How about this kind of MLAT?

Some of the messages broadcast are reponses to inquiries by towers. The towers send the inquiries via a rotating antenna (right?), so the time of the response must occur when the aircraft is in the beam of the tower broadcast. Knowing the position of the tower antenna (by listening to the dance of other replies) it should be possible to identify the direction from the tower simply by noticing when the reply was broadcast (and correlating it to a specific tower by comparing the delay between tower inquiry and aircraft reply. Doing this for multiple towers should narrow down the position. The precision will be limited by the width of the tower’s beam, so probably not that useful, unless other MLAT calculations are missing some receivers.

How wide is the beam, by the way?

I think planeplotter’s “beamfinder” does something similar, but I think it’s more aimed at locating the radar position rather than aircraft.

Note that you generally can’t see the 1030MHz interrogations (both because they’re too far out of band for a rtlsdr tuned to 1090MHz, and because they’re line-of-sight and you probably don’t have line of sight to the radar).

Beam widths are (according to wikipedia, anyway) around 2.5 degrees.

For curiosity’s sake I tuned to 1030 MHz and after a few minutes got one packet from the tower:

x-f@atom:~$ dump1090-mutability --device-index 0 --freq 1030000000 --modeac --lat 57 --lon 25 --ppm 72
CRC: 000000
RSSI: -39.1 dBFS
Score: 1000
Time: 400410377.00us (phase: 0)
DF 20: Comm-B, Altitude Reply.
  Flight Status  : ALERT & Special Position Identification. Airborne or Ground
  DR             : 12
  UM             : 45
  Altitude       : -9999 meters
  ICAO Address   : 000000
  Comm-B MB      : 556984400c3f0c

I’m about 60 km from the airport and dump1090-mu stats usually show 2-4 surface position reports per hour.

The interrogations on 1030mhz use a completely different modulation so that is either a massively mistuned transponder or random noise

Yes, the 1030 MHz modulation is not the same, and it is a higher bandwidth. 4 Mbps if I remember right.

Beamfinder only works if your nations radars are given individual radar ID’s. Alas, at least in my area the radars are networked, and they transmit multiple radar ID’s. I think the UK must be the only country that does that.

I believe the AEW airborne radars use a fixed radar ID, but if there are two of them within range of you, then you’re hosed.

Most of the radars have a 3 degree beamwidth, and they use dual receivers so they can resolve better azimuth using monopulse, which is required for Mode-S. Some radars are still equipped to do centroiding. These spray interrogations and collect replies from aircraft from the start to the end, and then split the difference to find azimuth. These are pretty obsolete now, and only are used for ModeA and C.