Category: KerberosSDR

DragonOS KerberosSDR Tutorials: Setting up Networked Direction Finding, Monitoring Multiple Signals Simultaneously

DragonOS is a ready to use Linux OS that includes various SDR programs preinstalled. The creator Aaron also runs a YouTube channel that contains multiple tutorial videos for DragonOS. One of the latest videos he's released is a tutorial that shows how to use one of our KerberosSDR (4x Coherent RTL-SDR) units to set up networked direction finding. To do this he uses our core KerberosSDR DSP software, along with RDFMapper, a third party bearing visualization tool with the ability to display bearing from multiple networked direction finding units.

The tutorial goes through the KerberosSDR software install procedure, shows how to set up the various parameters in the software, and then demonstrates it providing data to the RDFMapper software via our open source pyRDFMapper-KSDR-Adapter program. With this setup, you could run multiple KerberosSDR units around a city and use them to locate a signal source rapidly.

KerberosSDR Uploading Bearing data to RDFMapper
KerberosSDR Uploading Bearing data to RDFMapper

DragonOS LTS/10 Bearing Server (KerberosSDR, RDFMapper)

In addition to the direction finding video he's got another video that shows how to use a KerberosSDR and HackRF to simultaneously monitor various signals like home gas meters, ADS-B data, and 433 MHz ISM band devices using programs like rtlamr, rtladsb and rtl_433. What's particularly interesting is how he uses a program called Kismet to manage each radio on the device.

DragonOS LTS/10 KerberosSDR + HackRF One (qspectrumanalyzer, kismet, rtl_433, rtlamr, rtladsb)

KerberosSDR Now Available from ML&S in the UK

KerberosSDR is now available for sale from Martin Lynch & Sons (ML&S) in the UK for £169.95 incl. VAT. Quantities are limited. ML&S have also created a short overview video shown below.

The KerberosSDR is our 4-channel phase coherent capable RTL-SDR unit that we previously crowdfunded back in 2018.  With a 4-channel phase coherent RTL-SDR interesting applications like radio direction finding, passive radar and beam forming become possible. It can also be used as 4 separate RTL-SDRs for multichannel monitoring.

Virtual Video Visit Episode 4, The Kerberos 4 Coherent SDR new to ML&S

For non UK customers the KerberosSDR is also available from the USA with international shipping from the Othernet store and Hacker Warehouse for US$149.95.

The KerberosSDR: 4x Tuner Coherent Capable RTL-SDR
The KerberosSDR: 4x Tuner Coherent Capable RTL-SDR

KerberosSDR: Tracking Aircraft on a Map via Passive Radar and Beamforming Only (Future Code Demonstration)

If you've been following KerberosSDR development (our US$149 4 channel coherent RTL-SDR), then you'll know that one interesting experiment that you can set up with it is a passive radar. Passive radar makes use of already exiting strong transmitters that broadcast signals such as FM, DAB and HDTV.

With one directional antenna pointing towards the transmitter, and one pointing in the general direction of moving objects like aircraft, it's possible to detect the transmitted signal being reflected off the aircraft's body.From the time delay and doppler shift detected in the reflected signal, a simple distance/speed plot showing the aircraft in motion can be created. This previous post shows an example of what information you could potentially collect in a range/speed graph over time. In the past we've also used passive radar to detect vehicles and measure how much traffic is in a neighbourhood.

However, with two antennas we can only get the detected object's range and distance information. If we use four antennas (one pointing towards the transmitter, and three pointing in the direction of objects), it is possible to use beam forming techniques combined to obtain an estimated map coordinate of the object. This is possible as we then we have distance information available from the passive radar algorithm, and bearing information available from the beam forming algorithm.

Tamas Peto who wrote our open source KerberosSDR code has been working on some new upcoming features for the KerberosSDR software, and beamformed direction finding of passive radar is one of them.  We note that to be clear this software is not yet released, and we still expect there to be several months before it is ready. At the moment all data was processed manually offline after collecting data with a KerberosSDR as part of this early test.

