Cellular 4G/5G and satellite networks

A phone’s data takes a longer path than a laptop’s on Wi-Fi. It crosses the radio to a base station, an eNodeB in 4G or a gNB in 5G, and then the operator’s core network carries it, inside a tunnel, to a gateway that holds the phone’s IP address and connects it to the Internet. The radio access network (RAN) and the core are separate on purpose: the phone can move from cell to cell while its gateway, its address and its connections stay where they are. This lesson walks through the 4G and 5G architectures, follows a handover step by step, explains why phones often share public IPv4 addresses and also get IPv6, and compares the delay and capacity of 4G, 5G, fixed wireless access and satellites in low, medium and geostationary orbits.

From phone to Internet: the RAN and the core

A mobile network has two halves. The radio access network is the base stations with their antennas and the scheduling of who sends when on the radio. In 5G the base station is a gNB, and the radio interface between phone and gNB is called NR-Uu. A gNB can be split into a central unit and one or more distributed units, linked by an interface called F1, so that part of its work can run away from the mast. gNBs talk to each other over the Xn interface and to the core over NG, which is mostly N2 for control and N3 for user data.

The core network decides who may use the network, keeps track of each phone and carries its data to the outside world. The 5G core is a set of network functions, each offering services to the others, a design 3GPP calls a service-based architecture:

• The AMF (access and mobility management function) handles each phone’s registration and keeps track of where it can be reached.
• The SMF (session management function) sets up the phone’s sessions and controls the UPFs that carry them.
• The UPF (user plane function) forwards the user data itself, between the tunnels from the base stations and the Internet.
• The UDM holds subscription data, much as the HSS did in 4G, and the AUSF runs authentication; the PCF sets policy, and the NRF lets the functions find each other.

Control and user data are kept apart on purpose. A UPF can sit close to the users it serves, while the functions that control it stay in a few central sites.

The 4G core, the Evolved Packet Core, divides the same jobs differently. The MME handles control. The serving gateway (SGW) carries user data and is the anchor while a phone moves between eNodeBs. The PDN gateway connects to the Internet and is the anchor of the phone’s address: RFC 6459 describes it as the topological anchor for the addresses assigned to the phone.

The two generations also meet. In non-standalone 5G, also called EN-DC or option 3, 5G radios work alongside 4G base stations, which stay in charge, and the 4G core stays in place: phones get the capacity of the new radio, but only 4G’s services. In standalone 5G the radio connects to the 5G core, and only that configuration supports the full set of 5G services. 3GPP publishes its specifications in numbered releases, each adding features to the last, and the editions this lesson cites belong to Release 19.

Tunnels: how the core carries every packet

Between the base station and the UPF, the phone’s packets travel in GTP-U tunnels: each packet is wrapped in a GTP-U header, then in UDP to port 2152, then in an outer IP header between the two nodes. The receiving end of each tunnel picks a tunnel endpoint identifier (TEID) and tells the sender, and the TEID in every header says which session a packet belongs to. On 5G’s N3 interface every packet also carries a PDU Session Container, an extension header whose contents include the QoS flow identifier, the number that tells each node how to treat the packet.

# What the mobile core adds to every packet of a phone: between the base station and the user-plane
# gateway, the packet travels inside GTP-U, inside UDP to port 2152, inside an outer IP header
# (3GPP TS 29.281). The tunnel endpoint identifier (TEID) tells the receiver which session it belongs to.
# Over 5G's N3 interface every packet also carries a PDU Session Container extension header, whose
# contents (TS 38.415) include the packet's QoS flow identifier (QFI).
import struct

GTPU_PORT = 2152
G_PDU = 255                      # message type of a user data packet


def gtpu_header(inner_len, teid, qfi=None):
    """The GTP-U header for an inner packet of inner_len bytes; with a QFI, the 5G form with its container."""
    flags = 0b0011_0000          # version 1, protocol type 1 (GTP), no optional fields
    extra = b""
    if qfi is not None:
        flags |= 0b0000_0100     # E flag: an extension header follows
        extra = struct.pack("!HBB", 0, 0, 0x85)        # sequence, N-PDU number, next type: PDU Session Container
        extra += bytes([1, 0x10, qfi & 0x3F, 0])       # 1 x 4 bytes: PDU type 1 (uplink), the QFI, no more headers
    length = len(extra) + inner_len                    # everything after the first 8 bytes
    return struct.pack("!BBHI", flags, G_PDU, length, teid) + extra


