Tagged: radio scanner

Talk: Monitoring the Spectrum: Building Your Own Distributed RF Scanner Array

Andrew Reiter a researcher at Veracode has given a talk at the Chaos Communication Congress about building a distributed RF scanner array using cheap RTL-SDR dongles. This talk has been uploaded to YouTube.

Software-Defined Radio (SDR) has increased in popularity in recent years due to the decrease in hardware costs and increase in processing power. One example of such a class of devices is the RTL-SDR USB dongles based on the Realtek RTL2832U demodulator. This talk will discuss my experience in building a distributed RF scanner array for monitoring and spectrum mapping using such cheap SDR devices. The goal is to help the audience understand the what, why, and how of building their own RF monitoring array so that they will be able to do it themselves. In this era of increasingly being “watched”, we must be prepared to do our own “watching”.

Software-Defined Radio (SDR) has increased in popularity in recent years due to the decrease in hardware costs and increase in processing power.One example of such a class of devices is the RTL-SDR USB dongles based on the Realtek RTL2832U demodulator. This work investigates building and running an RF scanner array for monitoring and spectrum mapping using cheap SDR devices. The array allows for both RF sampling and power analysis to be split over multiple systems in order to increase capture and spectrum analysis capabilities. The system allows for “strong signal capture” as well as, simply, signal modeling with “strong signal alerting”. Also discussed will be using the array versus USRPs and the issue of antennae for all of the devices. I will explain the mistakes I made in building the array and what I did to attempt toovercome such pitfalls. The code for running the array will be introduced and released for public consumption. In addition, while we target the RTL-SDR devices, we will discuss the feasibility of including non-traditional SDR hardware in the array, including non-Realtek tuner cards and inclusion of HackRF devices.

Monitoring the Spectrum: Building Your Own Distributed RF Scanner Array [30c3]

Using Unitrunker with SDRSharp

Trunking radio is a radio system where a finite number of frequency channels are shared between multiple radio users. This allows support of a much larger number of radio users. A special control frequency is used to determine which frequency a radio should be tuned to.

This all means that following a radio conversation with a software defined radio such as the rtl-sdr can be difficult, as the conversation can hop around multiple frequencies. Fortunately there is software called unitrunker which can listen to the control channel, and determine what voice frequencies need to be tuned to. More information about unitrunker and the signals it can decode is shown on this RadioReference wiki page.

A tutorial on how to set up unitrunker with SDRSharp has been posted here. Essentially, to follow trunked radio conversations you will need two rtl-sdr dongles (or any two software radios), unitrunker and virtual audio cable. One radio will be used for the control channel and unitrunker, and the other will be used for the listening to the voice channel. This can also be done with one software radio, and one hardware radio with discriminator tap if one have one of those. If you are trying to track digital voice communications, it can be done with one dongle and this is discussed in the tutorial too.

Continue reading

Quick Start Guide

This page is a guide aimed at helping anyone set up a cheap radio scanner based on the RTL-SDR software defined radio as fast as possible on a Windows system.

Equipment Guide

Currently, the most common RTL-SDR dongle is the R820T which can be purchased here. See the Buy RTL-SDR dongles page for more information.

To get the most enjoyment out of RTL-SDR you will need a decent antenna. The stock antenna that is shipped with the dongle is okay for testing and will pick up a number of signals, but is generally considered as poor for any serious radio scanning. For beginners, a bunny ears antenna like those you get for TVs should already work much better than the stock antenna. The most recommended antenna for general scanning is a scantenna or discone due to their wide band receiving properties.

Set Up Guide (Tested on Windows Vista/7 + XP)

  1. Purchase an RTL-SDR dongle. The cheapest and best for most applications is the R820T dongle, which can be purchased here from Nooelec.
  1. SDRSharp is the easiest and most commonly used software defined radio software receiver for the RTL-SDR. Go to sdrsharp.com and head to the downloads page. Note that you must have the Microsoft .NET redistributable installed to use SDRSharp. Most modern Windows PCs should already have this installed by default, but older PCs running XP may need this to be installed.
  1. Ignore the downloads on the top of the page. Scroll down to where it says “Important note for RTL-SDR users”. Download sdr_install.zip from that link.

