900 / 1800 MHz
GSM
A cell’s identity off its synchronisation burst, the system information it broadcasts, and who a page is calling.
A GSM base station transmits continuously on its beacon channel, and everything needed to identify it is in clear: the country and network codes, the cell id, the location area and the neighbours it advertises. That is a survey of the mobile infrastructure around you from a receiver that never transmits.
Paging messages name the subscriber identity being called and the channel a phone is then directed to. Traffic itself is encrypted and is not decoded.
A whole downlink allocation is read in real time at 20 MS/s. Each cell is named with its location area and drawn on the cell map, looked up on beaconDB when the OpenCelliD export places it badly or not at all, and a cell heard with a position can be sent to beaconDB and WiGLE.
What comes out
- MCC, MNC, LAC and cell id
- System information blocks, including the neighbour list
- Paging requests and the identity paged
- Immediate assignment: the channel a phone is sent to
Voice and data on a traffic channel are encrypted and stay that way.
$ waveshark --tune 941 --span 2000 --linksRead next
Something did not decode?
Record the burst with --record and open an issue with the capture. A capture that decodes becomes a test fixture.
Open an issue