inner = 1400                     # bytes of the phone's own IP packet
for label, header in [("GTP-U as 4G uses it", gtpu_header(inner, 0x2F1A0C07)),
                      ("GTP-U on 5G's N3, QFI 9", gtpu_header(inner, 0x2F1A0C07, qfi=9))]:
    print(f"{label}: {len(header)} bytes: {header.hex(' ')}")

print(f"\nOverhead per packet, and the largest inner packet that fits a 1,500-byte link (UDP port {GTPU_PORT}):")
for label, gtp in [("GTP-U, 8 bytes", 8), ("GTP-U with the N3 container, 16 bytes", 16)]:
    for ip, ip_len in [("IPv4", 20), ("IPv6", 40)]:
        overhead = ip_len + 8 + gtp            # outer IP + UDP + GTP-U
        print(f"  {label:38} over {ip}: {overhead:2} bytes, inner packet up to {1500 - overhead:,} bytes")

GTP-U as 4G uses it: 8 bytes: 30 ff 05 78 2f 1a 0c 07
GTP-U on 5G's N3, QFI 9: 16 bytes: 34 ff 05 80 2f 1a 0c 07 00 00 00 85 01 10 09 00

Overhead per packet, and the largest inner packet that fits a 1,500-byte link (UDP port 2152):
  GTP-U, 8 bytes                         over IPv4: 36 bytes, inner packet up to 1,464 bytes
  GTP-U, 8 bytes                         over IPv6: 56 bytes, inner packet up to 1,444 bytes
  GTP-U with the N3 container, 16 bytes  over IPv4: 44 bytes, inner packet up to 1,456 bytes
  GTP-U with the N3 container, 16 bytes  over IPv6: 64 bytes, inner packet up to 1,436 bytes

The tunnel costs 36 to 64 bytes per packet. A phone’s 1,500-byte packet therefore does not fit a 1,500-byte link between the base station and the UPF, so an operator either runs those links with larger frames or tells its phones to send smaller packets.

The tunnel’s far end is also where the phone’s address lives. When a phone connects, the core sets up a session, a PDU session in 5G or a PDN connection in 4G, and gives it an IPv4 address, an IPv6 prefix, or both. Servers on the Internet see packets that leave the UPF or the PDN gateway, never the cell the phone is in.

Handover: changing cells, keeping the address

A phone in an active call or download keeps measuring the neighbouring cells, and the network decides when to move it. In the basic case of 3GPP TS 38.300, the two gNBs prepare the move between themselves and the core only switches the path at the end:

1. The phone reports that a neighbouring cell is stronger, and the source gNB decides to hand it over.
2. The source gNB asks the target gNB over Xn, and the target accepts if it has room.
3. The phone receives everything it needs to reach the target cell, and the source gNB forwards the data it had buffered for the phone, so that nothing in flight is lost.
4. The phone joins the target cell, and the target asks the core to switch the path. The UPF starts sending the phone’s downlink data to the target gNB, and the source releases what it kept.

The session, and with it the phone’s IP address, never moves. Only the tunnel’s end at the radio side changes, so a TCP connection or a video call carries on. What the user can notice is the gap while the phone changes cells: the ITU’s requirements for the 4G generation allow a handover interruption of up to 27.5 ms between cells on the same frequency and 40 to 60 ms between frequencies (ITU-R M.2134), while the requirement for 5G is 0 ms (ITU-R M.2410). TS 38.300 describes ways to get there, such as a handover in which the phone keeps receiving from the source cell until it is connected to the target.

The address does change in other cases: when the phone moves from Wi-Fi to the mobile network, when its session is set up again, or when a 5G network moves a session to a closer UPF, which TS 23.501 allows for sessions set up with that kind of continuity.

Why phones share addresses: carrier-grade NAT and IPv6

There are far more phones than public IPv4 addresses. RFC 6459 notes that operators tend to give phones private IPv4 addresses, and that the private ranges hold only about 16 million unique addresses, fewer than many operators have subscribers, so operators reuse private ranges and translate them. The translator is a carrier-grade NAT (CGN), which RFC 6888 sets requirements for: among them, it must keep all of one subscriber’s connections on the same public address and must be able to limit how many ports each subscriber uses. Between subscribers and a CGN, operators can also use 100.64.0.0/10, a block that RFC 6598 reserved for exactly that.

Address sharing has costs that reach far beyond the phone, which RFC 6269 describes:

• Many people behind one address. A server that blocks or rate-limits by IPv4 address treats everyone behind the same CGN address as one client.
• No incoming connections. A device behind a CGN cannot accept a connection from outside without help, which is why peer-to-peer calls need relays or NAT traversal.
• Logs need ports. To trace abuse, an operator must know the public address, the port and the time, the three things that RFC 6888’s section on logging names.

