1.1 About this Volume

This is the first of a ten-volume deep dive on Rayhunter — the Electronic Frontier Foundation’s open-source firmware that turns a cheap Qualcomm-modem mobile hotspot into a passive detector for cell-site simulators, the devices commonly called IMSI catchers or Stingrays. The reader is assumed to be an engineer comfortable with wireless concepts and embedded toolchains; this is a reference for the person deciding whether to acquire a unit, how to reason about what it can and cannot prove, and how it fits a counter-surveillance posture — not a getting-started card.

Rayhunter is maintained by the EFF, it is released under a free-software license (GPL family), and its source lives at github.com/EFForg/rayhunter with documentation at efforg.github.io/rayhunter. The codebase is mostly Rust. The idea is deliberately narrow: run on hardware the user already carries or can buy for about the price of a restaurant meal, and watch — passively — the cellular control plane that the hotspot is already participating in, looking for the handful of behaviors that distinguish a fake base station from an honest one.

The volume lays out the threat in a single page, states precisely what Rayhunter is and is not, establishes the defensive-only posture that governs every other volume in the series, and gives a decision tree that routes a prospective user to Rayhunter or to one of its neighbors (SnoopSnitch, Crocodile Hunter, or a software-defined-radio survey tool). It closes with the honesty ledger — the short list of things Rayhunter sounds like but is not — because internalizing that list before acquiring a unit prevents the single most common disappointment: expecting proof from a tool that is built to produce signals.

Scope note. Nothing in this series is owned hardware; Rayhunter is tracked here as an aspirational tool. Every capability and quirk below is drawn from the EFF’s public repository and documentation as of 2026-10-17, and version-specific behavior is dated where it matters. Rayhunter’s behavior around alerts, default-on heuristics, and the display line has changed across releases (notably at v0.3.3 and v0.4.0), so prefer the live docs over any secondary article where the two disagree.

1.2 The one-page threat: what an IMSI catcher does, and why a hotspot can see it

A cell-site simulator (CSS) is a device that impersonates a legitimate cellular base station. A phone or modem has no first-class way to authenticate the network in the older air interfaces: in 2G the network never proves its identity to the handset at all, and even in LTE the earliest moments of attachment — before mutual authentication completes — leak information. A CSS exploits exactly that asymmetry. It advertises itself as the most attractive cell in the area, the handset camps onto it, and from there the operator of the CSS can do some combination of: harvest the permanent subscriber identity (IMSI) and the hardware identity (IMEI); force the handset down onto 2G where traffic is weakly protected or not protected at all; command a null cipher so that nothing is encrypted; and in some configurations act as a man in the middle between the handset and the real network.

The reason a passive detector can exist at all is that these behaviors leave fingerprints in the control-plane signaling that any participating device can observe. A modem that attaches to a tower sees the identity requests, the cipher-mode commands, the system-information broadcasts that set cell-reselection priorities, and the connection-release messages that redirect it to another radio access technology. Rayhunter does not transmit anything special to provoke a CSS; it reads the diagnostic stream the modem already produces as it goes about normal attachment, and it looks for the patterns that an honest network almost never produces.

     A HANDSET'S VIEW OF AN HONEST NETWORK vs A CELL-SITE SIMULATOR

   Honest tower                          Cell-site simulator (CSS)
   ────────────                          ─────────────────────────
   broadcasts SIBs, normal priorities    unusually attractive cell; may
   mutual auth completes (LTE)           request IMSI/IMEI *before* auth
   cipher negotiated (not EEA0)          may command null cipher (EEA0)
   stays on LTE/5G                        may release + redirect → 2G
         │                                       │
         ▼                                       ▼
   modem's DIAG stream looks ordinary     modem's DIAG stream shows the
                                          tell-tale sequence Rayhunter flags

The crucial engineering truth, and the one the rest of this series keeps returning to: what is observable from the handset side is a subset of what a CSS might do. A detector can see an identity request that arrives too early, a redirect to 2G, a null-cipher command, a system-information block that is missing the fields an honest cell would carry. It cannot see what a CSS decides to do once a handset is captured, it cannot read the attacker’s intent, and it cannot in general distinguish a genuinely misconfigured legitimate tower from a deliberately hostile one on a single observation. Volume 2 develops this boundary properly; it is the foundation of why Rayhunter’s output is a warning, not a verdict.

1.3 What Rayhunter is — and the three words that matter most

Rayhunter is a small on-device daemon plus a web interface. It is installed onto a supported hotspot, where it sits in the background, continuously records the modem’s diagnostic (DIAG) stream to the device’s storage, and runs a set of heuristic analyzers over that stream. When an analyzer matches a suspicious pattern, Rayhunter raises an alert: the colored line across the top of the device’s little screen changes state, and the event is visible in the web UI where the user can review and export the capture.

