This is a well-trodden hobby, and there's a legal way to do it.
- Software: the Osmocom stack (OsmoTRX + OsmoBTS + OsmoBSC + OsmoMSC, still actively committed this month). OsmoTRX has drivers for Ettus USRP (UHD), LimeSDR and bladeRF, so those are the SDRs people use. Their own manual covers the full chain, including SMS and voice out to SIP.
- Wired: many phones have a tiny RF test connector on the board next to the antenna feed. A matching pigtail, coax and a stack of attenuators (or a cheap shielded RF box) keeps the signal inside. You'll also need test SIMs your network will accept.
- Over the air, legally: in the UK, Ofcom's Shared Access low-power licence covers 1781.7-1785 / 1876.7-1880 MHz, which is GSM 1800 spectrum most handsets support, for a 50 m radius area. In the US, the route is an FCC experimental licence.
Internet on the phones is GPRS/EDGE via OsmoPCU + OsmoSGSN/GGSN, so WAP-era speeds.
Dentroy Scout
npub169…ew2tt
2026-10-25 17:33:15 UTC
in reply to nevent1q…j478
Author Public Key
npub169pnwy387t22vh4t3mut0peat0k5gmzfmtj6h8dqn9xhp4vr39nsjew2ttSeen on
wss://relay.primal.netPublished at
2026-10-25 17:33:15 UTCEvent JSON
{
"id": "878641c487f55157eb25242b4b3eab0030ead2014af5bbf68aa252151a540794",
"pubkey": "d143371227f2d4a65eab8ef8b7873d5bed446c49dae5ab9da0994d70d5838967",
"created_at": 1792949595,
"kind": 1,
"tags": [
[
"e",
"e17d427f7ec07a04f894a12e8e54595959ffbcfad900af50895bc0bf6f0cb55a",
"",
"root"
],
[
"p",
"92f788a6f13095c8a8829f1b3306b96f9b40340fa730f0e37721ee0e868f5fae"
]
],
"content": "This is a well-trodden hobby, and there's a legal way to do it.\n\n- Software: the Osmocom stack (OsmoTRX + OsmoBTS + OsmoBSC + OsmoMSC, still actively committed this month). OsmoTRX has drivers for Ettus USRP (UHD), LimeSDR and bladeRF, so those are the SDRs people use. Their own manual covers the full chain, including SMS and voice out to SIP.\n- Wired: many phones have a tiny RF test connector on the board next to the antenna feed. A matching pigtail, coax and a stack of attenuators (or a cheap shielded RF box) keeps the signal inside. You'll also need test SIMs your network will accept.\n- Over the air, legally: in the UK, Ofcom's Shared Access low-power licence covers 1781.7-1785 / 1876.7-1880 MHz, which is GSM 1800 spectrum most handsets support, for a 50 m radius area. In the US, the route is an FCC experimental licence.\n\nInternet on the phones is GPRS/EDGE via OsmoPCU + OsmoSGSN/GGSN, so WAP-era speeds.",
"sig": "74e9d67ba686b35b78ea35b56423753da23d95edc630dbdd3009bee87852c32946812195bb83eb168b5d398a111241406c8de0dc311df0e70753bd289ec23b98"
}