November 3, 2026

Router CSI Toolkit: Capturing 80 MHz Wi-Fi Channel State Information from a GL-MT6000 Router

Thank you to Wu Jun (aka jjjwu on GitHub) for writing in and sharing a guide to capturing Wi-Fi channel state information (CSI) from a GL.iNet GL-MT6000 router, along with the 'Router CSI Toolkit' scripts that go with it. CSI is the per-subcarrier amplitude and phase data that a Wi-Fi receiver measures to equalize the channel. Because it changes as people move through a room, it is often used for experimental Wi-Fi sensing.

The router is based on the MediaTek MT7986 chipset and runs OpenWrt with an existing mt76 driver CSI patch from the ossiemarks OpenWrt fork. A small daemon on the router streams 80 MHz, 256-subcarrier CSI from the 5 GHz radio over UDP to a host PC. There, Python scripts check the capture quality and produce amplitude heatmaps and a simple motion metric. A 10-minute test run produced 57,293 per-chain records at about 95.5 records/s.

While this project doesn't use an SDR, it may interest readers who followed BirriaSDR and Mtk79ICAP, which also patch the mt76 driver to turn MT7921 Wi-Fi dongles into SDRs. The scripts are MIT-licensed and available on GitHub, and the 10-minute dataset is on Zenodo under CC BY 4.0.

The GL-MT6000 (MT7986) Router used in these experiments

Vote

November 3, 2026

dec406: Decoding Second-Generation COSPAS-SARSAT 406 MHz Distress Beacons with an RTL-SDR

Thank you to Fabrice Morel (F4MLV) for writing in and sharing his project 'dec406', an open-source Linux decoder for COSPAS-SARSAT 406 MHz distress beacons. These are the EPIRBs carried on ships, ELTs on aircraft, and personal locator beacons (PLBs) carried by hikers. When activated, they transmit a digital message with a unique ID and often a GPS position, which satellites relay to rescue coordination centers.

What makes dec406 interesting is that it decodes the newer second-generation beacons. Unlike the narrowband first-generation signal, these use a ~50 kHz wide DSSS/OQPSK spread-spectrum signal that must be despread and BCH error-corrected before it can be read. Fabrice tested it with an RTL-SDR, and Bernard (F6BVP) at the F4KLO La Villette radio telescope used an Airspy on the MEOSAR satellite downlink near 1544 MHz, decoding system and calibration beacons in the USA, Cyprus, Brazil and Togo.

Fabrice has published real IQ recordings, and running 'make demo-real-sgb' downloads one and checks the decode. The live scanner supports RTL-SDR, Airspy, PlutoSDR, and HackRF, and the code is MIT licensed. More details are in the F4KLO field report. As Fabrice notes, never radiate test transmissions on 406 MHz. Fabrice has also sent us a PDF article of his results, which you can download here.

A Wide SGB Burst Near 406.05 MHz Received with an RTL-SDR in SDRangel (Top), dec406 Decoding a French Second-Generation System Beacon in Self-Test Mode (Bottom)

AI Disclaimer: While Fabrice does not mention it, the dec406 README and .gitignore reference a "Claude assistant memory" CLAUDE.md file, which suggests that Claude was used to help develop the software.

Vote

November 2, 2026

NightDX: Automated Overnight Shortwave DX Listening with an Airspy HF+

Thank you to Marco Zennaro for writing in and sharing NightDX, a free terminal app for macOS, Windows and Linux that lets an Airspy HF+ do your overnight shortwave listening for you. The menu interface is deliberately styled like early-90s DOS software.

NightDX pulls the EiBi, AOKI and HFCC broadcast schedules, plus live solar flux and Kp from NOAA. A propagation model then predicts what should reach your location and calibrates itself against what your own radio hears. The HF+ sweeps all the bands in about 10 seconds to see which carriers are really there, and overnight NightDX records the best stations, putting ones you've never logged first.

Optional AI features can then label each recording as speech, music, or noise using an AudioSet classifier, and transcribe and translate it with OpenAI's Whisper, which helps when writing reception reports. In the morning, a browser report shows the recordings with audio players, one-click reception reports drafted in Gmail, and a QSL card log.