Three words govern everything else in this series, and they are worth stating before any capability list:

Detection, not prevention. Signal, not proof.

Rayhunter detects; it does not prevent. It cannot stop a handset from camping onto a hostile cell, cannot block an identity request, and cannot keep a device on LTE when a tower commands a downgrade. It tells the user, after the fact or in near-real-time, that something worth investigating happened. And its alerts are signals, not proof: a yellow, orange, or red line means “the control plane here did something an honest network rarely does,” not “you are being surveilled.” The varied, legitimate circumstances that can produce the same signatures — a misconfigured tower, an aircraft landing, a rural area where 2G is still prevalent, a carrier that genuinely runs an unusual configuration — are exactly why the output is framed as something to investigate rather than something to act on blindly.

Table 1 — 3. What Rayhunter is — and the three words that matter most

Rayhunter is	Rayhunter is not
A passive CSS/IMSI-catcher detector	An IMSI-catcher jammer, blocker, or preventer
An on-device recorder of the modem DIAG stream	A packet sniffer of other people’s traffic
A heuristic analyzer that raises signals	A system that produces courtroom-grade proof
Open source, EFF-maintained, mostly Rust	A commercial sealed appliance with a warranty
A tool for your own device and your own SIM	A tool to be pointed at networks you do not use

1.4 The defensive-only posture: no transmitter, no offensive surface

Rayhunter has no offensive surface and no extra transmitter. This is the single most important thing that distinguishes it from most of the tools in this hub, and it is why it can be discussed at full technical depth without the step-by-step cautions the transmit-capable tools carry.

The hotspot Rayhunter runs on is, of course, a radio — it is a cellular modem and a Wi-Fi access point. But Rayhunter does not add any transmit behavior of its own. It does not emit probe signals to elicit a response from a suspected CSS, it does not spoof base stations, and it does not inject anything into the cellular control plane. It reads. Specifically, it reads the DIAG diagnostic interface that Qualcomm modems expose, which is a firehose of the signaling the modem is already exchanging with whatever tower it is attached to. Everything Rayhunter knows, it learned by listening to the device’s own normal operation.

That passivity has three consequences worth stating plainly. First, Rayhunter is legal to run in far more places than an active scanner, because it is doing nothing a normal phone does not do — though the legal envelope still depends on jurisdiction, and the EFF’s own disclaimer is explicit that users outside the US should consult local counsel. Second, it is undetectable from the network side in the ordinary case, because it generates no anomalous traffic. Third, and most relevant to the engineering, its detection power is bounded by what the modem’s DIAG stream reveals — it cannot learn anything the modem does not already surface. The defensive posture and the detection ceiling are the same fact seen from two sides.

Why this matters for the hub. Most Hack Tools entries carry an offensive capability that demands a “own hardware or written authorization” caveat. Rayhunter does not. The lab-discipline rules in the hub’s shared legal/ethics note still apply to the context — do not use a SIM or device you are not entitled to use — but Rayhunter itself adds no transmit, no injection, and no attack. It is a watcher.

1.5 The decision tree: Rayhunter vs SnoopSnitch vs Crocodile Hunter vs an SDR

IMSI-catcher detection has several open-source approaches, and they are not interchangeable. The right tool depends on what hardware the user has, how passive they need to be, and whether they want a self-contained appliance or a laptop-tethered rig.

START ── Do you want a self-contained, carry-it-anywhere detector
         that needs no phone and no laptop in the field? ───────────────┐
                                                                         │
      ┌──────────────── YES ───────────────┐          ┌──── NO ─────────┘
      ▼                                     │          ▼
  Buy a supported Qualcomm hotspot          │     Do you already have a
  and flash RAYHUNTER.                      │     rootable Qualcomm *phone*
  Passive DIAG analysis, on-device          │     (older Snapdragon)?
  web UI, QMDL/PCAP export.                 │          │
  → the self-contained appliance            │     ┌── YES ──┐   ┌── NO ──┐
                                            │     ▼         │   ▼        │
                                            │  SNOOPSNITCH  │  Do you have an SDR
                                            │  (Android app,│  (HackRF / RTL-SDR)
                                            │  reads the    │  and a laptop?
                                            │  phone's own  │       │
                                            │  baseband)    │   ┌── YES ──┐
                                            │               │   ▼         │
                                            └───────────────┘  CROCODILE HUNTER
                                                               / SDR survey:
                                                               actively scans &
                                                               fingerprints cells
                                                               (heavier, laptop-bound,
                                                               more capable, less passive)