IPv6 removes the shortage. A 3GPP network gives each phone’s default session a unique /64 prefix of its own (RFC 6459), so no translation is needed for IPv6 traffic. A phone on an IPv6-only network can still reach IPv4-only servers with 464XLAT (RFC 6877), which translates on the phone and again in the network. The lesson on NAT and carrier-grade NAT explains port translation in detail. For a server, the lesson of this section is short: limit by account or token rather than by IPv4 address, and treat an IPv6 /64 as one mobile device.

Satellites: low, medium and geostationary orbits

The height of the orbit decides almost everything about a satellite link. A geostationary (GEO) satellite circles 35,786 km above the equator in step with the Earth’s rotation, so it seems to hang still in the sky and dishes on the ground never need to move. Each one covers a large part of the planet, and three evenly spaced satellites give near-global coverage (ESA). Medium Earth orbits (MEO) are typically 8,000 to 20,000 km up, and low Earth orbits (LEO) 500 to 2,000 km (3GPP). Kepler’s third law gives the time each one takes to go round, with the WGS 84 values of the Earth’s radius and gravitational constant:

# Low, medium and geostationary orbits from Kepler's third law with the WGS 84 constants: the time one orbit
# takes, the satellite's speed, the shortest round trip through it when it relays the signal from a user to a
# ground station and back ("bent pipe"), and how long a low satellite stays in view of one user.
import math

GM = 398600.4418        # km³/s², the Earth's gravitational constant (WGS 84)
R = 6378.137            # km, the Earth's equatorial radius (WGS 84)
C = 299792.458          # km/s, the speed of light in vacuum
MIN_ELEVATION = 25      # degrees above the horizon: an assumed lowest usable angle


def slant_km(altitude, elevation):
    """Distance from a user to a satellite seen at `elevation` degrees above the horizon."""
    e = math.radians(elevation)
    return math.sqrt((R + altitude) ** 2 - (R * math.cos(e)) ** 2) - R * math.sin(e)


def hm(seconds):
    hours, rest = divmod(round(seconds), 3600)
    return f"{hours} h {rest // 60:02d} min" if hours else f"{rest / 60:.1f} min"


print(f"Round trips go user, satellite, ground station and back, seen overhead or at {MIN_ELEVATION}°")
print(f"{'':16}{'one orbit':>11}{'speed':>11}{'overhead':>11}{f'at {MIN_ELEVATION}°':>10}")
for name, altitude in [("LEO, 550 km", 550), ("MEO, 8,000 km", 8000), ("GEO, 35,786 km", 35786)]:
    a = R + altitude                                    # radius of a circular orbit
    period = 2 * math.pi * math.sqrt(a ** 3 / GM)
    speed = math.sqrt(GM / a)
    overhead = 4 * altitude / C * 1000
    low = 4 * slant_km(altitude, MIN_ELEVATION) / C * 1000
    print(f"{name:16}{hm(period):>11}{speed:>6.2f} km/s{overhead:>8.1f} ms{low:>7.1f} ms")

# How long a LEO satellite passing straight overhead stays above the minimum elevation (Earth's turn ignored).
altitude = 550
period = 2 * math.pi * math.sqrt((R + altitude) ** 3 / GM)
e = math.radians(MIN_ELEVATION)
arc = 2 * (math.acos(R * math.cos(e) / (R + altitude)) - e)    # radians of the orbit above that elevation
in_view = arc / (2 * math.pi) * period
print(f"\nA 550 km satellite passing overhead stays above {MIN_ELEVATION}° for about {hm(in_view)}:")
print(f"a user's link moves to another satellite at least {60 * 60 / in_view:.0f} times an hour.")

Round trips go user, satellite, ground station and back, seen overhead or at 25°
                  one orbit      speed   overhead    at 25°
LEO, 550 km      1 h 35 min  7.59 km/s     7.3 ms   15.0 ms
MEO, 8,000 km    4 h 45 min  5.27 km/s   106.7 ms  139.7 ms
GEO, 35,786 km  23 h 56 min  3.07 km/s   477.5 ms  521.3 ms

A 550 km satellite passing overhead stays above 25° for about 4.5 min:
a user's link moves to another satellite at least 13 times an hour.

The geostationary period comes out at 23 h 56 min, which matches the 23 hours 56 minutes and 4 seconds that ESA gives for one geostationary orbit: the time the Earth takes to turn once relative to the distant stars. A signal that goes up to such a satellite, down to a ground station and back needs at least 477.5 ms, and 521.3 ms when both ends see the satellite at 25°. ITU-T G.114 says that most applications feel interactive when one-way delay stays below 150 ms, and that 400 ms should not be exceeded for general planning, except, for example, for an unavoidable double satellite hop (ITU-T G.114). One geostationary hop, about 239 ms each way, already passes the first limit before the ground network adds anything.

