Over on YouTube Fuzz The Pi Guy has uploaded a video tutorial showing how to set up a Broadcastify air traffic control audio feed with RTL-Airband and an RTL-SDR running on a Raspberry Pi. This allows you to publicly share your received air traffic control audio online via sites like Broadcastify.
The video is based on a comprehensive Radioreference text tutorial which takes you through the process from scratch. Setting it up involves installing the Raspbian OS, installing RTL-SDR, installing and setting up RTL-Airband, configuring ezstream and then ensuring that everything runs automatically on boot. It's a fairly involved setup process, but the video helps make things easier.
How To Setup Broadcastify On A Raspberry Pi Using RTL_AM For Aviation
Over on YouTube icholakov has uploaded an informative video that gives an overview of the main communication modes that aircraft use from HF to UHF. In the video he also gives examples of those modes being received and decoded with an SDR.
The modes that he explains and demonstrates are VHF voice, VHF ATIS automated weather, ACARS short data messages, HF voice, HF automatic weather, HF data selective calling (SELCAL), HF data link (HFDL) and UHF ADS-B aircraft positioning.
Today SpaceX have successfully launched and deployed the Es'hail-2 satellite which is now in geostationary orbit. This launch is special for amateur radio enthusiasts because it is the first geostationary satellite that contains an amateur radio transponder on it. The satellite is positioned at 25.5°E which is over Africa. It will cover Africa, Europe, the Middle East, India, eastern Brazil and the west half of Russia/Asia. Unfortunately, North America, Japan, most of South America, Australia and NZ miss out.
Coverage of Es'hail 2
The satellite has a two bandwidth segments, a 250 kHz narrow band for modes like SSB, FreeDV, CW, RTTY etc, and a 8 MHz wide band for digital amateur TV (DATV) modes like DVB-S and DVB-T.
The downlink frequencies are at 10 GHz so a low cost TV LNB could be used as the antenna. For receiving the narrowband modes, an RTL-SDR or similar SDR could be used, and for the 8 MHz DATV modes a standard DVB-S2 set top box can be used to receive and decode the video. For uplink, the transmission frequency is at 2.4 GHz.
According to the commissioning order of the satellite, it is expected that the AMSAT transponders will be activated only after all tests have been passed, and after other higher priority commercial telecommunications systems have been activated. This is expected to take about 1-2 months.
2018: Es'hail-2 and its amateur radio payload - Graham Shirville (G3VZV) & Dave Crump (G8GKQ)
Over on GitHub user jj1bdx has just released a new tool called rtl_power-fm-multipath which can be used for estimating broadcast FM multipath distortion with an RTL-SDR. Broadcast FM multipath is caused when a signal is received from multiple directions due to it reflecting off and refracting through physical objects like buildings and terrain. As the reflected/refracted signals will be delayed it can cause echo like distortions in the RF signal which can cause issues like poor digital decoding, poor FM audio reception and ghosting in analogue video.
The multipath distortion estimation method works by measuring the ratio of the strength of direct/reflected radio waves which results in the desired/undesired (D/U) ratio. This measurement method was proposed by Komiya87 and JushinFM who both wrote papers in Japanese describing the method. In summary the methodology is:
Measure the maximum peak strength for +-50kHz spectrum of the target FM station
Obtain the maximum value (Lmax) and minimum value (Lmin) within the spectrum
Obtain the ratio of the maximum and minimum values L = Lmax / Lmin (note: Lmax and Lmin are real values (not in dB), and L must be > 1)
The estimated D/U ratio R = (L+1) / (L-1) (in the real value, not in dB)
The rtl_power-fm-multipath program is based on rtl_power and works by using rtl_power to record power measurements for 5 minutes, then sending the data to a peakhold function which computes the maximum power value for each frequency, and then calculations the distortion ratio.
Motherboard, an online technology magazine has recently run an article titled "With $20 of Gear from Amazon, Nearly Anyone Can Make This IMSI-Catcher in 30 Minutes". The article describes how an RTL-SDR together with the IMSI-Catcher Linux software can be used to collect IMSI numbers from cellphones connected to a nearby cell tower. The IMSI is a unique number assigned to each SIM card and collecting this data could be used to identify if someone is in the area covered by the cell tower.
