Scrutinizing Real-life Configurations of Random Access Procedures in Cellular Networks

arXiv:2604.09077v1 [cs.NI] 10 Apr 2026

Scrutinizing Real-life Configurations of Random Access Procedures in Cellular Networks Joris Belder

Anup Bhattacharjee

Fernando Kuipers

D-INFK ETH Zurich, Switzerland jbelder@student.ethz.ch

Networked Systems Delft University of Technology Delft, the Netherlands a.k.bhattacharjee@tudelft.nl

Networked Systems Delft University of Technology Delft, the Netherlands f.a.kuipers@tudelft.nl

Abstract—In cellular networks, base stations broadcast configurations that devices use for the random access procedure, which is a vital part of the connection setup. Ideally, the network should choose configurations based on the deployment scenario to optimize radio resource management. Doing so can, for example, decrease collisions of random access messages. We captured 112,806 data points of cellular broadcast information from nine network operators across three countries and analyzed how the operators configure the random access procedure. We found that configurations often do not fit the deployment scenario, and neighboring cells often use the same configuration, causing an unnecessarily high risk of collisions and, hence, delay in the connection setup. Furthermore, we simulated the random access procedure in NS-3 and found that by varying the configurations in a large area with many cells, the number of collisions can be reduced by 43% on average and up to 61%, and the connection delay can be lowered by 11% on average and up to 42%. Our findings indicate that simple adaptations in the random access configurations can greatly improve the performance of cellular networks. Index Terms—Cellular Networks; 4G; Random Access Procedure; Data Collection; Simulation.

I. I NTRODUCTION In 2024, about 58% of global smartphone subscribers still used 4G [1], excluding those on 5G non-stationalone (NSA) networks that rely on 4G for the control plane. In contrast, adoption of 5G Standalone (SA), where both user and control planes operate on 5G, remains limited in Europe. According to Speedtest, only 2% of samples in Europe were on 5G SA networks, significantly behind China (80%), India (52%), and the United States (24%) [2]. This shows the high relevance of 4G networks and the use of control methods to optimize the configurations of the cellular networks. One vital aspect of cellular networks is connection setup. Devices perform a random access procedure to initialize a connection and receive uplink transmission grants. While researchers have already presented novel random access schemes [3], [4], it remains unclear how actual cellular deployments configure the random access procedure. Such insights into real-life configurations are essential for understanding and improving the performance of cellular networks and, in particular, of the connection setup. This research was supported by the National Growth Fund through the Dutch 6G flagship project “Future Network Services”.

In this paper, we present measurements of random access configurations in 4G networks. Our measurements encompass 112,806 data points and stretch across three countries. In each country, we took measurements for the three largest Mobile Network Operators (MNOs) by subscriber base. Specifically, we collected cell broadcast information that devices use to configure the random access procedure. For instance, cells broadcast information that tells devices which preamble they should use for initializing connections. To the best of our knowledge, we are the first to present such measurements. Our data indicates that random access configurations often do not suit the deployment scenario and are often the same across many cells. For example, neighboring cells commonly use the same preamble configuration for random access, which unnecessarily increases the risk of collisions, prolongs the connection setup, and leads to inefficient network resource usage. To analyze how much of an issue cells using the same configuration is, we simulated the random access procedure in NS-3 and compared the performance when cells use the same configuration with the performance when cells use different configurations. We found that simply deploying different configurations across cells reduces the number of collisions and lowers the connection delay significantly. For example, one can lower the median connection delay by up to 300 ms by deploying simple changes. MNOs can leverage our findings to improve the performance of cellular connection setup and to save network resources. While we measured the configurations in 4G networks, the random access procedure is similar in 5G. When considering Europe, most 5G deployments are currently non-standalone, meaning they have 4G as their control layer [2]. Our insights therefore also hold for more modern networks. As pushed by the Open-Radio Access Network (RAN) initiatives [5], future networks will be more softwarized, with the RAN being controlled by a RAN Interface Controller (RIC) [6]. We envision RICs to adjust the configurations of cells intelligently to improve network performance, and part of these configurations is the random access procedure, which we show can be a crucial factor in the performance of cellular networks. O-RAN provides interfaces to include 4G base stations as part of the O-RAN architecture, which will allow to make adjustments to the configurations for improved performance.

TABLE I M EASUREMENT S TATISTICS

Information Element n

eNodeB

Information Group n

SIB n

SIB2

MIB

SIB1

Downlink Broadcast Channel PRACHPRACHConfigInfo ConfigIndex

MNOs UE

Fig. 1. Transmission of the Master and System Information Blocks. SIB2 contains information on how to perform the random access procedure.

