Mobility - Handover, Mobile IP, GTP Anchoring and Connection Survival
- Moving means changing the attachment point. The radio side switches cells with a handover; the IP side must keep the address stable, or every connection keyed on it dies.
- Hysteresis and time-to-trigger stop handover ping-pong: the neighbour must beat the serving cell by a margin and stay ahead for a timer before the phone reports it.
- Mobile IP solves the address problem with a home agent that tunnels to a care-of address, at the cost of triangle routing. Cellular does the same job with a GTP tunnel to an anchor (P-GW or UPF) in the operator core, so phones never need Mobile IP.
- The anchor survives moving between towers, not between networks. Wi-Fi to LTE changes the IP address, so a plain TCP connection breaks; QUIC (connection IDs) and MPTCP (multiple subflows) are how a connection survives.
- Loss on a wireless link is mostly hidden below TCP by HARQ and link-layer retransmission; the bigger wireless problem for TCP is queueing delay, not mistaken loss.
Mental model
You move house and fill in a mail forwarding form. Letters still go to your old address (the home address), the post office there re-addresses them to where you are now (the care-of address), and you keep one stable address that friends write to. Moving between flats in the same building is just a change of door number that the building manager handles, which is the cellular case: you hop between towers and the operator hides it.
Where it breaks: forwarded mail is slow, and so is forwarded IP, because every packet detours through the old address. And real mail never has a strict "must arrive without a gap" rule, whereas a phone call does.
It is a stable load-balancer VIP in front of a changing backend. Clients talk to the VIP (the home address or the anchor), and the backend (where the phone really is) can change underneath. QUIC connection IDs go one step further: they decouple the connection from the 4-tuple the way a session token decouples a login from a TCP socket.
Where it breaks: a VIP is a hop on every path, so tunnelling adds latency (triangle routing), and the VIP is a single point of failure that must be replicated. A load balancer also does not care about radio signal strength; the handover decision is made on measurements that fluctuate.
How it works
Handover: switching towers without dropping the call
Handover (the 3GPP word; "handoff" in older texts) moves a connected phone from a source cell to a target cell. The phone does not decide alone. It measures the reference signal power of its neighbours (RSRP, in dBm), and when a configured event fires it sends a measurement report; the network then commands the handover.
The classic trigger is event A3, defined in 3GPP TS 36.331 clause 5.5.4.4 (and the same event in NR, TS 38.331): the neighbour becomes "offset better" than the serving cell. With no frequency-specific offsets, it is entered when
neighbour - hysteresis > serving + offset
and left when
neighbour + hysteresis < serving + offset
If the entering condition holds continuously for the time-to-trigger (TTT), the phone sends the report. If the leaving condition becomes true during the timer, the timer is cancelled.
Worked example: the A3 trace
Take the numbers as a design exercise (the samples below are made up for illustration, the rule is the standard's): serving cell at -95 dBm when the trace starts, A3 offset 3 dB, hysteresis 2 dB, TTT 320 ms, same carrier frequency so no frequency offsets.
- To enter A3 the neighbour must be stronger than
-95 + 3 + 2 = -90dBm, so a neighbour exactly at -90 dBm does not trigger; it must exceed it. - To leave A3 the neighbour must fall below
-95 + 3 - 2 = -94dBm (derived with the serving level held at -95 for simplicity). The 4 dB gap between -94 and -90 is the dead band, twice the hysteresis.
| Time (ms) | Serving (dBm) | Neighbour (dBm) | Neighbour above -90? | What happens |
|---|---|---|---|---|
| 0 | -95 | -93 | no | Neighbour is already 2 dB stronger, but not 5 dB. Nothing. |
| 200 | -95 | -91 | no | Still inside the dead band. Nothing. |
| 400 | -95 | -89 | yes | A3 entered. TTT timer starts. |
| 560 | -95 | -88 | yes | Held for 160 ms. Timer running. |
| 720 | -95 | -88 | yes | Held for 320 ms. Measurement report is sent. |
Had the neighbour dipped below -94 at, say, 560 ms, the timer would have been cancelled and the whole 320 ms would restart later. That filtering is the entire purpose of the two knobs, and it is why a phone standing on a cell boundary does not bounce between two towers (the ping-pong handover, see the deep dive).
