"5G" isn't one frequency. In the US it runs on bands from 600 MHz up to 40 GHz, and the band decides how far the signal reaches, how fast it is, how it looks on a spectrum display, and whether a portable receiver can see it at all. This guide maps the bands, explains the technology that makes 5G behave the way it does, and shows you how to recognise it on a walking survey.
How 5G bands are named
The standards body 3GPP defines 5G, also called NR (New Radio). It splits 5G spectrum into two frequency ranges:
- FR1: from 410 MHz up to 7.125 GHz. Everything people call "low-band" and "mid-band" lives here. You'll also hear it called "sub-6 GHz".
- FR2: from 24.25 GHz upward. This is millimetre wave (mmWave), named because the wavelengths are around a centimetre or less.
Within those ranges, 3GPP numbers each band with an n prefix: n71, n41, n77 and so on. Where a 5G band covers the same frequencies as an existing 4G LTE band, it usually takes the same number. LTE Band 71 and 5G n71 are the same 600 MHz spectrum; LTE Band 41 and n41 are the same 2.5 GHz spectrum. That's a clue to something important: a lot of 5G runs on spectrum that already carried 4G.
A band number is a technical definition, not a licence. n77 is defined as 3.3–4.2 GHz, but in the US only parts of that range are licensed for mobile use. The licence (issued by the FCC) says who may use which frequencies where. The band number says how phones and base stations should handle those frequencies.
The three groups at a glance
| Group | Main US bands | Main US use | Character |
|---|---|---|---|
| Low-band | n71 (600 MHz), n5 (850 MHz) | T-Mobile uses n71 widely; 850 MHz is shared 4G/5G spectrum | Long range, gets indoors, modest speed |
| Mid-band | n2/n25 (PCS), n66 (AWS), n41 (2.5 GHz), n77 (3.45 GHz and C-band), n48 (CBRS) | T-Mobile n41; Verizon and AT&T C-band n77; AT&T also 3.45 GHz | The workhorse: good range and high capacity |
| High-band (mmWave) | n258 (24 GHz), n261 (28 GHz), n260 (39 GHz) | Mainly Verizon and AT&T | Very fast, very short range, easily blocked |
Why frequency decides range
Two physical effects make higher frequencies travel less far in practice.
Wavelength and antenna size. Wavelength is the speed of light divided by frequency. At 600 MHz it's 50 cm. At 3.7 GHz it's about 8 cm. At 28 GHz it's about 1 cm. A receiving antenna of a given type collects less energy as the wavelength shrinks, because it's physically smaller. In the textbook free-space formula, which assumes simple antennas at both ends, the loss over a given distance rises by 20 dB for every tenfold increase in frequency. Worked example: between 600 MHz and 28 GHz that's 20 × log10(28,000 ÷ 600) ≈ 33 dB more loss, a factor of about 2,000 in power. Between 600 MHz and 3.7 GHz it's about 16 dB.
Obstacles. Walls, glass, foliage and people absorb and reflect higher frequencies more. Low-band passes through buildings reasonably well. Mid-band loses more indoors. mmWave struggles with a single wall, tinted glass, and even a hand over the phone.
Carriers fight back with antennas. Mid-band and mmWave sites use arrays of many small antenna elements that focus energy toward users (beamforming, explained below). That recovers much of the loss, but only in the direction the beam points.
Low-band 5G in detail
n71 (600 MHz). Downlink (base station to phone) is 617–652 MHz, and uplink (phone to base station) is 663–698 MHz. It's an FDD band: downlink and uplink use separate frequency ranges at the same time. T-Mobile uses n71 for wide-area 5G. Because the spectrum available is modest, channels here are narrower than in mid-band, so speeds are closer to good 4G. Its strength is reach: one site can cover a large area and reach indoors.
n5 (850 MHz). Uplink 824–849 MHz, downlink 869–894 MHz, also FDD. This is old cellular spectrum, used for 4G and earlier. Some carriers have run 5G in it alongside 4G using DSS (see below).
Other low-band frequencies around 700 MHz carry 4G and, depending on the carrier, can carry 5G too. Don't assume a low-band signal on your display is 5G or 4G from its frequency alone; in shared spectrum it can be either or both.
