---

9.1 About this Volume

Rayhunter is one answer to a question several projects have asked: how does an ordinary person get a chance of noticing a cell-site simulator? Each project answers with a different sensor. SnoopSnitch reads an Android phone’s own baseband diagnostics. CellGuard does a comparable job on iOS. SeaGlass turns a fleet of vehicles into a city-scale sensor grid. Crocodile Hunter listens with a software-defined radio. Rayhunter’s answer is a cheap, dedicated hotspot that passively records its own modem’s control plane and runs heuristics on it.

This volume places Rayhunter against those alternatives, notes where a general-purpose SDR like the HackRF One sits in the same awareness space, and — most importantly — states plainly what this whole class of consumer detector can and cannot do. The through-line: these are awareness tools that raise the cost of operating undetected, not interception-proof shields. Rayhunter’s particular bet is accessibility — a $20–40 used device and a one-command install — traded against the ceiling of what a cheap consumer modem’s diagnostic interface can reveal.

---

9.2 The detection landscape at a glance

The projects differ along a few axes that explain all the trade-offs that follow: the sensor (what hardware does the observing), the vantage point (control-plane log vs raw RF), the platform (dedicated device, your phone, a vehicle fleet), and the accessibility (cost, skill, and whether it needs a rooted/jailbroken device).

                       SENSOR / VANTAGE                 PLATFORM            ACCESS
 Rayhunter      cheap hotspot modem, control-plane log  dedicated device    very high ($20–40, 1-cmd install)
 SnoopSnitch    phone baseband diag, control-plane      your Android phone  needs rooted Qualcomm Android
 CellGuard      phone baseband data, control-plane      your iPhone         needs a jailbroken / profiled iOS
 SeaGlass       many RF sensors, city-scale survey      vehicle fleet       research-scale deployment
 Crocodile H.   SDR, raw LTE broadcast                  SDR + host          technical; SDR hardware + setup
 HackRF (DIY)   general SDR, raw RF                      SDR + host          general-purpose, not turnkey

Rayhunter and the phone-based tools share a vantage point — the control plane as seen from a participating device — and differ mainly in platform and accessibility. SeaGlass and the SDR tools observe differently (a survey grid, or raw RF) and answer a different-shaped question.

---

9.3 vs SnoopSnitch (Android, diag-based)

SnoopSnitch (from Security Research Labs) is the closest conceptual cousin to Rayhunter: it reads the Qualcomm diagnostic interface — the same class of modem control-plane data Rayhunter records — but does it on an Android phone rather than a dedicated hotspot. It analyzes that stream for IMSI-catcher indicators and related mobile-network security issues.

Table 1 — 3. vs SnoopSnitch (Android, diag-based)

	Rayhunter	SnoopSnitch
Sensor	A dedicated cheap hotspot’s modem	Your Android phone’s own modem
Vantage	Qualcomm diag / control-plane log	Qualcomm diag / control-plane log
Requirement	A supported, rootable hotspot	A rooted phone with a Qualcomm chipset
Form factor	A second device you carry	The phone already in your pocket
Trade-off	Separate instrument, no phone modification	Uses your main phone — but needs root + the right chipset

The practical split: SnoopSnitch needs no extra hardware but asks the user to root their daily phone and have the right (Qualcomm) chipset; Rayhunter asks for a cheap second device but leaves the phone untouched. For a user unwilling to root a primary phone, or whose phone isn’t a compatible Qualcomm device, Rayhunter’s dedicated-device model is the more accessible path — and keeps the detector logically separate from the phone whose traffic is the thing being protected (Vol 10 OPSEC).

---

9.4 vs CellGuard (iOS)

CellGuard is the iOS-side analogue — a research-driven app that examines iPhone baseband/cellular data to flag behaviour consistent with cell-site simulators, collecting cell measurements over time and surfacing anomalies. It brings this kind of awareness to iPhone users, who are otherwise poorly served because iOS exposes little of the baseband to ordinary apps.

