Joining the cellular world, you start to notice cellular towers every where you travel, just like Wifi Engineers tend to notice BadFi Wifi radios. Maybe with the proliferation of Private Cellular, maybe we will need to start a Bad5G site.. Trademarked.. jk 😉
A contact of mine, Virgilio Fiorese (Vico), was recently attending a telco conference in my area. He took the chance to explore the reason I love living in Utah.. my canyons and mountains. He posted the following to LinkedIn:
For years, I’ve been driving these canyons and have noticed those towers. I hadn’t surveyed them or had any in-depth knowledge about them so I decided to see what I could find out. It so happened that an earlier post that day, by Vico, had inspired me to get away to my mountains that very evening. Before Vico posted that photo, I noticed one of those monopole towers next to a parking lot and snapped my own photo. With my LTE WarDriving efforts, I decided I needed to see who was broadcasting from that tower and what information I could gather about these.
The route that Vico took was up a canyon called Little Cottonwood Canyon, UT190, above the Salt Lake Valley. Little Cottonwood along with her sister Big Cottonwood Canyon UT210, to the south, are famous for the Ski Resorts that had events featured in the Salt Lake 2002 Olympic Winter Games. At the top of Little Cottonwood Canyon you can drop down into the sites of other Olympic Venues. Park City, home of many Skiing, Bobsledding, and other Olympic venues, where Vico attended his conference. The other direction can take you down to the Heber Valley, home of Soldier Hollow Biathlon and Cross Country Skiing Olympic Venue.
The other canyon, located to the South on UT92, where I took my tower photo, is called American Fork Canyon. If you drive far enough along the American Fork, also called the Alpine Loop, UT92, you will reach Sundance Ski Resort made famous by Robert Redford and the Sundance Film Festival.
These canyons are surrounded by the stunning Wasatch Mountain Range and the beautiful Mount Timpanogos. At a towering 11,753 foot tall, Timpanogos is named after and resembles from a distance a sleeping native American princess.
Being a remote tower site away from the city, I figured most of the information gathered using my tools would be pretty limited, so I could tie it to a single tower or two. I decided to see what I could find about this specific tower. First, I decided to do some research before returning to the site with my tools.
One of the first thing I noticed is the attached camera. Being a local and using the UDOT Traffic app extensively during the winter months to navigate the neighboring canyons during snow storms, I decided to see if that camera is shared on that app. Sure enough the app has a bunch of cameras located up these canyons for the public to use. Most of those cameras are attached to monopole towers. From the screenshot below, the above camera and tower is the one located at the very bottom right camera icon. Little Cottonwood Canyon where Vico visited is shown with her traffic and weather measurements along the top of the screenshot. Big Cottonwood Canyon is located in the middle.
If you click on that camera icon it will show you the camera view. Here is the view of the parking lot and UT92 route from that camera. I’m now interested to check out this camera in the winter as this road is closed seasonally.
Previously, I thought those towers were used exclusively for emergency services. On my first visit to this tower, I sat in that parking lot and had no service. My iPhone has Dual SIMs for Verizon and Google Fi, which uses Tmobile’s Network on the iPhone. Sitting right next to that tower in American Fork Canyon, my phone showed no service on either SIM. So for my phone, all I had was emergency services at that site. The results from my iPhone show there is a r_MCC and r_MNC aka potential roaming candidate on 310 410 which is AT&T. This gives me a hint to who is broadcasting on that tower.
While researching the towers, I found that expansion up American Fork canyon had only been completed recently. Those towers in American Fork were installed in 2020 during the pandemic. There has been a lot of pushback from the public regarding these towers. I found a Facebook group called Protect and Preserve American Fork Canyon that had discussed these very towers. They even created a poll a year ago where they asked people if they want more towers in the canyon. Many of the responses were that people wanted to visit the canyons without the distraction of their cellphone. UDOT paints the towers brown to help disguise them with the surroundings, and most people rarely notice them.
I have a contact at UDOT that I have planned to asked some questions specifically about these towers. I have been unable to meet with her at this point. I’ll include additional information if I can get it.