The image below shows an example of a recent measurement made from an aircraft. The red tracks show the actual ADS-B GPS coordinates of the aircraft, and the black line indicates the positional data measured from a DAB signal reflecting off the aircraft body. The orange line to the east indicates the main lobe of the three beam formed directional antennas, and the lines to the west indicate transmit towers.

The measured trajectory is only about 1-2 km off the actual one. Tamas notes that the position offset may be because at the moment altitude is not measured yet.

If you're interested in more information, Tamas created a PowerPoint presentation which can be downloaded from our Google Drive.

Passive Radar with Beamforming and Direction Finding
Passive Radar with Beamforming and Direction Finding

Other upcoming features that are planned for the KebrerosSDR code include being able to use direction finding on short bursty signals, improvements to networked direction finding and beamforming which may be useful for applications like radio astronomy and performance improvements.

KerberosSDR can be purchased from the Othernet store or Hacker Warehouse, and every purchase helps us fund development of more interesting features like passive radar beamforming!

A FM Radio Passive Radar System from Two RTL-SDR Dongles

Over on his blog, Max Manning has posted about his senior year design project which was an RTL-SDR based passive radar system that he created with his project partner Derek Capone. Max's writeup explains what passive radar is, and how the theory works in a very easy to understand way, utilizing graphs and short animations to help with the understanding. The rest of the post then goes into some deeper math, which is also fully explained.

Passive Radar works by using already existing powerful transmitters such as those for TV/FM. A receiver listens for these signals being reflected off of objects like aircraft and vehicles, and compares the reflection with a signal received directly from the transmitter. From this information a speed/range graph of detected objects can be calculated

For hardware, the team used two RTL-SDR dongles with the local oscillators connected together. A standard dipole is used as the reference antenna, and a 5-element Yagi is used as the surveillance antenna.

Max's post is a great read for those trying to understand how to do passive radar with a KerberosSDR which is our 4x coherent input RTL-SDR unit available from the Othernet store or Hacker warehouse. Being a radio capable of coherency, it is useful for applications like passive radar and direction finding. 

Their code is all open source and available on GitHub. We note that their code should also work with KerberosSDR with only either zero to minor modifications required. However, for the KerberosSDR we also have our own passive radar code available which might be a little easier to setup via the GUI.

Passive Radar with Two RTL-SDR dongles sharing a single clock.
Passive Radar with Two RTL-SDR dongles sharing a single clock.

KerberosSDR 4-Channel RTL-SDR Passive Radar with Peak Hold Display

Recently we've been testing a simple peak hold for the KerberosSDR passive radar display. This results in some nice graphs that show aircraft and vehicle activity over time. 

Passive radar works by using already existing transmitters such as those for HDTV and listening for reflections that bounce off of RF reflective objects. With a two antenna setup, it is possible to generate a bistatic range/doppler speed graph of reflected objects.

With the reference Yagi antenna pointed towards a 600 MHz DVB-T tower, and the surveillance antenna pointed to an airport we were able to obtain the graph below. The top two large traces show aircraft heading towards our station, whereas the bottom traces show aircraft leaving the airport. Also visible are multiple blips with smaller doppler speeds, and these correspond to vehicles.

KerberosSDR Passive Radar Display Peak Hold
KerberosSDR Passive Radar Display Peak Hold

The code on the KerberosSDR git will be updated in a few days time. We are also working on a more comprehensive passive radar tutorial that will try to explain concepts like processing gain, bistatic ranges and other important tips for getting good passive radar results. At the same time we're also working on improving direction finding ease of use by prototyping antenna switches for calibration, and working on getting 4-channel beamformed passive radar working which will allow us to plot passive radar returns on a real map.

The KerberosSDR is our 4-channel phase coherent capable RTL-SDR unit that we previously crowdfunded back in 2018.  With a 4-channel phase coherent RTL-SDR interesting applications like radio direction finding, passive radar and beam forming become possible. It can also be used as 4 separate RTL-SDRs for multichannel monitoring. KerberosSDR is currently available from the Othernet store and Hacker Warehouse for US$149.95.

