So, you’re interested in seeing just what carriers are at that cell tower by your house.  Or maybe you’re interested in trying to determine the best location in your home for mobile reception.  There are many reasons why it might be useful to peek at the cellular, PCS, and AWS signals that make up our day to day communications network.  Unfortunately, the FCC does not maintain a database of all cellular and PCS transmitters and their locations.

However With the RTL-SDR, for $30 and open so

urce software, you can tune the frequency ranges for each carrier and see a graphic deception of the types of signals found.  Using this graphical depiction you can identify the type of signal (CDMA, GSM or LTE) and combined with looking up what block of frequencies it is in and who owns that block in this market, you can identify the carrier.

This post is the first of a multi part post on identification of cell phone towers.  This first one covers simply how to ID the signals with SDR#.  In future posts we will actually tune in to the streams and decode data to build a map of cell sites.

First, you need a SDR dongle that is capable of reception of signals up to 2GHz.  The best ones for this job are based on the E4000 tuner.  You will also need the free open source SDR# software.  Finally you will need a list of frequency ranges for each carrier.  Thankfully, I have done the work to research the bands used by each carrier in Eastern Iowa.

AT&T GSM dlink 1945-1950 ulink 1865-1870
AT&T UMTS dlink 2110-2120 ulink1710-1720
AT&T LTE dlink 740-746 ulink 710-716

Verizon CDMA dlink 880-890 ulink 835-845
Verizon CDMA dlink 891.5-894 ulink 846.5-849
Verizon LTE dlink 746-757 ulink 776-787

USCC CDMA dlink 869-880 ulink 824-835
USCC CDMA dlink 890-891.5 ulink 845-846.5
USCC LTE dlink 869-880 ulink 824-835
USCC LTE dlink: 734-740 ulink: 704-710

Sprint CDMA 1990-1995 1910-1915
Sprint CDMA dlink:851-869 ulink:806-869
Sprint LTE dlink:851-869 ulink:806-869
Sprint LTE dlink:1990-1995 ulink:1910-1915

Iowa Wireless GSM dlink 1930-1945 ulink:1850-1865
Iowa Wireless UMTS dlink 2130-2135 ulink 1730-1735

Simply tune around the ranges listed above with SDR # and look for signals that look like the examples below.  Because each carrier is licensed to their own block, you can look in the range for your carrier to see which carrier is running the site.  In the next post, we will tune in to the GSM or LTE signal to see detailed data such as signal to noise, or panel # or site # data.

This is a sample of a single CDMA2000 1xRTT carrier

This is a sample of a GSM signal

This is a sample of an LTE signal.