SDRSharp Download Page Screenshot

  1. Extract sdr_install.zip to a folder.
  1. Double click on install.bat from within the extracted folder. This will start a command prompt that will download SDRSharp and all the files required to make SDRSharp work with RTL-SDR. Everything will be placed into a new folder within the sdr-install folder called “sdrsharp”. The command prompt will automatically close when it is done.


  1. Plug in your dongle and do not install any of the software that it came with, but ensure you let plug and play finish trying to install it. If you’ve already installed the software drivers it came with previously, uninstall them first.
  1. Open the newly created sdrsharp folder. Find the file zadig.exe. Right click this file and select “Run as administrator” if using Windows Vista/7/8. If you are using Windows XP, download the XP version from this page. If you are on Windows 8 you may get signed driver issues. To get around this we recommend downloading and using the newer Zadig version 2.1 from here.
  1. In Zadig, go to Options->List All Devices and make sure this option is checked.
  1. Select “Bulk-In, Interface (Interface 0)” from the drop down list. Ensure that WinUSB is selected in the box next to where it says Driver. (Note on some PCs you may see something like RTL2832UHIDIR instead of the bulk in interface. This is also a valid selection).

Zadig Screen

  1. Click Install Driver. You might get a warning that the publisher cannot be verified, but just accept it by clicking on Install this driver software anyway. This will install the drivers necessary to run the dongle as a software defined radio. Note that you may need to run zadig.exe again if you move the dongle to another USB port, or want to use two or more dongles together.


  1. Open SDRSharp.exe. Set the drop down box at the top next to the Play button to ’RTLSDR / USB’. Press Play. Your rtl-sdr software radio should now be set up and ready to use! If everything has worked you should be able to start tuning to frequencies. Be sure to also adjust the gain settings by pressing the Configure button up the top near the Play button.

Device Selection


  • Zadig takes a long time to install the driver, then fails
    You have probably not run zadig in administrator mode. Make sure to right click zadig, and select “Run as Administrator”
  • I don’t see Bulk-In, Interface (Interface 0)
    Ensure Options->List All Devices is checked. Some people report seeing something else other than the bulk in interface. It may also show up as the brand of your dongle or something prefixed with “rtl”. This option should work too.
  • I don’t see RTL-SDR/USB in SDRSharp
    You may have downloaded a version without rtl-sdr support. Check that you followed the instructions in step 3 and downloaded the version under the heading “Important note for RTL-SDR users”.
  • Zadig gives “System policy has been modified to reject unsigned drivers“ error in Windows 8
    Windows 8 can cause signed driver issues with zadig. Some users report getting the error “System policy has been modified to reject unsigned drivers”. To solve this download and use the newer Zadig version 2.1 from here.
  • Reception in SDR# seems very poor/receiver is insensitive
    Make sure you have increased the gain slider which can be accessed by clicking on the configure button. Also, in poor reception areas using the stock antenna indoors may not be sufficient.
  • SDR# gives error “Application failed to initialize properly (0xc0000135).  Click OK to terminate.”
    This might mean that you do not have the .NET 3.5 Framework installed.

How to set the Gain

The gain can be adjusted in SDR# by clicking on the Configure button. When tuning the RF gain you are trying to get the signal as strong as possible, whilst keeping the noise floor as low as possible. Start with a low gain setting, and slowly increase the gain slider. Watch in the frequency spectrum as the signal strength increases, but stop just before the point at which the noise floor starts to rise.

The noise floor is the part of the frequency spectrum where there are no signals.

SDRSharp Plugins

A list of SDRSharp plugins can be found here.

SDRSharp Guide

A good guide to learning how to use SDRSharp and what all the options do can be found here. Another great illustrated guide can be found here.

Other SDR Windows Software Compatible with RTL-SDR

HDSDR – An advanced version of the WinRad SDR software. A free software defined radio package.

SDR-Radio v2 – A free Windows program for software defined radio.

SDR-J – Free Windows program capable of also decoding DAB signals in software.

See the Software Guide for a big list of other compatible RTL-SDR software.

Getting Started on Linux

A good guide to getting started on Linux and GNU Radio can be found at this blog post here.

Note that if you want to run Linux in a virtual machine it has been reported that performance with VirtualBox is rather poor due to it’s slow USB connection. VMWare Player on the other hand has good performance.

Installing SDR# with Mono in Linux

Install Mono and the Monodevelop environment.

sudo apt-get install mono-complete
sudo apt-get install monodevelop

Install libportaudio for sound

sudo apt-get install libportaudio-dev
sudo apt-get install libportaudio2

Use svn to checkout SDRSharp. If you don’t have svn installed use sudo apt-get install subversion to install subversion.

svn co https://subversion.assembla.com/svn/sdrsharp/trunk sdrsharp
cd sdrsharp

We first need to replace the version string in the SDR# solution file as Monodevelop currently does not recognize solution files created by Visual Studio 2012.

sed -i 's/Format Version 12\.00/Format Version 11\.00/' SDRSharp.sln

Open the solution file with monodevelop

monodevelop SDRSharp.sln

In Monodevelop set the build to Release|x86, then go to Build->Build All

Now we need to first symbolically link libportaudio to the Release folder where SDR# was just built.

cd Release

First we need to find out if you are running a 32-bit (x86/i686) OS or a 64-bit (x64/x86_64) OS. To do this type

uname –m

If you see the result as i686, you are running a 32-bit Linux so type in

ln -s /usr/lib/i386-linux-gnu/libportaudio.so.2 libportaudio.so

If you see the result as x86_64 you are running a 64-bit kernel so type

ln -s /usr/lib/x86_64-linux-gnu/libportaudio.so.2

Add RTL-SDR support to the SDRSharp.exe.config file by using the command

sed -i 's/<!-- <add key="RTL-SDR </ USB" value="SDRSharp.RTLSDR.RtlSdrIO,SDRSharp.RTLSDR" \/> -->//' SDRSharp.exe.config

Now you can run SDRSharp by typing

mono SDRSharp.exe


What is RTL-SDR?

RTL-SDR is a very cheap software defined radio that uses a DVB-T TV tuner dongle based on the RTL2832U chipset. With the combined efforts of Antti Palosaari, Eric Fry and Osmocom it was found that the signal I/Q data could be accessed directly, which allowed the DVB-T TV tuner to be converted into a wideband software defined radio via a new software driver.

Essentially, this means that a cheap $20 TV tuner with the RTL2832U chip can be used as a computer based radio scanner. This sort of scanner capability would have cost hundreds or even thousands just a few years ago. The RTL-SDR is also often referred to as RTL2832U, DVB-T SDR, or the “$20 Software Defined Radio”.

There are many other software defined radios similar to the RTL-SDR, but they all come at a much higher price. The FunCube PRO+ is a good receiver similar to the RTL-SDR, priced at around $190 USD. There is also the soon to be released HackRF (~$300USD) and BladeRF SDRs ($420 and $650), which can both transmit and receive.

What is Software Defined Radio?

Radio components such as modulators, demodulators and amplifiers are traditionally implemented in hardware components. The advent of modern computing allows these traditionally hardware based components to be implemented into software instead. Hence, the software defined radio. This enables easy signal processing and thus cheap wide band scanner radios to be produced.

What are some RTL-SDR Radio Scanner Applications?

The RTL-SDR can be used as a wide band radio scanner. Applications include

Furthermore, with an upconverter or direct sampling mod to receive HF signals the applications are expanded to

  • Listening to amateur radio hams on SSB with LSB/USB modulation.
  • Decoding digital amateur radio ham communications such as CW/PSK/RTTY/SSTV.
  • Receiving HF weatherfax.
  • Receiving digital radio monodial shortwave radio (DRM).
  • Listening to international shortwave radio.
  • Looking for RADAR signals like over the horizon (OTH) radar, and HAARP signals.

