Tutorial Cell towers

Tutorial: Cell towers (LTE)

What it is. LTE base stations (eNodeBs) broadcast system information that any receiver can read: the operator, the band, the cell identity, the tracking area and the neighbour cells. OnAir reads only this public broadcast and lists the cells around you, like a field-test app on a phone, and can place them on a map.

Read this first. This mode is receive only and reads the public broadcast channels. Nothing addressed to a phone or a subscriber is decoded: no calls, no messages, no data, no subscriber identities. Receiving the broadcast of cells is legal in many places but not everywhere; check the rules where you live. See Legal.

What you need

• A radio that tunes the LTE downlink bands you want and runs at a high enough sample rate. The mode asks for 20 Msps (a wide view finds cells faster) and works from 1.92 Msps. An RTL-SDR cannot do 20 Msps; at 1.92 to about 2.4 Msps it can still find narrow-bandwidth cells in the lower bands, but a HackRF, Airspy, PlutoSDR, LimeSDR or BladeRF is a better fit. The mode table covers 450 to 3800 MHz.
• A wideband antenna for 700 to 2600 MHz. A good antenna matters more than gain.
• Frequencies: the mode starts on 806 MHz (LTE band 20 downlink centre). The frequency database also lists 1842.5 MHz (band 3 downlink centre) and 2140 MHz (UMTS / LTE band 1).

Before you start

LTE cells are strong. Use moderate gain, watch the input level shown in the panel (dBFS), and avoid overload. A strong nearby carrier can desensitise a cheap radio.

Step by step

1. In the mode list open Cellular & rail and choose LTE, band scan.
2. Pick the radio under Source, set the highest sample rate it allows (the tuner may say if it cannot) and start the receiver.
3. For a single carrier, type its centre frequency (806 MHz is the start).
4. For a band scan, tick bands under Bands: B20, B8, B3, B1, B7, B28, B32, B38, B40, B41, B42, B43, B2, B4, B5, B12, B13, B25, B66, B71 and B31 are available as checkboxes (B20, B8, B3, B1 and B7 are ticked by default). Other bands... opens a popup with every other band of the 3GPP table (the 5 GHz bands are out of reach of the radios). Tick Custom to scan a range of your own, start and end in MHz, on the 100 kHz LTE raster. The line under the boxes shows the EARFCN range the choice covers.
5. Press Scan. The radio steps over the chosen bands and searches every LTE carrier in each step. Stop scan ends it.
6. Open Cells and watch the table fill.

What you should see

Cells appear first as sync only (the physical cell id is known, the rest is not), then with their operator, tracking area and cell id once SIB1 has been read. A status line counts blocks searched, SI messages and failures.

Reading the screen

• Cells: operator, band, EARFCN, PCI, eNB and sector, TAC, bandwidth, RSRP / RSRQ, last seen. A band marked with a question mark was derived from the frequency alone until SIB1 confirms it.
• Sites: cells grouped by site (the same eNB).
• Neighbours: the neighbour lists read from SIB4 and SIB5.
• Operators: the strongest cell per operator.
• Map: the cells on a map when positions are known.
• Log: decoded messages, for example MIB, SIB1, SIB2 and SIB3 values.

Options and settings

• Hide bands: type band numbers (for example 14 28) to leave those cells out of the list and the export.
• OpenCelliD API key: towers do not broadcast where they stand. OpenCelliD is an open crowd-sourced database of tower positions; with a free personal key OnAir asks it where each decoded cell is, and credits it on the map (data from OpenCelliD, CC BY-SA 4.0). The ? button next to it explains how to get a key. Load tower file takes positions from a file instead, with no internet.
• Clear empties the table.

Troubleshooting

• No cells. Try another band, a better antenna or a higher sample rate. In the lower bands an RTL-SDR may find some.
• Cells but no operator. SIB1 has not arrived yet or the signal is too weak; wait or improve reception.
• A band is missing from the boxes. Use Other bands....
• No positions on the map. Add an OpenCelliD key or load a tower file. Cells are listed without it.
• High CPU. Lower the sample rate or scan fewer bands.

Tips

Run a scan with a few bands, then switch to the best carrier and stay on it so SIB messages complete.

Legal and privacy notes

Only broadcast information that every terminal receives is shown. Nothing is decrypted and no traffic is followed.

Under the hood

OnAir searches for the primary and secondary synchronisation signals, reads the MIB from the PBCH, then SIB1 to SIB5 from the downlink shared channel broadcast (3GPP TS 36.211, 36.212, 36.331). Band numbers and EARFCN ranges follow TS 36.101.

Related

Mode-Cell-towers, Tutorial-5G-NR-cells, Tutorial-NB-IoT-cells, Tutorial-GSM-R, Live-map, Modes, Main-window, Supported-radios, Troubleshooting, FAQ, Legal.