Try it: press Ping-pong demo and step or play the phone along the cell boundary, then Page example to see the same noisy trace with 3 dB, 2 dB and 320 ms. The right-hand counters always show the run with no hysteresis and no TTT for comparison.
RSRP samples are illustrative: log-distance path loss plus seeded noise, not a measurement. A ping-pong is a return to the previous cell within 2 s. Time off the strongest cell is the cost of waiting: too little margin flaps, too much clings to a fading cell until the link fails.
What the network does after the report
The target is chosen and the handover runs in the core-assisted phases laid out in TS 23.401 clause 5.5.1 (4G; the 5G equivalents are in TS 23.502 clause 4.9):
- The source cell sends a handover request to the target (directly over X2 in 4G or Xn in 5G, or through the core over S1 or NG when no direct link exists).
- The target admits the phone and prepares resources. The source tells the phone to switch.
- The phone detaches from the source and synchronises to the target. The source meanwhile forwards packets still queued for the phone to the target, so they are not lost.
- The target asks the core to switch the data path: the downlink tunnel now ends at the target instead of the source. The old context is released.
The radio hop is break-before-make in LTE: there is a short gap while the phone retunes. How long depends on the deployment, so do not quote a number as a fact; the requirement is what is published: ITU-R M.2410 lists a mobility interruption time of 0 ms for IMT-2020 (a design target, not a measurement).
| Type | Break or make | Example |
|---|---|---|
| Hard handover | Break before make: release the old radio link, then set up the new one | GSM, and LTE and NR intra-system handover on a single connection |
| Soft handover | Make before break: the phone is connected to two cells at once for a while | 3G W-CDMA soft handover |
| Seamless (no data loss) | A property, not a mechanism: forwarding from source to target avoids dropped packets even if the radio briefly pauses | LTE data handover with X2 forwarding |
| Client-driven roaming | The device decides when to leave, not the network | Wi-Fi roaming between access points, see Wi-Fi 802.11 |
| Inter-RAT handover | Between different radio technologies, with core involvement | LTE to 5G, or LTE to Wi-Fi calling |
The anchor: how the IP address survives a tower change
The handover moved the radio. It did not move the IP address, and that is the point. The address belongs to the anchor gateway (P-GW in 4G, UPF in 5G), not to the tower, and the user-plane packets reach the phone through GTP-U tunnels (3GPP TS 29.281) from the anchor to whichever tower serves it now. Handover just re-points the tail end of that tunnel. The packet path and architecture are on Cellular Architecture; here is the mobility view.
This is why a phone keeps its IP while crossing a city. It is also why the anchor is a long-lived, stateful box: it is where the address, billing and policy live.
Mobile IP: the textbook answer
The same idea made for the general internet is Mobile IP: RFC 5944 for IPv4 and RFC 6275 for IPv6. The vocabulary:
| Term | Role | Cellular equivalent |
|---|---|---|
| Home network and home address | Where the device belongs; the address everyone else uses | The anchor's address pool (P-GW or UPF) |
| Home agent (HA) | A router on the home network that intercepts packets for the device and tunnels them on | The anchor gateway (P-GW or UPF) |
| Foreign network | Wherever the device currently is | Whichever cell and S-GW serve the phone |
| Care-of address (CoA) | The device's current, topologically correct address, the tunnel endpoint | The serving eNodeB or gNodeB end of the GTP tunnel |
| Foreign agent (FA) | A router on the foreign network that acts as the tunnel endpoint (Mobile IPv4 only) | The serving S-GW or gNodeB side |
| Binding | The HA's table entry that maps home address to CoA, set by a registration | The tunnel endpoint ID (TEID) state in the gateways |
The flow of indirect routing is:
- The device arrives on a foreign network, obtains a care-of address (from a foreign agent, or by DHCP as a "co-located" CoA), and registers it with its home agent (Mobile IPv4 uses UDP port 434).
