Category: Applications

Collecting private flight data on the World Economic Forum Atendees with an RTL-SDR

Every year politicians and business men meet at the “World Economic Forum” in the small mountain town of Davos, Switzerland to discuss various topics and create business deals. This year Quartz, an online newspaper/magazine sent a journalist to the forum. However, the journalist wasn’t tasked with writing a conventional story about the forum topics – instead he was asked to use an RTL-SDR to monitor the private helicopter traffic coming in and out of Davos using ADS-B data. They write that their reasoning for doing this as follows:

We went to all this trouble because there is perennial fascination with the flying habits of the 2,800 Davos delegates. Use of private aircraft, though often wildly overstated, highlights the vast wealth and power that descends upon this small skiing town in the Swiss Alps each year. And their transportation choices are frequently criticized for their environmental impact at a conference that seeks solutions to reducing carbon emissions, among other topics.

Using an RTL-SDR dongle, Raspberry Pi and ADS-B collinear antenna they monitored the flights over Davos. From the data they were able to determine the flight paths that many helicopters took, the types of helicopters used and the most popular flight times. They were able to identify 16 private helicopters that were used, although they write that some may not have had their ADS-B transponders turned on.

The RTL-SDR and various other components used to track the helicopters.
The RTL-SDR and various other components used to track the helicopters.
The flight path taken by the private helicopters.
The flight path taken by the private helicopters.


AISRec: Windows and Android AIS Decoder

Back in 2015 we posted about the free trial version of AISRec a few times, but we never really saw a full completed version get released. So far this year the full version is still not released, but the programmer Jane Feverlay has created a website and uploaded the latest Windows version of their trial version software

AISRec is an RTL-SDR compatible AIS decoder that is made for Windows and Android. AIS is an acronym for Automatic Identification System and is a system used by ships to broadcast position and vessel information. By monitoring AIS transmissions with the RTL-SDR we can build a boat radar system. We have a tutorial on this here (using other software).

The last time we tried AISRec we found that it had very good ability at decoding AIS messages, especially very weak ones and was by far the easiest AIS decoder to set up and use on Windows. The features include:

1. Work with all rtlsdr dongles. Allow future support for other SDR devices.
2. Stable reception of AIS signals at as low as SNR 7 dB.
3. Tolerance to frequency drifts > 30 ppm.
4. Dual-channel reception at 161.975 MHz and 162.025 MHz.
5. Channel selectivity > 56 dB.
6. Low CPU usage. No problem for Atom CPU and above.
7. Output all types of AIS messages (including Class A and Class B) in NMEA formats to UDP ports.
8. Convertion of AIVDM to AIVDO messages for your own ship.
9. Display of the received NMEA messages and the statistics.

The author of AISRec writes in an email to us an explains that the trial version has a time limit and an RX message count limit for each run, whereas the registered lite version will not. The pro version will have some additional features. Currently the author has no method for taking in paid registrations, but plans to have this ready in the future. We will post again once registration is available.

AISRec Running with OpenCPN
AISRec Running with OpenCPN


Receiving AERO-H on L-Band with an RTL-SDR

Over on YouTube Adam Alicajic (9A4QV – creator of the LNA4ALL and upcoming MIX4ALL) has uploaded a video showing his reception of AERO-H signals from an Inmarsat satellite. A few days ago we posted about how the JAERO decoder had recently been updated to be able to decode these AERO-H signals. These signals contain various messages meant for airplanes, but also sometimes contain news messages.

In the video Adam uses a satellite dish antenna together with his MIX4ALL, an RTL-SDR dongle and the JAERO software. With decent reception he is able to easily decode the AERO-H messages.

JAERO Updated: Now supports 10.5k Aero-H and Aero-H+

The JAERO decoder for AERO signals on Inmarsat satellites has recently been updated to version 1.03. This new version supports the decoding of 10.5k Aero-H and Aero-H+ signals. The author of JAERO Jonti writes that on these channels he’s seeing significantly more traffic than on the narrowband signals and that he was suprised to see that other non-aircraft messages such news was broadcast on this 10.5k signal. Jonti writes about his experience in developing the 10.5k decoder and his experience with receiving the messages in this post.

AERO is a system similar to VHF ACARS, but instead of running over terrestrial VHF it uses an L-band Inmarsat satellite link. Our first post about the JAERO decoder explains a bit about AERO, and this previous tutorial about decoding Inmarsat EGC messages may help you get set up with decoding Inmarsat signals in general.

Jonti discovered that news updates are also broadcast on 10.5k AERO.
Jonti discovered that news updates are also broadcast on 10.5k AERO.
What the 10.5k signals look like compared to the 600 signals.
What the 10.5k signals look like compared to the 600 signals.

If you like Jonti’s apps, then please remember to donate a small amount to him so that he can continue to work on them more. His PayPal donate button can be at the bottom of his main page.

