Mode NB IoT cells

NB-IoT cells: the public broadcast information of narrowband IoT carriers (receive only).

Group	Cellular & rail
Default frequency	806 MHz
Default sample rate	2 Msps
In the mode list	NB-IoT, band scan

Step-by-step: Tutorial-NB-IoT-cells

What NB-IoT cells is

NB-IoT (narrowband IoT) cells are LTE carriers for IoT devices. OnAir lists the cells around you from what each one broadcasts in the clear, such as its physical cell id and operating mode.

Frequencies and settings

LTE narrowband IoT carriers (180 kHz: in-band, guard band or standalone), found on the 100 kHz raster of the LTE bands that carry NB-IoT (20, 8, 3, 1, 28, 5, 2, 4, 12, 13, 17, 18, 19, 25, 26, 66, 71, 85); 2 Msps, even an RTL-SDR; one second per block, band presets and scan.

Setting	Value
Start frequency	806 MHz
Tuning range of the mode table	450 to 2200 MHz
Sample rate asked	2 Msps
Lowest working rate	1 Msps
Channel width	1.75 MHz

OnAir takes any frequency you type; the numbers above are the mode's starting point and the range its table describes. In the app the shortcut label is NB-IoT, band scan.

What OnAir shows

PCI (NPSS / NSSS), operating mode, NRS antenna ports and system frame number from the NPBCH (MIB-NB), and from SIB1-NB the operator (MCC / MNC), tracking area, cell identity (eNB and sector), band and barring; level, SNR, carrier and clock offset, a table of the cells with their signal level, results saved between runs. Receive only, public broadcast: paging, NPDCCH, data and device identities are never decoded. Receiving the broadcast channels of cellular networks is legal in many places but not everywhere, and decoding anything addressed to a phone or device is not allowed in most: check the rules where you live.

The mode's own tab has these screens: Cells, Log. The other tabs (Overview, Receiver, Scan, History) are described on the Main window page.

Tips and caveats

• Checked with generated signals and impairments; recordings of real signals welcome.
• Which radio: Usually yes for narrowband signals: an RTL-SDR tunes roughly 24 MHz to 1.7 GHz at up to about 2.4 Msps. Wide signals such as TV channels need a faster radio, and OnAir says next to the source what the selected radio can do.
• Try it without a radio: most modes include a built-in synthetic test signal, so you can open the screen and try the controls first.
• Receiving and the law: OnAir only reads the public broadcast information of cells and base stations, and does not decrypt or follow any user traffic. Check the rules where you live. See Legal.

Related pages

• All modes, Cellular & rail
• Supported radios, Troubleshooting, FAQ
• More in Cellular & rail: Cell towers, 5G NR cells, GSM-R, LBJ