What Is Rohde & Schwarz NESTOR?
R&S NESTOR is a Windows 10-based platform from Rohde & Schwarz (Germany) for comprehensive analysis of cellular networks via the air interface — supporting all major technologies from legacy 2G/GSM through current 5G NR simultaneously. The software is designed for use by law enforcement agencies, intelligence services, armed forces, spectrum regulators, and spectrum management authorities that require complete, reliable characterization of cellular radio environments.
NESTOR operates in combination with R&S TSMx mobile network scanners (TSMA, TSME, TSMW, TSMA6B) and R&S QualiPoc smartphones. Together, they form a complete system for passive cellular network measurement and analysis — collecting signal data across all active channels, processing it through NESTOR’s scenario-based analysis engine, and delivering actionable intelligence for a range of authorized public authority use cases.
Deployment environments: NESTOR is designed to operate in virtually any environment:
- Ground vehicles (cars, vans, trucks)
- Rail (trains and trams)
- Airborne platforms (manned aircraft, helicopters, drones/UAVs)
- Maritime (ships and boats)
- Dismounted/foot (backpack and handheld configurations)
Version covered: NESTOR 22.0, with reference to subsequent features available in more recent releases.
Technology Coverage
One of NESTOR’s core technical strengths is simultaneous, parallel measurement across all supported cellular technologies in a single pass — eliminating the need for separate measurement runs per technology:
Supported cellular technologies:
- GSM (2G) — all bands, full system information message decoding
- UMTS (3G/WCDMA) — FDD mode, all bands
- LTE (4G) — FDD and TDD modes, all bands
- 5G NR (New Radio) — Sub-6 GHz bands (FR1)
- CDMA2000 — 1xRTT and EVDO standards
- EV-DO — Evolution-Data Optimized
- Wi-Fi (IEEE 802.11 a/b/g/n/ac) — with appropriate additional hardware
Automatic channel detection: NESTOR does not require prior knowledge of which channels are active in an area. Combined with R&S TSMx scanners, it scans the full frequency range (80 MHz to 6 GHz covered by supported scanners) and automatically identifies all occupied RF channels. This is critical in unknown terrain, border areas, or post-incident investigations where the network environment needs to be characterized from scratch.
Once channels are detected, NESTOR automatically forwards them to all active use cases for seamless parallel measurement — no manual channel configuration is required.
Core Analysis Capabilities
Cellular Network Coverage Survey
The foundational capability: measuring and mapping the cellular radio environment of a defined geographic area.
What NESTOR collects:
- Signal strength (RSRP, RSRQ, RSSI, SINR for LTE/5G; RXLEV, C/I for GSM; RSCP, Ec/Io for UMTS)
- Cell identity information: MCC, MNC, CID, LAC/TAC, eNB/gNB identifiers
- System information messages (SIB broadcasts) — the full set of network configuration data that base stations broadcast openly
- Frequency, band, channel number, bandwidth
- Timing and synchronization parameters
- Neighbor cell lists
Geographic aggregation (binning): NESTOR generates geographically aggregated coverage data — measurements are binned by location into a grid, producing a map of network coverage for each measured technology and frequency. The output shows:
- Where each operator’s network provides coverage
- Which cells are serving which geographic areas
- Areas of overlap between cells or operators
- Signal strength gradients across the survey area
Map integration:
- Native integration with OpenStreetMap — surveys are visualized on real street-level maps without requiring separately licensed cartographic data
- Export to GIS tools for integration with existing geographic information systems and specialized mapping software
- Top-N chart, list, and map display of all aggregated data
Parallel measurement architecture: NESTOR connects to R&S TSMx scanners via 1 Gbps LAN (supporting up to four scanners simultaneously in some configurations) for parallel, synchronous measurement across all supported bands. This ensures every cell is measured at a defined time interval regardless of the number of active technologies.
