CROWD MONITORING THROUGH PASSIVE 5G SNIFFING

Urban transportation systems require continuous observability of mobility demand to address congestion, overcrowding, and resource inefficiency. This thesis investigates the feasibility of estimating device concentration within a 5G New Radio (NR) Standalone (SA) cell through passive control-plane observation, enabling independent deployment without operator cooperation. The methodology exploits structural observability of Cell-Radio Network Temporary Identifiers (C-RNTIs) in Physical Downlink Control Channel (PDCCH) transmissions, which remain exposed via cyclic redundancy check (CRC) masking throughout the connection lifetime. A hybrid prototype, NR-crowd-sniffer, extends existing passive monitoring tools through three core contributions: adaptive cell-wide PDCCH sweeping with three-tier RNTI prioritization and per-slot budget enforcement, event-driven temporal aggregation with time-to-live lifecycle management, and multi-format telemetry supporting both offline analysis and real-time visualization. Validation employs a reproducible Open5GS and srsRAN testbed across ZeroMQ emulation and RF laboratory deployments with USRP B210 hardware, exercising FDD (15 kHz) and TDD (30 kHz) numerologies. Results confirm algorithmic correctness of blind PDCCH sweeping under controlled conditions, while proving heavily sensitive to channel impairments and computational constraints.