Mapping the Spectrum: 24 to 1766 MHz in Nine Seconds

The first rule of SIGINT is reconnaissance. Before you decode a single bit you want a map: what is transmitting, where, and how strong. This post is about building that map across the entire tunable range of an RTL-SDR - 24 MHz to 1766 MHz - in about nine seconds, and reading it without being fooled.

01The sweep¶

An RTL-SDR only sees 2 MHz at a time, so a full-range survey means retuning. Step the center frequency across the whole range, grab a short capture at each step, FFT it, record the power. This is what rtl_power does; I wrote a small version over rtl_tcp because my dongle was a network node, not local.

freqs = range(24_000_000, 1_766_000_000, 2_000_000)  # ~870 steps
for fc in freqs:
    cmd(1, fc); time.sleep(0.006)   # retune + settle
    readn(4096)                      # discard first samples after retune
    x = readn(16384)
    P = 10*np.log10(np.abs(np.fft.fftshift(np.fft.fft(x*win)))**2 + 1e-9)
    seg = P[len(P)//10 : 9*len(P)//10]   # use middle 80%, edges roll off
    out.append((fc, np.median(seg), seg.max()))

Two details that matter: settle after retune (the PLL needs a few milliseconds to lock, and the first samples are garbage), and use only the middle of each window (the band edges roll off and will give you false readings). 870 steps, nine seconds, full map.

02What was over the house¶

Ranked by signal strength above the local noise floor:

That is a rich picture from one sweep: terrestrial broadcast, aviation, satellite, navigation. Each of those is a rabbit hole. ADS-B alone turns into a real-time map of every aircraft overhead; the Inmarsat carrier decodes into aeronautical and maritime messaging with the right software.

03The trap: tuner artefacts look exactly like signals¶

Here is where a naive reading goes wrong. Above roughly 1 GHz my map showed a broad "forest" of peaks, dozens of them, all at similar levels. It looks like the L-band is packed with transmitters.

It is mostly not. The R820T tuner in a cheap RTL-SDR degrades badly at the top of its range and generates spurs and images - internal artefacts that appear as signals but are not on the air. The genuine emitters up there are sparse (ADS-B, GPS, Inmarsat). The carpet between them is the receiver lying to you.

How do you tell them apart? A real signal stays put when you change gain and shows up on a second, better receiver. An artefact moves or scales with your front-end settings. The general SIGINT discipline: never trust a peak you have not confirmed with a second method or a second radio. This is exactly why my next hardware purchase was a 14-bit receiver - the 8-bit RTL-SDR's dynamic range is what produces those spurs when a +41 dB monster like DVB-T is in band.

04Why survey first¶

The sweep changes how you spend your time. Instead of guessing which frequency to camp on, you get a prioritised target list in seconds. You see the strong, easy wins (DVB-T, DAB, ADS-B) and you see the weak signals that will need better hardware before they are worth chasing (the faint LoRa from the previous post never even showed on the wideband map - another hint it was marginal).

A hard limit worth stating: the RTL-SDR stops at 1766 MHz. WiFi at 2.4 GHz, the 5 GHz bands, most modern telemetry - all invisible to it. Reaching 6 GHz is the whole reason the next post is about hardware.

Next in the series: what SDR to actually buy for SIGINT, why the cheapest upgrade is rarely the right one, and the one spec that mattered more than all the others.

All passive reception. Spectrum surveying is listening, not transmitting, and is legal in the EU.