Great question! It makes total sense to wonder about this since ETSI's GSM Layer 3 broadcast messages (like System Information Blocks) don't explicitly carry identifiers like CID or LAC. Here's the breakdown of how Android pulls this data:

• Direct Modem Communication via AT Commands
  Android's Telephony framework interacts directly with the device's modem using standard GSM AT commands. For example:

  • AT+CREG? returns the device's registration status along with the Location Area Code (LAC) and Cell ID (CID)
  • AT+COPS? fetches the Mobile Country Code (MCC) and Mobile Network Code (MNC)
    The modem stores these identifiers from core network signaling (like location updates or attach procedures) and exposes them via these commands. The Telephony service parses the responses and makes them available to upper-layer APIs.

• System-Level Caching in Telephony Databases
  Android maintains internal databases (like telephony.db) that cache cell and network information to avoid repeated modem queries. Tables like cell_info or carriers store recent MCC/MNC/CID/LAC values. When you call APIs like TelephonyManager.getNetworkOperator() or getCellLocation(), the system often pulls directly from this cache for faster access—only falling back to the modem if the cache is stale.

• Radio Interface Layer (RIL) Messaging
  The RIL acts as the middleman between Android's Telephony framework and the modem. The modem sends asynchronous RIL messages (like RIL_UNSOL_CELL_INFO_LIST) to the system whenever cell information changes. The RIL layer parses these messages into CellInfo objects, updates the system cache, and triggers callbacks for apps listening to cell changes.

To circle back to your observation about Layer 3 broadcasts: those messages focus on public cell parameters (e.g., frequency bands, neighbor lists, access rules). Identifiers like CID and LAC are exchanged during dedicated signaling between the device and core network (not broadcast to all devices), which is why the modem has to track them separately and expose them to Android via the methods above.

内容的提问来源于stack exchange，提问作者Walidebisi