Cell tower unencrypted headers

Hello Experts,

Looking online I couldn’t find a paper describing the PHY and MAC layers of LTE.
More specifically, what headers are sent from the cell tower in idle mode, or in the first interaction with mobile device.

I look for some way to get an “ID” or MAC adress of the tower in a passive way.

Thank you!
ET