# LTE signal identification

**URL:** <https://discourse.myriadrf.org/t/lte-signal-identification/1460>\
**Category:** LimeSDR\
**Created:** [13 July 2017 21:26 UTC](https://discourse.myriadrf.org/t/lte-signal-identification/1460 "2017-07-13T21:26:17Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![RyanThaDude](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@RyanThaDude](https://discourse.myriadrf.org/u/RyanThaDude)\
**Post date:** [13 July 2017 21:26 UTC](https://discourse.myriadrf.org/t/lte-signal-identification/1460/1 "2017-07-13T21:26:17Z")

</div>

Over past few years I’ve worked identifying many cellular sites in my region. I currently use a few cell phones, one on AT&T, one on VZW, and other on Project Fi (TMO, Sprint, USC). I also use a handheld spectrum analyzer (RF Explorer) connected to a laptop to aid in the identification process. Deciding that I needed something better I went with the LimeSDR. So far it’s done great as a spectrum analyzer currently using SdrAngel and helps me find spectrum/LTE bands from carriers that might be missed or unsupported on my phones.

I’m now wanting to take this project to the next step and actually be able to use the LimeSDR to get LTE/GSM/etc. IDs, much like the phones. I know there was a project that would work with the RTL-SDR (LTE-Cell-Scanner) that would work but would only display the PCI number and nothing else. Of course LTE-Cell-Scanner doesn’t work with the LimeSDR, either. Is there any software available that could this that works with the Lime? Is it even possible?

---

<div class="post-metadata">

**Author:** ![TegwynTwmfatt](https://yyz2.discourse-cdn.com/flex034/user_avatar/discourse.myriadrf.org/tegwyntwmfatt/32/193_2.png) [@TegwynTwmfatt](https://discourse.myriadrf.org/u/TegwynTwmfatt)\
**Post date:** [14 July 2017 08:50 UTC](https://discourse.myriadrf.org/t/lte-signal-identification/1460/2 "2017-07-14T08:50:22Z")

</div>

Sounds like you need Wireshark.

---

<div class="post-metadata">

**Author:** ![FFY00](https://yyz2.discourse-cdn.com/flex034/user_avatar/discourse.myriadrf.org/ffy00/32/1427_2.png) [@FFY00](https://discourse.myriadrf.org/u/FFY00)\
**Post date:** [14 July 2017 10:26 UTC](https://discourse.myriadrf.org/t/lte-signal-identification/1460/3 "2017-07-14T10:26:53Z")

</div>

To scan cell towers you have kalibrate.

---

<div class="post-metadata">

**Author:** ![TegwynTwmfatt](https://yyz2.discourse-cdn.com/flex034/user_avatar/discourse.myriadrf.org/tegwyntwmfatt/32/193_2.png) [@TegwynTwmfatt](https://discourse.myriadrf.org/u/TegwynTwmfatt)\
**Post date:** [14 July 2017 15:07 UTC](https://discourse.myriadrf.org/t/lte-signal-identification/1460/4 "2017-07-14T15:07:52Z")

</div>

Anybody ever got kalibrate to work? I tried it and failed ☹

---

<div class="post-metadata">

**Author:** ![mzs](https://yyz2.discourse-cdn.com/flex034/user_avatar/discourse.myriadrf.org/mzs/32/2678_2.png) [@mzs](https://discourse.myriadrf.org/u/mzs)\
**Post date:** [14 July 2017 18:16 UTC](https://discourse.myriadrf.org/t/lte-signal-identification/1460/5 "2017-07-14T18:16:54Z")

</div>

I followed this guide for using kalibrate with a rtl-sdr and that worked, at least for me:

> **[How to use Kal software to workout the PPM frequency offset of a RTL-SDR](https://314256.blogspot.com/2015/03/how-to-use-kal-software-to-workout-ppm.html)**
>
> The basic idea behind the Kalibrate software is that a GSM mobile phone base station has an expensive very high precision atomic clock (0....

  
As far as I know kalibrate was originally written for use with a USRP, has someone ported it for it for the LimeSDR ?

---

<div class="post-metadata">

**Author:** ![FFY00](https://yyz2.discourse-cdn.com/flex034/user_avatar/discourse.myriadrf.org/ffy00/32/1427_2.png) [@FFY00](https://discourse.myriadrf.org/u/FFY00)\
**Post date:** [15 July 2017 20:16 UTC](https://discourse.myriadrf.org/t/lte-signal-identification/1460/6 "2017-07-15T20:16:06Z")

</div>

I think so. There shouldn’t be any problem running kalibrate with the LimeSDR using the SoapyUHD plugin.