Contributions. Our contributions are as follows: • We present data on real-life random access configurations and show that configurations often do not suit the deployment scenario and are often the same across cells. • We use NS-3 simulations to show that using different configurations across cells can notably reduce the number of collisions and the connection delay. II. BACKGROUND Basics. In 4G, User Equipments (UEs), e.g., mobile phones, connect to base stations called Evolved NodeBs (eNodeBs), which connect to an Evolved Packet Core (EPC). The EPC is responsible for services such as user authentication, connection setup, and roaming [7]. Each MNO has their own frequency bands [8] to transmit and receive signals. This means that MNOs are not allowed not transmit in each others spectrum. To efficiently utilize these bands, MNOs deploy eNodeBs. Each eNodeB divides the allocated frequency bands into multiple logical cells. These logical cells operate on different frequencies to minimize interference within the same MNO network. A UE connects to one of these logical cells by communicating over a designated frequency band during specific time intervals known as radio frames. From this point onward in the paper, we refer to the “logical cell” as a “cell”. In 4G, the duration of a radio frame is 10 ms. Each radio frame is further divided into ten subframes of equal length. Signals sent on the same frequency and in the same subframe can collide [9]. Therefore, MNOs should optimize their cellular configurations to prevent collisions. Cell Broadcast. Cells broadcast system information using the Radio Resource Control (RRC) protocol [10], which manages network resources pertaining to user connections. With RRC, cells regularly broadcast a Master Information Block (MIB) that contains information that UEs need to synchronize and listen to other broadcast information such as different types of System Information Blocks (SIBs). SIBs provide further information for UEs to access cells. The MIB and the SIBs are divided into multiple Information Groups (IGs) that are further subdivided into Information Elements (IEs). Each IE typically describes some RAN parameter and assists the UEs in choosing configuration settings [11]. SIB1 contains information on the scheduling of other SIBs. SIB2 contains radio resource configuration information that UEs use for several procedures, including random access. Figure 1 illustrates the transmission of the MIB and SIBs and parts of the structure of SIB2.

Frequency bands observed Municipalities measured eNodeBs measured (grouped by MNO ) (Logical) Cells measured (grouped by MNO) Measurement locations Total measurements Measurement period

Country 1 3 1, 3, 7, 8, 20, 28, 38 7

Country 2 3 1, 3, 7, 8, 20, 28, 38 7

Country 3 3 1, 3, 7, 20, 28 10

155

188

43

992

2036

807

29 23,389

62 76,556 August - December 2022

13 12,861

December 2022

December 2022

Random Access Procedure. To connect or reconnect to a cell and receive uplink grants for data transfer, UEs perform a random access procedure. They must send a Physical Random Access Channel (PRACH) preamble to the cell to establish the connection. To decide which preamble to use, UEs listen to the cell broadcast information. SIB2 contains the IG PRACHConfigInfo, and this IG contains IE PRACH-ConfigIndex (as illustrated in Figure 1) that tells UEs which preamble to use and when to send it. There exist four PRACH preamble formats that suit different deployment scenarios. For instance, preamble formats 0 and 2 are suitable for smaller cells (such as those in urban deployments), whereas formats 1 and 3 suit larger cells (such as those in rural deployments), because the latter use longer guard intervals, giving signals more room to travel [9], [12], [13]. For each PRACH preamble format, there are 16 different PRACH preambles. Preambles differ in during which subframe numbers UEs may transmit them and in whether UEs may transmit them during odd, even, or all radio frame numbers. If several UEs attempt to connect at the same time with the same PRACH preamble, the preambles may collide even if they were meant for different cells, causing one or multiple of the connection attempts to fail. When a collision occurs, UEs must retry connecting later. So, collisions prolong the connection setup. Thus, MNOs should configure their cells such that neighboring cells use different preambles to prevent collisions, and they should ensure that they use preamble formats that suit the deployment scenario. III. M EASUREMENTS AND I NSIGHTS We captured SIB messages from cells in three different countries and for three MNOs per country. Section III-A details our setup for the data collection. We analyzed the collected data to see how MNOs configure the random access procedure. We detail our insights in Section III-B. A. Data Collection For our data collection, we used a laptop running Ubuntu 18.04 with Linux kernel 5.4.0-132-lowlatency alongside a Quectel EG25-G USB dongle1 as UE that connects to cells. Using this setup, we captured SIB1 and SIB2 broadcast messages from cells. We developed the code for capturing 1 We used firmware version EG25GGBR07A07M2G.

5HODWLYHQXPEHU



&RXQWU\ &RXQWU\ &RXQWU\

   

)RUPDW &RXQWU\ &RXQWU\



              1XPEHURIFHOOVWKDWVKDUHORFDWLRQIUHTXHQF\DQG35$&+&RQILJ,QGH[

Fig. 2. The relative number of cells that share location, frequency, and PRACH-ConfigIndex, for all three countries. Often, several cells share these properties and can, thus, incur collisions during random access.

these messages in Python 3.6.9 using QCSuper [14] at commit 5c4e529 and Tshark 2.6.10. To ensure comprehensive coverage, we made use of the websites Cellmapper [15] and OpenCellid [16], which provide public information on cells such as their location, operator, and frequencies. We used the websites to make a list of physical measurement locations where we could capture broadcast messages from multiple operators. Our measurements encompass a total of 112,806 data points. We obtained most measurements from Country 2, which has the largest population, mobile user base, and number of cells among the three countries. Table I presents detailed statistics about our measurements. B. Insights As explained in Section II, PRACH preambles meant for different cells can collide when they are sent at the same frequency (which depends on the MNO and the frequency band) and during the same subframe (which is determined by the PRACH-ConfigIndex). In what follows, we analyze our collected data and unveil how real-life configurations of cellular deployments incur an unnecessarily high risk of collisions. Insight 1: In many locations, there are multiple cells that share the same frequency and PRACH-ConfigIndex, making collisions during random access possible. For each measurement location, we determined the number of cells that share the same frequency and PRACH-ConfigIndex. Figure 2 illustrates how often each number occurred per country, relative to the total number of measurements per country. In all three countries, more than 60% of the locations contain multiple cells that share the same frequency and PRACHConfigIndex and are, therefore, prone to collisions during the random access procedure. Indeed, this may be because of frequency reuse. But for different cells, a different value for PRACH-ConfigIndex can be used to reduce the probability of collision even in the case of frequency reuse. The probability of collisions increases with the number of cells that share frequency and PRACH-ConfigIndex. In our data, 25%–35% of the locations contain three to five such cells, and the number of cells can reach up to fifteen. Our findings indicate suboptimal configurations of cellular deployments; MNOs could easily

