Perhaps some of you still remember the days when GSM base stations were spaced far apart and it was fun to search for them by using the timing advance information shown in the hidden monitoring tool of your GSM phone? Well, perhaps not but this method came in handy again when two people asked me within a few days of each other how they could locate the base station from which their hybrid DSL/LTE home gateway was served so they could perhaps improve their data rate by re-locating their LTE modem.
While there is no ‘timing advance’ parameter in UMTS it has resurfaced again in LTE. Unfortunately it is part of the network’s response to the Random Access request and so far down in the protocol stack that most tools don’t display the value. These days, however, GSM, UMTS and LTE signals are usually broadcast from the same base station site so why not use the GSM timing advance, that many smartphones even today show in their hidden monitoring tool to find out how far the combined GSM/LTE base station is away? (Note: A Google search will help to find out if a particular smartphone has a hidden tool where the GSM timing advance and other radio parameters are shown)
The GSM timing advance is a rough estimate of the distance to the base station tower and increments by 550m. A value of 3 for example means that the base station is between 3 and 4 times 550m away, i.e. between 1.6 and 2.2km. Obviously that only gives a radius but no direction. To get a rough direction one can then walk around an obstacle such as a house and observe the transmit power level and cell id which is usually also shown on the monitor screen. Another option to get the direction is to consult the public coverage map of the network operator. I know at least one that gives the direction of the base station serving a given address (but does not show the location of the base station itself). Together with the timing advance one has all that is required to find the base station location without even having to walk around the house.
Here’s a practical example: When I was recently on vacation the network operator’s web site told me that the base station is at 126 degrees from my current location. The timing advance on my mobile was 3, i.e. the distance was 1.6 to 2.2 km. I then used the ruler in the Viking open source mapping tool to pinpoint the location on a map. The result is shown in the screenshot on the left. A look out of the window confirmed the calculations. As can be seen in the two pictures on the left the base station was right were it was supposed to be.