UE and the core network (MME/AMF). Handles authentication, attachment, PDN/PDU session management. Messages: Attach, TAU, PDN Connectivity.
Learn more βLayer 3 protocol between the UE and the radio network (eNB/gNB). Manages connection, handover, measurements, UE capabilities. Key messages: RRCSetup, RRCReconfiguration, MeasurementReport.
Learn more βSignaling protocol used by IMS to establish, modify, and terminate multimedia sessions (VoLTE, ViLTE). Messages: INVITE, 200 OK, BYE, REGISTER.
Learn more βIMEI / TAC
4 termsGSMA central database that lists blocked IMEIs (stolen/lost). Carriers query the CEIR to block devices reported stolen.
Learn more βUnique 15-digit identifier assigned to every mobile device. Composed of the TAC (8 digits, model), SNR (6 digits, serial number), and a Luhn check digit.
Learn more β14-character hexadecimal identifier used on CDMA networks. Replaced by IMEI in modern LTE/5G networks.
Learn more βThe first 8 digits of an IMEI, assigned by the GSMA. Identifies the manufacturer and exact device model. Used for network diagnostics and fleet management.
Learn more βGeneral
10 termsPerformance comparison of multiple operators on the same route (drive test) or area (walk test). Measures RSRP, throughput, latency, and voice quality under identical conditions.
Learn more βPost-deployment radio coverage verification process for a site. Performed via indoor walk test with comparison to contractual KPI thresholds (RSRP, SINR, throughput).
Learn more βDistributed antenna system for indoor building coverage. Types: passive (coaxial cables), active (fiber + remote units), hybrid.
Learn more βNetwork measurements performed in a vehicle with geolocated radio KPI collection. Used to evaluate coverage, throughput, and quality along a route.
Learn more βHiCellTek's encrypted proprietary format (chiffrement authentifiΓ©) for diagnostic sessions. Contains L1/L2/L3, KPIs, GPS position, and QoE data.
Learn more βQualcomm post-processing analysis tool for decoding and visualizing QMDL/ISF files. Reference tool for Qualcomm chipset log decoding.
Learn more βQualcomm DIAG log file format. Compatible with post-processing analysis tools. HiCellTek exports native QMDL.
Learn more βIndoor site coverage validation through walk testing. Verifies that KPI thresholds (RSRP, SINR, throughput) are met.
Learn more βThe user's mobile terminal (smartphone, modem, IoT). Its capabilities (UE Capabilities) determine which network features can be used.
Learn more βNetwork measurements performed on foot inside a building, typically on an imported floor plan. Used for indoor acceptance testing (SSV/CV).
Learn more β5GC Architecture
14 termsManages UE mobility, registration, and authentication in 5G. Equivalent to the MME in 4G. Entry point for the terminal into the core network.
Learn more β5G authentication server. Manages the 5G AKA protocol and validates authentication vectors with UDM. Ensures mutual UE-network authentication.
Deploying compute capacity at the network edge, closest to the user. Reduces latency for real-time applications (AR/VR, industrial automation, gaming).
Exposes 5G network capabilities via REST APIs to third-party developers. Enables the telecom API economy: location, on-demand QoS, analytics.
Partitioning a physical 5G network into logically isolated virtual networks, each with its own SLA (latency, throughput, reliability). Identified by S-NSSAI.
Learn more βCentral registry of all available 5G network functions. Service discovery for the SBA architecture, analogous to an internal DNS for the 5G core.
Selects the set of network slices (S-NSSAI) the user is entitled to during 5G registration.
Collects and analyzes network data in real time. Congestion prediction, anomaly detection, automatic optimization. Enhanced with federated learning since R17.
Defines QoS, charging, and network access policies. Equivalent to PCRF in 4G. Works with SMF to enforce session rules.
Unique identifier for a 5G network slice, composed of SST (slice type: eMBB=1, URLLC=2, mMTC=3) and SD (optional differentiator).
Learn more β5G core network architecture where each function (AMF, SMF, UPF...) is an HTTP/2 microservice. Enables cloud-native deployment, Kubernetes scaling, and zero-downtime updates.
Learn more βManages PDU data sessions (IP assignment, QoS, UPF routing). Separated from AMF in 5G, allowing independent scaling of mobility and sessions.
Stores subscriber data and subscription profiles. Equivalent to HSS in 4G. Contains encryption keys for 5G AKA authentication.
Forwards user data packets. Can be deployed at the edge (MEC) to reduce latency. Key enabler for edge computing and private 5G networks.
NTN & Satellite
7 termsDirect communication between a satellite and a standard mobile terminal (smartphone or IoT) without an intermediate ground station. Goal of the U-DESERVE 5G project (CNES, France 2030).
NTN cell fixed on the ground. The satellite dynamically adjusts its beams to cover fixed geographic areas. Cell ID doesn't change for a stationary terminal.
Learn more βNTN cell that moves with the satellite at 27,000 km/h. A fixed terminal experiences frequent handovers (every few minutes). Legacy Iridium/Globalstar architecture.
