Category: Applications

Sniffing ANT-FS with an RTL-SDR and MMDS Downconverter in Pothos

ANT-FS is a wireless file transfer protocol that is designed specifically for transferring files wireless between two devices. It is designed for ultra low power devices and typically runs on devices operated by a coin sized battery. It is commonly used in applications like fitness tracker devices, which store data to later be downloaded to a PC.

Over on YouTube user sghctoma has uploaded a video showing a teaser of him receiving and decoding ANT-FS packets with blocks developed for the POTHOS graphical language. As ANT-FS is usually transmitted at 2.4 GHz, he had to use a MMDS downconverter which allowed his RTL-SDR to receive the packets. Sghctoma writes that the video is simply a teaser, and that a live demo with real deivce, and the full code + details will be released during his talk at DEFCON titled “Help, I’ve got ANTs!!!”.

Building a Quad RTL-SDR Receiver for Radio Astronomy

Amateur radio astronomer Peter W East has recently uploaded a new document to his website. The document details how he built a quad RTL-SDR based receiver for his radio astronomy experiments in interferometry and wide-band pulsar detection (pdf – NOTE: Link Removed. Please see his website for a direct link to the pdf “Quad RTL Receiver for Pulsar Detection”. High traffic from this post and elsewhere has made the document go offline several times). Interferometry is a technique which uses multiple smaller radio dishes spaced some distance apart to essentially get the same resolution a much larger dish. Pulsars are rapidly rotating neutron stars which emit radio waves, and the strongest ones can be observed by amateur radio telescopes and a receiver like the RTL-SDR.

The Quad receiver has four RTL-SDR’s all driven by a single TCXO, mounted inside an aluminum case with fans for air cooling. He also uses a 74HC04 hex inverter to act as a buffer for the 0.5 PPM TCXO that he uses. This ensures that the TCXO signal is strong enough to drive all four RTL-SDRs.

The Quad RTL-SDR with air cooling.
The Quad RTL-SDR with air cooling.

Whilst all the clocks are all synced to a single master clock, synchronisation between the RTL-SDR’s is still difficult to achieve because of jitter introduced by the operating system. To solve this he introduces a noise source and a switch. By switching the noise source on and off, correlation of the signal data can be achieved in post processing.

Noise Source and Switch Calibration Unit.
Noise Source and Switch Calibration Unit.
How correlation with the pulsed noise source works.
How correlation with the pulsed noise source works.

In the document Peter shows in detail how the system is constructed, and how it all works, as well as showing some interferometry results. The system uses custom software that he developed and this is all explained in the document as well.

Using the SUP-2400 Downconverter with an LNA and RTL-SDR to Receive 2.4 GHz Video

Earlier in June YouTube user T3CHNOTURK posted a video demonstrating him receiving signals above the maximum 1.7 GHz range of the RTL-SDR by using a modified SUP-2400 downconverter. Back in April it was discovered by KD0CQ that a $5 DirecTV SUP-2400 circuit could be modified and turned into a downconverter for use with the RTL-SDR.

Now T3CHNOTURK has uploaded a new video showing more demonstrations of the RTL-SDR + SUP-2400 combo in action. This time he adds a PGA-103 based LNA to boost the signal strength, which gives him better effective range. In the video he shows reception of a wireless keyboard once again, and then goes on to show him receiving 2.4 GHz analog PAL video using the RTL-SDR program TVSharp. The picture is not particularly clear, but it is a decent demonstration.

Remote Spectrum Monitoring Drone with OpenWebRX, Raspberry Pi and an RTL-SDR

Recently Zoltan of wrote in to us to show us how he combined efforts with András (programmer of the OpenWebRX software) to create a proof of concept remote spectrum monitoring drone. The drone uses an RTL-SDR connected to a Raspberry Pi, and the Raspberry Pi runs an OpenWebRX server which broadcasts the radio data via 4G mobile internet. The full connection flow chart goes as follows:

[Drone] Antenna –> RTL-SDR –> RPi 2 –> OpenWebRX Server –> 4G mobile net –> … Internet … [Notebook] –> 4G mobile net –> Browser with OpenWebRX client

Zoltan writes that some possible applications include emergency communications, ham radio, 3D spectrum mapping, etc. In the future he also hopes to add TX capabilities, so that the drone can also work a a makeshift transceiver tower. The biggest limitation that Zoltan noted is the flight time of only about 10 minutes. However, a solution he suggests for future experiments is using wire powered drones.

