Tagged: radio scanner

Talk: Monitoring the Spectrum: Building Your Own Distributed RF Scanner Array

Andrew Reiter a researcher at Veracode has given a talk at the Chaos Communication Congress about building a distributed RF scanner array using cheap RTL-SDR dongles. This talk has been uploaded to YouTube.

Software-Defined Radio (SDR) has increased in popularity in recent years due to the decrease in hardware costs and increase in processing power. One example of such a class of devices is the RTL-SDR USB dongles based on the Realtek RTL2832U demodulator. This talk will discuss my experience in building a distributed RF scanner array for monitoring and spectrum mapping using such cheap SDR devices. The goal is to help the audience understand the what, why, and how of building their own RF monitoring array so that they will be able to do it themselves. In this era of increasingly being “watched”, we must be prepared to do our own “watching”.

Software-Defined Radio (SDR) has increased in popularity in recent years due to the decrease in hardware costs and increase in processing power.One example of such a class of devices is the RTL-SDR USB dongles based on the Realtek RTL2832U demodulator. This work investigates building and running an RF scanner array for monitoring and spectrum mapping using cheap SDR devices. The array allows for both RF sampling and power analysis to be split over multiple systems in order to increase capture and spectrum analysis capabilities. The system allows for “strong signal capture” as well as, simply, signal modeling with “strong signal alerting”. Also discussed will be using the array versus USRPs and the issue of antennae for all of the devices. I will explain the mistakes I made in building the array and what I did to attempt toovercome such pitfalls. The code for running the array will be introduced and released for public consumption. In addition, while we target the RTL-SDR devices, we will discuss the feasibility of including non-traditional SDR hardware in the array, including non-Realtek tuner cards and inclusion of HackRF devices.

Monitoring the Spectrum: Building Your Own Distributed RF Scanner Array [30c3]

Using Unitrunker with SDRSharp

Trunking radio is a radio system where a finite number of frequency channels are shared between multiple radio users. This allows support of a much larger number of radio users. A special control frequency is used to determine which frequency a radio should be tuned to.

This all means that following a radio conversation with a software defined radio such as the rtl-sdr can be difficult, as the conversation can hop around multiple frequencies. Fortunately there is software called unitrunker which can listen to the control channel, and determine what voice frequencies need to be tuned to. More information about unitrunker and the signals it can decode is shown on this RadioReference wiki page.

A tutorial on how to set up unitrunker with SDRSharp has been posted here. Essentially, to follow trunked radio conversations you will need two rtl-sdr dongles (or any two software radios), unitrunker and virtual audio cable. One radio will be used for the control channel and unitrunker, and the other will be used for the listening to the voice channel. This can also be done with one software radio, and one hardware radio with discriminator tap if one have one of those. If you are trying to track digital voice communications, it can be done with one dongle and this is discussed in the tutorial too.

Continue reading

Quick Start Guide

This page is a guide aimed at helping anyone set up a cheap radio scanner based on the RTL-SDR software defined radio as fast as possible on a Windows system.

Equipment Guide

Currently, the most common RTL-SDR dongle is the R820T which usually sells for under $20 USD. See the Buy RTL-SDR dongles page for more information on purchasing.

To get the most enjoyment out of RTL-SDR you will need a decent antenna. The stock antenna that is shipped with the dongle is okay for testing and will pick up a number of signals, but is generally considered as poor for any serious radio scanning. For beginners, a bunny ears antenna like those you get for TVs should already work much better than the stock antenna. You can also improve the stock antenna performance by placing it on a metallic surface. The most recommended antenna for general scanning is a scantenna or discone due to their wide band receiving properties.

