There are many ways to determine the location, such as satellite navigation(GPS), location wirelessly WiFi networks and across networks cellular.

In this post, we tried to check how well the technology for determining the location on cell towers in the city of Minsk works (provided that only open bases coordinates of GSM transmitters).

The principle of operation is that cellular telephone(or cellular module) knows which transceiver base station it is serviced and having a database of coordinates of the base station transmitters, you can approximately determine your location.

Now a little about what a transmitter is in the understanding of OpenCellID and how the OpenCellID database is populated. This database is filled with different ways, the simplest is to install an application on a smartphone that records the coordinates of the phone and the serving base station, and then sends all measurements to the server. The OpenCellID server calculates the approximate location of the base station based on a large number of measurements (see figure below). So the coordinates wireless network are calculated automatically and are very approximate.

Map OpenStreetMap contributors

Now let's move on to the question of how to use this database. There are two options: use the Cell ID to Coordinate translation service provided by OpenCellID.org, or perform a local search. In our case, the local method is preferable, because we're going to take a 13 km route and web browsing will be slow and inefficient. Accordingly, we need to download the database to the laptop. You can do this by downloading the cell_towers.csv.gz file from downloads.opencellid.org.

The database is a table in CSV format described below:

• - code of the country;
• - operator code;
• - area code;
• - transmitter identifier;
• - transmitter longitude;
• - the latitude of the transmitter.

Everything is clear with the database, now you can move on to determining the Cell ID.

All cellular modules support the following commands: AT + CREG, AT + COPS (serving base station), AT + CSQ (signal strength from the base station). Some modules make it possible to recognize, in addition to the service transmitter, also neighboring ones, i.e. monitor base stations using AT ^ SMONC for Siemens and AT + CCINFO for Simcom. I had a SIMCom SIM5215E module at my disposal.

Accordingly, we used the AT + CCINFO command, its format is shown below.

We are interested in the following parameters:

• - indicator of the serving transmitter;
• - indicator of the adjacent transmitter;
• - code of the country;
• - operator code;
• - area code;
• - transmitter identifier;
• - received signal power in dBm.

Having connected the cellular module to the laptop, we received the following log:

Monitoring works - you can go.

The route ran in the western part of Minsk along the street. Matusevich, Pushkin Ave., st. Ponomarenko, st. Sharangovich, st. Maxim Goretsky, st. Lobanka, st. Kuntsevshchina, st. Matusevich.

Map OpenStreetMap contributors

The log was recorded at 1 second intervals. Performing the transformation of CellID into coordinates, it turned out that 6498 calls to the OpenCellID database were successful, and 3351 calls did not find matches in the database. Those. hit rate for Minsk is about 66%.

The figure below shows all the transmitters that were encountered in the log and were in the database.

Map OpenStreetMap contributors

The picture below shows all serving transmitters that were found in the log and were in the database. Those. a similar result can be obtained on any cellular module or telephone.

Map OpenStreetMap contributors

As you can see, at one of the moments we were served by a transmitter located behind a traffic intersection at the intersection of ul. Pritytsky and MKAD. Most likely, this is a suburban base station serving subscribers at a distance of several kilometers, which leads to significant errors in determining the location by Cell ID.

Since our SIMCom SIM5215Е at each moment of time shows not only the serving transmitter, but also the neighboring ones and the signal levels from them, we will try to calculate the coordinates of the device based on all the data available at a particular moment in time.

Calculation of the subscriber coordinates will be performed as a weighted average of the coordinates of the transmitters:
Latitude = Sum (w [n] * Latitude [n]) / Sum (w [n])
Longitude = Sum (w [n] * Longitude [n]) / Sum (w [n])

As is known from the theory of radio wave propagation, the attenuation of a radio signal in a vacuum is proportional to the square of the distance from the transmitter to the receiver. Those. at a distance of 10 times (for example, from 1 km to 10 km), the signal will become 100 times weaker, i.e. will decrease by 20 dB in power. Accordingly, the weight for each term is defined as:
w [n] = 10 ^ (RSSI_in_dBm [n] / 20)

Here we have assumed that the power of all transmitters is the same, this assumption is erroneous. But due to the lack of information about the transmitter power of the base station, one has to make deliberately rough assumptions.

