lte_cell_monitor.sh

#!/usr/bin/env bash
# ─────────────────────────────────────────────────────────────────
# LTE Cell Monitor — passive rogue-cell observation loop
#
# Repeatedly scans a configured LTE band with srsRAN's cell_search and
# watches for a "watch" PCI (a cell you suspect is rogue) appearing
# alongside your known-good baseline PCI. Every scan is logged to JSONL;
# state changes (appeared / disappeared) are recorded as evidence, and
# raw IQ is captured periodically while the watched cell is present.
#
# Mode: OBSERVE ONLY. This script never transmits. It only reads the RF
# environment and records what it sees.
#
# Requirements: srsRAN cell_search (or compatible) on PATH, HackRF tools
# (hackrf_transfer) for IQ capture, a HackRF or other supported SDR.
#
# Configure via environment variables or a sourced config file:
#   OUTDIR        output directory             (default ./imsi-monitor-data)
#   CELL_SEARCH   path to cell_search binary   (default: cell_search on PATH)
#   SDR_ARGS      SoapySDR/driver args         (default driver=hackrf)
#   GAIN          RX gain                      (default 70)
#   BAND          LTE band number              (default 1)
#   EARFCN_START  scan range start             (default 346)
#   EARFCN_END    scan range end               (default 358)
#   NOF_SAMPLES   samples per cell_search      (default 300)
#   WATCH_PCI     suspicious PCI to flag       (default 0)
#   BASELINE_PCI  known-good PCI to compare    (optional)
#   INTERVAL      seconds between scans        (default 60)
#   IQ_FREQ_HZ    IQ capture centre freq (Hz)  (optional; enables IQ capture)
#   IQ_RATE_HZ    IQ capture sample rate (Hz)  (default 10000000)
#   IQ_SECONDS    IQ capture duration (s)      (default 5)
#   IQ_EVERY      capture IQ every N scans     (default 10)
#   USE_SUDO      run cell_search/capture via sudo (default 1)
# ─────────────────────────────────────────────────────────────────
set -u

# Optional config file (first arg, or ./monitor.conf if present)
CONF="${1:-monitor.conf}"
[ -f "$CONF" ] && . "$CONF"

OUTDIR="${OUTDIR:-./imsi-monitor-data}"
CELL_SEARCH="${CELL_SEARCH:-cell_search}"
SDR_ARGS="${SDR_ARGS:-driver=hackrf}"
GAIN="${GAIN:-70}"
BAND="${BAND:-1}"
EARFCN_START="${EARFCN_START:-346}"
EARFCN_END="${EARFCN_END:-358}"
NOF_SAMPLES="${NOF_SAMPLES:-300}"
WATCH_PCI="${WATCH_PCI:-0}"
BASELINE_PCI="${BASELINE_PCI:-}"
INTERVAL="${INTERVAL:-60}"
IQ_FREQ_HZ="${IQ_FREQ_HZ:-}"
IQ_RATE_HZ="${IQ_RATE_HZ:-10000000}"
IQ_SECONDS="${IQ_SECONDS:-5}"
IQ_EVERY="${IQ_EVERY:-10}"
USE_SUDO="${USE_SUDO:-1}"

SUDO=""
[ "$USE_SUDO" = "1" ] && SUDO="sudo"

LOGDIR="$OUTDIR"
IQDIR="$OUTDIR/iq-evidence"
TRACK_LOG="$LOGDIR/tracking.jsonl"
ALERT_LOG="$LOGDIR/alerts.log"
EVIDENCE_LOG="$LOGDIR/evidence.log"
SESSION_LOG="$LOGDIR/session_$(date +%Y%m%d_%H%M%S).log"

mkdir -p "$LOGDIR" "$IQDIR"

TS() { date +"%Y-%m-%d %H:%M:%S"; }
log() { echo "[$(TS)] $1" | tee -a "$SESSION_LOG" "$ALERT_LOG"; }

command -v "$CELL_SEARCH" >/dev/null 2>&1 || {
    echo "ERROR: cell_search not found ('$CELL_SEARCH'). Install srsRAN or set CELL_SEARCH." >&2
    exit 1
}

cleanup() { log "Session stopped."; kill 0 2>/dev/null; }
trap cleanup INT TERM

log "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
log "  PASSIVE OBSERVATION SESSION STARTED"
log "  Band=$BAND EARFCN=$EARFCN_START..$EARFCN_END  watch PCI=$WATCH_PCI${BASELINE_PCI:+ baseline PCI=$BASELINE_PCI}"
log "  Mode: OBSERVE ONLY — evidence accumulation"
log "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

SCAN_NUM=0
PREV_WATCH=0
WATCH_START=""
WATCH_SESSION=0
LAST_IQ_SCAN=0

while true; do
    SCAN_NUM=$((SCAN_NUM + 1))
    TS_NOW=$(TS)
    EPOCH=$(date +%s)

    RAW=$($SUDO "$CELL_SEARCH" -a "$SDR_ARGS" -g "$GAIN" -b "$BAND" \
          -s "$EARFCN_START" -e "$EARFCN_END" -n "$NOF_SAMPLES" 2>&1)