The IMSI-Catcher software only works with the older 2G GSM signals which are now being phased out in some countries and are relatively unused in others. Also unlike more advanced IMSI-Catchers which create a fake cell tower signal, the RTL-SDR based IMSI-Catcher can only collect IMSI numbers when the cellphone first connects to the cell tower.
Thank you to Thierry Leconte (TLeconte) for writing in and submitting his new command line based open source software called vortrack. Vortrack is a simple VOR decoder which calculates the angle towards the VOR. It is compatible with both RTL-SDR and Airspy radios, and runs on Linux.
In the past we've seen several other posts about RTL-SDRs being used to decode VOR signals, but Thierry's implementation appears to be the easiest way to get a bearing straight away. You'll get the most use out of the software if you install it on a portable device like a Raspberry Pi and take it out for a drive as you'll be able to see the VOR angle changing then.
VOR stands for VHF Omnidirectional Range and is a way to help aircraft navigate by using fixed ground based beacons. The beacons are specially designed in such a way that the aircraft can use the beacon to determine a bearing towards the VOR transmitter. VOR beacons are found between 108 MHz and 117.95 MHz, and it's possible to view the raw signal in SDR#.
A DVOR Ground Station at an Airport. Source Wikipedia.
Othernet (previously known as Outernet) are currently having a 50% off sale on all their products. This means that you can snag a discounted Dreamcatcher at only US$75, and a moRFeus at US$99. The sale expires midnight on the 26th.
The sale is exclusive to RTL-SDR Blog readers (although feel free to share the coupon) and the coupon code to use at checkout is rtlsdrblog83759.
Dreamcatcher and Othernet Data Signal Information
If you weren't already aware, the Othernet project aims to bring live data such as news, weather, video, books, Wikipedia articles and audio broadcasts to the world via a free satellite service and cheap receivers. Although an internet connection provides the same data, Othernet's satellite broadcast is receivable in remote areas, will continue working in disasters, and costs nothing to continually receive roughly 200MB of data a day. The trade off is that the service is downlink only, so the data that you get is only what is curated by the Othernet team.
Othernet can provide this service for free because they are funded by private customers whom they provide private data/audio satellite channels to. One such private customer is attempting to implement an Othernet based Tsunami early warning system in Vanuatu which would work even when the cell phone system fails in a disaster. Each siren is equipped with an Othernet receiver and LNB that receives the Othernet signal. The goal is to allow for any village to be able to set up their own low cost warning system. At the same time the Othernet Tsunami warning receiver is made use of in normal circumstances as it receives a satellite radio broadcast which is then re-transmitted to the village over regular FM radio.
Currently the public service is in a test period and is only available in North America, but public service for the EU and possibly Oceania is planned to begin in Q1 2019. The rest of the world should eventually follow after. Some more information about the data service can be found on our previous post.
Alternatively, if you have no interest in the data service then your Dreamcatcher could also be used as a TX/RX capable LoRa radio. In a previous post we had some fun with two Dreamcatchers and a LoRa chat application.
Othernet Dreamcatcher
moRFeus Information
The moRFeus is a low cost signal generator. It's capable of generating a tone anywhere from 85 MHz to 5400 MHz, and it can also be used as a frequency mixer component for implementing things like homebrew upconverters and downconverters.
In his post K2GOG mentions our successfully crowd funded KerberosSDR which will be shipping in January next year. KerberosSDR is our 4x coherent RTL-SDR, and one possible application is to use it as a four antenna phase coherent direction finder. K2GOG explains the phase coherent concept in his post quite elegantly.
While looking over KerberosSDR, K2GOG was also reminded of another direction finding technique called heat mapping which can be performed with a single RTL-SDR. This process involves driving around with an RTL-SDR and GPS logger, measuring the signal power as you drive and combining it the current GPS coordinates. From that data a heat map can be generated, which shows where the signal is the strongest, and therefore where the likely source is. The RTLSDR Scanner application by eartoearoak makes doing this easy, and in his post K2GOG provide a short tutorial on setting it up.
A heatmap generated by K2GOG with an RTL-SDR, GPS and RTLSDR Scanner.
Airspy is currently running a 15% Black Friday sale over on the manufacturers website iead.cc, and on their US distributor airspy.us. The coupon code is BF2018.
This results in an Airspy Mini costing only $84.15, an Airspy HF+ costing $169.15, an Airspy R2 costing $143.65 and a SpyVerter costing $41.65. This is the cheapest we've seen these products to date.
