There are many methods of positioning, such as satellite navigation (GPS), wireless positioning, WiFi networks and over networks cellular communication.
In this post, we tried to check how well the technology of determining the location by cell towers in the city of Minsk works (provided that only open databases of coordinates of GSM transmitters are used).
The operating principle is that cellular telephone(or a cellular communication module) knows which base station transceiver it is served by and having a database of coordinates of base station transmitters, you can approximately determine your location.
Now a little about what a transmitter is in terms of OpenCellID and how the OpenCellID database is populated. This database is populated different ways, the simplest is to install an application on a smartphone that records the coordinates of the phone and the serving base station, and then sends all measurements to the server. The OpenCellID server calculates the approximate location of the base station based on a large number measurements (see figure below). So the coordinates wireless network calculated automatically and are very approximate.
Map Members of OpenStreetMap
Now let's move on to the question of how to use this database. There are two options: use the Cell ID to coordinates translation service provided by the OpenCellID.org site, or perform a local search. In our case, the local method is preferable, because we're going to drive a 13 km route, and web browsing will be slow and inefficient. Accordingly, we need to download the database to the laptop. This can be done by downloading the cell_towers.csv.gz file from downloads.opencellid.org .
The database is a table in the CSV format described below:
- code of the country; - operator code; - area code; - transmitter identifier; - transmitter longitude; - latitude of the transmitter.
All cellular modules support the following commands: AT+CREG, AT+COPS (serving base station), AT+CSQ (signal strength from base station). Some modules allow you to find out, in addition to the serving transmitter, also neighboring ones, i.e. Monitor base stations with AT^SMONC for Siemens and AT+CCINFO for Simcom. I had a SIMCom SIM5215E module at my disposal.
Accordingly, we used the AT + CCINFO command, its format is given below.
We are interested in the following parameters:
- indicator of the serving transmitter; - indicator of the neighboring transmitter; - code of the country; - operator code; - area code; - transmitter identifier; is the power of the received signal in dBm.
Monitoring works - you can go.
The route ran in the western part of Minsk along the street. Matusevich, Pushkin Ave., st. Ponomarenko, st. Sharangovich, st. Maxim Goretsky, st. Lobanka, st. Kuntsevshchina, st. Matusevich.
Map Members of OpenStreetMap
Logging was carried out with an interval of 1 second. By converting CellID to coordinates, it turned out that 6498 calls to the OpenCellID database were successful, and 3351 calls did not find matches in the database. Those. the hit rate for Minsk is about 66%.
The figure below shows all the transmitters that were found in the log and were in the database.
Map Members of OpenStreetMap
The figure below shows all serving transmitters that were encountered in the log and were in the database. Those. a similar result can be obtained on any cellular module or telephone.
Map Members of OpenStreetMap
As you can see, at one of the moments we were served by a transmitter located behind the traffic intersection at the intersection of st. Pritytsky and Moscow Ring Road. Most likely, this is a suburban base station serving subscribers at a distance of several kilometers, which leads to significant errors in determining the location by Cell ID.
Since our SIMCom SIM5215E at each moment of time shows not only the serving transmitter, but also neighboring and signal levels from them, we will try to calculate the coordinates of the device based on all the data available at a particular point in time.
The calculation of the subscriber's coordinates will be performed as a weighted average of the coordinates of the transmitters:
Latitude = Sum (w[n] * Latitude[n]) / Sum(w[n])
Longitude = Sum (w[n] * Longitude[n]) / Sum(w[n])
As is known from the theory of radio wave propagation, the attenuation of a radio signal in vacuum is proportional to the square of the distance from the transmitter to the receiver. Those. at a distance of 10 times (for example, from 1 km to 10 km), the signal will become 100 times weaker, i.e. will decrease by 20 dB in power. Accordingly, the weight for each term is defined as:
w[n] = 10^(RSSI_in_dBm[n] / 20)
Here we assumed that the power of all transmitters is the same, this assumption is erroneous. But due to the lack of information about the power of the base station transmitter, one has to make deliberately rough assumptions.
The result is a more detailed picture of locations.
Map Members of OpenStreetMap
As a result, the route turned out to be well drawn, with the exception of the release towards the interchange on the Moscow Ring Road, for the previously described reason. In addition, over time, the coordinate database will be filled, which should also increase the accuracy and availability of Cell ID location technology.
Thanks for attention. Questions and comments are welcome.