    WATCH_PRESENT=0
    WATCH_POWER=""; WATCH_PRB=""; WATCH_EARFCN=""; WATCH_PORTS=""
    BASE_POWER=""; BASE_EARFCN=""
    CELL_COUNT=0

    while IFS= read -r line; do
        FREQ=$(echo "$line"   | grep -o '[0-9]*\.[0-9]* MHz' | head -1)
        EARFCN=$(echo "$line" | grep -o 'EARFCN=[0-9]*'      | cut -d= -f2)
        PCI=$(echo "$line"    | grep -o 'PHYID=[0-9]*'       | cut -d= -f2)
        PRB=$(echo "$line"    | grep -o '[0-9]* PRB'         | head -1 | awk '{print $1}')
        PORTS=$(echo "$line"  | grep -o '[0-9]* ports'       | head -1 | awk '{print $1}')
        PWR=$(echo "$line"    | grep -o 'PSS power=[-0-9.]*' | cut -d= -f2)

        [ -z "$PCI" ] && continue
        CELL_COUNT=$((CELL_COUNT + 1))

        printf '{"ts":"%s","epoch":%s,"scan":%d,"earfcn":"%s","freq":"%s","pci":%s,"prb":%s,"ports":%s,"pss_dbm":%s}\n' \
          "$TS_NOW" "$EPOCH" "$SCAN_NUM" \
          "${EARFCN:-null}" "${FREQ:-null}" \
          "${PCI:-null}" "${PRB:-null}" "${PORTS:-null}" "${PWR:-null}" \
          >> "$TRACK_LOG"

        if [ "$PCI" = "$WATCH_PCI" ]; then
            WATCH_PRESENT=1; WATCH_POWER="$PWR"; WATCH_PRB="$PRB"
            WATCH_EARFCN="$EARFCN"; WATCH_PORTS="$PORTS"
        elif [ -n "$BASELINE_PCI" ] && [ "$PCI" = "$BASELINE_PCI" ]; then
            BASE_POWER="$PWR"; BASE_EARFCN="$EARFCN"
        fi
    done < <(echo "$RAW" | grep "^Found CELL")

    if [ "$WATCH_PRESENT" = "1" ]; then
        WATCH_SESSION=$((WATCH_SESSION + 1))
        [ -z "$WATCH_START" ] && WATCH_START="$TS_NOW"
        log "Scan #$(printf '%03d' $SCAN_NUM) | [!] PCI=$WATCH_PCI EARFCN=${WATCH_EARFCN} ${WATCH_POWER} dBm PRB=${WATCH_PRB} ports=${WATCH_PORTS}${BASELINE_PCI:+ | PCI=$BASELINE_PCI ${BASE_POWER:-N/A} dBm EARFCN=${BASE_EARFCN}}"
    elif [ "$CELL_COUNT" -gt 0 ]; then
        log "Scan #$(printf '%03d' $SCAN_NUM) | [ ] PCI=$WATCH_PCI absent${BASELINE_PCI:+ | PCI=$BASELINE_PCI ${BASE_POWER:-N/A} dBm EARFCN=${BASE_EARFCN}}"
    else
        log "Scan #$(printf '%03d' $SCAN_NUM) | [.] No cells detected"
    fi

    if [ "$WATCH_PRESENT" = "1" ] && [ "$PREV_WATCH" = "0" ]; then
        log "  ^ OBSERVATION: PCI=$WATCH_PCI appeared — epoch $EPOCH"
        echo "{\"event\":\"appeared\",\"ts\":\"$TS_NOW\",\"epoch\":$EPOCH,\"scan\":$SCAN_NUM,\"pci\":$WATCH_PCI,\"power\":\"$WATCH_POWER\",\"prb\":\"$WATCH_PRB\",\"earfcn\":\"$WATCH_EARFCN\"}" >> "$EVIDENCE_LOG"
    fi
    if [ "$WATCH_PRESENT" = "0" ] && [ "$PREV_WATCH" = "1" ]; then
        log "  v OBSERVATION: PCI=$WATCH_PCI ceased — active ${WATCH_SESSION} scans (~$((WATCH_SESSION * INTERVAL))s)"
        echo "{\"event\":\"disappeared\",\"ts\":\"$TS_NOW\",\"epoch\":$EPOCH,\"scan\":$SCAN_NUM,\"pci\":$WATCH_PCI,\"active_scans\":$WATCH_SESSION,\"started\":\"$WATCH_START\"}" >> "$EVIDENCE_LOG"
        WATCH_SESSION=0; WATCH_START=""
    fi

    # Periodic IQ capture while the watched cell is present (needs IQ_FREQ_HZ)
    if [ -n "$IQ_FREQ_HZ" ] && [ "$WATCH_PRESENT" = "1" ] && \
       [ $((SCAN_NUM - LAST_IQ_SCAN)) -ge "$IQ_EVERY" ]; then
        IQ_FILE="$IQDIR/cell${WATCH_PCI}_earfcn${WATCH_EARFCN}_scan${SCAN_NUM}_$(date +%H%M%S).iq"
        NSAMP=$((IQ_RATE_HZ * IQ_SECONDS))
        log "  IQ capture: $IQ_FILE (${IQ_SECONDS}s)"
        $SUDO hackrf_transfer -r "$IQ_FILE" \
          -f "$IQ_FREQ_HZ" -s "$IQ_RATE_HZ" -l 32 -g 40 -a 1 \
          -n "$NSAMP" >/dev/null 2>&1 &
        LAST_IQ_SCAN=$SCAN_NUM
    fi

    PREV_WATCH="$WATCH_PRESENT"
    sleep "$INTERVAL"
done