Mid-band 5G in detail
PCS and AWS: 4G spectrum reused
n2 and n25 (PCS, around 1.9 GHz). n2 has uplink 1850–1910 MHz and downlink 1930–1990 MHz. n25 is the same plus 5 MHz more at the top of each: uplink 1850–1915 MHz, downlink 1930–1995 MHz. n66 (AWS) has uplink 1710–1780 MHz and downlink 2110–2200 MHz. All are FDD. Carriers already used them heavily for 4G and now carry 5G in some of them as well.
n41: 2.5 GHz
n41 covers 2496–2690 MHz, 194 MHz of spectrum, and it's TDD: the same frequencies carry downlink and uplink in turn. T-Mobile is the main US user. Its large holdings let it run wide 5G carriers here, which is why n41 delivers much of T-Mobile's faster 5G. Because n41 sits below 2.7 GHz, it's inside the range of Consentiva's Standard plan.
n77: the 3.45 GHz band and the C-band
n77 is defined as 3.3–4.2 GHz, TDD. Two parts of it matter in the US:
- The C-band, 3.7–3.98 GHz. The FCC auctioned it in Auction 107. Verizon and AT&T are the main users, and it carries much of their faster mid-band 5G. Above it, 3.98–4.0 GHz is a guard band, and satellite downlinks continue at 4.0–4.2 GHz. Aircraft radar altimeters use 4.2–4.4 GHz, which is why the C-band rollout involved coordination with aviation authorities.
- The 3.45 GHz band, 3.45–3.55 GHz. Auctioned in Auction 110. AT&T is a major user.
You may also see n78 (3.3–3.8 GHz) mentioned. It's widely used in other countries. In the US, mid-band phones and networks generally use n77.
n48: CBRS, 3.55–3.7 GHz
CBRS (Citizens Broadband Radio Service) is shared spectrum with three tiers of users. Incumbents such as federal radar have top priority. Next come Priority Access Licence holders. Last comes General Authorized Access, which anyone with certified equipment can use. A Spectrum Access System coordinates them automatically. That makes CBRS unusual: you'll see carriers, cable companies, and private networks at venues, campuses and businesses all using it. A CBRS signal on your display isn't necessarily a mobile carrier.
The US mid-band picture from 3.3 to 4.2 GHz
| Range | Name | Band | Duplex |
|---|---|---|---|
| 3.45–3.55 GHz | 3.45 GHz service | n77 | TDD |
| 3.55–3.7 GHz | CBRS | n48 (also within n77/n78 definitions) | TDD |
| 3.7–3.98 GHz | C-band | n77 | TDD |
| 3.98–4.0 GHz | Guard band | – | – |
| 4.0–4.2 GHz | Satellite downlink | – | – |
Taken together, 3.45–3.98 GHz is a nearly continuous stretch of mobile and shared spectrum about 530 MHz wide. On a spectrum display in a busy area it can look like a wall of activity.
High-band mmWave in detail
- n258: 24.25–27.5 GHz.
- n261: 27.5–28.35 GHz, the "28 GHz" band.
- n260: 37–40 GHz, the "39 GHz" band.
All are TDD. In the US, mmWave is mainly used by Verizon and AT&T, in dense places such as stadiums, arenas, transit hubs and some downtown blocks. Channels can be very wide, up to 400 MHz each, and a phone can combine several. That's where mmWave's headline speeds come from. The trade-off is range: often a few hundred metres with a clear view, much less through obstacles. You'll usually find mmWave equipment mounted low, on light poles and building facades, close to where people are.
A HackRF can't receive any of this. Its range stops at 6 GHz. Measuring mmWave needs specialised receivers and antennas.
