## 2 Methodology
### Radio Monitoring Equipment  
For the measurement campaigns, two main measurement devices were used:  
* The NARDA SRM-3006 (Narda Safety Test Solutions GmbH, Pfullingen, Germany) is a spectrum analyzer that allows selective frequency measurements for safety analysis and environmental measurements in high-frequency electromagnetic fields, with a range from 9 kHz to 6 GHz [1]. The complete SRM-3006 measurement system consists of a Basic Unit SRM-3006 and a three-axis antenna, which enables quick and simple isotropic measurements, with automatic determination of the three spatial components of the electromagnetic field, as illustrated in Figure 1[13]. The NARDA SRM-3006 is widely used to monitor the coverage of cellular mobile networks and local wireless networks [1]. As signals in this frequency range of such magnitude are very difficult to sample digitally [13], this equipment combines analogue and digital signal processing to ensure absolute values, and limits high-frequency electromagnetic fields. * The R&S\({}^{\text{\textcircled{R}}}\)TSME6 scanner (Rohde & Schwarz GmbH & Co. KG, Munich, Germany) is used for the analysis and optimization of mobile networks, as shown in Figure 2. This scanner, combined with the R&S\({}^{\text{\circled{R}}}\)ROMES4 unit test software, version 21 (64-bit), can detect all available mobile network technologies across a frequency range from 9 kHz to 6 GHz, such as 5G NR, LTE, NB-IoT, and GSM, among others [1]. In addition to identifying the available mobile network technologies, the R&S\({}^{\text{\circled{R}}}\)TSME6 can perform  
Figure 1: Narda SRM-3006 spectrum analyzer. essential tasks involved in coverage measurements, such as detecting external interferences, measuring performance, and conducting quality analysis in mobile networks, e.g., bandwidth, total power received within the operator's bandwidth [1; 10]. The combination of the scanner with R&S\({}^{\text{\text{\textregistered}}}\)ROMES4 software allows viewing the available mobile networks, and which frequencies they are available on, while indicating the bandwidth and central frequency. The scanner supports various protocols such as 5G NR, GSM, LTE, NB-IoT, LTE-M, and TETRA. R&S\({}^{\text{\textregistered}}\)TSMA6 offers a detailed and comprehensive analysis of various parameters, performs an automated and reliable analysis, provides the view graphs of all detected technologies (with information to analyze various components of the cellular mobile network), with reduced energy consumption. The scanner combined with the R&S\({}^{\text{\textregistered}}\)ROMES4 unit test software also facilitates visualizing the timeline (with transmissions detected by the scanner) in graphical format. At the bottom of the homepage shown in Figure 3, in the lower horizontal bar, various menus with different functionalities are offered by the software: Welcome, Automatic Channel Detection (ACD), Navigation, 3 GPP2 (CDMA200) Scanner, GSM Scanner, LTE Scanner, NB-IoT Scanner, and UMTS Scanner. Details are as follows: the Welcome menu lists all previously mentioned menus, while the ACD menu displays the frequency range and detected technologies, as shown in Figure 3.  
Figure 3: View of the automatic channel detection menu. Figure 2: R&S\({}^{\text{\textregistered}}\)TSME6 drive test scanner. The Navigation menu allows users to check the estimated route of data collection and estimate the geographic positions of base stations (with the indicated transmission directions), as shown in Figure 4. The 5G NR Scanner presents technologies detected in 5G NR, including received signal strength indicator, RSSI [dBm], graphs, and related parameters (e.g., Physical Cell ID). The LTE Scanner allows users to view detected technologies, power [dBm] graphs, and associated parameters. The NB-IoT Scanner shows the detected operators' networks in NB-IoT, including New Radio Signal Strength, NRSS [dBm], view graphs (through NRSSI), and related parameters. The 3 GPP2 Scanner displays the operators (i.e., CDMA2000) at any point.