On Fri, 17 Feb 2017 12:02:54 +0100, Mikko OH2HVJ
wrote:

Jeff Liebermann writes:

I've been thinking of building (and selling) such a device. It can be
done if:
1. You have an RF direction finder.
2. You know the sub-band where to expect the vendors transmissions.
3. You know the SID (system ID) of the vendor.
4. You have a map or database of the vendors service areas.

You could also add some LTE/UMTS module, some of these can do a network
scan with an AT-command and give you the cell id, technology, channel
number etc. of all 'visible' base station.

Apparently even some USB dongles can do this, so you could connect some
cheap SDR+modem+GPS to an RPi and do your magic.

Thanks. To be uncharacteristically honest, I haven't really thought
about the cellular data extraction and collection aspects. I do RF,
not programming. If this becomes a real project, I'll probably do the
system design, DF antenna, and RF, while someone else is either hired
or invested as the programmist.

I did some light weight Googling and found:
http://www.rtl-sdr.com/tag/cell-phone/
http://www.rtl-sdr.com/rtl-sdr-cell-phone-imsi-tmsi-key-sniffer/
http://www.rtl-sdr.com/analyzing-td-lte-rtl-sdr/

There are also cell tower location databases like Opencellid.

https://en.wikipedia.org/wiki/OpenCellID
Yep. That will certainly be useful. Mostly, what I want is to find a
new cell site with the direction finder, and then determine which
services and vendors are on the tower, building, pole, whatever. A
tower ID to lat-long database will certainly be useful, but the real
problem is what frequency to use. For example, for LTE:
https://en.wikipedia.org/wiki/List_of_LTE_networks
the bands in use world wide are many and varied. Same with TDM vs
FDM, full duplex vs half duplex, odd splits. Then, there are
sub-bands for each vendor. Notice the number of question marks in
above tables.



--
Jeff Liebermann
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558