I put up a detailed guide going from zero to scanning a Control Channel a while back with pertinent commands, etc: http://blog.nikseetharaman.com/gsm-network-characterization-...