In previous posts we showed Hak5’s remote RTL-SDR ADS-B drone. Their results were not particularly great, however Zoltan and András’ results seem to be much better.

The video below shows an example of Zoltan and András’ drone experiments.

Broadcasting DVB-S2 with the LimeSDR

The LimeSDR is a $299 USD software defined radio that has RX and TX capabilities, a tuning range of 100 kHz – 3.8 GHz, a 12 bit ADC and up to 61.44 MHz worth of bandwidth. It is currently seeking crowdfunding over at, and there are still 170 early bird units available at a lower price of $249 USD. The funding campaign ends in 14 days at the time of this post.

In a recent blog post on the myriadrf website, beta tester Alexandru shows how the LimeSDR can be used to transmit DVB-S2 video using GNU Radio.  Alexandru used bladeRF dvbs2_tx.grc gr-dtv example which is provided with GNU Radio and modified it for the LimeSDR. He then transmitted the video stream and used an off the shelf satellite TV receiver to display the video, and an Airspy to monitor the spectrum. The gr-dtv library can also be used to transmit other video standards such as ATSC, DVB-T, DVB-T2, DVB-C and DVB-S2.

LimeSDR DVB-S2 GNU Radio Flowgraph
LimeSDR DVB-S2 GNU Radio Flowgraph

IF Average SDR# Plugin Updated

The IF Average tool is a RTL-SDR compatible plugin for SDR# which allows you to plot an average of the current spectrum shown in SDR#. This is especially useful for radio astronomers who often need to average the spectrum for a long time in order to get a good plot of the Hydrogen Line. Recently the plugin was updated to support newer versions of SDR# and to upgrade some features. Daniel Kaminski, the author of the plugin writes:

I used ultrafast FFT which works on 4k to 512k bit space. With this plugin it is possible to average up to 64000000 samples in real time. XNA allows to shows the calculation results in real time.

To install the plugin you will need to install the XNA Framework 4.0 Redistributable first. Then copy the plugin files over to the SDR# folder and add the “magicline” to the SDR# Plugins.xml file.

The IF Average SDR# Plugin
The IF Average SDR# Plugin

A Demonstration of the RTL-SDR Receiving WiFi and 2.4 GHz ISM with a Modded SUP-2400 Downconverter

Back in April we posted about how KD0CQ found that he could receive signals up to 4.5 GHz with an RTL-SDR by using a $5 downconverter for DirecTV called the SUP-2400. The RTL-SDR can only receive up to a maximum frequency of about 1.7 GHz, but the SUP-2400 downconverter can be modified to convert frequencies at around 2.4 GHz down into a range receivable by the RTL-SDR.

When we first posted the story the instructions for modifying the SUP-2400 to use as a downconverter weren’t uploaded yet, but they are now. The modification requires decent soldering skills as it involves desoldering a few small SMD components and bridging some points with wires.

Over on YouTube user T3CHNOTURK has uploaded a video showing the downconverter in action. With the SUP-2400 downconverter and RTL-SDR he is able to receive some WiFi at 2.447 GHz as well as signals from a wireless keyboard at 2.465 GHz

Monitoring Ionosondes and Creating Ionograms with a USRP and GNU Chirp Sounder

In the HF region between about 0 – 30 MHz it is common to see and hear “chripers” – signals which quickly sweep through the HF frequency band and produce an audible chirp. These chirps are actually signals from Ionosondes which is a type of radar system used to monitor the Ionosphere. The Ionosphere exists about 50km above the surface of the earth and is the atmospheric layer responsible for a large part of long range HF communications. In a previous post by Mario Filippi we also discussed Ionosondes.

Usually it is scientists who transmit and monitor these Ionosondes, however if you have wide band radio that can cover a majority of the HF spectrum then you can also monitor these chirpers yourself. Over on his blog Fabrizio Francione has created a post showing how to use a USRP, together with a GNU Radio Program called GNU Chirp Sounder to create his own amateur Ionogram monitoring station. The USRP is a fairly expensive SDR with a bandwidth of 25 MHz, but we add that we think that next generation of low cost wide band SDRs like the up and coming LimeSDR should also be able to do the same job.

The Ionograms show at what frequencies HF propagation is currently optimal for a specific distance (or number of signal bounces from the Ionosphere). Below is an example Ionogram animation showing the reception of Ionosondes taken over time. Video from the GNU Chirp Sounder page.