Detecting communication towers is not a criminal activity, but a fairly common task in remote regions and villages where the quality of coverage leaves much to be desired. How can you understand why this post gives better results than that wicket? The following tools and websites can help you navigate.

From English-language services, perhaps the best is opensignal.com, where you can select the operator and the desired location. The map does not show towers, but does show coverage areas. Among the Russians, I can recommend netmonitor.ru - its database contains a lot of information about operator towers.

Some Android applications are also interesting. For example, OpenSignal displays a map cell towers And Wi-Fi points(places with poor communication are also marked on the map), has a built-in compass and a speed checker.

Another interesting utility is Netmonitor. It can monitor GSM and CDMA networks, shows information about signal strength, contains a database of cell towers, supports devices with multiple SIM cards, and can also keep a log in CLF or KLM format.

Please note that Netmonitor has limitations when running on devices from some manufacturers. On Motorola smartphones, LG, Samsung, Acer and Huawei, the list of neighbors may be empty, and on Samsung devices, the signal strength may also not be displayed.

I also recommend the GSM Signal Monitoring application, which allows you to work with GSM, UMTS and LTE networks. It displays the change in signal level on a graph and shows neighboring cells (only in GSM networks). There is a data transfer rate monitor and the ability to track connection status, connection standard, cell and current zone identifiers (LAC/RNC/TAC) and received signal strength level (RSSI, as well as RSRP for LTE).

Knowing the data of the base station, you can access it through the website xinit.ru and obtain information about its location. In large cities, it doesn’t hurt to try to find folk maps with the location of the towers, but you should understand that the towers belong to to different operators. Plus, base stations are placed not only on poles, but also on the roofs of houses.

Published 04/22/2015 by John

Cellidfinder is a simple and convenient service for finding the location of base stations mobile communications GSM standard and plotting them on a map. The article provides detailed instructions to find the location of GSM base stations using this service.

What data is needed to localize the BS?

In order to find the coordinates of the base station sector, you need to know 4 parameters:

• MCC (Mobile Country Code) is a code that determines the country in which the mobile operator is located. For example, for Russia it is 250, the USA - 310, Hungary - 216, China - 460, Ukraine - 255, Belarus - 257.
• MNC (Mobile Network Code) is a code assigned to a mobile operator. Unique for each operator in a particular country. Detailed table MCC and MNC codes are available for operators worldwide.
• LAC (Location Area Code) - local area code. In a nutshell, LAC is an association of a number of base stations that are served by one base station controller (BSC). This parameter can be presented in either decimal or hexadecimal format.
• CellID (CID) - “cell identifier”. The same sector of the base station. This parameter can also be presented in decimal and hexadecimal format.

Where can I get this data?

The data is taken from the netmonitor. Netmonitor is special application For mobile phones or other devices that allow you to find out engineering parameters mobile network. There are a huge number of netmonitors on the Internet for various devices. Finding the right one is not a problem. In addition, many modern GPS trackers, in conditions of poor satellite reception, can send to the owner not coordinates, but parameters of the base station (MCS, MNC, LAC, Cellid) to which they cling. Cellidfinder will help you quickly translate these parameters into the approximate location of the BS.

Where do the coordinates of the base station come from?

The search for coordinates of base stations is carried out in the Google and Yandex databases, which provide such an opportunity. It should be noted that as a result of the search we do not get the exact location of the tower, but an approximate one. This is the location in which the largest number of subscribers were registered and transmitted information about their location to Google and Yandex servers. The most accurate location by LAC and CID is determined by using the averaging function, which calculates the coordinates of all sectors (CellID) of one base station, and then calculates the average value.

How to work with CellIDfinder?

In order to start working with the CellIdfinder base station location search service, you need to install any netmonitor on your smartphone. Here is one of the good options. We turn on the downloaded application and look at the necessary parameters.

In this case, in the netmonitor window we saw:
MCC = 257 (Belarus)
MNC = 02 (MTS)
LAC = 16
CID = 2224

We enter these parameters into the search form on . Because LAC and CID can be issued by the netmonitor in both decimal and hexadecimal form; the search form has auto-completion for LAC and CID in the second form. Select “Google Data”, “Yandex Data” and, if high accuracy is needed, “Averaging”. Click the "Find BS" button.

As a result, we obtained the coordinates for this sector of the base station. Moreover, the coordinates in the Google and Yandex databases practically coincided, which means we can assume that the BS are built on the map quite accurately.