SDR# (SDRSharp) Set Up Guide (Tested on Windows Vista/7 + XP)

  1. Purchase an RTL-SDR dongle. The cheapest and best for most applications is the R820T dongle. Information on purchasing one can be found here.
  1. SDRSharp is the easiest and most commonly used software defined radio software receiver for the RTL-SDR. Go to http://www.sdrsharp.com/#download and scroll to the bottom of the page to find the download button. Click the download button to download sdr_install.zip.
  1. Note that you must have the Microsoft .NET redistributable installed to use SDRSharp. Most modern Windows PCs should already have this installed by default, but older PCs running XP may need this to be installed.
  1. Extract (unzip) sdr_install.zip to a folder.
  1. Double click on install.bat from within the extracted folder. This will start a command prompt that will download SDRSharp and all the files required to make SDRSharp work with RTL-SDR. Everything will be placed into a new folder within the sdr-install folder called “sdrsharp”. The command prompt will automatically close when it is done.

installbat

  1. Plug in your dongle and do not install any of the software that it came with (if any), but ensure you let plug and play finish attempting to install it. If you’ve already installed the software drivers that came on the CD bundled with some dongles, uninstall them first.
  1. Open the newly created sdrsharp folder. Find the file zadig.exe. Right click this file and select “Run as administrator” if using Windows Vista/7/8. If you are using Windows XP, download the XP version from this page.
  1. In Zadig, go to Options->List All Devices and make sure this option is checked.
  1. Select “Bulk-In, Interface (Interface 0)” from the drop down list. Ensure that WinUSB is selected in the box next to where it says Driver. (Note on some PCs you may see something like RTL2832UHIDIR or RTL2832U instead of the bulk in interface. This is also a valid selection).

Zadig Screen

  1. Click Install Driver. You might get a warning that the publisher cannot be verified, but just accept it by clicking on Install this driver software anyway. This will install the drivers necessary to run the dongle as a software defined radio. Note that you may need to run zadig.exe again if you move the dongle to another USB port, or want to use two or more dongles together.

zadig_warning

  1. Open SDRSharp.exe. Set the drop down box at the top next to the Play button to ‘RTLSDR / USB’. Press Play. Your rtl-sdr software radio should now be set up and ready to use! If everything has worked you should be able to start tuning to frequencies. Be sure to also adjust the RF gain settings by pressing the Configure button (looks like a cog) up the top near the Play button. By default the RF gain is set at zero.

Device Selection

Troubleshooting

  • I get the error “No compatible devices found” when trying to start the dongle in SDR#
    Long low quality USB extension cables can sometimes cause this error. Some USB 3.0 ports are also incompatible with the dongle and cause this error. One user has had luck with this error by installing zadig from safe mode. Finally, there is a small chance that the dongle is actually faulty. If the dongle produces the same error on multiple computers the dongle is probably faulty and should be refunded or replaced.
  • Zadig takes a long time to install the driver, then fails
    You have probably not run zadig in administrator mode. Make sure to right click zadig, and select “Run as Administrator”
  • I don’t see Bulk-In, Interface (Interface 0)
    Ensure Options->List All Devices is checked. Some people report seeing something else other than the bulk in interface. It may also show up as the brand of your dongle or something prefixed with “RTL”. This option should work too. In rare cases you may receive a faulty dongle that will not show up in Zadig no matter what USB port or computer you try it on. You should ask for a replacement in this case.
  • I don’t see RTL-SDR/USB in SDRSharp
    You may have downloaded a version without rtl-sdr support. Check that you have downloaded the official version from the sdrsharp.com website.
  • USB 3.0 ports don’t work
    Unfortunately many USB 3.0 controllers are buggy and don’t work with some devices. Generally, USB 3.0 works fine with the RTL-SDR, but there are some controllers that will just recognise the dongle. In this case use a USB 2.0 port instead.
  • When running install.bat I get errors on the command line like “The system cannot find the file specified” and the sdrsharp folder is not downloaded
    This is probably because you did not unzip the files and you are trying to run install.bat from within the zip file. Make sure you extract or move the unzip.exe, install.bat and httpget.exe files out of the zip file into another folder, before running install.bat.
  • Zadig gives “System policy has been modified to reject unsigned drivers” error in Windows 8
    Windows 8 can cause signed driver issues with zadig. Some users report getting the error “System policy has been modified to reject unsigned drivers”. To solve this download and use the newer Zadig version 2.1 from here. (The newer SDR# install.bat downloads with Zadig 2.1 automatically)
  • Reception in SDR# seems very poor/receiver is insensitive
    Make sure you have increased the gain slider which can be accessed by clicking on the configure button. Also, in poor reception areas using the stock antenna indoors may not be sufficient. In rare cases if you still cannot receive anything and another radio can, then you may have received a broken dongle and should ask for a replacement.
  • SDR# gives error “Application failed to initialize properly (0xc0000135).  Click OK to terminate.”
    This might mean that you do not have the .NET 3.5 Framework installed.
  • I get the error “1 compatible devices have been found but are all busy”
    This sometimes occurs after the computer has been suspended. To fix it simply disconnect and reconnect the dongle. Sometimes it may also be necessary to reinstall the Zadig drivers. Also some USB 3.0 ports are buggy, switch to a USB 2.0 port. Some users have also had success with installing everything from Windows safe mode.
  • The dongle constantly disconnects from the USB port
    First test to make sure that it is not the fault of a dodgy USB extension cable by plugging the dongle directly into the PC. If it still disconnects often the dongle may be faulty and you should ask for a replacement.
  • The dongle won’t connect and the LED does not illuminate on models with an LED
    The dongle is faulty and should be refunded or replaced.