The distinctions that drive the tree:

Table 2 — The distinctions that drive the tree

Tool	Hardware	How it works	Posture	Best when
Rayhunter	Cheap Qualcomm hotspot (e.g. Orbic RC400L)	Passive DIAG-stream heuristics, on-device	Fully passive, self-contained, no PC/phone in field	You want a pocket appliance you can hand to a non-expert
SnoopSnitch	Rooted Qualcomm Android phone	Reads the phone’s own baseband diagnostics via an app	Passive, but tied to a specific class of phone	You already carry a compatible rooted Snapdragon phone
Crocodile Hunter	SDR (e.g. bladeRF/HackRF) + laptop	Actively surveys and fingerprints LTE eNodeBs in the area	More capable, less passive, laptop-bound	You want to survey an area’s cells, not just your own attachment
SDR survey (general)	HackRF One / RTL-SDR + PC tools	Decode and catalogue the cellular RF around you	Observational, expert-operated	You are doing a deliberate RF survey, not carrying a watcher

Rayhunter’s niche is the top-left of that table: the only one of the four that is genuinely self-contained, pocketable, passive, and cheap enough to deploy as a dedicated always-on watcher rather than a thing you set up for a session. SnoopSnitch overlaps in method (both read a Qualcomm baseband’s diagnostics) but differs in form — it needs a specific rooted phone and makes that phone the detector. Crocodile Hunter and SDR surveys trade passivity and portability for the ability to look at cells the detector is not even attached to.

For the full hardware-tier picture — which specific hotspots Rayhunter runs on, which are recommended versus merely functional, and the regional availability of each — this volume points down to the mandatory supported-hardware table in Volume 3, “Where this firmware runs — supported hardware”. Anyone about to buy a unit should read that table first; it is the single most consequential page in the series at purchase time.

1.6 Where it sits in the hub: the GL-iNet travel kit, HackRF One, Flipper Zero

Rayhunter is easiest to place by relating it to three tools the hub already covers.

The GL-iNet GL-BE3600 is the networking half of the travel kit — a Wi-Fi 7 travel router / portable OpenWrt platform. Rayhunter is its natural counter-surveillance companion in a go-bag: the GL-BE3600 gives a trustworthy local network wherever its owner lands, and a Rayhunter hotspot gives an always-on read on whether the cellular environment at that location is behaving. The two answer different questions — whether the local network is clean versus whether the tower a phone has attached to is honest — and travel is exactly the context where both questions matter at once. A Rayhunter unit can also run in Wi-Fi client mode on several of its supported boards, joining an existing network (such as one the GL-BE3600 provides) while still serving the hotspot, which makes it a clean fit alongside the travel router.

The HackRF One (with or without the PortaPack) is the hub’s wideband SDR. It represents the other side of the IMSI-catcher problem: where Rayhunter passively reads its own modem’s view of the cellular control plane, a HackRF-class SDR can observe cellular RF directly and is the hardware behind the Crocodile Hunter / SDR-survey branch of the decision tree above. The two are complementary, not redundant — Rayhunter is the carry-everywhere passive watcher, the HackRF is the bench instrument for a deliberate RF survey. A reader who wants the active-survey story should look to the HackRF One deep dive; this series stays on the passive-detector side.

The Flipper Zero is the multi-tool front end on many benches. It has no role in cellular CSS detection itself — it is not a cellular modem — but it shares Rayhunter’s “hand-it-to-a-non-expert, it just works” ergonomic goal, and both are the kind of small, self-contained device that lives in the same pocket of a field kit. The relationship is one of posture and form factor rather than overlapping capability.

Cross-reference discipline. Where this series needs cellular-RF domain depth beyond what the DIAG-stream heuristics require, it leans on the hub’s SDR coverage rather than duplicating it, and on the hub’s shared legal/ethics note for the lab-discipline rules that apply to any device carrying a live SIM.

1.7 The honesty ledger, up front

The most useful thing to internalize before acquiring a Rayhunter unit is the short list of things it sounds like but is not. Each line here is expanded elsewhere in the series; collecting them here prevents the common mistakes at purchase and first use.

