1

I live in a remote area with few visitors and it would be very interesting to detect a mobile phone in my vicinity that isn't my own.

It would be very easy to just use a frequency counter and look for activity on those bands, but that might be my own mobile phone and might also be chatter from a base station, etc.

So I would like to actually inspect the traffic with gnuradio. I am aware that I can't determine a phones number (need SS7 access). Also, I do not want to involve myself in illegal transmissions. But there must be some amount of data that is sent outwards from a mobile phone that I can receive and decode without decrypting or cracking and with an RX only SDR.

What can I find out in this RX only manner ? Can I differentiate between different phones ? Can I determine what their physical address is and correlate to manufacturer (sort of like a MAC address in ethernet) ... can I see what base station they are associated with ?

I'd like to scan the local airwaves and see a list of operating mobile handsets, the same way you might do a site survey for wifi clients. The question is simply: How much can I see with RX only and without doing difficult (and possibly illegal) decryption ?

Thanks.

Improve this question
3
  • What do you mean by RX? Do you mean RF (Radio Frequency) or something else?
    – auspicious99
    Apr 23, 2020 at 2:13
  • 1
    @auspicious99, "RX" stands for "receive", so he means receive-only (no radio transmission).
    – mgkrebbs
    Apr 23, 2020 at 5:09
  • Thanks @mgkrebbs , I should have known that. Mind slip today, lol
    – auspicious99
    Apr 23, 2020 at 6:23

1 Answer 1

Reset to default
1

You can't get much with passive scanning. These days all the mobile phones (even low end ones) are on the digital systems (LTE, etc.) with most information being encrypted, once the initial handshake signalling is completed.

Even if you listen to the initial handshake, you won't be seeing any important phone identities being exchanged over the air in plaintext. For example, even in the days of 2G, with GSM, the IMSI would be replaced with TMSI (Temporary Mobile Subscriber Identity) for such handshake signalling, to foil RX-only passive snooping attempts.

Taking a step back, if it's a matter of differentiating between mobile phone (or cellular base station) transmission and other wireless transmissions, the frequency/wavelength of the transmission could be useful. Mobile phone systems used licensed bands (that often cost the mobile operators a lot of money), so you shouldn't be hearing traffic from other wireless systems in those bands. Googling around could probably get you more info on who is the operator in that area (there may be more than one, though), and even what frequency band(s) they have licensed for their mobile service. The cellular base stations typically would be broadcasting beacons so that mobile phones can select a suitable base station to connect to and initiate the handshake/setup, including synchronizing for the timing of the frames, etc. This is known as the access or random access procedure. More details can be found in https://www.eventhelix.com/lte/random-access-procedure/lte-random-access-procedure.pdf for instance.

Improve this answer
3
  • OK, that is useful. I am not looking for anything identifiable, per se - I would just like to confirm that it is indeed a mobile phone and for that, I would like to go a bit beyond simply "is it on this frequency". I can do that with just a simple frequency counter. There must be some initial handshake or "who-has" or beacon response that I can listen for that will definitively identify a transmitter as a mobile phone (and hopefully some other details about it like hardware address or ... something ...)
    – user227963
    Apr 24, 2020 at 1:32
  • Ok, I have edited the response to provide more info along the lines of what you wrote.
    – auspicious99
    Apr 24, 2020 at 1:45
  • @user227963: How are you going to differentiate between the constant chatter of the base station and a mobile phone? Your simple frequency counter is going to need a tuner as well.
    – Transistor
    Apr 25, 2020 at 22:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .