# Network scan using the EM9190 dev kit **URL:** \ **Category:** MC/EM Series\ **Created:** [January 28, 2026, 6:00pm UTC](https://forum.sierrawireless.com/t/network-scan-using-the-em9190-dev-kit/35742 "2026-01-28T18:00:41Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![victor.souza](https://avatars.discourse-cdn.com/v4/letter/v/b782af/32.png) [@victor.souza](https://forum.sierrawireless.com/u/victor.souza)\ **Post date:** [January 28, 2026, 6:00pm UTC](https://forum.sierrawireless.com/t/network-scan-using-the-em9190-dev-kit/35742/1 "2026-01-28T18:00:41Z")
Hi all, We are trying to do network scan with the EM9190 dev kit, to get some stats of nearby networks (5G and LTE). In particular, we need to do this in a passive way, i.e., without having to connect to any network (no Tx basically). - Is this even possible with this module? - Or, are there any other modules that can perform this? Thank you in advance, Victor ---
**Author:** ![jyijyi](https://sea1.discourse-cdn.com/flex025/user_avatar/forum.sierrawireless.com/jyijyi/32/4766_2.png) [@jyijyi](https://forum.sierrawireless.com/u/jyijyi)\ **Post date:** [January 28, 2026, 6:15pm UTC](https://forum.sierrawireless.com/t/network-scan-using-the-em9190-dev-kit/35742/2 "2026-01-28T18:15:12Z")
if it is registered to network, you can try AT+COPS=? and AT!LTEINFO? Or you can try the MBPL SDK in linux: ```auto owner@ubuntu:~/QMI/MBPL/MBPL_SDK_R30_ENG6-lite.src/MBPL_SDK_R30_ENG6-lite.src/SampleApps/lite-qmi-nas$ sudo ./bin/lite-qmi-nashostx86_64 -o 8 [sudo] password for owner: Open transport "/dev/cdc-wdm0" on USB device in MBIM mode GetCellLocationInfo ret: 0 Mask: 0x00000004 Cell Location Information: LTEInfoIntrafreq->ueInIdle: 0 LTE Info - Intrafrequency ->plmn: 454 0615 LTEInfoIntrafreq->tac: 10101 LTEInfoIntrafreq->globalCellId: 24021527 LTEInfoIntrafreq->earfcn: 3000 LTEInfoIntrafreq->servingCellId: 437 LTEInfoIntrafreq->cellReselPriority: 0 LTEInfoIntrafreq->sNonIntraSearch: 0 LTEInfoIntrafreq->threshServingLow: 0 LTEInfoIntrafreq->sIntraSearch: 0 LTEInfoIntrafreq->cellsLen: 2 CellParams[0].pci: 437 CellParams[0].rsrq: -138 CellParams[0].rsrp: -963 CellParams[0].rssi: -624 CellParams[0].srxlev: 0 CellParams[1].pci: 237 CellParams[1].rsrq: -174 CellParams[1].rsrp: -1031 CellParams[1].rssi: -781 CellParams[1].srxlev: 0 LTEInfoInterfreq->ueInIdle: 0 LTEInfoInterfreq->freqsLen: 0 LTEInfoNeighboringGSM->ueInIdle: 0 LTEInfoNeighboringGSM->freqsLen: 0 LTEInfoNeighboringWCDMA->ueInIdle: 0 LTEInfoNeighboringWCDMA->freqsLen: 0 ``` ---
**Author:** ![victor.souza](https://avatars.discourse-cdn.com/v4/letter/v/b782af/32.png) [@victor.souza](https://forum.sierrawireless.com/u/victor.souza)\ **Post date:** [January 28, 2026, 7:43pm UTC](https://forum.sierrawireless.com/t/network-scan-using-the-em9190-dev-kit/35742/3 "2026-01-28T19:43:39Z")
Yes, these commands work fine, but only when the modem is registered to a network, or at least trading Control Plane (CP) information with them. However, we wish to have this function working regardless of CP procedures (in a more passive way). For example, some modems from a competitor brand can do a scan of nearby networks using the proprietary AT+QSCAN command, even when a SIM card is not inserted in the kit. We were hoping that this modem could behave in the same way. I think this is tied to the modem state, since many commands only seem to work under the “enabled” state. I wonder if there is any way to bypass this with some AT or QMI command? Thank you again. ---
