CellAnalysis is the main script to detect fake stations in the Linux computer with SDR boards, 2G modems or OsmocomBB phones.

 

(HOWTO CellAnalysis version 0.1.11)

1) Installation

Following are described how to setup everything, depending the hardware you want to use:

1.1) Installation with OsmocomBB phones:

Once you have downloaded “cell_analysis_version.tar.gz“, create a directory where you want to run and follow these steps to get started.

1.1.1) Locate osmocom-bb binaries, we are going to need two of them: “cell_log” and “ccch_scan“. Usually found on the following paths from osmocom-bb main directory:
<path_to_osmocom-bb>/src/host/layer23/src/misc/

1.1.2) Edit the file “cell_analysis.sh“, you’ll see in the first two lines the parameters which you must verify in order to check the two binaries paths that we have obtained in the previous step;
# OSMOCOM binaries paths:
CELLBIN="/opt/osmocom-bb/src/host/layer23/src/misc/cell_log"
CCCHBIN="/opt/osmocom-bb/src/host/layer23/src/misc/ccch_scan"

1.2) Installation with RTL-SDR devices:

1.2.1) Locate kalibrate and airprobe-rtl binaries, We will need two of them: “gsm_receive_rtl.py” and “kal“. Usually found on the following paths:
<path_to_airprobe>/gsm_receiver/src/python/
/usr/local/bin/kal

1.2.2) Edit the file “cell_analysis.sh”, you’ll see in the first two lines the parameters which you must verify in order to check the two binaries paths that we have obtained in the previous step.
HEART of the ="/usr/local/bin/kal"
GSMRECPATH="/opt/airprobe/gsm-receiver/src/python/"

In the following lines we can configure the spectrum bands where we want our rtl-sdr device to scan for cells. Usually these devices’ tuners only show consistent values ​​in the 900MHz band, so by default this will be the band set:
# GSM900: Banda de los 900Mhz
# DSC: Banda de los 1800Mhz
#BANDS ="GSM900 DCS"
Bandas = GSM900
If you want to add more bands, add them separated by a space. The list of bands supported by kalibrate-rtl is: GSM850, GSM-R, GSM900, EGSM, DCS and PCS.

1.3) Installation with USRP UHD devices:

1.3.1) Locate kalibrate and airprobe-uhd binaries , We will need two of them: “gsm_receive_usrp.py” and “kal“. Usually found on the following paths:
<path_to_airprobe>/gsm_receiver/src/python/
/usr/local/bin/kal
Aside these binaries, we will also use tshark (Wireshark command line).

1.3.2) Edit the file “cell_analysis.sh“, you’ll see in the first two lines the parameters which you must verify in order to check the two binaries paths that we have obtained in the previous step.
TSHARKBIN="/usr/bin/tshark"
HEART of the ="/usr/local/bin/kal"
GSMRECPATH="/opt/airprobe/gsm-receiver/src/python/"

The following lines configure the bands in which our cells UHD device searches. NOTE: the binary-uhd kalibrate must be patched to work properly in the EGSM band, otherwise the execution will not show any cell found. Set the default values ​​of the bands to your discretion, considering that those bands are not included no cells are detected false.
# GSM900: Banda de los 900Mhz (P equivalent to the Primary GSM-GSM)
# EGSM: Banda de los 900Mhz (equivalent to E-GSM Extended GSM)
# DSC: Banda de los 1800Mhz
#BANDS ="GSM900 DCS"
Bandas = GSM900

2) Using the program

2.1) OsmocomBB phones

To start using Cell Analysis, Layer 1 application should be running on the osmocomBB phone. To do this we must connect, with the phone off, the USB cord to the computer and the other end to the phone serial port. We will find the osmocon binary path and then, upload the firmware.

Until this moment we haven’t seen any output from the command line, but once we press the power button of the phone slightly. we will start seeing how it uploads the firmware:
Received PROMPT2 from phone, starting download
....
handle_write(): finished

Once the software is loaded correctly, we will see in the terminal the application Layer 1. If you have followed the installation steps, from now on Cell Analysis will be running. This is the best time to check that everything is properly installed and configured, by manually running cell_analysis.sh -w osmocombb.

2.2) RTL-SDR devices:

RTL-SDR devices requires no specific firmware or complicated steps, you must connect your device to any free USB port in your computer and manually running cell_analysis.sh -w rtlsdr.

2.3) USRP UHD devices:

UHD hardware is precision, stability and that it doesn’t require complicated steps or specific firmware, so manually run cell_analysis.sh -w usrp.

3) Other parameters

Usage: ./cell_analysis.sh -w working hardware {options: -l -g}

-w [OPTION] Mandatory. Hardware used to analyze cells. Must be one of: \{osmocombb, usrp, rtlsdr, rtlsdr-RPi or bladerf\}.

-l Optionally, run the application as infinite loop.

-g GPS mode, could be set in a variable or extract from file based on timestamp

4) Output Files and Folders

CellAnalysis will create 3 folders in the path where is been executed, so check you have enough permissions to create the folder and files. The program will generate the following:

4.1) OUTPUTS folder:

• • X_X_X_X.json (where X_X_X_X is: date, time, ARFCN, Location Area, CellId, MCC and MNC) to be sure the filename is unique.

. This file contains: a small cell profile, IMSIs paged in the cell and the traffic information; number of subscribers been paged in this cell:

{"data": {"version": "0.1.11 - free", "latitude": "0.0", "timestamp": "2017-08-05 17:10:17.429421", "longitude": "0.0" },
"profile": { "arfcn": 104, "cellid": 18343, "lac": 65102, "mcc": 214, "mnc": 1, "numchannel": 2, "channels": " 104 99"} },
"imsidata": [ {"imsi": "21401......"},{"imsi": "21401......"} ],
"traffic": [{"numpaged": 679, "rssi": 0 }] }

• • PROFILE_INCOMPLETE.txt

This file contains information from cells not able to process because the information is not complete. The columns that make up the file, ordered as they appear, are as follows:

Time Stamp formed by: “day month hour:minute“
Cell ARFCN
CellId
Location Area
MCC
MNC
Number of Channels
Channels ARFCNs
RX Level (only OsmocomBB phones and 2G modems)

05/08 17:10:48;111;SI3_not_found;NA;NA;NA;SI1_not_found;NA;0

4.2) EVENTS folder:

• • app.log

. The main cellanalysis output is redirected to this file, so when executed from cron or background we don’t have to worry about logging all the information.

• • alarms.csv

. This file contains the cell information whenever Cell Analysis finds it and classifies as fake. The format and content of the columns are identical to that shown for cell files “XXXX.csv“. For example, take a look at this alarm:
19/02 08:48;214_22_03E8_000A;1;214;22;(Spain, DigiMobil);0;1

• • error.log

. Errors will be reported to this file: – Sometimes errors occur in the “Layer 1” making the osmocom terminal unsuitable, so it will not detect any cell. If a hardware error occurs by which we can not access the RTL-SDR or USRP UHD device or the devices does not find any cell, Cell Analysis will notify the situation by generating this file.

4.3) TMP folder:

• For troubleshooting purposes, temporal files are saved for you to analyze them.