How can I fin1d the location of a BTS ?
Why should I look for the location of a BTS ?
Well, obviously you must not do it, but if you are interested in mobile communications it is the right hobby for you. Some people think that looking for BTS is a stupid hobby, but so it isn`t. By doing this hobby you are going to know how does a GSM network work, and how it is designed. Then, for people like me, it is simply very important to know where the BTS are.
What sort of equipment must I have ?
- 1 cellular phone with an engineering menu. The cellular phone with the engineering menu represents the most important equipment for this hobby. The cellular phone is used to show the system paramtetres of the network and also the reception level in dBm. It is recommended that you have two phones with an engineering menu, so that you are able to know the system paramtres of two different networks contemporarly. But don`t worry if you have only one phone, the only thing you must do change the SIM
- 1 map to know where you ( and the BTS ) are
- 1 tape recorder, to memorise the important things about each found BTS like FCN, CID and LAC
- 1 telescop Often a telescope is necessary to detect a far BTS
- 1 vehicle, you can use a car or a bicycle. I use my bicycle because I haven`t got a driving licence, but it is better to use a car.
Everyone who want to do this hobby must also know some generally things about how does a GSM network work. This is ncessary, because if you don`t know it you aren`able to understand the informations from the engineering menu
The equipment I use to find a BTS
First of all there are some things you should konw :
The favourit locations of Omnitel are :
- the roofs of houses, hotels or manufacturies are prefered
- radio or tv towers
- a own tower, if there is no alternativ possibility
The favourit locations of TIM are :
- Buildings or areas which belong to Telecom Italia. Nearly 90% of all the TIM BTS are installed on Telecom Italia buildings
- If there is no Telecom Italia building near enough, TIM has got the same favourit locations as Omnitel
What sort of antennas does Omnitel utilize ?
In South Tyrol ( but almost in all the italian areas ) Omnitel utilise nearly always directional antennas. Those directional antennas are often in diversity configuration, that means two reception and only one transmitting antenna. If this configuration is utilised, the trasmitting antenna is always in the middle, and the reception antennas are on the sides. So much base stations has got three directional antennas per each cell. Normally each base station is used to realize three radio cells, this configuration is called clover. Often there are always other directional antennas on the tower, used to connect the BTS with the MSC.
The classic BTS Omnitel utilize in non-urban areas
What sort of antennas does TIM utilize ?
Tim in Italy doesn`t manage only the GSM, but also the analogue E-TACS ( Extended Total Access Communication System ) system. Therefore nearly all the Tim BTS are equipped with antennas for both systems. The two reception antennas in the diversity configuration work for both systems, while there is a trasmitting antenna for each systems. That`s why the TIM BTS has not got three, but four directional antennas per each radio cell. Also TIM utilize other directional antennas to connect the BTS with the MSC. Those directional antennas are used by old base stations, often the new BTS are connected to the MSC via cable, because of TIM want their BTS to be harmoniously integreated into the city ( also Omnitel do so ).
Note that not all the TIM BTS are designed to work for the GSM and for the E-TACS network. Obviously there are some using only one of those systems. If a base station work only for one system, there are not four but only three antennas per each radio cell ( like a Omnitel BTS ). The E-TACS network is now and old system, with not many customers. Within a few years TIM would not provide this system any longer. Therefore there are no new E-TACS BTS needed, that`s why all the new TIM BTS are using only the GSM standard.
Here you can see the classic TIM BTS installed on a Telecom building which works with GSM and E-TACS standard
Mobile Base Stations :
The Italian GSM network operators such as Tim and Omnitel have also a few mobile base stations. Those BTS are normally installed on lorry adherends, and could be for example used to increase momentanly the capacity of the system ( for example when there is an important arrangement ). But mobile BTS are also used when the network operator must install a BTS within a short period of time. Generally mobile BTS are not used very often.
Directional antennas utilized for the connection with the MSC :
As already said, some old and also a few new BTS utilize special directional antennas for the connection with the MSC. A directional antenna is a normal antenna which transmitt only in one direction. There must be no obstacles between the reception and the transmitting antenna. The MSC must control a certain area and all the BTS and MSC which are contained. The MSC must provide all the calls from the MS which are in its service area. Therefore the calls mus be broadcasted form the BTS to the MSC. Often there are obstacles between the BTS and the MSC, so that the BTS must broadcast the call to another BTS. This base station transmitt the call to another BTS and so on until the call arrived to the base staion which is in direct contact ( without obstacles ) with the MSC. Therefore each of those directional antennas shows where the next BTS is, you must only follow the direction where the antenna transmitt.
BTS with directional antennas used for the connection with the MSC
What is Timing Advance ?
