WaveShark

758-960 / 1805-2690 MHz

Mobile downlinks

GSM and LTE base stations identifying themselves continuously: networks, cell ids, tracking and location areas, neighbours and levels, drawn on a map of the towers around you.

A cell transmits without pause, and everything that identifies it is in clear. A GSM beacon channel names the network, the cell and the location area; an LTE carrier gives its physical id and bandwidth on its synchronisation signals and the network, tracking area and site in its system information. That makes a survey of the mobile infrastructure around you a receive-only exercise.

Traffic is encrypted and stays that way. What is readable is who the network is, which cell you are under, what it advertises as its neighbours and how loud it is, which is enough to put each cell on the map, check it against OpenCelliD and beaconDB, and contribute the ones they are missing.

$ waveshark --tune 806 --span 20000

What lives here

  • GSMA cell’s identity off its synchronisation burst, the system information it broadcasts, and who a page is calling.
  • LTE cellsEvery LTE cell on every carrier in the span: its physical id, network, tracking area, band, bandwidth and level, and the neighbouring carriers it points phones at.

Every band, one receiver.

The decoders do not follow the dial: everything inside the span runs all the time.

All the bands