# How does direction finding work when using GMS mobile station and additional handset?

I am trying to understand the concept of direction finder (DF), for mobile GSM devices.

I have found the following description:

http://www.pki-electronic.com/products/interception-and-monitoring-systems/gsm-direction-finder/

It seems to describe the following configuration:

<IMSI catacher>-------- <additional handset (mobile)>
|
|-------- <target mobile device>


According to web site description, it is composed of IMSI catcher (probably), i.e. active base station, which force the target mobile to transmit, and probably the attacker base station (SDR radio) can detect the exact direction/signal strength of the attacked device.

I am not sure how it works, but this is what I think:

1. The base station (which is also a receiver) force the target mobile to keep transmission (by sending silent sms which force the mobile to transmit ack).

3. So we get 2 receivers (handset and base stations) , each can find the signal strength.

4. We can draw a map, with 2 circles, and the merge points will point us to the correct direction.

Do you think this is how it works ? any comment is appreciated.

EDIT: Can someone please give a description how it is done and what is the purpose of the handset ? Is it a reciever of just an antenna ?

Thanks.

• rule of thumb: in urban and indoor scenarios, localization usually cannot be done by signal strength. There's no way to know whether the line of sight is the strongest path, whether that exists at all, and how much weaker other paths are. All DF depends on TDOA and digital beamforming. – Marcus Müller Apr 20 '17 at 20:06
• So, I was wrong? Do you have another idea how this is done. see the link in the original post above. – ransh Apr 20 '17 at 20:11
• I don't know whether you were wrong. Just because someone sells a device, especially of moral ambiguity, doesn't mean it's a good device. "Locating via field strength and audio device" definitely sounds more like there's someone running around with an antenna, and generally, the closer you get into the general vicinity of a transmitter, the louder it beeps. There's absolutely no indication that the device wouldn't be led astray by other currently active devices in the same band. Might simply be snakeoil. – Marcus Müller Apr 20 '17 at 20:15
• I did find several such description of "direction finder" all of them seems to be described quite the same: base station which force the mobile to transmit, and an additional handset (not described what it is ) which helps to track direction to a mobile phone. It also use "audio" voice for the handset to help the searcher to estimate how close he it to target. I try to understand how it is done. Thanks. – ransh Apr 20 '17 at 20:23
• Read my answer. – Marcus Müller Apr 20 '17 at 20:32