So one of these for tx and a usb tv tuner for rx, a Raspberry Pi running OpenBTS, and you've got yourself a sub $100 IMSI catcher...
This DefCon talk: https://www.youtube.com/watch?v=fQSu9cBaojc
Gives a good overview of why you need tx to capture an IMSI - without forcing a handset into transmitting non-encrypted, you only get the TMSI (unless you can crack the crypto - and why bother, when a base station can instruct a handset to just not encrypt anything?)