Tutorial NB IoT cells

Tutorial: NB-IoT cells

What it is. NB-IoT (narrowband IoT) is an LTE variant for meters, trackers and sensors. A carrier is only 180 kHz wide and can sit inside an LTE carrier, in its guard band or on its own. OnAir lists the NB-IoT cells it hears from what they broadcast in the clear: the physical cell id, operating mode, and, from SIB1-NB, the operator, tracking area and cell identity.

Read this first. Receive only, public broadcast only. Paging, NPDCCH, data and device identities are never decoded. Receiving the broadcast channels of cellular networks is legal in many places but not everywhere, and decoding anything addressed to a phone or device is not allowed in most. Check the rules where you live. See Legal.

What you need

• A radio at 2 Msps or more (the lowest working rate is 1 Msps). An RTL-SDR works. The mode table covers 450 to 2200 MHz.
• A wideband antenna for 700 to 2200 MHz.
• Frequencies: the mode starts on 806 MHz (band 20 downlink); the database also lists 1842.5 MHz (band 3 downlink). NB-IoT is searched on the 100 kHz raster of the bands that carry it: 20, 8, 3, 1, 28, 5, 2, 4, 12, 13, 17, 18, 19, 25, 26, 66, 71 and 85.

Before you start

The scan spends one second per block. A longer dwell per step finds weak cells; an overloaded front end finds none. Moderate gain.

Step by step

1. Open Cellular & rail in the mode list and choose NB-IoT, band scan.
2. Choose the radio (2 Msps is enough) and start the receiver.
3. Under Bands tick the bands to scan (a band shows its downlink range as a tooltip). Custom scans a range of your own in MHz on the 100 kHz raster.
4. Press Scan; Stop scan ends it. Or tune a single frequency.
5. Open Cells. Select a cell for its details.

What you should see

Rows with the PCI (from NPSS and NSSS), operating mode, number of NRS antenna ports and system frame number (from NPBCH, MIB-NB). When SIB1-NB arrives you get the operator (MCC/MNC), tracking area, cell identity (eNB and sector), band and barring. Level, SNR, carrier and clock offset are shown. Results are saved between runs.

Reading the screen

• Cells: the cell table with signal level. A cell marked sync only has the PCI but no SIB1 yet.
• Log: decoded broadcast messages and the count of blocks searched, SIB1-NB messages and failures.

Options and settings

Clear empties the table. Scan bands and a custom range are in the scan row.

Troubleshooting

• No cells. NB-IoT is often switched on in only one or two bands per country; try more bands, a better antenna or a longer scan.
• Sync only, never operator. SIB1-NB is rare; wait for it or improve the signal.
• Wrong band shown. A band taken from frequency alone is a guess until SIB1-NB confirms it.

Tips

NB-IoT sits on the same sites as LTE, so Tutorial-Cell-towers helps you find where to look.

Legal and privacy notes

Only what is broadcast to every device is read. Device identities and traffic are not decoded.

Under the hood

NPSS, NSSS, NPBCH and SIB1-NB per 3GPP TS 36.211, 36.212 and 36.331. Operating modes: in-band, guard band, standalone.

Related

Mode-NB-IoT-cells, Tutorial-Cell-towers, Tutorial-5G-NR-cells, Modes, Main-window, Supported-radios, Troubleshooting, FAQ, Legal.