A low orbit brings the round trip down to 7 to 15 ms through the satellite, but the satellite moves at 7.59 km/s and goes round in 1 h 35 min. Passing straight overhead, it stays above 25° for only about four and a half minutes, so a user’s link moves to another satellite at least 13 times an hour, and a constellation needs many satellites to keep one in view everywhere. The link’s delay also depends on where the ground station is: a satellite that relays the signal to a ground station far from the user adds that distance on the ground.

Satellites are also joining the mobile standards. Release 17 was the first 3GPP release with normative support for non-terrestrial networks, for satellites that relay the signal unchanged (a transparent payload) in low and geostationary orbits, and Release 19 adds satellites that carry base-station functions on board, a regenerative payload (3GPP).

Comparing 4G, 5G, fixed wireless and satellite links

Two numbers decide whether an access option suits a use: the round trip it adds and the capacity each user gets. Capacity is shared. Everyone active in a cell, or under a satellite’s beam, divides it, so the same cell feels fast at night and slow at a stadium. The ITU’s minimum average spectral efficiencies make a fair yardstick for cells:

# A cell's capacity is shared by everyone active in it at that moment. As a yardstick, multiply the ITU's
# minimum average downlink spectral efficiency by a channel width: 4G from ITU-R M.2134 (bit/s/Hz per cell),
# 5G from ITU-R M.2410 (bit/s/Hz per transmission point, roughly one sector). LTE carriers are at most 20 MHz
# wide (TS 36.104), and 5G carriers in 5G's lower range, 410 MHz to 7.125 GHz, up to 100 MHz (TS 38.104).
# Real networks differ: these are requirements for evaluation, not measurements.
CELLS = [
    ("4G, base coverage urban, 20 MHz", 2.2, 20),
    ("5G, dense urban, 100 MHz", 7.8, 100),
    ("5G, rural, 100 MHz", 3.3, 100),
]
ACTIVE = (10, 50, 200)

print(f"{'':33}{'cell, Mb/s':>11}   " + "   ".join(f"{n:>3} active" for n in ACTIVE))
for name, bits_per_hz, mhz in CELLS:
    cell = bits_per_hz * mhz                    # bit/s/Hz x MHz = Mb/s
    shares = "   ".join(f"{cell / n:10.2f}" for n in ACTIVE)
    print(f"{name:33}{cell:11.1f}   {shares}")
print("(Mb/s for each user when that many users are active at once)")

                                  cell, Mb/s    10 active    50 active   200 active
4G, base coverage urban, 20 MHz         44.0         4.40         0.88         0.22
5G, dense urban, 100 MHz               780.0        78.00        15.60         3.90
5G, rural, 100 MHz                     330.0        33.00         6.60         1.65
(Mb/s for each user when that many users are active at once)

A 20 MHz LTE carrier, the widest LTE allows (TS 36.104), gives a 4G cell about 44 Mb/s by this yardstick, under 1 Mb/s each when 50 users are active. A 100 MHz carrier, the widest 5G allows in its lower frequency range of 410 MHz to 7.125 GHz (TS 38.104), gives a dense-urban sector about 780 Mb/s, 15.6 Mb/s each for the same 50 users. These are requirements for evaluation, not measurements of any network, but the ratio between them is the point.

The ITU figures in the first row are the radio’s contribution in unloaded conditions (M.2134, M.2410); queues in a busy cell, the core and the distance to the server come on top. Fixed wireless access uses the same radio as mobile, but from a receiver fixed at the home, and those homes share the cell with the phones around them.

Satellite capacity is shared in the same way, by everyone under a beam, and how much there is depends on the system. What separates the two kinds of orbit is the delay and how the link behaves over time:

Exercise and self-check

Rank six access options by the round trip they add and the capacity each user gets, and keep the ones that leave room for a video call. Then check what you remember of the rest of the lesson.