Table 2 — 4. vs CellGuard (iOS)

	Rayhunter	CellGuard
Platform	Dedicated hotspot	iPhone
Access to baseband	Full modem diag on the hotspot	Constrained by what iOS exposes (typically needs a jailbreak / special profile)
Model	Real-time heuristics + recording	Cell-measurement collection + anomaly analysis
Who it’s for	Anyone who’ll carry a second device	iPhone users specifically

CellGuard’s value is reaching a platform the other tools can’t — the iPhone. Its constraint is the same one every on-phone iOS tool faces: Apple’s baseband is largely closed, so the depth of visibility depends on jailbreak/profile status and on what iOS surfaces. Rayhunter sidesteps the platform-lockdown problem entirely by not living on the phone — the cost being a separate device to carry.

---

9.5 vs SeaGlass (vehicle-scale sensor network)

SeaGlass (a University of Washington research project) attacked the problem at a completely different scale: instrument a fleet of vehicles with cell-measurement sensors, collect readings across a whole city over time, and look for the statistical fingerprints of cell-site simulators against that city-wide baseline. It is a survey instrument, not a personal one.

Table 3 — 5. vs SeaGlass (vehicle-scale sensor network)

	Rayhunter	SeaGlass
Scale	One person, one device	City-scale sensor grid
Output	”Is something suspicious here, now?"	"Where in this city do anomalies cluster over weeks?”
Deployment	Buy a hotspot, flash it	Equip and operate a vehicle fleet
Who runs it	An individual	Researchers / an organization

SeaGlass and Rayhunter are complementary rather than competing. SeaGlass answers the research/mapping question — where and how often do simulators appear across a region — that no single personal device can. Rayhunter answers the personal, immediate question SeaGlass cannot be in every pocket to answer. A SeaGlass-style dataset is the kind of context that makes an individual Rayhunter warning easier to interpret.

---

9.6 vs Crocodile Hunter (SDR-based peer)

Crocodile Hunter is named here only as a peer project: an earlier, SDR-based cell-site-simulator detector. Where Rayhunter watches the control plane as a participating device sees it, an SDR-based detector listens to the radio directly. The two vantage points are genuinely different — one is “what the device’s own modem was told,” the other is “what the air carries” — and neither strictly dominates.

The relevant contrast, kept at the level this dive maintains throughout:

Table 4 — The relevant contrast, kept at the level this dive maintains throughout

	Rayhunter	Crocodile Hunter (SDR-based)
Sensor	A consumer modem’s diagnostics	A software-defined radio
Vantage	Control plane, post-attachment	Raw broadcast, independent of attachment
Accessibility	Very high (cheap hotspot, 1-cmd install)	Technical (SDR hardware + a decode setup)
Carry-ability	Pocket device, turn on and go	Larger kit, more setup

The SDR vantage can observe a tower’s broadcast without the detector’s own device having to attach to it, which sidesteps one of Rayhunter’s structural limits (§9 — Rayhunter only sees what its own modem experiences after attaching). The trade is accessibility and portability: an SDR-based detector is a more technical, more involved instrument. Crocodile Hunter’s internals are out of scope here; it is cited as the SDR-shaped point in the same solution space.

---

9.7 Where a general SDR like the HackRF One sits

A general-purpose SDR such as the HackRF One (see ../HackRF One/) is not a cell-site-simulator detector out of the box — it is a wideband radio. In the awareness space it occupies the “RF-level situational awareness” slot: with the right software stack it can observe cellular and other spectrum directly, which is a fundamentally different and lower-level vantage than Rayhunter’s control-plane log. Turning that raw capability into IMSI-catcher detection is a DIY exercise (the kind of thing Crocodile Hunter productized), not a feature of the HackRF itself.

The honest placement:

• Rayhunter is a turnkey, control-plane detector — buy, flash, carry, read the line.
• A HackRF is a general instrument for seeing the RF — spectrum awareness, signal investigation, and a platform for building or running an SDR-based detector if the user wants one. It demands far more skill and setup, and gives far more generality in return.

For a traveller or activist who wants a chance of noticing with minimal effort, Rayhunter is the appropriate tool. For an engineer who wants to understand the RF environment itself, or to build/run an SDR-based detector, the HackRF (and the SDR projects elsewhere in this hub) is the platform. They answer different questions; owning one is not a reason to skip the other.

