Kalibrate-RTL — GSM Frequency Scanner & Clock Calibrator

Kalibrate-RTL (kal) is a GSM base station frequency scanner that leverages the known timing structure of GSM FCCH and SCH bursts to precisely calibrate SDR hardware oscillators. Within TelcoChisel, it serves dual purposes: scanning for active GSM base stations for reconnaissance, and calibrating RTL-SDR frequency offsets for accurate reception in downstream tools like Gr-GSM and Kraken.

Key Capabilities & Security Vectors

• Broadband GSM Cell Scanning: Rapidly enumerate all active GSM ARFCN channels across GSM-850, GSM-900, DCS-1800, and PCS-1900 bands.
• SDR Clock Calibration: Calculate precise frequency offset (PPM) of RTL-SDR and HackRF dongles using GSM carrier signals as references.
• Signal Strength Mapping: Measure received signal power across ARFCNs for RF site survey and coverage analysis.
• Rogue BTS Pre-Reconnaissance: Identify unexpected GSM cells that may indicate IMSI catchers or unauthorized base stations.

TelcoChisel Execution Cheatsheet

1. Scan GSM-900 Band

# Scan and list all GSM-900 base stations with power levels
kal -s GSM900 -g 40

2. Scan DCS-1800 Band

# European DCS-1800 cell scan
kal -s DCS1800 -g 40

3. Calibrate RTL-SDR PPM Offset

# Lock to a strong GSM cell and calculate PPM correction
kal -c 55 -g 40 -e 0
# Use the output PPM value with other SDR tools: grgsm_livemon -p <ppm>

Practice in TelcoSec Academy

👉 Launch GSM Reconnaissance Lab on App.TelcoSec.Net