Map the mobile network around you

A base station tells every phone who it is, and none of that is encrypted. Point a radio at a mobile allocation and WaveShark finds every LTE carrier in the span, reads each cell’s physical id, bandwidth and level, and where the span covers the carrier, its network, tracking area, cell id and site. GSM beacon channels give the network, the cell and the location area, read across a whole allocation in real time.

The map draws the towers as hexagons from the OpenCelliD export for your country, only where enough reports agree, and the cells this receiver has actually heard in cyan. beaconDB can be asked where a heard cell is that the export places badly or not at all, and a cell heard with a position can be sent to beaconDB and WiGLE, which is how the next person’s map gets better.

Traffic is encrypted and stays that way. This is a survey of the infrastructure, the same one a phone does every time it looks for a better cell, without ever transmitting.

$ waveshark --tune 806 --span 20000