Two Antennas + One USRP B210 for Passive 5G Handset Direction Finding
This is a fresh arxiv paper in signal processing (eess.SP, id 2608.00080, submitted 29 Jul 2026). It asks a very practical question: can the network side estimate the angle of arrival (AoA) of off-the-shelf 5G smartphones purely by listening, with no protocol changes and no UE cooperation?
System: All Off-the-Shelf Open-Source / SDR Pieces
- RF front-end: a calibrated two-element USRP B210 receiver — classic low-cost SDR hardware.
- Protocol stack: a srsRAN-based gNB processing real 5G NR uplink.
- Signal source: the smartphones' native Sounding Reference Signal (SRS) — a reference signal that 5G NR UEs already transmit periodically for channel-quality measurement; no active probing needed.
- Algorithm: a MUSIC-based super-resolution AoA estimator applied to per-antenna SRS channel estimates.
The whole pipeline is passive: no protocol modification, no handset-side cooperation.
Key Capabilities and Measured Results
- Multi-user simultaneous AoA: independent SRS channel estimates allow AoA estimation for up to four commercial handsets at the same time.
- Indoor accuracy: on n40 and n78, across a 30° broadside sector, the reported RMS error is ~1.5°.
- Outdoor validation: live measurements in a real 5G SA (standalone) deployment confirm simultaneous multi-user operation.
- What limits accuracy: the authors show that error is dominated by propagation conditions and received SINR, rather than transmitter distance — i.e., as long as link quality is good, near and far users are equally tractable.
Simons Foundation
Why It Matters to the SDR Community
For the SDR / wireless-research crowd, this is a very down-to-earth combination:
- Low-cost hardware (USRP B210 is the canonical entry-level SDR);
- Fully open-source stack (srsRAN);
- A signal source that already exists in every NR uplink (SRS);
- A textbook high-resolution algorithm (MUSIC).
Stitched together, this is a reproducible passive 5G direction-finding testbed. The authors also note that the dataset and code will be released on Zenodo and GitHub, which means anyone wanting to replicate or extend passive 5G localization / AoA work has a concrete blueprint to start from.
Likely use cases include indoor/outdoor passive localization, source-direction identification in spectrum monitoring, and AoA-based fingerprinting for 5G physical-layer security research.
Source: arXiv paper 2608.00080, Passive AoA Estimation of COTS 5G NR Handsets from Uplink SRS: A Practical USRP-B210 Implementation, by Ricardo N. Barrios-Muñoz and Azim Akhtarshenas.