Recover the LTE resource grid with coherent capture

Mechanism

The LTE downlink is OFDMA: the carrier is divided into 15 kHz subcarriers grouped into resource blocks of 12 subcarriers, and a symbol plus its cyclic prefix occupies the time-frequency resource grid. A 20 MHz carrier carries 100 resource blocks (1200 subcarriers); the smallest, 1.4 MHz, carries 6 (72 subcarriers). Time is structured as a 10 ms radio frame of ten 1 ms subframes, each two 0.5 ms slots [[ts36211]]. Recovering anything above the antenna therefore means first reconstructing this grid, which is exactly where capture coherence matters: a free-running SDR clock drifts in frequency and time, rotating and smearing the QAM constellation on each subcarrier until the grid is unreadable. A disciplined reference (a GPSDO or equivalent) supplies the stable frequency/timing that keeps the subcarriers aligned (RFSAM-RES-09).

Synchronisation is bootstrapped from two signals the cell always transmits in the centre 62 subcarriers, independent of bandwidth. The Primary Synchronisation Signal (PSS) gives symbol timing and N_ID(2) ∈ {0,1,2}; the Secondary Synchronisation Signal (SSS) gives N_ID(1) ∈ {0..167} and frame timing. The Physical Cell ID is then PCI = 3·N_ID(1) + N_ID(2), one of 504 values [[ts36211]]. Once PSS/SSS are locked, the Physical Broadcast Channel (PBCH) around the centre carries the Master Information Block (MIB), which states the system bandwidth, PHICH configuration, and the System Frame Number, the bandwidth value is what tells the receiver how wide the rest of the grid actually is [[ts36211]]. With bandwidth known, the control region (PDCCH) and shared channel (PDSCH) of each subframe can be demapped.

The open-source LTE-receiver lineage establishes that this full chain, PSS/SSS sync, PCI, MIB on PBCH, then blind PDCCH and PDSCH decode, is reproducible on commodity SDRs, and that decode reliability is gated by capture quality and clock discipline rather than by any secret. OWL grounds reliable control-channel decoding on information from the random-access procedure and reports decoding the resource grid in over 99% of frames on inexpensive SDR hardware [[bui2016owl]]. FALCON blind-decodes the whole PDCCH (the DCI/RNTI scheduling grants in the cell) in real time and is an alternative to OWL that is less sensitive to non-ideal radio conditions [[falkenberg2019falcon]]. LTESniffer chains PDCCH → PDSCH/PUSCH to passively recover downlink and uplink scheduling and traffic, and documents that uplink capture across two USRP B-series units requires a GPSDO for inter-unit synchronisation, concrete evidence that grid recovery is coherence-bound [[hoang2023ltesniffer]]. This control verifies only the capture-feasibility prerequisite (sync + grid recovery); it is observational and reads what the network already broadcasts, so its criticality is info. Reading the broadcast/control information itself, and any active step, belong to the Link and Attack layers.

Procedure

All steps below are passive reception only. LTE is licensed spectrum: receiving a downlink is generally permissible, but treat local regulation as authoritative, and never transmit on an operator’s band, any active step (rogue cell, identity request) is a separate Attack-layer control and is for authorised testing on your own equipment in RF containment.

1. Confirm a disciplined reference and a healthy receiver. Lock the SDR to its GPSDO (or an external 10 MHz reference) and confirm it initialises before relying on the capture (RFSAM-RES-09). With UHD/USRP:

   uhd_usrp_probe --args "type=b200,clock_source=gpsdo,time_source=gpsdo"

   Expect the probe to enumerate the AD9361 daughterboard and report the reference source as locked. A free-running clock still captures, but report capture quality as a limiting factor for the control region.

2. Find the carrier and read its width on a waterfall. Sweep the candidate bands in gqrx and identify the steady OFDM “wall” of a downlink carrier; note its centre frequency (→ EARFCN) and visible width (1.4 to 20 MHz). A 20 MHz carrier fits in one HackRF view; a wider, disciplined SDR gives cleaner symbols later (RFSAM-RES-08).

3. Run cell search to recover the PCI from PSS/SSS. With srsRAN’s cell_search example, scan a band (here band 3, ~1800 MHz):

   ./srsran/lib/examples/cell_search -b 3

   Useful flags from usage(): -b band (required), -s earfcn_start, -e earfcn_end, -n nof_frames_total (default 100), -a "<RF args>", -g RF_gain, -d RF_devicename. Expected output line:

   Found CELL 1845.0 MHz, EARFCN=1500, PHYID=123, 100 PRB, 1 ports, PSS power=-65.0 dBm

   PHYID is the PCI (0 to 503), nof PRB confirms the bandwidth recovered from PBCH, and a sane PSS power indicates a clean lock. No “Found CELL” line means sync failed, revisit gain, centre frequency, or clock discipline.

