CEL Command — Cellular Connection Status
Query real-time cellular connection status, with fine signal telemetry and cell-based location.
What is it for?
📶 Main use cases:
- 📊 Monitor network connection quality (RSRP/RSRQ/SINR)
- 📍 Locate the device by cell (LAC + Cell ID) without GPS
- 🔍 Diagnose connectivity and coverage issues in the field
- 📡 Identify active technology (2G, 3G, LTE, NB-IoT) and band
- 🌍 Verify connected operator (MCC/MNC)
- 🔧 Communications and network-registration debugging
Commands
| Operation | Syntax | Response |
|---|---|---|
| Query all | QCEL | RCEL, + 17 fields |
| Query one field | QCEL[nn] | RCEL[nn],value |
The full 17-field response (indices 0-16) is available from firmware v1.09.24. In earlier versions QCEL returns only the first fields (status,tech,mcc,mnc).
The index is always two digits: QCEL04, not QCEL4. With a single digit (or no index) the device replies with the full 17-field line.
Response Fields
| # | Field | Description | Values |
|---|---|---|---|
| 0 | status | LPWA connection state | See table below |
| 1 | radio | Radio state (registration, QENG) | Status string |
| 2 | mcc | Mobile Country Code | Numeric country code |
| 3 | mnc | Mobile Network Code | Numeric operator code |
| 4 | rat | Radio access technology (QNWINFO) | GSM, FDD LTE, eMTC, NBIoT… |
| 5 | band | Active frequency band | e.g. B28, B2 |
| 6 | csq | RSSI signal | 0-31, 99=unknown |
| 7 | creg | CREG registration state | Numeric code |
| 8 | cereg | CEREG registration state (LTE) | Numeric code |
| 9 | roaming | Roaming active | 0=no, 1=yes |
| 10 | sim | Active SIM | 0 or 1 |
| 11 | reglvl | Registration ladder level | Numeric |
| 12 | lac | Location/Tracking Area Code | Numeric |
| 13 | cellid | Cell identifier (CID/ECI) | Numeric |
| 14 | rsrp | LTE signal power | dBm (e.g. -95) |
| 15 | rsrq | LTE signal quality | dB (e.g. -11) |
| 16 | sinr | LTE signal-to-noise | Raw value |
Connection States (field 0)
| State | Description | Icon |
|---|---|---|
| NOCONN | Not connected to LPWA - IDLE | 🔴 |
| CONNECT | Connected to LPWA | 🟢 |
| SEARCH | Searching for LPWA network | 🟡 |
| LIMSRV | Limited service | 🟠 |
Network Technologies (field 4)
The value arrives exactly as reported by the cellular module (the <AcT> field of AT+QNWINFO), with no translation in the firmware. The exact strings depend on the modem model:
| Value | Technology |
|---|---|
GSM | 2G |
WCDMA | 3G |
FDD LTE / TDD LTE | 4G LTE |
eMTC | LTE Cat-M1 |
NBIoT | LTE NB-IoT |
No Service | No service |
| (empty) | No network reading yet |
To classify by generation on the server side, match by substring (e.g. contains LTE → 4G) rather than exact equality: the exact string varies by modem.
LTE signal quality (RSRP / RSRQ / SINR)
Fields 14-16 let you assess real coverage without external instruments:
| Metric | Good | Acceptable | Poor |
|---|---|---|---|
| RSRP (dBm) | ≥ -90 | -90 to -105 | < -105 |
| RSRQ (dB) | ≥ -10 | -10 to -15 | < -15 |
| SINR | High | Medium | Low/negative |
SINR is reported as the modem’s raw value (internal index), not direct dB. Use it comparatively between measurements.
Cell-based location (LAC / Cell ID)
Fields 12-13 (lac, cellid) identify the cell the device is connected to. Combined with MCC/MNC they enable an approximate cell-ID location, useful when no GPS fix is available.
Examples
Full response (v1.09.24+)
>QCEL<
>RCEL,CONNECT,eMTC,722,310,eMTC,B28,24,1,1,0,0,7,7425,12345678,-95,-11,12<
// status=CONNECT, rat=eMTC, MCC=722 (Argentina), MNC=310 (Claro),
// band=B28, CSQ=24, roaming=0, SIM=0, level=7,
// LAC=7425, CellID=12345678, RSRP=-95dBm, RSRQ=-11dB, SINR=12Indexed query of a single field
>QCEL14<
>RCEL14,-95< // RSRP = -95 dBm
>QCEL13<
>RCEL13,12345678< // Cell IDConnected to 2G Movistar Argentina
>QCEL<
>RCEL,NOCONN,GSM,722,7,GSM,B8,14,1,0,0,0,3,7425,0,0,0,0<MCC/MNC Codes Argentina
| Operator | MCC | MNC |
|---|---|---|
| 📱 Movistar | 722 | 7, 70 |
| 📱 Claro | 722 | 310, 320, 330 |
| 📱 Personal | 722 | 34, 341 |
See the full list of MCC/MNC codes for other countries.