Over on Ham Radio Outlet, the RSP2 is currently reduced by $20, taking it down to a price of only $149.95. The RSP2 Pro is also reduced down to $192.95. Other SDRplay products, and products on their website appear to be not discounted.
HackRF
Over on SparkFun the original HackRF is 20% off, resulting in a price of only $239.96. It's still double the price of an Aliexpress clone, but it is an original unit. In the UK ML&S are also selling it for 15% off at £219.95. This is the cheapest price we've seen an original HackRF sold for.
Elad FDM S2
At the higher end of the SDR spectrum, we see that the Elad FDM-S2 is currently reduced by $51, resulting in a sale price of $529.
Most of these sales are expected to run until Monday, or until stocks run out.
Have you found any other great SDR deals? Let us know in the comments.
Thanks to Luigi (aka @luigifcruz and PU2SPY) for writing in and submitting to us his LimeSDR based doppler radar blog post. The LimeSDR Mini is a low cost two port TX and RX capable SDR. Luigi's doppler based radar makes use of one TX port to transmit the radar signal, and the RX port to receive the reflection. The idea is that the if the object being measured is moving, the received reflected signal will be altered in phase due to the doppler effect.
In terms of hardware, Luigi's radar uses the LimeSDR Mini as the TX/RX radio, a Raspberry Pi 3 as the computing hardware, an SPF5189Z based LNA on the RX side, and two cantenna antennas. It transmits a continuous wave signal at 2.4 GHz.
Luigi's LimeSDR Based Doppler Radar
On the software side it uses a GNU Radio program to transmit, receive and process the returned signal. Luigi's post goes over the DSP concepts in greater detail, but the basic idea is to measure the phase shift between the transmitted and reflected signal via a Multiply Conjugate block, and then decimate the output to increase the resolution. The result is then output on a frequency domain waterfall graph. The GNU Radio is all open source and available on Luigi's Github.
In order to test the system Luigi first set up a test to measure an electric fan's blade speed. The result was clearly visible line in the spectrogram which moved depending on the speed setting that the fan was set to.
Software Defined Radar - Continuous Wave Doppler Radar w/ LimeSDR
In his second test Luigi measures the speed of vehicles by placing the radar on the sidewalk, pointed at cars. The result was clear indication of the vehicle passes as shown by the longer vertical lines on the graph below. The smaller lines have been attributed to pedestrians passing by.
LimeSDR Vehicle Doppler Radar Results: Each long line indicates a vehicle, and shorter lines indicate pedestrians.
In a third test, Luigi measured vehicle speeds in tougher conditions, with the radar placed 50 meters away from the highway, at 45 degrees, and with weeds in the way. The radar still generated obvious lines indicating vehicles passes. Finally, in his fourth test, Luigi tested the speed accuracy of his radar by measuring a car driving at a known speed. The results showed excellent accuracy.
Software Defined Radar - Continuous Wave Doppler Radar w/ LimeSDR
Over on YouTube, channel Null Byte has uploaded a video showing us how to use an RTL-SDR V3 on an Android smartphone. In the video he discusses the hardware and software required to get started on Android and demonstrates the free SDRoid Android app (based on RFAnalyzer) by tuning to several signals including a voice signal. Later in the video he also shows an ADS-B app for receiving aircraft positions. The video is intended for people new to RTL-SDR so it is a little basic, but it's a great introduction.
He notes that the next video (which will probably be released in a week) will show RPiTX being used with the RTL-SDR.
Use an RTL-SDR Software-Defined Radio Receiver with an Android Smartphone [Tutorial]
Back in January we posted about a Vivaldi antenna project by "hexandflex". In that project he showed how he designed and manufactured the Vivaldi. A Vivaldi antenna is wideband and directional and the design works well for frequencies above 800 MHz, but becomes too physically large to handle for lower frequencies like 400 MHz. In his latest project, hexandflex has designed a PCB based spiral antenna to cover these lower frequencies.
Hexandflex is currently selling his spiral antennas over on Tindie. There are two versions, one smaller one costing $25.60 designed for 800 MHz+ and a larger one costing $33.50 designed for 300 MHz+. Both come with suction cups that allow for easy window mounting.