A cellular phone can be everywhere in the area covered by a radio cell. Therefore mobile stations are obviously at different distances from the BTS. Some are very near, other on the contrary are very far, until to 35km. The delay of their transmission depends on their distance. If a MS is very far from the BTS, the broadcasted burst arrived at the base station with a delay. The GSM system utilize the TDMA multiple access : each FDMA frequency is divided into 8 timeslots, each timeslot is used by a different MS. Therefore 8 different MS can use the same channel. A MS can only transmit on the assigned timeslot, in order to don`t disturb the other users. If a MS is very far from the BTS it possible that the broadcasted burst arrived at the base station with a delay and therefore overlap the next timeslot . In this case the broadcasting of this far MS must be advanced, in order that the burst is received by the BTS at the right time. The BTS measures the time delay of the MS broadcasting, and tells the MS via SACCH Downlink to advance the transmission ( obviously only if it is necessary ). The TA values goes from 0 to 63, whereat degree corresponds to bitperiod. Degree 0 obviously means that the transmission is not advanced.
The delay corresponds to the way the radio signal must overcome ( attention : with all the reflections ) before it is received by the base station. Therefore with TA you can find out the distance to the BTS, and this is very helpful to find a base station. By mutliplying TA with 547 you obtain the estimated distance in metres to the BTS. As already said, the delay corresponds to the distance, included all the reflections, the signal must overcome before received by the BTS. Therefore the value obtained by multiplying TA with 547 is not always correct. In cities, where the houses reflect the radio signal, this value is never correct.
How can I find an unknown BTS ?
The list of the known BTS :
At first you must put all the BTS you know into a list. Normally each base station is used to cover three cells, therefore you must make a circle around the BTS to cath all the three, and not only one cell.
For the list of the known BTS you can use for example Excel ( obviously you can use might as well other programms or a sheet of paper ). This list should contain the important parametres of each cell, necessary to identificate them in order to avoid confusions. A good list should contain the following parametres:
- FCN : Frequency Channel FDMA channel used by the BTS to transmitt the BCCH
- CID : Cell Identity, identification number of the BTS
- BCC : Base Station Color Code
- LAC : Location Area Code, identification number of the location area
- RxLevAM : Reception Level Access Minimum
- Antenna : sort of utilized antenna
- Ubication : the exact ubication where the base station is installed
Note that often the network operator change the FCN and the CID of the BTS. Normally this happened when in the nearness the operator has just installed a new BTS. Therefore it is advisable to check sometimes if the paramtetres indicated in your list are still correct. If you don`t do that, it is possible that you look for a BTS you already know. That happened to me a few months ago.
Looking for an unknown base station :
The most exciting part of this hobby is obviously looking for an unknown BTS, that means for a base station whose ubication you don`t know. When you are driving your car in order to find a BTS it is absolutely important that you have the list with all the known BTS, so that you know where you are receiving the BTS you are looking for. In areas where there aren`t many obstacles the radio signal isn`t reflected very often. In this case you can already obtain good resuts using TA to find a BTS.
With TA you can find out the distance to the base station, so that it is easy to find a BTS. First of all you must choose a place where you receive the unknown BTS. Then you begin a call, enter in the engineering menu of your cellular phone and note the value assigned to TA. This call should be a free one, in order to don`t waste money, so for example you can call the customer care of your network operator. Then you have to note the estimated distance to the BTS ( I say it again, you obtain this estimation by multiplying TA with 547 ) and the place where you have made the measuring. Then you must repeat this procedure three or four times, obviously by places where you receive the same base station. Then you draw in a map as much circles as you made measurings. Obviously the center of the circle corresponds to the place where you made the measuring, on the contrary the radius corresponds to the value of TA in metres the phone showed you in this place.
In the center of the three circles there must be the base station. This possibility to find a BTS will be exactlier if you make more measurings.
As already explained, this method can only be used in places where the radio signal isn`t refleceted very often. But how can I find a BTS in a city, where there are obviously much obstacles? Well, in areas where there are too much obstacles there aren`t many possibilities : you must look where the reception level of the BCCH channel is high. A good thing to do would be to note where the reception level is the highest, so that you can reduce the area where you must look for the BTS. When there are no obstacles between you and the BTS the reception level would probably be around -50dBm. Direct under the base station the RX level normally assumes values around -40 or -45dBm. A reception level of -50dBm and a TA value of 000 or 001 means that there must be a BTS in the vicinities.
The car I sometimes use to find a new BTS
And when I have found the base station...
If you have found the BTS you should step out of the car to look what a nice thing you have just found. Then note the parametres necessary for the list of the known BTS and make a photo for the photoalbum ( if you want you can might as well send me the photo via E-Mail ).
What should I do when a cannot find that stupid BTS ?
Obviously you can call the customer care of your network operator and ask where the BTS is installed. But this method doesn`t work very good because of two principal causes. At first the operators don`t tell you very gladly where the BTS are ( so it is in Italy ), because more and more people think that they are dangerous. At second, normally, the young girls who work at the customer care don`t know what a BTS is.
Also there is no alternativ solution, you must solve the problem by yourself. If you aren`t able to see the BTS from the street, you must try it from a higher position, for example a shop, a skyscraper or a church.
At last I wish that with my description you are able to find a great many of GSM base stations. It would be very nice if more and more people exercise this hobby.
I began to look for BTS after I had read Norbert Hüttisch`s homepage. Therefore nearly all the things I know about how find a BTS are written there. My homepage should not be interpreted as a copy of Nobbis GSM pages, I have only explained how I find a new BTS.