Best way to estimate number of 'active' cell phones nearby
For radio systems with a 'duplex offset', that is a different frequency band for downlink and uplink, a crude estimate can be done with an aerial and spectrum analyser. Tune the spectrum analyser to the uplink band, and use some proxy like the total power, or the number of data packets that start and stop. You might calibrate this proxy by loading the network with a few phones of your own at 5am when there's little other traffic.