AirNav is the company behind RadarBox24.com, a flight data aggregation service similar to sites like FlightAware.com and FlightRadar24.com. RTL-SDR hardware is typically used to receive ADS-B, and like other providers AirNav have their own custom ADS-B optimized RTL-SDR unit. In addition they sell RTL-SDR's optimized for UAT 978 MHz and the VHF Airband. They also have a range of ADS-B/UAT/VHF airband outdoor antennas as well as filters.
Currently their products are discounted by 20% for Black Friday/Cyber Monday sales. The discount is available on Amazon, as well as directly from their store with coupon GET20.
At this years ICNP 2020 IEEE conference a paper titled "Real-World ADS-B signal recognition based on Radio Frequency Fingerprinting" (pdf file) was presented by researchers from Harbin Engineering University in China. The idea presented in the paper is to use RF "fingerprinting" techniques to uniquely identify and confirm that the ADS-B signal originates from the correct aircraft source.
RF fingerprinting works on the premise that every transmitter has small manufacturing variances that result in slightly different signals be transmitted, resulting in a unique "fingerprint" that can be traced to a particular transmitter. The idea here is to use these fingerprints to ensure that a known aircraft is indeed transmitting an ADS-B signal and the signal is not being transmitted from a fake spoofer. ADS-B is completely unencrypted and not authenticated, so spoofing of ADS-B signals may be a real security threat.
In the teams research they use an RTL-SDR to collect ADS-B signals from five different aircraft. They then use that data to create "Contour Stellar Images" and train a deep learning neural network which after training accurately identifies which aircraft a signal comes from.
Over on his blog Ian Renton has posted about his dual plane and ship tracker project that he's titled "Plane/Sailing". The project consists of several elements including one FlightAware Pro Stick and Pimoroni ADS-B antenna for the aircraft tracking, and an RTL-SDR Blog V3 dongle and Diamond X-50 AIS antenna for the ship tracker.
Ian runs each dongle on a seperate Raspberry Pi. For aircraft the dump1090 software is used to decode the data, and it passes that data to multiple aggregator feeders such as FlightAware, FlightRadar24, ADS-B Exchange and OpenSky. For ships he uses rtl_ais which feeds into AIS Dispatcher which in turn feeds multiple marine aggregators such as Marine Traffic, VesselFinder, AIS Hub, Pocket Mariner and Ship Finder.
His system also feeds a personally hosted web front end based on his umid1090 software. umid1090 is a replacement for dump1090's web interface, the main difference being that the map is presented using military symbology. For the "Plane/Sailing" project he also extended umid1090 to be able to read the AIS ship position data from AIS Dispatcher's KML output file, and created a clean dark interface. The result is a slick looking map displaying both the tracked aircraft and ships. Ian's web interface for his system is public, and can be viewed at planesailing.ianrenton.com.
The Plane/Sailing Web Interface (Based of UMID1090)
In the past we've posted about the QIRX software a few times as it is an RTL-SDR compatible program that has a focus on DAB+ decoding. However, recently QIRX author Clem wrote in to let us know about version 3 beta, which is now a multi-mode receiver supporting modes such as ADS-B, AM, NBFM, WFM, SSB as well as DAB+ as it did in previous versions. It also now support ADS-B plane mapping, and can run multiple RTL-SDRs at once. We note that this version is not yet available for public download, however you can get the beta by contacting the author (details below). Clem writes:
In short, there are two main new features:
Multi-Receiver: More than one hardware RX can be connected, all I/Q data are fed via TCP/IP, local or remote. The configuration is read from the config file, per default prepared for three receivers.
As before, TCP/IP drivers for RTL-SDR dongles, the RSPs (RSPDuo single-channel), and Airspy. All binaries are part of the installer.
Although the software is "general purpose", particular emphasis has been given to serve aviation enthusiasts.
ADS-B: Aircrafts are displayed on the map. Information for about 450.000 aircrafts comes from an open database kindly provided by Opensky-network.org, updateable by the user from within the software, similar like the DAB database. The ADS-B decoder is a C# port of the well-known dump1090 software, with enhancements to decode aircraft ground movements.
The displayed aircrafts are those within the range of the attached receiver. In contrast to some other applications, it might be noted that the software is capable to decode the movements of the aircrafts not only when airborne, but also on the ground, of course when in range. This might be interesting for plane spotters, perhaps in the vicinity of an airport.