Learn more βLow orbit (300-1500 km). Radio latency 26 ms one-way (52 ms RTT). Satellites at 27,000 km/h. Constellation of hundreds to thousands of satellites required.
Learn more β5G network using non-terrestrial platforms (LEO/MEO/GEO satellites, HAPS, drones) as 3GPP base stations. Standardized in Release 17 (TR 38.821).
Learn more βNTN R18+ architecture where the satellite embeds gNB functions. Onboard processing, inter-satellite routing possible. Optimal performance but high complexity.
Learn more βNTN R17 architecture where the satellite acts as a simple RF relay. Amplifies and retransmits without onboard processing. The 5G core stays on the ground.
Learn more βCellular IoT
6 termsExtended radio sleep cycle (R13). Sleep up to 44 minutes between paging listens. Trade-off between energy savings and reachability time.
R18 evolution with dual bandwidth architecture: 20 MHz RF (control) + 5 MHz data. Throughput capped at 10 Mbps. Replaces LTE Cat-1. Chipset cost reduced by 50%+.
3GPP IoT standard (R13). 1.4 MHz band, 1 Mbps throughput, supports voice and mobility. More versatile than NB-IoT for wearables, GPS trackers, alarms.
3GPP LPWAN standard (R13, 2016). Band < 200 kHz, max throughput 250 kbps, very low power consumption. Ideal for meters, sensors, tracking. Battery life 10+ years.
IoT terminal deep sleep mode (R12). Terminal can sleep up to 413 days without disconnecting from the network. Battery life 15+ years for static sensors.
Simplified 5G NR terminal (R17). 20 MHz band, 150 Mbps, replaces LTE Cat-4. Designed for surveillance cameras, service robots, advanced wearables.
Security
4 terms5G mutual authentication protocol. Based on authentication vectors (RAND, AUTN, XRES*, KAUSF). Both terminal and network prove their identity to each other.
Asymmetric encryption algorithm used to encrypt SUPI into SUCI. Based on elliptic curves. Operator's public key stored in SIM/eSIM.
Encrypted version of SUPI via ECIES (Elliptic Curve). Only the operator's UDM can decrypt. Makes 4G IMSI catchers ineffective on 5G SA networks.
Learn more βPermanent subscriber identifier in 5G. Replaces IMSI. NEVER transmitted in clear over the air interface. Protects against subscriber tracking.
Learn more βO-RAN
6 termsCentral unit of the gNB in O-RAN architecture. Manages PDCP and RRC protocols. Can be split into O-CU-CP (control plane) and O-CU-UP (user plane).
Learn more βDistributed unit of the gNB in O-RAN architecture. Handles RLC, MAC layers and upper physical layer. Open Fronthaul interface to O-RU.
Learn more βOpen RAN architecture that disaggregates hardware and software with standardized interfaces. Aims to reduce dependency on proprietary vendors.
Learn more βRadio unit of the O-RAN gNB. Handles lower physical layer (FFT/iFFT, beamforming) and RF conversion. Connected to O-DU via split 7.2.
Learn more βO-RAN's AI brain. Two types: Non-RT RIC (optimization > 1s, rApps) and Near-RT RIC (10 ms to 1 s, xApps). Open platform for RAN optimization.
Learn more βFunctional split point between O-DU and O-RU in O-RAN architecture. Separates upper PHY (O-DU) from lower PHY (O-RU). O-RAN Alliance standard.
Learn more βAlphabetical Index
Frequently Asked Questions
What is the difference between RSRP, RSRQ and SINR?
RSRP measures reference signal power (coverage), RSRQ measures quality by combining power and interference, and SINR measures the signal-to-noise ratio that directly determines achievable throughput. All three are essential for a complete network diagnostic. HiCellTek displays these three KPIs in real time in the RF Monitor module.
What is the 2G and 3G equivalent of RSRP?
In 2G (GSM), the equivalent is RxLev (Received Signal Level). In 3G (UMTS/WCDMA), it's RSCP (Received Signal Code Power). All three measure received signal power but on different radio technologies. HiCellTek supports all generations from 2G to 5G.
How to measure VoLTE voice MOS in the field?
VoLTE voice MOS is objectively measured using the ViSQOL algorithm, integrated in HiCellTek's VoLTE QoE module. It analyzes audio quality in real time during calls without requiring listener panels. A MOS > 4.0 corresponds to HD Voice quality.
What is the difference between EN-DC and SA in 5G?
EN-DC (E-UTRA NR Dual Connectivity) is the NSA (Non-Standalone) mode where the UE uses an LTE anchor + a secondary NR link. SA (Standalone) mode uses only the 5G core and gNB, with no LTE dependency. HiCellTek's L3 Decoder module decodes both modes in real time.
What is a TAC and how to check it?
The TAC (Type Allocation Code) is the first 8 digits of an IMEI. It identifies the manufacturer and exact device model. HiCellTek offers a free TAC/IMEI verification tool covering more than 250,000 devices in its database.
Related Resources
HiCellTek measures RSRP, SINR, MOS, decodes Layer 3 and exports to QMDL, directly on Android smartphones.