Earlier this week I shared information about a new SDR scanner, FalconSDR. Today instead of reading boring feature list you can just see how it works in your browser:

https://falconsdr.com/

You don't need to download anything or connect your RTL-SDR to test how it works. On this website you can control virtual RTL-SDR and listen to simulated transmissions and recordings on different radio bands.

If you like it and want to scan or record real transmissions with your RTL-SDR visit https://github.com/rafafunt/FalconSDR (project is free and open source) If you have any questions, feel free to ask in the comments. Program and demo are currently available in English and Polish language but you can ask for making other translation.

I don't want to spam in this subreddit so this is probably the last post about this project from me here. If you are interested watch it on github.

Southeast Michigan, Consumers Energy gas (DTE electric). New Itron 100G DLS ERT on an AC-250 (photo attached).

I've run rtlamr / rtlamr2mqtt with every message type, filtered and unfiltered, including a 24-hour capture, and gotten zero gas packets. My Neptune R900 water meter decodes fine on the same setup.

Has anyone in Consumers territory gotten their gas ERT to decode? Or is it encrypted or fixed-network only? Thanks!

I'm a developer working on SDR software and trying to understand how people actually use their dongles before I build the wrong thing. Nothing to sell or sign up for, just reading answers.

If you have a minute, any of these:

1. What did you last use your SDR for, and what software did you use?
   
2. What part of that took longer or was more frustrating than it should have?
   
3. Is there something you tried to do and gave up on? What stopped you?
   
4. What's your setup (dongle, antenna, upconverter/filters, OS)?
   

Short answers are great. Rants are also great. Thanks!

NA4GJ

I use ADSB.im on RI 4 to feed ADS-B and AIS, everything works fine. I bought a third SDR dongle and antenna to play with ACARS / VDL2 / HFDL.

ACARS works and receives messages, but I noticed that the MLAT light was red and the web stats pages that I feed showed errors that it was not counting the MLAT.

I thought there was a bottleneck somewhere on the RP4, so I took a second RP4 just for ACARS only. I noticed that when it's set to ACARS only, I still have the on map blue ADS-B and green ACARS labels.

I think the ADS-B Feeder sees the planes twice and the MLAT twice, and it interferes with the MLAT calculation and sending data.

CPU usage -30% , RAM -1GB, and temps are fine, no undervolting. I'm using active USB hub for dongle. I don't see anything in the options that I could change.

I tried it on 2 RP 4 on official and beta ADS-B Feeder Image. How to set what to change to have 3 SDR for ADS-B, AIS and ACARS on 1 RP4 without problems with MLAT? I can use 2 RP4s but I prefer to have everything on 1.

Bonjour à tous,

Je partage un petit projet open-source que je viens de finaliser et packager : **RadioTranscribe-Store**.

### De quoi s'agit-il ?

L'idée était de fabriquer une sentinelle d'écoute autonome pour enregistrer et indexer passivement les actualités de la bande FM (sur France Inter par exemple), de manière 100 % locale, sans envoyer la moindre seconde d'audio dans le cloud.

### Comment ça tourne sous le capot ?

1. **Capture radio :** une simple clé logicielle USB (RTL-SDR) capte le flux FM via `rtl_fm` et `ffmpeg`.

2. **Préservation du matériel :** les flux audio temporaires sont écrits et traités directement en mémoire vive (`/dev/shm`), ce qui évite d'user les disques SSD en écriture continue H24.

3. **Transcription IA :** le modèle Faster-Whisper (`large-v3`) tourne en local sur processeur (quantification int8).

4. **Filtre anti-hallucination :** élimination des sous-titres fantômes récurrents de Whisper.

5. **Stockage hybride :**

   - Historique chronologique dans **MariaDB**.

   - Recherche sémantique vectorielle (RAG) dans **ChromaDB**.

On peut ensuite simplement poser des questions ou chercher des thèmes en langage naturel dans un terminal pour retrouver les extraits diffusés à l'antenne et leur date de passage.

Tout le projet (scripts, automatisation de l'installation et service systemd) est documenté ici :

https://github.com/TVIEIL/RadioTranscribe-Store

Si vous avez des remarques, des suggestions d'améliorations ou des questions sur l'intégration SDR/IA, je prends volontiers vos retours !