The AM decoder provides special features when tuned to the airband range and - as should be standard nowadays - 8.33kHz channel separation has been selected. In contrast to older times, in airband communications no longer frequencies in MHz are communicated, but channels. The software (in live mode, not visible in the above picture taken from a file replay) provides an own airband channel selector, directly accepting channel numbers as spoken by ATC controllers. This is paired with the indication of channels in the spectrum, together with the corresponding frequency. With 8.33kHz channel separation, cheap dongles should be calibrated to receive the correct frequency, e.g. with QIRX's DAB decoder (where DAB is available).
Readers interested to give this version a try might send an email to [email protected] and they will receive the current beta version (Win10 .msi installer). As it might not yet have its final stability, it is not yet provided for download. Of course all beta users are requested to give some feedback.
QIRX V3 ADS-B Interface: Showing activity over Zurich Airport
Clem has also provided a YouTube video demonstration 20 minutes of ADS-B and airband voice activity over Zurich airport via the new multi-receiver and ADS-B mapping features in QIRX.
The Organized Crime and Corruption Reporting Project (OCCRP) have recently run a story about how they have used ADS-B aircraft data to uncover the role that US civilian aircraft contractors are playing in the East African "kill chain". The investigation began over concerns that while civilian contractors do not pull the trigger, they may be becoming too involved in the process of determining exactly who will be killed in combat via data collection and analysis through their high tech surveillance aircraft. In the article they also note how many of these civilian contractors hide their true owners behind a chain of multiple LLC companies, thus reducing any accountability for their actions.
OCCRP also supports the Dictator Alert project which we have posted about in the past. In a related article titled "Mapping the Secret Skies: Lessons Learned From Flight Data" Emmanuel Freudenthal who helped setup the Dictator Alert project discusses how censorship free ADS-B tracking is helping journalists uncover new stories. In the article he notes how he uses uncensored ADS-B data together with the leaked Paradise Papers to reveal the true owners of aircraft hidden behind multiple LLC and shell companies. Regarding the "kill chain" article Emmanuel's post also explains how the story came to be:
An upcoming OCCRP story focuses on U.S. surveillance flights over Somalia. The U.S. military operates out of a small air base at Manda Bay just over the border in Kenya. We had a tip that it would be worth checking on planes in the area, so we set up an antenna nearby, which fed us information about planes taking off and landing from the base.
We eventually had to take down the antenna due to security concerns. But we managed to collect data on a number of planes that had been purchased by obscure shell companies and modified with advanced surveillance equipment before being sent to Kenya.
Why is this article posted on this blog? ADS-B data from aircraft is most often received these days via RTL-SDR dongles due to their low cost, so it is interesting to see to what extent cheap SDRs may be affecting the world via this type of reporting.
We note that ADS-B Exchange is the only censorship free ADS-B data aggregator available. All other online flight trackers censor flights from the government as well as from some private jets that may be owned by high profile company directors or in some cases dictators. The argument for censorship is that ADS-B data collection may be made illegal otherwise.
In a previous post we also discussed how censorship free ADS-B data from ADS-B Exchange revealed how military Blackhawk helicopters and Predator drones were used for surveillance during the early Black Lives Matter protests.
Over on YouTube we've recently discovered a live stream by channel Information Zulu that has created a virtual live 24hr view of LAX airport air traffic by piping ADS-B data into a flight simulator game. The stream also combines this with live air traffic audio and arrivals and departures information. Other videos on his channel show highlights like go arounds.
We're not sure what he's using to pipe ADS-B data into the simulator or exactly what simulator this is, but in the video description he notes that he uses a Pi 4, RTL-SDR blog V3 with ADS-B LNA, and an AirNav antenna to receive the ADS-B data.
Thank you to Mario Filippi (N2HUN, WQWL238) for submitting news about his latest article that has been published in the March 2020 edition of The Spectrum Monitor magazine. The article is titled "The ABCs of ADS-B and Airband Reception using Software Defined Radio", with the description reading:
Ever wonder about all the planes you see in the sky overhead where you live? What flight is that; where is it going; how high and how fast is it? All of these planes transmit on one frequency: 1090 MHz and you can monitor them all as Mario shows us. He tells us what receiver to use, which antenna (hint: you can build a better ADS-B antenna than you can buy), which software to use and how to assemble your own desktop virtual radar screen.
The article isn't free to access as it's published in the Spectrum Monitor magazine, however the magazine only costs $3 and contains a number of other airband related articles too.
The KerberosSDR is our 4-channel phase coherent capable RTL-SDR unit that we previously crowdfunded back in 2018. With a 4-channel phase coherent RTL-SDR interesting applications like radio direction finding, passive radar and beam forming become possible. KerberosSDR is currently available from the Othernet store and Hacker Warehouse for US$149.95.
