IMSI-catcher VS LTESniffer

I'll do you one better:

For GSM, basic IMSI sniffing: https://github.com/Oros42/IMSI-catcher

https://github.com/Oros42/IMSI-catcher this is the one I got working, there are others on Github

GSM signals https://github.com/Oros42/IMSI-catcher

I would start with ss7 and IMSI catcher in particular. There is also a project on git hub that might give some more insights. There are a bunch of tutorials on how to set it all up on YouTube. But it all basic. I think Juilliard have to dive into the protocols themselves. Though maybe I don’t know something.

imsi-catcher

But people are playing around with such things for educational purposes. Might be easier for some law enforcement officer to pull IMSI logs from the relevant time from providers... IANAL and don't know anything about US law.

This project goes a decent job at passively observing 2G: https://github.com/Oros42/IMSI-catcher An RTL2832U dongle is enough to get started.

Also, IMSI (actually, a randomised version (TMSI)) is sent in the clear over the air - see https://github.com/Oros42/IMSI-catcher https://en.wikipedia.org/wiki/Mobility_management#TMSI. IMEI should be encrypted as far as I remember. But that's not very useful to intercept anyway as it's just an indicator of the phone (and can be altered)

Have you looked at this on GH? https://github.com/Oros42/IMSI-catcher

https://github.com/Oros42/IMSI-catcher :)

(usable with cheap SDRs)

For LTE, full-on sniffing of all unencrypted metadata: https://github.com/SysSec-KAIST/LTESniffer