Sniffing GSM900 and DCS1800

The commands are repeated every time in this guide (--args=rtl=0 and --args=rtl=1), as this was an attempt to capture a voice call without hopping. For dealing with hopping, see the other guide.


            uplink          downlink
P-GSM-900   890.0 – 915.0 935.0 – 960.0
E-GSM-900   880.0 – 915.0 925.0 – 960.0
DCS-1800    1710.2 – 1784.8   1805.2 – 1879.8

Sorting power outputs

More readable power output than with Kalibrate, and MCC/MNC

echo $ppm

grgsm_scanner -h
grgsm_scanner -b GSM900  --gain=34 --speed=5 --args=rtl=0 --ppm="$ppm" | tee GSM900.RTL
grgsm_scanner -b DCS1800 --gain=34 --speed=5 --args=rtl=0 --ppm="$ppm" | tee DCS1800.RTL
grgsm_scanner -b GSM900  --gain=32 --speed=5 --args=hackrf=0 | tee GSM900.HRF
grgsm_scanner -b DCS1800 --gain=32 --speed=5 --args=hackrf=0 | tee DCS1800.HRF

#sort -h -k2,2 GSM900.RTL #ARFCN
#sort -h -k12,12 GSM900.RTL #MNC
sort -rh -k14,14 GSM900.RTL #Pwr
sort -rh -k14,14 GSM900.HRF #Pwr

sort -rh -k14,14 DCS1800.RTL #Pwr
sort -rh -k14,14 DCS1800.HRF #Pwr



Either take the frequency from grgsm_scanner’s output, or install arfcncalc for convenience

arfcncalc -h


freq=`arfcncalc -a $arfcn -d`


arfcncalc -b GSM1800 -p
freq=`arfcncalc -b GSM1800 -a $arfcn -d`

Watch Live

With auto-scroll enabled

wireshark -k -Y '!icmp && gsmtap' -i lo &

echo $arfcn
echo ppm=$ppm

grgsm_livemon_headless --help
grgsm_livemon_headless --fc=$freq --gain=34 --ppm="$ppm" --args=rtl=0

grgsm_livemon_headless --args=hackrf=0 --fc=$freq --gain=18 --samp-rate=2e6

sometimes I get better results with the GRC flavor (define Parameter fc=)

gnuradio-companion grgsm_livemon_headless.grc

Can you see some 2bs already? But only one FDMA channel at a time (unless you manage to send to different port to lo). The livemon only gets 0C.

Nothing comes out at 299e3. Next available sample rate setting is 901e3.


Filter SIs


Filter IAs


look for circuit switched IAs

and eventually build a custom filter for it,

Channel Description > Apply as filter > Selected


Recording / Capturing

Capturing downlink from a BTS. grgsm_capture wants a PPM integer, not float. 70 seconds on BCCH and 60 seconds on other known channel. Overwrites destination file by default.

mkdir -p capture/
cd capture/

echo $arfcn
echo $freq

grgsm_capture --help
grgsm_capture --arfcn=$arfcn --freq-corr="$ppm" --rec-length=70 --args=rtl=0 --gain=34 `date +%s`.$arfcn.cfile
ls -ltrh | tail -2

grgsm_capture --arfcn=$arfcn --freq-corr="$hppm" --args=hackrf=0 --if-gain=32 --bb-gain=20 $arfcn.hrf.cfile
ls -ltrh | tail -1

Note: I do not get any decoding output when I capture w/ sample rate 2M – channelize would probably be required. 1M is the default with grgsm.

Review signals w/ Octave

apt install octave
wget ""


Quoting Piotr,

you should see repeating bursts, with guard periods between them

Getting a PCAP instead

Instead of reviewing the frames through wshark, you might prefer to use tshark. For that you have two solutions: tcpdump

tcpdump -i lo -w 0C.pcap &
grgsm_decode ...
pkill tcpdump && echo killed

or wshark - save as PCAPNG

Save As...  $arfcn.0C.pcapng

as a result you can use handy filters from the command line

tshark -r 0C7S.pcap -Y 'FILTER' -V
#-2 -R 'FILTER'

BCCH timeslot 0

wireshark -k -Y '!icmp && !tcp && !mdns' -i lo &

grgsm_decode --help
grgsm_decode --arfcn=$arfcn --mode=BCCH --timeslot=0 --cfile=DATE.$arfcn.cfile
grgsm_decode --arfcn=$arfcn --mode=BCCH --timeslot=0 --cfile=$arfcn.hrf.cfile


SDCCH/8 timeslot X subslot Y

echo arfcn=$arfcn
echo ts=$ts
echo sub=$sub

grgsm_decode -h
grgsm_decode --cfile=DATE.$arfcn.rtl.cfile --arfcn=$arfcn --mode=SDCCH8 --timeslot=$ts --subslot=$sub \
    --print-bursts > $arfcn.$ts.$sub.S
wc -l DATE.$arfcn.$ts.2S

force sub-slot as filter


filter-out fragments, func=UI, func=RR


look for Cipher Mode Command

gsm_a.dtap.msg_rr_type == 0x35

A5/1 Cracking

See A5/1 Cracking


Aug 14, 2016 sample rate error #208

Aug 16, 2015 Recording traffic data #114

Jun 20, 2015 Code refactoring from other projects (Osmocom, OpenBTS…) #70

Feature Requests


gr-gsm mailing-list!forum/gr-gsm

Nethence | Pub | Lab | Pbraun | SNE Russia | xhtml