LTE signal identification

RyanThaDude · 13 July 2017 21:26

Over past few years I’ve worked identifying many cellular sites in my region. I currently use a few cell phones, one on AT&T, one on VZW, and other on Project Fi (TMO, Sprint, USC). I also use a handheld spectrum analyzer (RF Explorer) connected to a laptop to aid in the identification process. Deciding that I needed something better I went with the LimeSDR. So far it’s done great as a spectrum analyzer currently using SdrAngel and helps me find spectrum/LTE bands from carriers that might be missed or unsupported on my phones.

I’m now wanting to take this project to the next step and actually be able to use the LimeSDR to get LTE/GSM/etc. IDs, much like the phones. I know there was a project that would work with the RTL-SDR (LTE-Cell-Scanner) that would work but would only display the PCI number and nothing else. Of course LTE-Cell-Scanner doesn’t work with the LimeSDR, either. Is there any software available that could this that works with the Lime? Is it even possible?

TegwynTwmfatt · 14 July 2017 08:50

Sounds like you need Wireshark.

FFY00 · 14 July 2017 10:26

To scan cell towers you have kalibrate.

TegwynTwmfatt · 14 July 2017 15:07

Anybody ever got kalibrate to work? I tried it and failed

mzs · 14 July 2017 18:16

I followed this guide for using kalibrate with a rtl-sdr and that worked, at least for me:

As far as I know kalibrate was originally written for use with a USRP, has someone ported it for it for the LimeSDR ?

FFY00 · 15 July 2017 20:16

I think so. There shouldn’t be any problem running kalibrate with the LimeSDR using the SoapyUHD plugin.

BelmY · 27 August 2017 14:42

Some notes from my recent tests (Ubuntu 16.04), successful with RTL-SDR but with troubles using LimeSDR and kalibrate(-uhd), even if it is detected. Any idea to solve it?:

kalibrate-rtl is compiled and working fine with RTL-SDR based devices, it is possible to identify the deviation (offset) wrt selected base stations clocks (aprox. 20 ppm)

kalibrate v0.4.1-rtl, Copyright (c) 2010, Joshua Lackey
modified for use with rtl-sdr devices, Copyright (c) 2012, Steve Markgraf
Usage:
GSM Base Station Scan:
kal <-s band indicator> [options]

Clock Offset Calculation:
kal <-f frequency | -c channel> [options]

Where options are:
-s band to scan (GSM850, GSM-R, GSM900, EGSM, DCS, PCS)
-f frequency of nearby GSM base station
-c channel of nearby GSM base station
-b band indicator (GSM850, GSM-R, GSM900, EGSM, DCS, PCS)
-g gain in dB
-d rtl-sdr device index
-e initial frequency error in ppm
-v verbose
-D enable debug messages
-h help
belmy@Asus-PC-TP:~/kalibrate-rtl$ date ; kal -s GSM900 ; date
vie ago 25 06:11:35 CEST 2017
Found 1 device(s):
0: Generic RTL2832U

Using device 0: Generic RTL2832U
Found Elonics E4000 tuner
Exact sample rate is: 270833.002142 Hz
kal: Scanning for GSM-900 base stations.
GSM-900:
chan: 4 (935.8MHz - 18.193kHz) power: 216633.94
chan: 6 (936.2MHz - 18.129kHz) power: 218780.72
chan: 7 (936.4MHz - 18.207kHz) power: 441856.59
chan: 12 (937.4MHz - 18.315kHz) power: 561237.31
chan: 15 (938.0MHz - 18.302kHz) power: 933821.78
chan: 23 (939.6MHz - 18.457kHz) power: 414867.41
chan: 103 (955.6MHz - 18.638kHz) power: 738316.47
chan: 107 (956.4MHz - 18.682kHz) power: 1333562.75
chan: 112 (957.4MHz - 18.655kHz) power: 851611.23
chan: 115 (958.0MHz - 18.664kHz) power: 863864.67
vie ago 25 06:13:58 CEST 2017

belmy@Asus-PC-TP:~/kalibrate-rtl$ date ; kal -c 107 ; date
vie ago 25 06:43:17 CEST 2017
Found 1 device(s):
0: Generic RTL2832U

Using device 0: Generic RTL2832U
Found Elonics E4000 tuner
Exact sample rate is: 270833.002142 Hz
kal: Calculating clock frequency offset.
Using GSM-900 channel 107 (956.4MHz)
average [min, max] (range, stddev)

18.899kHz [-18919, -18879] (39, 10.356010)
overruns: 0
not found: 0
average absolute error: 19.761 ppm
vie ago 25 06:43:26 CEST 2017

kalibrate-uhd is compiled, recognizing the LimeSDR (SoapyUHD and OpenUSRP modules) but not working at all

belmy@Asus-PC-TP:/$ date ; kal -s GSM900 ; date
sáb ago 26 10:42:58 CEST 2017
linux; GNU C++ version 5.4.0 20160609; Boost_105800; UHD_003.010.002.000-0-gbd6e21dc