There are many ways to determine your location, such as satellite navigation (GPS), location using wireless networks WiFi and cellular networks.
In this post, we tried to check how well the technology of determining the location by cell towers in the city of Minsk works (provided that only open databases of coordinates of GSM transmitters are used).
The principle of operation is that a cell phone (or cellular communication module) knows which base station transceiver it is served by and having a database of coordinates of base station transmitters, you can approximately determine your location.
Now a little about what a transmitter is in terms of OpenCellID and how the OpenCellID database is populated. This database is filled in various ways, the simplest is installing an application on a smartphone that records the coordinates of the phone and the serving base station, and then sends all measurements to the server. The OpenCellID server calculates the approximate location of the base station based on a large number of measurements (see figure below). Thus, the coordinates of the wireless network are calculated automatically and are very approximate.
Map Members of OpenStreetMap
Now let's move on to the question of how to use this database. There are two options: use the Cell ID to coordinates translation service provided by the OpenCellID.org site, or perform a local search. In our case, the local method is preferable, because we're going to drive a 13 km route, and web browsing will be slow and inefficient. Accordingly, we need to download the database to the laptop. This can be done by downloading the cell_towers.csv.gz file from downloads.opencellid.org .
The database is a table in the CSV format described below:
- code of the country; - operator code; - area code; - transmitter identifier; - transmitter longitude; - latitude of the transmitter.
All cellular modules support the following commands: AT+CREG, AT+COPS (serving base station), AT+CSQ (signal strength from base station). Some modules allow you to find out, in addition to the serving transmitter, also neighboring ones, i.e. Monitor base stations with AT^SMONC for Siemens and AT+CCINFO for Simcom. I had a SIMCom SIM5215E module at my disposal.
Accordingly, we used the AT + CCINFO command, its format is given below.
We are interested in the following parameters:
- indicator of the serving transmitter; - indicator of the neighboring transmitter; - code of the country; - operator code; - area code; - transmitter identifier; is the power of the received signal in dBm.
Monitoring works - you can go.
The route ran in the western part of Minsk along the street. Matusevich, Pushkin Ave., st. Ponomarenko, st. Sharangovich, st. Maxim Goretsky, st. Lobanka, st. Kuntsevshchina, st. Matusevich.
Map Members of OpenStreetMap
Logging was carried out with an interval of 1 second. By converting CellID to coordinates, it turned out that 6498 calls to the OpenCellID database were successful, and 3351 calls did not find matches in the database. Those. the hit rate for Minsk is about 66%.
The figure below shows all the transmitters that were found in the log and were in the database.
Map Members of OpenStreetMap
The figure below shows all serving transmitters that were encountered in the log and were in the database. Those. a similar result can be obtained on any cellular module or telephone.
Map Members of OpenStreetMap
As you can see, at one of the moments we were served by a transmitter located behind the traffic intersection at the intersection of st. Pritytsky and Moscow Ring Road. Most likely, this is a suburban base station serving subscribers at a distance of several kilometers, which leads to significant errors in determining the location by Cell ID.
Since our SIMCom SIM5215E at each moment of time shows not only the serving transmitter, but also neighboring and signal levels from them, we will try to calculate the coordinates of the device based on all the data available at a particular point in time.
The calculation of the subscriber's coordinates will be performed as a weighted average of the coordinates of the transmitters:
Latitude = Sum (w[n] * Latitude[n]) / Sum(w[n])
Longitude = Sum (w[n] * Longitude[n]) / Sum(w[n])
As is known from the theory of radio wave propagation, the attenuation of a radio signal in vacuum is proportional to the square of the distance from the transmitter to the receiver. Those. at a distance of 10 times (for example, from 1 km to 10 km), the signal will become 100 times weaker, i.e. will decrease by 20 dB in power. Accordingly, the weight for each term is defined as:
w[n] = 10^(RSSI_in_dBm[n] / 20)
Here we assumed that the power of all transmitters is the same, this assumption is erroneous. But due to the lack of information about the power of the base station transmitter, one has to make deliberately rough assumptions.
The result is a more detailed picture of locations.
Map Members of OpenStreetMap
As a result, the route turned out to be well drawn, with the exception of the release towards the interchange on the Moscow Ring Road, for the previously described reason. In addition, over time, the coordinate database will be filled, which should also increase the accuracy and availability of Cell ID location technology.
Thanks for attention. Questions and comments are welcome.