Building a NEST Thermostat with Arduino and an RTL-SDR

The Nest thermostat is a smart thermostat that learns your schedule and automatically adjusts the heat in your house for optimal energy savings.  Tristan didn’t want to buy a Nest, but wanted to replicate the Nest thermostat’s functionality by using an Arduino to automatically regulate his apartments central heating boiler. To do this he needed to find a way to turn the heating on and off programatically.

Fortunately Tristan’s current thermostat is wireless, so he decided to use his RTL-SDR to sniff the data it sends to try and find the on and off signals. By using SDR# he was able to discover the radio traffic stream in the ISM band at 433 MHz. After simply recording the signal audio, he passed the audio file into Audacity to analyze the messages. He discovered that the ON and OFF signals were on-off key (OOK) modulated, and he was able to discover the binary control string and pulse timings.

With this information at hand, Tristan was then able to use a cheap 433 MHz radio transmitter together with his Arduino to replicate the ON/OFF boiler control signals. In the future Tristan plans to add a temperature sensor and web interface to monitor everything.

In the past we’ve also posted about a similar project by Tom Taylor where he reverse engineers his thermostat with an RTL-SDR and controls it with an Arduino.


DSD+ Updated to Version 1.101

DSD+ (Digital Speech Decoder+) is a popular decoding tool that can be used to listen to P25, DMR and other unencrypted digital speech signals. Recently DSD+ has been updated from version 1.074 to version 1.101.

The new version brings several changes, including the ability to decode Hytera Extended Pseudo Trunk (XPT) systems, Airspy compatibility, performance improvements and a TCP/IP link from FMP to DSD+ (no longer need to use a virtual audio cable). The full change log is as follows:

DSD+: Fixed AMBE tone frame audio generation.

FMA: Added Airspy-compatible FMP (FMPA.exe)

DSD+: Significant reduction in CPU usage when monitoring busy control channels. Improvement will be most noticeable on low power processors.

DSD+: Detection and decoding of Hytera Extended Pseudo Trunk (XPT) systems.

DSD+: The DSD+ -i command line parameter can contain an IPV4 address; this lets DSD+ connect to a copy of FMP that is running on a different PC in your local network or on the Internet

Example: DSDPlus -i192.168.1.150:20001

DSD+: NEXEDGE radio alias editing

DSD+ now marks auto-generated NEXEDGE radio aliases in the DSDPlus.radios file by prepending an asterisk like so:

NEXEDGE, … yyyy/mm/dd hh:mm, *”aliastext”

If you edit a NEXEDGE alias, you must remove the asterisk; this tells DSD+ that the new alias text is NOT auto-generated and DSD+ will not replace it with OTA alias text

FMP: FMP command line processing

The FMP command line format has been modified and is now similar to the DSD+ command line. A summary is listed here:

FMP rev 1.4t

FMP [options] Normal operation
FMP -h Show help

-i<num> RTL SDR device number (1-255) [-i1]
-o<num> Output audio device (1-255) [-o1]
-o<port> Output audio TCP port (256-65535)
-P<num> PPM value (-999.9-999.9) [-P0.0]
-g<num> RF gain (dB) [max]
-f<MHz> Initial tuned frequency [-f99.9]
-b<kHz> Initial filter bandwidth (4, 7, 9.5, 12.5) [-b7]
-z<num> Show zoomed spectrum (0-1) [-z1]
-e<num> Enable/disable economy mode (0-1) [-e1]
-n<num> Select noise filter (0-2) [-n0]
-v<num> Set volume level (0-500) [-v100]
-s<num> Enable/disable scanner mode (0-1) [-s0]
-wsl<v>.<h> Spectrum window location [-wsl50.50]
-_<num> Minimize windows at startup; bitmapped
-rv Role is trunk voice channel monitor

-rv puts FMP into voice following mode (same as pressing ‘V’ in FMP)

Any shortcuts or batch files that run FMP will have to be modified to match the new command line format.

DSD+: Less processor loading (probably only noticeable on very slow processors)

DSD+: Much faster groups/radios files loading/saving

DSD+: Editing existing radio aliases

In previous versions of DSD+, editing of pre-existing radio aliases can not be done with an external text editor while DSD+ is running; only radio records with no alias text can be edited

With DSD+ 1.092, existing radio alias text can be edited in an
external text editor while DSD+ is running; DSD+ will load and display any updated radio aliases

DSD+: A DSDPlus.radios file corruption bug has been fixed

DSD+: A command line option to add system details to event log entries has been added

