Sponsored Links

Band and cell locking guide

Steve1980

Regular Member
There's lots of useful information on the forum about band and cell locking but I thought it might be helpful to write up a guide pulling it into one place. This write-up is more "I did it this way, and here's how you can too" and not "This is the best way to do it, so do it this way!".

I am not an expert but I've been playing around with this a lot recently, specifically in the context of Three UK 5G with a ZTE MC888. I hope a lot of the concepts I've learned are fairly general but if I've got something wrong please let me know. Experts: I am trying to write for a general audience so please accept my apologies if I've brushed complexity under the carpet.

Why use band or cell locking?

If you are happy with your connection, you probably don't need to. If your connection is fine but you like tinkering, you might be able to get an even better connection or you might enjoy learning more about the network in your area.

Band or cell locking is most useful if you can't get a decent connection. I got my shiny new 5G home broadband and it worked great for a couple of days on the automatic settings, then downgraded to unusably slow (<2Mbit/s download) 4G broadband. Cell locking has (touch wood) got me back to a fast and reliable 5G connection.

Experimenting with band or cell locking can be tedious, but when you suddenly get a solid 5G connection it's very rewarding!

Is this safe?

Probably. Take some screenshots of your router's web GUI and/or export the settings to a file before you start playing around. That way if you have to factory reset it you can put things back how they were.

I suspect band locking is safer than cell locking. I did manage to soft-lock my router using cell locking, but taking the SIM out and then doing a factory reset sorted it out. Still, proceed with caution and (naturally) at your own risk.

Why do you keep talking about 4G? I want a 5G connection!

Most UK 5G connections use 5G NSA (non-standalone), which means the 5G connection piggybacks on a 4G connection. That 4G connection has a lot of influence on the 5G connection (if any) and how it performs, so this post is all about 4G band/cell locking. Don't be misled; this is very relevant to getting a good 5G connection, as well as optimising your 4G connection if you are in an area without 5G.

It is possible to do band/cell locking for the 5G part of 5G NSA and for 5G SA (standalone), but I don't have any experience with that so it isn't covered here.

The network cake shop

The mobile network near you is made up of lots of cells. Some of those cells will work better than others, for a variety of reasons. By default your router will look at the cells it can see and pick one for you. In general it will make a good (if not optimal) choice, your connection is fine and you're happy. Sometimes it won't make a good choice and you need to help it make the decision.

Let's pretend for a moment the network is like a cake shop. On the counter in front of you are dozens of cakes of different colours and types.

Not using cell or band locking is like saying to the baker: "I'd like a cake, please. I don't mind which, you pick one you think I'll like."

Using cell locking is like saying: "I'll have that lemon drizzle cake over there."

Band locking is a sort of halfway house, where you are only allowed to talk about colours. You can say "I'll have a yellow cake" or "I'll have a red, green or blue cake", but that's all. The baker picks you a cake that is a colour you specified, based on what he thinks you'd like.

Band locking is easier, because your choice is limited and relatively simple: you don't need to know what a lemon drizzle cake is or how it differs from a lemon tart. But it also gives you less control: if you want a lemon drizzle cake, you can't ask for it directly. You can only tilt the odds in your favour by saying things like "I want a yellow cake", and you might end up with a custard slice.

So in this analogy, the colour of a cake is like the band used by a network cell. The baker plays the role of the router.

The cake shop's special offer

It's actually more complex (but better) than this. The cake shop has a special offer, where they sometimes (not always) give you some additional cakes along with first cake. You never get to pick these yourself; the baker picks them. The only catch is that all the cakes you get have to be different colours.

This is carrier aggregation. A 4G connection typically uses more than one band - one of them is the primary band, and there can be several additional secondary bands. Not all bands are equal, but in general adding an extra band to your connection makes it better.

If you don't use cell or band locking, the baker will pick a cake or cakes, all of different colours, that he thinks you'll like.

If you use cell locking, you pick one cake out, and the baker may pick some others of different colours for you as well.

