Electrosense: RTL-SDR Based Crowd Sourced Spectrum Monitoring with a DC to 6 GHz Up/Downconverter

Recently we came across Electrosense which is an interesting open source project that aims to deploy radio spectrum sensors worldwide in order to analyze and understand radio spectrum usage. This information could be extremely valuable in order to make more efficient use of the limited radio spectrum, and for detecting sources of interference and illegal transmissions. The hardware that Electrosense uses consists of just an RTL-SDR, Raspberry Pi, antenna and an optional GPS for time synchronization.

The ElectroSense network is a crowd-sourcing initiative to collect and analyse spectrum data. It uses small radio sensors based on cheap commodity hardware and offers aggregated spectrum information over an open API.

The initiative's goal is to sense the entire spectrum in populated regions of the world and to make the data available in real-time for different kinds of stakeholders which require a deeper knowledge of the actual spectrum usage.

ElectroSense is an open initiative in which everyone can contribute with spectrum measurements and access the collected data.

High-level overview of the Electrosense network: Low-cost sensors collect spectrum information which are sent to the Electrosense backend. Different algorithms are run on the collected information in the backend and the results of these algorithms are provided to the users as a service through an open API. Users can develop their own applications from the spectrum information retrieved using the API.
Overview of the Electrosense network

There are already several spectrum sensing projects in the works by big companies like GoogleMicrosoft, and IBM, but these only cover a small portion of the spectrum, or use high cost sensing stations limiting their ability to be deployed on a wide scale. Electrosense solves these problems by using low cost RTL-SDRs, and a crowd sourcing paradigm.

At the time of writing there are 103 sensors registered to the Electrosense network, with 23 being online, most of which are in Europe. Once you register an account on their site, you can browse the active sensors. Clicking on the spectrum button for a sensor brings up a live spectrum graph. For example in the screenshot below we access the data from an RTL-SDR + downconverter sensor in Madrid. We're able to see a live wideband 20 MHz to 6 GHz spectrum scan, and graphs of frequency occupancy rates.

Electrosense Active Sensors
Electrosense Active Sensors
Electrosense Spectrum Scan and Occupancy Graphs
Electrosense Spectrum Scan and Occupancy Graphs

In addition to the standard SDR hardware being used, they've also designed a very interesting open hardware/source DC to 6 GHz up/downconverter board. The board is USB controlled, and switches between the upconverter for the lower HF bands, pass through for receiving DC- 1.6 GHz, and the downconverter for receiving up to 6 GHz. It has a 20 MHz output bandwidth which means that wide band SDRs can also make use of it.

Electrosense Up/Downconverter
Electrosense Up/Downconverter

The Electrosense website notes that anyone can host a sensor, and if you meet their criteria (permanent internet connection, ethernet connectivity and a low interference location) you can apply for a free kit. If you aren't selected for a free kit, then the Jetvision store based in Europe is selling Electrosense kits that include an RTL-SDR Blog V3, Raspberry Pi 3, power supply, SD card with preinstalled Electrosense software, and either our multipurpose dipole antenna, or a wideband discone with 15m of low loss cable for roof mounting.

The Electrosense team have been working hard on this project and have already published several related papers and a magazine article about the Electrosense network and it's use cases. One interesting paper discusses a method for decoding wideband signals using a network of non-coherent RTL-SDRs. Another paper discusses using using deep learning for automatic signal classification. The full list of publications can be found on their publications page.

If you're interested in this type of crowd sourced spectrum project, then you might also want to take a look at the KiwiSDR which is a networked 0 - 30 MHz SDR. Multiple crowd sourced KiwiSDR's can be used in a TDoA calculation for determining transmitter locations.

Subscribe
Notify of
guest

17 Comments
Inline Feedbacks
View all comments
Stu C

Tried it, 100% channel occupancy here, could not see them sending the downconverter which was one of my reasons for joining (China needs to start making those). Doesn’t feel right to me, like a good academic idea hijacked by corps looking to grab some cheap data. I quit the program (painless but not fast).
There needs to be a community corporates-excluded version as we the public need to know what we are being exposed to without giving the corps easy cheap ride.
Next project will probably be upward facing cameras funded by Amazon, “we have done research and there is lots of unused airspace suitable for our drones!”.