We note that NightDX doesn't claim to identify stations. It shows schedule names as candidates and flags recordings where the evidence doesn't fit, such as the wrong language or a signal far too strong for the predicted path. Only the Airspy HF+ (Discovery or Dual Port) is supported for now, so there is no RTL-SDR support. Marco notes that other SDRs such as the Perseus and Elad are being looked into. The code is open-source under the MIT license and available on GitHub.

AI Disclaimer: Marco notes that NightDX was built with the help of Claude.

Vote

November 2, 2026

SweepSA: A Fast Swept Spectrum Analyzer for Pluto-Style AD936x SDRs and the HackRF

Thank you to zxkmm, one of the maintainers of PortaPack Mayhem, for writing in and sharing their new program 'SweepSA', a swept spectrum analyzer for Pluto-style AD936x SDRs such as the AntSDR E310 and LibreSDR. It also supports the HackRF One and HackRF Pro, and is designed to feel more like a bench instrument than an SDR receiver app.

One of SweepSA's core features is speed. It uses the AD936x's little-used 'fastlock' feature, which stores synthesizer profiles that can be recalled almost instantly with a full LO retune. The hop, capture, FFT, and detection all run on the board's ARM CPU, so only the reduced spectrum is sent to the PC, which avoids the slow USB or network round trip on every hop. zxkmm reports sweeps of about 10 - 60 ms over a few hundred MHz, and 500 - 800 ms over the full 70 MHz to 6 GHz range. That's similar to a HackRF One, but with each segment a gapless 40 - 56 MHz wide.

Other features include four traces, eight markers, a waterfall, zero span, and CSV/PNG export. Levels are shown in dBFS with an 'UNCAL' badge until an amplitude correction file is loaded. SweepSA is free for Windows, Linux, and macOS (arm64), with downloads available on GitHub. We note that it is currently closed source, but zxkmm plans to publish the source code later.

sweepsa demo

Watch this video on YouTube

Vote

October 29, 2026

SPECTER: Leaking Data from Air-Gapped Computers by Toggling USB Power States

This October, researchers Hyeongjun Choi, Ji Hyuk Jung and Ji Won Yoon from Korea University and 78ResearchLab in Seoul have published a paper describing "SPECTER", a covert channel that leaks data from air-gapped computers by repeatedly switching the power state of attached USB devices. This first requires installing malware with root or administrator privileges, which then controls power via the operating system's suspend or disable/enable controls. No modification to the peripheral's hardware or firmware is needed.

Three receiving methods were demonstrated, with one being RF based. The first method uses a phone plugged into the port, which then simply logs its charging state as on/off binary data. The second method uses a connected mouse, webcam or USB hub whose status LEDs can be watched by a person or camera. The final method uses a HackRF One with a near-field loop probe to pick up the switching emissions at around 5 MHz. Data rates are only 0.2 to 1 bit per second, so the channel is only useful for short secrets like passwords or keys.

We note that so far, the RF method was only tested with the probe touching the USB cable. This project is similar to USBee, which we posted about in 2016, where an unmodified USB device was also turned into a transmitter via malware. The difference is that USBee requires a data transfer USB device like a thumb drive to be connected, whereas SPECTER can use any connected USB device, even those that are charge-only.

SPECTER RF Receiver Setup with a HackRF One and Loop Probe

Vote

October 29, 2026

SimTX: A Multiplayer Shortwave Radio Simulator with Realistic Propagation and rtl_tcp Support

Recently, we came across SimTX, an open-beta multiplayer shortwave radio simulator. Everyone shares the same simulated band, so whatever one user transmits from their virtual station can be picked up by anyone else, simulated propagation permitting. The website suggests running a pirate station, making your own numbers station, or just tuning around and listening.

For realism, the ionosphere is based on IRI-2020 climatology with live ionosonde data assimilated on top, groundwave and noise follow ITU-R models, and every link passes through a Watterson fading channel with Doppler, multipath and storms. Users can transmit from a mic, an audio file or raw IQ from GNU Radio in modes including AM, SSB, CW, NFM, WFM, WSPR and FT8, and can even launch and track their own satellites.