Although the KerberosSDR was mostly created to help unlock projects requiring phase coherency, we've had interest from multiple users asking for information on how to use the KerberosSDR as a tool for monitoring multiple separate signals at once.
Doing this is actually very simple. If you ignore the extra circuitry to make the KerberosSDR phase coherent, the KerberosSDR is at it's core just 4 separate RTL-SDR dongles connected to a quality USB hub. So if you're not using our coherent demo software, then plugging a KerberosSDR into a PC or single board PC will result in four RTL-SDR dongles that can be accessed individually.
The tutorial below could also be done with four individual RTL-SDR dongles, but you would also want to have a reliable powered USB hub.
Example Aviation Radio Monitor
Below we show an example tutorial of how the KerberosSDR could be used as a 4-channel aviation monitor for monitoring air traffic control, ADS-B, ACARS and VDL2 simultaneously on a single Raspberry Pi 3B+. The video below shows a demo.
KerberosSDR Monitoring Air Traffic Control Voice, ADS-B, ACARS & VDL2 on a Raspberry Pi 3 B+
The first step is to simply burn the latest Raspbian Buster to an SD Card, and set up your WiFi wpa_supplicant file as you would on any standard Raspbian install. Also add a blank file called "SSH" or "SSH.txt" to the boot directly to enable an SSH connection. Alternatively you could set this up with a monitor. We used Raspbian Buster Lite, as we are not intending to use the desktop GUI.
Next use PuTTY or your preferred terminal software to connect to your Raspberry Pi via SSH. You may need to use your routers config software/page to find the IP address of the Raspberry Pi. The default SSH port is 22.
Finally, update the repos on your install before continuing with the software installation process.
Here we connected a single quarterwave ground plane antenna tuned to the airband frequencies to three input ports on the KerberosSDR via a cheap RF TV splitter. The fourth antenna input was to a RadarBox ADS-B antenna.
The KerberosSDR and Raspberry Pi are powered via two official Raspberry Pi 5V plug packs, and the KerberosSDR is connected to the Pi via a single short high quality USB cable.
Setup Topology
Installing RTL-Airband
RTLSDR-Airband is an efficient command line based scanner program for the RTL-SDR. It works by rapidly scanning over a set of frequencies and looking for active signals, and playing the active AM or FM transmission. When an active signal is found it can be configured to stream the audio to an Icecast server, record to a file, or to play directly to your speakers. Alternatively you can also configure it to stream multiple channels simultaneously. If set up to stream to an Icecast server you can listen to the scanned audio from any device on your network with an internet browser.
Here we will use RTL-Airband to scan the air traffic control voice bands which are used by air traffic controllers and pilots to communicate by voice with one another. The transmissions are in AM and are found between 118–136.975 MHz.
First install the pre-requisites, and then install RTL-Airband.
sudo apt-get install -y build-essential libmp3lame-dev libshout3-dev libconfig++-dev libraspberrypi-dev librtlsdr-dev
cd
wget -O RTLSDR-Airband-3.0.1.tar.gz https://github.com/szpajder/RTLSDR-Airband/archive/v3.0.1.tar.gz
tar xvfz RTLSDR-Airband-3.0.1.tar.gz
cd RTLSDR-Airband-3.0.1
make PLATFORM=rpiv2
sudo make install
Next install an Icecast server onto your Raspberry Pi. This will allow us to connect to the Pi via a web browser to listen in to the audio.
sudo apt-get install icecast2 -y
The install steps will ask you to input admin passwords of your choice, make sure you remember or write these down.
Now edit the rtl_airband.conf file with:
sudo nano /usr/local/etc/rtl_airband.conf
Paste in the configuration below making sure to set the actual frequencies used by air traffic control and airlines in your particular area by adding or removing frequencies from the "freqs" line.
Also be sure to set the "index" to whatever antenna input you have used (0 - 3) on your KerberosSDR for your VHF air band antenna. You may want to experiment with the gain value, but for now you can leave it as default.
If you are using another template for the config file, ensure that the "correction" value is set to 0 as the KerberosSDR uses a TCXO and requires no PPM correction.