- A correspondent node sends to the home address. The home agent intercepts the packet and tunnels it (IP in IP) to the care-of address.
- The mobile node replies directly to the correspondent, using its home address as the source.
The cost is triangle routing. A made-up example: suppose correspondent to home agent is 40 ms one way, home agent to the mobile node is 30 ms, and the direct path is 10 ms. The forward path is 40 + 30 = 70 ms against 10 ms direct, seven times longer (derived from the assumed numbers, not a measurement). Mobile IPv6 removes the detour with route optimisation: the correspondent learns the care-of address through a binding update and sends directly, with a return-routability check so a liar cannot hijack someone else's address.
Deep dive
Measuring the radio: RSRP, RSRQ and SINR
Handover decisions use three related numbers. RSRP is the average received power of the cell's reference signals, in dBm, and is what A3 compares. RSRQ is a quality ratio that also includes total received power and so folds in interference and load. SINR is signal over interference plus noise, in dB, the cellular counterpart of the SNR in Wireless Fundamentals. A cell can have high RSRP and still be poor if it is drowning in interference, which is why operators also configure RSRQ-based events.
Tuning hysteresis and TTT
TTT is chosen from a fixed list in TS 36.331 that runs from 0 or 40 ms up to 5120 ms. Hysteresis is configured in half-dB steps. The trade is the same one a thermostat has:
- Too little margin or too short a timer and a phone near a boundary flips between two cells (ping-pong), wasting signalling and interrupting data each time.
- Too much and the phone clings to a fading cell until the link fails (a radio link failure, which looks to the user like a dropped call or a stalled page) before the handover happens.
Faster-moving users need a shorter TTT, which is why operators vary the parameters per cell and use self-organising networks (SON) to tune them from measured handover failures and ping-pongs.
X2 or Xn handover versus S1 or NG
When two cells have a direct interface (X2 in 4G, Xn in 5G) they exchange the handover request directly and tell the core afterwards with a path switch. Without a direct interface the source goes through the MME (or AMF) over S1 (or NG), which relays the request. Both reach the same result; the direct path has less signalling and is the default where it exists.
Inter-RAT handover and Wi-Fi calling
Moving between LTE and 5G NR is a handover with core involvement. Moving between a cellular network and Wi-Fi is different in kind: voice over Wi-Fi uses an IPsec tunnel from the phone to an ePDG in the operator core (TS 23.402), so the call keeps its IMS session even though the radio changes. For data, the operator's anchor cannot follow the phone onto the home Wi-Fi, which is where connection survival (below) comes in. Between Wi-Fi access points the device itself decides to roam, and the amendments 802.11r (fast BSS transition), 802.11k (neighbour reports) and 802.11v (BSS transition management) shorten the gap by moving the key exchange earlier, listing candidate APs and letting the network suggest a move. Detail is on Wi-Fi 802.11.
Mobile IPv6 and why cellular does not use it
Mobile IPv6 (RFC 6275) has no foreign agents: the mobile node configures its own care-of address with IPv6 autoconfiguration (see IPv6) and registers it with the home agent by a binding update. Packets carry the home address in a home address option or routing header.
Phones do not use it for the same reason enterprises prefer VPNs to it: the operator already owns the path. The GTP anchor gives address stability inside the operator's network with no help from the phone and no changes to the correspondent. Mobile IP also needs an extra tunnel, and reverse traffic that uses a home-address source can be dropped by ingress filtering, which is why reverse tunnelling was added later (RFC 3024).
IP preservation versus session continuity
These are different goals. IP preservation (Mobile IP, GTP anchor) keeps the address so unaware applications keep working. Session continuity means the conversation carries on, and it can be achieved without preserving the address at all if the transport can tolerate an address change. Wi-Fi to LTE breaks the first (a new network, a new address, and the CGNAT on the carrier side, see NAT), so everything after that is about the second.