The 800 MHz+ and 300 MHz+ spiral antennas by Hexandflex
Normally if you want to use the RTL-SDR as an SDR on Linux you install the SDR drivers, and blacklist the Kernel's built in DVB-T drivers to prevent them from taking over the RTL-SDR. Once blacklisted, no RTL-SDR plugged into that system can be used for DVB-T watching unless the blacklist is removed. But if the blacklist is removed, SDR mode cannot be used. So it's impossible to use one RTL-SDR as an SDR, and one for DVB-T TV at the same time.
However now, Hayati A. has submitted news about his RTL-SDR driver patch which allows you to run SDR mode and DVB-T TV mode at the same time with two RTL-SDR dongles.
The idea behind allowing two dongles to operate in separate modes is that one dongle needs to have the PID code stored in its EEPROM changed to a code which was recently registered by Hayati. The dongle with this PID code won't be recognized as a DVB-T device by Linux, and so can only be used for SDR. An dongle with the stock EEPROM can then be plugged in and used for DVB-T.
A special USB vendor/product id got reserved at http://pid.codes/ : 0x1209/0x2832
for such devices the linux kernel's DVB modules are not loaded automatically, thus can be used without blacklisting dvb_usb_rtl28xxu below /etc/modprobe.d/
this allows to use a second RTL dongle for use with DVB in parallel
the IDs can be programmed with 'rtl_eeprom -n' or 'rtl_eeprom -g realtek_sdr'
Note that the DVB-T drivers in Linux should not be blacklisted if you are doing this. Also some cheaper RTL-SDR models don't come an EEPROM, and those models can not do this.
Electronics distributor element14 has uploaded a video to their 'element14 presents' YouTube channel showing presenter Matt building and setting up a portable Raspberry Pi & RTL-SDR based NOAA weather satellite receiver. More information is also available on their supplemental content page.
The build consists of a Raspberry Pi, RTL-SDR and QFH antenna as the basic components. However, it is made into a very nice portable unit by using a stripped down LCD monitor placed into a heavy duty waterproof brief case. The whole thing is powered via a PC power supply. After the build is completed, Matt leaves the case on the roof for a few days collecting images.
Emboldened by the success of his Raspberry PIrate radio, Matt indulges in some more radio hacking by building a specialized QFH antenna and a briefcase form-factor satellite receiver in an attempt to intercept "faxes" from OUTER SPAACEEE!!! Connect with Matt on the element14 community: http://bit.ly/2RiSXC5
Project TIROS is a self-contained, Raspberry Pi-based satellite signal reception system designed to automatically download images and data from NOAA's POES spacecraft as they pass overhead and display the data on an integrated LCD panel. In this video, Matt will walk through how to set up an RTL-SDR module with a Raspberry Pi for automated satellite downloads as well as how to design and build a quadrifilar helical antenna for polar-orbiting signal reception.
Over on the AWS blog Jeff Barr has blogged about Amazon's new rentable ground station system called "AWS Ground Station". AWS, or Amazon Web Services is the server farm division of Amazon. They allow customers to rent out server capability on demand. In a similar sense, AWS Ground Station is aiming to allow customers to rent out satellite ground stations on demand.
Launching low cost micro/nano satellites has become very affordable in recent years and it's now common to see high schools, colleges, organizations and hobbyists designing, fabricating and launching their own satellites. Once launched, a ground station is required to receive the satellite's radio transmission as it passes over. Most low cost satellite owners will not have the budget to deploy ground stations all around the world for continuous monitoring of the satellite. This is where AWS Ground Station can take over, allowing a ground station on the other side of the world to be rented temporarily during a pass.
Currently the service is just starting, and only has 2 ground stations, but by 2019 they hope to have a total of 12. More information available on the official AWS Ground Station website.
Alternatively, there are other free open source services that could be utilized such as SATNOGS. SATNOGs relies on volunteer ground stations running antenna rotators that can be built with a 3D printer, some low cost motors and electronics, and an RTL-SDR. The antenna rotator carries a Yagi antenna and will automatically track, receive and upload satellite data to the internet for the public to access.
The Reverse Beacon Network is a project that monitors the amateur radio bands by using volunteer stations to continuously and autonomously collect data on what/when stations are being received, and how good the signal is. The data is made public on the internet and this allows amateur radio operators to easily determine overall propagation conditions. It is currently working mostly with CW (morse code) stations, and mostly on HF, although it is expanding to VHF+ as explained below.
