Reverse Engineering Wireless Mobile Traffic Lights with an RTL-SDR

When roadworks suddenly appeared on Bastian Bloessl’s girlfriends street the workers put up a set of automated wireless traffic lights to control the flow of traffic during the works. Seeing these lights, Bastian quickly grabbed his RTL-SDR dongle and got to work on reverse engineering the status telemetry signals transmitted by these lights.

Wireless traffic lights reverse engineered with an RTL-SDR
Wireless traffic lights reverse engineered with an RTL-SDR

Bastian discovered two signals at around 170 MHz which corresponded to two pairs of lights. By analyzing the signal in Baudline and Audacity he discovered that the signal was AFSK1200 modulated between 1200Hz and 2400Hz. He then created a simple GNU Radio program which was able to output the frame bit data. After some analysis he was able to make sense of the structure and create a simple web interface that visualized the data as virtual traffic lights on his PC. The YouTube video below shows the signal and his RTL-SDR decoding software in action.

It seems that the telemetry is unencrypted, however we would assume that the control signals are encrypted.

Reverse Engineering a Vintage Wireless Keypad with an RTL-SDR

Over on his blog, Veghead has posted about how he was able to reverse engineer a wireless alarm panel keypad from 1986 with an RTL-SDR dongle. The goal of his reverse engineering was to be able to eventually hook it up to a modern alarm system.

By first looking at the old FCC label on the keypad, Veghead discovered that the device transmitted between 319 MHz and 340 MHz. He then used his RTL-SDR dongle to take a recording of the transmitted signals, before opening them up in Audacity – a free audio processing program.

By analyzing the waveform in Audacity, Veghead discovered that the alarm panel uses simple ON-OFF Keying (OOK) modulation. Although the frequency of the signal drifted a lot (probably due to aged components), he was able to write a decoder that he called cletus which converts the recorded complex I/Q signal into a real signal and then uses a state machine to turn the waveform into 1’s and 0’s. Finally the program then outputs the correct button that was pressed to the terminal.

Vintage wireless alarm keypad reverse engineered with an RTL-SDR
Vintage wireless alarm keypad reverse engineered with an RTL-SDR

Modifying an Aluminium Case to fit into our SMA RTL-SDRs

Recently we started selling modified RTL-SDR units that came with a more sturdy and common SMA antenna connector and a TCXO temperature compensated oscillator. At the moment our dongles are enclosed in a plastic shell. One simple way to improve the performance of an RTL-SDR is to enclose it inside a conductive metal box. This helps prevent out of band interference from strong signals that may enter the device directly and not through the antenna.

At the moment we do not sell any metal enclosures for our SMA unit (but we are working on one). In the mean time one of our customers has been able to modify an enclosure made for the older style dongles with MCX connectors, to be able to fit our new SMA unit. To get the dongle to fit they simply file down the edges of the PCB and drill a new hole in the case to fit the SMA connector.

We note that for good performance with a metal case it is very important that the metal be conductive, and make a good electrical connection to the dongle’s ground. The case purchased was anodized aluminum, which is non-conductive. It is important to file down the coating to ensure a good electrical connection is made otherwise the case will not work.

Modifying an RTL-SDR aluminium case to fit our new SMA RTL-SDRs.
Modifying an RTL-SDR aluminium case to fit our new SMA RTL-SDRs.

Changes to SDR#: Update to .NET 4.6, Linux support and new install procedure

SDR# (SDRSharp) is probably the most popular software program that is used with the RTL-SDR. It is free, fast and fairly easy to use.

SDR# is coded in C# and so runs on the Microsoft .NET runtime. SDR# has always used the 3.5 version of the .NET runtime, however recently the programmers have made the decision to upgrade the runtime used to the latest 4.6 version of .NET. For non-programmers this means that compatibility with newer operating system such as Windows 10 is enhanced, performance and stability is improved and that SDR# can now be run on Linux and OSX with Mono 4.0. The downside is that Windows XP and Vista are no longer supported operating systems (Vista SP2 is supported). An OS compatibility list for .NET 4.6 can be found here.

If you are an SDR# user and run an older operating system such as XP or Vista we suggest that you either upgrade your OS, or simply continue to run the older versions of SDR#.

In addition to the new changes, the install procedure has also changed. Firstly, the old website now redirects to To install SDR# now, simply download SDR# zip file from Unzip it to any folder on your PC. Next, to download the RTL-SDR drivers simply run the install-rtlsdr.bat file. We will soon be updating our Quickstart guide to incorporate these changes.

To install SDR# on Linux or OSX you can follow the guide over at

The official announcement is as follows:


We have been relying on the .NET Framework 3.5 for quite some time until it’s no longer installed by default into the new operating systems. Microsoft also provides minimalist support of this version of the Framework on Windows 10 which handicaped the core and plugin developers in many ways. This also resulted in obscure bugs in the user base. So we moved recently the entire code base to the .NET 4.6 in order to refresh the software and make it compatible with modern operating systems like Windows 10.

This has many implications:

  • Better performance
  • Better programming API
  • Support of Windows 10
  • Support of Linux and Mac with Mono 4.0 and up
  • End of support of Windows XP and Vista
  • End of support of the ExtIO interface (not portable)

We coordinated this migration with all the plugins and front-ends developers so no body misses the boat.
The installation procedure has also changed and now the main package contains a batch file to download the dependencies required to run RTL-SDR.
This might be disturbing for a few, but the overall impact was judged positive and a better investment for the future, especially with the new API offered by .NET 4.6.


