Home PageGsm locator

GSM locator

You ever thought about how the police are able to track criminals by their mobile phones as a GSM locator . (or your children or your dementing aunt)

You can have a GSM locator by using the information provided by the mobile phone network and linking that to the cell transmitting antenna location data. Doing this you are able to locate the desired object fairly precisely but of course not as accurately as a GPS. (somewhere in the region of 50 meters and not the 3 meters GPS is able to achieve) So lets see how this can be done.
First you need a GSM receiver linked to an arduino. There are many variants but i used the good old Telit GM862. You use a simple program to link it to the GSM network and monitor the signals. Using special AT+ commands you get the strength and cell_ID of the nearest transmitters and also the opertor and country. A CellID is the number given to a specific cell (the radio tower to which your handset is connected) . In most of the case, it’s the closest tower to your location. So by knowing this tower, you know where the user is. But a tower can cover a huge area: from a few hundred meters, in high density area, to several kilometers in lower density area. That’s why CellID accuracy is lower than GPS accuracy, but this present a very good alternative. Unfortunately its not quite so simple. The issue is that the location of cells is not a public information. Operators keep this private, for many reasons:
– They don’t want to give tower location to their competitors
– They use this as an extra revenue income, as they provide paying services to retrieve cell location.
That’s why there is a service called “OpenCellID”. OpenCellID.org is an open source database of CellID, serving two purposes:
– Everybody can create an application gathering information about cell locations, and send these information to the OpenCellID server, improving the coverage
– The database can be used by other applications to get the location of a cell, according to his cell id.
Basically it means you can use this info to create a GSM locator. So where can you find the location of the antennas. There are two sites worth mentioning although the second one seems to be going under.

Currently, lat and lon are simply computed as the average of all measures but this may change in the future for a better computation if signal is null, this mean that this info was not available when measure has been done. Opencellid has an API to which you can request location to create your GSM locator.

GSM locator network


There is an API which takes care of the difficult stuff. All you need to do is provide at least mcc, mnc (mobile country code, and mobile network code of the operator), and cell id. Lac (location area code) is an optional parameter, and will help to find an alternate position if cell is not found.

mcc: mobile country code (decimal)
mnc: mobile network code (decimal)
lac: locale area code (decimal)
cellid: value of the cell id
lac can be ommitted. If cellid is not present or if cellid i unkown, a defaut return will be based on lac information, but with a much lower accuracy. In that case, cellid return will be -1.
The postion will be returned in xml format by default in the following form

<cell lat=”57.8240013122559″ lac=”0″ lon=”28.00119972229″ mcc=”250″ nbsamples=”38″ range=”0″ cellid=”29513″ mnc=”99″>

You can also get all the cell numbers in a certain area. This is done dy defining a bounding box BBOX.
This would give all the cells in an area 4-5 deg E and 50-52 deg North.
BBOX: the bounding box from where you want to get the measures
Optionnal parameters:
limit: a number defining the size of the returned list. Default is 200. Be careful, putting a too big number could generate an error
mcc:If you want to retrict the result to a specific country
mnc:If you want to restrict the result to a specific operator
fmt:you can specifiy Kml, Xml or TXT as output. Default is Kml. Txt is CSV type of output, with a first line defining the content of the list
You can specify country or operator. To do this just add &limit=800 for example. The following is the return.
<cell lat=”50.4746053014035″ mcc=”206″ lon=”4.31603674298246″ nbSamples=”19″ cellId=”27154″ mnc=”1″ lac=”2108″/>
This is one row of the output in this case for cell ID 27154 mcc=206 and mnc=1. Checking that this is the API result we put this into the other API.
<cell lat=”50.4746053014035″ mcc=”206″ lon=”4.31603674298246″ cellId=”27154″ nbSamples=”19″ mnc=”1″ lac=”2108″ range=”6000″/>
The correct outcome results.

All MNC and MCC codes for many countries.

Link to part II

Leave a Reply