Interesting observation on the nanoBTS because I have definitely seen
it used that way. I am fairly certain that the CellXion DX/GX
systems, marketed by Datong and at the heart of the MMI v. CellXion
lawsuit, were based on the IP Access nanoBTS. Even if I'm wrong on
that particular model, I am sure that I have seen IP Access equipment
used in that configuration.
That was a few years ago, though. Is it possible that IP Access
changed their firmware at some point to make IMSI-catching more
difficult?
On Dec 3, 2009, at 9:50 PM, Harald Welte wrote:
On Thu, Dec 03, 2009 at 01:07:56AM -0800, David A.
Burgess wrote:
I don't know if that's valid by the spec
or not, but it's part of a
pretty standard configuration in IMSI-catchers: CCCH+SDCCH4 +
6*SDCCH8 + TCH/F. That maximizes location updating capacity and
leaves one TCH/F for other ... mischief. Most of those
IMSI-catchers are based on commercial mini/nano-BTS equipment.
Unfortunately that combination is not supported by either the BS-11
nor the
ip.access nanoBTS. Maybe they have a special BTS firmware image
for the
nanoBTS to do that...
--
- Harald Welte <laforge(a)gnumonks.org> http://
laforge.gnumonks.org/
======================================================================
======
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300
175-7 Ch. A6)
David A. Burgess
Kestrel Signal Processing, Inc.