There is one way to catch a cellular phreak: Triangulation What does this mean? Well, basically there are two contexts that this applies. One, when your on line and the authorities are already looking for you.(You did something wrong if this is case.) first thing they do is send out three vans and use the differences of signal strength to pinpoint you're location. Or, if you live In Southern California they send out just one van, that is much quicker and accurate than the other types. I don't know how quick this new van, but I can say this, that'show the police originaly found O.J Simpson on the big chase to his house. You know, if O.J. had read this article, he most likely would be in Rio today, sipping Mi Tia's, living in his multimillion dollar mansion. Because, he would of known that each cellular phone has its own set of codes that controls billing and tells Tel-CO who you are, each time you put out a call. If, he had changed his Nam and ESN Number, Most likely, he would of never of been caught. Imagine a honey comb containing 21 separate hexagonal cubes. Now Imagine a bee walking around on the honey comb with it's cellular phone. Now each cube in the honey comb is numbered 1-21. And, what ever cube the bee is closest too, is where the cellular base he is using is located. As the bee moves, his cellular phone switches to the nearest cellular base. But the queen bee wants him dead, so she tracks him down by finding out what cell he was using at the time, next she will send out three drones to that cell to triangulate and destroy. Usually this scenario ends with grim results. But, it will never get that far, if you remember these specific rules. First off, you have to change you're esn number once a day, at least. The reason is to stop triangulation of another sort. Imagine you use the same number for a month. The true owner of the reports the over billing. Next, a LA cellular rep calls each Recipient of the fraudulent phone calls, in hopes that a common name shows up; your name. Plus even if you don't get caught, your putting a lot of undue heat on the people you call. You know the feds will look for the slightest excuse to close down any pirate or phreak board so don't give em reason. *Introduction* Well here's something to get you started. The system technician codes that I have included, will allow you to do many things (though I don't pretend to know all of them, what you should pay particular attention to, is (DTMF, MIN, NAM, ESN, and Sic codes) *Cellular Basics* When a cellular phone makes a call, it normally transmits it's Electronic Security Number(ESN),Mobile Identification Number(MIN),it's Station Class Mark(SCM) and the number called in a short burst of data. This burst is the short buzz you hear after you press the SEND button and before the tower catches the data. These four things are the components the cellular provider uses to ensure that the phone is programmed to be billed and that it also has the identity of both the customer and the phone. There are usually two cellular phone companies in an area. One is the wire-line carrier (Band B), which is usually Bell, and the other is the non-wireline carrier (Band A). Within the two bands are 832 cellular phone channels. Each one has 416 bands, and within the bands are voice channels that actually transmit and receive information from cellular phones. The ESN and the phone number (MIN) are the two primary identifiers for any cellular phone. By changing both, the cellular carrier will accept the call and bill it to either a wrong account or provide service based on the fact that it is NOT a disconnected receiver. It will also look at the other two components, in order to insure that it is actually a cellular phone and to forward billing information to that carrier. The Station Class Mark can also be changed if you wish to prevent the cellular carrier from determining the type of phone that is placing the call. By providing the cellular tower with a false SCM, the cellular carrier, the FCC, or whoever happens to chase down cellular fraud is often looking for a particular phone which in reality is not the phone they are looking for. For example, you can provide the SCM for a Radio Shack phone, when in reality you are using a Novatell The Number Assignment Module (NAM) also has the SIDH (System Identification for Home System) number programmed into it. Refer to SIDH TABLE. The transmittal of the SIDH number tells the carrier where to forward the billing information to in case the user is "roaming". The SIDH table tells the major cities and their identifying numbers. Changing an SIDH is programming job that takes only minutes, but be aware that the ESN is still sent to the cellular phone company. After they realize that the ESN is connected to either a fake number or a phone that is not in the network, they will block service. They only way around this is to reprogram the ESN. The following is a list of commonly used abbreviations used in the files to follow. SIDH A 15-bit field in the NAM designating the System Identification for the Home System. Bit 0 of the SIDH corresponds to the Preferred System flag used elsewhere in the NAM. Bits 6 and 5 of byte 0 are international code bits. Normally the SIDH is entered during programming of the phone as a 5 digit decimal number. Enter 0's to the left-most unused positions when reprogramming. L.U. Local Use Flag. Tells the cellular phone user if it must preregister with the system. Preregistration with the system means that a mobile must transmit its parameters to the Cellular System as soon as the power-up task and the control channel tasks are completed. "1" enables the flag. Usually set to "1". MIN MARK A 1-bit flag designating that MIN2 (area code) is always sent when making system access. "1" enables the flag. Usually set to "1". MIN2 A 10-bit field representing the area code of the mobile ID number. MIN1 A 24-bit field representing the mobile telephone number. MIN2 plus MIN1 equals MIN, the 10-digit phone number. SCM A 4-bit field designating the Station Class Mark. A (3-Watt) 832 channel mobile unit typically will be 1000, a 1.2 Watt portable 1001 or a 0.6 Watt handheld 1010 or 1110 (discontinuous transmission, meaning push-to-talk). These are class I, Class II and Class III power levels respectively. With the SCM the cellular system determines whether or not a cellular phone can be switched to one of the 156 channels. Bit-1 is "0" for 666 and "1" for 832. (See cellular freq. list) Bit-2 is "0" for a mobile unit and "1" for a voice-activated transmit. Bit-3 and -4 identify the power class of the phone: "00" = 3.0 watts "01" = 1.2 watts "10" = 0.6 watts "11" is not assigned IPCH An 11-bit field designating the initial paging channel to be used if in the home system. Normally it is 334 for wireline systems, 333 for non- wireline systems. But most phones allow other settings for test purposes. ACCOLC A 4-bit field designating the overload class for the cellular phone. The intention of this entry is to allow the Cellular System to be able to determine priority in the event of a system overload, however it is currently useless as the system operators have generally not provided guidance for thier installers. The usual (and correct) system now in effect (in U.S.) is to use a "0" plus the last digit of the phone number. Test phones should be set at "10",emergency vehicles at "11","12" through "15" are reserved. (A class 15 system is supposed to be police, fire, or military). P.S. 1 1-bit flag designating the preferred system. If PS is "0", channels 334 through 666(EVIL!!!) are used. If PS is "1" then channels 1 through 333 are used. Even numbered system numbers (B systems) require a PS of "0", odd system numbers (A systems) require a "1". GIM A 4-bit field designating the Group Identification Mark. This number tells the Cellular system how far to look in the SIDH to determine if it is roaming in a system which may have a roam agreement with the phone system. It is usually set to "10". LOCK DIGITS A 4-bit field designating the unlock code. The digit "0" in the lock code is represented by an "A" in the actual NAM hexidecimal data. A lock code of all "0" sometimes unlocks the cellular phone.(Note: Lock codes are 3 digits. When programming a phone use "0" as the first number.) E.E. A 1-bit flag designating that end-to-end signaling is enabled. End-to-end signaling means that the DTMF tones will be transmitted on the voice channel as well as being echoed on the handset. This feature in necessary for such services as Bank by Phone, activating answering machines and in third party long distance services such as Sprint and MCI. A "1" enables the flag. Usually set to "1". REP A 1-bit flag designating that repertory memory (speed dialing) in the cellular phone is enabled. And once a again a "1" enables the flag. H.A. A 1-bit flag designating that the horn alert feature in enabled. "1" enables the flag. H.F. A 1-bit flag designating that the handsfree option is enabled. A "1" enables the flag. Often, transceivers supplied as hands-free units require that this flag be left at "0". *Handset Reprograming* The secret diagnostic mode and test commands engineered into many cellular phones has managed to capture quite a bit of attention recently. Such debugging tools have never been a secret to knowledgeable cellular technicians, but these tools now have a wider enthusiastic audience(phreaks). Some of these functions have been demonstrated before congressional sub-committees and vaguely described in many magazines and newspapers as an intriguing new development on the cellular frontier. It should really come as no surprise to those of us familiar with synthesized radios to discover the inherent ability to manipulate such hardware. Most people possessing an amateur radio callsign are at least peripherally aware that a number of ham transceivers can be coaxed into performing neat tricks with a simple modification or a few undocumented keystrokes . And so it goes with cellular phones. The correct sequence of keystrokes is often enough to open up an interesting mode where the hardware directly responds to your every command. The ability to unmute the speaker a cellular phone to hear the audio being received and the ability to load the transceivers frequency synthesizer with a given cellular channel seems to be considered the coolest function available in debug mode. These two commands essentially allow a phone to become a cellular capable receiver. Even a manual scanner of sorts, though I Don't know if they are reverse scan capable. Of course, much of the interest has been generated because cellular capable scanners and continuous coverage receivers are now illegal to manufacture in (or import to) the United States. This ban took effect April 26th of this year thanks to a provision tucked away in legislation that primarily concern itself with the regulation of 900 number toll services. Since it is perfectly legal for us to own cellular capable scanning radios, and for distributors to sell their existing stock of such devices, there is nothing inherently illegal in using a Cellular phone to monitor cellular frequencies when such monitoring is consistent with the provisions of the Electronic Communications Privacy Act (ECPA) of 1986. When employing these modes for purposes other than testing, avoid intercepting calls without the consent of at least one party to the conversation, or you will violate this sacred statute and be subject to arrest by the FBI To highlight the paradox of the cellular capable scanner ban. lets document some of the motorolas available with these command sets tucked neatly away in their software subbasement While the information that follows is limited to the commands required to activate the audio section and program given frequencies into the receiver these are by no means the only test functions available. Motorolla is the manufacturer whose phones have generated a large amount of interest Whether your curiosity is of a professional nature, or you've been itching to tinker with the hardware you paid good money to buy, I hope you'll be pleased with the second half of this article which focuses in detail on the entire complement of commands available in the transceivers produced by Motorola. As we will discuss, many of these commands can be generalized to possibly work with other transceivers. The test and diagnostic modes available in cellular transceivers occurred by design and were the code, or deliberately written into computer program, that operates the phone's electronics. While some have expressed the opinion that these commands may have been inserted by hackers on the programming team designing such software this is a pretty unlikely scenario. From the beginning- before hand set programmability was introduced-most cellular phones could be manually controlled. Back in these early days the mobile telephone number (MlN) and other parameters had to be burned directly to an EPROM with an external programmer. Once programmed the chip was socketed inside the phone The format of the data contained within this chip pretty much adhered to an industry defined standard . Another industry defined protocol of the period was the AMPS, or Advanced Mobile Telephone Service Standard, detailing the interface and cabling between the transceiver unit (which was usually mounted in the trunk of a vehicle) and the handset/controlhead located in the passenger compartment. Such interconnection was accomplishing with a rather thick cable adhering to the AMPS spec as promulgated by Bellcore prior to divestiture and the court ordered breakup of the Bell System monopoly. The old AMPS standard also included provisions for manual testing of various subsystems within the phone to diagnose problems or align audio and R sections. Such testing was accomplished with a specially designed interface box and computer software, using a bulky cable and various adapters for different transceivers. During these initial years there weren't that many cellular hardware manufacturers and to give you a better feel for how Jurassic this equipment was by today's standards, one of the more popular test mode set up's, ran on a Commodore 64 personal computer. Manufacturers gradually moved away from the AMPS bus standard. As technology advanced, phones were re-engineered to use a serial data interface or some proprietary hybrid to control the transceiver. This eliminated an assortment of control circuitry and a number of the wires that previously interconnected the control head and transceiver, thus bringing down the manufacturing cost. Since the trusty AMPS test rig was now useless for in shop diagnostics, most manufacturers included a manual test mode in their operating software. Although some adapter or external piece of hardware may still have been required to access the test mode, the diagnostic commands could be punched in right from the keypad. Even today many of the debug mode commands adhere to some form of the old AMPS two-digit test codes, although there is considerable variation between which code does what from manufacturer to manufacturer. Based on this fact, one could probably ferret out the other test functions for other phones that aren't detailed in this