Laurin Cavender

I will chime in again, if you think for one second that a scheme such as this will be relied on by our government or any government for that matter, you may aly those fears. There are already such systems in place we just do not have access to them in most instances. There are many SDRs available to Hams and SWLs you can find them if you will just search the internet. That said I think it is a great idea! Look how it has worked for ADSB. Besides as I said the Gov’t probably most all governments has this type system already in place if they can at all afford to do it. I know for a fact that there are commercial companies pandering to large corporations mostly that even have innocent looking “Satellite TV” dishes set up on guard shacks with microphones on them listening to what is being said on docks and in parking lots by anyone on the property that they can see. And probably folks not on there property if they can be seen! So one would have to be mighty naive not to think that they are also listening to and for any RF source. I have been an RF Engineer for most of my life and consult for various organizations and I have had recorded transmissions brought to me asking my help to identify the signal and what information is being passed on it. This has taken many formats and is sometimes identifiable even decodable once it was as simple as a speech inverter. While in this case it was simply an employee talking to his girlfriend on company time the company’s Inquiring Minds Want To KNOW! As was said this levels the playing field, after all just because a cat wears a badge and uniform does not mean that we don’t want a bell around his neck too! It tends to keep people honest when they know that they can be held accountable for their actions! Laurin WB4IVG

James

Everyone’s sooo paranoid… I think its a great idea.?

James

Well i applied for a free kit and got approved straight away probs as theres no sensors in AU.. kit doesnt come with the DC to 6 GHz up/downconverter board but once your up and running with the RasPi & RTL-SDR then you go on some sort of sponsor list for the DC to 6 GHz up/downconverter board or if they think you got a good location they may provide one for free.?

John

electrosense.org is not just a harmless non-profit organisation in Switzerland. They are backed by the SPS Programme of NATO
https://www.networks.imdea.org/research/projects/myp-socrates
So please stop promoting an organization which uses opensource as an excuse to attract us nerds to help by collecting data for military and secret agencies

BadDad

Note the references to projects from Google and Microsoft in the article. These projects are being used to map spectrum for frequency grabs.

Timmy

That board looks interesting, shame that was created in Altium Designer, kinda limits who has access, and makes it difficult to even view the schematic (At least the LimeSDR projects, which also use Altium, included a pdf of the schematic). But Altium was probably required to allow the final board design to tune up to 12GHz (ref: https://github.com/electrosense/hardware/blob/master/electrosense-converter-firmware/firmware/drivers/system.c#L238 ).

Looking at the Bill of Materials in github::
It has the same frequency synthesizer chip as the HackRF (and moRFeus)
MAX2870 – 23.5MHz to 6000MHz Fractional/Integer-N Synthesizer/VCO

And a relatively new mixer chip, well it has been about for maybe a year but, the current price point is starting to make it more attractive.
LTC5549 – RF Mixer 2GHz to 14GHz Microwave Mixer with Integrated LO Frequency Doubler

There is also clever use of a GPS SAW filter B39162B3522U410 (1.574397 GHz to 1.576443 GHz) on the IF output of the Mixer. Because it is a widely used part the price is much lower for a very high quality filter.

Franco

Hello,
I can upload the PDF files of the schematic and also the gerber files of the layout if you like.

arishay

Yea, no thanks. This seems great but it has too much of a surveilance vibe. God forbid someone accidentally transmits and the FCC uses it as evidence to prosecute us in the near future.

