OFDM Protocol Fingerprinting

The time-frequency grid arrangement of known reference signals (pilots) is a primary discriminative feature. Different standards (LTE, 5G NR, Wi-Fi 6) and even different antenna port configurations within a standard use distinct pilot densities and placements.

• LTE: Cell-specific Reference Signals (CRS) are scattered across the entire bandwidth in a fixed diamond pattern, present even without user data.
• 5G NR: Uses a leaner design with Demodulation Reference Signals (DMRS) confined to scheduled resource blocks, appearing only when data is transmitted.
• Wi-Fi 802.11ax: Employs highly dense pilot subcarriers within each OFDM symbol to enable phase tracking for higher-order QAM.

The time-domain waveform at the start of a transmission burst contains unique sequences optimized for detection and coarse synchronization. The sequence type, length, and repetition structure directly map to a specific protocol.

• LTE PSS/SSS: Uses Zadoff-Chu sequences (length-63) for the Primary Synchronization Signal and m-sequences for the Secondary Synchronization Signal, located in fixed central subcarriers.
• 802.11a/g/n/ac: Begins with a Short Training Field (STF) of 10 repeating 0.8 µs symbols for packet detection and AGC, followed by a Long Training Field (LTF) for channel estimation.
• 5G NR SSB: Combines PSS, SSS, and PBCH DMRS into a single Synchronization Signal Block transmitted in beam-swept bursts.

The cyclic prefix (CP) length is a fundamental OFDM parameter that varies between standards and operating modes. Blind CP length estimation reveals the protocol family and deployment scenario.

• LTE Normal CP: 4.7 µs (short CP) for typical urban deployments.
• LTE Extended CP: 16.7 µs for large cells or multicast broadcast single frequency networks (MBSFN).
• 5G NR Scalable CP: Normal CP length scales inversely with subcarrier spacing (e.g., 2.3 µs for 30 kHz SCS, 1.1 µs for 60 kHz SCS).
• Detection Method: Autocorrelation at a lag equal to the useful symbol length (Tu) produces a plateau whose width equals the CP duration.

The temporal hierarchy of radio frames, subframes, slots, and symbols is a protocol-specific fingerprint. The number of OFDM symbols per slot and the slot duration are determined by the numerology.

• LTE FDD: Fixed 10 ms radio frame with 10 subframes, each containing 2 slots of 7 OFDM symbols (Normal CP).
• 5G NR Flexible Numerology: Slot length varies from 1 ms (15 kHz SCS) down to 125 µs (120 kHz SCS), with 14 OFDM symbols per slot.
• TDD UL/DL Patterns: The specific sequence of uplink, downlink, and flexible slots in a TDD frame reveals the operator's configuration and can identify the network vendor.

The subcarrier spacing (SCS) and the number of active resource blocks define the occupied bandwidth and are key discriminators between 4G and 5G, as well as between 5G frequency ranges.

• LTE: Fixed 15 kHz SCS with bandwidths from 1.4 MHz (6 RBs) to 20 MHz (100 RBs).
• 5G NR FR1: Supports 15, 30, and 60 kHz SCS with channel bandwidths up to 100 MHz (273 RBs at 30 kHz SCS).
• 5G NR FR2 (mmWave): Uses 60 and 120 kHz SCS with bandwidths up to 400 MHz (264 RBs at 120 kHz SCS).
• Wi-Fi 6: 78.125 kHz SCS for 20 MHz channels, with 256 subcarriers per symbol.

The location and structure of control regions within the resource grid provides a high-confidence protocol fingerprint. The presence, absence, and configuration of specific control channels are standard-defining.

• LTE PDCCH: Spans the first 1-3 OFDM symbols across the entire system bandwidth.
• 5G NR CORESET: A flexible time-frequency region configured for PDCCH transmission, not necessarily at the start of a slot and not spanning the full bandwidth.
• PBCH Payload Decoding: Successfully decoding the Master Information Block (MIB) provides explicit protocol parameters including system bandwidth, PHICH configuration (LTE), and subcarrier spacing offset (5G NR SSB).

A foundational data-aided synchronization algorithm that uses a specially designed training symbol with two identical halves in the time domain. It enables robust joint estimation of symbol timing and fractional carrier frequency offset without prior channel knowledge.

• Exploits the autocorrelation of the repeated preamble structure
• Provides the initial timing reference for subsequent protocol-specific decoding
• Widely implemented in Wi-Fi (802.11a/g/n/ac) and other OFDM standards

The unique spectral correlation pattern generated by the cyclic prefix and embedded pilot subcarriers. This signature is a powerful discriminator for blind protocol identification because different standards (e.g., LTE vs. Wi-Fi) exhibit distinct cyclic frequencies.

• Enables robust detection even under low signal-to-noise ratio (SNR) conditions
• Reveals the symbol duration and guard interval length
• Used to distinguish between normal and extended CP modes in LTE

The initial step in the LTE cell search procedure that uses a Zadoff-Chu sequence in the time domain. PSS detection acquires 5 ms slot timing and the physical-layer cell identity sector number (N_ID2).

• Provides a strong correlation peak for coarse time synchronization
• Identifies one of three orthogonal Zadoff-Chu root sequences
• The first structural element decoded in a complete protocol fingerprint

A UE-specific or cell-specific pilot signal embedded within the resource block allocation. DMRS provides the phase and amplitude reference for coherent demodulation, and its configuration—such as density, port mapping, and scrambling identity—is highly protocol-specific.

• In 5G NR, DMRS supports up to 12 orthogonal antenna ports
• The time-frequency pattern reveals the waveform numerology
• Front-loaded DMRS patterns indicate low-latency URLLC configurations

A technique that estimates the cyclic prefix duration of an unknown OFDM signal by analyzing the autocorrelation lag profile. The CP length is a critical parameter that distinguishes between standard configurations.

• Normal CP: 4.7 µs (LTE/5G NR below 6 GHz)
• Extended CP: 16.7 µs (used in large cells or MBMS)
• The correlation peak spacing directly reveals the composite symbol length (Tsym = Tfft + Tcp)

A 5G NR downlink signal burst composed of the PSS, SSS, and PBCH DMRS transmitted in a beam-swept manner. The SSB structure and periodicity (default 20 ms) are fundamental to NR protocol fingerprinting.

• Carries the physical cell identity and the Master Information Block (MIB)
• The SSB index within a burst reveals beamforming configuration
• Subcarrier spacing of the SSB indicates the frequency range (FR1 or FR2)