If you use band locking, you get a cake or cakes picked by the baker, and none of them can be a colour you said you didn't want.

This is another downside to band locking. If you were trying really hard to get given a lemon drizzle cake by saying "I only want a yellow cake", you won't get any extras. If you compromise and say "I want a yellow or red cake", you are less likely to get the lemon drizzle cake you really wanted, but you are still in with a chance, and you might get both a yellow cake and a red cake. You might just get a red cake on its own, though.

What's a band, anyway?

Let's drop the analogy and start using the right terminology.

A band is a range of radio frequencies used to send or receive data. Bands are given arbitrary but standardised numbers and assigned by regional authorities to different network operators. For example, in the UK Three uses bands 1, 3, 20, 28 and 32. These band numbers are probably what you will see when using your router's band locking feature.

Bands can also be referred to by their frequency (for example, band 20 is 800MHz) or by an EARFCN (for example, Three's band 28 is EARFCN 9360). There are lots of websites that will help you convert between these different conventions, such as this one. (Search for your network at the top to make it a lot more readable.)

Your router's network information page will probably use a mix of these ways to refer to bands and it may take some experimentation to work out what's what. I've included some notes for the ZTE MC888 below.

Using band locking

I suggest you try band locking first even if you plan to move on to cell locking later, as it will reveal some useful information about the nearby cells.

Start by finding the bands used by your network; check a few websites because there can be outdated information around. As noted above, Three UK currently uses bands 1, 3, 20, 28 and 32, so that's five different bands.

Your router's 4G band locking controls will allow you to enable or disable each different band individually. You can ignore bands not used by your network, as it won't make any difference whether they are enabled or disabled anyway.

You need to test different combinations of bands being enabled/disabled. For each combination, make sure your change to the band lock settings has been applied and then test the resulting connection. You may get no connection at all, you may get 4G or 5G. If you have a connection, do a speed test - don't just assume that all 4G connections are equally good, all 5G connections are equally good or that 5G is always better than 4G.

Keep notes as you test different combinations. Once you've finished, you can change the settings back to whichever combination worked best. If you can't or don't want to move on to cell locking, you're done.

If you might want to try cell locking afterwards, it will be helpful to check the network information in your router's web GUI and note down the cell ID, PCI and EARFCN of the cells the router picks with each band lock combination. Your router may only show the details for the primary cell, which is good enough, but if it shows the details for the secondary cells as well that is even better.

What band combinations should I try?

I suggest starting off by testing combinations where:
  • each band is enabled in isolation (so for Three, band 1 and nothing else, then band 3 and nothing else, etc)
  • each band is disabled in isolation (so for Three, bands 3+20+28+32, then bands 1+20+28+32, etc)
For n bands that is 2n combinations to test, so 2*5=10 for Three.

If you don't find a good combination that way, or if you're keen to see if you can find an even better one, you could simply try all possible combinations. If your network has n bands, there are 2^n combinations to try. So for Three with 5 bands that's 2^5=32 combinations, which is tedious but manageable. You don't need to test the combination with no bands enabled and you've probably already been testing with all bands enabled before you started band locking.

If you like, you can use this site to generate all the possible combinations of bands to try out.
 
Cell locking

Enable all bands in the band lock settings before moving on to cell locking.

A cell lock is specified by giving a pair of numbers that together uniquely identify a nearby cell: a PCI and an EARFCN.

If we imagine you've been magically given a list of PCI+EARFCNs to try, cell locking is similar to band locking. You test each PCI+EARFCN pair on the list in turn, see what sort of connection you get and make notes. When you've tested them all, you pick the one that worked best for you and that's that. This is tedious but not difficult.

The problem is getting a list of PCI+EARFCN pairs to try. For band locking the worst case is testing something like 30 separate combinations of bands, but the number of possible PCI+EARFCN pairs is much too large to just go and manually test them all. (The vast majority of PCI+EARFCN pairs do not identify any local cell anyway.)

Warning: Based on my own experience, specifying an EARFCN of a downlink-only band is not useful anyway, and it may cause some routers to soft-lock. You should probably check a website like this one and avoid any EARFCNs shown as downlink only.

