[k0ngo]

This. It is also important to note that you may interrupt the service of other people's handsets even if your BTS doesn't allow them to connect, just by operating your SDR with an insufficient clock reference [1]. The handset will re-calibrate it's VCXO to match your SDR, and then won't be able to see the legitimate cell networks.

[1] http://openbts.org/w/index.php?title=Clocks

[blantonl]

Excellent point. All cell phone sites have a GPS reference clock source for each provider. The clock source is critical for everything from RF tuning to handoff timing between sites.

You'll see this type of antenna mounted typically right on top of the equipment housing structure. Each one you see will tell you how many providers are there.

http://www.antenna.com/media/GPSL1-TMG-SPI-40NCB-thumb.png

(Note that it is small, about 6 inches in height. And different variations abound, but they are typically painted white and mounted right on the structure for LOS view to the sky)