Understanding why the Radio Access Network is vulnerable is only half the job. Our deep dive into RAN air interface vulnerabilities covers the theory in detail — O-RAN's disaggregated attack surface, MEC/edge exploitation, orchestration compromise, jamming, and beamforming deception. This piece picks up where that one leaves off: it is the field manual for actually doing the assessment.
Everything here assumes you already have written authorization, an RF test license or Faraday-shielded lab, and a defined scope. If you don't have those three things yet, start with our guide on building a private LTE/5G lab — nothing in this article should be pointed at a live commercial network without explicit permission.
This methodology walks through the four practical phases of a RAN and wireless security assessment: assembling and calibrating an SDR lab, capturing and decoding the air interface across 2G through 5G NR, testing the infrastructure interfaces that connect radio nodes to the core (fronthaul, X2/Xn, backhaul, O-RAN's RIC/E2), and running a structured rogue base station detection sweep. Where the theory has already been covered elsewhere on this site, we link out rather than repeat it.
I. Assembling the SDR Assessment Lab
The theoretical vulnerabilities described in our RAN deep-dive are only exploitable — or testable — if you can actually receive and transmit the relevant waveforms. That starts with hardware selection matched to the bands and generations in scope.
Hardware Tiers
| Tier | Hardware | Bandwidth | Use Case | Approx. Cost |
|---|---|---|---|---|
| Passive/Recon | RTL-SDR (RTL2832U) | 2.4 MHz | GSM BCCH decode, spectrum sweeps, coarse RF monitoring | $25–40 |
| Mid-tier | HackRF One | 20 MHz, half-duplex | LTE PDSCH capture, 5G NR SSB detection, general SDR development | $300–350 |
| Lab-grade | LimeSDR / LimeSDR Mini 2.0 | 61.44 MHz, full-duplex | Bidirectional LTE/5G NR work, rogue eNB/gNB transmission in a shielded lab | $300–700 |
| Reference | Ettus USRP B210 | 56 MHz, full-duplex, 2x2 MIMO | srsRAN/OpenAirInterface full-stack eNB/gNB emulation, MIMO capture | $1,500–2,000 |
For a first build, an RTL-SDR plus a HackRF One covers passive assessment work (spectrum monitoring, GSM/LTE broadcast decode, 5G NR cell scanning) for well under $500. Active transmission work — deploying a controlled rogue node inside a shielded enclosure to validate downgrade-attack resilience — requires a full-duplex device like the LimeSDR or USRP B210, which is the platform srsRAN expects for eNB/gNB emulation.
Software Stack
- GNU Radio (GRC) — the signal processing framework underpinning almost every tool in this list; used to build custom capture flowgraphs when off-the-shelf decoders don't cover a specific band or protocol variant
- gr-gsm — GSM Um interface decoding (BCCH/CCCH, burst classification, A5 cipher detection)
- srsRAN Project — full 4G/5G stack (UE, eNB, gNB) for both passive capture (
srsuein monitor mode) and controlled active testing - UERANSIM — 5G UE and gNB simulator, useful for RRC/NAS message-level testing without RF hardware
- LTE-Cell-Scanner — lightweight LTE cell scanner focused on PDSCH decode and serving-cell parameter extraction
- SigDigger / GQRX — real-time spectrum visualization for calibration and interference triage
- Wireshark with the LTE-RRC/NAS and NR-RRC dissectors for post-capture protocol analysis
Legal Band Scoping
Confirm the operator's licensed spectrum for the assessment region before capture. Cross-reference OpenCelliD and national regulator frequency allocation tables (e.g., FCC ULS, Ofcom Wireless Telegraphy Register) to build a target EARFCN/NR-ARFCN list — this keeps the assessment scoped to the client's own spectrum and avoids inadvertently capturing or transmitting on a neighboring operator's licensed bands.