---

<div class="post-metadata">

**Author:** ![BelmY](https://yyz2.discourse-cdn.com/flex034/user_avatar/discourse.myriadrf.org/belmy/32/843_2.png) [@BelmY](https://discourse.myriadrf.org/u/BelmY)\
**Post date:** [27 August 2017 14:42 UTC](https://discourse.myriadrf.org/t/lte-signal-identification/1460/7 "2017-08-27T14:42:21Z")

</div>

Some notes from my recent tests (Ubuntu 16.04), successful with RTL-SDR but with troubles using LimeSDR and kalibrate(-uhd), even if it is detected. Any idea to solve it?:

1. kalibrate-rtl is compiled and working fine with RTL-SDR based devices, it is possible to identify the deviation (offset) wrt selected base stations clocks (aprox. 20 ppm)

> kalibrate v0.4.1-rtl, Copyright (c) 2010, Joshua Lackey  
> modified for use with rtl-sdr devices, Copyright (c) 2012, Steve Markgraf  
> Usage:  
> GSM Base Station Scan:  
> kal \<-s band indicator\> [options]
> 
> Clock Offset Calculation:  
> kal \<-f frequency | -c channel\> [options]
> 
> Where options are:  
> -s band to scan (GSM850, GSM-R, GSM900, EGSM, DCS, PCS)  
> -f frequency of nearby GSM base station  
> -c channel of nearby GSM base station  
> -b band indicator (GSM850, GSM-R, GSM900, EGSM, DCS, PCS)  
> -g gain in dB  
> -d rtl-sdr device index  
> -e initial frequency error in ppm  
> -v verbose  
> -D enable debug messages  
> -h help  
> belmy@Asus-PC-TP:~/kalibrate-rtl$ date ; kal -s GSM900 ; date  
> vie ago 25 06:11:35 CEST 2017  
> Found 1 device(s):  
> 0: Generic RTL2832U
> 
> Using device 0: Generic RTL2832U  
> Found Elonics E4000 tuner  
> Exact sample rate is: 270833.002142 Hz  
> **kal: Scanning for GSM-900 base stations.**  
> GSM-900:  
> chan: 4 (935.8MHz - 18.193kHz) power: 216633.94  
> chan: 6 (936.2MHz - 18.129kHz) power: 218780.72  
> chan: 7 (936.4MHz - 18.207kHz) power: 441856.59  
> chan: 12 (937.4MHz - 18.315kHz) power: 561237.31  
> chan: 15 (938.0MHz - 18.302kHz) power: 933821.78  
> chan: 23 (939.6MHz - 18.457kHz) power: 414867.41  
> chan: 103 (955.6MHz - 18.638kHz) power: 738316.47  
> chan: 107 (956.4MHz - 18.682kHz) power: 1333562.75  
> chan: 112 (957.4MHz - 18.655kHz) power: 851611.23  
> chan: 115 (958.0MHz - 18.664kHz) power: 863864.67  
> vie ago 25 06:13:58 CEST 2017
> 
> belmy@Asus-PC-TP:~/kalibrate-rtl$ date ; kal -c 107 ; date  
> vie ago 25 06:43:17 CEST 2017  
> Found 1 device(s):  
> 0: Generic RTL2832U
> 
> Using device 0: Generic RTL2832U  
> Found Elonics E4000 tuner  
> Exact sample rate is: 270833.002142 Hz  
> **kal: Calculating clock frequency offset.**  
> Using GSM-900 channel 107 (956.4MHz)  
> average [min, max] (range, stddev)
> 
> - 18.899kHz [-18919, -18879] (39, 10.356010)  
> overruns: 0  
> not found: 0  
> average absolute error: 19.761 ppm  
> vie ago 25 06:43:26 CEST 2017

1. kalibrate-uhd is compiled, recognizing the LimeSDR (SoapyUHD and OpenUSRP modules) but not working at all

