## 4 Experimental Setup and Results
### Implementation of the Jammer  
Figure 12 illustrates the block diagram of the experimental setup and the flow of data. It is shown that the spectrum analyser Nestor monitored the downlink connection and provided the laptop with all the measurements set by the operator. Through the internet, the list of downlink frequencies and channels with the received signal level was provided to the laptop that controlled Hack-RF. To perform a jamming attack, the operator of the jammer manually set the central frequencies of the downlink connections and the bandwidth. After all these parameters were set, jamming could be performed. PR100 confirmed the actual signal level and whether the jamming procedure affected the radio spectrum monitored. The objective of jamming the downlink connection as shown in Figure 13 was accomplished. It was shown that an emission next to the receiver interfered with the downlink and disrupted the communication between the network and the smartphone. Therefore, taking into consideration the Matlab-simulated scenarios, the jamming of the downlink was verified and demonstrated. Monitoring the downlink frequencies can provide important information regarding the potential for employing reactive jamming on these frequencies. The efficiency of the jamming system was determined by monitoring the downlink by considering a Hack-RF output power of 15 dBm at its maximum, along with a 7 dBi antenna gain, resulting in a total of 22 dBm. Figure 11: Experimental setup for jamming downlink connection. Figure 12: Block diagram for experimental setup. Once the downlink channels were identified with the Nestor monitoring spectrum analyser based on the frequencies, the uplink frequencies could be calculated for monitoring purposes. This allowed us to focus our monitoring efforts exclusively on these frequencies. Basically, the block diagram and flows are illustrated in Figure 14:  
Practically, any amplitude detected on the uplink frequencies provided by Nestor above \(-70\) dBm triggered an emission at the corresponding downlink frequency at the maximum Hack-RF power. Hack-RF was used for detection and emission. After 15 s, the jamming was stopped, and the process repeated in a loop. The usage of jamming only of the existing downlink frequencies in the respective area offers the advantage of using reduced processing power, as well as a much shorter time to act [19,20]. A Python script was developed for an intelligent jamming system that uses Hack-RF and calls upon a set of standardised Hack-RF manipulation libraries. Practically, the entire uplink band of 800 MHz LTE technology was scanned. The next step involves scanning these uplink frequencies to see whether there are radio signals emitted by mobile phones [12]. Figure 15 depicts the setup for the jamming downlink connection without  
Figure 14: Block diagram for experimental setup jamming downlink connection with Nestor. Figure 13: Experimental setup for jamming downlink connection with Nestor. using a spectrum analyser. As we can observe, the Python code acts directly on Hack-RF through the developed code. Once the uplink frequency is identified, the entire scanning process stops following the jamming of the mobile phone. Stopping the scan and switching to emission brings a delay time to the whole process. This time cannot be 0 s because the SDR Hack-RF is not a full duplex; therefore, it cannot receive and emit concurrently, and thus, these processes must be independent in time. To perform this test, a mobile phone registered on the Digi Mobil Romania network in the 800 MHz LTE technology was utilised and a voice call was made using this smartphone. Considering the uplink frequency band and the 100 kHz channel splitting, a spectrum scan was performed using Python code on the uplink frequencies starting from 832 MHz up to 862 MHz. The first central frequency for LTE 800 was 834.5 MHz, channel 24,175; then, all central frequencies were scanned with a spacing of 100 kHz so that only the LTE 800 channels were considered [21].