II. Air Interface Capture, Generation by Generation
Each cellular generation exposes a different broadcast structure and requires a different toolchain. The goal at this phase is passive: enumerate cell parameters, identify security configuration (cipher suites in use, downgrade conditions), and establish the baseline you'll compare rogue-cell detections against later.
GSM (2G) — gr-gsm
GSM's Broadcast Control Channel (BCCH) is unencrypted by design, making it the easiest starting point for a capture workflow.
- Calibrate PPM offset with
kalibrate-rtl -s GSM900(or the relevant band) - Capture the BCCH with
grgsm_livemonand pipe into Wireshark for live decode - Extract System Information (SI) messages to enumerate LAC, Cell ID, and neighbor cell lists
- Flag any cell offering A5/0 (no encryption) or forcing a downgrade from A5/3 — both are immediate high-severity findings
LTE (4G) — srsRAN / LTE-Cell-Scanner
<CodeBlock
language="bash"
is-terminal
code=" # Passive LTE cell scan and RRC capture with srsRAN (monitor mode, no attach)
sudo srsue --rf.device_name=uhd --rf.device_args='type=b210'
--rat.eutra.dl_earfcn=1800 --rrc.release=15
--log.all_level=debug --pcap.enable=true --pcap.filename=/tmp/lte_scan.pcap
Decode SIB1 from the capture to pull PLMN, TAC, and cell reselection params
tshark -r /tmp/lte_scan.pcap -Y 'lte-rrc.systemInformationBlockType1'
-T fields -e lte-rrc.plmn_Identity -e lte-rrc.trackingAreaCode
-e lte-rrc.cellIdentity
Check the advertised security capabilities in SecurityModeCommand
tshark -r /tmp/lte_scan.pcap -Y 'lte-rrc.securityModeCommand'
-T fields -e lte-rrc.CipheringAlgorithm -e lte-rrc.IntegrityProtAlgorithm"
Cross-reference the decoded CipheringAlgorithm/IntegrityProtAlgorithm fields against the expected baseline — an advertised EEA0/EIA0 (null cipher/integrity) on a production cell is the signature of either a serious misconfiguration or an active downgrade attack in progress.
5G NR — SSB, MIB, and SIB1 Decoding
5G NR broadcasts its Synchronization Signal Block (SSB) periodically, carrying the Physical Cell ID (PCI) and the Master Information Block (MIB). Decoding the full System Information Block Type 1 (SIB1) requires demodulating the associated PDCCH/PDSCH, which is considerably more compute-intensive than LTE.
- Sweep the target NR-ARFCN range and detect SSBs via PSS/SSS correlation (srsRAN's
srsuein NR mode, or a custom GNU Radio SSB detector) - Decode the MIB to extract the Subcarrier Spacing (SCS) configuration and SIB1 scheduling information
- Decode SIB1 to enumerate the broadcast PLMN list — a cell advertising multiple PLMNs indicates a shared RAN (MOCN) deployment, which changes the threat model for roaming-partner impersonation
- For NSA deployments, identify the anchor LTE cell (via the LTE capture procedure above) paired with the NR secondary cell, and confirm the anchor cell isn't the weaker link in the security chain
III. Infrastructure Interface Testing
Air interface findings get the headlines, but in practice the highest-value findings in a RAN assessment usually come from the infrastructure interfaces connecting radio nodes to each other and to the core — precisely because they're assumed to be "internal" and are frequently under-hardened as a result. The architectural detail on why each of these interfaces matters is covered in Section II and III of our RAN vulnerabilities research; this section is the testing procedure.
