Building a Passive IMSI Catcher

Traditional IMSI catchers are illegal in most jurisdictions due to the fact that they transmit on cellular frequencies (which requires a license), and that they essentially perform a man-in-the-middle attack between a phone and mobile base station (which breaks all sorts of anti-hacking laws). The passive IMSI catcher works by capturing IMSI numbers when a phone initializes a connection to a base station. This means you will only collect IMSI numbers for devices as they move between base stations.

Source: harrisonsand.com