“However, those messages sent in plaintext can be completely analyzable. For example, the broadcast messages sent by the cell tower, or the messages at the beginning of the connection are completely visible.”
KAIST’s tool decodes control and data channels for every active user on a cell, in both directions. It ran in real time against a tower with 150 active users on a single Intel i7-9700K PC. The API ships with IMSI collecting and identity mapping built in. Passive IMSI catching now costs a gaming PC and a software radio.