Finally, don't forget to also set the Icecast server password that you set up in the previous step, making sure to leave the username as "source".
devices:
({
type = "rtlsdr";
index = 2;
gain = 32;
correction = 0;
mode = "scan";
channels:
(
{
freqs = ( 118.1, 118.7, 119.5 );
labels = ( "Tower A", "Tower B", "Tower Control");
outputs: (
{
type = "icecast";
server = "127.0.0.1";
port = 8000;
mountpoint = "stream.mp3";
name = "Airband Voice";
genre = "ATC";
description = "My local airport - aggregated feed";
username = "source";
password = "kerberos";
send_scan_freq_tags = false;
}
);
}
);
}
);
Next set up the Icecast server if required using the instructions here. If the default port and number of source is fine for you, you can leave everything as default.
Now to start RTL-Airband run:
sudo rtl_airband -f
To listen to the scanned audio, browse to http://RASPI_IP_ADDRESS:8000/stream.mp3 on any device connected to the same network
Installing dump1090
Leave the RTL-Airband PuTTy window open, and open a new instance of PuTTy and once again connect to the Raspberry Pi in a new session. We will install the FlightAware branch of dump1090, as this is the most up to date version. dump1090 allows you to track aircraft that are transmitted ADS-B.
Now we can run dump1090 with the following line. Make sure to set the "--device 3" flag to the antenna input that you have connected your ADS-B antenna to. In our case we connected it to the last SMA input which is input 3.
./dump1090 --device 3 --interactive --net
Now to view the data on a map, you can install Virtual Radar Server on any Windows PC on the same network. Once installed, add an "AVR or Beast Raw Feed" receiver, with the IP address of your Raspberry Pi and Port 30002.
Installing ACARSDeco2
Again, leave both PuTTy windows open, and open a new PuTTy SSH terminal and connect again. Here we'll install ACARSDeco2 which is a multiband ACARS decoder. ACARS is an acronym for Aircraft Communications Addressing and Reporting System which is a digital communications system that aircraft use to send and receive short messages to and from ground stations. Most messages are unreadable telemetry data intended for computers, but often you will see messages about weather, wind, dangerous cargo warnings, fuel loading information and more.
ACARSDeco2 is not an open source program, so you'll need to first download the compressed file from http://xdeco.org/?page_id=30 on a PC. Make sure to get the Raspberry Pi 2/3 version of ACARSdeco2 for Stretch.
Now use a program like WinSCP to transfer the .tgz file to the Raspberry Pi. In WinSCP select SCP as the file transfer protocol, log in with "pi/raspberry" and drag the file over to the Pi's home folder.
Then back on the Raspberry Pi, simply move the file into it's own folder, and extract the files.
mkdir acarsdeco2
mv acarsdeco2_rpi2-3_debian9_20181201.tgz acarsdeco2
cd acarsdeco2
tar -xvzf acarsdeco.tgz
Now you can run the program with the following command. Make sure to specify the ACARS frequencies used in your area if they are different. Also here we used antenna input 1 for the ACARS antenna and specified that with "--device-index 1". If you are running Virtual Radar Server on your Windows PC as explained in the dump1090 install, you can enter the Windows VRS server IP address, so that location data will be sent back to the ACARSdeco2 server.
Now on your Windows PC, open a browser and open PI_IP_ADDR:8081 to view the incoming ACARS messages.
Installing dumpvdl2
Again, leave both PuTTy windows open, and open a new PuTTy SSH terminal and connect again. Here we will install dumpvdl2 which is a VDL2 decoder. VDL2 is a replacement for the aging ACARS system which is being phased out in some areas. In some areas VDL2 is now more common than ACARS, and in some areas it's the opposite.
Dumpvdl2 requires libacars to work, so install libacars first:
cd
git clone https://github.com/szpajder/libacars
cd libacars
mkdir build
cd build
cmake ../
make
sudo make install
sudo ldconfig
Finally, install dumpvdl2
cd
git clone https://github.com/szpajder/dumpvdl2.git
cd dumpvdl2
mkdir build
cd build
cmake ../
make
sudo make install
Now to run dumpvdl2:
dumpvdl2 --rtlsdr 2 --gain 35
dumpvdl2 has no webserver so it can only be viewed from the terminal window.
Alternative Tools
Stations in the USA could replace one program with dump978, which decodes UAT positional data from smaller aircraft. If you live near a glider range, a FLARM decoder could also be used. You could also run an AIS receiver if you live near a water way.
Further Steps
If setting this up as a permanent station, you might want to go ahead and create a startup script that runs these programs on boot. Then you won't need to open up PuTTy terminals to start all the programs. The easiest way to do this is to use the @reboot code in crontab to run your script. Be sure to use sudo crontab -e for running RTL-Airband as this requires root.
