NB-IoT cells decoder for SDR: what it is and how to receive it

NB-IoT cells: the public broadcast information of narrowband IoT carriers (receive only).

Group: Cellular & rail
Start frequency: 806 MHz
In the mode list: NB-IoT, band scan

What NB-IoT cells is

NB-IoT (narrowband IoT) cells are LTE carriers for IoT devices. OnAir lists the cells around you from what each one broadcasts in the clear, such as its physical cell id and operating mode.

Frequencies and settings

LTE narrowband IoT carriers (180 kHz: in-band, guard band or standalone), found on the 100 kHz raster of the LTE bands that carry NB-IoT (20, 8, 3, 1, 28, 5, 2, 4, 12, 13, 17, 18, 19, 25, 26, 66, 71, 85); 2 Msps, even an RTL-SDR; one second per block, band presets and scan.

Start frequency	806 MHz
Tuning range of the mode table	450 to 2200 MHz
Sample rate asked	2 Msps
Lowest working rate	1 Msps
Channel width	1.75 MHz

OnAir takes any frequency you type; the numbers above are the mode's starting point and the range its table describes. In the app the shortcut label is NB-IoT, band scan.

What OnAir shows

PCI (NPSS / NSSS), operating mode, NRS antenna ports and system frame number from the NPBCH (MIB-NB), and from SIB1-NB the operator (MCC / MNC), tracking area, cell identity (eNB and sector), band and barring; level, SNR, carrier and clock offset, a table of the cells with their signal level, results saved between runs. Receive only, public broadcast: paging, NPDCCH, data and device identities are never decoded. Receiving the broadcast channels of cellular networks is legal in many places but not everywhere, and decoding anything addressed to a phone or device is not allowed in most: check the rules where you live.

The mode's own tab has these views: Cells, Log. The other tabs (Overview, Receiver, Scan, History) are described on the main window page.

Limits and what it was checked with

Checked with generated signals and impairments; recordings of real signals welcome.

Which radio you need

This is a shortwave mode, so the radio has to tune HF. An SDRplay, Airspy HF+ or an RTL-SDR in direct-sampling mode do that directly; with a HackRF an HF upconverter or a direct-sampling receiver is the usual route. A long wire or loop antenna matters more than the radio.

Receiving and the law

Receiving and the law. OnAir only reads the public broadcast information of cells and base stations, and does not decrypt or follow any user traffic. Check the rules where you live. See also Legal.

Questions about NB-IoT cells

Can I decode NB-IoT cells with an RTL-SDR?

An RTL-SDR can receive HF only in direct-sampling mode, which OnAir offers in its radio settings; results depend on the antenna. SDRplay and Airspy HF+ radios are better suited.

Is it legal to receive NB-IoT cells?

OnAir only reads the public broadcast information of cells and base stations, and does not decrypt or follow any user traffic. Check the rules where you live.

Can I try NB-IoT cells in OnAir without a radio?

Yes. Most modes include a built-in synthetic test signal, so you can open the screen and try the controls before you own a radio.

Cell towers 5G NR cells GSM-R LBJ EBICab / Eurobalise (needs a user test)