Category: Applications

RTL-SDR Tutorial: Listening to TETRA Radio Channels

TETRA is a trunked radio communications system that stands for “Terrestrial Trunked Radio”. It is used heavily in many parts of the world, except for the USA. Recently, a software program called Tetra Live Monitor (telive) was released on GitHub. This software can be used along with the (patched) Osmo-TETRA software to monitor and listen to unencrypted TETRA communications.

Below we show a tutorial on how to listen to TETRA communications using a RTL-SDR RTL2832U software defined radio. This tutorial is based heavily on the telive_doc.pdf file that is written by the author of telive and included in the telive git download. Please refer to that pdf file for further details on how the software works. We have modified their tutorial slightly to make it a little easier to understand. As this code is still under heavy development if you have trouble please check their PDF file for modifications to the procedures.

Again, we reiterate: This tutorial is not a substitute for a thorough reading of the documentation. If you have trouble setting this software up, please refer to the telive documentation first, before asking any questions. It contains a comprehensive FAQ section which solves most of the common problems. The documentation can be found directly at https://github.com/sq5bpf/telive/raw/master/telive_doc.pdf. There is also a discussion at http://forums.radioreference.com/digital-voice-decoding-software/302347-tetra-decoding.html.

Decoding and Listening to TETRA Tutorial

Most of this tutorial is performed in Linux and we assume that you have some decent Linux experience. We also assume you have some experience with the RTL-SDR dongle and have a decent antenna capable of picking up TETRA signals in your area. If you don’t have a RTL-SDR dongle yet see our Buy RTL-SDR dongles page.

First, we will need to find some TETRA signals. The easiest way to do this is to open SDR# or another program like GQRX and look for them. TETRA signals are continuously broadcasting with a bandwidth of around 25 kHz. There may be several TETRA signals grouped in close proximity to one another. See the example images below.

A Zoomed in TETRA Signal
A Zoomed in TETRA Signal
TETRA Signals Zoomed Out
A Grouping of TETRA Signals Zoomed Out

An example audio clip of a TETRA signal recorded in NFM mode is shown below.

Once you have found some TETRA signals, record their frequencies. Now close SDR#, or whatever software you were using and boot into Linux. In this tutorial we use a 32-bit Ubuntu 14.04 virtual machine running on VMWare Player as our Linux system. Some of the commands may vary if you are using a different system.

Continue reading

RTL-SDR Based Passive Aircraft Radar

Over on YouTube we’ve discovered a video from earlier in the year showing the RTL-SDR being used as a passive aircraft radar. This is different to ADS-B which is a type of active radar. A passive radar works by using a very strong radio signal from a readily available source such as a TV or FM radio transmitter and detecting the reflections from aircraft.

A RTL-SDR based passive radar system can be built by connecting two RTL-SDR dongles to a single clock source and by using two directional antennas.

We’ve also posted about RTL-SDR based passive radar being used to track aircraft here and here in the past. Another post about coherent multichannel RTL-SDR receivers can be found here.

http://www.youtube.com/watch?v=xrfIv6LNG0A

Reverse Engineering a Wireless Alarm with the HackRF

Wireless alarms consist of multiples devices such as sensors and detectors which all communicate to a central control box via RF signals. Blogger “fun over ip” decided that he wanted to understand the design and security measures used by his Verisure wireless alarm by reverse engineering the system.

First, he took his HackRF software defined radio and monitored the 433 MHz and 868 MHz ISM bands whilst pushing keys on his alarms remote control. In the 868 MHz band he found a corresponding signal that had two spikes in the RF spectrum, indicating that it was likely a 2-FSK (frequency shift keyed) signal.

Next he created a GNU Radio program to demodulate the 2-FSK signal into a binary sequence. He then used Audacity to view and analyze the binary sequence, decoding it into 0’s and 1’s and determining the sync word (or access code). With further analysis he also determined the symbol rate and samples per symbol. With all this information gathered, he was then able to expand his GNU Radio program to automatically detect and decode packets sent by the various wireless devices connected to the alarm system.

His post goes into good detail about the steps that he took and is a great aide in understanding how to reverse engineer wireless protocols.

Decoding Wireless Alarms
Decoding Wireless Alarms

RTL-SDR As a Spectrum Analyzer

Hackaday has brought to attention a blog post by Kerry Wong which shows how the RTL-SDR can be used as a simple and inexpensive spectrum analyzer. In the past we’ve already posted numerous examples of the RTL-SDR being used as a spectrum analyzer but Kerry’s post discusses some of the do’s and don’ts that you need to think about when using a SDR as a spectrum analyzer and also provides some measurements.

