On Thu, 16 Feb 2017 19:21:40 -0800, Jeff Liebermann wrote:

I've been thinking of building (and selling) such a device. It can be
done if:
1. You have an RF direction finder.
2. You know the sub-band where to expect the vendors transmissions.
3. You know the SID (system ID) of the vendor.
4. You have a map or database of the vendors service areas.

I used to design direction finders, so I have more than an average
clue as to how this MIGHT be done. I'm not up to speed on cellular,
but I think I can catch up. Basically, an SDR receiver that scans,
looks for a signal direction, identifies it by RF sub-band and service
area, draws a line on a map, and records the line. Drive around a
little and soon you'll have many lines that cross at one point, which
is the cell site. You won't get any ID numbers, but you can get those
from any phone that can display the field service mode.

Marketing research: How much would pay for such a device?

Jeff,
As an aside, I know extremely well a long-ago retired entrepreneur who made
a few dozen millions on Google stock who lives a couple homes away who
often funds enterprising people.

He runs a successful company that makes, sources, and sells technooid
things, so, he might be interested in funding you (for a cut, I would
guess). He also runs a local entrepreneur group that meets weekly on the
peninsula and he's always invited by Google to the Google fairs.

He's extremely technical, if a bit liberal in his politics, so he'll
understand everything technically that you'll be doing. At the very worst,
he'll give you suggestions for improvement.

If you're interested, just say so, and I'll drop you an email.
Otherwise, just ignore.