article simply by using the Motorola command set as an archetype. The keystroke sequences used to access the diagnostics are often referred to as "codes" or "passwords." Because these same terms are used to describe the unique words or digits that protect computers, accounts, alarm systems, and, things of that nature. It is important to clarify the role of these keystroke sequences. The series of digits that each uses a cellular phone to execute a test routine is not a trade secret, "code" or "Password" in the confidential sense. Such sequences are provided by the manufacturer to allow servicing, and are the same from one phone to the next on any given model. Never intended to be a big secret, the sequences were designed to prevent the end user from accidentally entering the diagnostic mode. Most people would be quite disturbed to suddenly hear another cellular call blazing from the handset after a clumsy dialing attempt, and then seeing arcane messages flash across the LCD display. It's not difficult to imagine the chaos that would be caused by someone driving around town with their phone in test mode, with the carrier on. Oblivious to the fact that the accidental transmission was causing calls to be dropped by the cellular system left and right. Remember, It might be a good Idea to get a service manual from the manufacturer for more detailed info, than I will relate to you in this text file. *Moding your Motorola phone for phun* As a first step, one must identify the process required to place a given transceiver in the manual test mode. Regardless of Motorola's unfathomable model numbering system, most popular phones can be described as belonging to one of three groups which determines the access method to be employed. Describing the physical style or class of the phone is far more productive than relying on the model number, Mechanical serial number, or particular title bestowed upon a particular unit. What may be known as a Motorola Wichita Cellular Classic series model 8006S in Kansas, or it may be a California Freedom phone in the Golden State House labels are the norm for carrier-marketed phones, and really has little bearing on the inherent diagnostics. These cellular transceivers fall into one of these categories: Installed or transportable units (Car or bag type cellular) Large handheld transceivers (The Brick) Small portable with a flip-down microphone panel (A flipper) Installed phones are generally mounted inside the passenger compartment or trunk of a vehicle, and with some phones, the same hardware when placed in a carrying case with a camcorder battery becomes a transportable unit commonly called a bag phone. These transceivers are rectangular and come in both a 4' deep silver case, or a black metal case less than half that depth. Both versions have a male DB 25 connector at one end. These units are placed in test mode by shorting the manual test line found at pin #21 to ground. Since the audio ground found on pin #20 is convenient, running a jumper between these two pins as depicted in (Figure B) is a convenient method of accessing the diagnostics. The best. way to accomplish this and still be able to attach a cable to the Connector, is to wire a pair of DB 25 Connectors straight through and jumper these two pins. An RS-232 break-out box from Radio Shack(part #276-1403 $9.95) is quite convenient for the constructed adapter. Large handhold transceivers are commonly referred to as a "brick" phone because someone once compared using the original, bulky version to holding a brick to his head. Current models are much thinner and lighter, but the test line can be found in the same location on the back of the phone. With the battery removed, 12 contacts are exposed on the upper portion of the phone, arranged in four groups of three terminals. The contact at the far right of the upper row is the test contact and is considered (pin #6). A small wire jumper wedged against the side of this contact and grounded at the other end on the antenna connector shield (Photo 1 ) is an easy way to access the test mode If the jumper is pushed flat against the back of the phone, the battery can be slid back on without dislodging the wire. Motorola's small "personal communicator" series phones have been relegated to category knownas "flip phones" because of the flip down microphone panel. The company officially refers to this as the "flipper" in several cellular service bulletins, perhaps as a tribute to the old television show about a dolphin. The test mode contact on these units is located between the battery terminals in lower right quadrant. Nestled in between the two power contacts is a recessed termimmal which needs to be grounded to activate the diagnostics. Since most batteries have e an extra negative contact in this middle position, all one really needs to do is build up the recessed terminal so that it contacts the center battery contact.(Photo 2) depicts how a small wad of conductive foil can be used for purpose. Whatever conductive material is employed. make sure it does not accidentally contact the positive terminal of the battery A shorted NiCad pack can cause a fire or possibly explode If the phone fails to power up or the battery be begins to feel warm, remove it immediately and check your work. Some exceptions to these general instructions apply. ln 1988, a series of phones marketed with a 15 pin connector instead of a 25-pin jack One of these, pin (#9)( first Pin on the lower row), is the test line and hands-free microphone connector. This pin can be brought low directly at the connector or by grounding one side of the hands free mic-connectorwhen working with older phones, be aware that these debugging capabilities were not written into the firmnware within the "F" series transceiver were introduced The fourth letter of the model number must be , F or greater. Do not attenmpt to place "D" or previous models in test mode or you'll be grounding a contact used for something other than diagnostics. *Test codes* That completes the construction of a handy programming aid for Motorola cellular phones, and you have a small packet of left over jumpers that are perfect for jumpering the test line contact on the hand held units. Be sure to save them. *Test Mode Commands* Once you've jumpered the appropriate contact or applied the test adapter, it's time to turn on the phone. When the phone powers up, a series of digits should appear in the display similar to those shown in Photo #6. They should alternate with another series of digits. This indicates your phone is in the manual test mode. One display consists of two numbers, each three digits in length. The set to the right is the channel number designator for the specific cellular frequency the phone is receiving from your local cell site (tower). The right-most trio is the relative signal strength indication (RSSI) of the received frequency. The seven-digit number alternating with the channel/RSSI display provides the technician with additional status information. Each individual digit in the field is actually an independent status register. With a letter substituted for each of the seven digits, this is what they represent: A B C D E F G Position A - SAT Frequency. Indicates which of the three SAT lock frequencies is being used by the phone. In this position a "0" = 5970Hz, "1" = 6000Hz, "2" = 6030Hz, "3" = No SAT lock. Position B - Carrier Status indication. "0" = carrier off, "1" = carrier on. Position C - Signalling Tone. "0" = tone off, "1" = tone on. Position D - RF Power Attenuation Level. "0" through "7" are valid values. Position E - Channel designation. A "0" = voice channel, "1" = control data channel. Position F - Audio Mute (receive). "1" = received audio is muted, "0" = unmuted. Position G - Audio Mute (transmit). "1" = transmitted audio is muted. "0" = unmuted. The meaning of all these status registers is fairly complex and has no bearing on cellular reprogramming. This display, like the majority of the test commands, are only of value to an engineer placing the phone under test with a cellular service monitor. Table "A" lists the test commands that can be of assistance in reprogramming. I have omitted the test commands designed for use with a service monitor, as issuing them without the phone connected to a monitor may cause interference to the cellular network. You may own the phone, but the cellular provider owns the FCC license that allows you to use it. Operating the transmitter in the phone in a manner inconsistent with this license could subject you to loss of service and possible legal trouble. "Issuing Commands" If your phone did not come up with the status display described above, you may need to manually instruct the phone to do so. Pressing "#" enters the test command mode, and "02#" is the command to display the status registers. If you enter a command improperly, the phone will scroll the word "error" across the display. If you need to review the current programming data stored in the NAM, enter "55#" which instructs the phone to enter the programming mode. You can scroll through the contents of NAM displaying the stored values by repeatedly pressing the "*" key. Actual reprogramming through this mode is considerably more difficult than through the standard programming mode. The test mode does not display a step number to let you know what programming step you are at, and the information is stored and displayed in a different order. Many programmers simply use this mode to obtain the security code, exit test mode and program the phone in the normal fashion. As you step through the NAM contents with the "*" key, the security code is the only six-digit number you'll see that isn't binary. Once you've written it down, continue to step through NAM until you see the "tick mark" in the display (it looks like an apostrophe) and exit test mode by turning off the phone. Motorola designed their phones so that they could only be programmed three times. I don't now the rationale for this, but a firmware counter increments each time the phone is reprogrammed, and after the third time it will no longer enter programming mode. The instruction booklet that accompanies the phone instructs you to take it to the dealer where you bought it. If you took the phone to a dealer, they would put the phone in test mode (just like we're doing) and enter the command "32#" which resets the counter to zero, allowing the phone to be reprogrammed three more times. Do it yourself and save! Many phones also have a cumulative call timer that counts the total number of minutes the phone has been used for calls (actively transmitting). This "autonomous timer" (that you were told was not resetable) can be cleared and reset to zero by punching in "03#" while in test mode. Another useful command is "38#" which causes the phone to display the Electronic Serial Number (ESN) that is burned in ROM. The phone will display the ESN one hex byte at a time. Press "*" to increment to the next byte. Note that the display shows four numbers. The two to the left indicate which byte you are viewing (00, 01, 02 or 03), and the actual value of that byte is at the right of the display. You can punch in "19#" if you'd like to view the software version number resident in your phone. The following list of manual test mode commands applies to a broad range of transceivers and firmware versions. As a composite list some of the commands will work only with specific models. Certain commands activate the transmit, and thus should only be used when employing a dummy load attached to the antenna connector to prevent interference to the cellular network. Proceed at your own risk this material was not provided and is not endorsed. by Motorola, but collected from a variety of sources including personal experimentation with an assortnment of transceivers. COMMAND TEST FUNCTION 01# Reboot (cycle through start-up routine) 02# Current Telephone Status Display 03# Autonomous Timer - Reset 04# Initialize 05# TX Carrier - On 06# TX Carrier Off 07# RX Audio - Mute On 08# RX Audio - Mute Off 09# TX Audio - Mute On 10# TX Audio - Mute Off 11xxxx# Load Frequency Synthesizer with Channel xxxx 12x# Set Output Power Attenuation to Step x (0 to 7) 13# Power Off 14# 10 KHz Signaling Tone - On 15# 10 KHz Signaling Tone Off 16# Setup (transmit a five word RECC message) 17# Voice (transmit a two word REVC message) 18# C-SCAN [-or- Display NAM. Version dependent] 19# Display Firmware Version 20# RECC- Message Error count (# to end) 21# REVC Message Error Count (# to end) 22# FOCC Message Sync Sequence Display (# to end) 23# FOVC Message Sync Sequence Display (# to end) 24# FOCC Busy/Idle Majority Vote Display (0 = idle) 25x# SAT - On (x = 0 1 or 2) 26# SAT - Off 27# Transmit Continuous RECC Data (# to end) 28#-31# Toggles DTMF high/low tones on/off. [Model dependent] 32# initialize (Clears timers & ALL Programming!) 33x# Generate DTMF for digit x 34# End DTMF Generation 35x# Set Audio Path to: 1 Speaker 2 Alert 3 Handset 4 - 6 Additional Options on some models. 