# How does direction finding work when using GMS mobile station and additional handset?

I am trying to understand the concept of direction finder (DF), for mobile GSM devices.

I have found the following description:

http://www.pki-electronic.com/products/interception-and-monitoring-systems/gsm-direction-finder/

It seems to describe the following configuration:

<IMSI catacher>-------- <additional handset (mobile)>
|
|-------- <target mobile device>


According to web site description, it is composed of IMSI catcher (probably), i.e. active base station, which force the target mobile to transmit, and probably the attacker base station (SDR radio) can detect the exact direction/signal strength of the attacked device.

I am not sure how it works, but this is what I think:

1. The base station (which is also a receiver) force the target mobile to keep transmission (by sending silent sms which force the mobile to transmit ack).

2. The additional handset is actually a second receiver.

3. So we get 2 receivers (handset and base stations) , each can find the signal strength.

4. We can draw a map, with 2 circles, and the merge points will point us to the correct direction.

Do you think this is how it works ? any comment is appreciated.

EDIT: Can someone please give a description how it is done and what is the purpose of the handset ? Is it a reciever of just an antenna ?

Thanks.

• rule of thumb: in urban and indoor scenarios, localization usually cannot be done by signal strength. There's no way to know whether the line of sight is the strongest path, whether that exists at all, and how much weaker other paths are. All DF depends on TDOA and digital beamforming. – Marcus Müller Apr 20 '17 at 20:06
• So, I was wrong? Do you have another idea how this is done. see the link in the original post above. – ransh Apr 20 '17 at 20:11
• I don't know whether you were wrong. Just because someone sells a device, especially of moral ambiguity, doesn't mean it's a good device. "Locating via field strength and audio device" definitely sounds more like there's someone running around with an antenna, and generally, the closer you get into the general vicinity of a transmitter, the louder it beeps. There's absolutely no indication that the device wouldn't be led astray by other currently active devices in the same band. Might simply be snakeoil. – Marcus Müller Apr 20 '17 at 20:15
• I did find several such description of "direction finder" all of them seems to be described quite the same: base station which force the mobile to transmit, and an additional handset (not described what it is ) which helps to track direction to a mobile phone. It also use "audio" voice for the handset to help the searcher to estimate how close he it to target. I try to understand how it is done. Thanks. – ransh Apr 20 '17 at 20:23
• Read my answer. – Marcus Müller Apr 20 '17 at 20:32

## 1 Answer

The fact that this thing only has a single antenna port and a loudness knob:

This will just look for a transmitter in the band of interest, and you'll have to turn around a directive antenna until the tone gets loud.

That's absolutely low-tech, it can't discern between GSM phones logged into the same network (and also active), and the whole setup will only work if the straightest path to the phone is also the one that delivers the most energy – which is not the case for e.g. a lot of the indoor and urban mobile channel scenarios that we use nowadays.

• Marcus, thanks a lot. I wander just how such product can really locate direction if the same frequency is used by other devices nearby. Maybe by forcing the target device to keep transmitting ? or maybe this product just does not work well as it claim ? not sure. – ransh Apr 28 '17 at 7:48
• read my answer. – Marcus Müller Apr 28 '17 at 7:51