How does direction finding work when using GMS mobile station and additional handset? I am trying to understand the concept of direction finder (DF), for mobile GSM devices.

I have found the following description:

http://www.pki-electronic.com/products/interception-and-monitoring-systems/gsm-direction-finder/

It seems to describe the following configuration:

&lt;IMSI catacher&gt;-------- &lt;additional handset (mobile)&gt;
|
|-------- &lt;target mobile device&gt;


According to web site description, it is composed of IMSI catcher (probably), i.e. active base station, which force the target mobile to transmit, and probably the attacker base station (SDR radio) can detect the exact direction/signal strength of the attacked device.

I am not sure how it works, but this is what I think:


The base station (which is also a receiver) force the target mobile to keep transmission (by sending silent sms which force the mobile to transmit ack).
The additional handset is actually a second receiver.
So we get 2 receivers (handset and base stations) , each can find the signal strength. 
We can draw a map, with 2 circles, and the merge points will point us to the correct direction.


Do you think this is how it works ? any comment is appreciated.

EDIT:
Can someone please give a description how it is done and what is the purpose of the handset ? Is it a reciever of just an antenna ?

Thanks.
The fact that this thing only has a single antenna port and a loudness knob:

This will just look for a transmitter in the band of interest, and you'll have to turn around a directive antenna until the tone gets loud. 

That's absolutely low-tech, it can't discern between GSM phones logged into the same network (and also active), and the whole setup will only work if the straightest path to the phone is also the one that delivers the most energy – which is not the case for e.g. a lot of the indoor and urban mobile channel scenarios that we use nowadays.