I tested it out with OpenBTS and a USRP1; that configuration definitely works. Also needed a high-precision clock board (ClockTamer). I ran with 2G only. For 3

I tested it out with OpenBTS and a USRP1; that configuration definitely works. Also needed a high-precision clock board (ClockTamer). I ran with 2G only. For 3G/4G/LTE there's network authentication, so "in theory" you can't do it... I've read a bunch of stuff which says you're supposed to be able to jam or disrupt non-2G frequencies to force a fallback to 2G... however, I'd expect a telco van to turn up if you tried this for more than a short period of time (the ranges you'd want to jam are massive) and I didn't try it for obvious reasons. BUT - what I found in practice (2011, field testing on an island near Auckland NZ) was that a surprising amount of stuff would just straight up camp to a 2G base station, presumably because the signal was stronger. You don't need LTE if the phone is happy to look for the best signal. I didn't analyse what models of phone did this, it seemed like everything did at the time. A more interesting approach which I haven't tried involves downloading a several GB of rainbow tables and cracking TMSIs with kraken; no idea how well that works in practice.