4. Decode the MIB and demodulate the grid on the chosen carrier. Point the pdsch_ue example at the carrier (use the EARFCN’s RX frequency from step 3):

   ./srsran/lib/examples/pdsch_ue -f 1845000000 -A 2

   Watch for:

   Tuning receiver to 1845.000 MHz
   Decoded MIB. SFN: 412, offset: 0

   followed by a live stats line at subframe 5 reporting RSRP, PDCCH-Miss: x.xx%, PDSCH-BLER: x.xx%. A low PDCCH-Miss and PDSCH-BLER with steady Decoded MIB confirms the grid is recovered coherently. Persistent Cell not found after [ ... ] attempts. Trying again... or a high PDCCH-Miss percentage is the symptom of an incoherent capture (clock drift, host-I/O underruns, or insufficient bandwidth).

5. (Optional) Cross-check with a second receiver chain. Run LTESniffer’s downlink mode on the same carrier to confirm PDCCH/PDSCH recovery independently:

   sudo ./src/LTESniffer -A 2 -W 4 -f 1840e6 -C -m 0 -a "num_recv_frames=512"

   -C turns on cell search, -m 0 is downlink mode, -A 2 uses two RX antennas (needed for transmission modes 3/4), and num_recv_frames=512 improves B210 synchronisation [[hoang2023ltesniffer]]. Consistent PCI and decode between srsRAN and LTESniffer is strong evidence the capture chain is sound. FALCON or a gr-lte flowgraph can serve the same cross-check role [[falkenberg2019falcon]][[grlte]].

6. Record the verdict. Capture-feasibility passes if PSS/SSS sync is stable, the PCI matches across runs, MIB decodes, and PDCCH-Miss/PDSCH-BLER stay low for sustained frames. Note the clock source and host so the result is reproducible.

Field case

Illustrative walkthrough, substitute the values you capture; this is a reproducible example, not a measured engagement, and every unmeasured quantity is marked [FILL: …].

Rig: a USRP B210 with the GPSDO option, fed a band-3 (1800 MHz FDD) downlink. After uhd_usrp_probe confirms the GPSDO reference, cell_search -b 3 returns a Found CELL line reporting EARFCN=[FILL: e.g. 1500], PHYID=[FILL: PCI 0 to 503], [FILL: nof] PRB, and PSS power=[FILL: dBm]. Pointing pdsch_ue -f [FILL: RX Hz] -A 2 at that carrier produces a steady Decoded MIB. SFN: [FILL] and, at subframe 5, PDCCH-Miss: [FILL: %] / PDSCH-BLER: [FILL: %]. The control passes when synchronisation holds, the PCI is stable across repeated runs, and the grid demodulates without timing-induced corruption.

A documented degradation pattern worth reproducing: the same recorded carrier that decoded MIB cleanly on a desktop host failed intermittently on an underpowered mini-PC, the SDR was fine, but host I/O could not sustain the sample rate, surfacing as Cell not found retries and elevated PDCCH-Miss. This is the practical lesson of RFSAM-RES-09: coherent OFDM capture is bounded by the whole chain (reference clock and host throughput), not the radio alone.

Remediation

This is an auditor-side capture-quality control; “remediation” is mostly about reporting accurately, but the layered guidance still applies to the systems being assessed.

• Auditor (capture chain): Use a disciplined reference (GPSDO or external 10 MHz) for any OFDM capture and validate the host can sustain the sample rate before drawing conclusions (RFSAM-RES-08, RFSAM-RES-09). If sync is marginal, report capture quality as a limiting factor rather than asserting a clean negative result.
• Developer / network integrator: The information recovered by this control, PCI, system bandwidth, MIB/SFN, and the PDCCH scheduling picture, is broadcast or sent in the clear by design and cannot be hidden at the PHY layer [[ts36211]][[bui2016owl]]. Do not treat broadcast obscurity as a security boundary. Real protections live above the air interface: enable user-plane ciphering and integrity per bearer, and ensure identity privacy (S-TMSI rather than IMSI on paging) so that easy grid recovery does not translate into easy tracking.
• Operator: Recognise that passive resource-grid recovery and PDCCH monitoring are inexpensive and well-documented [[falkenberg2019falcon]][[hoang2023ltesniffer]]; treat the control plane visible from the air as observable, and base detection of rogue-infrastructure and tracking on the Attack-layer controls rather than assuming the PHY layer is private.