More experiments with GSM- locate BTS

While working to identify the frequency my android phone uses, here are some important links and apps I came across.


This is an app I used to find out the LAC (Location Area Code) and CID()
https://github.com/SecUpwN/Android-IMSI-Catcher-Detector

The following information and more can be taken form the above app:

  • MCC — a Mobile Country Code. This code identifies the country.
    Sri Lanka- 413
  • MNC - a Mobile Network Code. This code identifies the mobile operator. eg: Dialog-2, CellTel(Etisalat)-3
  • LAC - Location Area Code is a unique number of current location area. A location area is a set of base stations that are grouped together to optimize signalling. eg: 20126, 3003
  • CellID (CID) — is a generally unique number used to identify each Base transceiver station (BTS) or sector of a BTS within a Location area code. eg: 1702739,


This is the link I used to find how to track the BTS with Cell ID and LAC:
http://cellidfinder.com/articles/how-to-find-cellid-location-with-mcc-mnc-lac-i-cellid-cid

Here is an app I used to find the location of the BTS (Base transceiver station).
https://play.google.com/store/apps/details?id=com.parizene.netmonitor&hl=en



Reference:
https://www.ckn.io/blog/2015/11/29/gsm-sniffing-sms-traffic/

Comments

Post a Comment

Popular posts from this blog

Save recorded data with hackRF to a .raw file

Image
HackRF receives data at a very high speed. It produces about 1GB data within 40 seconds of recording. These data can be saved to a file, to process later. I use the .raw file format here. The file can be created separately in .raw format and use a flow graph to record data. But the easiest way is to use the following command which creates the file and save data in one command. hackrf_transfer -r .raw -f  433000000 -s 20000000 Further info about hackRF_transfer command:                      about naming a file: You can use CTRL+C to stop recording data. Flow graph method: Waterfall Sink block allows us to see live data being recorded by HackRF and File Sink block saves data to the file named.  
Read more

Sniffing GSM traffic with hackRF

Image
This post is realted to my previous post , where the tools that should be pre installed are mentioned. Gqrx which is preinstalled in the live DVD can be used to visualize the frequencies. Here are examples of gqrx  tuned to different frequencies observed from channels captured from hackrf_kalibrate. (see my earlier post) Tuned to frequency 950.8MHz. Tuned to 959.6MHz. Then we need to run the grc script airprobe_rtlsdr.grc which is located at gr-gsm/apps folder found in the pre installed gr-gsm. Here is a screen shot of the flowgraph. I set the default value of gain to 40, which increases the packets captured from wireshark which is later explained. Here is a screen shot when I run the flow graph. Then we have to run wireshark from another terminal. Interface is loopback interface (lo). Use the following command, which runs wireshark as root user with icmp and gsmtap filters. sudo wireshark -k -Y 'gsmtap && !icmp' -i lo Here is a sc
Read more