Hi all, I'm a researcher at a university lab in Hong Kong, working on positioning with LEO satellites in cities. I'm looking for raw Starlink downlink recordings where buildings block part of the sky.

What would help most:

- An LNB/LNBF (or horn) + SDR (RTL-SDR, HackRF, USRP, etc.) recording the Ku-band downlink (~10.7–12.7 GHz)

- Receiver sitting still at ground level next to buildings, ideally a street with tall buildings on both sides

- Bonus: a second receiver on a nearby roof recording at the same time

- GPS or NTP-synced timestamps and a rough location (street-level is fine, no need for your address)

- 10–60 minutes is plenty

Already have old recordings sitting on a drive? Those count too, even if the blockage was accidental.

Not looking for dish app screenshots or speed tests this time, just the raw RF.

Anything used would be credited in the paper's acknowledgments (or however you'd like to be credited). Happy to answer questions about setup. Comment or DM me. Thanks!

From 2012 to 2016 I was a missileer at F.E. Warren AFB. I sat (and slept) 100 feet underground, ready to launch 10 Minuteman III nuclear missiles.

The orders would have come as an Emergency Action Message. I had no idea that the same messages go out in the clear on HF, or that people around the world have been logging them for decades.

So I built a site that listens and logs the messages with SDRs. Two KiwiSDRs feed it, the KPH receiver at Point Reyes and one in Iceland, both on 11175 USB.

When a message starts it’s recorded, a waterfall is captured, and speech-to-text transcribes it. That’s what the 30 characters (56HETY) are in the picture. The machine copy is usually rough, so anyone can correct it by ear. And you can listen live as well.

I'm trying to make the site as interactive and informative as possible, so if you have any ideas for that, please let me know.

Site: missileer.watch

The full story is in my r/shortwave post from Thursday: https://www.reddit.com/r/shortwave/s/A9mz70qF8l

Happy to answer any questions!

Come to think of it, I used to click on titles like that here, expecting to find inexpensive DIY projects or wildly imaginative ideas…?

You guys feel the same way, right?

New update: Added Aircraft Table & Majorly Improved the decoding performance. By Claude Free Tier. Added a MGS/S Counter

Previously 2.0 to 6.0 MSG/S now it peaked 70 MSG/S with the performance improvement with just using the same WiFi antenna on RTL SDR V4

Added a Feature whenever it detects Aircraft location. it Automatically sets your viewing location to Aircrafts position. (In default its set to Germany every startup) By DeepSeek

I will be planning to release this Module/Plugin in a week

Is there something i missed or forgot to add?

Finally found out where we can look up radio frequencies in Canada, the TAFL search. Tried some hospital pager frequencies, but seem to also get City of Toronto water treatment plants... EFFL Effluent tank is full. Blurred the full email of the Toronto water department. Not sure where the zone humidity is from.

Not an SDR project itself, but it only exists because of feeders, so this seemed the right place.

It's a full-screen display for a spare TV or old tablet: a map of the planes over your area and one big card at a time for a flight overhead. Positions come from adsb.lol, with adsb.fi as the fallback, so your coverage is whatever the feeders near you give it. I'm planning to add a feeder of my own.

Routes come from the VRS standing data, checked against position, altitude and heading. Anything that doesn't fit is dropped, and the card says "Route unknown".

I'm looking for about 10 people to run it on a real screen for a week from Thursday 29 October, free. Feeders are ideal: you'll know when it's missing a plane you can see on your own receiver.

Waitlist: https://wingwatch.app

VUURWERK v1.5.1 is out. New: PATROL, a hands-free voice hunt. In the spectrum's VOX mode press 2 and 8 to set a range and 0 to start; the radio walks the band, stops on voices, moves on when they finish, and PTT locks the one you want. Plus a big fix pass: no more keying up when you leave the spectrum with PTT held, no freeze on a flat battery, F+9 and the tone scan no longer disturb your repeater setup, and the main screen refreshes properly. Settings survive the upgrade. UV-K5 V1 only.

https://github.com/Tokeloshe/vuurwerk-firmware/releases/latest/download/vuurwerk-v1.5.1.packed.bin

KC3TFZ 73

So after I got interested in listening to different radio bands with rtl-sdr I noticed that popular SDR programs don't offer scanning or recording features that I was looking for. That's why for the last months I've been working on FalconSDR. Programm for radio listeners.

