5G “Beyond the Metrics”

From Modem Data to Meaningful Analysis

Signal strength, download speed, and latency describe important aspects of a mobile connection. They can show that performance has changed, that a device has moved to another cell, or that a different radio technology is being used. They do not, by themselves, show the messages exchanged between the phone and the network as those changes occur.
Understanding the missing context of connection configuration, measurement reporting, mobility procedures, and access to services presents a separate challenge. The question is how to obtain the relevant messages from the modem and turn their binary representation into information that can be interpreted alongside conventional measurements.

This was the focus of Task 3 under project FEMA.01.01-IP.01-02E5/24, “Optimization and improvement of a platform for analysis and quality assessment of services in next-generation 5G mobile networks”. Following the research conducted in the first two tasks of the project, this stage focused on the acquisition, decoding, and presentation of low-level signaling data from mobile devices.
The task’s objective was to establish and experimentally validate a method for collecting, processing, displaying, and saving Layer3 data in a laboratory mobile prototype.

As part of the cooperation between Notel and the Silesian University of Technology, the research findings were cross-checked through an independent comparative study conducted at the Department of Industrial Informatics within the Faculty of Materials Engineering and Industrial Digitalization. The study examined a sample of recorded measurement data, comparing the prototype’s output with reference logs. This complemented the team’s own research and testing with an external academic assessment of the results.

Questions and hypotheses

The research was organized around four practical questions:

• Could the planned QMI interface provide the signaling messages needed for the analysis, rather than only information about modem status?
• How could binary records be decoded while preserving their technology, direction, timing, and protocol context?
• Could the complete processing chain operate on a phone with the required continuity and presentation delay?
• Would the resulting data support meaningful comparison with a professional reference tool?

Answering these questions required experiments with modem interfaces, analysis of binary structures, parser development, mobile integration, and verification of both system behavior and the information produced.

Investigating QMI: 
the distinction between modem status and signaling

The first stage followed the planned QMI approach. Using a dedicated Android build environment and compiled library tools and components, the research team examined services associated with network access and data connectivity. The experiments returned information about serving and neighboring cells, radio technologies, registration status, frequency bands, carrier aggregation, and signal parameters. The initial expectation was that this approach would lead directly to the intended research outcome.

However, the research revealed a crucial distinction between these responses and the actual messages needed for the analysis. Reading a signal value does not provide the RRC MeasurementReport sent to the network by the terminal. Similarly, reading the current carrier-aggregation configuration does not reveal the RRCConnectionReconfiguration message that established it. Although both sources concern the same connection, they describe different aspects of its behavior.

In the services and device configurations examined, QMI provided useful radio and system information but did not supply the required stream of RRC, NAS, and RR messages. The work therefore established both what could be obtained through the planned interface and where another method was needed.

Rather than providing a direct route to the solution, this finding became the starting point for further experiments directed at the same objective: access to signaling data suitable for decoding and analysis.

Continuing the research through DIAG

The research continued with an investigation of the Qualcomm diagnostic interface, DIAG. This provided access to the lower-level records needed for the signaling analysis, but obtaining a log was only the first part of the problem.

A file-based approach using diag_mdlog confirmed that diagnostic data could be recorded. It also exposed difficulties associated with growing files, repeated reading and parsing, input/output load, and delays between recording a message and making it available to the application.

The task required a method that could support ongoing processing and presentation during a longer measurement session. This led the team to examine a streaming alternative based on diag_socket_log and a local TCP proxy.

In this arrangement, the manufacturer’s diagnostic component handled access to DIAG, while the application received a byte stream through a local connection. The proxy managed the transfer and frame boundaries, and the parser interpreted the diagnostic records. Files remained outputs of the session rather than the main transport for live processing. The resulting architecture connected data acquisition with continuous analysis, closing the information gap identified during the QMI experiments.

From binary frames to messages with context

A diagnostic stream is not a ready-made list of network events. It contains transport framing, diagnostic headers, log identifiers, protocol payloads, and records carrying different kinds of information.
The research separated these layers by identifying frame boundaries and removing transport encoding. Diagnostic commands and log codes were then used to select the appropriate decoding logic for LTE, NR, WCDMA, and GSM.

A significant part of the analysis concerned messages nested within RRC data, such as NR information carried within LTE signaling. To avoid losing part of their analytical meaning, the research led to a model that preserved the relationship between the outer message and its embedded content.

Signaling messages were also separated from records describing radio measurements or the current cell state. Unsupported formats, incomplete records, and decoding failures had to be identified and handled appropriately, with unsuitable records filtered out rather than forced into a known message type.
Decoded results were saved in file formats intended for the laboratory application and in PCAP/GSMTAP exports. These representations supported session review and further examination of the protocol data using external analytical tools.
The result was a structured decoding method: not simply extracting values from bytes, but retaining the context needed to understand what those values describe.