The SDR# Team


DesktopSDR MATLAB RTL-SDR Text Book Released

Back in August we posted about an RTL-SDR related text book called DesktopSDR that was due to be released later in the month. The text book discusses technical SDR topics, with the RTL-SDR used as the radio receiver and MATLAB used as the digital signal processing tool. It looks to be very useful to students of radio or communications engineering. There were a few delays with the release, but it is now out at The eBook version is free whilst the print version is soon to be released on Amazon for about $68 USD for the paperback and $89 USD for the hard back

To go along with the book they have also released several accompanying videos that are available at

The books blurb reads:

The availability of the RTL-SDR device for less than $20 brings software defined radio (SDR) to the home and work desktops of EE students, professional engineers and the maker community. The RTL-SDR can be used to acquire and sample RF (radio frequency) signals transmitted in the frequency range 25MHz to 1.75GHz, and the MATLAB and Simulink environment can be used to develop receivers using first principles DSP (digital signal processing) algorithms. Signals that the RTL-SDR hardware can receive include: FM radio, UHF band signals, ISM signals, GSM, 3G and LTE mobile radio, GPS and satellite signals, and any that the reader can (legally) transmit of course! In this book we introduce readers to SDR methods by viewing and analysing downconverted RF signals in the time and frequency domains, and then provide extensive DSP enabled SDR design exercises which the reader can learn from. The hands-on SDR design examples begin with simple AM and FM receivers, and move on to the more challenging aspects of PHY layer DSP, where receive filter chains, real-time channelisers, and advanced concepts such as carrier synchronisers, digital PLL designs and QPSK timing and phase synchronisers are implemented. In the book we will also show how the RTL-SDR can be used with SDR transmitters to develop complete communication systems, capable of transmitting payloads such as simple text strings, images and audio across the lab desktop.

Download the book at
Download the book at

4NEC2 The Definitive Guide Book

4NEC2 is a freeware antenna simulation software program. The program can be used to model an antenna, and then determine through simulation properties such as the radiation pattern and SWR of the modelled antenna. It is very useful for those designing home made antennas for their RTL-SDR or other radio, or for those just trying to understand how antennas work. 

4NEC2 can be a complicated piece of software and to get the most out of it a guide is needed. We’ve recently been informed that Mark Schoonover KA6WKE, is writing an eBook guide on this topic. His guide is currently only 20% complete, but a free sample of his book in its current state can be downloaded from leanpub. The guide already shows what the main windows of 4NEC2 do, and shows you how to model and simulate a simple dipole antenna.

4NEC2: The Definitive Guide
4NEC2: The Definitive Guide

Building an active wideband antenna for your SDR

As the RTL-SDR and other SDRs are wideband, we recommend that people use a wideband antenna if they want to scan over all the frequencies. Normally a discone or a scantenna is suggested as the wideband antenna of choice, however there are alternative designs such as the Dressler ARA-2000 which is a type of log spiral antenna that can receive from 50 – 2000 MHz. This particular product is no longer for sale, but an article detailing the breakdown of its construction can be found online

The dressler ARA-2000
The dressler ARA-2000

The article shows how to build the antenna from scratch. The active element consists of a thin copper sheet (or copper foil) in the shape of a wedge which is rolled into a cylinder around a plastic sheet. It is then connected to a low noise amplifier (LNA), which is powered through a bias tee. For the LNA something like the LNA4ALL could be used if building it yourself.

This antenna may be something to consider if you are thinking about building your own wideband antenna. It has the advantage of being much smaller than a discone and it can also be fully enclosed in a plastic radome to that fully protects it from weather elements. The author of the article also writes that he saw better performance from this antenna than when compared with a discone.

Inside the ARA-2000
Inside the ARA-2000

HAMSPIRIT.DE’s Review on Airspy vs SDRPlay

Over on the blog author January has just uploaded his latest review comparing the Airspy with the SDRPlay (article in German, so use Google Translate if necessary). These are two mid price range RX only software defined radio receivers that many people see as a first upgrade from an RTL-SDR dongle. Currently, the Airspy sells for $199 USD and the SDRPlay sells for $149 USD.

In his review January uses the SDR# to compare both devices on a wide range of signals include a beacon in the 10M band, broadcast FM stations, another beacon in the 2M band, TETRA signals and trunked radio in the 70cm band. He ran the SDRPlay at a bandwidth of 1.536 MHz and the Airspy at a bandwidth of 2.5 MHz, with decimation set to 2 in order to get comparable bandwidths.

From the results it appears that overall the two SDR’s are quite comparable to one another. But the SDRPlay has the advantage that it’s frequency range covers shortwave frequencies and his results show that the SDRPlay had better SNR in the FM broadcast band (although these results may be incorrect as it appears that his gain settings were not set properly, as the Airspy guide recommends that Airspy gains be adjusted to keep the noise floor near -80 dBFS). On the other hand the Airspy was much better when strong FM overload was present as shown in his TETRA results. In his conclusion he writes (translated from German to English):

If one value to a SDR, which covers with the short wave, it is running out on the SDRplay.

If one is interested in the field below the 70cm amateur radio bands, is in my view the Airspy front.

The Airspy software defined radio    The SDRPlay software defined radio