Using a KerberosSDR to Monitor Air Traffic Control Voice, ADS-B, ACARS & VDL2 Simultaneously on a Raspberry Pi 3B+

The KerberosSDR is our 4-channel phase coherent capable RTL-SDR unit that we previously crowdfunded back in 2018.  With a 4-channel phase coherent RTL-SDR interesting applications like radio direction finding, passive radar and beam forming become possible. KerberosSDR is currently available from the Othernet store and Hacker Warehouse for US$149.95.

Although the KerberosSDR was mostly created to help unlock projects requiring phase coherency, we've had interest from multiple users asking for information on how to use the KerberosSDR as a tool for monitoring multiple separate signals at once.

Doing this is actually very simple. If you ignore the extra circuitry to make the KerberosSDR phase coherent, the KerberosSDR is at it's core just 4 separate RTL-SDR dongles connected to a quality USB hub. So if you're not using our coherent demo software, then plugging a KerberosSDR into a PC or single board PC will result in four RTL-SDR dongles that can be accessed individually.

The tutorial below could also be done with four individual RTL-SDR dongles, but you would also want to have a reliable powered USB hub.

Example Aviation Radio Monitor

Below we show an example tutorial of how the KerberosSDR could be used as a 4-channel aviation monitor for monitoring air traffic control, ADS-B, ACARS and VDL2 simultaneously on a single Raspberry Pi 3B+. The video below shows a demo.

KerberosSDR Monitoring Air Traffic Control Voice, ADS-B, ACARS & VDL2 on a Raspberry Pi 3 B+

The first step is to simply burn the latest Raspbian Buster to an SD Card, and set up your WiFi wpa_supplicant file as you would on any standard Raspbian install. Also add a blank file called "SSH" or "SSH.txt" to the boot directly to enable an SSH connection. Alternatively you could set this up with a monitor. We used Raspbian Buster Lite, as we are not intending to use the desktop GUI.

Next use PuTTY or your preferred terminal software to connect to your Raspberry Pi via SSH. You may need to use your routers config software/page to find the IP address of the Raspberry Pi. The default SSH port is 22.

Finally, update the repos on your install before continuing with the software installation process.

sudo apt update
sudo apt install librtlsdr-dev rtl-sdr

KerberosSDR Hardware Setup

Here we connected a single quarterwave ground plane antenna tuned to the airband frequencies to three input ports on the KerberosSDR via a cheap RF TV splitter. The fourth antenna input was to a RadarBox ADS-B antenna.

The KerberosSDR and Raspberry Pi are powered via two official Raspberry Pi 5V plug packs, and the KerberosSDR is connected to the Pi via a single short high quality USB cable.

Setup Topology
Setup Topology

Installing RTL-Airband

RTLSDR-Airband is an efficient command line based scanner program for the RTL-SDR. It works by rapidly scanning over a set of frequencies and looking for active signals, and playing the active AM or FM transmission. When an active signal is found it can be configured to stream the audio to an Icecast server, record to a file, or to play directly to your speakers. Alternatively you can also configure it to stream multiple channels simultaneously. If set up to stream to an Icecast server you can listen to the scanned audio from any device on your network with an internet browser.

Here we will use RTL-Airband to scan the air traffic control voice bands which are used by air traffic controllers and pilots to communicate by voice with one another. The transmissions are in AM and are found between 118–136.975 MHz.

First install the pre-requisites, and then install RTL-Airband.

sudo apt-get install -y build-essential libmp3lame-dev libshout3-dev libconfig++-dev libraspberrypi-dev librtlsdr-dev

wget -O RTLSDR-Airband-3.0.1.tar.gz
tar xvfz RTLSDR-Airband-3.0.1.tar.gz
cd RTLSDR-Airband-3.0.1
make PLATFORM=rpiv2
sudo make install

Next install an Icecast server onto your Raspberry Pi. This will allow us to connect to the Pi via a web browser to listen in to the audio.

sudo apt-get install icecast2 -y

The install steps will ask you to input admin passwords of your choice, make sure you remember or write these down.