Full band reference
| Band | Common name | Downlink | Uplink | Duplex | Main US use |
|---|---|---|---|---|---|
| n71 | 600 MHz | 617–652 MHz | 663–698 MHz | FDD | T-Mobile low-band 5G |
| n5 | 850 MHz | 869–894 MHz | 824–849 MHz | FDD | Shared 4G/5G |
| n2 | PCS | 1930–1990 MHz | 1850–1910 MHz | FDD | Shared 4G/5G |
| n25 | PCS (extended) | 1930–1995 MHz | 1850–1915 MHz | FDD | Shared 4G/5G |
| n66 | AWS | 2110–2200 MHz | 1710–1780 MHz | FDD | Shared 4G/5G |
| n41 | 2.5 GHz | 2496–2690 MHz | Same (TDD) | TDD | T-Mobile mid-band 5G |
| n77 | 3.45 GHz / C-band | 3.45–3.55 and 3.7–3.98 GHz in the US (band defined 3.3–4.2 GHz) | Same (TDD) | TDD | Verizon, AT&T; AT&T also 3.45 GHz |
| n48 | CBRS | 3.55–3.7 GHz | Same (TDD) | TDD | Shared: carriers, private networks |
| n258 | 24 GHz | 24.25–27.5 GHz | Same (TDD) | TDD | mmWave |
| n261 | 28 GHz | 27.5–28.35 GHz | Same (TDD) | TDD | mmWave, mainly Verizon/AT&T |
| n260 | 39 GHz | 37–40 GHz | Same (TDD) | TDD | mmWave, mainly Verizon/AT&T |
For a walking survey, the downlink column is what matters most. Base stations transmit continuously-ish from fixed places; phones transmit uplink only when in use, and from wherever they happen to be.
FDD and TDD: two ways to share a band
A mobile link needs two directions: downlink and uplink. There are two ways to fit both into spectrum.
| FDD (frequency division) | TDD (time division) | |
|---|---|---|
| How it works | Separate frequency ranges for each direction, used at the same time | One frequency range, switching between directions in time |
| US 5G examples | n71, n5, n2, n25, n66 | n41, n77, n48, all mmWave |
| On a spectrum display | Downlink blocks steady at base-station frequencies; uplink blocks quieter, bursty | One block that flickers as transmissions switch on and off |
| Strength | Simple, symmetric, good for low-band coverage | Uses wide unpaired blocks; can give more time to downlink |
In TDD, the network repeats a fixed pattern of downlink and uplink slots every few milliseconds, usually giving most of the time to downlink because people download more than they upload. Neighbouring networks in the same band coordinate their patterns so one site's downlink doesn't land on another's uplink.
What this means for you: a sweeping receiver spends only a short time on each frequency step. In a TDD band, whether that moment falls in a downlink slot, an uplink slot or a gap changes the reading. Averaged over many sweeps, the level is stable enough to compare. Any one sweep isn't.
NSA and SA: how 5G attaches to the network
Non-standalone (NSA) was how most US 5G launched. The phone keeps a 4G LTE connection for signalling and control, and the network adds a 5G carrier for extra data capacity. The 5G radio is real, but it leans on 4G. You'll see an LTE signal and a 5G signal working together from the same area.
Standalone (SA) uses a 5G core network end to end. The phone doesn't need an LTE anchor. SA enables features NSA can't fully support, and it's how 5G is meant to work long term.
On a spectrum display you can't tell NSA from SA. The radio signals look the same; the difference is in the network behind them. It matters to you only because the 5G icon on a phone can appear in either case, and on low-band as well as mid-band. Carriers use their own labels, such as "5G UW", "5G UC" or "5G+", for their faster mid-band and mmWave service.
DSS: 4G and 5G in the same channel
Dynamic Spectrum Sharing lets a carrier run 4G and 5G in the same channel at the same time. The base station decides, moment to moment, how much of the channel to give each. Some carriers used it to offer 5G quickly on their existing low-band and PCS/AWS channels without clearing out 4G users.
The catch for surveying: a DSS channel looks exactly like an LTE channel on a spectrum display. A wide block at 850 MHz could be carrying 4G, 5G or both. Frequency alone tells you the band, not the technology. If you need to know which, you need a phone or test tool that decodes the network, not a spectrum sweep.
Channel bandwidths and carrier aggregation
5G allows much wider channels than 4G. In FR1, a single 5G carrier can be from 5 MHz up to 100 MHz wide. In FR2, up to 400 MHz. LTE tops out at 20 MHz per carrier.
