My team and I are using a SDR, GNU Radio, and some other hardware assembled into a custom tablet and a Python program we are writing to detect IMSI Catchers. I have some Packet Capture files with known IMSI Catcher data I am going through to implement the detection metrics but it has been very difficult to find the data I need about GSM other than very surface data about the protocols like TDMA, CDMA, etc. or completely incomprehensible terrible documentation about the packet structure drawn in ASCII.

Are there any good resources about the GSM protocol and packet contents?

Most importantly with descriptions of all data fields for all packet types.

Some background, one issue that I am trying to solve and can not find documentation for is what packets, and their fields, contain information to build a list of a cells neighbors location area codes (LAC). I have found packets with neighboring cell information:

    Measurement Results
    Protocol Discriminator: Radio Resources Management messages (6)
    .... 0110 = Protocol discriminator: Radio Resources Management messages (0x06)
    0000 .... = Skip Indicator: No indication of selected PLMN (0)
    ..11 1111 = RXLEV-FULL-SERVING-CELL: >= -48 dBm (63)
    .... .111  100. .... = BSIC-NCELL: 60
    .... ...0  01.. .... = NO-NCELL-M: 1 neighbour cell measurement result (1)
    RXLEV-SUB-SERVING-CELL: >= -48 dBm (63)
    0001 0... = BCCH-FREQ-NCELL: 2
    0... .... = BA-USED: 0
    .0.. .... = MEAS-VALID: The measurement results are valid
    ..11 1111 = RXLEV-NCELL: 63
    .... 000. = RXQUAL-SUB-SERVING-CELL: BER < 0.2%, Mean value 0.14% (0)
    .000 .... = RXQUAL-FULL-SERVING-CELL: BER < 0.2%, Mean value 0.14% (0)
    .0.. .... = DTX-USED: DTX was not used
    0... .... = 3G-BA-USED: 0
    DTAP Radio Resources Management Message Type: Measurement Report (0x15)

But most docs don't even have descriptions of all of the acronyms although I have found most now, and are missing packet types I am trying to examine. There are still about 15 other metrics I need to find also, if there is authoritative documentation on GSM somewhere neither I nor my team have been able to find it.

  • $\begingroup$ not 100% certain this really fits here, according to this nice little graph. $\endgroup$ Apr 22, 2017 at 8:14
  • 1
    $\begingroup$ maybe of interest: media.ccc.de/c/osmocon17 $\endgroup$ Apr 22, 2017 at 12:34
  • $\begingroup$ It's a very interesting question, and I would love to see a practical way to detect IMSI-catchers, but I'll be voting to close because I think a question about a radio technology that's not legal for use in amateur radio doesn't belong here. Good luck. $\endgroup$
    – rclocher3
    Apr 22, 2017 at 20:05
  • $\begingroup$ The Osmocom material definitely looks useful. I wasn't sure if it was a good fit here. It is legal to passively listen to all GSM traffic without trying to break any encryption. There is a small loophole where the 33-centimeter band overlaps the European 900 MHz and one could run a GSM base station with something like OpenBTS, but we are just passive listening and there could be issues with a legal active implementation, encryption, power level, etc. $\endgroup$ Apr 23, 2017 at 5:05
  • $\begingroup$ @8bit.wappen but that passive monitoring approach then would be about radio technology that is not amateur technology, again... You don't need to be a ham to legally listen! $\endgroup$ Apr 23, 2017 at 10:17


Browse other questions tagged .