There are many ways to determine location, such as satellite navigation(GPS), wireless location WiFi networks and over networks cellular communication.

In this post, we tried to check how well the technology for determining location using cell towers in the city of Minsk works (provided that only open bases coordinate data of GSM transmitters).

The operating principle is that cellular telephone(or cellular communication module) knows which base station transceiver it is served by, and having a database of coordinates of base station transmitters, you can approximately determine your location.

Now a little about what a transmitter is in the understanding of OpenCellID and how the OpenCellID database is populated. This database is filling up different ways, the simplest is to install an application on a smartphone that records the coordinates of the phone and the serving base station, and then sends all measurements to the server. The OpenCellID server calculates the approximate location of the base station based on large number measurements (see figure below). So the coordinates wireless network are calculated automatically and are very approximate.

Map Members OpenStreetMap

Now let's move on to the question of how to use this database. There are two options: use the Cell ID to coordinates translation service provided by OpenCellID.org, or perform a local search. In our case, the local method is preferable, because we're going to be driving a 13km route and the web will be slow and inefficient. Accordingly, we need to download the database to the laptop. This can be done by downloading the cell_towers.csv.gz file from downloads.opencellid.org.

The database is a table in CSV format, described below:

• - code of the country;
• - operator code;
• - area code;
• - transmitter identifier;
• - longitude of the transmitter;
• - latitude of the transmitter.

Everything is clear with the database, now you can move on to determining the Cell ID.

All cellular modules support the following commands: AT+CREG, AT+COPS (serving base station), AT+CSQ (signal level from the base station). Some modules allow you to recognize, in addition to the serving transmitter, also neighboring ones, i.e. monitor base stations using the AT^SMONC commands for Siemens and AT+CCINFO for Simcom. I had a SIMCom SIM5215E module at my disposal.

Accordingly, we used the AT+CCINFO command, its format is given below.

We are interested following parameters:

• - indicator of the serving transmitter;
• - indicator of a nearby transmitter;
• - code of the country;
• - operator code;
• - area code;
• - transmitter identifier;
• - received signal power in dBm.

Having connected the cellular module to the laptop, we received the following log:

Monitoring is working - you can go.

The route ran in the western part of Minsk along the street. Matusevich, Pushkin Ave., st. Ponomarenko, st. Sharangovicha, st. Maxim Goretsky, st. Lobanka, st. Kuntsevshchina, st. Matusevich.

Map Members OpenStreetMap

The log was recorded at intervals of 1 second. Converting CellID to coordinates, it turned out that 6498 calls to the OpenCellID database were successful, and 3351 calls did not find matches in the database. Those. The hit rate for Minsk is approximately 66%.

The figure below shows all the transmitters that were found in the log and were in the database.

Map Members OpenStreetMap

The picture below shows all serving transmitters that were found in the log and were in the database. Those. a similar result can be obtained on any cellular module or phone.

Map Members OpenStreetMap

As you can see, at one point we were served by a transmitter located behind the traffic intersection at the intersection of the street. Pritytsky and MKAD. Most likely, this is a suburban base station serving subscribers at a distance of several kilometers, which leads to significant errors in determining location using Cell ID.

Since our SIMCom SIM5215E at each moment of time shows not only the serving transmitter, but also neighboring ones and the signal levels from them, we will try to calculate the coordinates of the device based on all the data available at a particular moment in time.

We will calculate the subscriber coordinates as a weighted average of the transmitter coordinates:
Latitude = Sum (w[n] * Latitude[n]) / Sum(w[n])
Longitude = Sum (w[n] * Longitude[n]) / Sum(w[n])

As is known from the theory of radio wave propagation, the attenuation of a radio signal in a vacuum is proportional to the square of the distance from the transmitter to the receiver. Those. When removed by a factor of 10 (for example, from 1 km to 10 km), the signal will become 100 times weaker, i.e. will decrease by 20 dB in power. Accordingly, the weight for each term is defined as:
w[n] = 10^(RSSI_in_dBm[n] / 20)

Here we assumed that the power of all transmitters is the same; this assumption is erroneous. But due to the lack of information about the power of the base station transmitter, one has to make deliberately rough assumptions.

As a result, we get a more detailed picture of locations.