36# Scan [Alleged Channel scan for TDMA systems] 36xxx# Scan [Alleged Channel scan where xxx is scan speed] 37# Low battery calibration routine [model specific] 38# Display ESN (* to scroll, # to exit) 39# Receive 1 Data Word from FOCC 40# Receive 1 Data Word from FOVC 41# Enable Diversity [Model specific command] 42# Disable Diversity [Model specific command] 43# Diversity (dual antenna) - Disabled 44# Diversity (dual antenna) Disabled [uses Rx antenna] 45# Display Relative Signal Strength indication (RSSi) 46# Display Cumulative Call Timer 47x# Set RX Audio Attenuation Level (0 = lowest, 7 = highest) 48# Side Tone On 49# Side Tone Off 50# Transmit Maintenance Data [pass/fail] 51# Maintenance Data Loopback - [pass/fail] 52x# SAT Phase Adjustment to x [Model dependent] 53# Speech Scrambler Option Enable 54# Speech Scrambler Option Disable 55# Test Mode Programming (* to scroll, # to exit) 01 System ID 02 Options Byte Alpha 10000000 Local Use Enable 01000000 Preferred System (1 = A, 0 = B) 00100000 End to End DTMF Enabled 00010000 N/A 00001000 Repertory Dialing 00000100 Auxiliary Alert Enabled 00000010 N/A 00000001 MiN Mark Enabled 03 Mobile Identification Number (MI N) 04 Station Class Mark (SCM) 05 Access overload Class (ACCOLC) 06 Group ID Mark (GIM) 07 Security Code 08 Unlock Code 09 Service Level Restriction Select: 001 memory dialing 01-10 only 002 memory dialing only (mo keypad. no speed dial) 003 keypad dialing only (no memory) 004 no call restrictions 005 seven digit dialing only 006 full dialing, but no memory changing 007 memory dialing only 10 Options Byte Bravo 10000000 N/A 01000000 N/A 00100000 N/A 00010000 Extended Field Enable (0 in USA) 00001000 Single System Scan Enable 00000100 Auto Recall - Enable (speed dial) 00000010 Disable Service Level Restriction (0 = enable) 00000001 Disable Lock Code (0 = enable) 11 Options Byte Charlie 10000000 Disable Handset programming Capability 01000000 Dual NAM Enable 00100000 N/A [Call Timer on older phones] 00010000 Auto Redial Disable (0 = enable) 00001000 Internal Speaker - Disable (0 = enable) 00000100 Dual IMTS/Cellular Option - Enable 00000010 Selectable System Reg. - Disable 00000001 Dual Antenna (diversity) - Enable 12 Initial Paging Channel (0333 for A, 0334 for B) 13 Initial Paging Channel for System A (0333) 14 Initial Paging Channel for System B (0334) 15 Number of Dedicated Paging Channels (021 in USA) 16 Options Byte Delta 10000000 Motorola Enhanced Scan - Enable 01000000 Cellular Connection (0 = SERIES II) 00100000 Long Tone DTMF 00010000 Transportable Ringer Select (1 = speaker) 00001000 8 hour Timeout - Disable (0 enable) 00000100 N/A 00000010 Failed Page Indicator - Disable 00000001 Portable Scan (1 = mobile) [Press * to save programming changes or # to abort] 57x# Call Processing (System Protocol) Selection 0 AMPS 1 NAMPS 5 TDMA signaling 6 TDMA signaling with Loopback 7 TDMA signaling with Loopback (voice) 8 TDMA signaling with Loopback (FACCH after decoding) 9 TDMA - forced synchronization 58# Audio Compander - On 59# Audio Compander Off 61# ESN transfer 62# Ringer Audio Path On 63# Ringer Audio Path - Off 66# Identity Transfer Function [Original Method] 67# E&C bus test [G.M. OEM units omly] 68# Display Model Information 69# Identity Transfer Function [Revised Method used W/ 66#] 70# Transmitter Audio Deviation [Model specific] 71# Transmitter RF Power Adjustment [Model specific] 72# Audio modulation sensitivity Phasing Command [model specific] Transmit deviation/receiver discriminator adj [Older units] 73# Transmitter Power Adjustment Command [Model Specific] 188# Low battery - calibrate to 7.5V input [model specific] If you are makeing a large volume of calls, it becomes a big hassle to enter a new esn on the road. If this turns out to be the case, I would take a look at a reprograming program called "mot-cell.zip" which I have attached to this zip. It also contains the schematics on how to build programing shoes which I have included in a file called "wireing.exe", the programing shoes listed in it will work with other PC based programs, though I havent't tried them all. Well thats it, I hope you enjoyed, by the way i'll attach a couple of GIFS along with it that give some visual guidance. I also added some more of the same by different authors so anything I might of missed, will most likely be covered in one of the files to follow. Vid-Kid ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *AMENDED* This is the best info I could find on capturing Esn's while reverse scanning. There is a good P.C. based reverse scanner called "cm-vt100.zip" , which I attached to this .zip Some terms you should understand: Control Channel- The channel the phone and cell base first communicate on. Reverse Control Ch- The oposite frequency, 45 mhz lower than the control channel.This is where the mobile unit is. Voice channel- The channel you are assigned by the switch to commence the call on after the exchange of suscriber data. Reverse voice channel- Again 45mhz lower. Cell Site- The base station that talks to the mobile. Switch- The computer that places the calls, and takes and recieves data from the suscriber or from PSTN. (public switched tel netwk) OK that should get things started. A suscriber picks up his handset to place a call. The phone has already been locked onto the strongest control ch in the area by a computerized scanner in the phone. As he drives thru the service a the computer constantly picks out the strongest control ch and stays on it, altho more than one cell site can actualy be heard. The suscriber enters the number to call on the keypad, and presses the "send" button. At this time th folowing data is transmitted to the cell sit by the mobile. The callers electronic serial number (ESN) , his home system number (two digits) his mobile's area code and phone number, and the number he wants.The cellular switch now picks up an outgoing line, places the call for him and tells the mobile to switch to a voice channel. The two ends are linked in the central switch and violla! A complete phone call, in about 3 seconds. I have purposely over-simplified the whole process to point out the moment of truth. The mobile's ESN and phone number and the data in the switch must match or no go. This is how the billing is figgured out.If one had the ESN and the mobilephone number, you could call anytine anyplace without fear of trace, let alone bill. The ideal setup would let you listen to the reverse control channel, record and display heard working numbers and ESN's and recall them at your discression to make calls. This would be tits! Were not quite there yet. But some hard work has allready been done for us. All the aforementioned codes are sent in hex, in NRZ code (phancy term for phase shift keying) but the phone allready has, for example a NRZ receiver and transmitter built right in. All that has to be done is to have a receiver on the reverse control channel, recover the other suscribers data and save it or at least print it out. *SCANNING TO FIND THE ESN/MIN PAIR* Well if you haven't guessed by now, the mobiles ESN and MIN must match in the switch or no go. This is required for billing purposes. If one had the ESN and the mobile phone number (MIN), he could call anytime and anyplace without fear of a trace - let alone a bill. The ideal setup would let you listen with a scanner to the reverse control channel, record and display heard working numbers and ESN's, and recall them as one needs to make calls. This would be it, but we are not quite there yet. But some of the hard work has already been done for us. All the aforementioned codes are sent in hex, in NRZ code (phase-key shifting), when a cellular subscriber places a call. But guess what? All phones have an NRZ receiver and transmitter built right into them. All that has to be done is to have a receiver on the reverse control channel, recover the other subscibers data and save it or print it out. Cellular phones operate on a full duplex channel. One frequency is used for transmission from the base to the phone, while another is used for transmission from the phone to the base. The base frequencies are always exactly 45 MHZ higher than the phone frequency, and both of these are incremented by 30 KHZ as the progression of channels increases from Channel #1 to Chanel #1023 (NOTE: There are no channels between 800 and 990). With some systems (not all) the cellular transmission is received by the base and retransmitted on the base frequency. When this is done, a scanner can listen to both sides of the conversation by simply monitoring the base frequency. When this is not the case, two scanners set 45 MHZ apart will work. Here is a list of all Cellular Frequencies: Non-Wireline Wireline Channel Tx Freq Rx Freq Channel Tx Freq Rx Freq Number Mhz Mhz Number Mhz Mhz 1 870.03 825.03 334 880.02 835.02 2 870.06 825.06 335 880.05 835.05 3 870.09 825.09 336 880.08 835.08 4 870.12 825.12 337 880.11 835.11 5 870.15 825.15 338 880.14 835.14 6 870.18 825.18 339 880.17 835.17 7 870.21 825.21 340 880.20 835.20 8 870.24 825.24 341 880.23 835.23 9 870.27 825.27 342 880.26 835.26 10 870.30 825.30 343 880.29 835.29 11 870.33 825.33 344 880.32 835.32 12 870.36 825.36 345 880.35 835.35 13 870.39 825.39 346 880.38 835.38 14 870.42 825.42 347 880.41 835.41 15 870.45 825.45 348 880.44 835.44 16 870.48 825.48 349 880.47 835.47 17 870.51 825.51 350 880.50 835.50 18 870.54 825.54 351 880.53 835.53 19 870.57 825.57 352 880.56 835.56 20 870.60 825.60 353 880.59 835.59 21 870.63 825.63 354 880.62 835.62 22 870.66 825.66 355 880.65 835.65 23 870.69 825.69 356 880.68 835.68 24 870.72 825.72 357 880.71 835.71 25 870.75 825.75 358 880.74 835.74 26 870.78 825.78 359 880.77 835.77 27 870.81 825.81 360 880.80 835.80 28 870.84 825.84 361 880.83 835.83 29 870.87 825.87 362 880.86 835.86 30 870.90 825.90 363 880.89 835.89 31 870.93 825.93 364 880.92 835.92 32 870.96 825.96 365 880.95 835.95 33 870.99 825.99 366 880.98 835.98 34 871.02 826.02 367 881.01 836.01 35 871.05 826.05 368 881.04 836.04 36 871.08 826.08 369 881.07 836.07 37 871.11 826.11 370 881.10 836.10 38 871.14 826.14 371 881.13 836.13 39 871.17 826.17 372 881.16 836.16 40 871.20 826.20 373 881.19 836.19 41 871.23 826.23 374 881.22 836.22 42 871.26 826.26 375 881.25 836.25 43 871.29 826.29 376 881.28 836.28 44 871.32 826.32 377 881.31 836.31 45 871.35 826.35 378 881.34 836.34 46 871.38 826.38 379 881.37 836.37 47 871.41 826.41 380 881.40 836.40 48 871.44 826.44 381 881.43 836.43 49 871.47 826.47 382 881.46 836.46 50 871.50 826.50 383 881.49 836.49 51 871.53 826.53 384 881.52 836.52 52 871.56 826.56 385 881.55 836.55 53 871.59 826.59 386 881.58 836.58 54 871.62 826.62 387 881.61 836.61 55 871.65 826.65 388 881.64 836.64 56 871.68 826.68 389 881.67 836.67 57 871.71 826.71 390 881.70 836.70 58 871.74 826.74 391 881.73 836.73 59 871.77 826.77 392 881.76 836.76 60 871.80 826.80 393 881.79 836.79 61 871.83 826.83 394 881.82 836.82 62 871.86 826.86 395 881.85 836.85 63 871.89 826.89 396 881.88 836.88 64 871.92 826.92 397 881.91 836.91 65 871.95 826.95 398 881.94 836.94 66 871.98 826.98 399 881.97 836.97 67 872.01 827.01 400 882.00 837.00 68 872.04 827.04 401 882.03 837.03 69 872.07 827.07 402 882.06 837.06 70 872.10 827.10 403 882.09 837.09 71 872.13 827.13 404 882.12 837.12 72 872.16 827.16 405 882.15 837.15 73 872.19 827.19 406 882.18 837.18 74 872.22 827.22 407 882.21 837.21 75 872.25 827.25 408 882.24 837.24 76 872.28 827.28 409 882.27 837.27 77 872.31 827.31 410 882.30 837.30 78 872.34 827.34 411 882.33 837.33 79 872.37 827.37 412 882.36 837.36 80 872.40 827.40 413 882.39 837.39 81 872.43 827.43 414 882.42 837.42 82 872.46 827.46 415 882.45 837.45 83 872.49 827.49 416 882.48 837.48 84 872.52 827.52 417 882.51 837.51 85 872.55 827.55 418 882.54 837.54 86 872.58 827.58 419 882.57 837.57 87 872.61 827.61 420 882.60 837.60 88 872.64 827.64 421 882.63 837.63 89 872.67 827.67 422 882.66 837.66 90 872.70 827.70 423 882.69 837.69 91 872.73 827.73 424 882.72 837.72 92 872.76 827.76 425 882.75 837.75 93 872.79 827.79 426 882.78 837.78 94 872.82 827.82 427 882.81 837.81 95 872.85 827.85 428 882.84 837.84 96 872.88 827.88 429 882.87 837.87 97 872.91 827.91 430 882.90 837.90 98 872.94 827.94 431 882.93 837.93 99 872.97 827.97 432 882.96 837.96 100 873.00 828.00 433 882.99 837.99 101 873.03 828.03 434 883.02 838.02 102 873.06 828.06 435 883.05 838.05 103 873.09 828.09 436 883.08 838.08 104 873.12 828.12 437 883.11 838.11 105 873.15 828.15 438 883.14 838.14 106 873.18 828.18 439 883.17 838.17 107 873.21 828.21 440 883.20 838.20 108 873.24 828.24 441 883.23 838.23 109 873.27 828.27 442 883.26 838.26 110 873.30 828.30 443 883.29 838.29 111 873.33 828.33 444 883.32 838.32 112 873.36 828.36 445 883.35 838.35 113 873.39 828.39 446 883.38 838.38 114 873.42 828.42 447 883.41 838.41 115 873.45 828.45 448 883.44 838.44 116 873.48 828.48 449 883.47 838.47 117 873.51 828.51 450 883.50 838.50 118 873.54 828.54 451 883.53 838.53 119 873.57 828.57 452 883.56 838.56 120 873.60 828.60 453 883.59 838.59 121 873.63 828.63 454 883.62 838.62 122 873.66 828.66 455 883.65 838.65 123 873.69 828.69 456 883.68 838.68 124 873.72 828.72 457 883.71 838.71 125 873.75 828.75 458 883.74 838.74 126 873.78 828.78 459 883.77 838.77 127 873.81 828.81 460 883.80 838.80 128 873.84 828.84 461 883.83 838.83 129 873.87 828.87 462 883.86 838.86 130 873.90 828.90 463 883.89 838.89 131 873.93 828.93 464 883.92 838.92 132 873.96 828.96 465 883.95 838.95 133 873.99 828.99 466 883.98 838.98 134 874.02 829.02 467 884.01 839.01 135 874.05 829.05 468 884.04 839.04 136 874.08 829.08 469 884.07 839.07 137 874.11 829.11 470 884.10 839.10 138 874.14 829.14 471 884.13 839.13 139 874.17 829.17 472 884.16 839.16 140 874.20 829.20 473 884.19 839.19 141 874.23 829.23 474 884.22 839.22 142 874.26 829.26 475 884.25 839.25 143 874.29 829.29 476 884.28 839.28 144 874.32 829.32 477 884.31 839.31 145 874.35 829.35 478 884.34 839.34 146 874.38 829.38 479 884.37 839.37 147 874.41 829.41 480 884.40 839.40 148 874.44 829.44 481 884.43 839.43 149 874.47 829.47 482 884.46 839.46 150 874.50 829.50 483 884.49 839.49 151 874.53 829.53 484 884.52 839.52 152 874.56 829.56 485 884.55 839.55 153 874.59 829.59 486 884.58 839.58 154 874.62 829.62 487 884.61 839.61 155 874.65 829.65 488 884.64 839.64 156 874.68 829.68 489 884.67 839.67 157 874.71 829.71 490 884.70 839.70 158 874.74 829.74 491 884.73 839.73 159 874.77 829.77 492 884.76 839.76 160 874.80 829.80 493 884.79 839.79 161 874.83 829.83 494 884.82 839.82 162 874.86 829.86 495 884.85 839.85 163 874.89 829.89 496 884.88 839.88 164 874.92 829.92 497 884.91 839.91 165 874.95 829.95 498 884.94 839.94 166 874.98 829.98 499 884.97 839.97 167 875.01 830.01 500 885.00 840.00 168 875.04 830.04 501 885.03 840.03 169 875.07 830.07 502 885.06 840.06 170 875.10 830.10 503 885.09 840.09 171 875.13 830.13 504 885.12 840.12 172 875.16 830.16 505 885.15 840.15 173 875.19 830.19 506 885.18 840.18 174 875.22 830.22 507 885.21 840.21 175 875.25 830.25 508 885.24 840.24 176 875.28 830.28 509 885.27 840.27 177 875.31 830.31 510 885.30 840.30 178 875.34 830.34 511 885.33 840.33 179 875.37 830.37 512 885.36 840.36 180 875.40 830.40 513 885.39 840.39 181 875.43 830.43 514 885.42 840.42 182 875.46 830.46 515 885.45 840.45 183 875.49 830.49 516 885.48 840.48 184 875.52 830.52 517 885.51 840.51 185 875.55 830.55 518 885.54 840.54 186 875.58 830.58 519 885.57 840.57 187 875.61 830.61 520 885.60 840.60 188 875.64 830.64 521 885.63 840.63 189 875.67 830.67 522 885.66 840.66 190 875.70 830.70 523 885.69 840.69 191 875.73 830.73 524 885.72 840.72 192 875.76 830.76 525 885.75 840.75 193 875.79 830.79 526 885.78 840.78 194 875.82 830.82 527 885.81 840.81 195 875.85 830.85 528 885.84 840.84 196 875.88 830.88 529 885.87 840.87 197 875.91 830.91 530 885.90 840.90 198 875.94 830.94 531 885.93 840.93 199 875.97 830.97 532 885.96 840.96 200 876.00 831.00 533 885.99 840.99 201 876.03 831.03 534 886.02 841.02 202 876.06 831.06 535 886.05 841.05 203 876.09 831.09 536 886.08 841.08 204 876.12 831.12 537 886.11 841.11 205 876.15 831.15 538 886.14 841.14 206 876.18 831.18 539 886.17 841.17 207 876.21 831.21 540 886.20 841.20 208 876.24 831.24 541 886.23 841.23 209 876.27 831.27 542 886.26 841.26 210 876.30 831.30 543 886.29 841.29 211 876.33 831.33 544 886.32 841.32 212 876.36 831.36 545 886.35 841.35 213 876.39 831.39 546 886.38 841.38 214 876.42 831.42 547 886.41 841.41 215 876.45 831.45 548 886.44 841.44 216 876.48 831.48 549 886.47 841.47 217 876.51 831.51 550 886.50 841.50 218 876.54 831.54 551 886.53 841.53 219 876.57 831.57 552 886.56 841.56 220 876.60 831.60 553 886.59 841.59 221 876.63 831.63 554 886.62 841.62 222 876.66 831.66 555 886.65 841.65 223 876.69 831.69 556 886.68 841.68 224 876.72 831.72 557 886.71 841.71 225 876.75 831.75 558 886.74 841.74 226 876.78 831.78 559 886.77 841.77 227 876.81 831.81 560 886.80 841.80 228 876.84 831.84 561 886.83 841.83 229 876.87 831.87 562 886.86 841.86 230 876.90 831.90 563 886.89 841.89 231 876.93 831.93 564 886.92 841.92 232 876.96 831.96 565 886.95 841.95 233 876.99 831.99 566 886.98 841.98 234 877.02 832.02 567 887.01 842.01 235 877.05 832.05 568 887.04 842.04 236 877.08 832.08 569 887.07 842.07 237 877.11 832.11 570 887.10 842.10 238 877.14 832.14 571 887.13 842.13 239 877.17 832.17 572 887.16 842.16 240 877.20 832.20 573 887.19 842.19 241 877.23 832.23 574 887.22 842.22 242 877.26 832.26 575 887.25 842.25 243 877.29 832.29 576 887.28 842.28 244 877.32 832.32 577 887.31 842.31 245 877.35 832.35 578 887.34 