- Coverage of Uall fourU frequency bands (850, 900, 1800, 1900)
- 4 wide-band receivers and 64 digital processing receivers
- Real-time handling of A5/1 and A5/2 encryption types
- Monitoring & mass recording of all traffic from U8-16 BTS cells
- Concurrent processing capacity of U256 duplexU voice channels
- Concurrent Ulive monitoringU of 40 duplex voice calls
- Built-in hard-disk (SSD) storage of 2 TB.
- Post processing utility with Ufull mission playbackU & data-mining
- Smart search engine utilizing SMS keywords, partial digits, etc.
- Automatic Mobile-phone ULocalizationU (AML)
- Very compact and low weight equipment (43x33x9cm, 8Kg
SYSTEM MAIN COMPONENTS
Digital Receiver Module (DRM)
Digital Receiver Module (DRM) includes 8 channelized digital receivers
Each of the receivers is directly controlled by the Management Server which tunes the receiver into the necessary frequency for Uprocessing of all channels (time-slots) included within each frequency.
The board is fed with wide-band input signal which is split between the receivers. Each receiver can follow all the traffic (data + voice) from any specific base-station transceiver (TRX), no matter how many frequencies are being used (in Frequency-Hopping mode) by this BTS.
So 1 x DRM module can fully intercept 4 duplex TRXs. All the traffic from the DRM is processed by the Signal Processing Board (SPB).
A typical PGMU-64WX configuration includes 8 x DRM boards (64 digital receivers), so it can fully coverall the traffic from 32 duplex TRXs.
A typical BTS has 2-4 TRXs, so PGMU-64WX can fully cover all the traffic emanating from 16 BTSs.
SIGNAL PROCESSING BOARD
The Signal Processing Board (SPB) has 2 essential responsibilities:
The SPB is fed by data from the DRM and it demodulates the signals from off-the-air raw data into GSM standard known commands.
Chains of FPGA and DSP processors embedded in the board enable this complicated operation. The decoded data is sent to the Management Server using LAN connection.
The SPB is also responsible for managing and controlling the DRMs. There is 1 SPB in a PGMU-64WX system configuration.
DECIPHER ACCELERATED PROCESSING BOARD (APB)
The PGMU includes an integrated, built-in, Uvery high-speed decipherU, comprised of ASIC based Accelerated
Processing Boards (APB), enabling an average of 0.25 seconds deciphering time for A5/1.
UThe APB is connected via Ethernet LAN, through a switch, to the decipher software in the Management Server
MANAGEMENT SERVER (MS)
The Management Server (MS) is located in the laptop.
MS is in charge of multiple tasks and communicates directly (or in-direct) with all of the components mentioned
- The GUI (Graphic User Interface) is a sub-server in MS.
- The interceptor which controls and manages the receivers is a sub-server in MS.
- SQL database sub-server is stored on the laptop.
- A5/1 and A5/2 decipher management (Queues, priorities, etc.)
There are no special storing performance requirements demanded from the laptop.
16GB RAM of memory and approximately 2TB of HD (SSD) storage are enough for 3-days intensive operation.
The system works under Windows 7 Operating System.B
The system is set to process random sessions and at the same time to match the retrieved information with pre-defined parameters configured by the system operator. These parameters are able to assist interception of specific known targets such as: TMSI, IMSI, IMEI, MSISDN, TMSI and IMSI.
Mostly, only one of these parameters is used by networks as the real mobile phone number is never transmitted over the air in GSM networks. Using a special
technique, the system discovers the identity that corresponds to the particular phone number.
Since TMSI is temporary and the network changes it from time to time, the system automatically follows all TMSI modifications and automatically updates them in the
Target List without intervention of the system operator.
Pre-defined configuration is able to assist us intercepting unknown targets as well by filtering specific SMS keywords, roaming subscribers or phone numbers. Obviously, “target” or “potential target” interception will be prioritized over random interception.
Additionally, within the target list, targets are prioritized and the system follows the operator’s default in case of several targets at the same time. However, UnoneU of the intercepted session is gone, random, potential target or target.