---

9.8 The comparison table

Table 5 — 8. The comparison table

Project	Sensor	Vantage	Platform	Access / skill	Best at
Rayhunter	Cheap hotspot modem	Control-plane log, heuristics	Dedicated device	Very high — $20–40, one-command install	Accessible, carry-anywhere personal awareness, separate from your phone
SnoopSnitch	Phone’s own modem	Control-plane (Qualcomm diag)	Android phone	Needs rooted Qualcomm phone	No extra hardware, uses the phone you have
CellGuard	iPhone baseband	Control-plane / cell measurements	iPhone	Needs jailbreak / profile	Reaching iPhone users at all
SeaGlass	Many RF sensors	City-scale survey	Vehicle fleet	Research-scale	Mapping where/when simulators appear across a region
Crocodile Hunter	SDR	Raw broadcast, pre-attachment	SDR + host	Technical	Observing towers without attaching; SDR vantage
HackRF One (DIY)	General SDR	Raw RF	SDR + host	General-purpose, not turnkey	RF-level awareness; a platform to build detection on

No single row dominates: the right tool depends on platform (do you carry Android, iOS, or a spare device?), on whether the question is personal-and-now or survey-and-region, and on how much skill and hardware the user will bring.

---

9.9 The honest limits of Rayhunter

A fair assessment names the constraints plainly. None of these are defects to be fixed; they are the shape of what a cheap, passive, control-plane detector can be.

• Passive and heuristic. Rayhunter watches; it does not probe. Its analyzers flag patterns associated with cell-site simulators, so warnings are signal, not proof (Vol 7 §6). False positives occur near legitimate-but-unusual network behaviour; false negatives occur against techniques the heuristics don’t model.
• Control-plane only. It sees signalling, not the radio itself. A behaviour that doesn’t manifest in the control plane the modem exposes is invisible to it.
• Post-attachment. It observes what its own modem experiences after attaching to a cell. It cannot survey towers it never attaches to the way an SDR-based detector can (§6).
• Consumer-modem constrained. The ceiling is whatever a cheap Qualcomm modem’s diagnostic interface reveals — which is substantial, but not everything a lab instrument would see.
• 2G-downgrade-weighted. A classic cell-site-simulator behaviour is forcing a device down to 2G, and several analyzers watch exactly that. Techniques that stay on 4G/5G are harder for this tool to catch.
• Hardware availability and firmware drift. The reference Orbic RC400L is no longer made; supply is the used market. And an install depends on a rootable firmware rev — a carrier OTA update can close the install path, which is why the device is kept off the carrier network after flashing (Vol 6 §2).
• It does not make you safe. Rayhunter tells you when something is suspicious; it does not block, encrypt, or prevent anything. The protection is the operator’s response to a warning, not the device itself (Vol 10).

The right expectation. Rayhunter raises the cost of operating a cell-site simulator undetected, and gives a motivated user a real chance of noticing one — at a price and skill level nothing else in this list matches. That is a meaningful thing and a bounded one. An operator who understands the bounds gets the value; one who expects a guarantee will be misled by both its silences and its warnings.

---

9.10 Cross-links and where to go next

• ../HackRF One/ — the general-purpose SDR; the RF-level-awareness counterpart to Rayhunter’s control-plane view, and the platform for any SDR-based detection a user wants to build or run (§7).
• ../RTL-SDR/ — the receive-only SDR companion; a lower-cost entry to the raw-RF vantage.
• ../_shared/comparison.md — the cross-tool decision matrix for the whole hub.
• ../_shared/legal_ethics.md — the lab-discipline rules that apply across tools; Volume 10 develops the Rayhunter-specific legal/ethics/OPSEC picture.
• EFF Rayhunter docs — efforg.github.io/rayhunter and github.com/EFForg/rayhunter — the canonical reference for installation, supported devices, and the analyzers.

---

Volume 10 closes the dive with the legal footing of passively recording your own network connection, the ethics of carrying and reporting, the OPSEC of the detector itself, a laminate-ready field cheatsheet, and an A–Z glossary of the cellular and detection terms used throughout.