**Author:** ![jyijyi](https://sea1.discourse-cdn.com/flex025/user_avatar/forum.sierrawireless.com/jyijyi/32/4766_2.png) [@jyijyi](https://forum.sierrawireless.com/u/jyijyi)\ **Post date:** [January 28, 2026, 11:23pm UTC](https://forum.sierrawireless.com/t/network-scan-using-the-em9190-dev-kit/35742/4 "2026-01-28T23:23:45Z")
I just tried with EM9291 and EM8695, AT!LTEINFO? can be operated when no SIM card is inserted. (AT+COPS=? can even be used for EM8695 when no SIM card is inserted) EM9291: ```auto ati3 Manufacturer: Sierra Wireless, Incorporated Model: EM9291 Revision: SWIX65C_02.17.08.00 944ad5 jenkins 2024/08/01 20:22:05 IMEI: 358186652112435 IMEI SV: 5 FSN: 83403270212345 +GCAP: +CGSM OK at+cpin? +CME ERROR: SIM not inserted at+cops=? ERROR at!lteinfo? !LTEINFO: Serving: EARFCN MCC MNC TAC CID Bd D U SNR PCI RSRQ RSRP RSSI RXLV 39050 454 12 40802 0188A92B 40 5 5 3 319 -11.2 -83.9 -52.8 40 IntraFreq: PCI RSRQ RSRP RSSI RXLV 22 -19.2 -89.9 -62.9 40 InterFreq: EARFCN ThresholdLow ThresholdHi Priority PCI RSRQ RSRP RSSI RXLV 2850 10 14 5 441 -10.7 -94.9 -75.4 29 2850 10 14 5 252 -18.2 -101.4 -75.4 22 1650 10 14 4 328 -11.9 -82.0 -62.3 42 1650 10 14 4 326 -14.2 -84.2 -62.3 39 1850 10 14 4 328 -10.8 -81.7 -63.2 42 CA SCell : EARFCN SCID Bd ST D U Mdl Mul PCI RSRP RSSI SINR WCDMA: UARFCN ThreshL ThreshH Prio PSC RSCP ECN0 RXLV OK ``` EM8695: ```auto ati3 Manufacturer: Sierra Wireless, Incorporated Model: EM8695 Revision: SWIX35C_02.01.00.02 2025/12/30 10:17:10 IMEI: 359577770012345 IMEI SV: 2 FSN: G2540554912345 TS.25: 2025.8.11 +GCAP: +CGSM OK at+cfun=1 OK at+cpin? +CME ERROR: SIM not inserted at!lteinfo? !LTEINFO: Serving EARFCN MCC MNC TAC CID Bd D U SNR PCI RSRQ RSRP RSSI RXLV 2850 454 12 40802 192D751 7 5 5 2 299 -11 -92 -61 31 IntraFreq: PCI RSRQ RSRP RSSI RXLV 299 -11 -92 -61 31 52 -16 -99 -71 24 441 -8 -91 -71 32 296 -19 -99 -71 24 InterFreq: EARFCN ThresholdLow ThresholdHi Priority PCI RSRQ RSRP RSSI RXLV 1850 10 14 4 328 -6 -74 -60 0 1650 10 14 4 328 -9 -75 -58 0 1650 10 14 4 123 -17 -85 -58 0 38852 10 24 7 -- -- -- -- -- OK at!lteinfo? !LTEINFO: Serving EARFCN MCC MNC TAC CID Bd D U SNR PCI RSRQ RSRP RSSI RXLV 38852 454 21 40802 188A98F 40 5 5 9 319 -8 -85 -56 38 IntraFreq: PCI RSRQ RSRP RSSI RXLV 319 -8 -85 -56 38 128 -19 -94 -67 29 491 -11 -89 -67 35 InterFreq: EARFCN ThresholdLow ThresholdHi Priority PCI RSRQ RSRP RSSI RXLV 39050 10 24 7 -- -- -- -- -- 2850 10 14 5 -- -- -- -- -- 1650 10 14 4 -- -- -- -- -- OK at+cops=? +cops: (1,"SmarTone HK","SMC HK","45406",7),(1,"China Mobile HK","CMHK","45412",7),(1,"China Mobile HK","CMHK","45412",12),(1,"SmarTone HK","SMC HK","45406",12),(1,"454 21","454 21","45421",7),(1,"CSL","CSL","45400",7),(1,"3","3","45403",7),(1,"CSL","CSL","45400",12),,(0,1,2,3,4),(0,1,2) OK ```