At the same time of live monitoring, the system records the entire intercepted data.
The operator can, at any time, stop the live monitoring and analyze (playback) off-line the gathered recordings session by session, filtered or entirely.
GUI MAIN SCREEN
The first display when starting the GUI application is found in the figure below.
The screen is divided for 3 main windows:
UOperation WindowU - This window details the information gathered from the network and includes the BTS Scanned list, total sessions detected and ongoing monitored sessions.
UAssignment WindowU - This window is in charge of data management and includes target and potential target lists and filters set and BTS allocation.
Intercepted SMS sessions are stored on a separate tab in this window.
UEvent Log windowU - This window displays the communication commands and alerts between the different servers, components and the monitored networks.
STEP BY STEP OPERATION BASICS
The system is now all connected and waiting for operation. Our first step is scanning
the environment for BTS.
The receivers are commanded and Scan BTS list is created.
1. Provider’s name.
2. Mobile Country Code.
3. Mobile Network Code.
4. Location Area Code.
5. Base Station unique ID.
6. Channel number.
7. Signal level.
8. Signal quality.
9. List of frequencies used for hopping.
10. Antenna number.
12. Selection checkbox.
Once scanning is completed, BTS must be allocated for operation according to intelligence demands and environment conditions.
Chosen BTS are referred to the BTS List.
1. Frequency band used.
2. Number of receivers allocated.
3. List of BTS used for handover with the specific BTS.
4. BTS priority – used for efficient resource allocation.
5. Duplex – enable/disable UPLINK signals.
6. Select – enable/disable the BTS for monitoring.
The targeted area of operation is now mapped. Our next step should be intercepting the target phone. For that, the target’s TMSI must be defined in the target list. Since the only available parameter is the target’s phone number, the Silent Call/SMS tool finds the correlation between the phone number and the its TMSI.
Live Monitoring / Recording
Now we know both the network environment and the target’s identity. The next step is to begin the process of monitoring. Target, Random or Reverse.
The Session Activities window displays the intercepted SMS/calls sessions. These sessions can be processed during Ulive monitoringU or by Uoffline playbackU. The entire sessions listed in the Session Activities window are recorded.
Colored sessions alert for operator’s interest. (Blue = random, Red = target, Yellow = potential target, Green = associated to target) Sessions are processed according to LIFO (Last In First Out). Sessions with interest are prioritized over random sessions during live monitoring.
1. Session number.
2. Transmission’s direction. (Incoming / Outgoing)
3. TMSI of the monitored subscriber.
4. IMSI of the monitored subscriber.
5. IMEI of the monitored subscriber.
6. Number calling the monitored subscriber.
7. Number dialed by the monitored subscriber.
8. Encryption type.
9. Ciphering key of the monitored subscriber.
10. Uplink interception.
11. Distance between the monitored subscriber and the BTS providing service to the subscriber.
13. Comment. (Session type, target identity)
- Target List: List of targets defined by the operator
- Potential Target List: List of targets defined by sessions intercepted according to POI List
- POI List: Set of rules for filtering incoming sessions defined by the operator
- SMS: Window to display intercepted SMS sessions details
Automatic Mobile-phone Localization (AML)
This feature will estimate the approximate geographical location of an MS during
voice conversation, with A typical accuracy (uncertainty circle) of 50 meters, pending
the following conditions:
- Minimum intercepted call length 30 sec (shorter period yield less accuracy)
- Minimum of 4 intercepted BTS in same cellular network as the target mobile phone.
- The geographical location of the BTS is known. The location results (as well as the BTSs location) for all targeted mobile phones are displayed on geographical map background.
A typical presentation of the localization result is shown below:
In addition the system displays a BTS map with all the scanned BTS enabling operational planning to achieve optimal coverage of the operational area.