Cell Site Survey and Position Estimation
Beyond coverage measurement, NESTOR can determine the physical location and geometry of base station installations:
Cell site position determination:
- Geographic position of the transmitting base station antenna
- Sector direction estimation — which direction each antenna sector is oriented
- Works from both ground-based and airborne measurement campaigns
- Combines multiple measurement points to triangulate cell site positions
Multi-cell environment mapping: In dense urban environments where hundreds of base stations from multiple operators may be active simultaneously, NESTOR correlates measurements across multiple passes to build a complete picture of the cell site infrastructure — identifying each unique transmitter, its position, coverage area, and relationship to neighboring cells.
Airborne surveys: Airborne measurement campaigns (from aircraft, helicopters, or UAVs) provide the ability to survey large geographic areas rapidly that would be impractical to cover by ground vehicle alone. NESTOR supports dead reckoning GPS integration for accurate positioning in environments where GPS signal may be intermittent. Airborne surveys are particularly useful for border zone characterization, rapid area assessment after incidents, or large-scale spectrum monitoring operations.
Suspicious Cell Detection (Rogue Base Station Identification)
One of NESTOR’s distinctive capabilities is the detection and monitoring of irregular or unauthorized base stations — often referred to as rogue base stations — within the cellular frequency environment.
The rogue base station threat: Unauthorized transmitters operating on cellular frequencies pose two main categories of risk: they may disrupt legitimate network operations, or they may be deployed as surveillance devices targeting subscribers in a protected area. Sensitive facilities, government buildings, diplomatic installations, and critical infrastructure sites may require active monitoring for unauthorized cellular transmitters.
How NESTOR detects suspicious cells: NESTOR builds a reference model of the expected cellular network environment based on measured data. It then continuously monitors the air interface and compares detected cells against the established baseline and known network parameters. Cells that exhibit anomalous characteristics — unexpected cell identity parameters, inconsistent signal patterns, unusual system information message content, or discrepancies with network operator data — are flagged as suspicious.
Detection workflow:
- Continuous air interface monitoring in the target area
- Automatic comparison of detected cells against expected network parameters
- Real-time alerting when suspicious cells are detected
- Collection of all measurable parameters from the suspicious transmitter for further analysis
- Logging of appearance/disappearance events for time-correlation analysis
Deployment modes:
- Mobile campaigns (vehicle or foot) for area surveys
- Fixed monitoring setups for protecting specific sensitive locations on a permanent or semi-permanent basis
- Supported for GSM, UMTS, and LTE environments
Forensic Network Analysis — Law Enforcement Use Cases
NESTOR provides specialized analysis scenarios designed specifically for law enforcement and criminal investigation use, automating workflows that would otherwise require deep technical expertise:
Crime Scene Investigation (CSI) Scenario:
When a crime occurs, establishing which mobile devices were present in the area at the time of the incident is a critical investigative step. However, cellular networks are complex and constantly changing — the configuration of base stations active at the time of the crime may have changed by the time investigators arrive.
NESTOR’s CSI scenario addresses this by:
- Rapid survey of all active cells in the crime scene area
- Automatic generation of a list of cells of interest — the base stations that were covering the crime scene area at the time of investigation
- The cell list is formatted for submission to network operators to request subscriber records for devices connected to those cells during the relevant time window
- The export format is configurable to match network operator requirements, reducing administrative overhead
- Results can reduce investigation time by up to 50% compared to manual cell analysis methods
Time-critical advantage: The network environment should be measured as close to the time of the incident as possible, as base station configurations change continuously. NESTOR’s rapid automatic channel detection and streamlined workspace configuration minimizes setup time, enabling faster deployment to active crime scenes.
Alibi Verification Scenario:
When a suspect claims to have been at a specific location at the time of a crime, cellular network data can provide technical corroboration or contradiction of that claim. NESTOR automates the alibi verification workflow:
- Measure the cellular network coverage at the claimed alibi location
- Determine which base stations would have been measurable (and with what signal strength) from that location
- Compare measured coverage data against Call Detail Records (CDR) provided by network operators for the suspect’s device
- Generate a technical assessment of whether the device could have been connected to the cells indicated in the CDR from the claimed alibi location
CDR import: NESTOR can import CDR data provided by network operators or manually configure cells of interest, enabling comparison with measured network data even for retrospective investigations conducted months or years after the original incident. The network may have changed — NESTOR accounts for this through its configurable analysis parameters.
Missing Person Location Scenario:
In emergency situations involving a missing person, NESTOR can assist in defining the geographic area where the missing device was last active:
- Obtain network operator data indicating which base station(s) the missing person’s device was last connected to
- NESTOR measures the coverage area of those base stations in detail
- The coverage measurement identifies the geographic target area where the device was most likely located
- The target area output supports search and rescue teams in prioritizing search zones
This scenario can be conducted from ground vehicles, on foot, or from airborne platforms depending on the terrain and urgency of the situation.
Regulatory and Spectrum Management Use Cases
Spectrum monitoring and compliance: National spectrum regulators (telecommunications authorities, frequency management bodies) use NESTOR to verify compliance with frequency assignments, identify unauthorized transmitters, and map the actual coverage of licensed networks:
- Verify that licensed operators are transmitting on assigned frequencies and within authorized power levels
- Identify unlicensed transmitters operating on cellular frequencies
- Map actual coverage of licensed networks for comparison with claimed coverage in license applications or regulatory reporting
- Monitor for cross-border interference from foreign network operators
Network benchmarking for regulatory purposes: NESTOR can generate independent, third-party measurements of network coverage and quality for regulatory compliance assessment — supporting obligations that operators must demonstrate minimum coverage levels in their licensed areas.
Hardware Integration — R&S TSMx Scanner Family
NESTOR requires R&S TSMx mobile network scanners for measurement data collection. The scanner family includes several models optimized for different deployment scenarios:
R&S TSMA/TSMA6B — ultra-compact, battery-operated scanner for backpack and vehicle installations. Supports parallel measurement across all cellular technologies simultaneously. Connects to NESTOR via LAN.
R&S TSME — mid-size scanner for vehicle and fixed installations requiring higher measurement throughput.
R&S TSMW — wideband scanner for specialized applications requiring broader frequency coverage.
R&S TSMS8 (announced November 2025) — super wideband scanner covering 10 MHz to 8.5 GHz with front-end bandwidth up to 400 MHz and outstanding scanning speed. Represents the current state-of-the-art in the scanner family.
QualiPoc smartphones — commercially available smartphones with specialized R&S firmware for on-device testing, used alongside the TSMx scanners.
Configuration flexibility: NESTOR supports connecting multiple TSMx scanners simultaneously (up to four via 1 Gbps LAN in supported configurations) for high-throughput parallel measurement across more frequency bands than a single scanner can cover.
Software Architecture and Usability
Workspace-based organization: NESTOR organizes work into workspaces — saved configurations that define the use case, measurement parameters, data views, and analysis setup for a specific operational context. Workspaces can be created for recurring scenarios (CSI investigations, spectrum patrols, border monitoring) and rapidly loaded when needed. Pre-configured workspace templates are included for all standard use cases.
Use case framework: Within each workspace, individual use cases define specific subtasks — for example, a GSM cell position estimation use case, or an LTE coverage binning use case. Each use case has a standardized display showing measurement status and results. Multiple use cases can run simultaneously within a single workspace.
Settings modification during live measurement: All workspace settings, data views, and analysis parameters can be modified during active measurement without interrupting data collection. This is critical for field operations where the measurement environment may require on-the-fly adjustment.
User interface:
- Touchscreen optimized for tablet-based field operation — operators can work on foot or in vehicles without a keyboard
- Mouse-compatible for desktop post-processing
- Multiple user levels matching technical knowledge — experienced RF engineers and less technical law enforcement personnel can both operate the system effectively without deep cellular network expertise
- Automatic hardware configuration — connected scanners and smartphones are automatically detected and configured, minimizing setup time in time-critical situations
- Status display for all connected hardware, use cases, and workspaces in a single unified view
Export and reporting:
- Configurable export formats for submission to network operators (cell lists, coverage data)
- GIS-compatible export formats for integration with geographic information systems
- Standard report templates for investigation documentation
- Data can be post-processed in the NESTOR environment after field collection
System Requirements
- Operating system: Windows 10 (64-bit)
- Hardware: Modern laptop or tablet PC meeting R&S specifications for the connected scanner hardware; touchscreen recommended for field use
- Scanner connection: 1 Gbps Ethernet LAN to R&S TSMx scanners
- GPS: Internal or external GPS receiver for geographic position data
- Dead reckoning: Supported for airborne and indoor environments with intermittent GPS
NESTOR vs Other Cellular Analysis Tools
The market for cellular network analysis tools broadly divides into two categories: network operator tools (designed for telecom engineers optimizing commercial networks) and public authority tools (designed for law enforcement, regulators, and security organizations).
