Cellular Network Infrastructure

[...] there isn't a lot of info on how packets with 3G protocols are exactly formatted.

Feel free to play with Qualcomm (or any other modems) like [1][2]. You can get quite detailed 2G/3G/4G protocol traces from them. Of course, it's not the network side, but at least you won't break the laws and would learn some basics.

[1] https://osmocom.org/projects/quectel-modems/wiki/EC20
[2] https://media.ccc.de/v/33c3-8151-dissecting_modern_3g_4g_cellular_modems

Also, you can still use SDR (not sure about bladeRF) to run something like OpenBTS-UMTS [3] (this is not an Osmocom project) and deliver RF signals over cables. Or in the Faraday cage ;)

[3] https://github.com/RangeNetworks/OpenBTS-UMTS

Thank you! I'll take a look at these links.

Hello again,

I'm thinking of trying the Faraday cage method. Does anyone have recommendations of products to use or how to build one? There are several products I'm looking at on amazon.com such as this one: https://www.amazon.com/Fabric-EMI-Shielding-Grounding-Block-Anti-Radiation-Electromagnetic/dp/B07N4RBCBN/ref=sr_1_7?crid=7JTGO6508HOX&keywords=faraday+cage&qid=1562788456&s=gateway&sprefix=farada%2Caps%2C179&sr=8-7

Would something like this fully contain 3G signals? Or could I perhaps just use aluminum foil? I'm thinking about building a small box for the cell phones and HNB, and then coating the room in aluminum foil.

Thank you for reading.