Some detection methods rely on this, as well as fingerprinting the Stingray (they negotiate a drop in encryption and ask the phone to max signal strength)
Current solutions for Android will point out new base stations that stand out and are likely an IMSI catcher:
http://secupwn.github.io/Android-IMSI-Catcher-Detector/
The better method, since the devices change and some are stationary, is to authenticate the real cell phone towers. This would involve either updating the GSM protocol, or having the carriers send out additional settings that make the phone aware of their legitimate sites and only connect to them.
iOS doesn't make these settings available in official API's, but if they did it would be possible to develop apps or features that could detect/avoid IMSI catchers.
The best non-tech solution is to have an anonymous IMSI. The attack relies on linking an IMSI to a real person, or the pattern behavior of a phone to a real person. So - anonymous SIM cards, change them up often, don't have it switched on with any of your real phones or real phones of friends, leave it switched off, etc.
A recent news report mentioned that a "cell tower" moved along with participants in a demonstration (in London IIRC), and also that it switched networks, so obviously someone noticed that.
Time division logic involves keeping track of how far each phone is from the tower. I think GSM uses 50m or 100m bands, ie. phones that are 200m from the tower time their broadcast bursts so as not to conflict with phones that are 100m from the tower. I don't know whether the distance information is available to the phones, or is kept internally in the tower, though. (I'm not an expert on this, I just heard that this need paid for a fair amount of NTP research/development, many years ago.)
Units are GSM symbol periods, defined to be 48/13 µs = 3.69µs, which, multiplied by the speed of light (3⋅10^8 m/s) is 1108m. As the distance contributes in both ways (from base-station to handset, and back) one timing advance step is half the distance: about 550m.
The base station measures the relative phase of received transmissions from the mobile and will send information to the mobile to set or adjust the timing advance. [look for "timing advance" in http://www.etsi.org/deliver/etsi_gts/04/0408/05.03.00_60/gsm... which specifies the information elements that are exchanged.] So, yes, it should be possible to get TA for each cell the mobile exchanges data with from the phone.
I'm reminded of a British comedy that included a poacher being caught after a tagged animal was found to be traveling at 55mph down the m5.