Just as a point of interest around 4G/LTE, it's worth noting that (many/most) LTE networks don't support calling natively over LTE. At least not for a lot of th

Just as a point of interest around 4G/LTE, it's worth noting that (many/most) LTE networks don't support calling natively over LTE. At least not for a lot of the handsets in the hands of their customers. Unless your handset implements the all-IP Voice-over-LTE spec (which was an after-thought to original 4G), all calls are handled by the circuit-switched fallback (CSFB) process, where calls go over the legacy 2G or 3G networks. Since many networks don't actually have VoLTE fully implemented and working yet (and many popular Android handsets have quirks/bugs/issues around it, coupled with MNOs trying to "pitch" VoLTE as an exclusive feature when you buy the handset direct on their own MNO-modified firmware), a 2G catcher should still work in many scenarios. If 3G is switched off, that (ironically) means that many people's calls will end up going over original 2G networks, where the handset doesn't authenticate the network at all! 3G handsets at least do a mutual authentication of the network. If you want to look at a real LTE catcher, take a look at this paper [1]. Worth noting this is not passive however, and requires transmitting in licensed spectrum, which defeats the point of this passive one. [1] https://arxiv.org/pdf/1702.04434.pdf https://arxiv.org/pdf/1702.04434.pdf