LTE-Cell-Scanner — Passive LTE Cell Enumeration

LTE-Cell-Scanner is a passive reconnaissance tool that scans for LTE eNodeB cells across configurable frequency ranges. Within TelcoChisel, it is pre-compiled with RTL-SDR, HackRF, and UHD driver support, enabling broadband LTE cell discovery, Physical Cell ID (PCI) enumeration, and MIB/SIB system information decoding for site survey and IMSI catcher detection.

Key Capabilities & Security Vectors

• Broadband eNodeB Discovery: Scan entire LTE frequency allocations (700 MHz–2700 MHz) to map all active cells in range.
• PCI & TAC Enumeration: Extract Physical Cell IDs, Tracking Area Codes, and PLMN identifiers to fingerprint operator infrastructure.
• MIB/SIB Decoding: Decode Master and System Information Blocks to reveal cell bandwidth, SIB scheduling, PRACH configuration, and emergency alert capabilities.
• IMSI Catcher Detection: Compare discovered cell parameters against known operator databases to identify rogue base stations and stingrays.

TelcoChisel Execution Cheatsheet

1. Scan All LTE Bands with RTL-SDR

# Wideband LTE cell search across common bands
CellSearch --freq-start 700e6 --freq-end 2700e6 --device-type rtlsdr

2. Target Specific Band (Band 7 / 2600 MHz)

# Focused scan on LTE Band 7 (2620-2690 MHz downlink)
CellSearch --freq-start 2620e6 --freq-end 2690e6

3. Decode System Information

# Lock to a discovered cell and decode SIBs
CellSearch --freq-start 1805e6 --freq-end 1880e6 --num-sib-decode 10

Practice in TelcoSec Academy

👉 Launch LTE Reconnaissance Lab on App.TelcoSec.Net