> belmy@Asus-PC-TP:/$ date ; kal -s GSM900 ; date  
> sáb ago 26 10:42:58 CEST 2017  
> linux; GNU C++ version 5.4.0 20160609; Boost\_105800; UHD\_003.010.002.000-0-gbd6e21dc
> 
> Using OpenUSRP  
> [INFO] Estimated reference clock 30.7190 MHz  
> [INFO] Selected reference clock 30.720 MHz  
> [INFO] LMS7002M cache /home/belmy/.limesuite/LMS7002M\_cache\_values.db  
> CGEN: Freq=80 MHz, VCO=2.56 GHz, INT=82, FRAC=349525, DIV\_OUTCH\_CGEN=15  
> M=156, N=3, Fvco=1040.000 MHz  
> 16: 00 A0 AA  
> 16: AA AA 7C  
> 103: FF FF FF  
> phase: min 26.0; max 192.1; selected 109.0)  
> M=156, N=3, Fvco=1040.000 MHz  
> M=182, N=7, Fvco=1040.000 MHz  
> 16: AA 5A 75  
> 16: AA 52 D5  
> phase: min 10.4; max 176.5; selected 93.5)  
> M=182, N=7, Fvco=1040.000 MHz  
> M=156, N=3, Fvco=1040.000 MHz  
> 16: FE AF AA  
> 16: AA BA 7D  
> 1663: FF DF FF  
> phase: min 26.0; max 192.1; selected 109.0)  
> M=156, N=3, Fvco=1040.000 MHz  
> M=156, N=3, Fvco=1040.000 MHz  
> 16: 77 AD 3A  
> 16: 66 DC 3D  
> 16: AA 5A 75  
> 16: AA 52 D5  
> phase: min 20.8; max 176.5; selected 98.7)  
> M=156, N=3, Fvco=1040.000 MHz  
> [INFO] Rx Filter calibrated from cache  
> [INFO] Tx Filter calibrated from cache  
> M=156, N=3, Fvco=1040.000 MHz  
> phase: min 5.2; max 360.0; selected 182.6)  
> M=156, N=3, Fvco=1040.000 MHz  
> M=182, N=7, Fvco=1040.000 MHz  
> phase: min 5.2; max 360.0; selected 182.6)  
> M=182, N=7, Fvco=1040.000 MHz  
> M=156, N=3, Fvco=1040.000 MHz  
> phase: min 5.2; max 360.0; selected 182.6)  
> M=156, N=3, Fvco=1040.000 MHz  
> M=156, N=3, Fvco=1040.000 MHz  
> phase: min 5.2; max 360.0; selected 182.6)  
> M=156, N=3, Fvco=1040.000 MHz  
> [INFO] Rx Filter calibrated from cache  
> [INFO] Tx Filter calibrated from cache  
> **– Setting master clock rate selection to ‘manual’.**  
> CGEN: Freq=34.6667 MHz, VCO=2.42667 GHz, INT=77, FRAC=1041294, DIV\_OUTCH\_CGEN=34
> 
> > kal: Scanning for GSM-900 base stations.
> 
> SetFrequency using cache values vco:2, csw:214  
> SetFrequency using cache values vco:2, csw:214  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> Rx: 1.088 MB/s  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> Rx: 1.088 MB/s  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> Rx: 1.088 MB/s  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> [INFO] L 1044480  
> Rx: 1.088 MB/s  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> Rx: 1.088 MB/s  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:215  
> SetFrequency using cache values vco:2, csw:216  
> SetFrequency using cache values vco:2, csw:216  
> Rx: 1.088 MB/s  
> SetFrequency using cache values vco:2, csw:216  
> SetFrequency using cache values vco:2, csw:216  
> SetFrequency using cache values vco:2, csw:217  
> SetFrequency using cache values vco:2, csw:217  
> Rx: 1.088 MB/s

1. The following is detected with “uhd\_find\_devices” and “SoapySDRUtil --check” commands:

> belmy@Asus-PC-TP:~/$ **uhd\_find\_devices**  
> linux; GNU C++ version 5.4.0 20160609; Boost\_105800; UHD\_003.010.002.000-0-gbd6e21dc
> 
> * * *
> 
> ## – UHD Device 0
> 
> Device Address:  
> type: b200  
> product: B210  
> module: STREAM  
> media: USB 3.0  
> name: LimeSDR-USB  
> serial: 0009060B00472B19
> 
> * * *
> 
> ## – UHD Device 1
> 
> Device Address:  
> addr: 1d50:6108  
> driver: lime  
> label: LimeSDR-USB [USB 3.0] 9060B00472B19  
> media: USB 3.0  
> module: STREAM  
> name: LimeSDR-USB  
> serial: 0009060B00472B19  
> type: soapy
> 
> * * *
> 
> ## – UHD Device 2
> 
> Device Address:  
> type: b200  
> product: B210  
> module: STREAM  
> media: USB 3.0  
> name: LimeSDR-USB  
> serial: 0009060B00472B19
> 
> belmy@Asus-PC-TP:~/$ **SoapySDRUtil --check=lime**  
> ######################################################
> 
> ## Soapy SDR – the SDR abstraction library
> 
> ######################################################
> 
> Loading modules… linux; GNU C++ version 5.4.0 20160609; Boost\_105800; UHD\_003.010.002.000-0-gbd6e21dc
> 
> done  
> **Checking driver ‘lime’… PRESENT**
> 
> belmy@Asus-PC-TP:~/$ SoapySDRUtil --check=uhd  
> ######################################################
> 
> ## Soapy SDR – the SDR abstraction library
> 
> ######################################################
> 
> Loading modules… linux; GNU C++ version 5.4.0 20160609; Boost\_105800; UHD\_003.010.002.000-0-gbd6e21dc
> 
> done  
> **Checking driver ‘uhd’… PRESENT**
> 
> * * *

---

<div class="post-metadata">

**Author:** ![ph1047](https://avatars.discourse-cdn.com/v4/letter/p/b19c9b/32.png) [@ph1047](https://discourse.myriadrf.org/u/ph1047)\
**Post date:** [21 May 2018 09:26 UTC](https://discourse.myriadrf.org/t/lte-signal-identification/1460/8 "2018-05-21T09:26:58Z")

</div>

Since more than a year, just for random googlers:  
kalibrate uses KAL\_DEVICE env variable to select a device, so you do just:  
export KAL\_DEVICE=“driver=lime,soapy=0”  
and then  
./kal -s …