During his tests he discovered that popular software like RTLSDR Scanner and SDR# either distort the spectrum or don’t display the signal amplitude correctly. Only GQRX and osmocom_fft seemed to give an accurate depiction of the spectrum.

Kerry also discusses how to calibrate the spectrum display to show proper power levels, how to set the gain for spectrum analysis and discusses some thoughts on LO leakage.

Using an RTL-SDR as a spectrum analyzer with osmocom_fft
Using an RTL-SDR as a spectrum analyzer with osmocom_fft

Watching a VHS Tape using a RTL-SDR

Over on YouTube user DogsRNiceMineCraft has uploaded a video showing a VHS tape being played using an RTL-SDR. To do this he connected the RF out port on his VHS tape player by wrapping the RTL-SDR stock antenna cord around the RF out cable from the VCR. He then used the TV Sharp software to view the VHS tape.

The playback quality is very poor, but the concept works!

SatNOGS – Hackaday Prize Winner uses RTL-SDR in Design

The popular Hackaday blog recently announced the winner of their grand competition to win a trip to space or $200k. The goal of the competition was to design and build the best example of “an open, connected device”. The winner of the competition is SatNOGS, a system that hopes to enable a low cost network of satellite ground stations thus enabling greater access to satellite data. The radio receiver used in the SatNOGS hardware is a standard RTL2832U R820T RTL-SDR dongle.

The SatNOGS hardware is a system that uses high gain antennas, tracking motors, a RTL-SDR and a PC running GNU Radio and other software to automatically track, receive and record satellites as they pass over head. The open source software works to automatically schedule observations and record them to an online database.

More information about SatNOGS can also be found on their website https://satnogs.org/.

The third prize winner of the Hackaday prize was the ‘PortableSDR’, which we posted about previously.

SatNOGS Hardware Tracking a Satellite
SatNOGS Hardware Tracking a Satellite
SatNOGS Hardware with RTL-SDR Dongle Visible
SatNOGS Hardware with RTL-SDR Dongle Visible

ADS-B Onboard a 737 with Realtime Primary Flight and Navigation Display

Recently we found this video from 2013 on YouTube by user carcharias04 showing an RTL-SDR being used for ADS-B on board a 737-800 commercial jet. In the video he uses a custom program that interfaces with RTL1090 and XHSI, which is a navigation display program for the popular flight simulator known as X-Plane.

With his RTL-SDR, RTL1090, his custom software and XHSI running he is able to see a real time display of the primary flight and navigation displays which are the same or similar to the instruments used by the pilots in the cockpit.

Unfortunately, it seems like the uploaders custom interface program is not available anywhere that we know of.

Update 1: The software is this interface available on GitHub. Schumann-resonance from the comments section has uploaded a precompiled binary file here http://www57.zippyshare.com/v/49667810/file.html.

Update 2: To get it to work you need to first set the Table 2 name in RTL1090 to “tableb”, then run RTL1090 first before opening RTL1090-XHSI. Then enter the ICAO of the flight you’d like to use in the text box at the top of the interface window. Now data should begin to appear in the RTL1090-XHSI Window. Now you can open XHSI and it should automatically begin using the ADS-B data.

Decoding the Russian Parus (Cosmos) Navigation Satellites with the RTL-SDR

Once again Happysat, who previously wrote in to RTL-SDR.com to let us know how to receive dead satellites with the RTL-SDR has again written in to let us know about his latest achievements.

Happysat has recently been using a RTL-SDR to decode the discontinued Russian Parus (Cosmos) Navigation Satellites. These are low earth orbit satellites operated by the Russian Space Forces that are used for military communication and navigation. Since 1974 there have been 99 Parus satellites launched, but there are only three currently active.

With an RTL-SDR, SDR# and decoder software, Happysat was able to decode data from the satellite which includes the current Moscow time and various location and telemetry data.

Russian Parus (Cosmos) Satellite Decoded Data
Russian Parus (Cosmos) Satellite Decoded Data

Happysat writes:

The Russian Military Parus satellites are/where used for low-earth orbiting navigation information and store-dump radio communications relay service for Red Navy surface vessels and submarines.

Each satellite is in a near-circular orbit of about 1000 km (620 miles).The orbits are polar (pass over the poles of the earth) and stay stationary in space so that as the earth rotates, the satellite covers different parts of the planet.

There are three currently operational, Cosmos 2407, 2414, and the last one launched in this series (April 2012) Cosmos 2463 with a lifespan of 4 years.

