GSM Base Station Identification

Introduction

Welcome back. In our last lesson, we configured your RTL-SDR and ran your first scans, confirming that your hardware and software environment are ready for reconnaissance. We briefly introduced tools like kalibrate-rtl and grgsm_scanner and saw how they can be used to search for cellular signals.

Today's lesson zeros in on that process. Our learning outcome is to use kalibrate-rtl or similar tools to identify the frequencies of nearby GSM base stations. We will move from simply running a scan to strategically using these tools and, most importantly, interpreting their output. Finding the precise frequency of a local base station is the critical next step. Without a target frequency, we can't tune our radio to listen in, which is the foundation for all the passive analysis we'll do in this module.

1. The Strategy: Why GSM and What Are We Looking For?

Your ultimate goal involves 4G and 5G, so why are we starting with the older 2G GSM system?

Simplicity: GSM protocols are simpler and more extensively documented in the public domain than their modern counterparts.
Mature Tooling: The open-source tools for GSM analysis, like the ones we're using today, are well-established and reliable.
Relevance to Attacks: Many modern attacks, which we'll cover later, involve "downgrading" a 4G/5G phone, forcing it to connect to a malicious or compromised 2G/GSM station. Understanding how to find and interact with GSM is therefore still highly relevant.

When you run a scanner like kalibrate-rtl, it isn't just randomly searching. It's looking for a very specific signal called the Frequency Correction Channel (FCCH). Every GSM base station must transmit the FCCH at regular intervals. It's essentially a pure sine wave, a simple tone that stands out from the more complex data channels. This makes it a reliable beacon for scanners to lock onto.

The original purpose of kalibrate was to use this highly accurate broadcast signal to calculate the frequency error (measured in Parts Per Million, or PPM) of an SDR's own, less accurate, internal oscillator. For our purposes, we are less concerned with calibrating the device and more interested in the list of channels the tool discovers during its search.

2. Finding the Right Hunting Ground: GSM Frequency Bands

Before you can find a base station, you need to know which frequency band to scan. This is determined by your geographical location, as different regions of the world allocate different parts of the radio spectrum for GSM services.

The International Telecommunication Union (ITU) divides the world into three regions, and the GSM bands vary accordingly.

SDR calibration via GSM FCCH using Kalibrate and LTE-Cell-Scanner

This article provides an excellent overview of the different GSM frequency bands and their allocation across ITU regions. Understanding this is essential for efficient scanning.

Read the first two subsections of the article, titled 'GSM Bands vs ITU Regions' and 'Kalibrate, GSM, and FCCH'. Focus on the list of GSM bands and the map of ITU regions. Identify which bands are used in your part of the world.

Based on your reading, here is a quick summary:

Band Name	Common Regions	`kalibrate` Argument
GSM-850	North & South America (ITU Region 2)	`GSM850`
GSM-900	Europe, Asia, Africa (ITU Region 1 & 3)	`GSM900`, `EGSM`
DCS-1800	Europe, Asia (ITU Region 1 & 3)	`DCS`
PCS-1900	North America (ITU Region 2)	`PCS`

You will need to select the appropriate argument from the table above based on your location. If you are unsure, trying the most common bands for your continent is a good starting point.

3. Hands-On: Scanning with `kalibrate-rtl`

Now, let's put this knowledge into practice. Open your Linux terminal, make sure your RTL-SDR is connected, and prepare to run the scan.

The previous lesson covered the installation of kalibrate-rtl. The basic syntax is kal -s <BAND>, where <BAND> is one of the arguments from the table above.

Building a Cellphone IMSI Catcher (Stingray) – Hackers Arise

The security blog 'Hackers Arise' provides a concise, practical demonstration of this tool. We'll use their example as our guide.

Focus on 'Step #2: Find the Frequencies the Base Stations are Operating on'. Note the simple command structure and the example output.

Your Task

Run the Scan: In your terminal, run kalibrate-rtl targeting a band for your region. For example, if you're in North America, you would start with:
```
kal -s GSM850
```
If you're in Europe, you would use:
```
kal -s GSM900
```
Interpret the Output: If successful, kalibrate-rtl will print a list of found channels. Let's look at what the output means.

kalibrate-rtl GSM-900 Scan Output — This is a typical output from `kalibrate-rtl` after a successful scan. It lists the channel number (ARFCN), its exact frequency, the detected frequency offset, and the relative power of the signal.

Each line in the output represents a potential base station and contains key information:

chan:: This is the ARFCN (Absolute Radio Frequency Channel Number), a standardized number representing a specific frequency pair.
_...MHz_: This is the exact downlink frequency of the base station's broadcast channel. This is the value we need for the next lesson.
power:: This is a measure of the signal's strength. Higher numbers indicate stronger signals, which usually means the base station is closer to you or has a less obstructed line of sight. It's often best to start by targeting the strongest signals.

Troubleshooting

No channels found?
- Try a different band for your region (e.g., if GSM850 fails in North America, try PCS).
- Improve your antenna's position. Place it higher up and near a window.
- Manually increase the receiver gain. Use the -g flag followed by a value (e.g., 40). Experiment with values between 30 and 50.
```
kal -s GSM900 -g 40
```
"No supported devices found"? This usually indicates a problem with USB permissions. Refer back to the troubleshooting steps for rtl_test from the previous lesson.

4. An Alternative: `grgsm_scanner`

The learning outcome mentions "similar tools," and grgsm_scanner is an excellent alternative. It is part of the gr-gsm suite, which we will use heavily in the next lesson. It often provides more detailed information and gives you more granular control.

GSM Decoding Part One: Hardware/Software Setup And Finding GSM Base Stations With 'grgsm_scanner'

Let's revisit the video on grgsm_scanner. This time, focus specifically on the arguments used and how to interpret the final output.

Watch the segment from 10:02 to 15:24. Pay attention to how the command is built with arguments like band (-b), sample rate, and PPM correction (-p). Then, observe how the final output clearly lists the frequencies of the detected cells.

Based on the video, a command to scan the DCS 1800MHz band would look like this. Note that your PPM value may differ.

grgsm_scanner -b DCS1800 --samp-rate 2.4e6 -p 1 -v

The output of grgsm_scanner will show a list of "GSM stations." The most important piece of information for our current goal is the frequency listed for each station it finds. This frequency is what you would use to tune your radio for decoding.

Choose the tool that works best for you. For simply finding a frequency, kalibrate-rtl is often faster. grgsm_scanner can be more robust and provides a good introduction to the gr-gsm ecosystem we'll be using next.

Conclusion

In this lesson, you honed your passive reconnaissance skills by moving from blind scanning to targeted discovery. You now have a repeatable process for locating GSM base stations in your vicinity and identifying their precise operating frequencies.

Key Takeaways:

Scanning for GSM is a logical first step due to its relative simplicity and the maturity of available tools.
You must target the correct GSM frequency band (e.g., GSM850, GSM900) for your geographic location to find signals.
Tools like kalibrate-rtl and grgsm_scanner detect the FCCH beacon to identify base stations.
The key output from these tools is the list of active channels, which includes their exact frequencies and relative signal strength. The frequency is the essential piece of information needed for our next steps.

Preview of the Next Lesson:

You've found a target. Now what? With a known frequency in hand, we are ready to start eavesdropping. In the next lesson, "Capture GSM broadcast channels (BCCH) using gr-gsm and analyze them in Wireshark," we will tune your RTL-SDR to a specific frequency you discovered today. We will then capture the raw data from the base station's main broadcast channel and pipe it into Wireshark, allowing you to see the low-level cellular protocol messages for the first time.

Recommended resources