The BTS are displayed in a map or in satellite picture by selection of the operator
- RECEPTION BANDS 850 900 1800 1900
- RECEPTION RANGE FOR FORWARD CHANNEL (MHZ) 869 to 894 925-960 1805-1880 1930-1990
- RECEPTION RANGE FOR REVERSE CHANNEL (MHZ) 824 to 849 880-915 1710-1785 1850-1910
- FREQUENCY CHANNEL SPACING 200KHz
- NO OF ANTENNA INPUTS 2 (ONE FOR DL AND ONE FOR UL RECEPTION)
- RECEIVER TYPE WIDE-BAND DIGITAL RECEIVER
- NO OF WIDE-BAND RECEIVERS 4
- NO OF CHANNELIZED DIGITAL RECEIVERS 64 (32 DUPLEX)
- SYSTEM SENSITIVITY -105 DBM @ 10-7 BER
- FREQUENCY STABILITY 5X10-9
- DYNAMICAL RANGE > 80 dB
- DOWNLINK (BTS) RECEPTION RANGE 10 - 20 KM
- UPLINK (MS) RECEPTION RANGE 500 - 1,000 meters
- FULLY INTERCEPTED BTS TRANSCEIVERS (TRX) 32
- CONCURRENTLY PROCESSED VOICE CHANNELS 512 (256 duplex)
- CONCURRENT LIVE MONITORING CALLS 40 Duplex
- SUPPORTED VOICE CODECS RPE/LTP: FR, EFR, HR, AMR-FR, AMR-HR
- MONITORED CHANNELS BCCH, CCCH, SACCH, SDCCH, FACCH, TCH
- AUTOMATIC LOCALIZATION ACCURACY 25-50 meters
- A5/2 DECIPHER PROCESSING TIME 0.05 sec
- A5/1 DECIPHER PROCESSING TIME 0.25 sec
- DIMENSION 19”, 2U (43x33x9cm)
- WEIGHT 8 Kg
- POWER SUPPLY 12VDC + 220VAC
- POWER CONSUMPTION 350W
- WORKING TEMPERATURE RANGE 0°c ...+50°c
The PGMU reception distance depends on several parameters, as following:
- The distance between the PGMU and the target mobile phone.
- The antenna type
- The specific terrain/ environment conditions, i.e. – urban/ rural area, etc.
- The distance between the target phone and the base-station.
Generally speaking, the system can easily intercept traffic from BTS to MS (Forward Channel/Downlink) at a
distance of 10 to 20 km. The signal from the Mobile Phone to the BTS (Reverse Channel/Uplink) is very low, so the effective reception range from the PGMU to the target hand-phone in order to receive the reverse (uplink) channel using omni-directional antenna is typically 500 meters (in urban line of sight area) or typically 1 km (in rural, line-of-sight area).
With compact directional U antenna (8 dbi gain) - the range can be increased to 1 kilometers (in Urban area) or 3 km in rural areas and for stationary high gain antennas (>20 dbi gain) the effective range for the reverse channel may be increased to as much as 15-20 km in rural line-of-sight area.
Call for quotes
You may return most new, unopened items within 15 days of delivery for a full refund. We'll also pay the return shipping costs if the return is a result of our error (you received an incorrect or defective item, etc.).
You should expect to receive your refund within four weeks of giving your package to the return shipper, however, in many cases you will receive a refund more quickly. This time period includes the transit time for us to receive your return from the shipper (5 to 10 business days), the time it takes us to process your return once we receive it (3 to 5 business days), and the time it takes your bank to process our refund request (5 to 10 business days).
If you need to return an item, simply login to your account, view the order using the 'Complete Orders' link under the My Account menu and click the Return Item(s) button. We'll notify you via e-mail of your refund once we've received and processed the returned item.
We can ship to virtually any address in the world. Note that there are restrictions on some products, and some products cannot be shipped to international destinations.
When you place an order, we will estimate shipping and delivery dates for you based on the availability of your items and the shipping options you choose. Depending on the shipping provider you choose, shipping date estimates may appear on the shipping quotes page.
Please also note that the shipping rates for many items we sell are weight-based. The weight of any such item can be found on its detail page. To reflect the policies of the shipping companies we use, all weights will be rounded up to the next full pound.