Note that not all the applications listed may be legal in your country. Please be responsible.

What is the RTL-SDR frequency range?

This is dependant on the particular tuner variant used in the dongle.

TunerFrequency range
Elonics E400052 – 2200 MHz with a gap from 1100 MHz to 1250 MHz (varies)
Rafael Micro R820T24 – 1766 MHz
Fitipower FC001322 – 1100 MHz
Fitipower FC001222 – 948.6 MHz
FCI FC2580146 – 308 MHz and 438 – 924 MHz (gap in between)

Table Source: Osmocom

As you can see from the table, the Elonics E4000 and Rafael Micro R820T dongles have the greatest frequency range.

What is the RTL-SDRs sample rate?

The maximum sample rate is 3.2 MS/s (mega samples per second). However, the rtl-sdr is unstable at this rate and may drop samples. The maximum sample rate that does not drop samples is 2.4 MS/s, however some people have had luck with 3.2 MS/s working well on USB 3.0.

What is the RTL-SDR’s ADC resolution?

The resolution is 8 bits.

What is the RTL-SDR input impedance?

Since these dongles are intended for TV, all dongles will have an input impedance of 75 Ohms. However, the mismatch loss when using 50 Ohm cabling will be very minimal at the frequencies the dongle can cover.

The 75 Ohm impedance for the R820T can be checked on the datasheet which can be downloaded here.

What dongle should I buy?

The cheapest, most common an generally best performing dongle at the moment is the Rafael Micro R820T. It can be bought for about $20 USD.

The Elonics E4000 used to be the most common, but Elonics has closed and ceased chip production, making the E4000 rarer and much more expensive these days.

The R820T also is generally regarded as having better performance and sensitivity for most interesting frequencies. For ADS-B, the R820T is much more sensitive at 1090 MHz. For these reasons, the R820T is currently the recommended dongle, unless you need the greater frequencies the E4000 provides.

Be careful when buying a dongle as certain sellers tend to misrepresent their devices (knowingly or unknowingly) as having compatible tuners, when in fact they may send out a device with an incompatible tuner. Also be wary when buying E4000 dongles from auction sites as there are many dodgy sellers incorrectly advertising R820T dongles as the rare E4000.

See the BUY RTL-SDR page for more information about where to obtain dongles from reputable sources.

I already have a USB TV Tuner, is it Compatible?

An up to date list on compatible and incompatible tuners can be found on this reddit wiki page.

Comparisons with other Wideband Commercial Software Defined Radios

SDRTune Low (MHz)Tune Max (MHz)RX Sample Rate (MHz)ADC Resolution (Bits)Transmit?(Yes/No)Price ($USD)
RTL-SDR (R820T)24 17663.28No~20
Funcube Pro6417000.09616No150
Funcube Pro+0.15
BladeRF30038004012Yes400 & 650
USRP 1DC60006412Yes700


Useful Links

http://sdr.osmocom.org/trac/wiki/rtl-sdr - Official rtl-sdr osmocom website

http://www.reddit.com/r/RTLSDR – Reddit rtl-sdr forum

https://groups.google.com/forum/#!forum/ultra-cheap-sdr - Google groups forum

www.sdrsharp.com - SDRSharp official website

www.rtlsdr.org - RTL-SDR community Wiki

http://www.dxzone.com/ - A good ham related database useful for research

http://www.dangerousprototypes.com - A blog about open source hardware projects that often has SDR related posts.

http://www.hackaday.com – A blog about DIY hardware that also often has SDR related posts.

http://sdrformariners.blogspot.com/ - SDR for mariners. A new blog about marine related RTL-SDR applications.

http://www.EEWeb.com - A large electrical engineering news and community website that sometimes feature SDR related stories.