Passive 5G Handset AoA Estimation with a USRP B210

Two Antennas + One USRP B210 for Passive 5G Handset Direction Finding

This is a fresh arxiv paper in signal processing (eess.SP, id 2608.00080, submitted 29 Jul 2026). It asks a very practical question: can the network side estimate the angle of arrival (AoA) of off-the-shelf 5G smartphones purely by listening, with no protocol changes and no UE cooperation?

System: All Off-the-Shelf Open-Source / SDR Pieces

• RF front-end: a calibrated two-element USRP B210 receiver — classic low-cost SDR hardware.
• Protocol stack: a srsRAN-based gNB processing real 5G NR uplink.
• Signal source: the smartphones' native Sounding Reference Signal (SRS) — a reference signal that 5G NR UEs already transmit periodically for channel-quality measurement; no active probing needed.
• Algorithm: a MUSIC-based super-resolution AoA estimator applied to per-antenna SRS channel estimates.

The whole pipeline is passive: no protocol modification, no handset-side cooperation.

Key Capabilities and Measured Results

1. Multi-user simultaneous AoA: independent SRS channel estimates allow AoA estimation for up to four commercial handsets at the same time.
2. Indoor accuracy: on n40 and n78, across a 30° broadside sector, the reported RMS error is ~1.5°.
3. Outdoor validation: live measurements in a real 5G SA (standalone) deployment confirm simultaneous multi-user operation.
4. What limits accuracy: the authors show that error is dominated by propagation conditions and received SINR, rather than transmitter distance — i.e., as long as link quality is good, near and far users are equally tractable.

Simons Foundation

Why It Matters to the SDR Community

For the SDR / wireless-research crowd, this is a very down-to-earth combination:

• Low-cost hardware (USRP B210 is the canonical entry-level SDR);
• Fully open-source stack (srsRAN);
• A signal source that already exists in every NR uplink (SRS);
• A textbook high-resolution algorithm (MUSIC).

Stitched together, this is a reproducible passive 5G direction-finding testbed. The authors also note that the dataset and code will be released on Zenodo and GitHub, which means anyone wanting to replicate or extend passive 5G localization / AoA work has a concrete blueprint to start from.

Likely use cases include indoor/outdoor passive localization, source-direction identification in spectrum monitoring, and AoA-based fingerprinting for 5G physical-layer security research.

Source: arXiv paper 2608.00080, Passive AoA Estimation of COTS 5G NR Handsets from Uplink SRS: A Practical USRP-B210 Implementation, by Ricardo N. Barrios-Muñoz and Azim Akhtarshenas.