One of the first questions that arises when you are connecting to mobile internet, this is a question about the location of the base station of the operator of your choice in order to direct your antenna in its direction. It is advisable to find out the exact coordinates of the tower and the terrain before it in order to understand whether it makes sense to use the tower to receive a signal. Services and various android applications do not give the exact coordinates of the BS, because based on measurements and their mathematical processing. In this case, the error can reach several kilometers.
Often, tower coordinates can be established by studying operator coverage maps, terrain, Google and Yandex maps, as well as the opportunities they provide to view photos and panoramas of the area being studied. I must say that the BS on the map can not always be found. There can be many reasons for this - the maps are outdated, the BS is located on the roof of the building and it is simply not visible on the map, the tower is small, etc.
BS parameters are unknown. Kostroma region
Given: coordinates 57.564243, 41.08345, Kuzminka village in the Kostroma region.
The task is to determine the exact coordinates of the BS to which you can connect to receive a 3G signal. We will consider the search for BS in steps.
Step 1. Analysis of coverage maps.
Let's use the well-known service yota-faq.ru/yota-zone-map/, which shows the coverage areas of four operators, except for Beeline. I note here that the Beeline coverage presented on their offsite is almost impossible to use - as a rule, a continuous coverage is shown there that does not take into account the terrain. From the point of view of connection, the coverage areas of Megafon and MTS look the most interesting. You can see for yourself by opening the service, inserting the coordinates into the search box and switching operators.
Megaphone coverage area:
MTS coverage area:
From the analysis of the Megafon coverage area, we see that 3G BSs are most likely located in the directions of Krasnoe, Sukhonogovo, Lapino (at this scale, the Lapino map is not visible, it is southwest, approximately where the R-600 mark is).
The MTS coverage area is more interesting. Here we also consider the direction to Sukhonogovo and Krasnoe. But Red is a more interesting option, because. there is 4G coverage. The distance to the Red Order is 10 km, if MTS distributes 4G at a frequency of 1800 MHz, then there is every chance to establish a connection with one of the MTS BS located in this locality.
Step 2. Studying the terrain.
The relief up to Krasny is not easy, but it is quite passable. To assess the relief, we will use the service https://airlink.ubnt.com. If this is your first time on this site, then first you will need to go through a free registration procedure. Having opened the service, scroll the slider down to the end and enter the initial data in the lower right corner, as shown in the following figure.
I usually first enter the same coordinates in both boxes, and then I start moving the purple mark to the points of interest to me, where the BS can supposedly be. At the same time, in the upper right corner of the screen, the relief, the line-of-sight beam and the approximate size of the Fresnel zone are displayed.
For our coordinates we have:
Checking the relief in other "suspicious" directions showed that the relief there is much worse. Thus, we decided on the direction and at the same time chose the operator - MTS.
Step 3. Refinement of our choice using the "Quality of communication" service
The service opens at the following address https://geo.minsvyaz.ru. IN search line set the name of the village Kuzminka, switch the view from 4 windows to single-window mode, scale the map to a convenient size and get for the MTS operator:
We see that our choice is correct, because according to the measurement database of the users of this service, there is indeed a good coverage 4G from MTS.
Let's zoom in on this map and see that the most likely location of the tower (or towers) is Sovetskaya and Okruzhnaya streets.
Step 4. Exploring the area using Google and Yandex maps.
These maps have a useful tool for studying the area - panoramas and photographs of the area. Google maps have much more panoramas of various areas than Yandex, so you often have to use Google when viewing panoramas. On the other hand, Yandex has more photos taken in different places, and in addition, Yandex maps for Russia are usually more up-to-date. In this regard, you have to use both services. Google maps and services are used here.
So, we figured out that we need to look at two streets in Red in search of BS. We launch Google maps, enter the approximate coordinates of the street. Sovetskaya (or street name) and get:
The street view mode is turned on here, the street we need is highlighted in blue on the map. You can get a panorama of the street by clicking anywhere on the blue line. Moving in this way along the street to the north, near the post office we find the first BS:
And finally, not far from the intersection of Sovetskaya and Okruzhnaya streets, a third tower is found, the highest of those found:
We return to the map and find the shadow of this tower in the place where the photo points:
We mark this place on the map with the mouse and get the exact coordinates of the BS:
Let's sum up some results of our research. With the help of information obtained from the analysis of coverage areas, user measurements of the signal strength in the area of interest to us, and studying the area from photographs and panoramas, we were able to find three base stations and their exact coordinates in a city that we had never been to. The question of which operator the found BSs belong to remains open, since the answer to this requires further research. The easiest way is to drive along the route and measure the parameters of the BS using some kind of android application that issues MNC, MCC and signal strength. Some of these applications are presented here.