If you continue to have issues please feel free to post in the troubleshooting section of our Forums.

How to set the Gain

The gain can be adjusted in SDR# by clicking on the Configure button which looks like a cog. When tuning the RF gain you are trying to get the signal as strong as possible, whilst keeping the noise floor as low as possible. Start with a low gain setting, and slowly increase the gain slider. Watch in the frequency spectrum as the signal strength increases, but stop just before the point at which the noise floor starts to rise.

The noise floor is the part of the frequency spectrum where there are no signals.

SDRSharp Plugins

The official list of SDRSharp plugins can be found here and our unofficial list of plugins can be found here.

SDRSharp Guide

A good guide to learning how to use SDRSharp and what all the options do can be found here. Another great illustrated guide can be found here.

HDSDR Setup Guide

  1. Purchase an RTL-SDR dongle. The cheapest and best for most applications is the R820T dongle. Information on purchasing one can be found here.
  1. Plug in your dongle and do not install any of the software that it came with, but ensure you let plug and play finish trying to install it. If you’ve already installed the software drivers it came with previously, uninstall them first.
  1. Go to http://zadig.akeo.ie/ and download Zadig.
  1. In Zadig, go to Options->List All Devices and make sure this option is checked.
  1. Select “Bulk-In, Interface (Interface 0)” from the drop down list. Ensure that WinUSB is selected in the box next to where it says Driver. (Note on some PCs you may see something like RTL2832UHIDIR instead of the bulk in interface. This is also a valid selection).

Zadig Screen

  1. Click Install Driver. You might get a warning that the publisher cannot be verified, but just accept it by clicking on Install this driver software anyway. This will install the drivers necessary to run the dongle as a software defined radio. Note that you may need to run zadig.exe again if you move the dongle to another USB port, or want to use two or more dongles together.

zadig_warning

  1. Download HDSDR from http://hdsdr.de/, using the download button at the bottom of the page.
  1. Use the installer you just downloaded to install HDSDR.
  1. Download the ExtIO_RTL2832U.dll dll file from https://app.box.com/s/7tpiy8r6qo2bbhdxtt4k (MIRROR).
  1. Copy the ExtIO_RTL2832U.dll file into the HDSDR install folder which is by default set to C:\Program Files (x86)\HDSDR.
  1. Open HDSDR. You might be asked to select a .dll file. Choose the ExtIO_RTL2832U.dll file you just copied over and then click Open. It is okay if you do not see this screen as long as you have copied the ExtIO_RTL2832U.dll file over properly in the last step.

