Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to produce a list over the GSM phones in an area. I don't care about what data goes back and forth, neither are the various conversations relevant.

Most phones have IMEI (International Mobile Equipment Identity), this could serve as an identifier.

Given the fact that phones will operate on different frequencies, is it even feasible with a relatively small unit to sniff the GSM meta data in an area of approximately 30 meters?

I would like to perform this within EU legislation but without the explicit support from any network operator.

share|improve this question

This is certainly possible. And many such devices do exist.

Whether this is legal is not a question for this site, but I would strongly suggest talking to a lawyer in your area who deals with this type of law. There's a really, really strong possibility that local laws prohibit exactly what you're talking about.

In particular, the simplest technique is to transmit a strong enough signal to cause nearby phones to temporarily disconnect from their towers and attempt to communicate with you. If your device can do this on GSM frequencies, then it almost certainly runs afoul of local communication laws, since your device will not have a license to do so. Though exceptions for experimentation with devices you build yourself may exist in your locality.

It may be possible to discover IMEI numbers through passive-only sniffing, which would mean a much smaller build, less power, and less legal complication. I would recommend pouring over the GSM specification to see if this is possible.

You'll need to read it sooner or later if you intend to build this device. Might as well read it now.

share|improve this answer

A GSM phone will happily talk to any "base station" in range, and will happily talk to the one which claims to be the most powerful. It is a feature of the protocol: the phone will not necessarily link to the base station that it receives the most clearly; a station can simply say "talk to me ! I have dibs on the connections !" and the phone will use it as long as it hears it at all. Among the things that the GSM phone will tell is the IMEI.

Such rogue base stations are on sale so they clearly exist. Intelligence agencies are said to use such objects regularly to track identities of protesters in public manifestations (in our modern world, no political opponent would even imagine claiming his anger in the street without maintaining a constant Twitter/Facebook flow about it, so smartphones are powered).

Now for the size: there is nothing complex about the protocol so the IMEI scanner can probably be made quite small, as long as it can emit a powerful enough signal to be heard by the target phones -- as explained above, the scanner does not need to drown out the signals from the legitimate base stations, it just needs to be heard by the phone. For a 30m range, this is highly doable with only minimal electric power, hence it could run off a small battery, and fit in a pocket. After all, smartphones can do some WiFi between them at ranges of 100m and they fit in pockets, too (WiFi is not GSM, but the frequencies are of the same order of magnitude so propagation constraints and ranges are similar for the same power).

Of course, technical feasibility does not automatically equates with availability on an open market.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.