BS parameters are known. Suburb of Penza
As you know, a number of android applications, as well as a HiLink modem interface and an MDMA program, can provide BS parameters, with the help of which known services and applications can give approximate BS coordinates, which makes it easier to find specific BS coordinates on maps. Consider a specific example from the forum, the example is based on
The distance to the tower is approximately 4800 meters:
As can be seen from our study, the error in determining the BS coordinates obtained using the xinit.ru/bs service is very significant - it is almost 2 km. Such errors are typical for all services based on user measurement databases, but there are no other services available.
Conclusion
The presented technique, based on the use of widely available mapping tools, does not always, but quite often, allows you to find the exact coordinates of the BS. Significant assistance in determining the BS belonging to a particular operator is provided by services that provide information on the parameters of the BS and its approximate coordinates.
There are many methods of positioning, such as satellite navigation (GPS), wireless positioning, WiFi networks and over networks cellular communication.
In this post, we tried to check how well the technology of determining the location by cell towers in the city of Minsk works (provided that only open databases of coordinates of GSM transmitters are used).
The operating principle is that cellular telephone(or a cellular communication module) knows which base station transceiver it is served by and having a database of coordinates of base station transmitters, you can approximately determine your location.
Now a little about what a transmitter is in terms of OpenCellID and how the OpenCellID database is populated. This database is populated different ways, the simplest is to install an application on a smartphone that records the coordinates of the phone and the serving base station, and then sends all measurements to the server. The OpenCellID server calculates the approximate location of the base station based on a large number measurements (see figure below). So the coordinates wireless network calculated automatically and are very approximate.
Map Members of OpenStreetMap
Now let's move on to the question of how to use this database. There are two options: use the Cell ID to coordinates translation service provided by the OpenCellID.org site, or perform a local search. In our case, the local method is preferable, because we're going to drive a 13 km route, and web browsing will be slow and inefficient. Accordingly, we need to download the database to the laptop. This can be done by downloading the cell_towers.csv.gz file from downloads.opencellid.org .
The database is a table in the CSV format described below:
- code of the country; - operator code; - area code; - transmitter identifier; - transmitter longitude; - latitude of the transmitter.
All cellular modules support the following commands: AT+CREG, AT+COPS (serving base station), AT+CSQ (signal strength from base station). Some modules allow you to find out, in addition to the serving transmitter, also neighboring ones, i.e. Monitor base stations with AT^SMONC for Siemens and AT+CCINFO for Simcom. I had a SIMCom SIM5215E module at my disposal.
Accordingly, we used the AT + CCINFO command, its format is given below.
We are interested in the following parameters:
- indicator of the serving transmitter; - indicator of the neighboring transmitter; - code of the country; - operator code; - area code; - transmitter identifier; is the power of the received signal in dBm.
Monitoring works - you can go.
The route ran in the western part of Minsk along the street. Matusevich, Pushkin Ave., st. Ponomarenko, st. Sharangovich, st. Maxim Goretsky, st. Lobanka, st. Kuntsevshchina, st. Matusevich.
Map Members of OpenStreetMap
Logging was carried out with an interval of 1 second. By converting CellID to coordinates, it turned out that 6498 calls to the OpenCellID database were successful, and 3351 calls did not find matches in the database. Those. the hit rate for Minsk is about 66%.
The figure below shows all the transmitters that were found in the log and were in the database.
Map Members of OpenStreetMap
The figure below shows all serving transmitters that were encountered in the log and were in the database. Those. a similar result can be obtained on any cellular module or telephone.
Map Members of OpenStreetMap
As you can see, at one of the moments we were served by a transmitter located behind the traffic intersection at the intersection of st. Pritytsky and Moscow Ring Road. Most likely, this is a suburban base station serving subscribers at a distance of several kilometers, which leads to significant errors in determining the location by Cell ID.
Since our SIMCom SIM5215E at each moment of time shows not only the serving transmitter, but also neighboring and signal levels from them, we will try to calculate the coordinates of the device based on all the data available at a particular point in time.
The calculation of the subscriber's coordinates will be performed as a weighted average of the coordinates of the transmitters:
Latitude = Sum (w[n] * Latitude[n]) / Sum(w[n])
Longitude = Sum (w[n] * Longitude[n]) / Sum(w[n])
As is known from the theory of radio wave propagation, the attenuation of a radio signal in vacuum is proportional to the square of the distance from the transmitter to the receiver. Those. at a distance of 10 times (for example, from 1 km to 10 km), the signal will become 100 times weaker, i.e. will decrease by 20 dB in power. Accordingly, the weight for each term is defined as:
w[n] = 10^(RSSI_in_dBm[n] / 20)
Here we assumed that the power of all transmitters is the same, this assumption is erroneous. But due to the lack of information about the power of the base station transmitter, one has to make deliberately rough assumptions.