Map Members OpenStreetMap

As a result, the route turned out to be well mapped out, with the exception of the ejection towards the interchange on the Moscow Ring Road, for the previously described reason. In addition, over time, the coordinate database will be filled, which should also increase the accuracy and availability of Cell ID location technology.

Thank you for your attention. Questions and comments are welcome.

One of the first questions that arises when you are connecting to mobile internet, this is a question about the location of the base station of your chosen operator in order to point your antenna in its direction. It is advisable to find out the exact coordinates of the tower and the terrain before it in order to understand whether it makes sense to use the tower to receive the signal. Services and various Android applications do not provide exact coordinates of the BS, because based on measurements and their mathematical processing. The error can reach several kilometers.

Often, tower coordinates can be determined by studying operator coverage maps, terrain, Google and Yandex maps, as well as the opportunities they provide to view photographs and panoramas of the area being studied. It must be said that the BS cannot always be found on the map. There can be many reasons for this - the maps are outdated, the BS is located on the roof of the building and is simply not visible on the map, the tower is small, etc.

BS parameters are unknown. Kostroma region

Given: coordinates 57.564243, 41.08345, Kuzminka village in the Kostroma region.
The task is to determine the exact coordinates of the BS to which you can connect to receive a 3G signal. We will consider the search for BS step by step.

Step 1. Analysis of coverage maps.

Let's use the well-known service yota-faq.ru/yota-zone-map/, which presents the coverage areas of four operators, except Beeline. I will note here that the Beeline coverage presented on their website is almost impossible to use - as a rule, it shows continuous coverage that does not take into account the terrain. The coverage areas of Megafon and MTS look the most interesting from a connection point of view. You can see this for yourself by opening the service, inserting coordinates into the search bar and switching operators.

Megafon coverage area:

MTS coverage area:

From the analysis of Megafon's coverage area, we see that 3G BS are most likely located in the directions Krasnoye, Sukhonogovo, Lapino (at this scale the map of Lapino is not visible, this is the southwest, approximately where the P-600 mark is).

The MTS coverage area is more interesting. Here we also consider the direction to Sukhonogovo and Krasnoe. But Red is a more interesting option, because... there is 4G coverage there. The distance to Krasny is about 10 km, if MTS distributes 4G at a frequency of 1800 MHz, then there is every chance of establishing communication with one of the MTS BSs located in this locality.

Step 2. Study of the terrain.

The terrain up to Krasny is difficult, but quite passable. To assess the terrain, we will use the service https://airlink.ubnt.com. If this is your first time on this site, you will first need to go through a free registration procedure. Having opened the service, scroll the slider down to the end and enter the initial data in the lower right corner, as shown in the following figure.

I usually first enter the same coordinates in both windows, and then start moving the purple mark to the points of interest to me, where the BS could presumably be located. At the same time, the relief, line of sight and the approximate size of the Fresnel zone are displayed in the upper right corner of the screen.

For our coordinates we have:

Checking the terrain in other “suspicious” directions showed that the terrain there is much worse. Thus, we decided on the direction and at the same time chose the operator - MTS.

Step 3. Clarifying our choice using the “Communication Quality” service

The service opens at the following address https://geo.minsvyaz.ru. IN search bar set the name of the village Kuzminka, switch the view from 4 windows to single-window mode, scale the map to a convenient size and get for the MTS operator:

We see that our choice is correct, because according to the measurement database of users of this service, Krasnoye actually has good 4G coverage from MTS.

Let's zoom in on this map and see that the most likely location of the tower (or towers) is Sovetskaya and Okruzhnaya streets.

Step 4. Study the area using Google and Yandex maps.

These maps have a useful tool for studying the area - panoramas and photographs of the area. Google maps have much more panoramas of various areas than Yandex, so you have to use Google more often when looking at panoramas. On the other hand, Yandex has more photos taken in different places, in addition, Yandex maps for Russia are usually more relevant. In this regard, you have to use both services. Google maps and services are used here.