Typical patterns you'll meet:
- Low-band: narrow, a few MHz to about 20 MHz, because that's all the spectrum available.
- PCS/AWS: similar widths to LTE, often shared with it.
- n41 and n77: wide, tens of MHz, up to 100 MHz per carrier.
- mmWave: 100–400 MHz per carrier.
Phones also combine carriers, called carrier aggregation: for example, a low-band carrier for reach plus a mid-band carrier for speed, or two mid-band carriers side by side. On a spectrum display that can look like one very wide block or several adjacent ones.
Inside a carrier, 5G divides the channel into many narrow subcarriers, spaced 15 or 30 kHz apart in mid-band FR1 (wider in FR2). You won't see individual subcarriers on a survey; they merge into a flat top.
SSB and beam sweeping
A phone needs to find a 5G cell before it can use it. Every 5G cell transmits a synchronisation signal block (SSB): a small bundle of synchronisation signals and basic system information. With 30 kHz subcarrier spacing it's 7.2 MHz wide, a narrow strip inside a wide carrier. By default phones assume it repeats every 20 ms while they search, though networks can configure other intervals.
On beamformed cells, the SSB isn't sent once in all directions. The base station sends it several times in quick succession, each time in a different beam, sweeping across its coverage area. In lower FR1 bands that's up to 4 or 8 beams; in mmWave up to 64. The phone listens, picks the strongest beam, and reports it back.
Two consequences for surveying:
- An idle 5G carrier is quiet. LTE transmits reference signals across its whole channel all the time, so an idle LTE carrier still looks like a full block. 5G was designed to avoid that. With little traffic, a 5G carrier may show mostly its SSB and a few control signals: a narrower bump that comes and goes, rather than a full plateau.
- A busy 5G carrier fills out. When users are active, data fills the channel and the full width appears. So a 5G carrier can look very different at 3 am and at 6 pm. That's one reason Consentiva keeps separate baselines for night, morning, afternoon and evening.
Beamforming and massive MIMO
Mid-band and mmWave 5G antennas aren't single elements. They're panels holding many small elements, each driven with carefully adjusted timing. By changing that timing, the base station steers energy toward particular users and away from others. That's beamforming.
Massive MIMO (multiple input, multiple output) goes further: with dozens of elements and many radio chains (32 or 64 are common in mid-band designs), the base station can serve several users at once on the same frequencies, each with its own beam. Panels for this are often a little chunkier than older cellular panels because they contain the radios as well as the antennas.
For a survey, beamforming means:
- The level at your spot depends on where the beams are pointing, which depends on who is using the network nearby.
- When someone near you starts a big download, the beam toward them may pass over you and your reading jumps. When they stop, it drops.
- Two people a few metres apart can see different levels at the same moment.
- The same spot, same time of day, on different days, will vary. That's normal.
Low-band FDD sites typically use simpler antennas with wide fixed beams, so their levels are steadier.
Why 5G levels flicker
Put together, these are the reasons a 5G reading won't sit still:
| Cause | Affects | Timescale |
|---|---|---|
| TDD switching between downlink and uplink | n41, n77, n48, mmWave | Milliseconds |
| Beams steering toward active users | Mid-band and mmWave | Milliseconds to seconds |
| SSB beam sweep | All 5G, more so beamformed cells | Tens of milliseconds |
| Traffic load filling or emptying the carrier | All 5G, strongly | Seconds to hours |
| DSS sharing with 4G | Shared low-band and PCS/AWS channels | Milliseconds |
| Fading as you walk past buildings and vehicles | All bands; worse at higher frequencies | Every few steps |
| Phones nearby transmitting uplink | TDD bands and FDD uplink ranges | Whenever someone uses their phone |
None of this means the readings are useless. It means you should compare like with like: the same block, the same time of day, over several walks. That's how Consentiva's baselines work. See how to survey radio signals for the method.
How 5G looks on a spectrum display
Here's what to expect, band by band, on a sweeping receiver like a HackRF.
- Low-band (n71, n5): flat-topped blocks a few MHz to around 20 MHz wide in the downlink ranges, fairly steady. Indistinguishable from LTE by eye.