Now edit the rtl_airband.conf file with:

sudo nano /usr/local/etc/rtl_airband.conf

Paste in the configuration below making sure to set the actual frequencies used by air traffic control and airlines in your particular area by adding or removing frequencies from the "freqs" line.

Also be sure to set the "index" to whatever antenna input you have used (0 - 3) on your KerberosSDR for your VHF air band antenna. You may want to experiment with the gain value, but for now you can leave it as default.

If you are using another template for the config file, ensure that the "correction" value is set to 0 as the KerberosSDR uses a TCXO and requires no PPM correction.

Finally, don't forget to also set the Icecast server password that you set up in the previous step, making sure to leave the username as "source".

type = "rtlsdr";
index = 2;
gain = 32;
correction = 0;
mode = "scan";
freqs = ( 118.1, 118.7, 119.5 );
labels = ( "Tower A", "Tower B", "Tower Control");
outputs: (
type = "icecast";
server = "";
port = 8000;
mountpoint = "stream.mp3";
name = "Airband Voice";
genre = "ATC";
description = "My local airport - aggregated feed";
username = "source";
password = "kerberos";
send_scan_freq_tags = false;

Next set up the Icecast server if required using the instructions here. If the default port and number of source is fine for you, you can leave everything as default.

Now to start RTL-Airband run:

sudo rtl_airband -f

To listen to the scanned audio, browse to http://RASPI_IP_ADDRESS:8000/stream.mp3 on any device connected to the same network

Installing dump1090

Leave the RTL-Airband PuTTy window open, and open a new instance of PuTTy and once again connect to the Raspberry Pi in a new session. We will install the FlightAware branch of dump1090, as this is the most up to date version. dump1090 allows you to track aircraft that are transmitted ADS-B.

sudo apt-get install build-essential debhelper librtlsdr-dev pkg-config dh-systemd libncurses5-dev libbladerf-dev
git clone
cd dump1090
dpkg-buildpackage -b

Now we can run dump1090 with the following line. Make sure to set the "--device 3" flag to the antenna input that you have connected your ADS-B antenna to. In our case we connected it to the last SMA input which is input 3.

./dump1090 --device 3 --interactive --net

Now to view the data on a map, you can install Virtual Radar Server on any Windows PC on the same network. Once installed, add an "AVR or Beast Raw Feed" receiver, with the IP address of your Raspberry Pi and Port 30002.

Installing ACARSDeco2

Again, leave both PuTTy windows open, and open a new PuTTy SSH terminal and connect again. Here we'll install ACARSDeco2 which is a multiband ACARS decoder. ACARS is an acronym for Aircraft Communications Addressing and Reporting System which is a digital communications system that aircraft use to send and receive short messages to and from ground stations. Most messages are unreadable telemetry data intended for computers, but often you will see messages about weather, wind, dangerous cargo warnings, fuel loading information and more.

ACARSDeco2 is not an open source program, so you'll need to first download the compressed file from on a PC. Make sure to get the Raspberry Pi 2/3 version of ACARSdeco2 for Stretch.

Now use a program like WinSCP to transfer the .tgz file to the Raspberry Pi. In WinSCP select SCP as the file transfer protocol, log in with "pi/raspberry" and drag the file over to the Pi's home folder.

Then back on the Raspberry Pi, simply move the file into it's own folder, and extract the files.

mkdir acarsdeco2
mv acarsdeco2_rpi2-3_debian9_20181201.tgz acarsdeco2
cd acarsdeco2
tar -xvzf acarsdeco.tgz

Now you can run the program with the following command. Make sure to specify the ACARS frequencies used in your area if they are different. Also here we used antenna input 1 for the ACARS antenna and specified that with "--device-index 1". If you are running Virtual Radar Server on your Windows PC as explained in the dump1090 install, you can enter the Windows VRS server IP address, so that location data will be sent back to the ACARSdeco2 server.

./acarsdeco2 --device-index 1 --freq 131550000 --freq 131450000 --gain 34 --http-port 8081 --vrs-url

Now on your Windows PC, open a browser and open PI_IP_ADDR:8081 to view the incoming ACARS messages.