After doing the research part, I decided it was time to return and do some survey testing with my tools. With Mount Timpanogos towering in the background, I climbed atop the hammock on the roll-cage of my ’92 YJ Jeep Wrangler and pulled out my CBRS Pi.
The monopole tower, located across the parking lot, began giving up her secrets. I let my tool capture the signaling data for about 30 minutes while I relaxed and enjoyed the view.
Later that night, it was time to see what my device had captured from that tower. Pulling up the PCAP in Wireshark, the data quickly jumped out at me. Those towers are exclusively AT&T broadcasting AT&T’s PLMN, 310410, and FirstNet Emergency Services PLMN, 313100. The tower and a neighboring tower further down the canyon are broadcasting on Bands 2, 4, 12, 17, 25, and 66 with a TAC of 39168 (9900 HEX).
The PCAP and PCI Scanning Tool picked up five different EARFCNs: 1125, 5110, 5780, 8290, and 66661. I also picked up five different PCI measurements 15, 16, 17, 51, and 377. EARFCN 1125 was captured in the PCAP but didn’t show up in the PCI Scan. My guess is that it was a tower located down the canyon that my tool captured traffic from occasionally but wasn’t able to capture any PCI data.
Because of the differing measured RSRP and RSSI, I believe my tool captured the radios on the tower across the parking lot and a neighboring tower down the mountain. I believe that the tower is broadcasting EARFCNs 5110, 5780, and 66661 with a PCI 51, and 8290 with a PCI of 377. EARFCNs 5110, 5780, and 8290 with PCIs of 15, 16, and 17 are from a tower further down the canyon.
This is some interesting data about those specific towers that confirmed my understanding. These towers are leased to AT&T by UDOT to provide Emergency Services for FirstNet. I don’t have an AT&T SIM card so I was unable to verify, but you would have service in this location on AT&T or an MVNO with agreements to roam on AT&T. Everyone else are limited to emergency 911 services only.
The Cottonwood Canyons are different as more people recreate in those canyons year round. Vico mentioned that he had Tmobile Service the entire route up the canyon. Having visited those canyons extensively over the years, I can also confirm that Verizon has service throughout the Cottonwood canyons.
A few days later, I had the itch to get back into the mountains for the 4th of July. I decided to take my tools down Little Cottonwood Canyon a few hours before the real fireworks began back at home.
Sure enough, I captured more data fireworks in Little Cottonwood Canyon, as you can see above. Interestingly enough, AT&T increased the Tracking Area Code in Little Cottonwood Canyon by 5 digits, 39173 (HEX 9905), compared to what I found in American Fork Canyon, 39168 (HEX 9900). I captured a bunch more EARFCNs and PCI results, with some similarities between the canyons, like EARFCN 66661 and 5110. Interestingly enough, one of the PCIs I captured is 435. That’s one of the local phone number area codes. It makes me wonder how AT&T designs their TACs and PCIs. It seems like in some cases they just choose a random number either from something local or just incrementing a number.
I captured Verizon, Tmobile, and AT&T PLMNs off of a tower in the canyon. It looks like more carriers are willing to lease space on those towers. The reason is most likely because of the pure number of people who visit Little Cottonwood Canyon over American Fork Canyon. The other reason could include the ties to the Olympics which brought upgrades to the Cottonwoods. Another reason could be the pushback from the local community using the towers in one canyon over the other.
Just as pulling away shows off from the Sleeping Princess, Mount Timpanogos, in all her beauty. Pulling back the datasets from both canyons begins to paint an interesting picture. Maybe UDOT is working towards adding additional carriers on those towers in American Fork canyon or AT&T will continue to have exclusivity because of the need for FirstNet and the pushback from the community. I’m sure as more people continue to visit the canyons the need for connectivity will overtake the naysayers and will bring more towers to these remote areas.
No matter your view on the issue, I think having better emergency connectivity is paramount in some of these higher trafficked areas. In a post pandemic world, as more people are able to work remotely, having connectivity in the back country is enabling more people to work and recreate in the canyons and on the side of my mountains.
