Having fun with 4G/5G network – part 1

As I’m looking for a fallback connection for my home fiber, I’ve been experimenting with 4G and 5G at home. I’ll write down my discoveries little by little across multiple posts.

The first router: “why am I stuck at 10 Mbps?”

I started with a basic 4G router, the MERCUSYS MB110-4G. The connection was underwhelming: I could barely reach ~10 Mbps down / ~10 Mbps up, even though the box claims up to 150 Mbps.

That’s when I learned about LTE categories. This router is LTE Cat 4, and the “150 Mbps” number is a theoretical peak under ideal conditions. Different LTE categories support different features (carrier aggregation, higher-order modulation, etc.). This page has a good overview:
https://4grouter.co.uk/4g-and-5g-lte-categories-and-their-characteristics-cat4-cat6-cat12-etc/

Moving to a better modem (Cudy LTE)

I switched from the Mercusys to a Cudy LTE modem/router, mainly to get better modem capabilities and visibility into what the radio was doing.

5G basics (NSA vs SA)

One thing I discovered: in many networks, 5G runs in NSA (Non-Standalone) mode, where 4G provides the anchor and 5G is added when conditions allow. (Some operators also support 5G SA — Standalone — where 5G can operate without a 4G anchor.)

Also, not all 5G (or LTE) frequencies behave the same: lower frequencies typically penetrate walls better, while higher frequencies often provide more capacity but don’t travel/penetrate as well. So “best band” depends on your location and indoor/outdoor setup.

Finding towers and bands

To explore nearby cells and bands I used CellMapper:
https://www.cellmapper.net/map

Near my home, with my current setup/operator, I can reliably use Band 3 and Band 20. I can’t get a useful Band 7 carrier from my location (at least not with my current operator).

Checking Carrier Aggregation: AT+QCAINFO

This command shows what the modem is aggregated on:

AT+QCAINFO+QCAINFO: "PCC",6400,50,"LTE BAND 20",5,173,-58,-9,-29,6
+QCAINFO: "SCC",1301,100,"LTE BAND 3",1,375,-75,-13,-52,1OK

• PCC = Primary Component Carrier
• SCC = Secondary Component Carrier (added via Carrier Aggregation)

In my case, Band 20 alone gives me ~11 Mbps, while Band 20 + Band 3 (CA) gets me up to ~60 Mbps. Huge difference.

Morning speeds: why do they sometimes drop?

I noticed that in the morning I sometimes fall back to ~10 Mbps. My current theory is that carrier aggregation (or one of the carriers I depend on) isn’t available yet, or the modem sticks to a suboptimal cell/band until it reconnects.

A crude-but-effective workaround has been rebooting the router around 8:00 AM, which often results in a better attachment/CA combo.

How the modem decides what to camp on

The modem’s choice is heavily influenced by radio metrics:

• RSRP = signal strength (roughly “how loud” the cell is)
• RSRQ = signal quality (how clean it is vs interference/load)
• SINR / SNR = signal vs noise (often a big driver for throughput)

These are expressed in dB/dBm, so negative values are normal.

You can inspect the current serving cell with:

AT+QENG="servingcell"+QENG: "servingcell","NOCONN","LTE","FDD",214,07,7086A14,375,1301,3,5,5,B61E,-76,-12,-42,11,80,-OK

And neighboring cells with:

AT+QENG="neighbourcell"+QENG: "neighbourcell intra","LTE",1301,375,-14,-75,-41,-,-,-,-,-,-
+QENG: "neighbourcell intra","LTE",1301,260,-20,-84,-52,-,-,-,-,-,-
+QENG: "neighbourcell intra","LTE",1301,193,-19,-81,-52,-,-,-,-,-,-
+QENG: "neighbourcell inter","LTE",6400,173,-13,-60,-37,-,-,-,-,-
+QENG: "neighbourcell inter","LTE",6400,24,-20,-68,-37,-,-,-,-,-
+QENG: "neighbourcell inter","LTE",6400,204,-20,-70,-37,-,-,-,-,-
+QENG: "neighbourcell inter","LTE",6400,97,-20,-68,-37,-,-,-,-,-OK

The output is typically shaped like:

"neighbourcell intra","LTE", <EARFCN>, <PCI>, <RSRQ>, <RSRP>, <RSSI>, <SINR>, ...

Can we go faster?

With the current band availability (B3 + B20), there’s a ceiling to what I can do purely in software/settings. Two practical levers are:

• Improve radio conditions: e.g. try a directional antenna to increase signal quality and reduce interference.
• Try a different cell (sometimes): but you often trade better capacity for worse signal, and it can backfire.

Measuring stability: ping and mtr

For a quick stability check I use ping and mtr. Example:

sudo mtr -rwzc 200 -i 0.2 172.16.167.52Start: 2026-02-23T20:31:40+0100
HOST: ~             Loss%   Snt   Last   Avg  Best  Wrst StDev
  1. 192.168.10.1   77.0%   200    6.9   7.1   2.0  97.2  14.3
  2. ???            100.0   200    0.0   0.0   0.0   0.0   0.0
  3. 172.16.167.52   0.0%   200   41.8  45.8  29.1 169.3  12.5

A note: loss shown on intermediate hops (especially hop 1/2) is often caused by ICMP rate limiting (devices de-prioritizing replies), not real packet loss. What matters most is the loss/latency on the final hop(s) you care about.