700 MHz to 2.7 GHz
LTE cells
Every LTE cell on every carrier in the span: its physical id, network, tracking area, band, bandwidth and level, and the neighbouring carriers it points phones at.
An LTE cell broadcasts who it is to every phone that might want to use it, and none of that is encrypted. WaveShark finds the synchronisation signals of every carrier in the span, reads the master information block for the cell’s physical id and bandwidth, and where the span is as wide as the carrier, reads the system information for the network, the tracking area, the cell id and the site it belongs to.
Auto mode holds each carrier it finds, so a sweep of a band turns into a list of cells rather than a list of peaks. Each one is drawn as a hexagon on the cell map, in cyan once this receiver has heard it, beaconDB can be asked where a cell is that the OpenCelliD export places badly or not at all, and a cell heard with a position can be sent to beaconDB and WiGLE.
The physical layer was built against the specification and checked on off-air captures and srsRAN recordings, including distributed allocations where srsRAN and the specification disagree.
What comes out
- Physical cell id, and the EARFCN and band it is on
- Bandwidth, from 1.4 to 20 MHz
- MCC, MNC, tracking area, cell id and site
- RSRP, RSRQ and signal to noise
- Neighbouring carriers the cell advertises
Only what a cell broadcasts to every phone is read. Traffic is encrypted and stays that way.
$ waveshark --tune 806 --span 20000Read next
Something did not decode?
Record the burst with --record and open an issue with the capture. A capture that decodes becomes a test fixture.
Open an issue