- PCS/AWS (n2/n25, n66): several flat-topped blocks side by side in the downlink ranges, from more than one carrier. Again, 4G and 5G look the same.
- n41: wide plateaus, often tens of MHz, between 2496 and 2690 MHz, with a ragged, flickering top. Near a site, they may be among the strongest signals on the display.
- n77 and n48: wide plateaus between 3.45 and 3.98 GHz, flickering, sometimes almost continuous across hundreds of MHz in a busy area.
- Uplink: short bursts in the FDD uplink ranges, and extra flicker in TDD bands, from phones near you. Your own phone counts: it's centimetres from the antenna, so its transmissions can be the strongest thing on the display for a moment.
What the HackRF itself adds
The HackRF captures about 20 MHz at a time and sweeps by hopping. A 100 MHz carrier spans several hops, each sampled at a slightly different moment. In a TDD band, one hop might land in a downlink slot and the next in an uplink slot. So a wide 5G carrier often looks uneven or stepped across its width in a single sweep, and smooths out when averaged.
The HackRF also has a weak spot at the centre of each hop, the DC spike, which Consentiva fills in from neighbouring points. Its sensitivity also varies across its range. Compare levels within one band, across walks, rather than between bands far apart. The HackRF setup guide covers gain, overload and artefacts in detail.
Finally, remember that levels are in uncalibrated dBFS unless you've entered a calibration offset, in which case they're approximate dBm. Either way, they describe what reached your antenna, not what the base station transmitted. Our guide to RF units explains the scales.
Worked example: reading a plateau's width
The width of a block on the display is a useful clue. The FCC licensed the C-band in 20 MHz blocks, so carriers' holdings, and the channels they run, come in multiples of 20 MHz. Suppose your averaged spectrum shows a flat-topped block whose edges sit at about 3,700 and 3,800 MHz.
- Its width is 3,800 − 3,700 = 100 MHz, five 20 MHz blocks.
- That's consistent with one 100 MHz 5G carrier, or two narrower carriers side by side. A sweep can't tell which.
- Its centre is 3,750 MHz. If a later walk shows a second block from 3,800 to 3,860 MHz, that's 60 MHz more, three blocks, and probably a second carrier or a second operator.
Read the edges where the level drops steeply to the noise floor, not where it starts to sag. Single sweeps make edges ragged; use the averaged chart. And treat the numbers as approximate: the sweep's frequency resolution and the HackRF's tuning steps blur edges by a fraction of a MHz or more.
Wi-Fi isn't 5G
"5 GHz Wi-Fi" sometimes gets confused with 5G. They're unrelated. 5 GHz Wi-Fi runs on unlicensed spectrum roughly from 5.15 to 5.85 GHz, and newer Wi-Fi uses 6 GHz too. On a display it's bursty and scattered, from access points and devices all around you. A strong signal at 5.5 GHz is almost certainly Wi-Fi, not a cell site.
What a HackRF and each Consentiva plan can measure
A HackRF One covers 1 MHz to 6 GHz, so it can survey all US low-band and mid-band 5G. It can't receive mmWave. Which part of that you can analyse depends on your plan.
| Band | Downlink range | Free | Standard ($29/month) | Full ($45/month) |
|---|---|---|---|---|
| n71 | 617–652 MHz | Recorded; analysis locked | Yes | Yes |
| n5 | 869–894 MHz | Recorded; analysis locked | Yes | Yes |
| n2/n25 | 1930–1995 MHz | Recorded; analysis locked | Yes | Yes |
| n66 | 2110–2200 MHz | Recorded; analysis locked | Yes | Yes |
| n41 | 2496–2690 MHz | Recorded; analysis locked | Yes | Yes |
| n77 (3.45 GHz) | 3450–3550 MHz | No | No | Yes |
| n48 (CBRS) | 3550–3700 MHz | No | No | Yes |
| n77 (C-band) | 3700–3980 MHz | No | No | Yes |
| mmWave (n258, n261, n260) | 24–40 GHz | No | No | No (beyond HackRF range) |
Free records 30 MHz–2.7 GHz and keeps recordings for 7 days, with analysis locked. Standard unlocks analysis, reports, evidence packages and video, covering up to 2.7 GHz. Full adds 2.7–6 GHz, which is where the 3.45 GHz band, CBRS and the C-band sit, plus 5 and 6 GHz Wi-Fi. There's a 3-day free trial. Details are on the plans page.
