On reading about IMSI catchers, I keep seeing that they "impersonate" a real cell tower or "base station" so that the phone drops its signal-carried data on that machine while on its way to the intended destination.
What I don't understand is, how exactly does the IMSI catcher do that, or by what mechanism? What is it doing to trick the phone/SIM/connection into saying "This is a valid stop to drop off data"?
Clarification (thanks to Steve Sether): Are there specific flags/attributes used in GSM and/or LTE broadcasts that the ISMI catcher must copy to spoof its identity as a cell tower? What are they?