gNB/eNodeB Site Enumeration
Before testing any interface, build a complete inventory of the sites in scope:
- Resolve observed CGIs (MCC-MNC-TAC-CID / MCC-MNC-TAC-NCI for 5G) from the air interface capture phase against OpenCelliD and national tower registries
- Map site clusters to the operator's published coverage polygons to identify co-location and shared-mast arrangements — a shared site with a competing operator or a neutral-host provider is a lateral-movement consideration for later phases
- Flag any site with a CGI that doesn't resolve cleanly against the expected topology; this list becomes your baseline for rogue cell detection in Section IV
O-RAN Near-RT RIC / E2 Interface Testing
Where the deployment is disaggregated (O-RAN), the Near-RT RIC and its E2 interface become testable network endpoints rather than internal vendor firmware:
- Enumerate the Near-RT RIC's REST management API and any exposed xApp onboarding endpoints
- Attempt unauthenticated access to the E2 interface (ASN.1 over SCTP) between the RIC and the E2 Nodes (O-CU-CP, O-CU-UP, O-DU) — confirm mTLS is actually enforced rather than merely configured
- Validate O1 (NETCONF/YANG) interface authentication against the SMO; a common finding is default or weak NETCONF credentials left over from vendor provisioning
- Test A1 policy interface input validation — malformed or boundary-value policy payloads should be rejected by the Near-RT RIC, not silently applied
Fronthaul (CPRI/eCPRI) Capture
If the assessment scope includes physical access to a Far Edge site or street cabinet:
- Identify the physical fronthaul link between the O-RU and O-DU
- If accessible via a tap or SPAN port, capture eCPRI traffic and check whether MACsec (802.1AE) is actually applied at the Ethernet layer — many "IPsec-protected" deployments only protect the backhaul, leaving fronthaul in cleartext
- Where fronthaul is unencrypted, demonstrate impact by decoding raw IQ samples from the capture — this is the practical proof-of-concept for the eCPRI risk category described in the deep-dive's O-RAN interface table
X2/Xn and Backhaul Review
- Enumerate X2 (LTE-LTE) and Xn (NR-NR) inter-node interfaces exposed on the transport network; test for unauthenticated SCTP association setup
- Validate SCTP association hardening (association limits, cookie validation) to rule out resource-exhaustion DoS via crafted
INITfloods - Confirm IPsec is deployed on the S1/N2/N3 backhaul between the radio node and core, and specifically check for cleartext transport segments where the SeGW (Security Gateway) configuration has gaps — a common finding is IPsec correctly applied on the primary path but missing on a secondary/backup transport link
IV. Rogue BTS / IMSI Catcher Detection and RF Fingerprinting
Detecting a rogue base station is fundamentally a baseline-comparison exercise. The full attack mechanics (bidding-down, forced reject messages, beamformed deception) are covered in the RAN vulnerabilities article and our dedicated IMSI catcher and rogue base station research; this section is the detection procedure.
Detection Methodology
- Build the baseline. Using the site enumeration data from Section III, compile the expected CGI, PLMN, LAC/TAC, and signal strength envelope for every legitimate cell in the assessment area.
- Continuous SDR sweep. Run a scheduled scan (SigDigger or a custom GNU Radio flowgraph) across the in-scope bands, logging PCI/CGI, signal strength (RSRP/RSRQ), and broadcast parameters for every observed cell.
- Anomaly scoring. Flag any observation where:
- A CGI appears that isn't in the baseline inventory
- A known-good CGI reappears with a signal strength far outside its historical envelope (a classic rogue-cell tell — attackers overpower the legitimate signal to force reselection)
- A cell's LAC/TAC is geographically inconsistent with its claimed location
- A cell downgrades its advertised cipher suite compared to the historical baseline for that CGI
- Cross-reference with UE-side indicators, where available: unexpected cell reselections, forced RAT downgrades (5G→4G→2G), or a spike in Authentication Reject / TAU Reject messages logged by test UEs in the field.