If your interest is T-Mobile's 5G, Standard covers both its main bands, n71 and n41. If it's Verizon or AT&T mid-band, you need Full for the C-band. For the frequency range, the Cellular & Wi-Fi 600 MHz – 6 GHz preset in the app covers every 5G band a HackRF can see.
Macro sites and small cells: two shapes on a walk
5G reaches the street from two kinds of installation, and they leave different footprints in a survey.
| Macro site | Small cell | |
|---|---|---|
| Where it's mounted | Towers, rooftops, tall building facades | Light poles, utility poles, low walls and bus shelters |
| What you see | Panels in groups, usually three groups pointing in different directions | A single compact box or cylinder, often with a cabinet nearby |
| Coverage | Large area, many blocks | A short stretch of street or one plaza |
| Bands | Often several at once: low-band, PCS/AWS and mid-band 5G | Often one or two bands; mmWave small cells in dense spots |
| Footprint on a walk | Levels change gradually over several blocks | A sharp rise in one block, falling off quickly either side |
A macro site usually splits its coverage into sectors, each served by its own panel facing a different direction. Walking around the base of a macro site, you may find the level dips when you're directly underneath, because the panels point outward and slightly down, aimed at the area some distance away. The strongest readings often come a block or two out, in line with a sector. That surprises people who expect the level to peak at the foot of the tower.
A small cell is lower and closer, so its signal climbs steeply as you approach and fades within a short distance. In a report, a small cell tends to show as one block with an unusual level and its neighbours normal. A macro site's change, if it adds a new band, tends to show across a cluster of blocks.
Setting up a survey for 5G bands
If 5G is your main interest, a few choices make your walks more useful.
- Pick the plan for the bands you care about. T-Mobile's n71 and n41 sit under 2.7 GHz (Standard). The C-band, 3.45 GHz and CBRS need Full.
- Choose the preset. Cellular & Wi-Fi 600 MHz – 6 GHz skips frequencies below 600 MHz, so each sweep spends its time on the bands that matter for cellular.
- Use an antenna rated to 6 GHz. A long telescopic antenna is weak at 3.7 GHz. A wideband whip specified to 6 GHz suits mid-band 5G better. Use the same one every time.
- Keep the gain moderate. Mid-band sites near street level can be strong. Start with the defaults and lower the LNA if you see the signs of overload; then keep it fixed.
- Walk at all four times of day you want to compare. Because idle and busy 5G carriers look so different, an evening baseline says little about the morning. Consentiva keeps them separate for this reason.
- Keep your own phone's activity steady. Large uploads or video calls on the survey phone during a walk put extra uplink bursts right beside the antenna. Avoid them while walking.
Finding 5G in a Consentiva report
Each report section shows 5G in a different way.
- Spectrum chart: look for the wide blocks in the ranges in the reference table. n41 and C-band carriers stand out by their width.
- Strongest signals: near mid-band sites, n41 or n77 frequencies may top the list. Note that the list gives frequencies, not technologies.
- Unusual-signal table: each entry gives a block, time and frequency where the level beat that block's baseline. Several entries in the same 5G range, in neighbouring blocks, are worth a closer look.
- Route map and timeline: show where and when the unusual readings happened, next to your marks.
- Record integrity: confirms the walk's data hasn't been changed since it was recorded, which matters if you'll show it to anyone else.
Our guide to reading a Consentiva report explains each section in full.
How to spot a new 5G site on a walk
Consentiva learns what's normal for each block of about 150 metres, separately for night, morning, afternoon and evening. It flags signals stronger than that baseline as unusual. A newly switched-on 5G site shows up as a change against that baseline. Here's how to read it.
- Build a baseline first. Walk the same route several times, at the times of day you care about, with identical settings. A baseline from one walk is thin.
- Look for unusual flags in a 5G band. In the report's unusual-signal table, check the frequency. Is it inside n41, n77, n48 or another range in the reference table?