Using OpenUSRP
[INFO] Estimated reference clock 30.7190 MHz
[INFO] Selected reference clock 30.720 MHz
[INFO] LMS7002M cache /home/belmy/.limesuite/LMS7002M_cache_values.db
CGEN: Freq=80 MHz, VCO=2.56 GHz, INT=82, FRAC=349525, DIV_OUTCH_CGEN=15
M=156, N=3, Fvco=1040.000 MHz
16: 00 A0 AA
16: AA AA 7C
103: FF FF FF
phase: min 26.0; max 192.1; selected 109.0)
M=156, N=3, Fvco=1040.000 MHz
M=182, N=7, Fvco=1040.000 MHz
16: AA 5A 75
16: AA 52 D5
phase: min 10.4; max 176.5; selected 93.5)
M=182, N=7, Fvco=1040.000 MHz
M=156, N=3, Fvco=1040.000 MHz
16: FE AF AA
16: AA BA 7D
1663: FF DF FF
phase: min 26.0; max 192.1; selected 109.0)
M=156, N=3, Fvco=1040.000 MHz
M=156, N=3, Fvco=1040.000 MHz
16: 77 AD 3A
16: 66 DC 3D
16: AA 5A 75
16: AA 52 D5
phase: min 20.8; max 176.5; selected 98.7)
M=156, N=3, Fvco=1040.000 MHz
[INFO] Rx Filter calibrated from cache
[INFO] Tx Filter calibrated from cache
M=156, N=3, Fvco=1040.000 MHz
phase: min 5.2; max 360.0; selected 182.6)
M=156, N=3, Fvco=1040.000 MHz
M=182, N=7, Fvco=1040.000 MHz
phase: min 5.2; max 360.0; selected 182.6)
M=182, N=7, Fvco=1040.000 MHz
M=156, N=3, Fvco=1040.000 MHz
phase: min 5.2; max 360.0; selected 182.6)
M=156, N=3, Fvco=1040.000 MHz
M=156, N=3, Fvco=1040.000 MHz
phase: min 5.2; max 360.0; selected 182.6)
M=156, N=3, Fvco=1040.000 MHz
[INFO] Rx Filter calibrated from cache
[INFO] Tx Filter calibrated from cache
– Setting master clock rate selection to ‘manual’.
CGEN: Freq=34.6667 MHz, VCO=2.42667 GHz, INT=77, FRAC=1041294, DIV_OUTCH_CGEN=34

kal: Scanning for GSM-900 base stations.

SetFrequency using cache values vco:2, csw:214
SetFrequency using cache values vco:2, csw:214
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
Rx: 1.088 MB/s
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
Rx: 1.088 MB/s
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
Rx: 1.088 MB/s
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
[INFO] L 1044480
Rx: 1.088 MB/s
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
Rx: 1.088 MB/s
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:215
SetFrequency using cache values vco:2, csw:216
SetFrequency using cache values vco:2, csw:216
Rx: 1.088 MB/s
SetFrequency using cache values vco:2, csw:216
SetFrequency using cache values vco:2, csw:216
SetFrequency using cache values vco:2, csw:217
SetFrequency using cache values vco:2, csw:217
Rx: 1.088 MB/s

The following is detected with “uhd_find_devices” and “SoapySDRUtil --check” commands:

belmy@Asus-PC-TP:~/$ uhd_find_devices
linux; GNU C++ version 5.4.0 20160609; Boost_105800; UHD_003.010.002.000-0-gbd6e21dc

– UHD Device 0

Device Address:
type: b200
product: B210
module: STREAM
media: USB 3.0
name: LimeSDR-USB
serial: 0009060B00472B19

– UHD Device 1

Device Address:
addr: 1d50:6108
driver: lime
label: LimeSDR-USB [USB 3.0] 9060B00472B19
media: USB 3.0
module: STREAM
name: LimeSDR-USB
serial: 0009060B00472B19
type: soapy

– UHD Device 2

Device Address:
type: b200
product: B210
module: STREAM
media: USB 3.0
name: LimeSDR-USB
serial: 0009060B00472B19

belmy@Asus-PC-TP:~/$ SoapySDRUtil --check=lime
######################################################

Soapy SDR – the SDR abstraction library

######################################################

Loading modules… linux; GNU C++ version 5.4.0 20160609; Boost_105800; UHD_003.010.002.000-0-gbd6e21dc

done
Checking driver ‘lime’… PRESENT

belmy@Asus-PC-TP:~/$ SoapySDRUtil --check=uhd
######################################################

Soapy SDR – the SDR abstraction library

######################################################

Loading modules… linux; GNU C++ version 5.4.0 20160609; Boost_105800; UHD_003.010.002.000-0-gbd6e21dc

done
Checking driver ‘uhd’… PRESENT

ph1047 · 21 May 2018 09:26

Since more than a year, just for random googlers:
kalibrate uses KAL_DEVICE env variable to select a device, so you do just:
export KAL_DEVICE=“driver=lime,soapy=0”
and then
./kal -s …