def rtt_ms(option):
    """Return the round trip in ms: the access network's own delay plus the signal's trip there and back."""
    # Replace this line with your code.
    return 0.0


def per_user_mbps(option):
    """Return each active user's equal share of the shared capacity, in Mb/s."""
    # Replace this line with your code.
    return 0.0


def fits(options, budget_ms, need_mbps):
    """Return the names of the options within the budget, shortest round trip first."""
    # Replace this line with your code.
    return []

import math

from budget import fits, per_user_mbps, rtt_ms

# Example figures for the exercise, not measurements.
OPTIONS = [
    {"name": "GEO satellite", "access_ms": 30, "path_km": 71_572, "km_per_ms": 299.792, "shared_mbps": 500, "active_users": 100},
    {"name": "4G", "access_ms": 20, "path_km": 1_000, "km_per_ms": 204, "shared_mbps": 44, "active_users": 20},
    {"name": "LEO satellite", "access_ms": 20, "path_km": 2_250, "km_per_ms": 299.792, "shared_mbps": 400, "active_users": 80},
    {"name": "5G fixed wireless", "access_ms": 8, "path_km": 1_000, "km_per_ms": 204, "shared_mbps": 780, "active_users": 120},
    {"name": "fibre", "access_ms": 2, "path_km": 1_000, "km_per_ms": 204, "shared_mbps": 2_400, "active_users": 32},
    {"name": "5G", "access_ms": 8, "path_km": 1_000, "km_per_ms": 204, "shared_mbps": 780, "active_users": 50},
]
BY_NAME = {o["name"]: o for o in OPTIONS}


def test_round_trip():
    """adds the access delay to the trip over the path and back"""
    assert math.isclose(rtt_ms(BY_NAME["GEO satellite"]), 30 + 2 * 71_572 / 299.792)
    assert math.isclose(rtt_ms(BY_NAME["fibre"]), 2 + 2_000 / 204)
    assert 34.9 < rtt_ms(BY_NAME["LEO satellite"]) < 35.1


def test_share():
    """divides the shared capacity equally between the active users"""
    assert per_user_mbps(BY_NAME["5G"]) == 15.6
    assert per_user_mbps(BY_NAME["4G"]) == 2.2
    assert per_user_mbps(BY_NAME["fibre"]) == 75.0


def test_video_call():
    """keeps the options within 100 ms and 3 Mb/s, fastest first, the larger share first on a tie"""
    assert fits(OPTIONS, 100, 3) == ["fibre", "5G", "5G fixed wireless", "LEO satellite"]


def test_edges():
    """handles a zero-length path, a budget nothing meets and options that just fit"""
    still = dict(BY_NAME["5G"], path_km=0)
    assert rtt_ms(still) == 8
    assert fits(OPTIONS, 5, 1) == []
    assert fits(OPTIONS, 600, 0) == ["fibre", "5G", "5G fixed wireless", "4G", "LEO satellite", "GEO satellite"]
    assert fits([still], 8, 15.6) == ["5G"]

Interview questions

What do the radio access network and the core do in a 4G or 5G network? The radio access network is the base stations, eNodeBs in 4G and gNBs in 5G, which run the radio: they schedule who sends when, encrypt the radio link and hand phones from cell to cell. The core decides who may use the network and carries their data: in 5G the AMF registers phones and tracks where they are, the SMF sets up sessions, the UPF forwards user data between GTP-U tunnels from the base stations and the Internet, and the UDM and AUSF hold subscriber data and authenticate. In 4G the MME, the serving gateway and the PDN gateway share those jobs.

Why does a phone keep its IP address when it moves to another cell? Because the address belongs to the phone’s session, which is anchored at a gateway in the core, the UPF in 5G or the PDN gateway in 4G, not at the cell. In a handover the base stations move the radio connection, the source forwards the data it had buffered, and the core switches the tunnel’s radio end to the new base station, while the anchor stays the same. Connections survive; the address changes only when the session itself is set up again, for example after moving to Wi-Fi.

Key takeaways

• A mobile network has a radio access network of base stations (eNodeB, gNB) and a core: in 5G the AMF handles registration and mobility, the SMF sessions, the UPF user data and the UDM subscriber data.
• User data travels between base station and core in GTP-U tunnels over UDP port 2152, which add 36 to 64 bytes to every packet.
• A handover moves the radio end of the tunnel while the session’s anchor stays put, so the IP address and open connections survive; the ITU allows 4G up to 27.5 ms of interruption on one frequency and requires 0 ms for 5G.
• Phones often share public IPv4 addresses behind carrier-grade NAT, so servers should not limit by IPv4 address alone; with IPv6 each phone’s session gets its own /64 prefix.
• Orbit height sets a satellite’s delay: at least 477.5 ms round trip through a geostationary satellite, 7 to 15 ms through one at 550 km, which in return changes satellite every few minutes.
• Capacity is shared by everyone active in a cell or beam: by the ITU yardsticks, about 44 Mb/s for a 20 MHz 4G cell and 780 Mb/s for a 100 MHz 5G sector.