- Check the shape. A new 5G carrier is wide: tens of MHz, flat-topped when averaged, ragged in single sweeps. A narrow spike is something else.
- Check it repeats. A cell site doesn't move. If the same band is above baseline in the same blocks across several walks, at different times of day, it's persistent. A one-off could be a vehicle, a temporary site at an event, or traffic on an existing site.
- Look for a gradient. Levels from a fixed site rise as you get closer and fall as you move away. If the unusual level peaks in one block and tapers in the blocks either side, the source is probably near the peak.
- Look up. Mid-band sites use panel antennas on rooftops, towers and building facades; small cells sit on light poles and walls. Mark what you see by voice and, on Standard or Full, take a short video clip: it carries time, GPS and the live RF reading in the picture.
- Rule out the usual suspects. Your own phone transmitting, overload from a strong nearby signal, and Wi-Fi at 5 GHz all cause false impressions. The setup guide explains the 8 dB test for overload.
- Cross-check public records. The FCC's Antenna Structure Registration database lists tall structures, and its licence database shows which carriers hold which frequencies in an area. Many small cells don't appear in structure records, so absence there proves nothing. Our guide to finding cell towers walks through these lookups.
A scenario
Say you've walked the same six-block loop near Brickell every evening for three weeks on the Full plan. One evening, two adjacent blocks are flagged with unusual signals at 3.7–3.8 GHz, about 10 dB above their evening baseline. The flag is wide, a plateau rather than a spike, and in the spectrum chart the level is highest in the middle of one block. You check the next morning: the same blocks are flagged in the same range, though the morning level is a little lower. You look up from the spot where it peaked and notice new panel antennas on a building's parapet that you hadn't marked before. You mark it with your voice and record a 20-second clip. Two walks later, the pattern holds. You haven't proven who owns it or what it carries. You have a dated, located, repeatable record that a new wide signal in the C-band appeared on a particular date, along with video and voice marks for context, and an evidence package with a hash chain that shows the record hasn't been changed. The sample report shows what that looks like.
5G and exposure limits
5G base stations and phones are covered by the same FCC radio-frequency exposure rules as earlier networks. For the general public, the FCC's limits for maximum permissible exposure are set out in 47 CFR 1.1310, as power density averaged over 30 minutes:
| Frequency | General population limit | Example |
|---|---|---|
| 300–1,500 MHz | f/1500 mW/cm² (f in MHz) | 600 MHz: 0.4 mW/cm²; 850 MHz: about 0.57 mW/cm² |
| 1,500–100,000 MHz | 1.0 mW/cm² | PCS, AWS, n41, C-band and mmWave alike |
1.0 mW/cm² is the same as 10 W/m². The limits are higher for workers in controlled settings, with a shorter averaging time.
A receiver reading from a walking survey isn't an exposure measurement. Converting a received level into power density needs a calibrated antenna with a known response at that frequency, and exposure assessment has its own procedures. Consentiva measures received levels relative to a learned baseline. That tells you what changed and where, not how it compares with a limit. The exposure limits guide explains the numbers in more depth.
Common claims, checked
| Claim | What's actually the case |
|---|---|
| "5G is millimetre wave." | Some is, but most US 5G connections use low-band and mid-band. mmWave is limited to dense spots. |
| "5G uses completely new frequencies." | Partly. The C-band, 3.45 GHz and mmWave were new for mobile; 600 MHz, 850 MHz, PCS, AWS and 2.5 GHz were already in mobile use. |
| "A 5G icon means a fast connection." | Not necessarily. It can mean low-band 5G, or NSA 5G alongside 4G. Carriers' special labels usually indicate their faster mid-band or mmWave service. |
| "5G sites aren't covered by exposure rules." | They are. FCC exposure limits apply to 5G as to earlier services. |
| "5G sites transmit at full power all the time." | Output depends on traffic. Idle 5G carriers transmit much less than busy ones, and beams follow users. |
| "mmWave passes through walls." | Poorly. Walls, glass, foliage and bodies block much of it, which is why mmWave sites are close together. |
| "Any cheap radio can see all of 5G." | A HackRF can see 5G below 6 GHz. mmWave needs specialised equipment. |
| "A spectrum survey reading shows your exposure." | No. It shows received level at the antenna, uncalibrated unless you enter an offset, and isn't an exposure assessment. |
Common mistakes when surveying 5G
- Judging from one sweep. TDD and beamforming make single readings unreliable. Use averages and repeat walks.