&RXQWU\ 

)RUPDW   

8UEDQ 6XEXUEDQ 5XUDO   8UEDQ   6XEXUEDQ   5XUDO  8UEDQ   6XEXUEDQ   5XUDO           3UHDPEOH)RUPDW8VDJH

Fig. 3. The usage of each preamble format of cells in urban, suburban, and rural areas, with the relative amount of cells using a preamble format on the x-axis and the absolute amount on the bars. Only two formats are in use, and the vast majority of cells use format 0.

deploy different PRACH-ConfigIndex values to reduce the risk of collisions and lower the connection delay. Insight 2: Many cells deploy the same PRACH preamble format, which is not always suitable for the deployment scenario. We found that the MNOs for which we collected data use only two out of four preamble formats: 0 and 1. Format 0 supports cells with a range of up to ∼14 km, whereas format 1 supports up to ∼75 km due to its higher tolerance in fading environments [17] and its longer guard interval [18] compared to format 0. Hence, format 1 is better suited to larger cells and areas with less fading, such as cells in rural environments [19]. To verify whether MNOs choose preamble formats based on the cell location, we classified our measurement locations into urban, suburban, and rural. We call a location urban if it is within 100 m of a city center, a busy public space (parks, tourist attractions, train stations, hospitals, or university buildings), or a main road that leads through a major city. We call a location suburban if it is in a city but does not fall into our urban categorization. We call a location rural if it is outside of city borders. Our categorization is by no means a proper classification one could use for urban planning, but it suffices for our purpose. Figure 3 presents how often we observed each preamble format in each type of location (urban, suburban, rural) per country. The MNOs we measured predominantly deploy format 0. In two countries, deployments exclusively or almost exclusively use format 0. Country 2 sometimes uses format 1, but format 0 still dominates, and there is little difference between rural and urban locations in the usage of format 1 even though the formats suit different types of locations better. We found this trend to appear for all MNOs. Insight 3: For many IEs, only one or few different configurations are deployed. Our data shows that MNOs deploy few different configurations not only for the PRACHConfigIndex but also for other IEs in SIB2 that pertain to random access. For example, for the IE random access response window size (ra-ResponseWindowSize), which indicates how long UEs should wait for a response after they sent the preamble, we observed but one or two unique values per country.

It would be sensible to adapt this value to the deployment scenario and, for instance, set a longer window for denser deployments. For many other IEs, we observed similarly few different values. We present the details in Section A. While our work focuses on the PRACH-ConfigIndex, which plays an important role in the random access procedure, these findings indicate that the configurations of cellular deployments are deficient in general. IV. S IMULATIONS In this section, we verify that the current assignment of the PRACH-ConfigIndex IEs in the wild is deficient, and we show how much the network performance can be improved with more thoughtful assignments. To this end, we simulate the random access procedure with varying numbers of cells using NS-3 [20] and evaluate the performance when cells use the same PRACH-ConfigIndex and when they use different indices. We use two metrics: the number of collisions (how often cells do not receive a PRACH preamble due to interference with another preamble) and the connection delay (the time it takes a UE to finish the connection setup after sending the first PRACH preamble). To measure the potential improvement that using different indices can yield, we need data on the number of collisions and the connection delay experienced by UEs. However, MNOs do not make such data available from their deployments. So, we turn to simulations to get an idea of what could be possible. A. Simulation Setup We implemented our simulations in NS-3.24 [21] and used the LENA+ module [3], which implements a PRACH model in NS-32 . LENA+ adds support for the PRACH-ConfigIndex IE to NS-3 and turns the messages UEs and cells exchange as part of the random access procedure into proper signals that are affected by path loss and collisions; vanilla NS-3 does not properly model these signals. Moreover, LENA+ allows us to collect the number of collisions and the connection delay as defined above. A peculiarity of LENA+ is that it always sets the PRACH-ConfigIndex IE to 0. Thus, we modified the module to allow for selecting different PRACH-ConfigIndex values. Our module can simulate a specific set of PRACHConfigIndex values. These values allow for preambles to be sent only during even radio frame numbers. Furthermore, only preamble format 0 exists in LENA+, effectively limiting the usable values for PRACH-ConfigIndex to 0, 1, 2, and 15 because these values correspond to even radio frames and preamble format 0. Adding support for other PRACHConfigIndex values would require major changes to LENA+’s scheduler, which was not needed because the usable values are precisely the ones we need, as we clarify hereafter. In urban scenarios, many users are already connected to the network and are actively using it for data transmission. Spending too many network resources (subframes and radio frames) on the 2 LENA+ is built on top of NS-3.24 and supports only this version of NS-3, which is why we could not use a newer version of the simulator.

