OnAirCellular & rail · Experimental
Decode 5G NR cells with an SDR
OnAir receives 5G NR cells. 5G NR cells around you from their SS/PBCH blocks on the sync raster (GSCN) of n1, n3, n7, n8, n20, n28, n38, n40, n41, n77, n78: PCI, SSB index / beam, SS-RSRP / RSRQ / SINR, MIB (SFN, subcarrier spacing, k_SSB, CORESET#0, barred) (receive only, public broadcast).
What 5G NR cells is
5G NR cells broadcast synchronisation and master information blocks (SS/PBCH) that identify the cell. OnAir reads that public broadcast only.
Frequencies and where it is used
NR SS/PBCH blocks on the sync raster (GSCN) of n1, n3, n7, n8, n20, n28, n38, n40, n41, n77 and n78, 15 / 30 kHz SSBs, from 3.84 / 7.68 Msps (20 Msps searches several raster points per step).
In OnAir the tuning shortcut is 5G NR, GSCN scan; you can enter any frequency your radio reaches.
What OnAir shows for 5G NR cells
PCI (PSS / SSS), SSB index and the beams heard, SS-RSRP / RSRQ / SINR, carrier offset, and the MIB from the polar-coded PBCH: SFN, common subcarrier spacing, k_SSB, DMRS type A position, CORESET#0 and search space 0 of SIB1, barred, intra-frequency reselection. Receive only, public broadcast; SIB1 (operator, TAC, cell id) is not decoded yet, so the tower map stays empty.
This receiver is built from the published specification and checked end to end on simulated signals. It has had little or no testing on real transmissions yet, so reports and recordings on Discord are welcome.
Which radio you need
This is a shortwave mode, so the radio has to tune HF. An SDRplay, Airspy HF+ or an RTL-SDR in direct-sampling mode do that directly; with a HackRF an HF upconverter or a direct-sampling receiver is the usual route. A long wire or loop antenna matters more than the radio.
Questions about 5G NR cells
Can I decode 5G NR cells with an RTL-SDR?
An RTL-SDR can receive HF only in direct-sampling mode, which OnAir offers in its radio settings; results depend on the antenna. SDRplay and Airspy HF+ radios are better suited.
Is it legal to receive 5G NR cells?
OnAir only reads the public broadcast information of cells and base stations, and does not decrypt or follow any user traffic. Check the rules where you live.
Can I try 5G NR cells in OnAir without a radio?
Yes. Most modes include a built-in synthetic test signal, so you can open the screen and try the controls before you own a radio.
Try it without a radio
OnAir includes built-in synthetic test signals for most modes, so you can open this screen, see the layout and try the controls before you own a radio. The Tour button walks you through the app.