Installing dumpvdl2

Again, leave both PuTTy windows open, and open a new PuTTy SSH terminal and connect again. Here we will install dumpvdl2 which is a VDL2 decoder. VDL2 is a replacement for the aging ACARS system which is being phased out in some areas. In some areas VDL2 is now more common than ACARS, and in some areas it's the opposite.

First install pre-requisites.

sudo apt-get install build-essential cmake git libglib2.0-dev pkg-config librtlsdr-dev

Dumpvdl2 requires libacars to work, so install libacars first:

git clone 
cd libacars
mkdir build 
cd build 
cmake ../ 
sudo make install 
sudo ldconfig

Finally, install dumpvdl2

git clone
cd dumpvdl2
mkdir build
cd build
cmake ../
sudo make install

Now to run dumpvdl2:

dumpvdl2 --rtlsdr 2 --gain 35

dumpvdl2 has no webserver so it can only be viewed from the terminal window.

Alternative Tools

Stations in the USA could replace one program with dump978, which decodes UAT positional data from smaller aircraft. If you live near a glider range, a FLARM decoder could also be used. You could also run an AIS receiver if you live near a water way.

Further Steps

If setting this up as a permanent station, you might want to go ahead and create a startup script that runs these programs on boot. Then you won't need to open up PuTTy terminals to start all the programs. The easiest way to do this is to use the @reboot code in crontab to run your script. Be sure to use sudo crontab -e for running RTL-Airband as this requires root.

Networked Radio Direction Finding with KerberosSDR and RDFMapper

We've just uploaded a short Python script to GitHub that allows radio direction bearings from a KerberosSDR to be used with the RDF Mapper software created by Jonathan Musther. RDF Mapper is a (~US$25) program that was initially written for the RDF42, a kit based doppler direction finding system. RDFMapper runs on Windows/MacOS and Linux.

KerberosSDR is our experimental 4-Tuner Coherent RTL-SDR product made in collaboration with Othernet. It can be used for applications such as radio direction finding and passive radar. Currently it's available for US$149 on the Othernet store.

The RDF Mapper software allows you to upload bearings from multiple devices distributed around a city to a public RDF server, and view all the bearings on any internet connected PC. This can allow you to quickly triangulate the location of a transmitter.

Normally you would use RDFMapper combined with an RDF42 to upload bearings, but we've written a simple script that can be used to upload bearings generated by a KerberosSDR onto the server. The RDFMapper software can then be used to visualize those bearings.

The script is based on Python, and can run directly on the Pi 3/4 or Tinkerboard that is running the KerberosSDR, or on another PC that can see the KerberosSDR bearing server if you prefer.

Instructions are available on the GitHub page. Simply set unique station names for each of your distributed units, entry your lat/lon and fixed direction bearing. Then on the RDF Mapper software open the 'Web upload/download' tab and add the unique station ID name. All the other tabs for connecting to a GPS and serial port can be ignored, as those are used for the RDF42.

This script will only work for stationary KerberosSDR units as the lat/lon is fixed. If you want to try radio direction finding in a vehicle, we recommend using our Android App for a better experience. If there is interest, we may also add support for the Android app to upload to an RDFMapper server for mobile bearing uploads. 

Notes: RDFMapper runs on the system's default browser and it needs to run in either Chrome or Firefox to work. IE does not work. It also appears that Jonathan processes orders manually, so we just want to note that there may be a delay between payment and receiving the software.

RDF Mapper Software. Data from networked units.
RDF Mapper Software. Plotting bearing data from networked units.

Measuring Traffic in a Neighborhood with KerberosSDR and Passive Radar

KerberosSDR is our four tuner coherent RTL-SDR product made in collaboration with Othernet. With KerberosSDR applications like radio direction finding and passive radar are possible, and our free open source demo software helps to make it easier to get started exploring these applications. In this post we explore how a simple passive radar setup can be used to measure how busy a neighborhood is in terms of vehicular traffic.