842.34 246 877.38 832.38 579 887.37 842.37 247 877.41 832.41 580 887.40 842.40 248 877.44 832.44 581 887.43 842.43 249 877.47 832.47 582 887.46 842.46 250 877.50 832.50 583 887.49 842.49 251 877.53 832.53 584 887.52 842.52 252 877.56 832.56 585 887.55 842.55 253 877.59 832.59 586 887.58 842.58 254 877.62 832.62 587 887.61 842.61 255 877.65 832.65 588 887.64 842.64 256 877.68 832.68 589 887.67 842.67 257 877.71 832.71 590 887.70 842.70 258 877.74 832.74 591 887.73 842.73 259 877.77 832.77 592 887.76 842.76 260 877.80 832.80 593 887.79 842.79 261 877.83 832.83 594 887.82 842.82 262 877.86 832.86 595 887.85 842.85 263 877.89 832.89 596 887.88 842.88 264 877.92 832.92 597 887.91 842.91 265 877.95 832.95 598 887.94 842.94 266 877.98 832.98 599 887.97 842.97 267 878.01 833.01 600 888.00 843.00 268 878.04 833.04 601 888.03 843.03 269 878.07 833.07 602 888.06 843.06 270 878.10 833.10 603 888.09 843.09 271 878.13 833.13 604 888.12 843.12 272 878.16 833.16 605 888.15 843.15 273 878.19 833.19 606 888.18 843.18 274 878.22 833.22 607 888.21 843.21 275 878.25 833.25 608 888.24 843.24 276 878.28 833.28 609 888.27 843.27 277 878.31 833.31 610 888.30 843.30 278 878.34 833.34 611 888.33 843.33 279 878.37 833.37 612 888.36 843.36 280 878.40 833.40 613 888.39 843.39 281 878.43 833.43 614 888.42 843.42 282 878.46 833.46 615 888.45 843.45 283 878.49 833.49 616 888.48 843.48 284 878.52 833.52 617 888.51 843.51 285 878.55 833.55 618 888.54 843.54 286 878.58 833.58 619 888.57 843.57 287 878.61 833.61 620 888.60 843.60 288 878.64 833.64 621 888.63 843.63 289 878.67 833.67 622 888.66 843.66 290 878.70 833.70 623 888.69 843.69 291 878.73 833.73 624 888.72 843.72 292 878.76 833.76 625 888.75 843.75 293 878.79 833.79 626 888.78 843.78 294 878.82 833.82 627 888.81 843.81 295 878.85 833.85 628 888.84 843.84 296 878.88 833.88 629 888.87 843.87 297 878.91 833.91 630 888.90 843.90 298 878.94 833.94 631 888.93 843.93 299 878.97 833.97 632 888.96 843.96 300 879.00 834.00 633 888.99 843.99 301 879.03 834.03 634 889.02 844.02 302 879.06 834.06 635 889.05 844.05 303 879.09 834.09 636 889.08 844.08 304 879.12 834.12 637 889.11 844.11 305 879.15 834.15 638 889.14 844.14 306 879.18 834.18 639 889.17 844.17 307 879.21 834.21 640 889.20 844.20 308 879.24 834.24 641 889.23 844.23 309 879.27 834.27 642 889.26 844.26 310 879.30 834.30 643 889.29 844.29 311 879.33 834.33 644 889.32 844.32 312 879.36 834.36 645 889.35 844.35 313 879.39 834.39 646 889.38 844.38 314 879.42 834.42 647 889.41 844.41 315 879.45 834.45 648 889.44 844.44 316 879.48 834.48 649 889.47 844.47 317 879.51 834.51 650 889.50 844.50 318 879.54 834.54 651 889.53 844.53 319 879.57 834.57 652 889.56 844.56 320 879.60 834.60 653 889.59 844.59 321 879.63 834.63 654 889.62 844.62 322 879.66 834.66 655 889.65 844.65 323 879.69 834.69 656 889.68 844.68 324 879.72 834.72 657 889.71 844.71 325 879.75 834.75 658 889.74 844.74 326 879.78 834.78 659 889.77 844.77 327 879.81 834.81 660 889.80 844.80 328 879.84 834.84 661 889.83 844.83 329 879.87 834.87 662 889.86 844.86 330 879.90 834.90 663 889.89 844.89 331 879.93 834.93 664 889.92 844.92 332 879.96 834.96 665 889.95 844.95 333 879.99 834.99 666 889.98 844.98 667 890.01 845.01 717 891.51 846.51 668 890.04 845.04 718 891.54 846.54 669 890.07 845.07 719 891.57 846.57 670 890.10 845.10 720 891.60 846.60 671 890.13 845.13 721 891.63 846.63 672 890.16 845.16 722 891.66 846.66 673 890.19 845.19 723 891.69 846.69 674 890.22 845.22 724 891.72 846.72 675 890.25 845.25 725 891.75 846.75 676 890.28 845.28 726 891.78 846.78 677 890.31 845.31 727 891.81 846.81 678 890.34 845.34 728 891.84 846.84 679 890.37 845.37 729 891.87 846.87 680 890.40 845.40 730 891.90 846.90 681 890.43 845.43 731 891.93 846.93 682 890.46 845.46 732 891.96 846.96 683 890.49 845.49 733 891.99 846.99 684 890.52 845.52 734 892.02 847.02 685 890.55 845.55 735 892.05 847.05 686 890.58 845.58 736 892.08 847.08 687 890.61 845.61 737 892.11 847.11 688 890.64 845.64 738 892.14 847.14 689 890.67 845.67 739 892.17 847.17 690 890.70 845.70 740 892.20 847.20 691 890.73 845.73 741 892.23 847.23 692 890.76 845.76 742 892.26 847.26 693 890.79 845.79 743 892.29 847.29 694 890.82 845.82 744 892.32 847.32 695 890.85 845.85 745 892.35 847.35 696 890.88 845.88 746 892.38 847.38 697 890.91 845.91 747 892.41 847.41 698 890.94 845.94 748 892.44 847.44 699 890.97 845.97 749 892.47 847.47 700 891.00 846.00 750 892.50 847.50 701 891.03 846.03 751 892.53 847.53 702 891.06 846.06 752 892.56 847.56 703 891.09 846.09 753 892.59 847.59 704 891.12 846.12 754 892.62 847.62 705 891.15 846.15 755 892.65 847.65 706 891.18 846.18 756 892.68 847.68 707 891.21 846.21 757 892.71 847.71 708 891.24 846.24 758 892.74 847.74 709 891.27 846.27 759 892.77 847.77 710 891.30 846.30 760 892.80 847.80 711 891.33 846.33 761 892.83 847.83 712 891.36 846.36 762 892.86 847.86 713 891.39 846.39 763 892.89 847.89 714 891.42 846.42 764 892.92 847.92 715 891.45 846.45 765 892.95 847.95 716 891.48 846.48 766 892.98 847.98 991 869.04 824.04 767 893.01 848.01 992 869.07 824.07 768 893.04 848.04 993 869.10 824.10 769 893.07 848.07 994 869.13 824.13 770 893.10 848.10 995 869.16 824.16 771 893.13 848.13 996 869.19 824.19 772 893.16 848.16 997 869.22 824.22 773 893.19 848.19 998 869.25 824.25 774 893.22 848.22 999 869.28 824.28 775 893.25 848.25 1000 869.31 824.31 776 893.28 848.28 1001 869.34 824.34 777 893.31 848.31 1002 869.37 824.37 778 893.34 848.34 1003 869.40 824.40 779 893.37 848.37 1004 869.43 824.43 780 893.40 848.40 1005 869.46 824.46 781 893.43 848.43 1006 869.49 824.49 782 893.46 848.46 1007 869.52 824.52 783 893.49 848.49 1008 869.55 824.55 784 893.52 848.52 1009 869.58 824.58 785 893.55 848.55 1010 869.61 824.61 786 893.58 848.58 1011 869.64 824.64 787 893.61 848.61 1012 869.67 824.67 788 893.64 848.64 1013 869.70 824.70 789 893.67 848.67 1014 869.73 824.73 790 893.70 848.70 1015 869.76 824.76 791 893.73 848.73 1016 869.79 824.79 792 893.76 848.76 1017 869.82 824.82 793 893.79 848.79 1018 869.85 824.85 794 893.82 848.82 1019 869.88 824.88 795 893.85 848.85 1020 869.91 824.91 796 893.88 848.88 1021 869.94 824.94 797 893.91 848.91 1022 869.97 824.97 798 893.94 848.94 1023 870.00 825.00 799 893.97 848.97 *Amended* As you can see these files are very complicated and Incomplete It would be A boon to cellular freaking if some one wrote an accurate and consise file on scanning for Nam+ESN codes, If you have one let me know. *Amended* Well here are some scanner mods so that you can cover cellular bands. =============================================================================== Modifying two scanners for cellular reception =============================================================================== The word "modifying" in this case is wrong. That implies that there is a _conversion_ process whereby you can cause your scanner to suddenly begin receiving cellular mobile telephone calls. This is wrong thinking. A scanner that is _designed_ to receive those frequencies above 512 MHz can have those frequencies RESTORED (_sometimes_). A scanner that covers from 30-512 MHz can NEVER receive 800-900 MHz frequencies without the aid of an external RF converter. Many times you will see messages from people asking how to modify such-and-such a receiver to pick up CMT. The sad truth is, the answer is $$$, as that's what it will take to get a new scanner that covers those frequencies. Some older scanners (most of them in fact) have no modifications so that they will cover these frequencies. There may be cosmetic changes, such as the addition of an S-meter, or squelch or tone improvement, but there will never, ever be anything that can be done to most of them to make them cover CMT. The PRO-2004/2005/34 receivers originally had those frequencies, but had them blocked out. Restoring those frequencies was simply a matter of _unblocking_ them. There was really no "modifying" taking place. If a scanner was never intended to cover 800 MHz, it never will. You can get RF converters that will convert 800-912 MHz down to 400-512 MHz, however, and these should work on all scanners. MOST SCANNERS CANNOT BE MODIFIED OR CHANGED TO RECEIVE THE CMT FREQUENCIES. There are a handful of exceptions to this. It started out with the Realistic PRO-2004 and the PRO-34, and went to the PRO-2005. To restore CMT for the 2004, open the radio and turn it upside down. You'll see a large metal box. Carefully remove the cover. Find diode D-513. It may be in the line of diodes, or it may be on the bottom of the PC board, in which case you'll have to VERY carefully remove the board. In either case, the cure is the same. Clip one leg of D-513 to restore CMT frequencies. If you're careful, you can unsolder this diode and place it in the empty spot at D-510. That will give you 400 channels instead of 300. For the PRO-2005, the procedure is the same, except you clip one leg of D-502 to restore cellular reception. In the 2004, put a 1N914 diode in D-514 and you'll increase your scan/search speed by 25%. Watch your diode polarity! For the PRO-2005, it's D-501, which is on the display board behind the keyboard. Adding D-504 to the PRO-2005 will DELETE 66-88 MHz coverage -- TV channels, radio control, etc., so don't add D-504!!!! As far as is known, there is no channel expansion capability on the order of the PRO-2004 for the PRO-2005. 400 channels appears to be its limit. The PRO-34 handheld can also have CMT restored, and all can be modified to receive 6,400 channels (3,200 on the PRO-34), but that's beyond the capability of this article. I could have typed in the directions for restoring CMT to the PRO-34, but you really need pictures to go with the modification. The original article was in "Popular Communications." All these are described in great detail in the "Scanner Modification Handbook" by Bill Cheek, available from CRB Research Books, Inc., PO Box 56, Commack, New York, 11725. It's $17.95 + $2.00 postage and handling, but is well worth the price due to the treasure trove of info that's in it. ============================================================================= ANTENNAS: A mobile cellular antenna is usually a short (less than a foot long) piece of stiff wire with a half-dozen or so turns in the middle, like a spring. The "spring" acts as a phasing coil in a 5/8-wave configuration. The antenna is mounted verti cally either through a hole in the vehicle's roof or at the top of the rear windshield using silicone adhesive with conductive plates on either side to pass RF energy right through the glass. It's not quite as efficient as a roof mount, but most folks pr efer not to drill a hole in their Mercedes. A 50-Ohm coaxial cable such as RG-58/U links the antenna to the transceiver with a male TNC-type UHF connector. A ceramic duplexer allows the transmitter and receiver to share the same antenna simultaneously. Mobile roof-mount antennas are designed to work with the ground plane provided by the vehicle's body, but for fixed use an "extended-feed" or voltage-fed coaxial antenna (which requires no ground plane) can be used if there's no tin roof on your house. A capped PVC pipe makes an ideal rooftop housing for this type of antenna, concealing it and making it weatherproof at the same time. As with any kind of antenna, the higher the better--but unless you're surrounded by tall steel buildings any height will probably do (provided you're within range of a cell-site repeater.) It should even work indoors if near a window--remember that cellular systems are designed to work primarily with inefficient antennas at ground-level. Yagi and corner-reflector antenna s are available for fixed use that provide very high gain and directivity. Antenna specialists Co. (216/791-7878) manufactures a broad line of cellular antennas. INTERFACING: Interfacing audio devices such as MF tone-generators to a CMT can be accomplished by coupling the device's output through an audio coupling transformer and capacitor across the control head's microphone wires. If it's available, a schematic diagram will show which CMT bus lines carry the transmit audio; coupling the signal there would be preferable. Acoustic modems can be interfaced acoustically, or by coupling the mic and speaker wires to those on the control head or to the appropriate bu s lines. Direct-connect modems, answering machines, regular and cordless telephones and other devices can be interfaced to a CMT through the AB1X cellular interface manufactured by Morrison & Dempsey Communications (818/993-0195). This compact $300 devi ce is a one-line PBX that connects between the tranceiver and control head and provides an RJ-11C jack that accepts ANY direct-connect telephone accessory. It recognizes Touch-Tone and pulse dialling, provides 1.0B equivalent ringing voltage, and generat es dial and busy tones when appropriate. =============================================================================== How to discover other scanner modifications =============================================================================== HOW TO 'DISCOVER' THOSE NEAT RADIO MODIFICATIONS by Bob Parnass, AJ9S How do the people that discover modifications to radios go about finding them? Good question! The first rule of thumb is to obtain service manuals, as they contain more than just troubleshooting information. For example, the alignment procedure outlined in the Regency K500 and M400 service manuals describes how to circumvent the frequency limit checking firmware, which allows out of band frequency programming. The Uniden 200/205XLT service manual describes a keyboard sequence that clears most of the 200 memory channels, and loads the others with bizarre test frequencies. Service manuals often describe the circuit changes in models intended for export to other countries. This can reveal features disabled for some customers but enabled for others. A good library of IC and semiconductor data books is very helpful, although radio service manuals can also include IC internal diagrams. Old TTL databooks are no longer enough. The transition to surface mount components in radios like the Uniden/Bearcat 760XLT is motivation for acquiring data books for leadless components. Although some modifications involve discovery of "hidden" features, many others involve designing new circuitry or applying old circuitry from another radio. I can't claim credit for many "add/delete a diode" modifications, but here are the factors that accounted for a few other modifications. ***** Recognize Common Radio Circuits ***** Modification: Improve the squelch on the PRO-24, PRO-2004, 800XLT, etc. Motivation: Unsatisfied with stock performance. Almost all modern scanners use MC3357, MC3359, or Japanese pin equivalent chips, which contain the IF, squelch, limiter & discriminator circuitry. Older Bearcat and Regency scanners, like the BC300 and M400, often hid the identity of their IC with "house numbers" painted over them. I compared these ICs pin for pin with the MC3357 and other known radio ICs to unmask their true identity. Having the Motorola IC data sheet and scanner service manuals made learning the chip internals easy, so I found the way to decrease hysteresis involved changing one resistor. ***** Be Curious ***** Modification: Trick the Icom R-71A to tune below 100 kHz. Motivation: Curiosity. Tried manipulating