LTE sniff

1- Information on the environment We use an Android phone configured to connect with 4G Networks. The android app CellInfo Viewer confirm our *Earfcn*, for us it's 6300. The frequency our phone is listening to can be deduced from the Earfcn. We can calculate the frequency with niviuk.free.fr. Earfcn 6300 correspond to 806Mhz on LTE frequency band.

LTE-Cell-Scanner/build/src$ ./CellSearch -g 40 -s 806000000 LTE CellSearch (release) beginning. 1.0 to 1.1.0: OpenCL/TDD/HACKRF/bladeRF/ext-LNB added by Jiao Xianjun(putaoshu@gmail.com)

 PPM: 0
 correction: 1

HACKRF device FOUND! Use HW begin with 806MHz actual 806MHz 1.92e+06MHz

   Search frequency: 806 to 806 MHz

with freq correction: 0 kHz

   Search PSS at fo: -140 to 135 kHz

Examining center frequency 806 MHz ... try 0

input level: avg abs(real) 0.0901816 avg abs(imag) 0.0900797 Hit PAR [13.4983 12.8747]dB PSS XCORR cost 5.65892s Hit num peaks 3 try peak 0 tdd_flag 0

 Detected a FDD cell! At freqeuncy 806MHz, try 0
   cell ID: 476
    PSS ID: 2
   RX power level: -25.3461 dB
   residual frequency offset: -3301.78 Hz
                    k_factor: 1

try peak 0 tdd_flag 1 try peak 1 tdd_flag 0

 Detected a FDD cell! At freqeuncy 806MHz, try 0
   cell ID: 232
    PSS ID: 1
   RX power level: -26.449 dB
   residual frequency offset: -3310.88 Hz
                    k_factor: 1

try peak 1 tdd_flag 1 try peak 2 tdd_flag 0

 Detected a FDD cell! At freqeuncy 806MHz, try 0
   cell ID: 181
    PSS ID: 1
   RX power level: -27.9678 dB
   residual frequency offset: -3330.92 Hz
                    k_factor: 1

try peak 2 tdd_flag 1 Detected the following cells: DPX:TDD/FDD; A: #antenna ports C: CP type ; P: PHICH duration ; PR: PHICH resource type DPX CID A fc freq-offset RXPWR C nRB P PR CrystalCorrection ppm FDD 476 2 806M -3.3k -25.3 N 50 N 1/6 0.999995903521185 -4.1 FDD 232 2 806M -3.31k -26.4 N 50 N 1/6 0.999995892223039 -4.11 FDD 181 2 806M -3.33k -28 N 50 N 1/6 0.999995867358836 -4.13

We can now track signal received from antenna around us. LTE-Cell-Scanner/build/src$ ./LTE-Tracker -f 806000000

LTE-Tracker confirm that our phone listening on physical antenna number 476 correspond to a physical antenna sniffed by the hackrf.