Mobile phone monitoring and positioning system

card product

» Products » Mobile phone monitoring and positioning system » GSM PASSIVE INTERCEPTION SYSTEM

1. Introduction


GSM networks are the most popular and wide spread wireless communication media in the world, especially are widely used in Europe and Asia-Pacific. So interception of communications is an important means to obtain intelligence information. The analysis and monitoring of GSM networks requires portable and reliable solutions.



Figure 1 1  GSM Network Structure



2. System Overview


The device is a multi-band fully passive GSM interception system. It is designed to record the entire traffic occurring between Base Transmitting Stations (BTS) and Mobile Stations (MS) located within the system’s operational range. This means tens or even hundreds of simultaneous calls. The device allows user to scan, analyze, intercept, monitor or record short messages and phone calls from GSM mobiles, regardless of whether they are encrypted by A5/1 or A5/2 algorithm or not.




Figure 2.1  Passive GSM Interception





Figure 2.2 Passive GSM Interceptor Solution



The device supports all GSM networks, including GSM 900Hz/1800Hz GSM850Hz/1900Hz , EGSM and DSC. It is widely used in national departments and agencies such as Police, Public Safety, Procuratorates, Intelligence, etc., which playing a significant role in safeguarding national security and maintaining stability.




2.1 Major Functions


  • The system works in a fully passive mode and the major functions are as follows:


2.1.1 Cell parameter measurement


  • The device can automatically detect broadcast information, including frequency number, cell ID/ ID, national / regional network, service carrier set etc.


2.1.2 GSM mobile phone information collection


  • It can collect different parameters of targets such as (IMSI, IMEI, TMSI, etc.) in the coverage area of the device, then send them to the back-end, and import into the database.
  • When the target IMSI/IMEI in the coverage area is detected, alarm will be generated.
  • Automatically store BTS information during the operation for quicker scan.


2.1.3 Core Functions


  • Wide monitoring:Randomly monitor voice and SMS of multi-targets of different operators and cells, display caller / called phone number or IMSI/TMSI/IDSDN number.
  • Specific target monitoring:According to the parameters of targets, such as TMSI, MSISDN,IMSI, the device is able to simultaneously identify targets, and intercept voice calls and short messages of multi-targets of different operators and cells.
  • If the target is in idle condition, system can still mark the specific target in the coverage.
  • Enable HR,FR,EFR,AMR-FR, AMR-HR.
  • Blacklist: after input the number, the system will highlight its audio and SMS for alert.
  • Classification: The operators can classify targets as level (High/Medium/Low), the related information will stored according the level.
  • The decryption unit can operate automatically without manual order. Mysql database is available, the information captured can be stored in Mysql.
  • The system can output, delete, and query audio and message information. The audio will be stored as .wav, messages will be stored as .csv.
  • Enable frequency hopping function to prevent any loss or cutoff of captured data.
  • Advanced search function base on MSISDN,IMSI,TMSI, time and content. The system will highlight the SMS which contain key words
  • The device connects with PC via 100Mbps Ethernet interfaces.
  • The target can be set with TMSI、IMSI、etc. And Captured information is stored on the PC Database (DB) for inquiry anytime, and also the system is able to playback all of the intercepted calls and short messages, to display all call related information.
  • GIS function is available. The system can display BTS location and diameter.
  • Enable channel format SDCCH / 8 and SDCCH / 4 Signal
  • Multiple receiving device can apply VPN network through LAN/WIFI/3G/4G and deciphering by the same device.



2.2 Advantages & Features


  • Passive GSM interception system provides solutions for information interception in GSM network. And it has the following advantages and features:


2.2.1 Fully Passive and undetectable


  • The system does not emit any signals.
  • Do not interfere with GSM networks and mobile phones.
  • The system’s operation is completely undetectable, so it can be used in sensitive places and for sensitive purposes, such as border monitoring, embassy monitoring, and prison control, etc.
2.2.2 Large Area Coverage


  • The downlink and uplink signal receiver sensitivity is up to -110 dBm
  • For downlink channel, the system can cover the large area covered by BTS.
  • For uplink channel, the cover area is from 500 meters to 2 kilometers.


2.2.3 Advanced A5/1&A5/2 decryption algorithm


  • Real-time decryption, A5/1 decryption time: <0.55s,
  • High A5/1&A5/2 decryption successive ratio: nearly 100% @ BER=0


2.2.4 Multiple channel voice monitoring and recording


  • The system can search 548 cells, monitors 32 cells simultaneously and selects 128channels for random monitoring.
  • Monitoring channels can be customized according to different requirements, and support monitoring 20 targets at most.
  • Captured information is stored on the operation terminal Database (DB) for inquiry at random , and also the system is able to playback all the intercepted calls and short messages online of offline. Multiple inquiry conditions are available, such as time interval, monitoring flag, subscriber identity and call duration, etc.




