Discovering Parameter Setting in 3G Networks via Active Measurements

The behavior and performance of a UMTS network are governed by a number of parameter settings that are configured by the network operator, e.g., timeouts. In this letter we show that the actual value of such parameters can be inferred by a conceptually simple set of end-to-end measurements, without any cooperation with the network operator. In principle, such information can be used by researchers to define realistic network scenarios, e.g., for their simulations. Moreover, it can be used by a malicious attacker to fine-tune a large scale attack against the radio access network, e.g., a paging attack.