By Sina Khanifar
Wardriving involves driving in search of towers using a tower identifier and signal strength as your guide.
Maybe you're aiming antennas for a signal booster. Or maybe you're connecting directional antennas directly to a hotspot. Or perhaps you're just curious.
Knowing the location of your nearest cell tower can be extremely useful.
There are easier but much less accurate ways to map cell phone towers. But if you want to be sure, Wardriving is the only option.
Before we start, a few tips:
Android gives apps programmatic access to signal information. This makes it possible for apps to identify the tower you're connected to.
Some iPhone models still work. Specifically ones with Intel chipsets. But even then, the interface isn't nearly as easy to read as on Androids.
Don’t have an Android phone? Try borrowing one from a friend, or bringing them along for the ride. Just make sure they're on the same carrier as you.
There are lots of different apps there that claim to show you where your nearest towers are. Unfortunately, most of them are terribly inaccurate. We tested dozens of apps, and highlighted our 3 favorite in our post on mapping cell phone towers. Give that a read, it'll help you get some ideas on which direction to start driving. That being said, no app is completely accurate. Wardriving is definitely the way to go if you want to be sure of tower locations.
To wardrive, you need two things: a tower identifier (we recommend PCI) and a signal strength (RSRP) reading.
Only some iPhone models with an Intel modem chipset let you access tower identifier and signal strength data. So the instructions below may not work on some iPhones.
First, start by walking around the circumference of your home. Specifically, you should watch to see if the PCI changes at all.
If the PCI changes, your home is between multiple towers. Note down each PCI – you'll be hunting for multiple towers! You might also want to note if the signal strength (RSRP) from one tower is stronger than the others.
If you're on Android, use the "Map" tab of Network Cell Info Lite to get an idea of where each tower might be.
Signal strength, measured in dBm, will always be a negative number. So -80 dBm is a stronger signal than -100 dBm.
Now that you have your PCI identifiers, you can start wardriving. Your goal is to stay within the range of the same PCI, but to "heatseek" towards the strongest signal.
If you're on Android, use the "Map" tab of Network Cell Info Lite to get an idea of where each tower might be. Start by driving in that direction.
If your PCI changes, that means you've changed to a different tower. This might be temporary. For example you might just have an obstruction between you and the tower. Or it might be because you're moving in the wrong direction.
You should eventually be able to see the cell site, and when you're next to it, your RSRP should max out at around -40 dBm.
Note, that the cell site isn't always a tower. It might be on top of a building or on a light pole. And it might be "concealed" as a tree or something else.
Here are some photos so you know what you're looking for:
Have more questions that we haven't covered here? Or found a helpful tip you think we should add here? Please leave a comment or reach out to us!