Figure 2.5 Monitoring Cells and Channels




Figure 2.6 Information Inquiry



2.2.5 Flexible configuration the number of monitoring cells and channels


  • Automatic and manual mounted mode for frequency point scan.
  • In manual mounted mode, the system scans the surrounding cells, and the user selects the cells to be monitored.
  • In manual mounted mode, the system scans the channels, and the user selects the channels to be monitored.
  • The device can be cascaded and extended monitoring capability


2.2.6 Extended range of reconnaissance


  • Uplink coverage is not less than 1000M.
  • Downlink coverage is not less than 500M.
  • Coverage is related to antenna selection and erection height.


2.2.7 Compact Size and Low Power Consumption


  • The system has a compact design, which can be installed in different ways easily such as vehicle-mounted, fixed, or portable, and deployed rapidly.
  • Low power consumption: 110w,
  • Power supply: AC 220V for fixed scenarios, and DC 12V for vehicle-mounted, or portable scenarios.
  • All the function integrated in one cabinet which dimension is 430mm * 480mm * 100mm


2.2.8 Friendly UI


  • The Friendly UI makes the system easy to learn and easy to operate.
  • Enable safety User-login system.
  • Connect to PC through 100Mbs Ethernet.





Figure 2.7 Friendly UI



3. Product Introduction


3.1  System Unit


  • The Passive system is composed of monitoring unit, deciphering unit, antenna, operation and maintenance unit (laptop), power supply.


3.1.1 Monitoring unit


  • Random or target intercept voice and SMS in the air interface, connects with A51 decryption unit for cracking encrypted information.
  • Call related information collection.


3.1.2 Deciphering unit


  • Connects to monitoring unit for cracking encrypted packages with fast speed and high accuracy.


3.1.3 Operation and Maintenance unit


  • Operation and management software is installed in a laptop.
  • Set operation parameters.
  • Save and analysis information collected by monitoring unit.


3.1.4 Antennas unit


  • Receive signals between mobile phone and BTS.


3.1.5 Technical Specifications


Table 3.1 Technical Specification(MC-G64Z/MC-G128Z)



Equipment Dimension(W×D×H)(mm)

430mm * 480mm * 100mm

Working Frequency

900/1800MHz, 850/1900MHz

Operation coverage


Direction finding coverage

from 0 to 1000 meters

Frequency Bands


Processing Speed


Monitoring number of cells

32 cells simultaneously

Monitoring number of channels

128 channels simultaneously

Capability of Voice Control


Number of Specific Target Control (Black list)


Static receiver sensitivity

-110 dBm, single antenna receiving

A51/A52 Deciphering Delay


A51/A52 Deciphering Rate


Specific Target Capturing Rate


Deciphering Rate

≈100%(up to signal quality)

Power supply mode, and allowed voltage fluctuation range

DC power adaptor supply: 12V

Typical power consumption


Foreground and background interfaces

Ethernet interface



10/100 BASE-T

Antenna interface





Ambient temperature

-20°C ― 50°C

Relative humidity

< 90%


≥ 2,000 hours


< 0.5 hour



4. Hardware Composition


Table 4.1 Hardware list





Directional antenna




–  Bandwidth standing wave ratio:≤1.5
–  Impedance:50Ω
– Gain:14dBi
– Size:75cm




Omni-directional antenna




– Bandwidth standing wave ratio:≤2.5@ 880-960MHz,

– Impedance:50Ω
– Gain:
2dBi @ 790-960MHz




GSM Interception Device



small switch



power module



Control Platform

i5-7200U 3.1 Ghz
– 14“FHD IPS(1920 x 1080)
– 4GB的DDR4
– 1 TB HD 5400RPM
– RJ 45

– Windows 10 Pro 64





5. Appendix: Acronyms


Table 5.1 Acronyms



Full Spelling


 Global System for Mobile Communication


 Code Division Multiple Access


 Wideband Code Division Multiple Access


 International Mobile Subscriber Identity


 International Mobile Equipment Identity


 Location Area Code


 Low Noise Amplifier


 Received Signal Strength Indication


 Encryption algorithm A5/1


 Encryption algorithm A5/2


 Mobile Station Integrated Services Digital Number


 Temporary Mobile Subscriber Identity


 Wireless Fidelity

Other products from the category:
Write the E-Mail, we will contact you within days.

Write the E-Mail, we will contact you within days.