As a result, we get a more detailed picture of the locations.

Map OpenStreetMap contributors

As a result, the route turned out to be well drawn, with the exception of an ejection towards the interchange on the Moscow Ring Road, for the previously described reason. In addition, over time, the coordinate database will be filled, which should also increase the accuracy and availability of positioning technology by Cell ID.

Thank you for the attention. Questions and comments are welcome.

One of the first questions that arises when you are trying to connect to mobile internet, it is a question of the location of the base station of the operator of your choice in order to point your antenna in its direction. It is advisable to find out the exact coordinates of the tower and the relief to it in order to understand whether it makes sense to use the tower to receive a signal. Services and various android applications do not give the exact coordinates of the BS, tk. based on measurements and their mathematical processing. In this case, the error can reach several kilometers.

Often, the coordinates of the tower can be established by studying operator coverage maps, terrain, Google and Yandex maps, as well as the opportunities they provide to view photographs and panoramas of the studied area. I must say that BS on the map can not always be found. There may be many reasons for this - the maps are outdated, the BS is located on the roof of the building and is simply not visible on the map, the tower is small, etc.

BS parameters are unknown. Kostroma region

Given: coordinates 57.564243, 41.08345, the village of Kuzminka in the Kostroma region.
The task is to determine the exact coordinates of the BS, to which you can connect to receive a 3G signal. We will consider the search for BS in steps.

Step 1. Analysis of coverage maps.

We will use the well-known service yota-faq.ru/yota-zone-map/, which presents the coverage areas of four operators, except for Beeline. I will note here that the Beeline coverage presented on their off-site is almost impossible to use - as a rule, a continuous coverage is shown there, which does not take into account the terrain. The most interesting from the point of view of connection are the coverage areas of Megafon and MTS. You can see for yourself by opening the service, pasting coordinates into the search bar and switching operators.

Megaphone coverage area:

MTS coverage area:

From the analysis of the Megafon coverage area, we see that the 3G BSs are most likely located in the directions of Krasnoe, Sukhonogovo, Lapino (on this scale, Lapino's map is not visible, it is southwest, approximately where the P-600 mark is).

The coverage area of ​​MTS is more interesting. Here we also consider the direction to Sukhonogovo and Krasnoe. But Red is a more interesting option, because there is 4G coverage. The distance to Red is about 10 km, if MTS distributes 4G at a frequency of 1800 MHz, that is, there is every chance to establish communication with one of the MTS BSs located in this settlement.

Step 2. Study of the terrain.

The relief up to Red is not easy, but quite penetrable. To assess the relief, we will use the service https://airlink.ubnt.com. If this is your first time on this site, then first you will need to go through a free registration procedure. Having opened the service, scroll the slider down to the end and enter the initial data in the lower right corner, as shown in the following figure.

I usually first enter the same coordinates in both windows, and then I begin to move the purple label to the points of interest to me, where the BS can presumably be located. In this case, the relief, line of sight and the approximate size of the Fresnel zone are displayed in the upper right corner of the screen.

For our coordinates, we have:

Checking the relief in other "suspicious" directions showed that the relief there is much worse. Thus, we decided on the direction and at the same time chose the operator - MTS.

Step 3. Clarification of our choice using the "Quality of Communication" service

The service opens at the following address https://geo.minsvyaz.ru. V search bar we set the name of the village Kuzminka, switch the view from 4 windows to one-window mode, scale the map to a convenient size and get for the MTS operator:

We see that our choice is correct, because according to the measurement database of users of this service, Krasniy does indeed have good 4G coverage from MTS.

Let's zoom in on this map and see that the most likely location of the tower (or towers) is Sovetskaya and Okruzhnaya streets.

Step 4. Explore the area using Google and Yandex maps.

These maps have a useful tool for exploring the area - panoramas and photographs of the area. Google maps have much more panoramas of various areas than Yandex, so you often have to use Google when looking at panoramas. On the other hand, Yandex has more photos taken in different places, and besides, Yandex maps are usually more relevant for Russia. In this regard, you have to use both services. Google maps and services are used here.

