Identifying LTE Base Stations with a Cell Scanner

1. The LTE Landscape: Key Identifiers

As we move from 2G to 4G, the terminology and some of the underlying concepts evolve. While the goal remains the same—finding a base station—the identifiers we look for are different.

• In GSM, the base station is a Base Transceiver Station (BTS). We looked for its ARFCN (Absolute Radio Frequency Channel Number) to find its frequency.
• In LTE, the base station is an eNodeB (Evolved Node B). We will look for two primary identifiers:
  • EARFCN (E-UTRA Absolute Radio Frequency Channel Number): This is the LTE equivalent of an ARFCN. It's an integer that maps to a specific pair of downlink and uplink frequencies used by the cell.
  • PCI (Physical Cell ID): A number ranging from 0 to 503. Its primary purpose is to allow a phone to quickly distinguish between different cells transmitting on the same frequency. You can think of it as being conceptually similar to the BSSID in a Wi-Fi network, which differentiates access points that might be on the same channel.

The tools we'll use are designed to scan ranges of frequencies, lock onto potential LTE signals, and report back the EARFCN and PCI of any cells they find. The output of these tools often includes signal strength metrics like RSRP, similar to the data seen in professional drive-test software.

2. The Tool: LTE-Cell-Scanner

For this task, we'll use LTE-Cell-Scanner, a popular open-source tool designed to work with SDRs like your RTL-SDR to detect and identify eNodeBs. It consists of a program, CellSearch, which scans a given frequency range and reports any detected cells.

Since you are proficient with the Linux command line, we will install the tool from its source code. This involves cloning the repository, installing a few dependencies, and compiling the software—a standard workflow for many security tools.

The following guide outlines the complete process.

After following the steps, you should have an executable file named CellSearch inside the LTE-Cell-Scanner/build/src/ directory.

3. Hands-On Lab: Scanning for LTE Cells

Now that the tool is ready, let's find some local LTE signals.

Step 1: Determine Frequency Bands for Your Region

Unlike the relatively simple band plan of GSM in a given country, LTE is deployed across a wide and complex array of frequency bands that vary significantly by country and carrier. Before scanning, you need to know which frequency ranges to check.

A quick web search for "LTE frequency bands [your country]" (e.g., "LTE frequency bands United States") will give you a list of the bands used by carriers in your area. For example, in the US, common bands are around 700 MHz, 850 MHz, 1900 MHz (1.9 GHz), and 1700/2100 MHz (AWS).

For this exercise, pick one or two common bands to start your scan. Let's say a band in your region operates from 734 MHz to 746 MHz.

Step 2: Run the Scan

Navigate to the build directory you created during installation. The basic command for CellSearch requires a start and end frequency.

# First, navigate to the correct directory
cd LTE-Cell-Scanner/build/




# Then, run the scanner.
# This example scans from 734 MHz to 746 MHz.
# The tool expects the frequency in Hz.
./src/CellSearch --freq-start 734e6 --freq-end 746e6

Important: Just like with kalibrate-rtl and gr-gsm, you may need to specify your RTL-SDR's frequency correction value (PPM). If you don't get any results, add the --correction <ppm_value> argument to the command.

Step 3: Analyze the Output

If successful, the scanner will begin to sweep the frequency range. When it finds a cell, it will print output similar to this:

Found a cell!
earfcn=1850, freq=740.0MHz, pci=123,

This tells you:

• The EARFCN of the cell (1850 in this example).
• The corresponding downlink frequency (740.0 MHz).
• The Physical Cell ID (123).

Let the scan run for a few minutes across different bands to build a list of nearby eNodeBs.

The following video provides a practical demonstration of this entire process.

4. An Alternative Tool: srsUE

The LTE-Cell-Scanner is a simple, effective tool for finding cells. As we progress, you'll be using the more comprehensive srsRAN software suite to build your own 4G network. One of its components, srsUE, which emulates a phone, can also be used for cell scanning.

When srsUE starts, its very first job is to scan for a cell to connect to. Its log output shows a very similar discovery process.

Take a look at the srsRAN documentation. Notice in the example console output how it searches for and finds a cell.

You don't need to install srsRAN today, but it's valuable to see that the information we're gathering with a simple scanner is the same foundational data used by more complex LTE systems.

Conclusion

Excellent work. You have now extended your passive reconnaissance skills from 2G into the 4G domain. By finding active LTE cells and identifying their core parameters, you've taken the first essential step toward analyzing and interacting with modern cellular networks.

Key Takeaways:

• LTE base stations (eNodeBs) are identified by their EARFCN (frequency channel) and PCI (Physical Cell ID).
• The LTE-Cell-Scanner tool allows you to use your RTL-SDR to scan frequency ranges and discover nearby eNodeBs.
• Knowing the LTE frequency bands for your specific region is critical for conducting an effective scan.
• More advanced tools like srsUE perform the same cell search procedure as a fundamental part of their operation.

Preview of the Next Lesson:
Finding the cell is only the first step. Just as we tuned to a GSM cell's BCCH to read its System Information messages, we must now do the same for LTE. In the next lesson, "Decode LTE Master Information Block (MIB) and System Information Block (SIB) messages," we will use a different tool to lock onto one of the cells you found today and start decoding the critical broadcast data that reveals its identity, capabilities, and security configuration.