TABLE II G ENERAL SIMULATION PARAMETERS . Parameter Simulation repetitions Simulation time UE height Frequency band (downlink) Cell antenna height Inter-cell distance

Value 5 5s 1m 17 (740 MHz) 30 m 200 m

random access procedure would come at the cost of already connected users. Because the group of already connected users is typically larger, one should use PRACH-ConfigIndex values that imply minimal time spent on the random access procedure to increase the throughput of data transmissions [12], [13]. The PRACH-ConfigIndex values we can simulate are precisely the ones that imply minimal time spent on the random access procedure. Hence, they do not limit our results. Another point to keep in mind is that, in this study, our simulations do not consider frequency reuse. When a MNO deploys its network, it typically employs a frequency reuse pattern to minimize interference between cells. However, our focus for this paper has been on scenarios where a UE receives SIB messages for the same MNO and frequency from different logical cells. As illustrated in Figure 2, the number of logical cells sharing the same PRACH-ConfigIndex can reach up to 15 in some cases. Investigating frequency reuse patterns could be a valuable avenue for future work or for other members of the research community to explore as an extension of this study. Our simulation uses an urban path loss model provided by NS-33 and contains only the setup that is necessary for the random access procedure. So, we can realistically test this procedure for any number of UEs and cells and for different configurations of the PRACH-ConfigIndex. Table II shows the simulation parameters common to all simulations. We set most parameters in accordance with the 3GPP specification on 4G deployment scenarios [19]. We deploy eNodeBs in a hexagonal grid with omnidirectional antennas. While actual eNodeBs often use multiple antennas, these antennas are deployed such that they collectively cover a 360° radius around the eNodeB. Hence, we can use omnidirectional antennas in our simulation for simplicity without this affecting the outcome. We repeated each simulation five times and averaged the results. Each simulation lasts 5 s, which suffices for all UEs to complete the random access procedure in all scenarios. We tested our simulations with frequency bands 17 (center frequency 740 Mhz), 11 (center frequency 1486 Mhz), and 7 (center frequency 2655 Mhz), and the outcomes were similar. Thus, we present results only for frequency band 17. We define two PRACH configuration schemes: same and different. We have simulated with multiple configurations; however, for the scope of this paper, we present the same and different configuration results to illustrate the impact of configuration choices on system performance. The remaining configurations produced intermediate results that 3 Specifically, we used NS-3’s HybridBuildingsPropagationLossModel.





 

                8(V



Fig. 4. The average number of collisions per amount of UEs on a logscale axis (left y-axis) and the percentual decrease when using different configurations (right y-axis) in the 2-cell scenario. In a simple scenario, using different configurations lowers the number of collisions significantly.

fall between these extremes. In same, all cells use the same PRACH-ConfigIndex4 . In different, neighboring cells always use a different PRACH-ConfigIndex. In all simulations, we distribute the UEs uniformly across the simulated area, and all UEs try to connect to a cell at the same time5 . B. Simulation Results 2-cell Scenario. We first simulate a 2-cell scenario to see how much the network performance is affected by the choice of PRACH configuration in the most straightforward scenario in which contention is possible. We vary the number of UEs that try to connect to a cell at the same time to compare different amounts of random access messages. Few connecting UEs could represent regular traffic where some people move into a different cell, and many connecting UEs could represent an arriving train or machine-type devices such as smart meters trying to join the network. Figure 4 shows for varying numbers of UEs the average number of collisions across five repetitions of the simulation, with error bars indicating the entire range of observed values. It compares the results using the same and different PRACH configuration schemes and the corresponding percentual decrease in the average number of collisions between the two configurations. Simply changing the configuration from same to different reduces the average number of collisions by 40% on average, and we observed reductions of up to 67%. While the percentage by which collisions decrease is lower when there are more UEs in total, the absolute decrease in collisions is larger with more UEs. Hence, the impact of using different configurations is greater the more UEs try to connect at the same time. Similarly, Figure 5 illustrates for varying numbers of UEs and for the same and different PRACH configurations the median connection delay of all UEs within one simulation, averaged over five repetitions of the simulation. It further presents the corresponding percentual decrease in the average median delay between the two configurations. Using different PRACH-ConfigIndex values results in a substantial decrease in the connection delay for the UEs. On average, the connection 4 We used PRACH-ConfigIndex value 1 for the same configuration scheme because this value occurred most often in our measurements. 5 More UEs could be already connected and transmit data; we simulate only UEs that want to initiate a new connection.



 





 

                8(V



GHFUHDVHPHGLDQGHOD\





6DPH35$&+ 'LIIHUHQW35$&+

Fig. 5. The average median connection delay (median across UEs, average across simulations) per amount of UEs (left y-axis) and the percentual decrease when using different configurations (right y-axis) in the 2-cell scenario. In a simple scenario, using different configurations reduces the connection delay notably.

 



6DPH35$&+ 'LIIHUHQW35$&+





 



 







  8(V









GHFUHDVHFROOLVLRQV



$YHUDJHPHGLDQGHOD\V



$YHUDJHFROOLVLRQV



6DPH35$&+ 'LIIHUHQW35$&+

GHFUHDVHFROOLVLRQV

$YHUDJHFROOLVLRQV





Fig. 6. The average number of collisions per amount of UEs on a logscale axis (left y-axis) and the percentual decrease when using different configurations (right y-axis) in the 19-cell scenario. In a large area, assigning different configurations to neighboring cells lowers the number of collisions significantly.

