[{"data":1,"prerenderedAt":192},["ShallowReactive",2],{"tool-doc-lte-cell-scanner":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"name":8,"protocol":10,"category":11,"hardware":12,"command":13,"academyLab":14,"body":15,"_type":186,"_id":187,"_source":188,"_file":189,"_stem":190,"_extension":191},"\u002Ftools\u002Flte-cell-scanner","tools",false,"","LTE-Cell-Scanner","Passive LTE cell discovery and MIB\u002FSIB decoder using RTL-SDR or USRP to enumerate nearby eNodeBs, tracking areas, and operator configurations.","4G LTE","Passive Cell Discovery","RTL-SDR \u002F HackRF \u002F USRP B210","CellSearch --freq-start 700e6 --freq-end 2700e6","https:\u002F\u002Fapp.telcosec.net",{"type":16,"children":17,"toc":175},"root",[18,27,45,52,97,103,110,123,129,138,144,153,159],{"type":19,"tag":20,"props":21,"children":23},"element","h1",{"id":22},"lte-cell-scanner-passive-lte-cell-enumeration",[24],{"type":25,"value":26},"text","LTE-Cell-Scanner — Passive LTE Cell Enumeration",{"type":19,"tag":28,"props":29,"children":30},"p",{},[31,36,38,43],{"type":19,"tag":32,"props":33,"children":34},"strong",{},[35],{"type":25,"value":8},{"type":25,"value":37}," is a passive reconnaissance tool that scans for LTE eNodeB cells across configurable frequency ranges. Within ",{"type":19,"tag":32,"props":39,"children":40},{},[41],{"type":25,"value":42},"TelcoChisel",{"type":25,"value":44},", it is pre-compiled with RTL-SDR, HackRF, and UHD driver support, enabling broadband LTE cell discovery, Physical Cell ID (PCI) enumeration, and MIB\u002FSIB system information decoding for site survey and IMSI catcher detection.",{"type":19,"tag":46,"props":47,"children":49},"h2",{"id":48},"key-capabilities-security-vectors",[50],{"type":25,"value":51},"Key Capabilities & Security Vectors",{"type":19,"tag":53,"props":54,"children":55},"ul",{},[56,67,77,87],{"type":19,"tag":57,"props":58,"children":59},"li",{},[60,65],{"type":19,"tag":32,"props":61,"children":62},{},[63],{"type":25,"value":64},"Broadband eNodeB Discovery",{"type":25,"value":66},": Scan entire LTE frequency allocations (700 MHz–2700 MHz) to map all active cells in range.",{"type":19,"tag":57,"props":68,"children":69},{},[70,75],{"type":19,"tag":32,"props":71,"children":72},{},[73],{"type":25,"value":74},"PCI & TAC Enumeration",{"type":25,"value":76},": Extract Physical Cell IDs, Tracking Area Codes, and PLMN identifiers to fingerprint operator infrastructure.",{"type":19,"tag":57,"props":78,"children":79},{},[80,85],{"type":19,"tag":32,"props":81,"children":82},{},[83],{"type":25,"value":84},"MIB\u002FSIB Decoding",{"type":25,"value":86},": Decode Master and System Information Blocks to reveal cell bandwidth, SIB scheduling, PRACH configuration, and emergency alert capabilities.",{"type":19,"tag":57,"props":88,"children":89},{},[90,95],{"type":19,"tag":32,"props":91,"children":92},{},[93],{"type":25,"value":94},"IMSI Catcher Detection",{"type":25,"value":96},": Compare discovered cell parameters against known operator databases to identify rogue base stations and stingrays.",{"type":19,"tag":46,"props":98,"children":100},{"id":99},"telcochisel-execution-cheatsheet",[101],{"type":25,"value":102},"TelcoChisel Execution Cheatsheet",{"type":19,"tag":104,"props":105,"children":107},"h3",{"id":106},"_1-scan-all-lte-bands-with-rtl-sdr",[108],{"type":25,"value":109},"1. Scan All LTE Bands with RTL-SDR",{"type":19,"tag":111,"props":112,"children":117},"pre",{"className":113,"code":115,"language":116,"meta":7},[114],"language-bash","# Wideband LTE cell search across common bands\nCellSearch --freq-start 700e6 --freq-end 2700e6 --device-type rtlsdr\n","bash",[118],{"type":19,"tag":119,"props":120,"children":121},"code",{"__ignoreMap":7},[122],{"type":25,"value":115},{"type":19,"tag":104,"props":124,"children":126},{"id":125},"_2-target-specific-band-band-7-2600-mhz",[127],{"type":25,"value":128},"2. Target Specific Band (Band 7 \u002F 2600 MHz)",{"type":19,"tag":111,"props":130,"children":133},{"className":131,"code":132,"language":116,"meta":7},[114],"# Focused scan on LTE Band 7 (2620-2690 MHz downlink)\nCellSearch --freq-start 2620e6 --freq-end 2690e6\n",[134],{"type":19,"tag":119,"props":135,"children":136},{"__ignoreMap":7},[137],{"type":25,"value":132},{"type":19,"tag":104,"props":139,"children":141},{"id":140},"_3-decode-system-information",[142],{"type":25,"value":143},"3. Decode System Information",{"type":19,"tag":111,"props":145,"children":148},{"className":146,"code":147,"language":116,"meta":7},[114],"# Lock to a discovered cell and decode SIBs\nCellSearch --freq-start 1805e6 --freq-end 1880e6 --num-sib-decode 10\n",[149],{"type":19,"tag":119,"props":150,"children":151},{"__ignoreMap":7},[152],{"type":25,"value":147},{"type":19,"tag":46,"props":154,"children":156},{"id":155},"practice-in-telcosec-academy",[157],{"type":25,"value":158},"Practice in TelcoSec Academy",{"type":19,"tag":28,"props":160,"children":161},{},[162,164],{"type":25,"value":163},"👉 ",{"type":19,"tag":32,"props":165,"children":166},{},[167],{"type":19,"tag":168,"props":169,"children":172},"a",{"href":14,"rel":170},[171],"nofollow",[173],{"type":25,"value":174},"Launch LTE Reconnaissance Lab on App.TelcoSec.Net",{"title":7,"searchDepth":176,"depth":176,"links":177},2,[178,179,185],{"id":48,"depth":176,"text":51},{"id":99,"depth":176,"text":102,"children":180},[181,183,184],{"id":106,"depth":182,"text":109},3,{"id":125,"depth":182,"text":128},{"id":140,"depth":182,"text":143},{"id":155,"depth":176,"text":158},"markdown","content:tools:lte-cell-scanner.md","content","tools\u002Flte-cell-scanner.md","tools\u002Flte-cell-scanner","md",1792170262393]