several front panel controls at the same time to see if I could confuse the microprocessor into doing something neat. I did. ***** Study the Schematic, Look for Unused Pins ***** Modification: Double the memory in the R-7000 (also published by another radio hobbyist). Motivation: curiosity. I studied the schematic of the R-7000, and looked up the memory IC in a data book. Icom grounded an address lead, so only 1/2 the chip capacity was used. Not having enough time to try the idea on my own radio, I suggested the idea Jack Albert, who writes the RTTY column in "Monitoring Times", who used his R-7000 as a guinea pig. ***** Borrow Circuits from Other Radio Models ***** Modification: S-meter circuit for Bearcat scanners (unpublished). Motivation: wanted to use scanners for transmitter hunting. I looked for other radios that used the same IF/squelch chip and already featured S-meters (like the Kenwood TR- 2600A, IC-28A, IC228H, etc.) I grafted their S-meter circuitry to my scanners. ***** Vary Parameters and Measure the Impact ***** Modification: Speed up the R-7000 scan rate. Motivation: dissatisfied with stock performance. I studied the radio schematic, found the components that determined scan rate, and substituted various values of resistance, measuring the affect of each change. ***** Apply Simple Theory ***** Modification: COR light for the PRO-2004. Motivation: make scanner easier to use in a roomful of other active radios. Having studied the schematics of many scanners, I was familiar with FM receiver and scanner circuitry. I used service manual and found the proper point in the circuit where a logic level signal was produced depending on whether a signal was absent or present. Again, the PRO-2004 used a popular IF/squelch chip. I used the simplest transistor switching principles to design a COR light circuit. ***** Fashion a Test Harness ***** Marvin Moss used an interesting approach to explore his portable scanner. He wired the diodes in the diode matrix of his Radio Shack PRO-34 to separate DIP switches so he could experiment with switching in and out different combinations of diodes. ***** All That Glitters is Not Gold ***** I always find other peoples' modifications very interesting, although not all are meritorious. For instance, avoid changing the crystal or RC time constant circuitry used as a clock for the microprocessor controller in your receiver. The controller performs many functions, so this alteration can produce undesirable side effects which outweigh any small increase in scan rate. Scanning the 800-900 bands with a a moded PRO-43 and a binary or DTMF decoder (I don't know which yet), can give you a shit load of MIN codes in minutes. If you have an scanner that is older than 92 then most likley you won't have to make any modds at all, to recieve the 800 band and up! A Utility you should have is called "cm-v100.zip", You can get it from digital decay. As you can see this section is seriously lacking if anyone is willing to write an file on it, I want to see it, so post it on digital decay. *Instructions* INSTRUCTIONS FOR PRO-43 CELLULAR RESTORATION 1. Remove the battery pack and cover. 2. Remove the four screws on back and GENTLY pry apart. 3. Remove the 6 silver screws from the 1st PC Board. 4. Remove solder from the ground pad and center feed conductor of the antenna directly under the antenna on the PC Board heat solder on top PC Board and center feed will loosen, this is the only really tricky part to this. 5. Disconnect the 2 plugs/wiring harness, make note of the color scheme for re-installing. Harness has 2-metal guides on the side....BE CAREFUL NOT TO PINCH WIRES. 6. Lift top board away from bottom, paying careful attention the black plug near the bottom of the assembly, gently pry this apart. DO NOT FORCE IT! 7. Remove 2-silver screws from the 2nd PC Board. (remember to replace on re-assembly) 8. Remove solder from the four points on the large silver shield covering the microprocessor board. Remove shield. Make sure to replace shield on re-assembly as this serves as protection from intermod and interference. 9. Near the bottom you will see a row of surface mount diodes (very small and square, approx 1/32" long, black with gray markings) These will be in locations marked D1, D2, D3, D4, D5. Some of the locations are blank. 10.Use a very low temp iron (15-watt) and the smallest solder wick available, remove the solder from both sides of D4. Use hemostats or needle nose (very small) to grip while de soldering. Remove diode D4. 11.Once D4 is removed you will have full 800 MHZ coverage and 30 KHZ spacing on cellular. 12.Save the diode you removed from the D4 position and install it in the D3 position being careful to make sure the diode is facing the same direction it was in the D4 position. This will increase the low band coverage from 30-50 to 30-88 Mhz. 13.Carefully re-assemble unit remembering to double check before going on to next step. USE THIS PROCEDURE AT YOUR OWN RISK!!!! The 800 Mhz reception on the PRO-43 is superb. ============================================================================= Here a few scanners and what it takes to modify them. If your scanner is not shown here, don't worry. Ham Radio BBS's are all over the country. You should be able to find the instructions for modifying your scanner there. Restoration of Cellular Frequency Coverage on Radio Shack PRO-34 Handheld Scanner 1. Remove battery cover and battery, four black screws on rear cover, and volume and squelch knobs. 2. Remove rear cover, lifting back and up to clear controls. Do not remove belt clip or circuit board screws. 3. Unplug the brown volume control connector (grn/yel/blk) and white squelch control connector (wht/blk/red) from the linear circuit board. 4. Unsolder the ground lead from T111 (at corner of linear circuit board above the external power connectors). Unsolder the two power switch leads from the back of the volume control. Unsolder the antenna connector center pin and ground wires from the l 5. Unscrew the four combination screws that hold the linear circuit board and received the back cover screws. Grasp the linear board at the top and lift it straight away from the front case, unplugging the 16-pin connector. 6. Remove the three screws holding the metal frame assembly which held the linear board to the front panel. Unplug the red-black power lead and lay the frame aside. It is still connected to the battery contacts. 7. Locate diodes D9 - D12 on the volume control side of the of the logic circuit board under T1; D10 and D11 are marked. Clip one lead of D11, separating the gap. This may be resoldered later if desired. 8. Reassemble the board by reversing the disassembly procedures above. Restoration of Cellular Frequency Coverage on Radio Shack PRO-2004 Scanner By cutting diode D513 on the PC 3 sub chassis in the Realistic PRO-2004 Scanner you can re-enable the 825.00 to 845.00 and 870-00 to 890.00 frequency selection. To scan in 30KHZ steps press "STEP-RESET". Restoration of Cellular Frequency Coverage on Radio Shack PRO-2005 Scanner 1. Unplug the radio 2. Remove the screws and take off the top cover. 3. Look for D502 on the inside right hand-side of the front panel. (No need to unsolder the silver plate protecting the vertical board!) 4. Simply cut the diode and reverse the process. Aren't you glad I only chose to cover Radio Shack models. I'm sure you appreciate the fact that I only deal with quality merchandise. If you have some cash to blow (like $500), I would recommend buying the ICOM R-1 handheld scanner. It scans from 1 to 1400 in 1/2 step increments and already includes the cellular frequencies. Plus is is about as tall as a box of 3.25 floppies and about as wide as a 16 oz. coke bottle. It is the smallest and one of the more powerful hand-scanners around. *THE 40-50 MHZ CELLULAR SCANNER* The cellular phone freqs. occupy the UHF spectrum previously assign to commercial TV stations. Since a TV channel occupies a Bandwidth(BW) of 6 MHZ and each cellular channel requires 24 KZ (for a plus and minus 12 KHZ signal) and a 3KHZ guard band for each audio signal (thus the 30KHZ spacing). 200 cellular channels can fit into one UHF TV channel. Thus, with a little fine tuning, and old TV set with variable VHF tuning can tune in all cellular freqs. between 824 and 890 MHZ. UHF TV tuners ares designed to convert these UHF freqa. to intermediate (difference) freqs. between 41 and 47 MHZ. Thus, by purchasing a commonly available UHF tuner (check sith a TV shop and try to get a copy of the SAMS for powering the AFC info, and avoid those with tubes). Tuner voltage is usually 8-24 volts, and must be correctly connected up. You should also remove with the tuner, the TV's channel select and fine tuning controls for ease of use - and they should be in good condition. Once you have the tuner, you can then wire it between a 30-50 MHZ scanner and a UHF antenna (highly directional yagi type is preferred). Since the tuner will probably have a 300 ohm input impedance, a twin antenna cable is preferred (Yes Radio Shack has 'em). If you are into directional-finding, the UHF antenna should NOT have AGC (automatic Gain Control) as those with active AGC will amplify reflections, resulting in readings from so many directions that the target will be lost. Because of the use of inconspicuous, commonly available, inexpensive, high-gain UHF antennas, using a good UHF tuner to scan cellular channels is a good method of doing it. Tuner output is usually through an RCA-type plug. CAUTION: BE SURE TO COUPLE YOUR SCANNER TO THE UHF TUNER WITH A 0.01-0.1 mf (50 V min.) CAPACITOR FOR DC BLOCKING. AND DO NOT TRY TO OPERATE THE TUNER THROUGH ITS TV SET AS THE DANGER OF HIGH-VOLTAGE DISCHARGE IS HIGH. Also, connect a ground wire between the tuner and the scanner. The table below describes how cellular freqs. can be downconverted by a commonly available UHF TV tuner (all freqs. are in MHZ) CELLULAR MOBILE FREQS & SCANNER EQUIVALENTS TV BAND CELL. CHAN. SCAN TV OSCIL CHAN. # and FREQ. FREQ. FREQ. LIMIT ----------- ------------ ----- -------- ----- 73 (first) 0001-825.03 45.97 871 824-830 73 (last) 0166-829.98 41.02 871 824-830 74 (first) 0167-830.01 46.99 877 830-836 74 (last) 0366-835.98 41.02 877 830-836 75 (first) 0367-836.01 46.99 883 836-842 75 (last) 0566-841.98 41.02 883 836-842 76 (first) 0567-842.01 46.99 889 842-848 76 (last) 0766-847.98 41.02 889 842-848 77 (first) 0767-848.01 46.99 895 848-854 77 (last) 0799-848.97 46.03 895 848-854 CELLULAR PHONE FREQS. HAVE NOT BEEN ASSIGNED FOR CHANNELS 800-990 73 (first) 0991-824.04 46.96 871 824-830 73 (last) 1023-825.00 46.00 871 824-830 80 (first) 0001-870.03 42.97 913 866-872 80 (last) 0066-871.98 41.02 913 866-972 81 (first) 0067-872.01 46.99 919 872-878 81 (last) 0266-877.98 41.02 919 872-878 82 (first) 0267-878.01 46.99 925 878-884 82 (last) 0466-883.98 41.02 925 878-884 83 (first) 0467-884.01 46.99 931 884-890 83 (last) 0666-889.98 41.02 931 884-890 83 (**) 0667-890.01 46.99 931 884-890 83 (**) 0799-893.97 37.03 931 884-890 CELLULAR PHONE FREQS. HAVE NOT BEEN ASSIGNED FOR CHANNELS 800-990 80 (first) 0991-869.04 43.96 913 866-872 80 (last) 1023-870.00 43.00 913 866-872 (**) These freqs. are outside of the normal Channel 83 BW. However, most UHF tuners have a fine tuner that can be adjusted up to about another 6 MHZ. Note that the term "first" and "last" refers to the first and last cellular channels receivable by the UHF tuner for the given TV channel. Base voice channels are monitored when both sides of the conversation is required. Mobile voice channels or base control channels are monitored to locate a cellular phone. Tuning is simple: (1) Decide which cellular channel or freq. you wish to monitor. (2) Find what UHF channel includes that freq. and switch the TV to that channel. (3) Using the table, look up the corresponding TV oscillator freq. (ex: 919 MHZ for TV channel 81). Subtract the cellular channel freq. from the TV oscillator freq. (4) Tune your scanner to the difference freq. When you select a scanner, you should pick one that will scan in 30 MHZ increments to efficiently receive cellular transmissions. If you can't get one like that, then get one that will scan in 15,10 or 5 KHZ increments. =============================================================================== Cellular phone channel construction =============================================================================== *Amended* Well here are some files on the specifics of how a cellular network works. I sure l wish the that guy wrote this file, also wrote a file on reverse scanning, then I would have a file that made more sense, and were easier to read. Here is a method of determining which frequencies are used in a cellular system, and which ones are in what cells. If the system uses OMNICELLS, as most do, you can readily find all the channels in a cell if you know just one of them, using tables constructed with the instructions below. Cellular frequencies are assigned by channel number, and for all channel numbers, in both wireline and non-wireline systems, the formula is: Transmit Frequency = (channel number x .030 MHz) + 870 MHz Receive Frequency = (channel number x .030 Mhz) + 825 Mhz "Band A" (one of the two blocks) uses channels 1 - 333. To construct a table showing frequency by cells, use channel 333 as the top left corner of a table. The next entry to the right of channel 333 is 332, the next is 331, etc., down to channel 313. Enter channel 312 underneath 333, 311 under 332, etc. Each channel across the top row is the first channel in each CELL of the system; each channel DOWN from the column from the the first channel is the next frequency assigned to that cell. You may have noted that each channel down is 21 channels lower in number. Usually the data channel used is the highest numbered channel in a cell. "Band B" uses channels from 334 to 666. Construct your table in a similar way, with channel 334 in the upper left corner, 335 the next entry to the right. The data channel should be the lowest numbered channel in each cell this time. Cellular Phone Band A (Channel 1 is Data) Cell # 1 -------------------------------------------------- Channel 1 (333) Tx 879.990 Rx 834.990 Channel 2 (312) Tx 879.360 Rx 834.360 Channel 3 (291) Tx 878.730 Rx 833.730 Channel 4 (270) Tx 878.100 Rx 833.100 Channel 5 (249) Tx 877.470 Rx 832.470 Channel 6 (228) Tx 876.840 Rx 831.840 Channel 7 (207) Tx 876.210 Rx 831.210 Channel 8 (186) Tx 875.580 Rx 830.580 Channel 9 (165) Tx 874.950 Rx 829.950 Channel 10 (144) Tx 874.320 Rx 829.320 Channel 11 (123) Tx 873.690 Rx 828.690 Channel 12 (102) Tx 873.060 Rx 828.060 Channel 13 (81) Tx 872.430 Rx 827.430 Channel 14 (60) Tx 871.800 Rx 826.800 Channel 15 (39) Tx 871.170 Rx 826.170 Channel 16 (18) Tx 870.540 Rx 825.540 Cell # 2 -------------------------------------------------- Channel 1 (332) Tx 879.960 Rx 834.960 Channel 2 (311) Tx 879.330 Rx 834.330 Channel 3 (290) Tx 878.700 Rx 833.700 Channel 4 (269) Tx 878.070 Rx 833.070 Channel 5 (248) Tx 877.440 Rx 832.440 Channel 6 (227) Tx 876.810 Rx 831.810 Channel 7 (206) Tx 876.180 Rx 831.180 Channel 8 (185) Tx 875.550 Rx 830.550 Channel 9 (164) Tx 874.920 Rx 829.920 Channel 10 (143) Tx 874.290 Rx 829.290 Channel 11 (122) Tx 873.660 Rx 