IMSI-catcher VS LTE-Cell-Scanner

I'll do you one better:

For GSM, basic IMSI sniffing: https://github.com/Oros42/IMSI-catcher

https://github.com/Oros42/IMSI-catcher this is the one I got working, there are others on Github

GSM signals https://github.com/Oros42/IMSI-catcher

I would start with ss7 and IMSI catcher in particular. There is also a project on git hub that might give some more insights. There are a bunch of tutorials on how to set it all up on YouTube. But it all basic. I think Juilliard have to dive into the protocols themselves. Though maybe I don’t know something.

imsi-catcher

But people are playing around with such things for educational purposes. Might be easier for some law enforcement officer to pull IMSI logs from the relevant time from providers... IANAL and don't know anything about US law.

This project goes a decent job at passively observing 2G: https://github.com/Oros42/IMSI-catcher An RTL2832U dongle is enough to get started.

Also, IMSI (actually, a randomised version (TMSI)) is sent in the clear over the air - see https://github.com/Oros42/IMSI-catcher https://en.wikipedia.org/wiki/Mobility_management#TMSI. IMEI should be encrypted as far as I remember. But that's not very useful to intercept anyway as it's just an indicator of the phone (and can be altered)

Have you looked at this on GH? https://github.com/Oros42/IMSI-catcher

https://github.com/Oros42/IMSI-catcher :)

Having a quick look : I understand they only listen and never transmit, and just decode MIB and SIB1 => why do they require a sophisticated and expensive SDR such as bladerf ? I though an rtl-sdr would be able to decode MIB (and probably SIB, but I have a doubt there because maybe the location of those resource blocks would exceed the rtl-sdr's limited bandwidth... I would need to check, but anyway it seems https://github.com/JiaoXianjun/LTE-Cell-Scanner is able to decode SIB)