Cell identifiers

In order to find PCI+EARFCN pairs to try, you need to know something about cell identifiers.

Each cell has a cell ID, which is a long (6+ digit) number that uniquely identifies the cell across the whole network. Cells also have a PCI (Physical Cell Identifier), which is a number in the range 0-503. The PCI does not identify the cell across the whole network (for example, there are cells with PCI 54 in both Nottingham and Inverness), but it will be unique within the local area.

Cells live on cell towers (masts) and each tower will usually have several cells on it. Towers are identified by a tower eNB ID, and these are the IDs shown on the maps on cellmapper.net. Clicking on a tower will show the user-reported details for the cells on that tower, including the PCI and EARFCN. So one way to get PCI+EARFCN pairs to try is to find your home on the cellmapper.net map, click on all the nearby towers and write down all the PCI+EARFCN pairs for all the cells on those towers. This will give you a long but just about manageable list of things to try cell locking to.

Be aware that the data on cellmapper.net can be out of date. PCIs can change over time even if the cell itself remains active with the same cell ID. It won't hurt to use outdated information, but it also takes time and will result in you having no connection with that PCI+EARFCN pair.

One trick worth knowing is that dividing the 6+ digit cell ID by 256 (and ignoring any decimals) will give the tower eNB ID for that cell. This is helpful if (for example) your router shows cell IDs but not tower eNB IDs, since it is easier to search for tower IDs on cellmapper.net than it is to search for cell IDs.

There is no mathematical way to go from a 6+ digit cell ID to a PCI; you can only use network monitoring tools and sites like cellmapper.net to do this.

Where to get PCI+EARFCN pairs to try cell locking to

As noted above, a good source is cellmapper.net. Other mapping websites are available. :)

In order to get up to date information, you could install the cellmapper.net app on your phone and go visit the nearby towers shown on the map. I suggest you take screenshots of the cell information so you don't have to wait for your data to be uploaded and feed through into the online map. PCI+EARFCN pairs you gather this way are more likely to work than old values taken from the cellmapper.net map. The information you gather will not necessarily be complete though - there may be a cell your phone just didn't choose to connect to - so it's still worth trying the values from the cellmapper.net map as well.

As you experiment with cell locking over time, you will have PCI+EARFCN pairs that you know worked well for you at one point, even if they stopped working later. Keep a list of these so you can try them again in the future.

If you tried band locking first and noted down the PCI+EARFCN pairs that the router chose for different band locks, you can try these as cell locks.

You can also use cell permuting, which is described separately below.

Cell permuting

You can only do this if you can get the PCI and EARFCN of the secondary cells your router has connected to.

Suppose at some point you saw your router had connected to three cells using carrier aggregation:
- PCI 156+EARFCN 1392 (primary)
- PCI 462+EARFCN 6175 (secondary)
- PCI 231+EARFCN 99 (secondary)

This might have happened during normal use, or as a result of band locking, or as a result of you cell locking to PCI 156+EARFCN 1392.

Whether this connection works well or not, it's also worth trying cell locks to each of the secondary cells, i.e. try a cell lock to PCI 462+EARFCN 6175 and to PCI 231+EARFCN 99. This might seem silly, but it sometimes works better this way.

In particular, 5G NSA upload uses a mix of 5G and the primary 4G cell, so changing which of the cells being aggregated is the primary may improve your upload speed even if your download speed doesn't change.

Warning: Be particularly careful to avoid downlink-only EARFCNs when using cell permuting. See above for more details on this.

Nothing lasts forever

Factors which can affect your connection include network faults and maintenance, the season, extreme weather and the locations and behaviour of the other people using the network. This means that you might find some settings which work well for you right now, but which stop working later.

For example, I found a promising cell lock but had to abandon it because the cell I was locking to apparently got turned off at about 2am and my connection would stop working. (Cell permuting may help if this happens to you.)