Published 04/22/2015 by Johhny
Cellidfinder is a simple and convenient service for finding the location of base stations mobile communications GSM standard and plotting them on the map. The article provides detailed instructions to find the location of GSM base stations using this service.
What data is needed to localize the BS?
In order to find the coordinates of the base station sector, you need to know 4 parameters:
- MCC (Mobile Country Code) - a code that identifies the country in which the mobile operator is located. For example, for Russia it is 250, the USA - 310, Hungary - 216, China - 460, Ukraine - 255, Belarus - 257.
- MNC (Mobile Network Code) is a code assigned to a mobile operator. Unique for each operator in a particular country. A detailed table of MCC and MNC codes for operators worldwide is available.
- LAC (Location Area Code) - local area code. In a nutshell, LAC is an association of a number of base stations that are served by one base station controller (BSC). This parameter can be represented in both decimal and hexadecimal form.
- CellID (CID) - "cell identifier". The same sector of the base station. This parameter can also be represented in decimal and hexadecimal form.
Where to get this data?
The data is taken from the netmonitor. Netmonitor is a special application for mobile phones or other devices that allows you to find out the engineering parameters mobile network. There are a huge number of netmonitors on the network for various devices. Finding the right one is not a problem. In addition, many modern GPS trackers in conditions of poor satellite reception, they can send to the owner not the coordinates, but the parameters of the base station (MCS, MNC, LAC, Cellid) for which they cling. Cellidfinder will help you quickly translate these parameters into the approximate location of the BS.
Where do base station coordinates come from?
The search for the coordinates of base stations is carried out in the Google and Yandex databases, which provided such an opportunity. It should be noted that as a result of the search, we do not get the exact location of the tower, but an approximate one. This is the location where registered the largest number subscribers who have transmitted information about their location to Google servers and Yandex. The most accurate location for LAC and CID is determined using the averaging function, which calculates the coordinates of all sectors (CellID) of one base station, and then calculates the average value.
How to work with CellIDfinder?
In order to start working with the CellIdfinder base station location search service, you need to install any netmonitor on your smartphone. Here is one of the good options. We turn on the downloaded application and look at the necessary parameters.
In this case, in the netmonitor window, we saw:
MCC = 257 (Belarus)
MNC = 02 (MTS)
LAC=16
CID=2224
Enter these parameters in the search form on . Because LAC and CID can be displayed by the netmonitor in both decimal and hexadecimal form, then the search form has autocomplete for LAC and CID in the second form. Select "Google Data", "Yandex Data" and, if high accuracy is needed, "Averaging". Press the "Find BS" button.
As a result, the coordinates for this sector of the base station were obtained. Moreover, the coordinates according to the Google and Yandex databases almost coincided, which means that we can assume that the BS are built on the map quite accurately.
The detection of communication towers is not a criminal activity, but a fairly common task in remote regions and villages where the quality of coverage leaves much to be desired. How to understand why it takes better from this post than from that gate? The following tools and websites can help you navigate.
Of the English-language services, perhaps the best is opensignal.com, where you can select the operator and the desired location. The map does not display towers, but shows coverage areas. Of the Russians, I can recommend netmonitor.ru - its database contains a lot of information about operator towers.
Some of the apps for Android are also interesting. For example, OpenSignal displays a map of cell towers and WiFi hotspots(there are also places with poor communication marked on the map), it has a built-in compass and a speed checker.
Another interesting utility is Netmonitor. It can monitor GSM and CDMA networks, display information about signal strength, contain a database of cell towers, support devices with multiple SIM cards, and can also log in CLF or KLM format.
Please note that Netmonitor has limitations when working on devices from some manufacturers. On the Motorola smartphones, LG, Samsung, Acer, and Huawei, the neighbor list may be empty, and Samsung devices may not display signal strength.
I also recommend the GSM Signal Monitoring application, which allows you to work with GSM, UMTS and LTE networks. It displays the change in the signal level on the graph and shows neighboring cells (only in GSM networks). There is a data rate monitor and the ability to monitor connection status, connection standard, cell and current zone identifiers (LAC / RNC / TAC) and received signal strength (RSSI, as well as RSRP for LTE).
Knowing the data of the base station, you can punch it through the site xinit.ru and get information about its location. In large cities, it does not hurt to try to find popular maps with the location of the towers, but you should understand that the towers belong to different operators. Plus, base stations are placed not only on poles, but also on the roofs of houses.