During October, John Ackermann (NBUR) did a talk at the "Microwave Update 2018" conference held in Dayton, Ohio. His talk was about setting up a VHF+ reverse beacon network monitoring station, using multiple RTL-SDR dongles for monitoring. The RTL-SDR dongles run on a Raspberry Pi which runs the rtl_hpsdr software. This allows multiple RTL-SDR dongles to emulate a multi-band HPSDR receiver over Ethernet. They can then be accessed on a PC by the CW Skimmer program which decodes the received CW signals, and then logs it online on the reverse beacon network's website.
The talk slides can be found here, and the video is shown below. More talks from the conference can be found on this YouTube playlist.
Four RTL-SDR.COM V3 dongles used in a VHF+ Reverse Network Setup
John Ackermann, N8UR - The VHF+ Reverse Beacon Network
A while ago we posted about Osmo-FL2K which is a Steve M Osmocom project that allows you to use a cheap $10 USB to VGA adapter as an HF - 1.7 GHz transmitting SDR. Now another similar project by Ted Yapo has been released which allows the use of a low cost FT232RL based USB to Serial Port adapter as a transmit capable SDR. It appears that the FT232RL via harmonics is able to transmit up to at least 27 MHz, and possibly higher.
A USB To Serial Port adapter being used as a transmitting SDR
The basic implementation is similar to the idea used by RPiTX - that is to modulate the square wave output of a TX pin to generate an arbitrary signal at a desired frequency. Of course this results in numerous harmonics which must be heavily filtered if ever actually transmitting with some power or high gain antenna.
In his hackaday.io project log, Ted shows that he's been able to transmit AM audio at 1 MHz, and has also been able to control an RC toy at 27 MHz. For the RC toy controller he's also created a simple BPF in order to reduce the harmonics. In addition to the FT232RL chip, he's also tried other serial chips like the CP2102N but found that the signal produced was not as clean.
According to researchers at the International Association for Cryptologic Research it is possible to snoop on 3G to 5G mobile users using a fake base station created by an SDR. It has been well known for several years now that 2G mobile phone security has been broken, but 3G to 5G remained secure. However, the researchers have now determined that lack of randomness and the use of XOR operations used in the Authentication and Key Agreement (AKA) cryptographic algorithm's sequence numbering (SQN) allows them to beat the encryption.
In their research they used a USRP B210 SDR which costs about US$1300, but it's likely that cheaper TX/RX capable SDRs such as the US$299 LimeSDR could also be used. In their testing they used a laptop, but note that a cheap Raspberry Pi could replace it too.
"We show that partly learning SQN leads to a new class of privacy attacks," the researchers wrote, and although the attacker needs to start with a fake base station, the attack can continue "even when subscribers move away from the attack area."
Though the attack is limited to subscriber activity monitoring – number of calls, SMSs, location, and so on – rather than snooping on the contents of calls, the researchers believe it's worse than previous AKA issues like StingRay, because those are only effective only when the user is within reach of a fake base station.
The World Radio TV Handbook (WRTH) is a directory book (or CD) of world radio stations on LW, MW, SW and FM. In addition to the directory they also do reviews of radios/SDRs, and recently they reviewed the Airspy HF+ (pdf). The Airspy HF+ is high dynamic range HF/VHF receiver designed for DXing.
According to the review, WRTH give the Airspy HF+ the award of being the best value HF SDR for 2019. The review takes note of the HF+'s excellent dynamic range and then goes on to validate the manufacturers claimed specifications. Finally they write how they tested it during a contest at 7 MHz, and found no overloading or spurious responses apart from a minor noise floor increase when an extremely strong local CW station was encountered.
At the beginning of last month we posted about an update to JAERO which allows us to now listen to AERO C-Channel voice audio. AERO is a satellite based communications service used by modern aircraft, and it's possible to easily receive the signals with an RTL-SDR, L-band patch antenna and LNA. The C-Channel conversations are typically about Medlink which is a support line for medical emergencies, but other conversations may be heard too.
While it is possible to listen to these conversations, due to legal reasons regarding patents it is necessary to compile the audio decoder manually from source, and this can be quite an involved multi-step process on Windows. Fortunately, YouTuber Corrosive, who has been making SDR related videos for some time now has put up a three part video series on the process.