The result is a more detailed picture of locations.
Map Members of OpenStreetMap
As a result, the route turned out to be well drawn, with the exception of the release towards the interchange on the Moscow Ring Road, for the previously described reason. In addition, over time, the coordinate database will be filled, which should also increase the accuracy and availability of Cell ID location technology.
Thank you for your attention. Questions and comments are welcome.
nik2166 12-05-2013 23:40
Hi all!
The tag in the car sends signals about its location in the following form:
MCC:250
MNC:02
LAC:1E7E
CID:4F0C
PW:-73
T:0
Motorist 13-05-2013 12:46
Given:
MCC:250 - Russia
MNC:02 - Megaphone
LAC:1E7E - location area
CID:4F0C - station number
Let's try some magic:
("status":"ok","balance":17,"lat":59.88155,"lon":30.37293,"cid":"20236","lac":"7806","mnc":"02" ,"mcc":"592")
Vyshechka was found, it remains to find a typewriter. In the worst case, you will have to circle a circle with a radius of a couple of kilometers. But that's without me.
TWU55 13-05-2013 10:29
Yes, more details please, Motorist?
Motorist 13-05-2013 18:25
In fact, I've been using this site. There's some unrealistic number of stations around the world.
http://ayauto.in/aypi/index.php/site/page?view=api
You can receive a one-time token by mail, you can register and have 20 definitions per day for free. Only the data must be converted from hexadecimal to decimal.
jacker2000 13-05-2013 18:42
Hi all!
Tell me, is it possible to determine the real location of the base station cellular network(MegaFon, if anything) according to the data provided online?
The tag in the car sends signals about its location in the following form:MCC:250
MNC:02
LAC:1E7E
CID:4F0C
PW:-73
T:0That is, as I understand it, it points to the base station closest to itself.
I didn’t find it on Google ... maybe I wasn’t looking there ((
pogdskazhite and how did you get the original data?
I saw this when I entered the technical menu on my siemens m35 back in 2003
Motorist 13-05-2013 19:08
When they hung a directional antenna, they used Netmonitor for android.
https://play.google.com/store/...etmonitor&hl=ru
It should have analogues for all platforms.
nik2166 14-05-2013 12:34
quote: pogdskazhite and how did you get the original data?
one of the anti-theft functions
nik2166 14-05-2013 12:40
What you need!
jacker2000 14-05-2013 15:30
quote: Originally posted by nik2166:
Great, this is the link I was looking for!
entered the coordinates of the BS - and here you have a link to Yandex-maps !!!
What you need!
Can you tell me where you got the original data from?
nik2166 14-05-2013 21:52
I'm telling you - a SIM card is caulked in an anti-theft device, tied to my phone.
I send SMS with the command - he writes the coordinates of the nearest BS in the response SMS
Blackmoon 15-05-2013 11:15
This data can be received by a netmonitor in mobile phones (what exactly, dig in the network) or GSM modules.
In trackers / signalers, this data is transmitted if it is not possible to determine the coordinates by GPS.
unname22 19-06-2013 10:02
Don't be hopeful.
The megaphone is such a mess.
I just worked for their contractors for a while. This is a star, we were looking for these bases, all the information was given out, but they themselves do not really know where they have what.
The site may well be a couple of blocks away from the designated location. And this happened more than once.
There are many ways to determine your location, such as satellite navigation (GPS), location using wireless networks WiFi and cellular networks.
In this post, we tried to check how well the technology of determining the location by cell towers in the city of Minsk works (provided that only open databases of coordinates of GSM transmitters are used).
The principle of operation is that a cell phone (or cellular communication module) knows which base station transceiver it is served by and having a database of coordinates of base station transmitters, you can approximately determine your location.
Now a little about what a transmitter is in terms of OpenCellID and how the OpenCellID database is populated. This database is filled in various ways, the simplest is installing an application on a smartphone that records the coordinates of the phone and the serving base station, and then sends all measurements to the server. The OpenCellID server calculates the approximate location of the base station based on a large number of measurements (see figure below). Thus, the coordinates of the wireless network are calculated automatically and are very approximate.
Map Members of OpenStreetMap
Now let's move on to the question of how to use this database. There are two options: use the Cell ID to coordinates translation service provided by the OpenCellID.org site, or perform a local search. In our case, the local method is preferable, because we're going to drive a 13 km route, and web browsing will be slow and inefficient. Accordingly, we need to download the database to the laptop. This can be done by downloading the cell_towers.csv.gz file from downloads.opencellid.org .
The database is a table in the CSV format described below:
- code of the country; - operator code; - area code; - transmitter identifier; - transmitter longitude; - latitude of the transmitter.