You need to be aware that you could have to tweak your band or cell lock settings in the future. But as my own experience shows, you can't rely on the router's default choices to work either - they might be fine today but unusable tomorrow.

Because cell locking gives the router a very specific target, cell locking is probably more likely to result in no connection at all rather than merely a bad connection if things go wrong. If this is a concern for you, you may want to use only band locking even if you can get better results with a cell lock. For example, if you plan to use internet-accessible cameras to monitor your house while you're on holiday, you might want to avoid using cell locking.

Useful posts

This post has a worked example of how band locking can help and why. You don't need to understand this, you can just try band locking and see if it does help, but I think this is interesting.

Information on 4G performance and weather is given in this post and this post.

Information on upload performance of 5G NSA is given in this post and this post.

Specific tips for the ZTE MC888

On my MC888, the band and cell locking features are hidden away under the misleadingly named Advanced Settings->Others->Developer Options->Network Debug page in the router's web GUI.

Network information for the current connection is shown in the web GUI under Advanced Settings->Others->Network Information:
  • "4G Frequency" is the EARFCN of the primary cell.
  • "4G PCI" is the PCI of the primary cell.
  • "4G Cell ID" is the 6+ digit cell ID of the primary cell.
The tower eNB ID is not shown, but you can take the "4G Cell ID" and divide it by 256 (ignoring any decimals) to get this.

The web GUI does not show full details for the secondary cells being used. The "4G Connected Band" does hint at the EARFCN of the secondary cells, but this is not much use without the PCIs. (A 4G Connected Band of "5.0MHz@800(B20) + 15.0MHz@1800(B3) + 10.0MHz@2100(B1)" shows that the primary cell is using band 20 and two secondary cells are using bands 3 and 1. We can therefore infer that the secondary cells are using EARFCNs 1392 and 99.)

It is possible to get the PCI and EARFCN of the secondary cells by querying the router directly (e.g. using Javascript).

To remove a cell lock, enter 0 for both the PCI and EARFCN and click apply, then restart the router.
 
Last edited:
Sponsored Links
The tower eNB ID is not shown, but you can take the "4G Cell ID" and divide it by 256 to get this.
I just looked again quickly at this post and technically this information is wrong. Does the router output a sector ID since ideally you should do (cell ID - sector ID) / 256?

If that's not the case, I'd link to a sector ID guide or just advise to round the number down at all times (can't say to just round regularly given the 128 sector on O2 and anything higher would give you the wrong eNB).

(for reference Three uses 0-2 sectors for B3, 6-8 for B20, 71-73 for B1 and 91-93 for B28)

e.g. if you divide 2097154 by 256, you don't get a whole number, you need to subtract the sector ID first (in this case 2)

(am I seriously that blind, you did mention it but I failed to see it)
 
I did advise to round it down when I mentioned dividing by 256 earlier in my post, but I didn't there - I'll edit the post to mention it in both places, thanks.

And FWIW I don't see a sector ID on the MC888 network information page, so rounding down is the way to go.

It would be possible to get the sector ID by doing cell ID mod 256, but is that actually interesting? If it is I'll add a link about it, but I'm not sure it is relevant for cell locking.
 
In particular, 5G NSA upload is handled entirely by the primary 4G cell, so changing which of the cells being aggregated is the primary may improve your upload speed even if your download speed doesn't change.
That's not entirely true, if you're close enough to the 5G site you will typically use 5G for upload but falling back to 4G depending on signal conditions.

Of course as n78 can be transmitted much further by a mast than it can be done by a phone you'll often see 4G handling it if you're a distance from the site or if your 4G anchor site is closer.
 
Thanks for the correction. I've updated the guide:
In particular, 5G NSA upload uses a mix of 5G and the primary 4G cell, so changing which of the cells being aggregated is the primary may improve your upload speed even if your download speed doesn't change.
Is that correct/reasonable?
 
Sponsored Links
Hi all.
I've got a ZTE MC7010 and have been experimenting locking to masts etc using Miononno's Javascript page. love it!
When I first got it up and running, I knew which mast and Cell no. I was locked to and I was getting 300+ Mbps.