KerberosSDR is currently available from the Othernet store for US$149.95, and the setup guide is available at

Passive radar makes use of already existing strong 'illuminator' signals such as broadcast FM, DAB, digital TV and cellular. When these signals reflect off a moving metallic object like an aircraft or vehicle, it distorts the signal slightly. By comparing the distorted signal to a clean signal we can determine the distance and speed of the object causing the reflection. Wide reaching digital signals like DVB-T and DAB are often the best illuminators to use. Wideband cellular signals can also be used to detect more local targets.

In a simple passive radar system we use two directional antennas such as Yagi's. One Yagi points towards the broadcast tower and receives the clean non-distorted reference signal. This is known as the reference channel. A second Yagi points towards the area you'd like to monitor for reflections, and this is called the surveillance channel.

In our setup we point the reference channel Yagi towards a 601 MHz DVB-T transmitter roughly 33 km away. A second Yagi is placed on a vantage point overlooking a neighborhood. The Yagi's used are cheap DVB-T TV Yagi's that can be found in any electronics or TV retail store (or on Amazon for ~$30 - $60 USD).  In the software we used a bandwidth of 2.4 MHz and adjusted the gains for maximum SNR.

It is important that the surveillance channel is isolated from the reference signal as much as possible. We improve the isolation simply by placing a metal sheet next to the surveillance Yagi to block the reference DVB-T signal more. Note that putting the antennas outside will obviously result in much better results. These walls and windows contain metal which significantly reduce signal strength. We also added our RTL-SDR Blog wideband LNA to the surveillance channel powered by a cheap external bias tee to improve the noise figure of the surveillance channel.

KerberosSDR Passive Radar Setup
KerberosSDR Passive Radar Setup
Surveillance Antenna View
Surveillance Antenna View

The resulting passive radar display shows us a live view of objects reflecting. Each dot on the display represents a moving vehicle that is reflecting the DVB-T surveillance signal. In the image shown below the multiple colored objects in the left center are vehicles. The X-Axis shows the distance to the object, and the Y-Axis shows the doppler speed. Both axes are relative to the observation location AND the transmit tower location.

Vehicles on the Passive Radar Display
Vehicles on the Passive Radar Display

When there are more moving cars on the road during the day and rush hours, there are more blips seen on the passive radar display. Larger vehicles also produce larger and stronger blips. By simply summing the matrix that produces this 2D display, we can get a crude measurement of how busy the neighborhood is, in terms of cars on the road since reflections are represented by higher values in the matrix. We logged this busyness value over the course of a day and plotted it on a graph.

The resulting graph is as you'd intuitively expect. At 6AM we start to see an increase in vehicles with people beginning their commute to work. This peaks at around 8:30AM - 9am with parents presumably dropping their kids off to the neighborhood school which starts classes at 9AM. From there busyness is relatively stable throughout the day. Busyness begins to drop right down again at 7PM when most people are home from work, and reaches it's minimum at around 3am.

Traffic Busyness detected with KerberosSDR Passive Radar
Traffic Busyness detected with KerberosSDR Passive Radar

One limitation is that this system cannot detect vehicles that are not moving (i.e. stuck in standstill traffic). Since the doppler speed return will be zero, resulting in no ping on the radar display. The detection of ground traffic can also be distorted by aircraft flying nearby. Aircraft detections result in strong blips on the radar display which can give a false traffic result.

It would also be possible to further break down the data. We could determine the overall direction of traffic flow by looking at the positive and negative doppler shifts, and also break down busyness by distance and determine which distances correspond to particular roads. In the future we hope to be able to use the additional channels on the KerberosSDR to combine passive radar and direction finding, so that the the blips can actually be directly plotted on a map.

If you want to try something similar on the KerberosSDR software edit the RD_plot function in the _GUI/ file, and add the following simple code before CAFMatrix is normalized. You'll then get a log file traffic.txt which can be plotted in excel (remember to convert Unix time to real time and apply a moving average)

CAFMatrixSum = np.sum(CAFMatrix)
trafficLog = open("traffic.txt", "a")
logString = str(round(time.time())) + "," + str(round(CAFMatrixSum)) + "\r\n"