## 3 Intelligent Jamming
### Estimation of jamming Effect  
Estimating the effect of jamming in a communication system can be complex and depends on various factors, including the characteristics of the jamming signal, the modulation scheme and the signal-to-noise ratio (SNR) of the communication channel. There is no single formula that universally applies to all scenarios, but a simplified formula for estimating the bit error rate (BER) of a communication system under jamming conditions is presented in Equation (1) [15; 16]. Calculating the minimum effective jamming power (EIRP--equivalent isotropic radiated power) and, consequently, the maximum range of a jamming device involves several factors, including the jamming device's output power, the sensitivity of mobile phones and potential interference from the surrounding environment. This can be a complex task and should be undertaken carefully for accuracy. Below are the general steps to follow:  
* Know the jamming device's output power (dBm): Start by knowing the output power of the jamming device, expressed in decibel-milliwatts (dBm). This is the actual power the device emits. * Know the sensitivity of mobile phones (dBm): Be aware of the minimum signal level that mobile phones in the affected area need to receive to operate correctly. This is their sensitivity, also expressed in dBm. * Calculate the power difference (dBm): The difference between the jamming device's output power and the sensitivity of mobile phones will determine the minimum effective jamming power needed to interfere with the signal. The power is expressed in dBm, and is given by Formula (1): \[P\text{Power}_{\text{jamming}}(\text{dB})=\text{Power}_{\text{Output}}(\text{ dB})-\text{Phone}_{\text{sensitivity}}(\text{dB})\] (1)  
The SNR, or signal-to-noise ratio, is a measure used to quantify how significant a signal is compared with the noise in a communication system or measurement. It is typically expressed in decibels (dB) and represents the ratio between the signal power and the noise power. \[SNR(\text{dB})=10\cdot\log_{10}\left(\frac{P_{signal}}{P_{noise}}\right) \tag{2}\]  
where:  
* \(P_{signal}\) is the power that is measured on the downlink connection from the network. * \(P_{noise}\) is a parameter that is measured at the output of the Hack-RF antenna. Calculating the SNR using Formula (2) can be undertaken in two different scenarios. With an RSRP \(-79.5\) dBm, as measured in the monitoring radio point, the following is illustrated in Figure 4:  
* First, the output of Hack-RF was \(15\) dBm, and using an antenna without gain, the SNR was \(-7.24\) dB. * Second, the output of Hack-RF was \(22\) dBm, and using a directional antenna with \(7\) dBi gain, the SNR was \(-5.596\) dB. We considered the RSRP measured with QualiPock installed on a smartphone because it was the closest to measuring a real scenario. The RSRP obtained with Nestor was higher just because the sensitivity of the spectrum analyser was higher than that of a mobile phone. In conclusion, to obtain an overview of how the SNR is modified by increasing the frequencies of the LTE technologies, we considered the RSRP obtained with Nestor for the LTE DL connections monitored (Figure 3) and \(P_{noise}=22\) dBm. Therefore, calculating with Formula (2):  
* The RSRP for band 20 (800 MHz) was \(-58.82\) dBm and SNR \(=-4.254\). * The RSRP for band 1 (2100 MHz) was \(-87.73\) dBm and SNR \(=-6.025\). * The RSRP for band 38 TDD (2600 MHz) was \(-85.29\) dBm and SNR \(=-5.886\). * The RSRP for band 7 (2600 MHz) was \(-81.94\) dBm and SNR \(=-5.723\). In LTE networks, SNR values typically range from around \(-20\) dB to 40 dB or more, depending on the signal conditions; an SNR below 0 dB indicates a very poor signal quality and the signal may be practically unusable [16]. In our experiments, an SNR below 0 was a very good indicator that our conditions for jamming were appropriate.