delay decreases by 5% and this decrease tends to be larger when there are more UEs. In the worst-case scenario, when the total number of UEs is largest, the median connection delay decreases by 300 ms or 19%. 19-cell Scenario. The 2-cell scenario provides interesting insights, but actual deployments comprise many cells not just two. Therefore, we simulate a 19-cell scenario, which represents a larger area where UEs try to connect at the same time. We chose 19 cells because 3GPP defines 19 as a suitable number of cells for simulations of cellular networks [22]. As before, we evaluate the number of collisions and the connection delay for varying numbers of UEs and compare the results when using the same or different6 configurations. Figure 6 shows the average number of collisions in our 19-cell scenario. We obtain similar results as in the 2-cell scenario: the average reduction in the number of collisions when using different PRACH-ConfigIndex values compared to using the same value is 43%, and we observed reductions of up to 61%. Again, the relative decrease in collisions is smaller 6 To ensure that neighboring cells in a large hexagonal grid are always assigned different PRACH-ConfigIndex values out of the set of four available values, we use the following assignment scheme. We split the hexagonal grid into rows (horizontally neighboring cells). On each row, we alternate between two values, using two distinct sets of values for alternating rows. For instance, we assigned 0 and 1 to even rows and 2 and 15 to odd rows. When reusing a set of values, we invert the order. In our case, we assign row 0 the values 0, 1, 0, 1, . . . , row 2 the values 1, 0, 1, 0, . . . , and so forth.



























  8(V











GHFUHDVHPHGLDQGHOD\

$YHUDJHPHGLDQGHOD\V



6DPH35$&+ 'LIIHUHQW35$&+

Fig. 7. The average median connection delay (median across UEs, average across simulations) per amount of UEs (left y-axis) and the percentual decrease when using different configurations (right y-axis) in the 19-cell scenario. In a large area, assigning different configurations to neighboring cells reduces the connection delay notably.

when there are more UEs, but the absolute decrease is larger. Figure 7 illustrates the median connection delay of all UEs within one simulation, averaged over five repetitions of the simulation. On average, using different PRACH-ConfigIndex values results in an 11% decrease in the connection delay, and the decrease reaches up to 42%. Our findings suggest that in sizeable deployments of many cells, using different PRACHConfigIndex values yields substantial performance benefits for any number of UEs. While our simulations cannot represent all details of real-life deployments, they do show that there is potential for improving the performance of cellular networks by simply deploying different configurations. V. R ELATED W ORK Measurements. Numerous studies have conducted real-life measurements in cellular networks from the point of view of a UE. They offer insights into mobility patterns [23], [24], power consumption [25], [26], network coverage and performance [27], handover performance [24], [26], [28], [29], end-to-end latency [26], software reliability for connection failures [30], and overall Quality of Experience (QoE) [26]. Due to the absence of proper measurement tools from MNOs, researchers have created measurement platforms [31]–[35] to better enable the community to conduct measurements in cellular networks. Researchers have also developed applications for analyzing low-level protocol operations in 4G that run on top of UEs [36], [37]. Furthermore, there are measurement studies by MNOs that have delved into roaming with smartphones [38] or Internet of Things (IoT) devices [39], handovers and user mobility [40], and diagnosing RAN problems [41], [42]. Unfortunately, MNOs rarely make data openly available. For random access configurations in particular, there exist, to the best of our knowledge, no previous studies that have collected, analyzed, and published real-life data. RAN Configurations. Researchers have analyzed the impact of misconfigurations that lead to handover loops, both within one and between different radio access technologies [43]– [45] as well as between small cells and macro-cells [36]. Such loops cause a UE to keep performing handovers even if the radio conditions or the UE’s location do not change.

Misconfigurations can also lead to situations where a UE performs a handover, but the newer cell performs worse than the previous cell [43]. With regard to random access procedures, we are the first to inspect how cellular networks configure these procedures and find how real-world configurations are suboptimal. Moreover, researchers have made use of real-life 4G and 5G datasets for configuration recommendation systems such as Aurora [46] and SOCRATES [47]. These systems use information on the configuration and current performance to recommend or automatically tune network parameters in an attempt to improve the network performance. Such configuration recommendation systems can make use of insights from the random access configurations, and could leverage measurements such as ours to strengthen their recommendations and, thus, improve the overall network performance. RRC Procedures. Some research has aimed to optimize RRC procedures [48]–[51] including random access procedures [3], [4]. Other work has focused on optimizing RRC algorithms for handovers [52]–[54], improving energy usage [55], and cell selection strategies [56]. Nevertheless, none of these works make use of real-life datasets to show the potential impact of configurations in actual cellular deployments. We believe that such insights are vital for further improving the design of RRC schemes. VI. D ISCUSSION Our measurements were obtained from 4G networks and are directly relevant to today’s cellular infrastructure: in 2024 about 58% of smartphone subscribers worldwide still used 4G [1], and in Europe the vast majority of 5G deployments are non-standalone (NSA) relying on LTE for control. Indeed, only 2% of European Speedtest samples are on 5G standalone (SA) networks [2], underscoring the continued dominance of 4G and the need to optimize its operation. Because mobile operators do not make data on connection collisions or delays available from live networks, we could not evaluate the effect of our PRACH reconfiguration scheme in a live network. Instead, like many other works, we resorted to packet-level simulations in NS-3: we implemented the 3GPP random-access procedure using the NS-3.24 simulator with the LENA+ PRACH module. This approach yields a much more realistic view of network behaviour than a purely analytical model: NS-3/LENA+ explicitly models the PHY/MAC stack (including path-loss, fading, and collision effects) and simulates user arrivals (e.g., a uniform population of UEs attempting simultaneous access). In contrast, closedform predictions typically omit these details. Of course, even NS-3 has its limitations. For example, LENA+ only supports a subset of PRACH-ConfigIndex values (even-frame transmissions and format 0) and is tied to an older NS-3 release. These constraints highlight the need for richer simulation tools; in particular, we encourage a community effort to extend NS-3 (or “LENA”) to support 5G-Standalone features so that nextgeneration RAN behaviour can also be accurately evaluated.

