5.7 Where the subscriber is
Location is the most consequential thing a mobile network knows about a person, and every technique in this family derives it from something the network itself has to measure. Three of the four are passive; the fourth forges the answer.
5.7.1 Timing advance geolocation
Need: measurements. Timing advance is the network telling a handset how late to transmit because of how far away it is. That number is a range, and three ranges meet at a point.
modules/39_ta_geoloc.sh --ta 10 lte # 10 TA units -> 780.71 m, error bound 39.04 m
modules/39_ta_geoloc.sh --ta 10 nr
modules/39_ta_geoloc.sh --trilaterate anchors.tsv # least-squares fix from x/y/range rows
modules/39_ta_geoloc.sh --cells cells.tsv # ranges for a cell list
modules/39_ta_geoloc.sh --plan # measurement handoff plan
LTE's TA unit is 78.07 m of one-way range; NR's is finer. --ta prints the
range and the error bound, because a TA-derived position is a band, not a
point: quoting 780 m without ±39 m overstates the instrument. --trilaterate
takes anchors and ranges and solves for the intersection, with the residual
reported so a bad geometry is visible rather than silently producing a confident
wrong answer.
What you read: per measurement the range and its error, and for a fix the least-squares solution plus residuals; the plan verb says which measurements a real collection would need.
When it refuses: fewer than three anchors, anchors on one line (collinear geometry has no unique solution), a RAT whose TA unit it does not know.
Read next: §5.7.2 for the position report the network would rather use, and §5.1.6 for the cell coordinates these anchors come from.
5.7.2 Forging an LPP position
Need: nothing to build; a capture to detect. LPP is the protocol by which an E-SMLC asks a handset where it is. A forged response is a handset that lies.
modules/46_lpp.sh --list-pids # LPP procedure codes
modules/46_lpp.sh --forge-position 51.5,-0.12 # a ProvideLocationInformation, built
# status built / pdu_hex D2020028410124FA51FFA8A0
modules/46_lpp.sh --parse-position <hex|file>
modules/46_lpp.sh --detect-forgery <pcap> # what a forged report looks like
modules/46_lpp.sh --otdoa-assist # the assistance data an E-SMLC sends
modules/46_lpp.sh --decode-header <hex>
--forge-position produces a syntactically valid ProvideLocationInformation,
which is the point: the message is legal, and nothing in it is authenticated
against the device that produced it. --detect-forgery is the other half — it
looks for reports whose uncertainty, timing advance or cell measurements do not
fit the claimed position, which is the only way a network catches a lying
handset.
What you read: for a forged message, the PDU and its bit length; for detection, the specific contradictions it found between claim and measurement.
When it refuses: coordinates outside the encodable range, a hex string that fails the LPP header grammar.
Read next: §5.7.1, because the TA in the same attach is what catches the lie.
5.7.3 Paging-based tracking
Need: a capture, and a lot of them.
modules/28_paging_track.sh --torpedo-model <pcap> # collision and response timing
modules/28_paging_track.sh --piercer-correlate <cands> <pcap> [mfrms]
modules/28_paging_track.sh --detect <pcap> # paging anomaly signals
modules/28_paging_track.sh --adaptover-detect <pcap> # the keep-awake paging pattern
modules/28_paging_track.sh --paging-parse <hex> [gsm|lte|nr]
The mechanism is worth understanding even if you never run it: a page is a
broadcast, so the response to a page is the only part that identifies a
handset, and a handset that answers a page you sent has told you it is in the
cell. --torpedo-model measures the collision and response timing that makes
this work; --piercer-correlate takes candidate identities and a capture and
correlates paging behaviour against them; --adaptover-detect looks for the
pathological version, a paging stream designed to keep a handset awake and
draining.
The module's own header records a disagreement with its brief: this implements the NDSS 2019 paper, and says so rather than repeating a venue it could not verify. That is the same rule as everywhere else in the manual — the citation is stated as checked or as briefed.
What you read: timing distributions, correlation scores with the identity they imply, and named anomaly signals with counts.
When it refuses: a capture with no paging messages at all (no paging messages
in <path>), which is a different statement from "no anomalies found".
Read next: §5.1.3 for the arithmetic underneath, and §5.3.2 for the same signalling used to break a cell rather than to track a phone.
5.7.4 RF fingerprinting a device
Need: IQ recordings. Every transmitter is slightly wrong in its own way, and the wrongness is stable enough to recognise.
modules/24_rf_fingerprint.sh --features <iq> cf32 1000000 # RMS, peak, PAPR, flatness, ...
modules/24_rf_fingerprint.sh --transient <iq> cf32 1000000 # burst edge, rise time, envelope
modules/24_rf_fingerprint.sh --sig-add <name> <iq> cf32 1000000
modules/24_rf_fingerprint.sh --classify <iq> cf32 1000000 3
modules/24_rf_fingerprint.sh --csi-parse <hex> [auto|lte|80211]
modules/24_rf_fingerprint.sh --csi-motion <file> # phase variance across snapshots
--features computes the statistics that survive a change of channel;
--transient looks at the moment a burst starts, which is where a device's
power amplifier is least corrected and most individual. --csi-motion is the
odd one out: it uses channel-state-information phase variance across snapshots
to infer that something moved, which is sensing rather than identification, and
the module keeps the two apart.
What you read: a feature vector per recording, a ranked match against a stored signature set, and — stated in the output — how many signatures were in the set, because a classification against two references is not a classification.
When it refuses: an IQ file that does not exist or whose format/sample-rate does not match the declared ones.
Read next: §5.9.1 for the network-traffic equivalent of the same idea.