It's gone down to 100Mbs and on checking the javascript, I'm still connected to the same mast and the same PCI/EARFN but the cell ID has changed from (using cellmapper) No.72 526408 (which was the 300Mbps one) to No.1 526337.
As seen by attached excel spreadsheet info.
I presume by this, I can't lock on to Cell ID 526408 as they have the same PCI/EARFN?
 

Attachments

  • Cell Locking.webp
    Cell Locking.webp
    20.7 KB · Views: 80
Hi all.
I've got a ZTE MC7010 and have been experimenting locking to masts etc using Miononno's Javascript page. love it!
When I first got it up and running, I knew which mast and Cell no. I was locked to and I was getting 300+ Mbps.

It's gone down to 100Mbs and on checking the javascript, I'm still connected to the same mast and the same PCI/EARFN but the cell ID has changed from (using cellmapper) No.72 526408 (which was the 300Mbps one) to No.1 526337.
As seen by attached excel spreadsheet info.
I presume by this, I can't lock on to Cell ID 526408 as they have the same PCI/EARFN?
You should be able to lock on, since this is Three, 0-2 will be EARFCN 1392, 6-8 will be 6175, 71-73 will be 76/99 (what you desire, B1) and 91-93 will be 9360.

Still the same site it's coming from btw, eNB 2056
 
Sponsored Links
Thanks for that. Do what do I put as my PCI/EARFN? (To lock it in using Miononno's JavaScript jack)
If Cellmapper data is right, try 358/99. That should keep it on band 1 which was providing you 300mbps, PCIs might have changed though since Three does that though, hopefully it's not an issue.
 
I think I'm already locked to that. If you look at my spreadsheet, it's the same PCI/EARFN for both cell IDs. Maybe they've dumped cell number 72 (526408) for number 1 526337
I might just try deselecting everything except B1, see if it'll connect to 526408
 
I think I'm already locked to that. If you look at my spreadsheet, it's the same PCI/EARFN for both cell IDs. Maybe they've dumped cell number 72 (526408)
I might just try deselecting everything except B1, see if it'll connect to 526408
Cell ID 1 should be EARFCN 1392 though
 
Interesting. I was actually locked to 471/1392. When I turned off Band 3, I lost service! (Maybe they're doing repairs or something)
Using 358/99 (which is on my spreadsheet and therefore must have connected to before!) I've got my old cell ID back (526408) - still only getting 50-100Mbps.
I'll leave it for a bit - they might be doing repairs- I do miss my 300+Mbps tho!
Thanks for your help. Really appreciate it.
 
Top
Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
150Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £22.99
132Mbps
Gift: None
Vodafone UK ISP Logo
Vodafone £24.00 - 26.00
150Mbps
Gift: None
NOW UK ISP Logo
NOW £24.00
100Mbps
Gift: None
Plusnet UK ISP Logo
Plusnet £25.99
145Mbps
Gift: £50 Reward Card
Large Availability | View All
Cheapest ISPs for 100Mbps+
Gigaclear UK ISP Logo
Gigaclear £17.00
200Mbps
Gift: None
Community Fibre UK ISP Logo
150Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £22.99
132Mbps
Gift: None
Hey! Broadband UK ISP Logo
150Mbps
Gift: None
Youfibre UK ISP Logo
Youfibre £23.99
150Mbps
Gift: None
Large Availability | View All
Sponsored Links
The Top 15 Category Tags
  1. FTTP (6027)
  2. BT (3639)
  3. Politics (2721)
  4. Business (2440)
  5. Openreach (2405)
  6. Building Digital UK (2330)
  7. Mobile Broadband (2146)
  8. FTTC (2083)
  9. Statistics (1901)
  10. 4G (1816)
  11. Virgin Media (1764)
  12. Ofcom Regulation (1582)
  13. Fibre Optic (1467)
  14. Wireless Internet (1462)
  15. 5G (1407)
Sponsored

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms  ,  Privacy and Cookie Policy  ,  Links  ,  Website Rules