VII. C ONCLUSION In this paper, we have measured, analyzed, and simulated the random access configurations of real-life cellular networks. Our measurements show that random access configurations in the wild barely adapt to the deployment scenarios at hand, and neighboring cells often use the same configurations. Our simulations reveal that such configurations are deficient, and assigning configurations more astutely can greatly reduce the risk of collisions, shortening the connection setup for many users, and allowing for more efficient use of network resources. We hope our work encourages operators and researchers to design and deploy such astute random access configuration schemes, and we envision the advent of RICs to enable these schemes in practice. Furthermore, we invite the community to explore the configurations of other cell broadcast parameters, for which there might be room for optimizations similar to what we have shown. ACKNOWLEDGEMENTS This research was supported by the National Growth Fund through the Dutch 6G flagship project “Future Network Services”. Furthermore, we thank Adrian Zapletal for his valuable feedback on this work. R EFERENCES [1] GSMA. (2025) The Mobile Economy 2025. [Online]. Available: https://www.gsma.com/solutions-and-impact/ connectivity-for-good/mobile-economy/ [2] Ookla. (2025) A Global Evaluation of Europe’s Competitiveness in 5G SA. [Online]. Available: https://www.ookla.com/articles/ europe-5gsa-2025 [3] M. Polese, M. Centenaro, A. Zanella, and M. Zorzi, “M2M Massive Access in LTE: RACH Performance Evaluation in a Smart City Scenario,” in IEEE ICC, 2016. [4] T.-W. Huang, Y. Ren, K. C.-J. Lin, and Y.-C. Tseng, “r-Hint: A Messageefficient Random Access Response for mMTC in 5G Networks,” in IEEE PIMRC, 2017. [5] O.-R. Alliance. (2024) Open Software for the RAN. [Online]. Available: https://www.o-ran.org [6] O-RAN Near-RT RIC Architecture 5.0, O-RAN Alliance, Oct. 2023. [7] 3GPP, “Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); LTE; Network architecture (3GPP TS 23.002 version 18.0.0 Release 18),” https://www. 3gpp.org/dynareport/23002.htm, 2024. [8] GSMA, “Spectrum regional insights,” hhttps://www.gsma.com/ connectivity-for-good/spectrum/spectrum-regional-insights/, 2024, [Online; accessed 9-May-2024]. [9] 3GPP, “LTE; Evolved Universal Terrestrial Radio Access (E-UTRA); Physical channels and modulation (3GPP TS 36.211),” https://www. 3gpp.org/dynareport/36211.htm, 2024. [10] ——, “LTE; Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN); Overall description; Stage 2, 3GPP TS 36.300 version 17.3.0 Release 17,” https://www.3gpp.org/dynareport/36300.htm, 2024. [11] ——, “LTE; Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification (3GPP TS 36.331),” https://www.3gpp.org/dynareport/36331.htm, 2024. [12] H. Holma and A. Toskala, LTE for UMTS: Evolution to LTE-Advanced: Second Edition, 2011, ch. 5, pp. 83–139. [13] S. Hamalainen, H. Sanneck, and C. Sartori, LTE Self-Organising Networks (SON): Network Management Automation for Operational Efficiency, 2012, ch. 5. [14] P1Security, “QCSuper,” https://github.com/P1sec/QCSuper, 2024. [15] Cellmapper, “Cellmapper Map,” https://www.cellmapper.net, 2024. [16] OpenCellid, “OpenCellid,” https://opencellid.org, 2024.