They are discontinued now as the GLONASS Navigation systems did take over the service which are providing a better accurate GPS position.

Why the Parus-Satellites are currently still broadcasting data is unknown. Most probably due the older vessels and submarines are still using Shkhuna Radio systems.

The satellites transmit two radio carriers, one on VHF which is FM modulated with the navigational data around 10 watts, and one on UHF which is unmodulated (tracking Beacon).

Already in 1980 the British Kettering Group was able to decode the encryption. The first 18 Bit of data contain the Moscow time, the other Bits contain the positions and orbits from the other active Parus-Satellites. Very similar data like our GPS output and the Orbcomm satellites (on 137 Mhz) with OrbcommPlotter (explained also on rtl-sdr).

With RTL-SDR and SDRSharp its possible also to decode the Russian Military Parus satellites.

Alan Cordwell did write a Java decoder that will decode the navigation data from the VHF transmission in non-real time. cosmos_export.rar [Mirror] It is experimental software and very basic.

Unfortunately his website is offline but still on web-archive (link to web archive)

You will need to record the audio from the satellite and save it as a 44100, 8-bit, mono .wav file. Which means SDRSharp included wave recording is not suitable to do this you need a external program like Audacity or any favourite which can handle the requirements above.

Then you will need to apply narrow bandpass filtering to it at 3, 5 and 7 kHz. Without this filtering step only a small portion of the data will be available, i’m still struggling with this step ;)

He did use Cool Edit Pro to do this, there are no doubt other apps available like Audacity. Included is a sample filtered audio file for you to try it with, it’s in the rar archive as well.

Unpack the archive to a convenient location a folder called cosmos-export will result. Execute the file cosdec.jar to run the application. Open a file with file/open and in the file chooser dialog select the wav file. To decode it go to Actions/Process File.

To write all output to a log file: check the Dump to log option in File menu (log file will be created with same name as audio file but with .log extension appended). Datascope does as it suggests; it launches a little frame that shows (using graphics) the waveform of the data recovered from the audio. The frequency axis is upside down! you’ll see the 3, 5 and 7kHz bits with 7 at the bottom.

There is another program (Sorcerer) which can decode in real-time only, the current actual atom Moscow time from the satellites.

[sorcer download]

Start sorcerer and go to the menu add decoder on the left FSK and choose COSMOS NAVDATA. Move the first bar slider in the spectrum to 3 kHz so the second and third are on 5 and 7 KHz as seen in the screenshot.

Its possible to run this application and record audio at the same time which is later on needed for the cosmos_export Java program.

The frequencies are as follows:

Cosmos 2407 and 2414
VHF Frequency NavData 149.970 MHz, Tracking Beacon 399.920MHz

Cosmos 2463
VHF Frequency NavData 149.940 MHz Tracking Beacon 399.840MHz

Orbital parameters and predictions:

You need to run Orbitron in SDRSharp to take care of the Doppler!

TLE’s for the current satellites, (these are current as of 10th November 2014)

COSMOS 2407
1 28380U 04028A   14313.17698750  .00000073  00000-0  59418-4 0  2927
2 28380  82.9601 332.2565 0038129 220.5020 139.3308 13.75978622517201

COSMOS 2414
1 28521U 05002A   14314.08629907  .00000094  00000-0  65641-4 0  6502
2 28521  82.9510   6.9860 0040501 164.6577 195.5838 13.87513505496523

COSMOS 2463
1 36519U 10017A   14313.57202739 -.00000009  00000-0 -27079-4 0  4041
2 36519  82.9553 122.2841 0036820   7.8477 352.3245 13.71357663227175

New ones can be downloaded at celestrak: musson.txt

Good luck and if anyone has good knowledge on how to apply narrow bandpass filtering at 3, 5 and 7 kHz, please write in the comments!

Note that Orbitron can be downloaded from http://www.stoff.pl/, and the SDR# plugin to interface with it can be downloaded from SatelliteTracker2.zip or here. A tutorial on using Orbitron with SDR# for Doppler correction can be found on our NOAA Weather satellite reception tutorial.

SDR# with Orbitron for Doppler Correction and Sorcerer for Decoding Cosmos
SDR# with Orbitron for Doppler Correction and Sorcerer for Decoding Cosmos
Image of the Russian Parus  Satellite
Image of the Russian Parus Satellite
Image of the Russian Parus  Satellite
Image of the Russian Parus Satellite
Which option to choose in Sorcerer
Which option to choose in Sorcerer