image017

  1. Choose your output sound card by clicking on the Soundcard button  in the bottom left corner, or alternatively by pressing F5. The only important setting here is the “RX Output (to Speaker)” setting which you should set to your speakers, or desired audio piping software.

image019

  1. Click on the Bandwidth button  or alternatively press F6. Choose an output Sampling Rate of 48000 Hz for general use.

image021

  1. Press Start or alternatively press F2. This will start the SDR.
  1. To set the RTL-SDR sample rate, gain and frequency correction click on the ExtIO button .

image023

  1. To tune to a station, change the Local Oscillator frequency to a frequency near the frequency you are interested in. Then tune to the desired frequency either by clicking in the RF spectrum, or using the Tune numbers.

image024

  1. You can zoom in and out of the spectrum by using the Zoom slider which is to the left of the word zoom.

image025

  1. The mode can be altered by clicking on the mode buttons.

image026

  1. After clicking on the FM mode button, the FM bandwidth can be manually modified with the FM-BW slider.

image027

  1. To listen to a typical wideband broadcast FM station, you will need to change the audio sampling rate to 192000 Hz. Do this by clicking on the Bandwidth button or alternatively by pressing F6 and then selecting the output sampling rate as 192000 Hz.

SDR-RADIO V2 Setup Up Guide

To install SDR-RADIO for the RTL-SDR follow the steps below

  1. Purchase an RTL-SDR dongle. The cheapest and best for most applications is the R820T dongle. Information on purchasing one can be found here.
  1. Plug in your dongle and do not install any of the software that it came with, but ensure you let plug and play finish trying to install it. If you’ve already installed the software drivers it came with previously, uninstall them first.
  1. Go to http://zadig.akeo.ie/ and download Zadig.
  1. In Zadig, go to Options->List All Devices and make sure this option is checked.
  1. Select “Bulk-In, Interface (Interface 0)” from the drop down list. Ensure that WinUSB is selected in the box next to where it says Driver. (Note on some PCs you may see something like RTL2832UHIDIR instead of the bulk in interface. This is also a valid selection).

Zadig Screen

  1. Click Install Driver. You might get a warning that the publisher cannot be verified, but just accept it by clicking on Install this driver software anyway. This will install the drivers necessary to run the dongle as a software defined radio. Note that you may need to run zadig.exe again if you move the dongle to another USB port, or want to use two or more dongles together.

zadig_warning

  1. Download the SDR-RADIO installer from http://v2.sdr-radio.com/Download.aspx.
  1. Use the installer to install SDR-RADIO.
  1. Either compile yourself using the instructions from http://sdrnuke.wces.net/Support/RTLSDRs/BuildingDlls.aspx, or download from the bottom of http://www.aa5sh.com/?page_id=65 (MIRROR), the SDRSourceRTL2832U.dll, rtlsdr.dll and libusb-1.0.dll dll files. Copy the dlls into either the C:\Program Files\SDR-RADIO-PRO.com (64 bit), or C:\Program Files (x86)\SDR-RADIO-PRO.com (32 bit) folder depending on what version of Windows you have.
  1. Open SDR-RADIO. Upon opening it you will be greeted with the Select Radio screen and a prompt saying “List is empty – add radio definition now?” Click Yes. If this prompt does not display, click the + Definitions button.
  1. In the new window open the Search drop down menu and select RTL SDR (USB). After clicking it the RTL-SDR will be added to the Radio Definitions list. Click OK.

image030

image031

  1. Click on the RTL-SDR click to select it, choose your desired sample rate then click Start.

image032

  1. Click on the Span button and adjust the span to the sample rate bandwidth you chose in the last step. This will let you see the whole spectrum.

