3 ms·

In essence you can build this using a software defined radio, and open source tooling like srsUE/srsRAN to decode the air interface packets [0]. The gotcha is

by g_p 5y ago

In essence you can build this using a software defined radio, and open source tooling like srsUE/srsRAN to decode the air interface packets [0]. The gotcha is you can't easily decrypt your own "data" over the air, as the keys you need are resident in the SIM card, and can't be extracted (Ki and OPc being the two symmetric keys you need for LTE) What you can do though is use srsUE to connect to a network as a piece of user equipment through an SDR, and you can connect a real SIM card to your PC using a standard PCSC smartcard reader [1]. If you have a couple of SDRs, you can run your own eNodeB (4G base station) and run your own "mini network". Obviously watch out for spectrum licensing rules, as handsets only work on certain bands, which are probably all licensed out and illegal to use without spectrum licencing. Some options with light/"zero" licensing are emerging - the UK, US, Germany, Sweden and some others have shared spectrum in bands that work for 5G. The open source ecosystem isn't quite there yet, but it's not a million miles away. This should get you towards an "LTE wireshark" as you were looking for. [0] https://docs.srsran.com/en/latest/usermanuals/source/srsue/source/1_ue_intro.html https://docs.srsran.com/en/latest/usermanuals/source/srsue/s... [1] https://docs.srsran.com/en/latest/usermanuals/source/srsue/source/4_ue_advanced.html https://docs.srsran.com/en/latest/usermanuals/source/srsue/s...

drmpeg 5y ago
It's too bad srsRAN doesn't support TDMA (yet). LTE band 42 and the 9 cm amateur radio band overlap, so it would be legal for hams to run LTE/5G nodes. Having your phone being your first ham radio might be a great way to get younger folks into the hobby.
- g_p 5y ago
  Yeah, once TDD is implemented, things will get interesting for sure - also the CBRS band will open up opportunities for much lower cost radio devices that can have some "serious" range (i.e. small neighbourhood scale WiFi AP) - maybe we'll see that new generation get into ham, and also learning more about networking and launch their own metro-net ISPs? One minor thing - hams would need to be careful they can run LTE/5G "out the box", given most setups use an encrypted layer to the base station. You can turn that down to zero confidentiality (EEA0) but still using integrity checking (EIA>0), but I am not sure if that's a particularly well-supported mode of operation.
  - cschmittiey 5y ago
    I believe you can also satisfy the encryption requirement by publishing the keys, fwiw
- RF_Savage 5y ago
  There's also the 13cm band (2300-2450MHz) that overlaps in part or fully TDD-LTE Band40 and FDD-LTE Band30. North americans also have 902-928MHz 33cm band, but that lacks the paired spectrum above it, so FDD-LTE or GSM are not possible. And I don't think there's a widely supported TDD-LTE spec for it.
  - drmpeg 5y ago
    Thanks for pointing out band 40. Apparently it's just used in China, but it is supported on the iPhone 13. Band 30 is a no-go because the downlink is at 2350 to 2360 MHz, which is not a ham band. The ham band is split because of satellite radio. It's 2300 to 2310 and 2390 to 2450 MHz.
    - RF_Savage 5y ago
      The 13cm band is a bit of a mess globally. Here in Finland it's still full 2300-2450MHz. But in 2300-2320MHz it is shared with lightly licenced "provate LTE". Hop over to Sweden and it's 2400-2450MHz only with a powerlimit under a watt. And im USA it's that pumctured mess, isn't there also AT&T running Band30 FDD-LTE? Years back when I was searching for LTE phones with Band30 for hamLTE use I only found AT&T carrier locked stuff from USA.
    - namibj 5y ago
      Band38 is the one most 2.4 GHz WiFi-covering half-duplex SDR can handle, at least if modified/adjusted with a local oscillator quartz suitable for LTE. It's an ugly fraction to synthesize with a fractional PLL to LTE-specs of local-oscillator-quality. Yeah, it's not ham, but low power levels and RF-shielding-cages should suffice to keep radiated emissions far below interfering levels. It's also surprisingly well supported, at least on non-US handsets, from when I researched it a bit a few months before the first wave hit and blocked collaborative hardware hacking.

by g_p 5y ago

drmpeg 5y ago

It's too bad srsRAN doesn't support TDMA (yet). LTE band 42 and the 9 cm amateur radio band overlap, so it would be legal for hams to run LTE/5G nodes. Having your phone being your first ham radio might be a great way to get younger folks into the hobby.

g_p 5y ago
Yeah, once TDD is implemented, things will get interesting for sure - also the CBRS band will open up opportunities for much lower cost radio devices that can have some "serious" range (i.e. small neighbourhood scale WiFi AP) - maybe we'll see that new generation get into ham, and also learning more about networking and launch their own metro-net ISPs? One minor thing - hams would need to be careful they can run LTE/5G "out the box", given most setups use an encrypted layer to the base station. You can turn that down to zero confidentiality (EEA0) but still using integrity checking (EIA>0), but I am not sure if that's a particularly well-supported mode of operation.
- cschmittiey 5y ago
  I believe you can also satisfy the encryption requirement by publishing the keys, fwiw
RF_Savage 5y ago
There's also the 13cm band (2300-2450MHz) that overlaps in part or fully TDD-LTE Band40 and FDD-LTE Band30. North americans also have 902-928MHz 33cm band, but that lacks the paired spectrum above it, so FDD-LTE or GSM are not possible. And I don't think there's a widely supported TDD-LTE spec for it.
- drmpeg 5y ago
  Thanks for pointing out band 40. Apparently it's just used in China, but it is supported on the iPhone 13. Band 30 is a no-go because the downlink is at 2350 to 2360 MHz, which is not a ham band. The ham band is split because of satellite radio. It's 2300 to 2310 and 2390 to 2450 MHz.
  - RF_Savage 5y ago
    The 13cm band is a bit of a mess globally. Here in Finland it's still full 2300-2450MHz. But in 2300-2320MHz it is shared with lightly licenced "provate LTE". Hop over to Sweden and it's 2400-2450MHz only with a powerlimit under a watt. And im USA it's that pumctured mess, isn't there also AT&T running Band30 FDD-LTE? Years back when I was searching for LTE phones with Band30 for hamLTE use I only found AT&T carrier locked stuff from USA.
  - namibj 5y ago
    Band38 is the one most 2.4 GHz WiFi-covering half-duplex SDR can handle, at least if modified/adjusted with a local oscillator quartz suitable for LTE. It's an ugly fraction to synthesize with a fractional PLL to LTE-specs of local-oscillator-quality. Yeah, it's not ham, but low power levels and RF-shielding-cages should suffice to keep radiated emissions far below interfering levels. It's also surprisingly well supported, at least on non-US handsets, from when I researched it a bit a few months before the first wave hit and blocked collaborative hardware hacking.