All cellular modules support the following commands: AT+CREG, AT+COPS (serving base station), AT+CSQ (signal strength from base station). Some modules allow you to find out, in addition to the serving transmitter, also neighboring ones, i.e. Monitor base stations with AT^SMONC for Siemens and AT+CCINFO for Simcom. I had a SIMCom SIM5215E module at my disposal.
Accordingly, we used the AT + CCINFO command, its format is given below.
We are interested in the following parameters:
- indicator of the serving transmitter; - indicator of the neighboring transmitter; - code of the country; - operator code; - area code; - transmitter identifier; is the power of the received signal in dBm.
Monitoring works - you can go.
The route ran in the western part of Minsk along the street. Matusevich, Pushkin Ave., st. Ponomarenko, st. Sharangovich, st. Maxim Goretsky, st. Lobanka, st. Kuntsevshchina, st. Matusevich.
Map Members of OpenStreetMap
Logging was carried out with an interval of 1 second. By converting CellID to coordinates, it turned out that 6498 calls to the OpenCellID database were successful, and 3351 calls did not find matches in the database. Those. the hit rate for Minsk is about 66%.
The figure below shows all the transmitters that were found in the log and were in the database.
Map Members of OpenStreetMap
The figure below shows all serving transmitters that were encountered in the log and were in the database. Those. a similar result can be obtained on any cellular module or telephone.
Map Members of OpenStreetMap
As you can see, at one of the moments we were served by a transmitter located behind the traffic intersection at the intersection of st. Pritytsky and Moscow Ring Road. Most likely, this is a suburban base station serving subscribers at a distance of several kilometers, which leads to significant errors in determining the location by Cell ID.
Since our SIMCom SIM5215E at each moment of time shows not only the serving transmitter, but also neighboring and signal levels from them, we will try to calculate the coordinates of the device based on all the data available at a particular point in time.
The calculation of the subscriber's coordinates will be performed as a weighted average of the coordinates of the transmitters:
Latitude = Sum (w[n] * Latitude[n]) / Sum(w[n])
Longitude = Sum (w[n] * Longitude[n]) / Sum(w[n])
As is known from the theory of radio wave propagation, the attenuation of a radio signal in vacuum is proportional to the square of the distance from the transmitter to the receiver. Those. at a distance of 10 times (for example, from 1 km to 10 km), the signal will become 100 times weaker, i.e. will decrease by 20 dB in power. Accordingly, the weight for each term is defined as:
w[n] = 10^(RSSI_in_dBm[n] / 20)
Here we assumed that the power of all transmitters is the same, this assumption is erroneous. But due to the lack of information about the power of the base station transmitter, one has to make deliberately rough assumptions.
The result is a more detailed picture of locations.
Map Members of OpenStreetMap
As a result, the route turned out to be well drawn, with the exception of the release towards the interchange on the Moscow Ring Road, for the previously described reason. In addition, over time, the coordinate database will be filled, which should also increase the accuracy and availability of Cell ID location technology.
Thank you for your attention. Questions and comments are welcome.
The detection of communication towers is not a criminal activity, but a fairly common task in remote regions and villages where the quality of coverage leaves much to be desired. How to understand why it takes better from this post than from that gate? The following tools and websites can help you navigate.
Of the English-language services, perhaps the best is opensignal.com, where you can select the operator and the desired location. The map does not display towers, but shows coverage areas. Of the Russians, I can recommend netmonitor.ru - its database contains a lot of information about operator towers.
Some of the apps for Android are also interesting. For example, OpenSignal displays a map of cell towers and WiFi hotspots(there are also places with poor communication marked on the map), it has a built-in compass and a speed checker.
Another interesting utility is Netmonitor. It can monitor GSM and CDMA networks, display information about signal strength, contain a database of cell towers, support devices with multiple SIM cards, and can also log in CLF or KLM format.
Please note that Netmonitor has limitations when working on devices from some manufacturers. On Motorola smartphones, LG, Samsung, Acer, and Huawei, the neighbor list may be empty, and Samsung devices may not display signal strength.
I also recommend the GSM Signal Monitoring application, which allows you to work with GSM, UMTS and LTE networks. It displays the change in the signal level on the graph and shows neighboring cells (only in GSM networks). There is a data rate monitor and the ability to monitor connection status, connection standard, cell and current zone identifiers (LAC / RNC / TAC) and received signal strength (RSSI, as well as RSRP for LTE).
Knowing the data of the base station, you can punch it through the site xinit.ru and get information about its location. In large cities, it does not hurt to try to find popular maps with the location of the towers, but you should understand that the towers belong to different operators. Plus, base stations are placed not only on poles, but also on the roofs of houses.