828.660 Channel 12 (101) Tx 873.030 Rx 828.030 Channel 13 (80) Tx 872.400 Rx 827.400 Channel 14 (59) Tx 871.770 Rx 826.770 Channel 15 (38) Tx 871.140 Rx 826.140 Channel 16 (17) Tx 870.510 Rx 825.510 Cell # 3 -------------------------------------------------- Channel 1 (331) Tx 879.930 Rx 834.930 Channel 2 (310) Tx 879.300 Rx 834.300 Channel 3 (289) Tx 878.670 Rx 833.670 Channel 4 (268) Tx 878.040 Rx 833.040 Channel 5 (247) Tx 877.410 Rx 832.410 Channel 6 (226) Tx 876.780 Rx 831.780 Channel 7 (205) Tx 876.150 Rx 831.150 Channel 8 (184) Tx 875.520 Rx 830.520 Channel 9 (163) Tx 874.890 Rx 829.890 Channel 10 (142) Tx 874.260 Rx 829.260 Channel 11 (121) Tx 873.630 Rx 828.630 Channel 12 (100) Tx 873.000 Rx 828.000 Channel 13 (79) Tx 872.370 Rx 827.370 Channel 14 (58) Tx 871.740 Rx 826.740 Channel 15 (37) Tx 871.110 Rx 826.110 Channel 16 (16) Tx 870.480 Rx 825.480 Cell # 4 -------------------------------------------------- Channel 1 (330) Tx 879.900 Rx 834.900 Channel 2 (309) Tx 879.270 Rx 834.270 Channel 3 (288) Tx 878.640 Rx 833.640 Channel 4 (267) Tx 878.010 Rx 833.010 Channel 5 (246) Tx 877.380 Rx 832.380 Channel 6 (225) Tx 876.750 Rx 831.750 Channel 7 (204) Tx 876.120 Rx 831.120 Channel 8 (183) Tx 875.490 Rx 830.490 Channel 9 (162) Tx 874.860 Rx 829.860 Channel 10 (141) Tx 874.230 Rx 829.230 Channel 11 (120) Tx 873.600 Rx 828.600 Channel 12 (99) Tx 872.970 Rx 827.970 Channel 13 (78) Tx 872.340 Rx 827.340 Channel 14 (57) Tx 871.710 Rx 826.710 Channel 15 (36) Tx 871.080 Rx 826.080 Channel 16 (15) Tx 870.450 Rx 825.450 Cell # 5 -------------------------------------------------- Channel 1 (329) Tx 879.870 Rx 834.870 Channel 2 (308) Tx 879.240 Rx 834.240 Channel 3 (287) Tx 878.610 Rx 833.610 Channel 4 (266) Tx 877.980 Rx 832.980 Channel 5 (245) Tx 877.350 Rx 832.350 Channel 6 (224) Tx 876.720 Rx 831.720 Channel 7 (203) Tx 876.090 Rx 831.090 Channel 8 (182) Tx 875.460 Rx 830.460 Channel 9 (161) Tx 874.830 Rx 829.830 Channel 10 (140) Tx 874.200 Rx 829.200 Channel 11 (119) Tx 873.570 Rx 828.570 Channel 12 (98) Tx 872.940 Rx 827.940 Channel 13 (77) Tx 872.310 Rx 827.310 Channel 14 (56) Tx 871.680 Rx 826.680 Channel 15 (35) Tx 871.050 Rx 826.050 Channel 16 (14) Tx 870.420 Rx 825.420 Cell # 6 -------------------------------------------------- Channel 1 (328) Tx 879.840 Rx 834.840 Channel 2 (307) Tx 879.210 Rx 834.210 Channel 3 (286) Tx 878.580 Rx 833.580 Channel 4 (265) Tx 877.950 Rx 832.950 Channel 5 (244) Tx 877.320 Rx 832.320 Channel 6 (223) Tx 876.690 Rx 831.690 Channel 7 (202) Tx 876.060 Rx 831.060 Channel 8 (181) Tx 875.430 Rx 830.430 Channel 9 (160) Tx 874.800 Rx 829.800 Channel 10 (139) Tx 874.170 Rx 829.170 Channel 11 (118) Tx 873.540 Rx 828.540 Channel 12 (97) Tx 872.910 Rx 827.910 Channel 13 (76) Tx 872.280 Rx 827.280 Channel 14 (55) Tx 871.650 Rx 826.650 Channel 15 (34) Tx 871.020 Rx 826.020 Channel 16 (13) Tx 870.390 Rx 825.390 Cell # 7 -------------------------------------------------- Channel 1 (327) Tx 879.810 Rx 834.810 Channel 2 (306) Tx 879.180 Rx 834.180 Channel 3 (285) Tx 878.550 Rx 833.550 Channel 4 (264) Tx 877.920 Rx 832.920 Channel 5 (243) Tx 877.290 Rx 832.290 Channel 6 (222) Tx 876.660 Rx 831.660 Channel 7 (201) Tx 876.030 Rx 831.030 Channel 8 (180) Tx 875.400 Rx 830.400 Channel 9 (159) Tx 874.770 Rx 829.770 Channel 10 (138) Tx 874.140 Rx 829.140 Channel 11 (117) Tx 873.510 Rx 828.510 Channel 12 (96) Tx 872.880 Rx 827.880 Channel 13 (75) Tx 872.250 Rx 827.250 Channel 14 (54) Tx 871.620 Rx 826.620 Channel 15 (33) Tx 870.990 Rx 825.990 Channel 16 (12) Tx 870.360 Rx 825.360 Cell # 8 -------------------------------------------------- Channel 1 (326) Tx 879.780 Rx 834.780 Channel 2 (305) Tx 879.150 Rx 834.150 Channel 3 (284) Tx 878.520 Rx 833.520 Channel 4 (263) Tx 877.890 Rx 832.890 Channel 5 (242) Tx 877.260 Rx 832.260 Channel 6 (221) Tx 876.630 Rx 831.630 Channel 7 (200) Tx 876.000 Rx 831.000 Channel 8 (179) Tx 875.370 Rx 830.370 Channel 9 (158) Tx 874.740 Rx 829.740 Channel 10 (137) Tx 874.110 Rx 829.110 Channel 11 (116) Tx 873.480 Rx 828.480 Channel 12 (95) Tx 872.850 Rx 827.850 Channel 13 (74) Tx 872.220 Rx 827.220 Channel 14 (53) Tx 871.590 Rx 826.590 Channel 15 (32) Tx 870.960 Rx 825.960 Channel 16 (11) Tx 870.330 Rx 825.330 Cell # 9 -------------------------------------------------- Channel 1 (325) Tx 879.750 Rx 834.750 Channel 2 (304) Tx 879.120 Rx 834.120 Channel 3 (283) Tx 878.490 Rx 833.490 Channel 4 (262) Tx 877.860 Rx 832.860 Channel 5 (241) Tx 877.230 Rx 832.230 Channel 6 (220) Tx 876.600 Rx 831.600 Channel 7 (199) Tx 875.970 Rx 830.970 Channel 8 (178) Tx 875.340 Rx 830.340 Channel 9 (157) Tx 874.710 Rx 829.710 Channel 10 (136) Tx 874.080 Rx 829.080 Channel 11 (115) Tx 873.450 Rx 828.450 Channel 12 (94) Tx 872.820 Rx 827.820 Channel 13 (73) Tx 872.190 Rx 827.190 Channel 14 (52) Tx 871.560 Rx 826.560 Channel 15 (31) Tx 870.930 Rx 825.930 Channel 16 (10) Tx 870.300 Rx 825.300 Cell # 10 -------------------------------------------------- Channel 1 (324) Tx 879.720 Rx 834.720 Channel 2 (303) Tx 879.090 Rx 834.090 Channel 3 (282) Tx 878.460 Rx 833.460 Channel 4 (261) Tx 877.830 Rx 832.830 Channel 5 (240) Tx 877.200 Rx 832.200 Channel 6 (219) Tx 876.570 Rx 831.570 Channel 7 (198) Tx 875.940 Rx 830.940 Channel 8 (177) Tx 875.310 Rx 830.310 Channel 9 (156) Tx 874.680 Rx 829.680 Channel 10 (135) Tx 874.050 Rx 829.050 Channel 11 (114) Tx 873.420 Rx 828.420 Channel 12 (93) Tx 872.790 Rx 827.790 Channel 13 (72) Tx 872.160 Rx 827.160 Channel 14 (51) Tx 871.530 Rx 826.530 Channel 15 (30) Tx 870.900 Rx 825.900 Channel 16 (9) Tx 870.270 Rx 825.270 Cell # 11 -------------------------------------------------- Channel 1 (323) Tx 879.690 Rx 834.690 Channel 2 (302) Tx 879.060 Rx 834.060 Channel 3 (281) Tx 878.430 Rx 833.430 Channel 4 (260) Tx 877.800 Rx 832.800 Channel 5 (239) Tx 877.170 Rx 832.170 Channel 6 (218) Tx 876.540 Rx 831.540 Channel 7 (197) Tx 875.910 Rx 830.910 Channel 8 (176) Tx 875.280 Rx 830.280 Channel 9 (155) Tx 874.650 Rx 829.650 Channel 10 (134) Tx 874.020 Rx 829.020 Channel 11 (113) Tx 873.390 Rx 828.390 Channel 12 (92) Tx 872.760 Rx 827.760 Channel 13 (71) Tx 872.130 Rx 827.130 Channel 14 (50) Tx 871.500 Rx 826.500 Channel 15 (29) Tx 870.870 Rx 825.870 Channel 16 (8) Tx 870.240 Rx 825.240 Cell # 12 -------------------------------------------------- Channel 1 (322) Tx 879.660 Rx 834.660 Channel 2 (301) Tx 879.030 Rx 834.030 Channel 3 (280) Tx 878.400 Rx 833.400 Channel 4 (259) Tx 877.770 Rx 832.770 Channel 5 (238) Tx 877.140 Rx 832.140 Channel 6 (217) Tx 876.510 Rx 831.510 Channel 7 (196) Tx 875.880 Rx 830.880 Channel 8 (175) Tx 875.250 Rx 830.250 Channel 9 (154) Tx 874.620 Rx 829.620 Channel 10 (133) Tx 873.990 Rx 828.990 Channel 11 (112) Tx 873.360 Rx 828.360 Channel 12 (91) Tx 872.730 Rx 827.730 Channel 13 (70) Tx 872.100 Rx 827.100 Channel 14 (49) Tx 871.470 Rx 826.470 Channel 15 (28) Tx 870.840 Rx 825.840 Channel 16 (7) Tx 870.210 Rx 825.210 Cell # 13 -------------------------------------------------- Channel 1 (321) Tx 879.630 Rx 834.630 Channel 2 (300) Tx 879.000 Rx 834.000 Channel 3 (279) Tx 878.370 Rx 833.370 Channel 4 (258) Tx 877.740 Rx 832.740 Channel 5 (237) Tx 877.110 Rx 832.110 Channel 6 (216) Tx 876.480 Rx 831.480 Channel 7 (195) Tx 875.850 Rx 830.850 Channel 8 (174) Tx 875.220 Rx 830.220 Channel 9 (153) Tx 874.590 Rx 829.590 Channel 10 (132) Tx 873.960 Rx 828.960 Channel 11 (111) Tx 873.330 Rx 828.330 Channel 12 (90) Tx 872.700 Rx 827.700 Channel 13 (69) Tx 872.070 Rx 827.070 Channel 14 (48) Tx 871.440 Rx 826.440 Channel 15 (27) Tx 870.810 Rx 825.810 Channel 16 (6) Tx 870.180 Rx 825.180 Cell # 14 -------------------------------------------------- Channel 1 (320) Tx 879.600 Rx 834.600 Channel 2 (299) Tx 878.970 Rx 833.970 Channel 3 (278) Tx 878.340 Rx 833.340 Channel 4 (257) Tx 877.710 Rx 832.710 Channel 5 (236) Tx 877.080 Rx 832.080 Channel 6 (215) Tx 876.450 Rx 831.450 Channel 7 (194) Tx 875.820 Rx 830.820 Channel 8 (173) Tx 875.190 Rx 830.190 Channel 9 (152) Tx 874.560 Rx 829.560 Channel 10 (131) Tx 873.930 Rx 828.930 Channel 11 (110) Tx 873.300 Rx 828.300 Channel 12 (89) Tx 872.670 Rx 827.670 Channel 13 (68) Tx 872.040 Rx 827.040 Channel 14 (47) Tx 871.410 Rx 826.410 Channel 15 (26) Tx 870.780 Rx 825.780 Channel 16 (5) Tx 870.150 Rx 825.150 Cell # 15 -------------------------------------------------- Channel 1 (319) Tx 879.570 Rx 834.570 Channel 2 (298) Tx 878.940 Rx 833.940 Channel 3 (277) Tx 878.310 Rx 833.310 Channel 4 (256) Tx 877.680 Rx 832.680 Channel 5 (235) Tx 877.050 Rx 832.050 Channel 6 (214) Tx 876.420 Rx 831.420 Channel 7 (193) Tx 875.790 Rx 830.790 Channel 8 (172) Tx 875.160 Rx 830.160 Channel 9 (151) Tx 874.530 Rx 829.530 Channel 10 (130) Tx 873.900 Rx 828.900 Channel 11 (109) Tx 873.270 Rx 828.270 Channel 12 (88) Tx 872.640 Rx 827.640 Channel 13 (67) Tx 872.010 Rx 827.010 Channel 14 (46) Tx 871.380 Rx 826.380 Channel 15 (25) Tx 870.750 Rx 825.750 Channel 16 (4) Tx 870.120 Rx 825.120 Cell # 16 -------------------------------------------------- Channel 1 (318) Tx 879.540 Rx 834.540 Channel 2 (297) Tx 878.910 Rx 833.910 Channel 3 (276) Tx 878.280 Rx 833.280 Channel 4 (255) Tx 877.650 Rx 832.650 Channel 5 (234) Tx 877.020 Rx 832.020 Channel 6 (213) Tx 876.390 Rx 831.390 Channel 7 (192) Tx 875.760 Rx 830.760 Channel 8 (171) Tx 875.130 Rx 830.130 Channel 9 (150) Tx 874.500 Rx 829.500 Channel 10 (129) Tx 873.870 Rx 828.870 Channel 11 (108) Tx 873.240 Rx 828.240 Channel 12 (87) Tx 872.610 Rx 827.610 Channel 13 (66) Tx 871.980 Rx 826.980 Channel 14 (45) Tx 871.350 Rx 826.350 Channel 15 (24) Tx 870.720 Rx 825.720 Channel 16 (3) Tx 870.090 Rx 825.090 Cell # 17 -------------------------------------------------- Channel 1 (317) Tx 879.510 Rx 834.510 Channel 2 (296) Tx 878.880 Rx 833.880 Channel 3 (275) Tx 878.250 Rx 833.250 Channel 4 (254) Tx 877.620 Rx 832.620 Channel 5 (233) Tx 876.990 Rx 831.990 Channel 6 (212) Tx 876.360 Rx 831.360 Channel 7 (191) Tx 875.730 Rx 830.730 Channel 8 (170) Tx 875.100 Rx 830.100 Channel 9 (149) Tx 874.470 Rx 829.470 Channel 10 (128) Tx 873.840 Rx 828.840 Channel 11 (107) Tx 873.210 Rx 828.210 Channel 12 (86) Tx 872.580 Rx 827.580 Channel 13 (65) Tx 871.950 Rx 826.950 Channel 14 (44) Tx 871.320 Rx 826.320 Channel 15 (23) Tx 870.690 Rx 825.690 Channel 16 (2) Tx 870.060 Rx 825.060 Cell # 18 -------------------------------------------------- Channel 1 (316) Tx 879.480 Rx 834.480 Channel 2 (295) Tx 878.850 Rx 833.850 Channel 3 (274) Tx 878.220 Rx 833.220 Channel 4 (253) Tx 877.590 Rx 832.590 Channel 5 (232) Tx 876.960 Rx 831.960 Channel 6 (211) Tx 876.330 Rx 831.330 Channel 7 (190) Tx 875.700 Rx 830.700 Channel 8 (169) Tx 875.070 Rx 830.070 Channel 9 (148) Tx 874.440 Rx 829.440 Channel 10 (127) Tx 873.810 Rx 828.810 Channel 11 (106) Tx 873.180 Rx 828.180 Channel 12 (85) Tx 872.550 Rx 827.550 Channel 13 (64) Tx 871.920 Rx 826.920 Channel 14 (43) Tx 871.290 Rx 826.290 Channel 15 (22) Tx 870.660 Rx 825.660 Channel 16 (1) Tx 870.030 Rx 825.030 Cell # 19 -------------------------------------------------- Channel 1 (315) Tx 879.450 Rx 834.450 Channel 2 (294) Tx 878.820 Rx 833.820 Channel 3 (273) Tx 878.190 Rx 833.190 Channel 4 (252) Tx 877.560 Rx 832.560 Channel 5 (231) Tx 876.930 Rx 831.930 Channel 6 (210) Tx 876.300 Rx 831.300 Channel 7 (189) Tx 875.670 Rx 830.670 Channel 8 (168) Tx 875.040 Rx 830.040 Channel 9 (147) Tx 874.410 Rx 829.410 Channel 10 (126) Tx 873.780 Rx 828.780 Channel 11 (105) Tx 873.150 Rx 828.150 Channel 12 (84) Tx 872.520 Rx 827.520 Channel 13 (63) Tx 871.890 Rx 826.890 Channel 14 (42) Tx 871.260 Rx 826.260 Channel 15 (21) Tx 870.630 Rx 825.630 Cell # 20 -------------------------------------------------- Channel 1 (314) Tx 879.420 Rx 834.420 Channel 2 (293) Tx 878.790 Rx 833.790 Channel 3 (272) Tx 878.160 Rx 833.160 Channel 4 (251) Tx 877.530 Rx 832.530 Channel 5 (230) Tx 876.900 Rx 831.900 Channel 6 (209) Tx 876.270 Rx 831.270 Channel 7 (188) Tx 875.640 Rx 830.640 Channel 8 (167) Tx 875.010 Rx 830.010 Channel 9 (146) Tx 874.380 Rx 829.380 Channel 10 (125) Tx 873.750 Rx 828.750 Channel 11 (104) Tx 873.120 Rx 828.120 Channel 12 (83) Tx 872.490 Rx 827.490 Channel 13 (62) Tx 871.860 Rx 826.860 Channel 14 (41) Tx 871.230 Rx 826.230 Channel 15 (20) Tx 870.600 Rx 825.600 Cell # 21 -------------------------------------------------- Channel 1 (313) Tx 879.390 Rx 834.390 Channel 2 (292) Tx 878.760 Rx 833.760 Channel 3 (271) Tx 878.130 Rx 833.130 Channel 4 (250) Tx 877.500 Rx 832.500 Channel 5 (229) Tx 876.870 Rx 831.870 Channel 6 (208) Tx 876.240 Rx 831.240 Channel 7 (187) Tx 875.610 Rx 830.610 Channel 8 (166) Tx 874.980 Rx 829.980 Channel 9 (145) Tx 874.350 Rx 829.350 Channel 10 (124) Tx 873.720 Rx 828.720 Channel 11 (103) Tx 873.090 Rx 828.090 Channel 12 (82) Tx 872.460 Rx 827.460 Channel 13 (61) Tx 871.830 Rx 826.830 Channel 14 (40) Tx 871.200 Rx 826.200 Channel 15 (19) Tx 870.570 Rx 825.570 ************************************************** Cellular Phone Band B (Channel 1 is Data) Cell # 1 -------------------------------------------------- Channel 1 (334) Tx 880.020 Rx 835.020 Channel 2 (355) Tx 880.650 Rx 835.650 Channel 3 (376) Tx 881.280 Rx 836.280 Channel 4 (397) Tx 881.910 Rx 836.910 Channel 5 (418) Tx 882.540 Rx 837.540 Channel 6 (439) Tx 883.170 Rx 838.170 Channel 7 (460) Tx 883.800 Rx 838.800 Channel 8 (481) Tx 884.430 Rx 839.430 Channel 9 (502) Tx 885.060 Rx 840.060 Channel 10 (523) Tx 885.690 Rx 840.690 Channel 11 (544) Tx 886.320 Rx 841.320 Channel 12 (565) Tx 886.950 Rx 841.950 Channel 13 (586) Tx 887.580 Rx 842.580 Channel 14 (607) Tx 888.210 Rx 843.210 Channel 15 (628) Tx 888.840 Rx 843.840 Channel 16 (649) Tx 889.470 Rx 844.470 Cell # 2 -------------------------------------------------- Channel 1 (335) Tx 880.050 Rx 835.050 Channel 2 (356) Tx 880.680 Rx 835.680 Channel 3 (377) Tx 881.310 Rx 836.310 Channel 4 (398) Tx 881.940 Rx 836.940 Channel 5 (419) Tx 882.570 Rx 837.570 Channel 6 (440) Tx 883.200 Rx 838.200 Channel 7 (461) Tx 883.830 Rx 838.830 Channel 8 (482) Tx 884.460 Rx 839.460 Channel 9 (503) Tx 885.090 Rx 840.090 Channel 10 (524) Tx 885.720 Rx 840.720 Channel 11 (545) Tx 886.350 Rx 841.350 Channel 12 (566) Tx 886.980 Rx 841.980 Channel 13 (587) Tx 887.610 Rx 842.610 Channel 14 (608) Tx 888.240 Rx 843.240 Channel 15 (629) Tx 888.870 Rx 843.870 Channel 16 (650) Tx 889.500 Rx 844.500 Cell # 3 -------------------------------------------------- Channel 1 (336) Tx 880.080 Rx 835.080 Channel 2 (357) Tx 880.710 Rx 835.710 Channel 3 (378) Tx 881.340 Rx 836.340 Channel 4 (399) Tx 881.970 Rx 836.970 Channel 5 (420) Tx 882.600 Rx 837.600 Channel 6 (441) Tx 883.230 Rx 838.230 Channel 7 (462) Tx 883.860 Rx 838.860 Channel 8 (483) Tx 884.490 Rx 839.490 Channel 9 (504) Tx 885.120 Rx 840.120 Channel 10 (525) Tx 885.750 Rx 840.750 Channel 11 (546) Tx 886.380 Rx 841.380 Channel 12 (567) Tx 887.010 Rx 842.010 Channel 13 (588) Tx 887.640 Rx 842.640 Channel 14 (609) Tx 888.270 Rx 843.270 Channel 15 (630) Tx 888.900 Rx 843.900 Channel 16 (651) Tx 889.530 Rx 844.530 Cell # 4 -------------------------------------------------- Channel 1 (337) Tx 880.110 Rx 835.110 Channel 2 (358) Tx 880.740 Rx 835.740 Channel 3 (379) Tx 881.370 Rx 836.370 Channel 4 (400) Tx 882.000 Rx 837.000 Channel 5 (421) Tx 882.630 Rx 837.630 Channel 6 (442) Tx 883.260 Rx 838.260 Channel 7 (463) Tx 883.890 Rx 838.890 Channel 8 (484) Tx 884.520 Rx 839.520 Channel 9 (505) Tx 885.150 