<CodeBlock language="bash" is-terminal code=" # Simple anomaly check: compare a live scan against the baseline inventory grgsm_scanner --band GSM900 > /tmp/live_scan.txt
python3 - <<'PY' import csv
baseline = {row'cgi': row for row in csv.DictReader(open('baseline_cgi.csv'))} live = csv.DictReader(open('/tmp/live_scan.txt'))
for cell in live: cgi = cell'cgi' if cgi not in baseline: print(f'ALERT Unknown CGI observed: {cgi} @ {cell"rssi"} dBm') continue delta = abs(float(cell'rssi') - float(baseline[cgi]'rssi_avg')) if delta > 15: print(f'ALERT Signal deviation on known CGI {cgi}: {delta:.1f} dB from baseline') PY"
RF Fingerprinting
CGI and PLMN comparison catches naive rogue cells, but a well-resourced adversary can clone every broadcast parameter of a legitimate cell. RF fingerprinting closes that gap by identifying the physical transmitter itself, independent of what it claims to be:
- Power-up transient analysis — every transmitter has a characteristic amplitude ramp during burst power-up, driven by its specific RF front-end components
- Frequency offset profiling — oscillator imperfections produce a small, consistent frequency offset unique to each transmitter, measurable across repeated observations
- Phase noise characteristics — the phase noise spectrum of a transmitter's local oscillator forms a distinguishable signature under spectral analysis
In practice, this means recording a fingerprint library for every legitimate site during the baseline phase, then comparing subsequent observations of a given CGI against its recorded fingerprint. A cell broadcasting a familiar CGI and PLMN but a different RF fingerprint is close to definitive proof of a cloned rogue node — this is the technique that defeats attacks which pass simple parameter-matching checks.
V. Frequently Asked Questions
An RTL-SDR dongle ($30) plus a HackRF One ($300) covers the majority of passive assessment work described in this article: GSM BCCH decode, LTE broadcast capture, and 5G NR SSB/MIB detection. Active transmission testing (deploying a controlled rogue node in a shielded lab) requires a full-duplex platform like a LimeSDR or Ettus USRP B210 — see our private LTE/5G lab guide for a complete procurement list.
Yes. GSM's Um interface is decoded with gr-gsm against an unencrypted BCCH. LTE requires srsRAN or LTE-Cell-Scanner to decode PDSCH/PDCCH and extract RRC parameters. 5G NR requires SSB detection followed by MIB and SIB1 decoding, which is considerably more compute-intensive due to the OFDM numerology and beam-sweeping involved. There isn't a single tool that covers all three well — plan your toolchain per generation in scope.
The air interface is the most accessible attack surface, but in TelcoSec's assessment experience, infrastructure interfaces (backhaul IPsec gaps, fronthaul without MACsec, unauthenticated O-RAN E2/O1 endpoints) are where exploitable gaps are actually found most often — precisely because they're assumed to be "internal" and get less scrutiny than the RF layer. Both surfaces need testing; this methodology just reflects where the highest-value findings tend to live. See the full RAN threat model for why each interface matters architecturally.
Partially. Continuous SDR sweeps comparing observed CGI/signal-strength data against a maintained baseline can be scripted and run unattended, catching the majority of naive rogue cells. RF fingerprinting to defeat cloned-parameter attacks currently requires more manual signal-processing work and a pre-built fingerprint library per site, though this is an active area of tooling development. Neither fully replaces periodic manual verification.
Only with explicit written authorization from the operator and, for any active transmission, the appropriate spectrum test license or a Faraday-shielded lab environment. Passive spectrum monitoring in unlicensed observation is generally lower-risk but still requires care around local RF interception law. Everything active in this article — rogue node deployment, downgrade testing — should be confined to an isolated lab; see our private 5G lab setup guide for how to build one.
Conclusion & Next Steps
A RAN and wireless security assessment is only as good as its methodology discipline: calibrated hardware, a per-generation capture toolchain, a systematic pass through the infrastructure interfaces that connect radio nodes to the core, and a baseline-driven detection process for rogue transmitters. None of it requires exotic access — an assessor with a few hundred dollars of SDR hardware and authorized scope can cover the majority of this article's procedures.
Where this piece has been deliberately procedural, the RAN vulnerabilities deep-dive covers the why: the O-RAN interface threat model, MEC/edge lateral movement, orchestration compromise, and the beamforming and jamming attack classes that motivate the tests described here. Read both together, and pair them with our IMSI catcher and rogue base station research for the detection side in full depth.