Laurin Cavender

How little you realize! This has been done for over 50 years, with predetection recording. When I was but a young and adventurous RF Explorer I built just such a Rube Goldberg device in the late 1960’s. I became aware that video recorders put out signals in the 80 meter ham band. Realizing that when I played back a taped prerecorded session it caused the same signals to be present at the same exact frequencies I studied the service manual for the video recorder that I was working on. Upon studying them very closely that these video signals were in the 3 to 4 megacycle (now called MegaHertz) range both on record and playback. I then tried first hooking an antenna into the video input ( with very little but noticeable results!) I then added an Ameco tunable recieve preamp in line between the antenna and the BNC video input. After tuning it to the 80 meter range I recorded and then played it back listening with my old National NC109 reciever. Over and over I heard the same signals. I did a deeper dive into the service manual and found points closer to the record and playback heads that served my purpose better. I soon acquired a similar recorder from a local cable tv station that they were nolonger using due to upgrade. I got the required service manual on that unit after confirming that it functioned the same as the first unit had, I proceeded to modify it to my purposes. I found the best point to apply my preamped antenna input signals, then found the cleanest strongest output signals from the tape head and fed them to new BNC connectors mounted on the rear of the unit. I then realized that I needed a way around the tuned input. I found some preamps made by HP at a Radio. Swapmeet. No one much at that time knew what good they were, so they were cheap for a while. Once it was discovered that were for use in the input section of extremely expensive HP Frequency counter that covered up above 1000 Megacycles, not only were they literally Gold but Gold in the eyes of experimenters because 2 meters was all the rage and 450 was coming on, so everybody but everybody wanted preamps to improve their receiving equipment. This drove the price high on these items (as it is still today, when they are available. ). These are wideband preamps, VERY wide band, covering way more than the recorder was capable of, I even used these on the 6 meter band, but I digress. Meanwhile back at the ranch, I built an addition to my setup by enclosing one of these HP preamps in a metal RF sealed enclosure and putting the wideband preamp in place of the frequency tuned one. Now I could run my recorder come back later and play it back and tune up and down the bands with my reciever and listen to various signals on various frequencies over and over. I discovered that on the bottom end my limit was my receivers capabilities which was around 500 Kilocycles. The top end was a little over 10 Megacycles. The receiver was hot enough here, I knew that from frequently listening to traffic in the 11 Megacycle range. But the recorder or the playback section was almost nonfunctional above 10 Megacycles. Sure I could hear WWV and the Strongest of stations on 11.175 Mhz but not much else up there. However down at 2.5, & 5.0 WWV was excellent, conditions permitting. 160, 80, 40 Meters were really functional. I added an old Pan-Adapter that came from an old WWII Radar and Surveillance set up so that I could see either side of the frequency that I was tuned to. This all predated Spectrum Analyzers as we know them today, and long before that I could afford one. With my setup I could record when I had to leave, then when I got back, rewind tune to the desired frequency and listen. Once I heard something of interest (i.e. an interfering signal) I could then tune WWV and know the exact time of the incident. That is the way that the FCC finds offending signals. A report is made of interference on a certain frequency, they pull up the time frame in question, go to the frequency in question and document the interference as evidence of the occurrence. This is the way predetection recording works in principle, while there have been enormous advances in technology, the premise remains the same today. The FCC has shuttered many of their field offices, and the monitoring stations are all but unmanned. Routine maintenance and other scheduled events are still manned but most of the time they are simply remote stations for antennas and remotely operated SDRs. Those stations are mostly remotely monitored by other machines recording wide swaths of frequencies that can be pulled back up and investigated at any future time. Those records are stored in a giant server farm somewhere for those who need access to have at their disposal at some future time. Laurin WB4IVG

Bruce Robertson

WOW, impressive. Thanks for telling us.

Nice

Amazing!!! Great story, very clever on your part, must have been very few people in the world had access to what you did, and homebrew! Love it!

proto

It’s not that this helps big corporations to snoop. This helps EVERYONE to snoop. Do you want a level playing field or not?

freedomf

When we have uncrackable encryption to use on our radios, ill consider that a level playing field. Until then sod big government and big corporations.

Dodo

They just do spectrum (FFT) monitoring so you can’t really decode the transmission unless you use very slow AM or PSK or something 🙂

OKCarl

Would be nice if the downconverter could be teamed up with the UNIDEN SDS 200. I would buy a UNIDEN in a heart beat if I could make it reach all the way up to 6.0 Gigahertz and had the bandwidth of a HackRF. These people need encouragement.

freedomf

Helping corp to snoop, no thanks