Rx 840.150 Channel 10 (526) Tx 885.780 Rx 840.780 Channel 11 (547) Tx 886.410 Rx 841.410 Channel 12 (568) Tx 887.040 Rx 842.040 Channel 13 (589) Tx 887.670 Rx 842.670 Channel 14 (610) Tx 888.300 Rx 843.300 Channel 15 (631) Tx 888.930 Rx 843.930 Channel 16 (652) Tx 889.560 Rx 844.560 Cell # 5 -------------------------------------------------- Channel 1 (338) Tx 880.140 Rx 835.140 Channel 2 (359) Tx 880.770 Rx 835.770 Channel 3 (380) Tx 881.400 Rx 836.400 Channel 4 (401) Tx 882.030 Rx 837.030 Channel 5 (422) Tx 882.660 Rx 837.660 Channel 6 (443) Tx 883.290 Rx 838.290 Channel 7 (464) Tx 883.920 Rx 838.920 Channel 8 (485) Tx 884.550 Rx 839.550 Channel 9 (506) Tx 885.180 Rx 840.180 Channel 10 (527) Tx 885.810 Rx 840.810 Channel 11 (548) Tx 886.440 Rx 841.440 Channel 12 (569) Tx 887.070 Rx 842.070 Channel 13 (590) Tx 887.700 Rx 842.700 Channel 14 (611) Tx 888.330 Rx 843.330 Channel 15 (632) Tx 888.960 Rx 843.960 Channel 16 (653) Tx 889.590 Rx 844.590 Cell # 6 -------------------------------------------------- Channel 1 (339) Tx 880.170 Rx 835.170 Channel 2 (360) Tx 880.800 Rx 835.800 Channel 3 (381) Tx 881.430 Rx 836.430 Channel 4 (402) Tx 882.060 Rx 837.060 Channel 5 (423) Tx 882.690 Rx 837.690 Channel 6 (444) Tx 883.320 Rx 838.320 Channel 7 (465) Tx 883.950 Rx 838.950 Channel 8 (486) Tx 884.580 Rx 839.580 Channel 9 (507) Tx 885.210 Rx 840.210 Channel 10 (528) Tx 885.840 Rx 840.840 Channel 11 (549) Tx 886.470 Rx 841.470 Channel 12 (570) Tx 887.100 Rx 842.100 Channel 13 (591) Tx 887.730 Rx 842.730 Channel 14 (612) Tx 888.360 Rx 843.360 Channel 15 (633) Tx 888.990 Rx 843.990 Channel 16 (654) Tx 889.620 Rx 844.620 Cell # 7 -------------------------------------------------- Channel 1 (340) Tx 880.200 Rx 835.200 Channel 2 (361) Tx 880.830 Rx 835.830 Channel 3 (382) Tx 881.460 Rx 836.460 Channel 4 (403) Tx 882.090 Rx 837.090 Channel 5 (424) Tx 882.720 Rx 837.720 Channel 6 (445) Tx 883.350 Rx 838.350 Channel 7 (466) Tx 883.980 Rx 838.980 Channel 8 (487) Tx 884.610 Rx 839.610 Channel 9 (508) Tx 885.240 Rx 840.240 Channel 10 (529) Tx 885.870 Rx 840.870 Channel 11 (550) Tx 886.500 Rx 841.500 Channel 12 (571) Tx 887.130 Rx 842.130 Channel 13 (592) Tx 887.760 Rx 842.760 Channel 14 (613) Tx 888.390 Rx 843.390 Channel 15 (634) Tx 889.020 Rx 844.020 Channel 16 (655) Tx 889.650 Rx 844.650 Cell # 8 -------------------------------------------------- Channel 1 (341) Tx 880.230 Rx 835.230 Channel 2 (362) Tx 880.860 Rx 835.860 Channel 3 (383) Tx 881.490 Rx 836.490 Channel 4 (404) Tx 882.120 Rx 837.120 Channel 5 (425) Tx 882.750 Rx 837.750 Channel 6 (446) Tx 883.380 Rx 838.380 Channel 7 (467) Tx 884.010 Rx 839.010 Channel 8 (488) Tx 884.640 Rx 839.640 Channel 9 (509) Tx 885.270 Rx 840.270 Channel 10 (530) Tx 885.900 Rx 840.900 Channel 11 (551) Tx 886.530 Rx 841.530 Channel 12 (572) Tx 887.160 Rx 842.160 Channel 13 (593) Tx 887.790 Rx 842.790 Channel 14 (614) Tx 888.420 Rx 843.420 Channel 15 (635) Tx 889.050 Rx 844.050 Channel 16 (656) Tx 889.680 Rx 844.680 Cell # 9 -------------------------------------------------- Channel 1 (342) Tx 880.260 Rx 835.260 Channel 2 (363) Tx 880.890 Rx 835.890 Channel 3 (384) Tx 881.520 Rx 836.520 Channel 4 (405) Tx 882.150 Rx 837.150 Channel 5 (426) Tx 882.780 Rx 837.780 Channel 6 (447) Tx 883.410 Rx 838.410 Channel 7 (468) Tx 884.040 Rx 839.040 Channel 8 (489) Tx 884.670 Rx 839.670 Channel 9 (510) Tx 885.300 Rx 840.300 Channel 10 (531) Tx 885.930 Rx 840.930 Channel 11 (552) Tx 886.560 Rx 841.560 Channel 12 (573) Tx 887.190 Rx 842.190 Channel 13 (594) Tx 887.820 Rx 842.820 Channel 14 (615) Tx 888.450 Rx 843.450 Channel 15 (636) Tx 889.080 Rx 844.080 Channel 16 (657) Tx 889.710 Rx 844.710 Cell # 10 -------------------------------------------------- Channel 1 (343) Tx 880.290 Rx 835.290 Channel 2 (364) Tx 880.920 Rx 835.920 Channel 3 (385) Tx 881.550 Rx 836.550 Channel 4 (406) Tx 882.180 Rx 837.180 Channel 5 (427) Tx 882.810 Rx 837.810 Channel 6 (448) Tx 883.440 Rx 838.440 Channel 7 (469) Tx 884.070 Rx 839.070 Channel 8 (490) Tx 884.700 Rx 839.700 Channel 9 (511) Tx 885.330 Rx 840.330 Channel 10 (532) Tx 885.960 Rx 840.960 Channel 11 (553) Tx 886.590 Rx 841.590 Channel 12 (574) Tx 887.220 Rx 842.220 Channel 13 (595) Tx 887.850 Rx 842.850 Channel 14 (616) Tx 888.480 Rx 843.480 Channel 15 (637) Tx 889.110 Rx 844.110 Channel 16 (658) Tx 889.740 Rx 844.740 Cell # 11 -------------------------------------------------- Channel 1 (344) Tx 880.320 Rx 835.320 Channel 2 (365) Tx 880.950 Rx 835.950 Channel 3 (386) Tx 881.580 Rx 836.580 Channel 4 (407) Tx 882.210 Rx 837.210 Channel 5 (428) Tx 882.840 Rx 837.840 Channel 6 (449) Tx 883.470 Rx 838.470 Channel 7 (470) Tx 884.100 Rx 839.100 Channel 8 (491) Tx 884.730 Rx 839.730 Channel 9 (512) Tx 885.360 Rx 840.360 Channel 10 (533) Tx 885.990 Rx 840.990 Channel 11 (554) Tx 886.620 Rx 841.620 Channel 12 (575) Tx 887.250 Rx 842.250 Channel 13 (596) Tx 887.880 Rx 842.880 Channel 14 (617) Tx 888.510 Rx 843.510 Channel 15 (638) Tx 889.140 Rx 844.140 Channel 16 (659) Tx 889.770 Rx 844.770 Cell # 12 -------------------------------------------------- Channel 1 (345) Tx 880.350 Rx 835.350 Channel 2 (366) Tx 880.980 Rx 835.980 Channel 3 (387) Tx 881.610 Rx 836.610 Channel 4 (408) Tx 882.240 Rx 837.240 Channel 5 (429) Tx 882.870 Rx 837.870 Channel 6 (450) Tx 883.500 Rx 838.500 Channel 7 (471) Tx 884.130 Rx 839.130 Channel 8 (492) Tx 884.760 Rx 839.760 Channel 9 (513) Tx 885.390 Rx 840.390 Channel 10 (534) Tx 886.020 Rx 841.020 Channel 11 (555) Tx 886.650 Rx 841.650 Channel 12 (576) Tx 887.280 Rx 842.280 Channel 13 (597) Tx 887.910 Rx 842.910 Channel 14 (618) Tx 888.540 Rx 843.540 Channel 15 (639) Tx 889.170 Rx 844.170 Channel 16 (660) Tx 889.800 Rx 844.800 Cell # 13 -------------------------------------------------- Channel 1 (346) Tx 880.380 Rx 835.380 Channel 2 (367) Tx 881.010 Rx 836.010 Channel 3 (388) Tx 881.640 Rx 836.640 Channel 4 (409) Tx 882.270 Rx 837.270 Channel 5 (430) Tx 882.900 Rx 837.900 Channel 6 (451) Tx 883.530 Rx 838.530 Channel 7 (472) Tx 884.160 Rx 839.160 Channel 8 (493) Tx 884.790 Rx 839.790 Channel 9 (514) Tx 885.420 Rx 840.420 Channel 10 (535) Tx 886.050 Rx 841.050 Channel 11 (556) Tx 886.680 Rx 841.680 Channel 12 (577) Tx 887.310 Rx 842.310 Channel 13 (598) Tx 887.940 Rx 842.940 Channel 14 (619) Tx 888.570 Rx 843.570 Channel 15 (640) Tx 889.200 Rx 844.200 Channel 16 (661) Tx 889.830 Rx 844.830 Cell # 14 -------------------------------------------------- Channel 1 (347) Tx 880.410 Rx 835.410 Channel 2 (368) Tx 881.040 Rx 836.040 Channel 3 (389) Tx 881.670 Rx 836.670 Channel 4 (410) Tx 882.300 Rx 837.300 Channel 5 (431) Tx 882.930 Rx 837.930 Channel 6 (452) Tx 883.560 Rx 838.560 Channel 7 (473) Tx 884.190 Rx 839.190 Channel 8 (494) Tx 884.820 Rx 839.820 Channel 9 (515) Tx 885.450 Rx 840.450 Channel 10 (536) Tx 886.080 Rx 841.080 Channel 11 (557) Tx 886.710 Rx 841.710 Channel 12 (578) Tx 887.340 Rx 842.340 Channel 13 (599) Tx 887.970 Rx 842.970 Channel 14 (620) Tx 888.600 Rx 843.600 Channel 15 (641) Tx 889.230 Rx 844.230 Channel 16 (662) Tx 889.860 Rx 844.860 Cell # 15 -------------------------------------------------- Channel 1 (348) Tx 880.440 Rx 835.440 Channel 2 (369) Tx 881.070 Rx 836.070 Channel 3 (390) Tx 881.700 Rx 836.700 Channel 4 (411) Tx 882.330 Rx 837.330 Channel 5 (432) Tx 882.960 Rx 837.960 Channel 6 (453) Tx 883.590 Rx 838.590 Channel 7 (474) Tx 884.220 Rx 839.220 Channel 8 (495) Tx 884.850 Rx 839.850 Channel 9 (516) Tx 885.480 Rx 840.480 Channel 10 (537) Tx 886.110 Rx 841.110 Channel 11 (558) Tx 886.740 Rx 841.740 Channel 12 (579) Tx 887.370 Rx 842.370 Channel 13 (600) Tx 888.000 Rx 843.000 Channel 14 (621) Tx 888.630 Rx 843.630 Channel 15 (642) Tx 889.260 Rx 844.260 Channel 16 (663) Tx 889.890 Rx 844.890 Cell # 16 -------------------------------------------------- Channel 1 (349) Tx 880.470 Rx 835.470 Channel 2 (370) Tx 881.100 Rx 836.100 Channel 3 (391) Tx 881.730 Rx 836.730 Channel 4 (412) Tx 882.360 Rx 837.360 Channel 5 (433) Tx 882.990 Rx 837.990 Channel 6 (454) Tx 883.620 Rx 838.620 Channel 7 (475) Tx 884.250 Rx 839.250 Channel 8 (496) Tx 884.880 Rx 839.880 Channel 9 (517) Tx 885.510 Rx 840.510 Channel 10 (538) Tx 886.140 Rx 841.140 Channel 11 (559) Tx 886.770 Rx 841.770 Channel 12 (580) Tx 887.400 Rx 842.400 Channel 13 (601) Tx 888.030 Rx 843.030 Channel 14 (622) Tx 888.660 Rx 843.660 Channel 15 (643) Tx 889.290 Rx 844.290 Channel 16 (664) Tx 889.920 Rx 844.920 Cell # 17 -------------------------------------------------- Channel 1 (350) Tx 880.500 Rx 835.500 Channel 2 (371) Tx 881.130 Rx 836.130 Channel 3 (392) Tx 881.760 Rx 836.760 Channel 4 (413) Tx 882.390 Rx 837.390 Channel 5 (434) Tx 883.020 Rx 838.020 Channel 6 (455) Tx 883.650 Rx 838.650 Channel 7 (476) Tx 884.280 Rx 839.280 Channel 8 (497) Tx 884.910 Rx 839.910 Channel 9 (518) Tx 885.540 Rx 840.540 Channel 10 (539) Tx 886.170 Rx 841.170 Channel 11 (560) Tx 886.800 Rx 841.800 Channel 12 (581) Tx 887.430 Rx 842.430 Channel 13 (602) Tx 888.060 Rx 843.060 Channel 14 (623) Tx 888.690 Rx 843.690 Channel 15 (644) Tx 889.320 Rx 844.320 Channel 16 (665) Tx 889.950 Rx 844.950 Cell # 18 -------------------------------------------------- Channel 1 (351) Tx 880.530 Rx 835.530 Channel 2 (372) Tx 881.160 Rx 836.160 Channel 3 (393) Tx 881.790 Rx 836.790 Channel 4 (414) Tx 882.420 Rx 837.420 Channel 5 (435) Tx 883.050 Rx 838.050 Channel 6 (456) Tx 883.680 Rx 838.680 Channel 7 (477) Tx 884.310 Rx 839.310 Channel 8 (498) Tx 884.940 Rx 839.940 Channel 9 (519) Tx 885.570 Rx 840.570 Channel 10 (540) Tx 886.200 Rx 841.200 Channel 11 (561) Tx 886.830 Rx 841.830 Channel 12 (582) Tx 887.460 Rx 842.460 Channel 13 (603) Tx 888.090 Rx 843.090 Channel 14 (624) Tx 888.720 Rx 843.720 Channel 15 (645) Tx 889.350 Rx 844.350 Channel 16 (666) Tx 889.980 Rx 844.980 Cell # 19 -------------------------------------------------- Channel 1 (352) Tx 880.560 Rx 835.560 Channel 2 (373) Tx 881.190 Rx 836.190 Channel 3 (394) Tx 881.820 Rx 836.820 Channel 4 (415) Tx 882.450 Rx 837.450 Channel 5 (436) Tx 883.080 Rx 838.080 Channel 6 (457) Tx 883.710 Rx 838.710 Channel 7 (478) Tx 884.340 Rx 839.340 Channel 8 (499) Tx 884.970 Rx 839.970 Channel 9 (520) Tx 885.600 Rx 840.600 Channel 10 (541) Tx 886.230 Rx 841.230 Channel 11 (562) Tx 886.860 Rx 841.860 Channel 12 (583) Tx 887.490 Rx 842.490 Channel 13 (604) Tx 888.120 Rx 843.120 Channel 14 (625) Tx 888.750 Rx 843.750 Channel 15 (646) Tx 889.380 Rx 844.380 Cell # 20 -------------------------------------------------- Channel 1 (353) Tx 880.590 Rx 835.590 Channel 2 (374) Tx 881.220 Rx 836.220 Channel 3 (395) Tx 881.850 Rx 836.850 Channel 4 (416) Tx 882.480 Rx 837.480 Channel 5 (437) Tx 883.110 Rx 838.110 Channel 6 (458) Tx 883.740 Rx 838.740 Channel 7 (479) Tx 884.370 Rx 839.370 Channel 8 (500) Tx 885.000 Rx 840.000 Channel 9 (521) Tx 885.630 Rx 840.630 Channel 10 (542) Tx 886.260 Rx 841.260 Channel 11 (563) Tx 886.890 Rx 841.890 Channel 12 (584) Tx 887.520 Rx 842.520 Channel 13 (605) Tx 888.150 Rx 843.150 Channel 14 (626) Tx 888.780 Rx 843.780 Channel 15 (647) Tx 889.410 Rx 844.410 Cell # 21 -------------------------------------------------- Channel 1 (354) Tx 880.620 Rx 835.620 Channel 2 (375) Tx 881.250 Rx 836.250 Channel 3 (396) Tx 881.880 Rx 836.880 Channel 4 (417) Tx 882.510 Rx 837.510 Channel 5 (438) Tx 883.140 Rx 838.140 Channel 6 (459) Tx 883.770 Rx 838.770 Channel 7 (480) Tx 884.400 Rx 839.400 Channel 8 (501) Tx 885.030 Rx 840.030 Channel 9 (522) Tx 885.660 Rx 840.660 Channel 10 (543) Tx 886.290 Rx 841.290 Channel 11 (564) Tx 886.920 Rx 841.920 Channel 12 (585) Tx 887.550 Rx 842.550 Channel 13 (606) Tx 888.180 Rx 843.180 Channel 14 (627) Tx 888.810 Rx 843.810 Channel 15 (648) Tx 889.440 Rx 844.440 =============================================================================== Cellular phone frequency and cell construction =============================================================================== __ __ \__/C \__/D \__ \__/G \__/A \__/ _/D \__/E \__/F \__ \__/B \__/C \__/ _/F \__/G \__/A \__ \__/D \__/E \__/ _/A \__/B \__/C \__ \__/ \__/ \__/ This represents how a cellular system might be laid out. Cells A and B never share a common border. Neither do B and C, A and G, etc. Cells that are next to each other are never assigned adjacent frequencies. They always differ by at least 60 kiloHertz. To track a mobile phone as it changes cells, let's put the mobile in a B cell. When the mobile switches frequencies, you know that he could only go to an D, E, F or G cell because A and C have adjacent frequencies. The two tables below will help you determine which channel cells can go next to each other. You can contact your local cellular phone company and see if they have any maps of the cells available. This is not a sure thing, but it couldn't hurt to try. Cells that can go next to each other: Cell Compatible cells A C, D, E, F B D, E, F, G C E, F, G, A D F, G, A, B E G, A, B, C F A, B, C, D G B, C, D, E Here is a frequency/cell layout chart. The cell frequencies are used by the cell site towers, and the mobile frequencies are the input frequencies used by the cars. Wireline company cell frequencies (BAND B) CELL A CELL B CELL C CELL D CELL E CELL F CELL G ======= ======= ======= ======= ======= ======= ======= 889.890 889.920 889.950 889.980 Ä¿ 889.680 889.710 889.740 889.770 889.800 889.830 889.860 ³ 889.470 889.500 889.530 889.560 889.590 889.620 889.650 ³ 889.260 889.290 889.320 889.350 889.380 889.410 889.440 ³ 889.050 889.080 889.110 889.140 889.170 889.200 889.230 ³ 888.840 888.870 888.900 888.930 888.960 888.990 889.020 ³ 888.630 888.660 888.690 888.720 888.750 888.780 888.810 ³ 888.420 888.450 888.480 888.510 888.540 888.570 888.600 ³ 888.210 888.240 888.270 888.300 888.330 888.360 888.390 ³ 888.000 888.030 888.060 888.090 888.120 888.150 888.180 ³ 887.790 887.820 887.850 887.880 887.910 887.940 887.970 ³ 887.580 887.610 887.640 887.670 887.700 887.730 887.760 ³ 887.370 887.400 887.430 887.460 887.490 887.520 887.550 ³ 887.160 887.190 887.220 887.250 887.280 887.310 887.340 ³ 886.950 886.980 887.010 887.040 887.070 887.100 887.130 ³ 886.740 886.770 886.800 886.830 886.860 886.890 886.920 ³ 886.530 886.560 886.590 886.620 886.650 886.680 886.710 ³ 886.320 886.350 886.380 886.410 886.440 886.470 886.500 ³Voice 886.110 886.140 886.170 886.200 886.230 886.260 886.290 ³ 885.900 885.930 885.960 885.990 886.020 886.050 886.080 ³ 885.690 885.720 885.750 885.780 885.810 885.840 885.870 ³ 885.480 885.510 885.540 885.570 885.600 885.630 885.660 ³ 885.270 885.300 885.330 885.360 885.390 885.420 885.450 ³ 885.060 885.090 885.120 885.150 885.180 885.210 885.240 ³ 884.850 884.880 884.910 884.940 884.970 885.000 885.030 ³ 884.640 884.670 884.700 884.730 884.760 884.790 884.820 ³ 884.430 884.460 884.490 884.520 884.550 884.580 884.610 ³ 884.220 884.250 884.280 884.310 884.340 884.370 884.400 ³ 884.010 884.040 884.070 884.100 884.130 884.160 884.190 ³Channels 883.800 883.830 883.860 883.890 883.920 883.950 883.980 ³ 883.590 883.620 883.650 883.680 883.710 883.740 883.770 ³ 883.380 883.410 883.440 883.470 883.500 883.530 883.560 ³ 883.170 883.200 883.230 883.260 883.290 883.320 883.350 ³ 882.960 882.990 883.020 883.050 883.080 883.110 883.140 ³ 882.750 882.780 882.810 882.840 882.870 882.900 882.930 ³ 882.540 882.570 882.600 882.630 882.660 882.690 882.720 ³ 882.330 882.360 882.390 882.420 882.450 882.480 882.510 ³ 882.120 882.150 882.180 882.210 882.240 882.270 882.300 ³ 881.910 881.940 881.970 882.000 882.030 882.060 882.090 ³ 881.700 881.730 881.760 881.790 881.820 881.850 881.880 ³ 881.490 881.520 881.550 881.580 881.610 881.640 881.670 ³ 881.280 881.310 881.340 881.370 881.400 881.430 881.460 ³ 881.070 881.100 881.130 881.160 881.190 881.220 881.250 ³ 880.860 880.890 880.920 880.950 880.980 881.010 881.040 ³ 880.650 880.680 880.710 880.740 880.770 880.800 880.830 ÄÙ ------------------------------------------------------------------- 880.440 880.470 880.500 880.530 880.560 880.590 880.620 Ä¿Digital 880.230 880.260 880.290 880.320 880.350 880.380 880.410 ³Control 880.020 880.050 880.080 880.110 880.140 880.170 880.200 ÄÙChannels Wireline company mobile frequencies (BAND B) CELL A CELL B CELL C CELL D CELL E CELL F CELL G ======= ======= ======= ======= ======= ======= ======= 844.890 844.920 844.950 844.980 Ä¿ 844.680 844.710 844.740 844.770 844.800 844.830 844.860 ³ 844.470 844.500 844.530 844.560 844.590 844.620 844.650 ³ 844.260 844.290 844.320 844.350 844.380 844.410 844.440 ³ 844.050 844.080 844.110 844.140 844.170 844.200 844.230 ³ 843.840 843.870 843.900 843.930 843.960 843.990 844.020 ³ 843.630 843.660 843.690 843.720 843.750 843.780 843.810 ³ 843.420 843.450 843.480 843.510 843.540 843.570 843.600 ³ 843.210 843.240 843.270 843.300 843.330 843.360 843.390 ³ 843.000 843.030 843.060 843.090 843.120 843.150 843.180 ³ 842.790 842.820 842.850 842.880 842.910 842.940 842.970 ³ 842.580 842.610 842.640 842.670 842.700 842.730 842.760 ³ 842.370 842.400 842.430 842.460 842.490 842.520 842.550 ³ 842.160 842.190 842.220 842.250 842.280 842.310 842.340 ³ 841.950 841.980 842.010 842.040 842.070 842.100 842.130 ³ 841.740 841.770 841.800 841.830 841.860 841.890 841.920 ³ 841.530 841.560 841.590 841.620 841.650 841.680 841.710 ³ 841.320 841.350 841.380 841.410 841.440 841.470 841.500 ³Voice 841.110 841.140 841.170 841.200 841.230 841.260 841.290 ³ 840.900 840.930 840.960 840.990 841.020 841.050 841.080 ³ 840.690 840.720 840.750 840.780 840.810 840.840 840.870 ³ 840.480 840.510 840.540 840.570 840.600 840.630 840.660 ³ 840.270 840.300 840.330 840.360 840.390 840.420 840.450 ³ 840.060 840.090 840.120 840.150 840.180 840.210 840.240 ³ 839.850 839.880 839.910 839.940 839.970 840.000 840.030 ³ 839.640 839.670 839.700 839.730 839.760 839.790 839.820 ³ 839.430 839.460 839.490 839.520 839.550 839.580 839.610 ³ 839.220 839.250 839.280 839.310 839.340 839.370 839.400 ³ 839.010 839.040 839.070 839.100 839.130 839.160 839.190 ³Channels 838.800 838.830 838.860 838.890 838.920 838.950 838.980 ³ 838.590 838.620 838.650 838.680 838.710 838.740 838.770 ³ 838.380 838.410 838.440 838.470 838.500 838.530 838.560 ³ 838.170 838.200 838.230 838.260 838.290 838.320 838.350 ³ 837.960 837.990 838.020 838.050 838.080 838.110 838.140 ³ 837.750 837.780 837.810 837.840 837.870 837.900 837.930 ³ 837.540 837.570 837.600 837.630 837.660 837.690 837.720 ³ 837.330 837.360 837.390 837.420 837.450 837.480 837.510 ³ 837.120 837.150 837.180 837.210 837.240 837.270 837.300 ³ 836.910 836.940 836.970 837.000 837.030 837.060 837.090 ³ 836.700 836.730 836.760 836.790 836.820 836.850 836.880 ³ 836.490 836.520 836.550 836.580 836.610 836.640 836.670 ³ 836.280 836.310 836.340 836.370 836.400 836.430 836.460 ³ 836.070 836.100 836.130 836.160 836.190 836.220 836.250 ³ 835.860 835.890 835.920 835.950 835.980 836.010 836.040 ³ 835.650 835.680 835.710 835.740 835.770 835.800 835.830 ÄÙ ------------------------------------------------------------------- 835.440 835.470 835.500 835.530 835.560 835.590 835.620 Ä¿Digital 835.230 835.260 835.290 835.320 835.350 835.380 835.410 ³Control 835.020 835.050 835.080 835.110 835.140 835.170 835.200 ÄÙChannels =============================================================================== Non-wireline company cell frequencies (BAND A) CELL A CELL B CELL C CELL D CELL E CELL F CELL G ======= ======= ======= ======= ======= ======= ======= 879.900 879.930 879.960 879.990 Ä¿Digital 879.690 879.720 879.750 879.780 879.810 879.840 879.870 ³Control 879.480 879.510 879.540 879.570 879.600 879.630 879.660 ³Channels ------------------------------------- 879.390 879.420 879.450 ÄÙ 879.270 879.300 879.330 879.360 --------------------------- Ä¿ 879.060 879.090 879.120 879.150 879.180 879.210 879.240 ³ 878.850 878.880 878.910 878.940 878.970 879.000 879.030 ³ 878.640 878.670 878.700 878.730 878.760 878.790 878.820 ³ 878.430 878.460 878.490 878.520 878.550 878.580 878.610 ³ 878.220 878.250 878.280 878.310 878.340 878.370 878.400 ³ 878.010 878.040 878.070 878.100 878.130 878.160 878.190 ³ 877.800 877.830 877.860 877.890 877.920 877.950 877.980 ³ 877.590 877.620 877.650 877.680 877.710 877.740 877.770 ³ 877.380 877.410 877.440 877.470 877.500 877.530 877.560 ³ 877.170 877.200 877.230 877.260 877.290 877.320 877.350 ³ 876.960 876.990 877.020 877.050 877.080 877.110 877.140 ³ 876.750 876.780 876.810 876.840 876.870 876.900 876.930 ³ 876.540 876.570 876.600 876.630 876.660 876.690 876.720 ³ 876.330 876.360 876.390 876.420 876.450 876.480 876.510 ³ 876.120 876.150 876.180 876.210 876.240 876.270 876.300 ³ 875.910 875.940 875.970 876.000 876.030 876.060 876.090 ³ 875.700 875.730 875.760 875.790 875.820 875.850 875.880 ³ Voice 875.490 875.520 875.550 875.580 875.610 875.640 875.670 ³ 875.280 875.310 875.340 875.370 875.400 875.430 875.460 ³ 875.070 875.100 875.130 875.160 875.190 875.220 875.250 ³ 874.860 874.890 874.920 874.950 874.980 875.010 875.040 ³ 874.650 874.680 874.710 874.740 874.770 874.800 874.830 ³ 874.440 874.470 874.500 874.530 874.560 874.590 874.620 ³ 874.230 874.260 874.290 874.320 874.350 874.380 874.410 ³ 874.020 874.050 874.080 874.110 874.140 874.170 874.200 ³ 873.810 873.840 873.870 873.900 873.930 873.960 873.990 ³ 873.600 873.630 873.660 873.690 873.720 873.750 873.780 ³ 873.390 873.420 873.450 873.480 873.510 873.540 873.570 ³ Channels 873.180 873.210 873.240 873.270 873.300 873.330 873.360 ³ 872.970 873.000 873.030 873.060 873.090 873.120 873.150 ³ 872.760 872.790 872.820 872.850 872.880 872.910 872.940 ³ 872.550 872.580 872.610 872.640 872.670 872.700 872.730 ³ 872.340 872.370 872.400 872.430 872.460 872.490 872.520 ³ 872.130 872.160 872.190 872.220 872.250 872.280 872.310 ³ 871.920 871.950 871.980 872.010 872.040 872.070 872.100 ³ 871.710 871.740 871.770 871.800 871.830 871.860 871.890 ³ 871.500 871.530 871.560 871.590 871.620 871.650 871.680 ³ 871.290 871.320 871.350 871.380 871.410 871.440 871.470 ³ 871.080 871.110 871.140 871.170 871.200 871.230 871.260 ³ 870.870 870.900 870.930 870.960 870.990 871.020 871.050 ³ 870.660 870.690 870.720 870.750 870.780 870.810 870.840 ³ 870.450 870.480 870.510 870.540 870.570 870.600 870.630 ³ 870.240 870.270 870.300 870.330 870.360 870.390 870.420 ³ 870.030 870.060 870.090 870.120 870.150 870.180 870.210 ÄÙ Non-wireline company mobile frequencies (BAND A) CELL A CELL B CELL C CELL D CELL E CELL F CELL G ======= ======= ======= ======= ======= ======= ======= 834.900 834.930 834.960 834.990 Ä¿Digital 834.690 834.720 834.750 834.780 834.810 834.840 834.870 ³Control 834.480 834.510 834.540 834.570 834.600 834.630 834.660 ³Channels ------------------------------------- 834.390 834.420 834.450 ÄÙ 834.270 834.300 834.330 834.360 --------------------------- Ä¿ 834.060 834.090 834.120 834.150 834.180 834.210 834.240 ³ 833.850 833.880 833.910 833.940 833.970 834.000 834.030 ³ 833.640 833.670 833.700 833.730 833.760 833.790 833.820 ³ 833.430 833.460 833.490 833.520 833.550 833.580 833.610 ³ 833.220 833.250 833.280 833.310 833.340 833.370 833.400 ³ 833.010 833.040 833.070 833.100 833.130 833.160 833.190 ³ 832.800 832.830 832.860 832.890 832.920 832.950 832.980 ³ 832.590 832.620 832.650 832.680 832.710 832.740 832.770 ³ 832.380 832.410 832.440 832.470 832.500 832.530 832.560 ³ 832.170 832.200 832.230 832.260 832.290 832.320 832.350 ³ 831.960 831.990 832.020 832.050 832.080 832.110 832.140 ³ 831.750 831.780 831.810 831.840 831.870 831.900 831.930 ³ 831.540 831.570 831.600 831.630 831.660 831.690 831.720 ³ 831.330 831.360 831.390 831.420 831.450 831.480 831.510 ³ 831.120 831.150 831.180 831.210 831.240 831.270 831.300 ³ 830.910 830.940 830.970 831.000 831.030 831.060 831.090 ³ 830.700 830.730 830.760 830.790 830.820 830.850 830.880 ³ Voice 830.490 830.520 830.550 830.580 830.610 830.640 830.670 ³ 830.280 830.310 830.340 830.370 830.400 830.430 830.460 ³ 830.070 830.100 830.130 830.160 830.190 830.220 830.250 ³ 829.860 829.890 829.920 829.950 829.980 830.010 830.040 ³ 829.650 829.680 829.710 829.740 829.770 829.800 829.830 ³ 829.440 829.470 829.500 829.530 829.560 829.590 829.620 ³ 829.230 829.260 829.290 829.320 829.350 829.380 829.410 ³ 829.020 829.050 829.080 829.110 829.140 829.170 829.200 ³ 828.810 828.840 828.870 828.900 828.930 828.960 828.990 ³ 828.600 828.630 828.660 828.690 828.720 828.750 828.780 ³ 828.390 828.420 828.450 828.480 828.510 828.540 828.570 ³ Channels 828.180 828.210 828.240 828.270 828.300 828.330 828.360 ³ 827.970 828.000 828.030 828.060 828.090 828.120 828.150 ³ 827.760 827.790 827.820 827.850 827.880 827.910 827.940 ³ 827.550 827.580 827.610 827.640 827.670 827.700 827.730 ³ 827.340 827.370 827.400 827.430 827.460 827.490 827.520 ³ 827.130 827.160 827.190 827.220 827.250 827.280 827.310 ³ 826.920 826.950 826.980 827.010 827.040 827.070 827.100 ³ 826.710 826.740 826.770 826.800 826.830 826.860 826.890 ³ 826.500 826.530 826.560 826.590 826.620 826.650 826.680 ³ 826.290 826.320 826.350 826.380 826.410 826.440 826.470 ³ 826.080 826.110 826.140 826.170 826.200 826.230 826.260 ³ 825.870 825.900 825.930 825.960 825.990 826.020 826.050 ³ 825.660 825.690 825.720 825.750 825.780 825.810 825.840 ³ 825.450 825.480 825.510 825.540 825.570 825.600 825.630 ³ 825.240 825.270 825.300 825.330 825.360 825.390 825.420 ³ 825.030 825.060 825.090 825.120 825.150 825.180 825.210 ÄÙ Monitoring of the base sites is obviously going to be easier than monitoring the mobiles. The cell base sites are towers (usually blue) with a triangle shaped "head" on top, and sporting a couple of what appear to be vertical antennas. These base sites have a range of 3-5 miles. If you take a look at the honeycomb diagram, you can see how they are laid out. The cell transmitter is in the middle of the cell. It is possible to hear many, most, or all of the cells in your city, depending on your location. The closer you live to a boundary, the greater the chances of your being able to receive more cells. Due to the nature of radio signals, the actual cell shape is more or less round. However, the hexagon shape lends itself better to show how the system is laid out. With a circular coverage area, there will be some overlapping between adjacent cells. __ __ \__/C \__/D \__ \__/G \__/A \__/ _/D \__/E \__/F \__ \__/B \__*C \__/ _/F \__/G \__/A \__ \__/D \__/E \__/ _/A \__/B \__/C \__ \__/ \__/ \__/ If, for example, you live near the asterisk (*) in the above diagram, you will be able go easily hear the G, C, E, and A cells you're near. Since the maximum _practical_ range of a cell is 3-5 miles, you'll be able to hear them a bit farther away. However, due to the nature of the FM transceivers at the cell sites (they capture only the _strongest_ signal), you should be able to hear all seven cells. Which _one_ of each cell you hear will depend on your location and the strength of the received signal. In the above diagram, you'll most likely hear the F cell in the upper right, rather than the one on the left. Mobile reception is almost a waste of time unless you have an outdoor antenna. And, since the mobile will be repeated on the cell site, it's better to listen to the cell frequencies. You may not be able to hear both sides of the conversation if you listen only to the mobile frequencies!!! It is useful, however, for determining which channel cell you're in. If you use the antenna that came with the scanner, mobile range will be decreased down to 1 or 2 miles. By checking the scanner readout against the cell list above (825.030-844.980 MHz), you can tell what cell the mobile is in. This is also useful on the cell site frequencies. If you hear someone say, "I'm at the corner of highway FF and 37," and you know where the cell site antenna is in that area, you can check the frequency listing above and determine what cell that antenna belongs to. ***************************************************************************** *Places to get cheap phones* I got these numbers from the ham classified ads, each number is a person or bussiness that sells used cellualar's and related shit for less than a hundred. CELLULAR PHONE SUPPLIERS NCI R/M Wholesale Communications 744 Roble Road, Suite 185 800-837-5532 Allentown,PA 18103 800-669-5167 215-264-5117 Superior Cellular Products Cellular Enterprises, Inc. 3925 N. Rosemead Blvd. #205 813-885-7766 Rosemead,CA 91770 818-280-6665 Dynatek Communication Dist. Wholesale Cellular, Inc. 340 Constance Dr. 5720 West 71st St. Warminster,PA 18974 Indianapolis, IN 46278 215-672-5000 317-297-6100 CELLULAR SERVICE MONITORS InTouch USA 800-USA-ROAM 800-872-7626 CELLULAR TEST EQUIPMENT WAVETEK 1-800-223-WVTK Ask for free Communications Catalog CELLULAR SERVICE MONITORS Communication Instruments 356 Hillcrest Street El Segundo, CA 90245 800-288-8223 213-322-3666 CELLULAR PHONE REPAIRS Communication Consultants Co. Cellular Phone Services, Inc 16128 Cohasset St. 403 E. Gude Dr. Van Nuys, CA 91406 Rockville, MD 20850 818-901-9711 800-326-7901 ext. 101 PROM EMULATORS Parallax, Inc. Incredible Technologies 6200 Desimone Lane, #69A 708-437-2433 Citrus Heights, CA 95621 916-726-1905 Technical Solutions P.O. Box 462101 Dept. 101 Garland, TX 75046 214-272-9392 PROM PROGRAMMERS BP Microsystems Link Computer Graphics 10681 Haddington 369 Passaic Road, Ste. 100 Houston,TX 77043 Fairfield, NJ 07004 713-461-9430 201-808-8990 MVS Needhamps Electronics Box 994 4539 Orange Grove Ave. Merrimack, NH Sacramento, CA 95841 508-792-9507 916-924-8037 PROM CHIPS National Semiconductor Offices throughout the U.S. 408-721-5000 JDR Microdevices 800-538-5000 Easy Tech 2917 Bayview Drive Fremont, CA 94538 800-582-4044 Spy Supply 7 Colby Court, Suite 215 Bedford, NH 03110 (617) 327-7272 Consumertronics 2011 Crescent Drive P.O. Box 88310 Alamogordo, NM 88310 TeleCode P.O. Box 6426 Yuma, AZ 85366-6426 (602) 782-2316 Used cellular phones $50 (619)741-2632 MDM RADIO, Used cellular's, Large selection. Fax(708)848-4210 voice(708)848-0230 Fax switches $39.95 (415)641-9346, call 6:00 to 8:00 PM (This is used with cordless phreaking) DTMF decoder kit $50, Gary Bach, PO box 751454, Dayton, Oh, 45475 (remember whenever you buy equipment, use a PO box that has false info on you, in adittion to useing a money order bought from a non-local conveince store. This may sound paranoid but it works for me.) This file was written half by me, the other half was freely palgarized, so that I could fill in the gaps in my original work, with files that were written by other authors. This saved me considerable time, and allowed this .Zip to be Very conprehensive. have fun and remember, The only cellular freaks that get caught, are the ones that sell there services, Don't be one of these people, or you could end up doing time. Thanx to sparky for asking me to write this file in the first place. vid