Cell Phone Signal Repeater / Booster / Femtocell Project

Yeah no way around it satellites are expensive but I don’t know how much those Cubiesats cost per satellite. Have to guess that the price is coming down.

Well the space elevator project has been started but won’t be done for a while.

However there is a new (well probably not new) but new implementation for positioning satellites using quasi-zenith orbits. Very very good idea. I just learned of it recently. That orbit allows a satellite to give centimeter level accuracy in cities with tall buildings, like Tokyo. It would make a lot of sense for a country to place their own in a quasi-zenith orbit. IIRC 3 or 4 satellites only are required so that there is always at least one to provide that level of accuracy/precision.

Orbit looks somewhat like a figure eight.

So call your parliament/congress/etc. and tell them to get that going! Don’t laugh it would be a boon for the entire country. Automated farming including plowing, planting, farming. Drone cars/buses/trucks/lorries/trolleys, drone planes, etc., etc.

Regarding testing my repeater idea.
VZ, my provider, runs Band 2 (700) and 13 (1900) in my area. I have found both signals using sdrangel. I have to use a high gain 13dbi antenna I built just to see a signal at 3 to 5 db SNR. What I see on the waterfall tells me I have no chance of repeating it. It also tells me why I had such a bad time pointing the antenna when I was using it before on a 4G modem. The signal comes in clear only if the antenna is pointed in certain positions, exactly pointed. The slightest az/el deviations cause huge changes in the signal. There are a few positions that work well, though. The problem is that these positions change. I live in the mountains and the multipaths have multipaths. I need a balloon to get line of sight. Another possibility is a battery operated solar charged remote repeater with directional antennas sneaked onto an intervening ridge-top to relay the signal. Not that I would do that without proper authorization.

@Axeman I’d go with the solar powered mountain top solution, with appropriate authorisation . You’ll need full duplex, but the lime can do this, but only on frequencies that are close together . Also, check out the solar charger for digital noise as some are better than others. Also I should have a suitable amp to bolt on lime output sometime soon

Or even inappropriate authorisation! :eyes:

I’ve been doing a little reading and looking. It’s an interesting topic and the wording seems to be important.

Call it a “booster” and you are required to register that with your carrier/provider. If you’re on a MVNO then you’d need to contact the mothership.

Call it a “repeater” and that seems to be less of a bother as far as the carrier is concerned.

Not sure where the femtocell comes in but I think that qualifies as a booster.

You definitely want to avoid calling it a cellular spoofer or interceptor because then you’re in competition with the purveyors of those “techniques”.

This is coming from USA. But probably applies similarly and I realize too that you may already be aware of these subtleties.

Some I learned just from here (I have no relation or affiliation BTW):

It’s actually a good site for just understanding that space but now I’m curious what radios are inside those boxes.

A booster is what we can best use the LimeSDR for. A repeater will take an up/down converter, but still quite easy. Both methods will take a few extra components. A booster needs good separation between the input and output to prevent feedback. That makes it more dangerous to the spectrum that a repeater. A true femtocell should be a repeater and shift the frequencies. Four LOs on the LimeSDR would be awesome! But you can still do the mixing outside the board.

The difference between a booster and a repeater… that is very interesting. Now that we have made boosters I guess it is time to make repeaters ?

Well the carriers will come down hard on a booster if it’s discovered and not registered or even if it’s registered but misconfigured. The issue is that one could over power Tx to the tower and hog the bandwidth, IIUC. You probably know all that and IIRC you mentioned that.

@hTo137 does the base station (tower) not send control signals to each and every cell phone on its network? Surely one of the functions of the control signal would be to tell the phone to turn down its transmit power if necessary ?

For example, if a group of kids all crowd around a base station holding their phones up in the air, they’re not going to affect the base unless their phones are faulty, in which case Uncle Base will just turn them off?

Finally, after weeding over 10,000 carrot plants, I managed to spend a bit of time working on the LimeSDR.