Network operator tools (e.g., R&S ROMES4, Keysight Nemo, TEOCO IQSUITE) provide RF measurements, KPI analysis, and network optimization workflows — they do not include the forensic analysis scenarios, law enforcement-specific export formats, or rogue cell detection workflows present in NESTOR.
NESTOR’s differentiating characteristics vs general network analysis software:
- Dedicated law enforcement scenario modules (CSI, alibi verification, missing person) with automated workflows not present in operator-grade tools
- Rogue base station detection with automatic anomaly flagging
- Configured for passive air interface measurement only — does not transmit
- Streamlined workspace system for rapid deployment by personnel who are not cellular network specialists
- Regulatory and intelligence organization-oriented export formats
NESTOR occupies a distinct position: it collects the same raw air interface data as operator tools, but interprets it through specialized analysis modules designed for authorized public authority use cases rather than commercial network optimization.
Frequently Asked Questions
Does NESTOR require prior knowledge of active frequencies in the measurement area? No. NESTOR’s automatic channel detection scans the full supported frequency range and identifies all active cellular channels without prior configuration. This is essential for operations in unknown environments or areas where the network configuration is not publicly documented.
Can NESTOR measure 5G NR networks? Yes. NESTOR supports 5G NR in FR1 (sub-6 GHz) bands. Combined with appropriate R&S TSMx scanner hardware (including the newer TSMS8 for extended frequency coverage), NESTOR provides the same measurement and analysis capabilities for 5G NR as for legacy technologies.
Can NESTOR be used from a drone or UAV? Yes. Airborne deployment including drones and UAVs is supported. NESTOR includes dead reckoning GPS integration for positioning in environments where GPS may be unreliable. Airborne surveys enable rapid coverage of large areas impractical to survey by ground vehicle.
Does NESTOR intercept communications content? No. NESTOR is a passive air interface measurement tool. It collects broadcast information transmitted openly by base stations (system information messages, cell identity parameters, signal measurements) and passive signal strength data. It does not intercept subscriber communications, SMS, voice calls, or data traffic content.
What training is required to operate NESTOR? NESTOR is designed for operation by personnel who are not cellular network specialists. The workspace and use case framework, automatic hardware configuration, and scenario-based workflows minimize the technical knowledge required. Rohde & Schwarz provides application training for new users. Touchscreen operation supports deployment by field personnel in mobile environments.
Summary
R&S NESTOR 22.0 is the leading cellular network analysis platform for authorized public authority use — providing law enforcement agencies, intelligence organizations, armed forces, and spectrum regulators with complete characterization of the cellular radio environment. Simultaneous parallel measurement across GSM, UMTS, LTE, 5G NR, CDMA2000, EV-DO, and Wi-Fi; automatic channel detection without prior frequency knowledge; scenario-based forensic analysis workflows for crime scene investigation, alibi verification, and missing person search; rogue base station detection; and optimized touchscreen operation for field deployment in vehicles, on foot, and from airborne platforms. The integration with R&S TSMx scanner hardware provides the measurement front-end, while NESTOR’s analysis engine transforms raw RF data into structured intelligence for authorized investigative and regulatory purposes.
For licensing assistance, contact our team via Telegram: t.me/DoCrackMe
Related: Rohde & Schwarz ROMES4 22.0 — Drive Test Software for Mobile Network Quality Measurement Guide | Rohde & Schwarz TSMx Mobile Network Scanners — Technical Overview