[17] P. Bertrand and J. Jiang, LTE – The UMTS Long Term Evolution. John Wiley & Sons, Ltd, 2011, ch. 17, pp. 371–406. [18] S. Ahmadi, LTE-Advanced: A Practical Systems Approach to Understanding 3GPP LTE Releases 10 and 11 Radio Access Technologies. Academic Press Inc; Illustrated edition, 2013, ch. 10. [19] 3GPP, “5G; Study on Scenarios and Requirements for Next Generation Access Technologies (3GPP TR 38.913 version 17.0.0 Release 17),” https://www.3gpp.org/dynareport/38913.htm, 2022. [20] G. F. Riley, T. R. Henderson, and N. S. Goff, “NS-3: A discreteevent network simulator for Internet systems,” University of Wisconsin, Technical Report, vol. ECE-TR-03-05, 2008. [21] nsnam.org, “NS-3.24,” https://www.nsnam.org/releases/ns-3-24/, 2015, [Online; accessed 24-August-2023]. [22] 3GPP, “Universal Mobile Telecommunications System (UMTS); Radio Frequency (RF) system scenarios (3GPP TR 25.942 version 17.0.0 Release 17),” https://www.3gpp.org/dynareport/125942.htm, 2022. [23] H. Kolamunna, I. Leontiadis, D. Perino, S. Seneviratne, K. Thilakarathna, and A. Seneviratne, “A First Look at SIM-enabled Wearables in the Wild,” in ACM IMC, 2018. [24] C. E. Andrade, S. D. Byers, V. Gopalakrishnan, E. Halepovic, D. J. Poole, L. K. Tran, and C. T. Volinsky, “Connected cars in cellular network: A measurement study,” in ACM IMC, 2017. [25] D. Yang, X. Zhang, X. Huang, L. Shen, J. Huang, X. Chang, and G. Xing, “Understanding Power Consumption of NB-IoT in the Wild: Tool and Large-scale Measurement,” in ACM MobiCom, 2020. [26] D. Xu, A. Zhou, X. Zhang, G. Wang, X. Liu, C. An, Y. Shi, L. Liu, and H. Ma, “Understanding Operational 5G: A First Measurement Study on its Coverage, Performance and Energy Consumption,” in ACM SIGCOMM, 2020. [27] M. Ghoshal, I. Khan, Z. J. Kong, P. Dinh, J. Meng, Y. C. Hu, and D. Koutsonikolas, “Performance of Cellular Networks on the Wheels,” in ACM IMC, 2023. [28] L. Li, K. Xu, T. Li, K. Zheng, C. Peng, D. Wang, X. Wang, M. Shen, and R. Mijumbi, “A Measurement Study on Multi-path TCP with Multiple Cellular Carriers on High Speed Rails,” in ACM SIGCOMM, 2018. [29] H. Deng, C. Peng, A. Fida, J. Meng, and Y. C. Hu, “Mobility Support in Cellular Networks: A Measurement Study on its Configurations and Implications,” in ACM IMC, 2018. [30] Y. Li, H. Lin, Z. Li, Y. Liu, F. Qian, L. Gong, X. Xin, and T. Xu, “A Nationwide Study on Cellular Reliability: Measurement, Analysis, and Enhancements,” in ACM SIGCOMM, 2021. [31] A. Nikravesh, H. Yao, S. Xu, D. Choffnes, and Z. M. Mao, “Mobilyzer: An Open Platform for Controllable Mobile Network Measurements,” in ACM MobiSys, 2015. [32] Y. Li, C. Peng, Z. Yuan, J. Li, H. Deng, and T. Wang, “Mobileinsight: Extracting and Analyzing Cellular Network Information on Smartphones,” in ACM MobiCom, 2016. [33] Y. Li, C. Peng, Z. Zhang, Z. Tan, H. Deng, J. Zhao, Q. Li, Y. Guo, K. Ling, B. Ding et al., “Experience: A Five-year Retrospective of MobileInsight,” in ACM MobiCom, 2021. [34] Ö. Alay, A. Lutu, M. Peón-Quirós, V. Mancuso, T. Hirsch, K. Evensen, A. Hansen, S. Alfredsson, J. Karlsson, A. Brunstrom et al., “Experience: An Open Platform for Experimentation with Commercial Mobile Broadband Networks,” in ACM MobiCom, 2017. [35] L. Bonati, S. D’Oro, S. Basagni, and T. Melodia, “SCOPE: An Open and Softwarized Prototyping Platform for NextG Systems,” in ACM MobiSys, 2021. [36] C. Peng, Y. Li, Z. Li, J. Zhao, and J. Xu, “Understanding and Diagnosing Real-world Femtocell Performance Problems,” in IEEE INFOCOM, 2016. [37] X. Shi, M. Osinski, C. Qian, and J. Wang, “Towards Automatic Troubleshooting for User-level Performance Degradation in Cellular Services,” in ACM MobiCom, 2022. [38] A. M. Mandalari, A. Lutu, A. Custura, A. Safari Khatouni, Ö. Alay, M. Bagnulo, V. Bajpai, A. Brunstrom, J. Ott, M. Mellia et al., “Experience: Implications of Roaming in Europe,” in ACM MobiCom, 2018. [39] A. Lutu, B. Jun, A. Finamore, F. E. Bustamante, and D. Perino, “Where Things Roam: Uncovering Cellular IoT/M2M Connectivity,” in ACM IMC, 2020. [40] A. Lutu, D. Perino, M. Bagnulo, E. Frias-Martinez, and J. Khangosstar, “A Characterization of the COVID-19 Pandemic Impact on a Mobile Network Operator Traffic,” in ACM IMC, 2020.

A PPENDIX E THICS The 4G dongle UE we used triggers and sends a failed attach procedure to the eNodeB, but it does not generate any traffic load and neither harms the mobile network infrastructure nor other users. Additionally, we ensured that no authorized or unauthorized connections to any mobile networks were made during our experiments. I NFORMATION E LEMENTS FOR R ANDOM ACCESS As mentioned in Section III-B, SIB2 contains many IEs related to random access for which we observed few different configurations. Figure 8 shows for the IEs in SIB2 that pertain to random access how many unique values we observed in our measurements. For approximately half of the IEs we present here, we observed very few different values being used even though deploying different values based on the deployment scenario might be sensible. Hereafter, we provide brief descriptions of each of these IEs.

