Network Reconnaissance - Through communication reconnaissance, the code stream of mobile communication cell users is obtained, and the code stream of single user are separated from the mixed code stream, which is vital for the behavior analysis and intelligent management of mobile terminals. In this process, the Cell Radio Network Temporary Identifier (C-RNTD is a specific sign of the user terminal, and is also the key to identify and separate different users code stream. However, there are few related studies on CRNTI and acquisition of code stream. To overcome the problem, the combining method about comprehensive searching of the 4th Generation Mobile Communication Technology (4G) Physical Downlink Control Channel (PDCCH), and interception of Sth Generation Mobile Communication Technology (5G) Physical Random Access Channel (PRACH) is proposed, to obtain the users C-RNTI effectively. According to the corresponding downlink control information (DCI), Physical Downlink Shared Channel (PDSCH) are correctly demodulated, descrambled and decoded to obtain the code stream within it. Finally, the communication reconnaissance receiver is used to carry out a real reconnaissance experiment on the actual 4G/5G\_ mobile communication system. The results, i.e. the obtained C-RNTI and code stream verify the correctness and efficiency of the proposed method. It lays an important technical foundation for the accurate identification and management of mobile communication user terminals.