Why TCP breaks, and what survives
A TCP connection is named by its 4-tuple (source IP, source port, destination IP, destination port; see TCP connection). Change the source IP and the server has no connection to match the packets to. The stall that follows lasts until the retransmission timers give up, because the old path is silent and the new path is not recognised.
| Mechanism | Survives a path change? | Deployed where |
|---|---|---|
| Plain TCP | No: the 4-tuple changes | Everywhere, which is why apps reconnect |
| GTP anchor | Yes across towers inside one operator, no across to Wi-Fi | All 4G and 5G networks |
| Mobile IPv4 or IPv6 | Yes in principle, with triangle routing or route optimisation | Rare outside special deployments |
| QUIC connection migration (RFC 9000 section 9) | Yes: the connection is found by connection ID, then the new path is validated | HTTP/3 clients and servers, see QUIC and HTTP/3 |
| MPTCP (RFC 8684) | Yes: multiple subflows, each its own 4-tuple, under one connection | Apple (Siri and Maps), Linux 5.6 and later |
| Application reconnect or ICE restart | Yes, with a new session and some recovery work | WebRTC and most mobile apps |
QUIC migration in detail
QUIC fixes the identity problem at the transport layer. Each side picks connection IDs that appear in every packet, and the server finds the connection from the ID, not from the address. When the client's address changes, it keeps sending on the new path; the server answers a packet from an unrecognised address with PATH_CHALLENGE and the client replies with PATH_RESPONSE. Until that completes the server is capped by the anti-amplification limit (three times what it has received) so a spoofed source cannot be used for a flood (RFC 9000 section 9.3). Only the client initiates migration, and the spec asks an endpoint to switch to a new connection ID on the new path so an observer cannot link the two paths. The full account of IDs and the handshake belongs to QUIC and HTTP/3.
MPTCP
Multipath TCP presents one TCP connection to the application while using several subflows, each a normal TCP connection over a different interface, tied together with a token (RFC 8684, which obsoleted the experimental RFC 6824). If Wi-Fi disappears the connection continues on the LTE subflow. It needs support at both ends, and middleboxes that strip unknown TCP options can break it, which is part of why it is deployed where one company controls both ends (the client OS and a server) rather than across the open internet.
TCP over wireless
The textbook claim is that TCP reads every loss as congestion and so throttles needlessly on a lossy wireless link (see Congestion Control for the AIMD logic, which is not re-taught here). The loss side is real, but it is mostly hidden before TCP sees it:
- HARQ (hybrid ARQ) at the radio layer retransmits a corrupted block within a few milliseconds and combines the copies (LTE FDD uses 8 HARQ processes, TS 36.321). Above it, RLC acknowledged mode retransmits what HARQ missed.
- So the loss TCP sees is small, and the visible symptom is more often delay: the retransmissions and a deep radio buffer add queueing, a case of bufferbloat on the radio link (see Congestion Control).
- BBR estimates bandwidth and round-trip time instead of treating each loss as a congestion signal, which helps where loss is not congestion, but it has its own behaviour on shared queues; the comparison belongs to the congestion control page.
Textbook vs real world
| The textbook says | Production does | Why |
|---|---|---|
| Mobility uses Mobile IP with home and foreign agents | Cellular uses a GTP tunnel to an anchor gateway; Wi-Fi uses DHCP on the new network and apps reconnect | The operator owns the path, so no phone support or correspondent change is needed |
| TCP over wireless is broken because loss means congestion | HARQ and RLC ARQ hide most radio loss; delay and bufferbloat on the radio link are the bigger issue | Link-layer retransmission sits below TCP; see the congestion control page |
| Direct routing sends traffic straight to the device | Traffic goes through the anchor tunnel every time | The anchor holds the address, billing and policy |
| Handover drops the call | Data handover in LTE forwards queued packets; voice stays up in practice | Target buffering and forwarding avoid loss even with a brief radio gap |
| A moving device keeps its connections | Only across towers inside one operator; Wi-Fi to LTE changes the address and breaks plain TCP | Different networks, different addresses and NATs |
In production
- iOS and Android switch a weak Wi-Fi connection to cellular automatically (Apple calls it Wi-Fi Assist); connections that cannot survive the address change must reconnect. Behaviour is documented in the vendors' support pages, so check the current one rather than relying on a description here.