-E Add NAC/RAN/DCC/RAS data to event log file entries

DSD+: Decoding of more DMR and TIII messages has been added

DSD+: A symbol recovery bug has been fixed

DSD+: Con+ handling has been modified; previous versions of DSD+ would create “DMR” entries in the DSDPlus.groups and DSDPlus.radios files for traffic on monitored voice channels; DSD+ 1.090 creates “Con+” entries; if you have “DMR” entries with nonzero NID fields, you should either bulk delete them or change their protocol string from “DMR” to “Con+”; Notepad has a simple search/replace function that can be used to do this

DSD+: A command line option to minimize windows at startup has been added

-_<num> Minimize selected windows at startup (bitmapped, 0-15) [-_0]

value window

1 console
2 source audio
4 channel activity
8 event log

sum values to minimize multiple windows

DSD+: Several high contrast display modes have been added

-H<num> High contrast mode (bitmapped, 0-63) [-H0]

two bits are used per graphical window; pressing ‘H’ in a window will cycle it to the next display mode; pressing ‘W’ displays the current -H<num> value in the event log window

DSD+: Control of AMBE and IMBE unvoiced audio levels has been added

-UA<num> AMBE unvoiced speech level (0-100) [-UA50]
-UI<num> IMBE unvoiced speech level (0-100) [-UI50]

pressing ‘A’/’a’/’I’/’i’ will also adjust the levels;
lower levels may reduce the “underwater” sound of some comms

DSD+: DSD+ can get its raw audio source from FMP via a TCP link instead of via Virtual Audio Cable or VB-Cable

-i<TCPport> FMP TCP link port number (256-65535)

linking FMP to DSD+ via VAC or VBC is deprecated; please use the TCP
link feature instead; any port number between 10000 and 65000 should be fine

DSD+: DSD+ can record separate .wav files for each voice call

-P<wav|mp3> Also create per-call wav or mp3 files

the file names encode metadata:

site number
call type (group/private)

note: per-call mp3 files are not supported at this time

FMP: A command line option to minimize windows at startup has been added

-_<num> Minimize selected windows at startup (bitmapped, 0-3) [-_0]

value window

1 console
2 spectrum display

CANFI: Cheap Automatic Noise Figure Indicator Updated to V2.7

Back in July 2014 we posted about the CANFI (Cheap Automatic Noise Figure Indicator) system. The CANFI system is a set of hardware components that include an RTL-SDR and a corresponding software program for control. Back then the CANFI system only supported E4000 dongles. However, recently CANFI was updated to version 2.7 and now supports the R820T/2 tuners as well. The documentation has also been heavily improved. The authors of CANFI introduce their system as follows:

One of the main tasks for an experimenting microwave amateur is to measure the Gain (G) and Noise Figure (NF) of a particular receiving device. For this one will need a Noise Figure Indicator and a (calibrated) Noise Source.

There are a number of commercial devices available from different vendors at prices which will exceed an amateur’s budget by many times. A lot of them can be found on the surplus market but this doesn’t help very much. A combination of both meter and noise source is barely sold below the 2.000€ margin.

Since a lot of cheap DVB – T sticks became available the idea was born to use it together with a homebrew noise source as a very cheap alternative to commercial devices [1]. It is now possible to build a suitable solution within a budget of 100 – 200€. Using a PC with USB port for communication and power supply such a device is very compact and almost compatible to an industrial solution. Special software gives a convenient user interface. Last not least you can reuse the DVB-T stick (together with the preamplifier) as a sensitive receiver along with SDR software.

To create a CANFI system you will need an RTL-SDR, a MGZ 30889 preamp, a noise source, a 28V boost converter to power the noise source and a serial to USB converter to control the noise source.


RTLSDR-Airband V2 Released

Back in June of 2014 we posted about the released of a new program called RTLSDR-Airband. RTLSDR-Airband is a Windows and Linux compatible command line tool that allows you to simultaneously monitor multiple AM channels per dongle within the same chunk of bandwidth. It is great for monitoring aircraft voice communications and can be used to feed websites like

Since our post the development of the software has been taken over by a new developer szpajder, who wrote in to us to let us know that he has now updated RTLSDR-Airband to version 2.0.0. The new versions improves performance and support for small embedded platforms such as the Raspberry Pi 2, but the Windows port is now not actively maintained and probably does not work. The full list of changes is shown below:

  •  New libconfig-style config file format
  • util/convert_cfg: can be used to convert old-style config.txt to the new format
  • Syslog logging (enabled by default)
  • Daemon mode
  • Reworked makefiles, added install rule
  • /dev/vcio is now used to access GPU on Raspberry Pi; creating char_dev no longer necessary
  • Startup scripts for Debian and Gentoo
  • Support for auto gain setting
  • Support for multiple outputs per channel
  • Support for recording streams to local MP3 files
  • Support for ARMv7-based platforms other than RPi (eg. Cubieboard)
  • Updated documentation
  • Numerous bugfixes and stability improvements

Compilation and install instructions can be found on the projects main GitHub page.