So, we found out that we need to consider two streets in Krasnoye in search of BS. We launch Google maps, enter the approximate coordinates of st. Sovetskaya (or street name) and we get:

Here the street view mode is turned on, the street we need is highlighted in blue on the map. You can get a panorama of the street by clicking the mouse anywhere on the blue line. Moving in this way along the street to the north, near the post office we find the first BS:

And finally, not far from the intersection of Sovetskaya and Okruzhnaya streets, a third tower is discovered, the highest one found:

We return to the map and find the shadow of this tower in the place where the photo points:

We mark this place on the map with the mouse and get the exact coordinates of the BS:

Let's summarize some of the results of our research. With the help of information obtained from the analysis of coverage areas, custom measurements of signal strength in the area of ​​interest to us and study of the area from photographs and panoramas, we were able to find three base stations and their exact coordinates in a city that we have never been to. The question of which operator the found BS belongs to remains open, since the answer to it requires additional research. The easiest way is to drive along the route and measure the BS parameters using some android application that gives MNC, MCC and signal strength. Some of these applications are presented here.

The BS parameters are known. Suburb of Penza

As you know, a number of android applications, as well as the HiLink modem interface and the MDMA program can give BS parameters, with the help of which known services and applications can give approximate BS coordinates, which makes it easier to find specific BS coordinates on maps. Let's consider a specific example from the forum, the example is based on

Distance to the tower is approximately 4800 meters:

As can be seen from our study, the error in determining the BS coordinates obtained using the xinit.ru/bs service is very significant - it is almost 2 km. Such errors are common for all services based on user measurement databases, but there are no other services available.

Conclusion

The presented methodology, based on the use of widely available cartographic tools, does not always, but quite often, allows us to find the exact coordinates of the BS. Significant assistance in determining whether a BS belongs to a particular operator is provided by services that provide information on the parameters of the BS and its approximate coordinates.

Locating communication towers is not a criminal activity, but a fairly common task in remote regions and villages where the quality of coverage is poor. How to understand why it takes better from this post than from that gate? The following tools and sites can help you navigate.

From English-speaking services perhaps best is opensignal.com, where you can choose the operator and the desired location. The map does not display towers, but shows coverage areas. Of the Russians, I can recommend netmonitor.ru - its database contains a lot of information about operator towers.

Some applications for Android are also interesting. For example, OpenSignal displays a map cell towers and Wi-Fi points(places with poor connection are also marked on the map), has a built-in compass and a speed checker.

Another interesting utility is Netmonitor. It can monitor GSM and CDMA networks, shows information about the signal level, contains a database of cell towers, supports devices with multiple SIM cards, and can also keep a log in CLF or KLM format.

Please note that Netmonitor has limitations when working on devices from some manufacturers. On Motorola smartphones, LG, Samsung, Acer and Huawei, the list of neighbors may be empty, and on Samsung devices, moreover, the signal strength may not be displayed.

I would also recommend the GSM Signal Monitoring application, which allows you to work with GSM, UMTS and LTE networks. It displays the change in the signal strength on the graph and shows the neighboring cells (only in GSM networks). There is a data rate monitor and the ability to track connection status, connection standard, cell and current zone identifiers (LAC / RNC / TAC) and received signal strength (RSSI, as well as RSRP for LTE).

Knowing the data of the base station, you can punch it through the xinit.ru website and get information about its location. In large cities, it does not hurt to try to find folk maps with the location of the towers, but you should understand that the towers belong different operators... Plus, base stations are installed not only on poles, but also on rooftops.

There are many ways to determine your location, such as satellite navigation (GPS), WiFi and cellular location.

In this post, we tried to check how well the technology for determining the location by cell towers in the city of Minsk works (provided that only open databases of coordinates of GSM transmitters are used).

The principle of operation lies in the fact that the cell phone (or cellular communication module) knows which base station transceiver it is serviced by and having a database of coordinates of the base station transmitters, you can approximately determine your location.

