Skip to Content

CEL Command — Cellular Connection Status

Query real-time cellular connection status, with fine signal telemetry and cell-based location.


What is it for?

📶 Main use cases:

  • 📊 Monitor network connection quality (RSRP/RSRQ/SINR)
  • 📍 Locate the device by cell (LAC + Cell ID) without GPS
  • 🔍 Diagnose connectivity and coverage issues in the field
  • 📡 Identify active technology (2G, 3G, LTE, NB-IoT) and band
  • 🌍 Verify connected operator (MCC/MNC)
  • 🔧 Communications and network-registration debugging

Commands

OperationSyntaxResponse
Query allQCELRCEL, + 17 fields
Query one fieldQCEL[nn]RCEL[nn],value

The full 17-field response (indices 0-16) is available from firmware v1.09.24. In earlier versions QCEL returns only the first fields (status,tech,mcc,mnc).

The index is always two digits: QCEL04, not QCEL4. With a single digit (or no index) the device replies with the full 17-field line.

Response Fields

#FieldDescriptionValues
0statusRadio connection state (QENG <state>)See table below
1radioServing cell technology as reported by QENGGSM, LTE, eMTC, NBIoT…
2mccMobile Country CodeNumeric country code
3mncMobile Network CodeNumeric operator code
4ratRadio access technology (QNWINFO)GSM, FDD LTE, eMTC, NBIoT…
5bandActive frequency bande.g. B28, B2
6csqRSSI signal0-31, 99=unknown
7cregCREG registration stateNumeric code
8ceregCEREG registration state (LTE)Numeric code
9roamingRoaming active0=no, 1=yes
10simActive SIM0 or 1
11reglvlRegistration ladder levelNumeric
12lacLocation/Tracking Area CodeNumeric
13cellidCell identifier (CID/ECI)Numeric
14rsrpLTE signal powerdBm (e.g. -95)
15rsrqLTE signal qualitydB (e.g. -11)
16sinrLTE signal-to-noiseRaw value

Connection States (field 0)

The value is the <state> field returned by AT+QENG="servingcell" on the modem, verbatim, with no translation in the firmware. The four possible states are the same on BG95 and EG915U:

StateWhat it meansRegistered on the network?
SEARCHSearching, has not found a suitable cell yet❌ No
LIMSRVLimited service: camping on a cell but not registered (SIM rejected, no data plan, PLMN not allowed)❌ No
NOCONNRegistered on the network and radio idle: no connection open at this instant✅ Yes
CONNECTRegistered on the network and with a radio connection open at this instant (transmitting)✅ Yes

NOCONN does not mean “no connection” or “no signal”. It is the normal state of a device that is reporting correctly: a device sending a UDP report every 30 s transmits for milliseconds and leaves the radio idle the rest of the time, so almost any QCEL will find it in NOCONN. Catching a CONNECT is a matter of luck: you have to query right during the transmission.

The states that do indicate a problem are SEARCH (cannot find a network) and LIMSRV (found a network but is not allowed to register).

When the state is SEARCH the modem answers only the state (+QENG: "servingcell","SEARCH"), without the remaining fields. In that case lac and cellid read 0 and field 1 (radio) keeps the last valid reading.

Network Technologies (field 4)

The value arrives exactly as reported by the cellular module (the <AcT> field of AT+QNWINFO), with no translation in the firmware. The exact strings depend on the modem model:

ValueTechnology
GSM2G
WCDMA3G
FDD LTE / TDD LTE4G LTE
eMTCLTE Cat-M1
NBIoTLTE NB-IoT
No ServiceNo service
(empty)No network reading yet

To classify by generation on the server side, match by substring (e.g. contains LTE → 4G) rather than exact equality: the exact string varies by modem.


LTE signal quality (RSRP / RSRQ / SINR)

Fields 14-16 let you assess real coverage without external instruments:

MetricGoodAcceptablePoor
RSRP (dBm)≥ -90-90 to -105< -105
RSRQ (dB)≥ -10-10 to -15< -15
SINRHighMediumLow/negative

SINR is reported as the modem’s raw value (internal index), not direct dB. Use it comparatively between measurements.

Cell-based location (LAC / Cell ID)

Fields 12-13 (lac, cellid) identify the cell the device is connected to. Combined with MCC/MNC they enable an approximate cell-ID location, useful when no GPS fix is available.


How do I know the device is reporting?

The cellular state does not answer that. What tells you reports are going out is that they do not pile up:

QueryExpected responseWhat it checks
QBURBU;GPRS=0;SMS=0Reports pending transmission in the buffer
QDLRDLOK00xxx 00000Second number: datalog reports pending download

If both read zero and do not grow between two queries, the device is delivering everything, whatever the cellular state says. Add a reasonable signal level (QCEL06, the CSQ) and there is nothing to fix.

With WiFi connected and the CXWIF auto-destination set to 1, reports go out over WiFi and the cellular radio stays idle: in that scenario NOCONN is exactly what you should expect.


Examples

Full response (v1.09.24+)

>QCEL< >RCEL,CONNECT,eMTC,722,310,eMTC,B28,24,1,1,0,0,7,7425,12345678,-95,-11,12< // status=CONNECT, rat=eMTC, MCC=722 (Argentina), MNC=310 (Claro), // band=B28, CSQ=24, roaming=0, SIM=0, level=7, // LAC=7425, CellID=12345678, RSRP=-95dBm, RSRQ=-11dB, SINR=12

Indexed query of a single field

>QCEL14< >RCEL14,-95< // RSRP = -95 dBm >QCEL13< >RCEL13,12345678< // Cell ID

Registered on 2G Movistar, idle

>QCEL< >RCEL,NOCONN,GSM,722,7,GSM,B8,14,1,0,0,0,3,7425,0,0,0,0< // NOCONN = registered, with no radio connection open at this instant. // That is normal between reports: the device is working. // The LTE fields (RSRP/RSRQ/SINR) are 0 because the network is 2G.

MCC/MNC Codes Argentina

OperatorMCCMNC
📱 Movistar7227, 70
📱 Claro722310, 320, 330
📱 Personal72234, 341

See the full list of MCC/MNC codes  for other countries.

See Also

Compatibility

💾Firmware:v1.00.00
💾Firmware v1.00.00
SP-IOT
SM-IOT
ZE-IOT
Fine telemetry (17 fields) from v1.09.24
Last updated