- Google QUIC and HTTP/3 are deployed in Chrome and on Google's services; connection migration is part of the QUIC standard (RFC 9000) and whether a given deployment uses it depends on the client and server stack.
- Apple MPTCP has been used for Siri since iOS 7 in 2013 (see Multipath TCP for a survey of deployments and RFC 8684 for the protocol).
- Operator Wi-Fi calling (VoWiFi) uses an IPsec tunnel to the operator's ePDG (TS 23.402).
- Self-organising networks tune handover parameters from measured outcomes; the SON features are defined across 3GPP releases, starting from Release 8, and vendors differ in what they expose.
- WireGuard keeps a tunnel alive through an address change by updating the peer endpoint from the latest authenticated packet (WireGuard paper), a simple version of the same idea as QUIC migration.
History and evolution
- 1996 Mobile IP (RFC 2002) lets a host keep its address across networks with a home agent. IPv4 had no concept of a host moving.
- 2004 Mobile IPv6 (RFC 3775, revised as RFC 6275 in 2011) removes foreign agents and adds route optimisation, because triangle routing was costly.
- 2010 Mobile IPv4 is revised as RFC 5944. Meanwhile mobile networks never adopted it: cellular data used GTP anchoring from GPRS in the late 1990s, so the operator hid mobility.
- 2013 MPTCP (RFC 6824) lets one connection use several interfaces, and Apple deploys it for Siri, because plain TCP dies at an address change. It becomes RFC 8684 in 2020.
- 2021 QUIC (RFC 9000) builds connection migration into the transport with connection IDs, because the 4-tuple was the wrong identity for a mobile client.
- Now GTP anchors plus CGNAT plus QUIC and app-level reconnect is the working stack.
- Next 5G UPF relocation (moving the anchor close to the user) and ATSSS (access traffic steering, switching and splitting) in the 5G core, which steers one session across Wi-Fi and 5G.
Hands-on
Output depends on your network and tools, so none is reproduced here. Run each and read the fields named.
Watch a TCP connection stall on a path change (Linux). Start a long download, then drop the interface it is using (Cloudflare's endpoint refuses requests of 100 MB or more, as of 2026-10, so the rate limit keeps the transfer running long enough):
In another terminal, bring the interface down (sudo ip link set wlan0 down) and watch the transfer freeze; it does not switch to another interface because the 4-tuple is fixed. Inspect the socket with:
Look at cwnd (congestion window), rtt (smoothed round-trip time) and retrans (retransmissions): after the path change the rtt estimate and retransmission counter grow while nothing is delivered. ss is Linux only; on macOS use netstat -an and Activity Monitor or nettop.
Check Multipath TCP support (Linux 5.6 or later, current iproute2):
An empty list means no extra endpoints are configured; add one with ip mptcp endpoint add <address> dev <interface> subflow and run a client under mptcpize run (from the mptcpd tools) to see it use both. See the kernel MPTCP documentation.
See QUIC path validation in Wireshark: set the SSLKEYLOGFILE environment variable for your browser so Wireshark can decrypt, switch networks mid-transfer, and filter on QUIC frame types 0x1a (PATH_CHALLENGE) and 0x1b (PATH_RESPONSE), frame types defined in RFC 9000 section 19.
Compare jitter over tethering with mtr (macOS and Linux) against a public host: mtr -rwc 50 1.1.1.1. Read the StDev and Wrst columns for the radio hop; the first hops beyond the phone are the carrier's.
Gotchas
Interview questions
Show answer
The address is held by an anchor gateway (P-GW in 4G, UPF in 5G) in the operator core, not by the tower. Packets reach the phone through a GTP-U tunnel from the anchor to the serving cell. On handover only the tail of that tunnel is moved to the target cell, so the address never changes.
Follow-ups:
- What changes on Wi-Fi to LTE? The phone leaves the operator's anchor and joins a different network, so it gets a new address and plain TCP connections break.
- Where is the tunnel defined? GTP-U is specified in 3GPP TS 29.281.
Show answer
Mobile IP lets a host keep its home address while on another network. A home agent on the home network intercepts packets for that address and tunnels them to the host's current care-of address. The reply goes back directly, so the paths form a triangle, and the forward path is longer than a direct one.
