Mobile Networking · Mobile Data Under the Hood · Lesson 1 of 4

Getting Online Over Cellular

How your phone joins the carrier's data network and gets an IP address.

The APN: Your Data's Front Door

When you turn on mobile data, your phone asks the carrier's network for a data connection. That request includes an APN, short for Access Point Name. The APN tells the carrier which gateway to use. A gateway is the doorway between the carrier's network and another network, usually the public internet.

The carrier checks the APN and your SIM, then sets up the connection. The gateway gives your phone an IP address, and from then on all your mobile data flows through it. Some carriers use separate APNs for separate jobs, such as one for the internet and one for picture messages (MMS).

Most phones fill in the APN automatically from the SIM. Sometimes you have to enter it yourself, for example with a budget carrier's SIM in an unlocked phone. If calls work but data doesn't, a wrong APN is a common cause.

For investigators, the gateway is a key point. Every mobile data connection passes through it, so the carrier knows which IP address your phone had at a given time.

Carrier-Grade NAT

In the NAT module you saw a home router let many devices share one public IP address. Carriers face the same problem on a much bigger scale. There aren't enough IPv4 addresses for every phone, so many carriers run a huge NAT inside their own network. This is called carrier-grade NAT, or CGNAT.

With CGNAT, your phone gets a private address from the carrier. It often comes from a block reserved for exactly this job, 100.64.0.0/10, set aside in RFC 6598. The carrier's NAT then shares a small pool of public addresses among many customers and tells their connections apart by port number.

You can spot this yourself. The IP address in your phone's settings often won't match the one an IP-checking website reports.

CGNAT matters in investigations. A server log might show one public IP linked to a crime, while hundreds of people used that address at the same moment. To pick out one subscriber, the carrier usually needs the exact time and the source port as well. That's why RFC 6302 advises internet-facing servers to log source ports and accurate timestamps.