1XPEHURIXQLTXHYDOXHVIRUUDQGRPDFFHVVUHODWHG,(V

                 

ILJ

IIVHW UHT2 SUDFK )

ODJ

RQH& RQ LRQ= ]HUR& RUUHO DW

KLJK VSHH G)

:LQG RZ6 L]H PDF& RQWHQ WLRQ5 HVROX WLRQ7 LPHU SUDFK &RQI LJ,QG H[

SRQV H UD5H V

UJHW3 RZHU SUHDP EOH7 UDQV0 D[

WLDO5 HFHLY HG7D

QJ6W H SUHDP EOH,Q L

SRZH U5DP SL

QXP 5$

S

&RXQWU\ &RXQWU\ &RXQWU\

SUHDP EOHV

8QLTXHYDOXHV

[41] M. Dasari, S. Vargas, A. Bhattacharya, A. Balasubramanian, S. R. Das, and M. Ferdman, “Impact of Device Performance on Mobile Internet QoE,” in ACM IMC, 2018. [42] A. P. Iyer, L. E. Li, and I. Stoica, “Automating Diagnosis of Cellular Radio Access Network Problems,” in ACM MobiCom, 2017. [43] Z. Zhang, Y. Liu, Q. Li, Z. Liu, C. Peng, and S. Lu, “Dependent Misconfigurations in 5G/4.5 G Radio Resource Control,” in ACM CoNEXT, 2023. [44] X. Zhao, H. Ma, Y. Jin, and J. Yao, “Measuring Instability of Mobility Management in Cellular Networks,” IEEE Network, vol. 32, no. 5, 2018. [45] Y. Li, H. Deng, J. Li, C. Peng, and S. Lu, “Instability in Distributed Mobility Management: Revisiting Configuration Management in 3G/4G Mobile Networks,” in ACM SIGMETRICS, 2016. [46] A. Mahimkar, Z. Ge, X. Liu, Y. Shaqalle, Y. Xiang, J. Yates, S. Pathak, and R. Reichel, “Aurora: Conformity-based Configuration Recommendation to Improve LTE/5G Service,” in ACM IMC, 2022. [47] A. Eisenblatter, U. Turke, and C. Schmelz, “Self-configuration in LTE Radio Networks: Automatic Generation of ENodeB Parameters,” in IEEE VTC, 2011. [48] N. H. Mahmood, M. Lauridsen, G. Berardinelli, D. Catania, and P. Mogensen, “Radio Resource Management Techniques for eMBB and mMTC Services in 5G Dense Small Cell Scenarios,” in IEEE VTC, 2016. [49] T. Stoner, X. Wei, J. Knight, and L. Guo, “Experience: Rethinking RRC State Machine Optimization in Light of Recent Advancements,” in ACM MobiCom, 2015. [50] X. Wei, T. Stoner, J. Knight, and L. Guo, “Measuring and Understanding RRC State Machine Optimization in Light of Recent Advancements,” IEEE ToMC, vol. 16, no. 5, 2016. [51] Y. Li, H. Deng, C. Peng, Z. Yuan, G.-H. Tu, J. Li, and S. Lu, “iCellular: Device-Customized Cellular Network Access on Commodity Smartphones,” in USENIX NSDI, 2016. [52] M. Liu, Z. Li, X. Guo, and E. Dutkiewicz, “Performance Analysis and Optimization of Handoff Algorithms in Heterogeneous Wireless Networks,” IEEE ToMC, vol. 7, no. 7, 2008. [53] C. Brunner, A. Garavaglia, M. Mittal, M. Narang, and J. V. Bautista, “Inter-system Handover Parameter Optimization,” in IEEE VTC, 2006. [54] A. Lobinger, S. Stefanski, T. Jansen, and I. Balan, “Coordinating Handover Parameter Optimization and Load Balancing in LTE Selfoptimizing Networks,” in IEEE VTC, 2011. [55] A. T. Koc, S. C. Jha, R. Vannithamby, and M. Torlak, “Device Power Saving and Latency Optimization in LTE-A Networks through DRX Configuration,” IEEE ToWC, vol. 13, no. 5, 2014. [56] E. Coronado, S. Siddiqui, and R. Riggio, “Roadrunner: O-RAN-based Cell Selection in Beyond 5G Networks,” in IEEE/IFIP NOMS, 2022. [57] 3GPP, “LTE; Evolved Universal Terrestrial Radio Access (E-UTRA); Medium Access Control (MAC) protocol specification (3GPP TS 36.321),” 3GPP , https://www.3gpp.org/dynareport/36321.htm, 2022.

Fig. 8. Number of unique values for different IEs in SIB2 pertaining to the random access procedure.

numRApreambles: Number of non-dedicated random access preambles [57]. powerRampingStep: Power ramping factor. Value in dB [57]. preambleInitialReceivedTargetPower: Initial preamble power. Value in dBm [57]. preambleTransMax: Maximum number of preamble transmissions [57]. raResponseWindowSize: Duration of the random access response window. Value in subframes [57]. macContentionResolutionTimer: Timer for contention resolution. Value in subframes [57]. prachConfigIndex: The PRACH configuration index that defines the preamble [9, §5.7.1]. highspeedFlag: High-speed-flag. TRUE corresponds to Restricted set and FALSE to Unrestricted set [9, §5.7.2]. zeroCorrelationZoneConfig: NCS configuration, which is the cyclic shift value used for random access preamble generation [9, §5.7.2]. prachFreqOffset: The PRACH frequency offset [9, §5.7.1].

Related documents

• Location Privacy in Cellular Networks#1027245
• When the UE Turns Adversary: Real-Time Uplink Jamming from Within 5G Networks#271734
• CellSecInspector: Safeguarding Cellular Networks via Automated Security Analysis on Specifications#974288
• Method, system and apparatus for multicast session management in 5G … — Nokia Solutions And Networks Oy (US12015967B2)#607184
• Method, system and apparatus for multicast session management in 5G … — Nokia Solutions And Networks Oy (US11825385B2)#607189