Follow-ups:
- Why is it not widely used? Cellular already hides mobility with a GTP anchor, and the extra tunnel, the home agent dependency and ingress filtering made it unattractive elsewhere.
- How does Mobile IPv6 help? Route optimisation lets the correspondent send directly to the care-of address after a return-routability check, and it drops foreign agents.
Show answer
The new network gives the phone a new source address, so the 4-tuple changes and the server drops the packets because no connection matches. The old path goes silent and TCP waits on retransmission timers until it gives up.
Follow-ups:
- How does QUIC avoid it? It identifies the connection by connection ID, validates the new path with PATH_CHALLENGE and PATH_RESPONSE, and carries on.
- How does MPTCP avoid it? The connection has several subflows over different interfaces, so it continues on the surviving one.
Show answer
It prevents ping-pong. A phone near a cell boundary sees the two signals jitter around equality, and without a margin it would hand over back and forth. The A3 event requires the neighbour to beat the serving cell by offset plus hysteresis and to stay ahead for the time-to-trigger.
Follow-ups:
- What are the A3 parameters? An offset, a hysteresis, and a time-to-trigger; with offset 3 dB and hysteresis 2 dB the neighbour must be 5 dB stronger.
- What goes wrong if they are too large? The phone holds a fading cell too long and can suffer radio link failure.
Show answer
Radio links lose and delay packets, and TCP can read loss as congestion. Mitigations sit below TCP: HARQ and RLC ARQ retransmit locally so little loss reaches TCP, and congestion controllers such as BBR do not rely on loss alone. In practice the larger problem is queueing delay on the radio link rather than mistaken loss.
Follow-ups:
- What is bufferbloat on the radio? Deep buffers plus retransmissions inflate round-trip time; see the congestion control page.
- Do performance-enhancing proxies help? Operators have used them to split a TCP connection at the edge, but they break end-to-end semantics and do not work with encrypted transports like QUIC.
Show answer
Keep the media session independent of the address. Use QUIC or WebRTC with ICE restart so a new candidate pair is negotiated when the interface changes, keep a jitter buffer to ride out the gap, and keep signalling on a connection that can reconnect. Prefer a transport with connection IDs so the path change does not need a new handshake.
Follow-ups:
- What does an ICE restart cost? A fresh candidate gathering and connectivity check, which takes a few round trips; the jitter buffer hides the silence.
- What about server-side load balancers? They must route on connection ID, not the 4-tuple, or migration lands on the wrong backend (see the QUIC page).
Show answer
Carrier-grade NAT shares public addresses among many subscribers and keeps a mapping per flow, so there is no mapping for inbound traffic and peers need STUN, TURN and ICE to connect. Idle mappings expire, so long-lived connections need keepalives shorter than the NAT timeout, or the app must reconnect. See NAT.
Follow-ups:
- What is a safe keepalive interval? It depends on the operator; measure it rather than assuming, since timeouts vary widely.
- Does IPv6 help? Yes, an IPv6 address reaches the phone without NAT44, though stateful firewalls still block unsolicited inbound traffic.
Fun facts
- Mobile IPv4 registrations travel over UDP port 434 (RFC 5944).
- The A3 time-to-trigger can be as short as 40 ms or as long as 5120 ms in the standard's list (TS 36.331).
- QUIC frame types
0x1aand0x1bare PATH_CHALLENGE and PATH_RESPONSE (RFC 9000 section 19). - Mobile IPv6 removed the foreign agent entirely, because IPv6 hosts can configure their own care-of address.
Cheat sheet
- A3 entry - neighbour more than serving + offset + hysteresis, held for TTT (example: -95 + 3 + 2 = -90 dBm)
- Dead band - twice the hysteresis (4 dB in the example)
- TTT range - 40 ms to 5120 ms in the standard's list
- UDP 434 - Mobile IPv4 registration
- UDP 2152 - GTP-U user-plane tunnels
- 0 ms - IMT-2020 mobility interruption requirement (ITU-R M.2410), a target not a measurement