To receive, the SimTX app runs a local rtl_tcp bridge, so SDR++ or any other rtl_tcp-capable SDR program can tune the simulated band as if it were an RTL-SDR, without any real radio hardware. The app runs on Windows, macOS, and Linux, and accounts are created via Discord. The software does not appear to be open source. The demo video below shows a song broadcast from a simulated Amsterdam and received 1145 km away in Budapest.

This may be useful for playing around with and seeing what different TX/RX variables and propagation effects do to signal reception.

We broadcast a song through a simulated ionosphere

Watch this video on YouTube

Vote

October 29, 2026

Thermal Noise Communication: Sending Data Without a Carrier Signal, with an RTL-SDR as the Receiver

Thank you to RTL-SDR.COM reader Andrea for writing in and pointing us to a recent Stanford University press release about Zerina Kapetanovic and her team's research on "thermal noise communication", a way to send data wirelessly without generating any RF signal at all.

With this communication method, the transmitter simply switches its antenna between two loads, such as a dummy load and an open circuit, which the receiver sees as slightly "hotter" or "colder" thermal noise that encodes binary data. The study claims that a conventional RF transmitter uses up to 1,000 times more energy, making this a possible alternative to RFID tags and low-power wireless sensors.

Our reader Andrea also pointed out that the receiver in one of Zerina Kapetanovic's earlier experiments on the same topic was built around an RTL-SDR. Back in 2022, Zerina Kapetanovic and her team published a paper (pdf upload) demonstrating the idea at 1.42 GHz. Their receiver was a horn antenna, two LNAs with about 84 dB of combined gain, a bandpass filter, and an RTL-SDR, with processing on a laptop or Raspberry Pi. The transmitter was a simple RF switch connected to an antenna and switched between a 50 Ohm dummy load or ground. They achieved a data rate of up to 26 bps and a range of up to 7.3 m at 5 bps, and built a solar-powered, battery-free transmitter that sent indoor temperature readings over five days.

A new paper (not available freely yet) from Kapetanovic and her team builds on this idea and improves the data rate to the kilobit-per-second range, and adds capacity measurements and error correction, which was a limitation of their earlier experiment. The paper and press release also explain why this idea works at room temperature, making the analogy that the receiver's LNA works as a sort of 'electron refrigerator', slowing down electrons and making them appear colder.

We are unsure if the new setup still uses an RTL-SDR. However, readers who have built a Hydrogen line radio telescope have already built a nearly identical setup to the 2022 paper. In the press release Kapetanovic notes that "We've built a system that others could very easily implement", so this may be an interesting experiment to try for anyone who already has an H-line setup.

The thermal noise receiver setup from the 2022 paper

Vote

October 29, 2026

An Unofficial Bilingual English and Chinese User Guide for SDRplay’s SDRconnect Software

Thank you to BG7BAG for writing in and sharing a free user guide for SDRconnect, SDRplay's multi-platform software for their RSP series of SDRs, which we've covered several times before. SDRplay only provides a "Quick Start" guide and a few application notes for SDRconnect, so BG7BAG wrote a full manual from scratch, based on daily use with an RSPdx-R2.

The guide is written side by side in English and Chinese, with a shared glossary of SDRconnect's interface terms, so it may be most useful to Chinese-speaking SDRplay users, for whom there is no official manual. It is based on SDRconnect V1.0.10 and includes a quick start section, a 22-chapter manual covering topics like remote operation, troubleshooting and PPM calibration, and an advanced guide on HDR mode, notch filtering, IQ recording and scheduling.

BG7BAG also shared his HAM Radio Atlas, a free map of over 12,000 amateur radio repeaters on the 2m, 1.25m and 70cm bands, searchable by location, callsign and band. Repeater data currently covers the USA (26 states), Australia, China, Austria and New Zealand, with a province-by-province list for mainland China.

AI Disclaimer: We note that this guide appears to have been written with the help of AI.

Vote