image033

  1. To change the receive mode use the left menu under the frequency tab. You can also change the signal bandwidth here. NFM signals are typically around 12 kHz wide and broadcast FM is typically around 192 kHz wide.

image034

  1. To adjust the frequency, use the VFO tuning box on the right side. If you don’t see it you may need to click on the VFO tuning tab. Also if the screen is too small you may need to expand it’s size to show it. You can also click on the waterfall to instantly tune to the clicked frequency.

image035

  1. Be sure to adjust the gain settings using the RF gain button in the top which is under the Home tab. By default it is set to automatic.

sdrconsolegain

  1. Also to adjust the waterfall colors so that signals are more clearly seen go to the Display tab up the top and then click on the Automatic Calibration button on the very top right.

sdrconsoleautocal

Other SDR Windows Software Compatible with RTL-SDR

HDSDR – An advanced version of the WinRad SDR software. A free software defined radio package.

SDR-Radio v2 – A free Windows program for software defined radio.

SDR-J – Free Windows program capable of also decoding DAB signals in software.

See the Software Guide for a big list of other compatible RTL-SDR software.

Getting Started on Linux

A good guide to getting started on Linux and GNU Radio can be found at this blog post here.

Note that if you want to run Linux in a virtual machine it has been reported that performance with VirtualBox is rather poor due to it’s slow USB connection. VMWare Player on the other hand has good performance.


For a comprehensive book about the RTL-SDR you may be interested in our eBook available on Amazon.

The Hobbyist’s Guide to the RTL-SDR: Really Cheap Software Defined radio.

About RTL-SDR

What is RTL-SDR?

RTL-SDR is a very cheap software defined radio that uses a DVB-T TV tuner dongle based on the RTL2832U chipset. With the combined efforts of Antti Palosaari, Eric Fry and Osmocom it was found that the signal I/Q data could be accessed directly, which allowed the DVB-T TV tuner to be converted into a wideband software defined radio via a new software driver.

Essentially, this means that a cheap $20 TV tuner USB dongle with the RTL2832U chip can be used as a computer based radio scanner. This sort of scanner capability would have cost hundreds or even thousands just a few years ago. The RTL-SDR is also often referred to as RTL2832U, DVB-T SDR, or the “$20 Software Defined Radio”.

There are many other software defined radios similar to the RTL-SDR, but they all come at a much higher price. The FunCube PRO+ is a good receiver similar to the RTL-SDR, priced at around $190 USD. There is also the soon to be released HackRF (~$300USD) and BladeRF SDRs ($420 and $650), which can both transmit and receive.

What is Software Defined Radio?

Radio components such as modulators, demodulators and amplifiers are traditionally implemented in hardware components. The advent of modern computing allows these traditionally hardware based components to be implemented into software instead. Hence, the software defined radio. This enables easy signal processing and thus cheap wide band scanner radios to be produced.

What are some RTL-SDR Radio Scanner Applications?

The RTL-SDR can be used as a wide band radio scanner. Applications include

Furthermore, with an upconverter or direct sampling mod to receive HF signals the applications are expanded to

  • Listening to amateur radio hams on SSB with LSB/USB modulation.
  • Decoding digital amateur radio ham communications such as CW/PSK/RTTY/SSTV.
  • Receiving HF weatherfax.
  • Receiving digital radio monodial shortwave radio (DRM).
  • Listening to international shortwave radio.
  • Looking for RADAR signals like over the horizon (OTH) radar, and HAARP signals.

Note that not all the applications listed may be legal in your country. Please be responsible.

What is the RTL-SDR frequency range?

This is dependant on the particular tuner variant used in the dongle.