Table 3 — 7. The honesty ledger, up front

It can sound like…	What it actually is
”A device that stops IMSI catchers”	A detector only — it never prevents, blocks, or jams anything
”Proof you were surveilled”	A signal to investigate — legitimate causes produce the same patterns
”Works on any phone/hotspot”	Only specific Qualcomm-modem devices with a reachable DIAG interface, on specific rootable firmware/hardware revisions
”Install it like an app”	A firmware-level install that roots the device and installs a daemon; buy a verified-rootable unit
”Always reachable over Wi-Fi”	Some boards (TMOHS1, CT2MHS01) drop their Wi-Fi AP after ~10 min with no clients — recording continues, but the UI goes unreachable until you reconnect
”A 5G-aware detector”	Strongest on LTE and 2G control-plane tells; the observable surface narrows on newer air interfaces
”Set it and forget it, zero noise”	Several heuristics can false-positive (e.g. IMSI-request near a landing aircraft, SIB downgrades where 2G is genuinely prevalent); a test heuristic is deliberately noisy

None of this is a criticism of the project — it is why the project is trustworthy. An IMSI-catcher detector that advertised certainty would be the one to distrust. Rayhunter’s documentation is candid about every one of these limits, and the series follows that candor.

1.8 Who it is for — and who should reach for something else

A good fit is the journalist, activist, researcher, or privacy-minded traveler who wants a cheap, self-contained, passive device that watches the cellular environment and raises a flag when something is worth a closer look — and who understands that a flag is a prompt to investigate, not a conviction. It suits the engineer who wants to learn how CSS detection actually works by running an open, inspectable implementation, and the person assembling a counter-surveillance go-bag who values that Rayhunter adds no transmit surface and almost no operational risk. It is an unusually good tool to hand to a non-expert, precisely because the EFF designed it to be installable and usable regardless of technical skill.

A poor fit is anyone who expects prevention, certainty, or a courtroom artifact from a single red line — that misunderstanding is what §7 exists to prevent. It is a poor fit for someone whose only phone is a non-Qualcomm or non-rootable device, since Rayhunter needs specific hardware (Volume 3). It is the wrong tool for an active RF survey of an area’s cells — that is the SDR / Crocodile Hunter job — and it is not a general cellular sniffer for other people’s traffic, which it neither can nor should do. Finally, it is a poor fit for anyone unwilling to keep up with a fast-moving open-source project whose alert behavior and defaults have shifted across releases.

1.9 How this series is organized

Ten volumes, building from the threat model up through the hardware, the reference device, the internals, and out to operation, context, and a laminate card.

Table 4 — 9. How this series is organized

Vol	Title	What it covers
1	Overview & decision tree	This volume — the threat in a page, the defensive-only posture, the Rayhunter/SnoopSnitch/Crocodile Hunter/SDR decision tree, hub placement, the honesty ledger
2	Cellular & IMSI-catcher primer	How a UE registers (IMSI/TMSI/GUTI), 2G→5G control-plane basics, what a CSS does, and precisely what is and is not detectable from the handset/modem side
3	Where this firmware runs — supported hardware	The mandatory supported-hardware table — every board, modem, tier, region, quirk, and where to buy a verified-rootable unit
4	The Orbic RC400L platform	The reference device in depth — the Qualcomm modem, the DIAG/QMI interface Rayhunter rides, storage, battery, display, and how root is obtained at a high level
5	How Rayhunter works	The Rust daemon architecture, the QMDL/DIAG capture pipeline, the analyzer/heuristic model category by category, the warning UX, false-positive sources, and the “detection not prevention” framing
6	Installing, flashing & first run	The installer binary, the per-device install commands, reaching the web UI, and verifying the running line
7	Using Rayhunter day to day	Recordings, reading the colored line, the web UI controls, QMDL/PCAP export, and Wi-Fi-client-mode operation
8	Reading the warnings	The analyzers one by one, severity, how to triage a flag, and the discipline of treating a signal as a prompt
9	Rayhunter in context	A fuller comparison against SnoopSnitch, Crocodile Hunter, and SDR surveys, plus the hub-sibling workflows
10	Posture, legal envelope, glossary & cheatsheet	The operational playbook, the legal line, a laminate-ready quick-reference, and the glossary

A suggested reading order for a prospective user: this volume to decide whether and to understand the posture; Volume 3 to choose and buy the right hardware; Volume 2 for the cellular background that makes the alerts legible; then Volumes 4–5 for the reference device and the internals; Volumes 6–8 as the hands-on build, operate, and interpret references; and Volumes 9–10 for context and the laminate card.

The next volume builds the cellular and IMSI-catcher primer that every alert in the series depends on — how a device registers with a network, what a cell-site simulator actually does, and the exact boundary between what a handset-side detector can and cannot see.

Rayhunter is free software maintained by the Electronic Frontier Foundation; source at github.com/EFForg/rayhunter, documentation at efforg.github.io/rayhunter. Facts in this volume are drawn from that public repository and documentation as of 2026-10-17; alert and default behavior has changed across releases and is dated where it matters.