Now a little about what a transmitter is in the understanding of OpenCellID and how the OpenCellID database is populated. This database is filled in in various ways, the simplest is to install an application on a smartphone that records the coordinates of the phone and the serving base station, and then sends all measurements to the server. The OpenCellID server calculates the approximate location of the base station based on a large number of measurements (see figure below). Thus, the coordinates of the wireless network are calculated automatically and are very approximate.

Map OpenStreetMap contributors

Now let's move on to the question of how to use this database. There are two options: use the Cell ID to Coordinate translation service provided by OpenCellID.org, or perform a local search. In our case, the local method is preferable, because we're going to take a 13 km route and web browsing will be slow and inefficient. Accordingly, we need to download the database to the laptop. You can do this by downloading the cell_towers.csv.gz file from downloads.opencellid.org.

The database is a table in CSV format described below:

• - code of the country;
• - operator code;
• - area code;
• - transmitter identifier;
• - transmitter longitude;
• - the latitude of the transmitter.

Everything is clear with the database, now you can move on to determining the Cell ID.

All cellular modules support the following commands: AT + CREG, AT + COPS (serving base station), AT + CSQ (signal strength from the base station). Some modules make it possible to recognize, in addition to the service transmitter, also neighboring ones, i.e. monitor base stations using AT ^ SMONC for Siemens and AT + CCINFO for Simcom. I had a SIMCom SIM5215E module at my disposal.

Accordingly, we used the AT + CCINFO command, its format is shown below.

We are interested in the following parameters:

• - indicator of the serving transmitter;
• - indicator of the adjacent transmitter;
• - code of the country;
• - operator code;
• - area code;
• - transmitter identifier;
• - received signal power in dBm.

Having connected the cellular module to the laptop, we received the following log:

Monitoring works - you can go.

The route ran in the western part of Minsk along the street. Matusevich, Pushkin Ave., st. Ponomarenko, st. Sharangovich, st. Maxim Goretsky, st. Lobanka, st. Kuntsevshchina, st. Matusevich.

Map OpenStreetMap contributors

The log was recorded at 1 second intervals. Performing the transformation of CellID into coordinates, it turned out that 6498 calls to the OpenCellID database were successful, and 3351 calls did not find matches in the database. Those. hit rate for Minsk is about 66%.

The figure below shows all the transmitters that were encountered in the log and were in the database.

Map OpenStreetMap contributors

The picture below shows all serving transmitters that were found in the log and were in the database. Those. a similar result can be obtained on any cellular module or telephone.

Map OpenStreetMap contributors

As you can see, at one of the moments we were served by a transmitter located behind a traffic intersection at the intersection of ul. Pritytsky and MKAD. Most likely, this is a suburban base station serving subscribers at a distance of several kilometers, which leads to significant errors in determining the location by Cell ID.

Since our SIMCom SIM5215Е at each moment of time shows not only the serving transmitter, but also the neighboring ones and the signal levels from them, we will try to calculate the coordinates of the device based on all the data available at a particular moment in time.

Calculation of the subscriber coordinates will be performed as a weighted average of the coordinates of the transmitters:
Latitude = Sum (w [n] * Latitude [n]) / Sum (w [n])
Longitude = Sum (w [n] * Longitude [n]) / Sum (w [n])

As is known from the theory of radio wave propagation, the attenuation of a radio signal in a vacuum is proportional to the square of the distance from the transmitter to the receiver. Those. at a distance of 10 times (for example, from 1 km to 10 km), the signal will become 100 times weaker, i.e. will decrease by 20 dB in power. Accordingly, the weight for each term is defined as:
w [n] = 10 ^ (RSSI_in_dBm [n] / 20)

Here we have assumed that the power of all transmitters is the same, this assumption is erroneous. But due to the lack of information about the transmitter power of the base station, one has to make deliberately rough assumptions.

As a result, we get a more detailed picture of the locations.

Map OpenStreetMap contributors

As a result, the route turned out to be well drawn, with the exception of an ejection towards the interchange on the Moscow Ring Road, for the previously described reason. In addition, over time, the coordinate database will be filled, which should also increase the accuracy and availability of positioning technology by Cell ID.

Thank you for the attention. Questions and comments are welcome.