How to Inspect Cellular Network Telemetry and Signal Quality on Android Using ADB dumpsys telephony.registry

Diagnosing mobile data connection drops, carrier aggregation failures, and erratic signal fluctuations on Android devices requires low-level radio telemetry beyond standard graphical signal bars. While the Android Settings menu displays basic carrier names and numerical network types, critical radio frequency (RF) parameters—such as physical cell identity (PCI), Reference Signal Received Power (RSRP), Signal-to-Interference-plus-Noise Ratio (SINR), LTE/5G frequency bands, and active voice call states—are processed by the Android Telephony framework. Using the Android Debug Bridge (ADB), engineers and mobile app developers can extract real-time radio metrics directly using dumpsys telephony.registry.

Architecture of the Android Telephony Registry

The Android telephony architecture operates across multiple layers: the cellular baseband modem, the Radio Interface Layer (RIL) Hardware Abstraction Layer, and the system TelephonyRegistry daemon. The telephony.registry service acts as a centralized event broker that maintains the live state of all SIM slots and subscriptions, notifying registered system components and applications whenever signal strengths shift, cell towers hand over, or data connections transition.

The dumpsys telephony.registry diagnostic utility exposes the internal state tables of this broker, providing an exhaustive snapshot of physical cell measurements and data network registrations.

Inspecting Real-Time Cellular Telemetry via ADB

To inspect active cellular connections, connect your device via USB or wireless debugging and run:

adb shell dumpsys telephony.registry

Because the registry dump tracks event listeners and active listeners across all installed apps, filtering for physical cell identity and signal strength isolates key RF metrics.

Querying Serving Cell Tower Identity and Frequency Bands

To view the serving cell tower and neighboring cellular towers detected by the modem, filter for cell info blocks:

adb shell dumpsys telephony.registry | grep -A 20 "mCellInfo"

A typical LTE or 5G NR connection reports detailed RF parameters:

mCellInfo:
  CellInfoLte:
    CellIdentityLte:{ mCi=28419201 mPci=342 mTac=14201 mEarfcn=1650 mBands=[3] mMcc=234 mMnc=15 }
    CellSignalStrengthLte: rssi=-65 rsrp=-92 rsrq=-10 rssnr=180 cqi=14 level=4

Key parameters include:

• mCi (Cell Identity): The unique global cell tower sector identifier.
• mPci (Physical Cell ID): The physical radio cell identifier (0–503 for LTE, 0–1007 for 5G NR) used by the radio modem to differentiate overlapping sectors.
• mEarfcn / mArfcn: The Absolute Radio Frequency Channel Number identifying the exact carrier uplink and downlink center frequency.
• mBands: The active operating LTE or 5G band (e.g., Band 3 for 1800 MHz, Band 20 for 800 MHz, Band 78 for 5G 3.5 GHz).

Evaluating Signal Quality Metrics (RSRP, RSRQ, and SINR)

Unlike raw received signal strength indicator (RSSI) which measures all incoming radio energy including noise, modern LTE and 5G connections evaluate signal quality using specialized metrics reported in the dump:

Metric	Optimal Range	Poor Range	Technical Diagnostic Meaning
rsrp	-70 to -90 dBm	Below -115 dBm	Reference Signal Received Power: The actual power of the dedicated LTE reference signals. Lower values cause link degradation.
rsrq	-3 to -10 dB	Below -15 dB	Reference Signal Received Quality: Measures the ratio of reference signal to total received channel power, indicating cell edge interference.
rssnr / sinr	15 to 30 dB	Below 0 dB	Signal-to-Interference-plus-Noise Ratio: True channel clarity. Values below 0 dB indicate extreme radio frequency noise or co-channel interference.

Auditing Data Connection States and APN Profiles

To inspect active packet data networks, IP routing parameters, and Access Point Name (APN) bearer types, query the data connection block:

adb shell dumpsys telephony.registry | grep -A 15 "mDataConnectionState"

The dump reveals:

mDataConnectionState: 2 (CONNECTED)
mDataConnectionNetworkType: 13 (LTE)
mPreciseDataConnectionState:
  State: 2 (CONNECTED), NetworkType: 13, APN: "internet.telecom.com"
  FailCause: 0 (NONE)

If mobile data fails to connect, the FailCause field indicates whether the failure was caused by authentication rejection, APN misconfiguration, or radio link timeout.

Monitoring Live Telephony Events

To trace cellular tower handovers, radio power mode transitions, and signal changes dynamically, pipe logcat through telephony tags:

adb logcat -v time -s TelephonyRegistry RILJ GsmCdmaPhone

Monitoring this stream while driving, testing in RF shielding enclosures, or performing network handovers reveals precisely when the radio modem requests cell reselection and whether carrier aggregation secondary cells (SCell) activate during high-bandwidth transfers.