Skip to content

Commit

Permalink
Update Readme
Browse files Browse the repository at this point in the history
  • Loading branch information
hdtuanss committed Apr 28, 2023
1 parent 37a6191 commit 254df7e
Showing 1 changed file with 21 additions and 0 deletions.
21 changes: 21 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,27 @@ To enable the WireShark to analyze the decoded packets correctly, please refer t
When sniffing LTE uplink, LTESniffer requires USRP X310 because it needs to listen to two different frequencies at the same time, 1 for uplink and 1 for downlink. The main target of the uplink sniffing function is to decode uplink traffic from nearby smartphones. However, as LTESniffer needs to decode the downlink traffic to obtain uplink-downlink DCI messages, it also supports decoding downlink traffic at the same time. Nevertheless, the downlink sniffing function is limited to decoding messages which use transmission modes 1 and 2, since LTESniffer only has 1 antenna for downlink.
### Distance for uplink sniffing
The effective range for sniffing uplink is limited in LTESniffer due to the capability of the RF front-end of the hardware (i.e. SDR). The uplink signal power from UE is significantly weaker compared to the downlink signal because UE is a handheld device that optimizes battery usage, while the eNB uses sufficient power to cover a large area. To successfully capture the uplink traffic, LTESniffer can increase the strength of the signal power by i) being physically close to the UE, or ii) improving the signal reception capability with specialized hardware, such as a directional antenna, dedicated RF front-end, and signal amplifier.
### The information displayed on the terminal
**Downlink Sniffing Mode**
``Processed 1000/1000 subframes``: Number of subframes was processed by LTESniffer last 1 second. There are 1000 LTE subframes per second by design.
``RNTI``: Radio Network Temporary Identifier of UEs.
``Table``: The maximum modulation scheme that is used by smartphones in downlink. LTESniffer supports up to 256QAM in the downlink. Refer to our [paper][paper] for more details.
``Active``: Number of detected messages of RNTIs.
``Success``: Number of successfully decoded messages over number of detected messages (``Active``).
``New TX, ReTX, HARQ, Normal``: Statistic of new messages and retransmitted messages. This function is in development.
``W_MIMO, W_pinfor, Other``: Number of messages with wrong radio configuration, only for debugging.

**Uplink Sniffing Mode**
``Max Mod``: The maximum modulation scheme that is used by smartphones in uplink. It can be 16/64/256QAM depending on the support of smartphones and the configuration of the network. Refer to our [paper][paper] for more details.
``SNR``: Signal-to-noise ratio (dB). Low SNR means the uplink signal quality from the smartphone is bad. One possible reason is the smartphone is far from the sniffer.
``DL-UL_delay``: The average of time delay between downlink signal from the base station and uplink signal from the smartphone.
``Other Info``: Information only for debugging.

**API Mode**
``Detected Identity``: The name of detected identity.
``Value``: The value of detected identity.
``From Message``: The name of the message that contains the detected identity.

<!-- ## FAQ
**Q:** Is it possible to capture and see the phone call content using LTESniffer? \
**A:** No. LTE traffic including phone call traffic is encrypted, so you cannot use LTESniffer to know the content of phone calls of someone. Moreover, it is important to note that sniffing phone calls in the commercial network is illegal in most countries. -->
Expand Down

0 comments on commit 254df7e

Please sign in to comment.