Bringing the processing chain into Android

The laboratory parser was implemented in Python and connected to Kotlin/Java data models through a native SDK. A bridge then linked the native processing layer with the React Native interface of the laboratory application.

This introduced two conversion boundaries: Python to Kotlin and Kotlin to JavaScript. Passing every complete record through both created a bottleneck and added unnecessary processing, particularly during a sustained stream of messages.

To address this, the prototype was modified to separate full records from a compact display model. The application received the data needed for the main view, while detailed content remained available through the native layer and saved session data. Results traveled toward the interface, while commands to start or stop a session traveled back toward the acquisition components. This separation made it possible to examine acquisition, decoding, storage, and presentation as connected but independently testable parts of the same prototype.

Making signaling readable on a phone

Research into the presentation layer focused on a model centered on a chronological message list, with filters for technology, protocol, channel, and direction. A radio-status panel provided the current connection context, while selecting a message opened its decoded fields in a detailed tree view.
This supported two levels of analysis: reviewing the sequence of a session and inspecting the content of an individual message. Measurement reports, network reconfigurations, and registration messages could therefore be distinguished without displaying every field at once.

The interface was also designed to accommodate the volume of incoming data: updates were delivered in batches, only visible list entries were rendered, and detailed records were retrieved when selected. As in the geovisualization research in Task 2, the objective was to make complex information usable without requiring the reader to reconstruct its underlying technical structure.

Verifying the complete prototype

Validation covered the full path from data acquisition to processing, presentation, and storage. The test series used Qualcomm-based mobile devices to collect samples for further analysis. Tests followed defined criteria for recording-session duration, presentation delay, and the maximum interval between successive messages in the recorded test data.

The laboratory tests confirmed that the required conditions were met, demonstrating achievement of the Task 3 milestone through the solution developed during the research. Data verification also examined recognizable network procedures. The analyzed material included LTE registration, radio and packet-resource preparation for VoLTE, and Tracking Area Update. These examples required more than finding isolated message names: the records had to retain the sequence and content needed to relate a terminal request to the network response.
Comparison with the reference solution focused on shared message classes, transmission direction, procedure names, and selected information fields. The objective was to verify the usefulness of the data, rather than reproduce every reporting or service-quality function of the reference system.

Cooperation with the Silesian University of Technology: an independent comparison

Cooperation with the Silesian University of Technology provided academic support for this task through an independent comparative study of the data produced by the laboratory prototype. The university assessed the research output independently of the team responsible for its implementation.

The study examined a sample of measurement data comprising two datasets: logs generated by the test module under investigation and reference logs. The recordings were made on separate terminals. To make the datasets as comparable as possible, both terminals followed the same test scenario in parallel sessions involving mobile data transfers and voice calls under comparable conditions.

The university researchers normalized the datasets before comparing message types, the content of selected messages, diagnostic metadata, and the ability to reconstruct signaling procedures. Their independent analysis confirmed that the logs generated by the test module contained information useful for examining LTE RRC, NAS-EPS, and NR-RRC signaling. Researchers could identify key messages, inspect connection and measurement parameters, and establish relationships between messages belonging to selected procedures. The scope of information was largely comparable to that of the analyzed reference logs.
Because the recordings came from separate terminals, the study compared information coverage, detail, logical consistency, and analytical usefulness rather than matching identical events record by record. This added an independent scientific assessment of the resulting data to the testing of the prototype.

Read more about the comparative study here
 

What does it mean for network analytics?

This task brought together several results: knowledge of the capabilities and limitations of the examined QMI services, a tested DIAG acquisition method, a structured parser, mobile data models, an interactive presentation layer, and verification against reference material.

When the initially investigated interface proved insufficient for the intended signaling analysis, the research team explored alternative approaches, ultimately producing a laboratory prototype that met the task’s functional and test criteria. The outcome combines new knowledge about the original method with an experimentally verified way of achieving the intended result.

For network analytics, the significance lies in connecting a measured state with the signaling surrounding it. Instead of examining a signal value or technology change in isolation, an analyst gains access to the messages, configurations, and responses that help explain the observed behavior.
The outcome is documented, experimentally validated knowledge that helps explain the communication behind the measurements.

This research was made possible by the opportunity to investigate the above-described challenges as part of Task 3 – Implementation of a QMI module for collecting data from GSM modems, carried out under project No. FEMA.01.01-IP.01-02E5/24-00, “Optimization and Enhancement of the Platform for Analyzing and Assessing Service Quality in New Generation 5G Mobile Networks.” 

The prototypes and solutions developed within Task 3 do not constitute a complete, standalone commercial product fit for immediate use, nor a fixed asset within the meaning of Article 3(1)(15) of the Polish Accounting Act. They remain at the conceptual and experimental stage and require further optimization, scaling to the full volume of real-world data, validation under production conditions involving very high traffic loads, and integration with the remaining modules of the platform — activities that fall outside the scope of this research and development project.