So, we found out that we need to consider two streets in Krasnoye in search of BS. Launch Google maps, enter the approximate coordinates of the street. Sovetskaya (or street name) and we get:

Here the street view mode is turned on, the street we need is highlighted in blue on the map. You can get a panorama of the street by clicking the mouse anywhere on the blue line. Moving in this way along the street to the north, at the post office building we find the first BS:

And finally, not far from the intersection of Sovetskaya and Okruzhnaya streets, a third tower is discovered, the highest of those found:

We return to the map and find the shadow of this tower in the place where the photo points:

We mark this place on the map with the mouse and get the exact coordinates of the BS:

Let us summarize some of the results of our research. Using information obtained from coverage area analysis, user measurements of signal strength in the area of ​​interest, and study of the area through photographs and panoramas, we were able to find three base stations and their exact coordinates in a city we had never been to. The question of which operator owns the found BS remains open, because the answer to this requires additional research. The easiest way is to drive along the route and measure the BS parameters using some Android application that displays MNC, MCC and signal strength. Some of these applications are presented here.

The BS parameters are known. Suburb of Penza

As is known, a number of Android applications, as well as a HiLink modem interface and an MDMA program, can provide BS parameters, with the help of which well-known services and applications can provide approximate BS coordinates, which makes it easier to find specific BS coordinates on maps. Let's look at a specific example from the forum, the example is based on

Distance to the tower is approximately 4800 meters:

As can be seen from our research, the error in determining the BS coordinates obtained using the xinit.ru/bs service is very significant - almost 2 km. Such errors are typical for all services based on user measurement databases, but there are no other services available.

Conclusion

The presented technique, based on the use of widely available cartographic tools, does not always, but quite often allows one to find the exact coordinates of the BS. Significant assistance in determining whether a BS belongs to a particular operator is provided by services that provide information on the parameters of the BS and its approximate coordinates.

nik2166 12-05-2013 23:40

Hi all!

The tag in the car sends signals about its location in the following form:

MCC:250
MNC:02
LAC:1E7E
CID:4F0C
PW:-73
T:0

Motorist 13-05-2013 12:46

Given:
MCC:250 - Russia
MNC:02 - Megafon
LAC:1E7E - location area
CID:4F0C - station number

Let's try some magic:
("status":"ok","balance":17,"lat":59.88155,"lon":30.37293,"cid":"20236","lac":"7806","mnc":"02" ,"mcc":"592")

The tower was found, all that was left was to find the machine. In the worst case, you will have to crawl around a circle with a radius of a couple of kilometers. But this is already without me.

TWU55 13-05-2013 10:29

Yes, more details please, Car Enthusiast?

Motorist 13-05-2013 18:25

In fact, I used this site. There is an unreal number of stations around the world.
http://ayauto.in/aypi/index.php/site/page?view=api
You can receive a one-time token by email, you can register and have 20 definitions per day for free. Only the data needs to be converted from hexadecimal to decimal.

jacker2000 13-05-2013 18:42

Hi all!
Tell me, is it possible to determine the real location of the base station? cellular network(MegaFon, if anything) according to the online data provided?
The tag in the car sends signals about its location in the following form:

MCC:250
MNC:02
LAC:1E7E
CID:4F0C
PW:-73
T:0

That is, as I understand it, it points to the base station closest to itself.
I didn’t find it on Google... maybe I was looking in the wrong place((

Tell me, how did you get the original data?
I saw something similar when I entered the technical menu on my Siemens M35 back in 2003

Motorist 13-05-2013 19:08

When we hung up the directional antenna, we used Netmonitor for Android.
https://play.google.com/store/...etmonitor&hl=ru
It should have analogues for all platforms.

nik2166 14-05-2013 12:34

quote: Tell me, how did you get the original data?

one of the anti-theft functions

nik2166 14-05-2013 12:40

Just what you need!

jacker2000 14-05-2013 15:30

quote: Originally posted by nik2166:

great, this is the link I was looking for!!!
entered the coordinates of the BS - and here you have a link to Yandex maps!!!
Just what you need!

Tell me, where did you get the original data?

nik2166 14-05-2013 21:52

I’m telling you, there’s a SIM card sealed in the anti-theft device and it’s connected to my phone.
I send an SMS with the command - in a reply SMS he writes me the coordinates of the nearest BS

BlackMoon 15-05-2013 11:15

This data can be obtained by a netmonitor in mobile phones (exactly which ones, dig on the network) or GSM modules.

In trackers/signals, this data is transmitted if it is not possible to determine the coordinates using GPS.

unname22 19-06-2013 10:02

Don't get your hopes up.
The megaphone is such a mess.
I just worked for their contractors for a while. This is crazy, we looked for these databases, all the information was given out, but they themselves don’t really know where they have what.
The site may well be located a couple of blocks from the designated location. And this happened more than once.