[srsran-users] Downlink and uplink sniffer

[cao dev]

Hello!

I'm new to the mailing list and have some questions about implementing
sniffing with srsRAN.

The main goal I'd like to do is sniff on the uplink to get the RNTIs of
active devices in the area. I've been using pdsch_ue successfully to decode
the downlink and get the MIB and SIB1, but I've been working towards using
srsue to do create a downlink sniffer and eventually an uplink sniffer in a
similar manner to the research papers below [1] [2]. These papers utilize
srsue as both a DL/UL sniffer to capture the Timing Advance, then
synchronize the uplink sniffer in order to properly decode and get UE RNTIs
in the uplink.

Similarly to this thread I've been struggling to find where to modify srsue
so that it can be used for downlink sniffing (
https://lists.srsran.com/pipermail/srsran-users/2021-July/004402.html). Its
suggested in this thread to comment out the uplink functions in
cc_worker.cc starting at line 576 but which functions exactly should be
removed?

- How can I modify srsue to only receive and not transmit?
- How can I capture the Timing Advance Command in the MAC Random Access
Response (RAR) and the MAC Control Element (CE)?

While the research papers listed below use separate SDRs for the downlink
sniffing and the uplink sniffing, my plan is to use an SDR with two Rx
channels capable of 61.44 Msps to capture the downlink at 30.72 Msps and
the uplink at 30.72 Msps at the same time and process each stream in its
own thread, synchronized in time. Is this a viable solution?

Thank you for your time

Best regards,
-Caleb


[1] LTE Monitoring, Kotuliak:
https://www.research-collection.ethz.ch/bitstream/handle/20.500.11850/462184/1/Kotuliak_Martin.pdf

[2] LTRACK: Stealthy Tracking of Mobile Phones in LTE, Kotuliak:
https://arxiv.org/pdf/2106.05007.pdf
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.srsran.com/pipermail/srsran-users/attachments/20221209/7e1eac2e/attachment.htm>