How to Create a Cell Tower Map by Wardriving

By Sina Khanifar

Wardriving involves driving in search of towers using a tower identifier and signal strength as your guide.

Maybe you're aiming antennas for a signal booster. Or maybe you're connecting directional antennas directly to a hotspot. Or perhaps you're just curious.

Knowing the location of your nearest cell tower can be extremely useful.

There are easier but much less accurate ways to map cell phone towers. But if you want to be sure, Wardriving is the only option.

Before we start, a few tips:

Two Tips Before You Start

1. Use an Android phone

Android gives apps programmatic access to signal information. This makes it possible for apps to identify the tower you're connected to.

Some iPhone models still work. Specifically ones with Intel chipsets. But even then, the interface isn't nearly as easy to read as on Androids.

Don’t have an Android phone? Try borrowing one from a friend, or bringing them along for the ride. Just make sure they're on the same carrier as you.

2. Use Tower Mapping Apps to Get an Idea of Tower Locations Before You Start

There are lots of different apps there that claim to show you where your nearest towers are. Unfortunately, most of them are terribly inaccurate. We tested dozens of apps, and highlighted our 3 favorite in our post on mapping cell phone towers. Give that a read, it'll help you get some ideas on which direction to start driving. That being said, no app is completely accurate. Wardriving is definitely the way to go if you want to be sure of tower locations.

Step 1: Find Tower Identifiers & Signal Strength

To wardrive, you need two things: a tower identifier (we recommend PCI) and a signal strength (RSRP) reading.

Only some iPhone models with an Intel modem chipset let you access tower identifier and signal strength data. So the instructions below may not work on some iPhones.

Android Instructions

Download the Network Cell Info Lite app.
The signal strength is show as "RSRP" in the center of the "Gauge" tab.
Beneath the gauge to the right you can see your PCI.

iOS Instructions

Open the phone app and dial *3001#12345#*
Tap on “LTE”
Select “Serving Cell Meas”
The “rsrp0” value provides the signal strength of the connected tower in dBm
The “phy_cell_id” provides the PCI (tower ID)

Step 2: Identify Nearby Towers

First, start by walking around the circumference of your home. Specifically, you should watch to see if the PCI changes at all.

If the PCI changes, your home is between multiple towers. Note down each PCI – you'll be hunting for multiple towers! You might also want to note if the signal strength (RSRP) from one tower is stronger than the others.

If you're on Android, use the "Map" tab of Network Cell Info Lite to get an idea of where each tower might be.

Tip: Signal Strength (RSRP) is a Negative Number

Signal strength, measured in dBm, will always be a negative number. So -80 dBm is a stronger signal than -100 dBm.

Step 3: Start Driving

Now that you have your PCI identifiers, you can start wardriving. Your goal is to stay within the range of the same PCI, but to "heatseek" towards the strongest signal.

If you're on Android, use the "Map" tab of Network Cell Info Lite to get an idea of where each tower might be. Start by driving in that direction.

If your PCI changes, that means you've changed to a different tower. This might be temporary. For example you might just have an obstruction between you and the tower. Or it might be because you're moving in the wrong direction.

Step 4: Find the tower(s)!

You should eventually be able to see the cell site, and when you're next to it, your RSRP should max out at around -40 dBm.

Note, that the cell site isn't always a tower. It might be on top of a building or on a light pole. And it might be "concealed" as a tree or something else.

Here are some photos so you know what you're looking for: