Too bad the hardware for this is eyewateringly expensive :'(
replies(6):
Can someone outline the architectural limitations of using a smartphone modem for such network debugging/sniffing tasks?
They could perhaps be modified to do that but the baseband firmware is usually very closed source.
There is only one example I know, there was one particular dumbphone from the 2G era for which the baseband sourcecode was available due to a hack. You could use several (one for uplink and one for downlink) of these with modified firmware to sniff 2G traffic. I forget which model it was exactly but obviously the price ballooned on eBay :)
Haven't heard of this happening with later models. Baseband sourcecode firmware is really rare.
You can ask the processor to send higher layer information via diag, including the messages the base stations send. There’s also commands to lock on to a specific base station so you’re not constantly moving from cell to cell.
There’s plenty of commercial devices that use this functionality to provide network monitoring and management capabilities for mobile network operators checking out base station functionality in the field. TEMS comes to mind for that but they’re certainly not the only ones.
It’s a deep rabbit hole :-)
It does, however, more than just "listing cells" though. You can sniff all the comms, but only between your device and the base station. It won't listen to anything else, you need SDRs for that.