And, in part, as a response to a comment from @Zack that I had strayed too far away from the LimSDR and from Ebrahim Bushehri that I had not published enough videos, here is the latest Cell Phone Signal Repeater / Booster / Femtocell Project update:

Control LimeSDR Tx Gains using Arduino Due and Analogue Slider

2 Likes

[quote=“TegwynTwmfatt, post:69, topic:1205, full:true”]
@hTo137 does the base station (tower) not send control signals to each and every cell phone on its network?[/quote]

I dunno. Also I dunno what’s in a booster. I would think that it’s a dumb device. But I am happy to posit incorrectly. And I do it a lot. I thought the tower wouldn’t know it’s talking to booster but instead would think it’s talking to a cell phone. So it tells the cell phone to lower tx power and the cell does so. But now the cell talks more weakly to the booster but does the booster lower its tx power? I dunno but it sounds to complicated to me. i.e. too complex and expensive

But what do I know.

But I guess what you’re telling me is that the booster is not a dumb, transparent device. But then it’s more complicated and I’ll have to think about how it works.

[quote=“TegwynTwmfatt, post:70, topic:1205, full:true”]
Finally, after weeding over 10,000 carrot plants, I managed to spend a bit of time working on the LimeSDR. [/quote] What the? Did Weedroid become a little to sentient for it’s own good and wander off chasing the Lawnbot next door (irresistable tantalum?)?

[quote]
And, in part, as a response to a comment from @Zack that I had strayed too far away from the LimSDR[/quote]

Zack has to say that! Well, he knows it’ll work.

Will have to look at that soon. Good to know you’re still keeping at it.

@hTo137 Today I decided to go on a religious pilgrimage to my local cell phone base station.

After making the necessary offerings and sacrificing of a few chickens I turned on my RSSI test rig and began uploading live video to YouTube:


Orange = Town.
Green = Countryside.
Full details are HERE.

3 Likes

This is good but it is also frustrating to someone as lazy as I. Harald Welte (of Osmocom) mentions this lack of information often in the cell phone world*. But maybe this info is out there but hard to find.

But we can make guesses based on our own observations. Here’s my guess… The phone detects that weaker signal and boosts its output. This is based on my observation that the cell battery will run down sooner when it’s on but stored in a purse under a desk or if the phone is put in a drawer, especially bad in a metal drawer.

Last but not least certainly there are people on this forum that know things about the inner workings of base stations. Maybe they are sworn to secrecy by penalty of “you’ll not work in this town again”.

*

Watch Harald’s talks, etc. lot of info.

Maybe … but IMO it’s more that esoteric information such as this can cause problems for the uninitiated masses. The only way to unravelling the dark secrets of RF is the step by step approach - after each step is completed, certain information is revealed enabling the next step to be tackled.

You don’t say, is my signal boosting theory on the mark or only partially correct or ?

Ok I’ll agree that bad things can happen by accident if someone’s given the knowledge. But this is quite an old discussion/argument. However current history is saying that secrecy is far worse.

But back to base stations, the base station must be very vulnerable if its only protection from the “uninitiated masses” is secrecy. The RF world, from what I’ve learned, is steeped in secrecy. But it also awash with clever folks who like nothing better than to figure out what those secret signals are sending/receiving. It’s akin to an arms race. Intellectual and physical (i.e. hardware) arms race and that hardware variable has largely been removed from the equation. Well the current method to keep the hardware variable in play seems to be expensive hardware with greater capabilities. Terahertz?

Back again to base stations… They seem to be limited in what they can/can’t do. And so far it seems to me that they keep the base station as simple as possible and improve the tech in the handsets. And they can always put boots on the ground if the “uninitiated masses” continue to do bad things against their base station, as a last resort of course.

FWIW I thought the GSM stack was fully understood by the “uninitiated masses” already. But maybe that’s just the encryption part I’m remembering.

I also would guess that each carrier can do and does do things slightly differently then their competition at the base station.

The information is certainly out there and you can go and read the OsmocomBB and OpenBSC/OsmoBTS/OsmoTRX etc. source code should you wish. Then there’s all the publicly available ETSI/3GPP specifications and technical recommendations etc. It’s not so much secrecy as arcane… Of course, GSM encryption (A5) was a secret, but we all know how that worked out :smiley: Hopefully people are finally learning that security-by-obscurity is perhaps not the best strategy and open publishing with widespread peer review has certain benefits.

1 Like

Here’s the latest video update on this project. Hopefully at least the first 2 minutes are entertaining?

There’s also an open request for info from anybody who knows anything about how cell phone base stations work to please get in contact.

1 Like