[srslte-users] P-RNTI as UE detector

[Ismael Gomez]

Hi Meny,

I'm not sure that the P-RNTI gives you information on whether a UE is close
to you or not. The best way to do that, in my opinion, would be to detect
PUSCH/PUCCH DMRS signals or SRS signals generated by the UE and, if you
want, use AoA and energy estimation to detect the position.

The RSSI is difficult to intercept, what you could try to do is to capture
CQI reports on PUCCH transmitted by the UE and then assume the SNR is only
due to the path loss, which gives you the distance to the eNodeB. To
intercept those messages, you first need to know the C-RNTI for that user,
which could be obtained by sniffing the Random Access Responses.

Overall, none of the two approaches is "straightforward", but definitely
very interesting research! Good luck!

On Tue, 15 Dec 2015 at 16:50 Meny Sidar <sidar.meny at gmail.com> wrote:

> Hi guys
>
> I was wondering if there is way in srsLTE to use P-RNTI (paging radio
> network temporary identifier)
> as a way to detect mobile phones nearby?
>
> My enodeB base station is implemented with OpenLTE, for testing those
> "attacks".
> my purpose is to try and determine the distance between a UE and a USRP
> running the srsLTE code, that i need to impersonate the base station.
>
> is there a way to page a UE and take it's RSSI value from it to the
> impersonated base station (the one running the srsLTE)?
>
> Thanks a lot for your help!
> Meny
>
>
> _______________________________________________
> srslte-users mailing list
> srslte-users at lists.softwareradiosystems.com
> http://www.softwareradiosystems.com/mailman/listinfo/srslte-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.srsran.com/pipermail/srsran-users/attachments/20151216/4f993562/attachment.htm>