Tuner Frequency range
Elonics E4000 52 – 2200 MHz with a gap from 1100 MHz to 1250 MHz (varies)
Rafael Micro R820T 24 – 1766 MHz
Fitipower FC0013 22 – 1100 MHz
Fitipower FC0012 22 – 948.6 MHz
FCI FC2580 146 – 308 MHz and 438 – 924 MHz (gap in between)

Table Source: Osmocom

As you can see from the table, the Elonics E4000 and Rafael Micro R820T dongles have the greatest frequency range.

What is the RTL-SDRs sample rate?

The maximum sample rate is 3.2 MS/s (mega samples per second). However, the rtl-sdr is unstable at this rate and may drop samples. The maximum sample rate that does not drop samples is 2.4 MS/s, however some people have had luck with 3.2 MS/s working well on USB 3.0.

What is the RTL-SDR’s ADC resolution?

The resolution is 8 bits.

What is the RTL-SDR input impedance?

Since these dongles are intended for TV, all dongles will have an input impedance of 75 Ohms. However, the mismatch loss when using 50 Ohm cabling will be very minimal at the frequencies the dongle can cover.

The 75 Ohm impedance for the R820T can be checked on the datasheet which can be downloaded here.

What dongle should I buy?

The cheapest, most common an generally best performing dongle at the moment is the Rafael Micro R820T. It can be bought for about $20 USD.

The Elonics E4000 used to be the most common, but Elonics has closed and ceased chip production, making the E4000 rarer and much more expensive these days.

The R820T also is generally regarded as having better performance and sensitivity for most interesting frequencies. For ADS-B, the R820T is much more sensitive at 1090 MHz. For these reasons, the R820T is currently the recommended dongle, unless you need the greater frequencies the E4000 provides.

Be careful when buying a dongle as certain sellers tend to misrepresent their devices (knowingly or unknowingly) as having compatible tuners, when in fact they may send out a device with an incompatible tuner. Also be wary when buying E4000 dongles from auction sites as there are many dodgy sellers incorrectly advertising R820T dongles as the rare E4000.

See the BUY RTL-SDR page for more information about where to obtain dongles from reputable sources.

I already have a USB TV Tuner, is it Compatible?

An up to date list on compatible and incompatible tuners can be found on this reddit wiki page.

Comparisons with other Wideband Commercial Software Defined Radios

SDR Tune Low (MHz) Tune Max (MHz) RX Sample Rate (MHz) ADC Resolution (Bits) Transmit?(Yes/No) Price ($USD)
RTL-SDR (R820T) 24  1766 3.2 8 No ~20
Funcube Pro 64 1700 0.096 16 No 150
Funcube Pro+ 0.15
410
260
2050
0.192 16 No 200
HackRF 30 6000 20 8 Yes ~300
BladeRF 300 3800 40 12 Yes 400 & 650
USRP 1 DC 6000 64 12 Yes 700
MatchStiq 300 3800 28 12 Yes 4500

 

Useful Links

http://sdr.osmocom.org/trac/wiki/rtl-sdr – Official rtl-sdr osmocom website

http://www.reddit.com/r/RTLSDR – Reddit rtl-sdr forum

https://groups.google.com/forum/#!forum/ultra-cheap-sdr – Google groups forum

www.sdrsharp.com – SDRSharp official website

www.rtlsdr.org – RTL-SDR community Wiki

http://www.dxzone.com/ – A good ham related database useful for research

http://www.dangerousprototypes.com – A blog about open source hardware projects that often has SDR related posts.

http://www.hackaday.com – A blog about DIY hardware that also often has SDR related posts.

http://sdrformariners.blogspot.com/ – SDR for mariners. A new blog about marine related RTL-SDR applications.

http://www.EEWeb.com – A large electrical engineering news and community website that sometimes feature SDR related stories.

http://labyrinth13.com/ – Strange Beacons. Radio user who records and makes videos about several interesting signals he finds. Often uses an RTL-SDR.


For a comprehensive book about the RTL-SDR you may be interested in our eBook available on Amazon.

The Hobbyist’s Guide to the RTL-SDR: Really Cheap Software Defined radio.