Sniffing GSM900 and DCS1800

The commands are repeated every time in this guide (--args=rtl=0 and --args=rtl=1), as this was an attempt to capture a voice call without hopping. For dealing with hopping, see the other guide.

Bands

            uplink          downlink
P-GSM-900   890.0 – 915.0 935.0 – 960.0
E-GSM-900   880.0 – 915.0 925.0 – 960.0
DCS-1800    1710.2 – 1784.8   1805.2 – 1879.8

Sorting power outputs

More readable power output than with Kalibrate, and MCC/MNC

echo $ppm

grgsm_scanner -h
grgsm_scanner -b GSM900  --gain=34 --speed=5 --args=rtl=0 --ppm="$ppm" | tee GSM900.RTL
grgsm_scanner -b DCS1800 --gain=34 --speed=5 --args=rtl=0 --ppm="$ppm" | tee DCS1800.RTL
grgsm_scanner -b GSM900  --gain=32 --speed=5 --args=hackrf=0 | tee GSM900.HRF
grgsm_scanner -b DCS1800 --gain=32 --speed=5 --args=hackrf=0 | tee DCS1800.HRF
#-v

#sort -h -k2,2 GSM900.RTL #ARFCN
#sort -h -k12,12 GSM900.RTL #MNC
sort -rh -k14,14 GSM900.RTL #Pwr
sort -rh -k14,14 GSM900.HRF #Pwr

sort -rh -k14,14 DCS1800.RTL #Pwr
sort -rh -k14,14 DCS1800.HRF #Pwr

arfcn=

Preparing

Either take the frequency from grgsm_scanner’s output, or install arfcncalc for convenience

wget http://www.runningserver.com/software/arfcncalc.tar
...
arfcncalc -h

GSM900

freq=`arfcncalc -a $arfcn -d`

DCS1800

arfcncalc -b GSM1800 -p
freq=`arfcncalc -b GSM1800 -a $arfcn -d`

Watch Live

With auto-scroll enabled

wireshark -k -Y '!icmp && gsmtap' -i lo &

echo $arfcn
echo ppm=$ppm

grgsm_livemon_headless --help
grgsm_livemon_headless --fc=$freq --gain=34 --ppm="$ppm" --args=rtl=0
#--args=rtl=1
#--gain=42

grgsm_livemon_headless --args=hackrf=0 --fc=$freq --gain=18 --samp-rate=2e6

sometimes I get better results with the GRC flavor (define Parameter fc=)

gnuradio-companion grgsm_livemon_headless.grc

Can you see some 2bs already? But only one FDMA channel at a time (unless you manage to send to different port to lo). The livemon only gets 0C.

Nothing comes out at 299e3. Next available sample rate setting is 901e3.

#--samp-rate=901e3

Filter SIs

gsmtap.chan_type==1

Filter IAs

gsm_a.dtap.msg_rr_type==0x3f

look for circuit switched IAs

and eventually build a custom filter for it,

Channel Description > Apply as filter > Selected

ts=X

Recording / Capturing

Capturing downlink from a BTS. grgsm_capture wants a PPM integer, not float. 70 seconds on BCCH and 60 seconds on other known channel. Overwrites destination file by default.

mkdir -p capture/
cd capture/

echo $arfcn
echo $freq

grgsm_capture --help
grgsm_capture --arfcn=$arfcn --freq-corr="$ppm" --rec-length=70 --args=rtl=0 --gain=34 `date +%s`.$arfcn.cfile
#--args=rtl=1
#--gain=42
#--freq=$freq
ls -ltrh | tail -2

grgsm_capture --arfcn=$arfcn --freq-corr="$hppm" --args=hackrf=0 --if-gain=32 --bb-gain=20 $arfcn.hrf.cfile
#--rec-length=60
ls -ltrh | tail -1

Note: I do not get any decoding output when I capture w/ sample rate 2M – channelize would probably be required. 1M is the default with grgsm.

Review signals w/ Octave

apt install octave
wget "https://raw.githubusercontent.com/UpYou/gnuradio-tools/master/matlab/read_complex_binary.m"
octave-cli

x=read_complex_binary('CFILE-HERE')
plot(abs(x(1:100000)));

Quoting Piotr,

you should see repeating bursts, with guard periods between them

Getting a PCAP instead

Instead of reviewing the frames through wshark, you might prefer to use tshark. For that you have two solutions: tcpdump

tcpdump -i lo -w 0C.pcap &
grgsm_decode ...
pkill tcpdump && echo killed

or wshark - save as PCAPNG

STOP
Save As...  $arfcn.0C.pcapng

as a result you can use handy filters from the command line

tshark -r 0C7S.pcap -Y 'FILTER' -V
#-2 -R 'FILTER'

BCCH timeslot 0

wireshark -k -Y '!icmp && !tcp && !mdns' -i lo &

grgsm_decode --help
grgsm_decode --arfcn=$arfcn --mode=BCCH --timeslot=0 --cfile=DATE.$arfcn.cfile
grgsm_decode --arfcn=$arfcn --mode=BCCH --timeslot=0 --cfile=$arfcn.hrf.cfile

ts=
sub=

SDCCH/8 timeslot X subslot Y

echo arfcn=$arfcn
echo ts=$ts
echo sub=$sub

grgsm_decode -h
grgsm_decode --cfile=DATE.$arfcn.rtl.cfile --arfcn=$arfcn --mode=SDCCH8 --timeslot=$ts --subslot=$sub \
    --print-bursts > $arfcn.$ts.$sub.S
#--burst-file=
wc -l DATE.$arfcn.$ts.2S

force sub-slot as filter

gsmtap.sub_slot==Y

filter-out fragments, func=UI, func=RR

gsmtap.chan_type==8

look for Cipher Mode Command

gsm_a.dtap.msg_rr_type == 0x35

A5/1 Cracking

See A5/1 Cracking

Troubles

Aug 14, 2016 grgsm_capture.py sample rate error #208 https://github.com/ptrkrysik/gr-gsm/issues/208

Aug 16, 2015 Recording traffic data #114 https://github.com/ptrkrysik/gr-gsm/issues/114

Jun 20, 2015 Code refactoring from other projects (Osmocom, OpenBTS…) #70 https://github.com/ptrkrysik/gr-gsm/issues/70

Feature Requests

Support

gr-gsm mailing-list https://groups.google.com/forum/#!forum/gr-gsm


Nethence | Pub | Lab | Pbraun | SNE Russia | xhtml