- Labelling a wide block as 5G from its frequency. In PCS, AWS and 850 MHz it may be 4G, 5G or both. In n41 and n77 it's more likely 5G, but you can't decode it from a spectrum sweep.
- Comparing night with evening. A 5G carrier looks quieter with less traffic. Compare against the same time-of-day baseline.
- Forgetting your own phone. Its uplink bursts are close to the antenna. Keep the HackRF's antenna a little away from the phone, and treat short bursts in uplink ranges with caution.
- Mistaking Wi-Fi at 5 GHz for 5G. Check the frequency.
- Changing gain partway through a survey. It shifts every reading, and makes old baselines unfair comparisons.
- Reading a survey as a site map. A received level tells you something's near, not exactly where or whose. Look up and check records before drawing conclusions.
Glossary
- 3GPP: the standards body that defines LTE and 5G NR.
- Beamforming: steering radio energy in a chosen direction by adjusting the timing across many antenna elements.
- Carrier: one 5G or LTE channel, with a defined centre frequency and width.
- Carrier aggregation: combining several carriers into one connection.
- C-band: in US 5G, 3.7–3.98 GHz, part of band n77.
- CBRS: Citizens Broadband Radio Service, shared spectrum at 3.55–3.7 GHz (band n48).
- dBFS: decibels relative to a receiver's full scale; uncalibrated, but good for comparisons.
- Downlink / uplink: base station to phone / phone to base station.
- DSS: Dynamic Spectrum Sharing, running 4G and 5G in the same channel.
- FDD / TDD: frequency-division / time-division duplexing, the two ways to carry both directions.
- FR1 / FR2: 5G frequency ranges: up to 7.125 GHz, and from 24.25 GHz up.
- Massive MIMO: base-station antennas with many elements and radio chains, serving several users at once.
- mmWave: millimetre-wave 5G, in the US at 24–40 GHz.
- NR: New Radio, the 3GPP name for 5G's radio technology.
- NSA / SA: non-standalone (5G with an LTE anchor) and standalone (5G core) operation.
- SSB: synchronisation signal block, the beacon phones use to find a 5G cell.
Common questions
What frequency is 5G in the US?
US 5G uses three groups of frequencies: low-band (about 600-900 MHz), mid-band (about 1.7-2.7 GHz and 3.45-3.98 GHz, including the C-band) and high-band millimetre wave (24-40 GHz). Most 5G connections use low- or mid-band; millimetre wave is limited to dense spots.
Can a HackRF measure 5G?
It can measure 5G below 6 GHz, which covers low-band, the 2.5 GHz band, CBRS and the C-band. It can't see millimetre-wave 5G at 24-40 GHz, which needs specialised equipment.
Which Consentiva plan covers C-band 5G?
The Full plan, which adds 2.7-6 GHz. Standard covers up to 2.7 GHz, which includes 600 MHz, 850 MHz, PCS, AWS and all of n41 at 2.5 GHz.
What is band n77?
n77 is the 3GPP band definition covering 3.3-4.2 GHz, used with time-division duplexing. In the US it carries the C-band (3.7-3.98 GHz) and the 3.45-3.55 GHz band.
Why does a 5G signal level keep jumping around?
Mid-band 5G is time-division and beamformed: the same frequencies switch between downlink and uplink many times a second, and the antenna steers energy toward active users. The level at one spot therefore depends on traffic and timing, so patterns over several walks mean more than any single reading.
Is 5G more powerful than 4G?
Not as a rule. 5G and 4G base stations are subject to the same FCC exposure limits. A received level on a survey also isn't an exposure measurement.
What is the difference between 5G NSA and SA?
Non-standalone (NSA) 5G uses a 4G LTE connection for control and adds 5G for data. Standalone (SA) 5G uses a 5G core network and doesn't need the LTE anchor.