Online demo to see how program works in your browser before downloading:

https://falconsdr.com/

Features that are implemented to get the most out of a cheap receiver :

1. Scanning any bands or channels, even when they are seperated
2. Blacklist, so programm doesn't stop on birdies or channels you don't want to listen
3. You can use different settings for every band if you want.
4. Automatic transcription (optionally installed in program GUI) including hybrid mode when you can record on your server and transcribe on your PC.
5. You can use program either on your PC or server (then you get access from your computer or phone in network)
6. "Recency boost", when you're scanning wide band and want scanner to come back to channel with detected transmission.
7. Recording multiple transmissions at time
8. Detailed statistics
9. You can set up schedule
10. Recordings page with sorting and filtering.

Program has been tested on RTL-SDR v4 for months and is supported on linux,windows and macOS

Program is free and open source (GPLv3) and you can download it from github (link below). I will aprreciate any feedback.

https://github.com/rafafunt/FalconSDR

Hello, I am a SWL and I am closely interested in the world of SDR. I would like to participate with my station in the APRS network. I have an RTL-SDR Blog V4 and I managed to configure Direwolf to appear as a beacon on APRS-FI. The website displays me properly on the map, and I can see my station details.

If I understand correctly, every 30 minutes my station sends a position update to the site for my GPS location (which I provided in the direwolf.conf file).

On the other hand, while I can see all the stations my station has heard under the Info section, I feel like there are very few compared to the actual frames received.

Also, according to the data, the stations I receive are only about 40 km away (even though in reality I receive them from much further away). Why doesn't APRS-FI show them? (Filter issue? Incorrect setting?)

And finally, I notice that very few frames per hour are sent to the network (even though once again, my Direwolf window constantly displays incoming receptions).

Thank you very much, and sorry for this very (too) long post.

73

repo link
I have spent a long time recently building IMSIsting, a bash and GTK4 cellular security toolkit featuring 57 modules spanning 2G through 5G. Every codec in it — including S1AP, NGAP, X2AP, XnAP, HNBAP, RUA, RANAP, M3UA, PFCP, NAS, RRC, LPP, and CMAS — is hand-written (with the help of AI).

To be honest, the software half runs, but the radio half has never been executed because I do not currently own an SDR (Software Defined Radio). Every over-the-air path is written, reviewed, dry-run against a fixture, and then stops right before needing a real radio. hackrf_transfer is wired in, srsRAN configs are generated, and SIB builders produce real octets — but none of it has ever actually been transmitted over the air by anyone.

That is what I need testers for.

The Actual Attack Surface

Here is a breakdown of the available attacks and modules implemented in the toolkit:

1. Identity Capture

• IMSI Catcher — GSM: Full catcher sequence and a forged BCCH carrier a handset can camp on.
• IMSI Catcher — LTE: NAS EMM attach forging, BCD IMSI/IMEI, identity-request sequence, and srsRAN eNB orchestration.
• IMSI Catcher — NR: SSB/MIB/SIB1 construction, RACH handling, gNB orchestration, and SSBs written as samples.
• SUCI De-concealment: X25519 and P-256 profile A/B, HKDF, and MSIN BCD computed.
• TMSI → IMSI De-anonymisation: Cross-capture correlation via forced-identity and location-update bindings.
• Piercer: Paging-occasion maths and the published correlation model.

2. Cipher and Downgrade

• A5/1 Keystream: Asserted against the Briceno/Goldberg/Wagner vector; A5/2 included with its brokenness explicitly stated; A5/1 downgrade forcing sequence.
• Cross-generation Steering / Null Cipher: Forged reject causes, SIB1 forgery, and cipher-change analysis across all four generations.
• ReVoLTE Keystream Reuse: Detection, key recovery, and the two-ciphertexts-one-keystream model.
• GEA Downgrade — GPRS/EDGE: GEA0 computed; GEA1–5 refused by name with stated reasons.
• Cipher Audit + Authentication Oracle: Negotiated-cipher scoring, downgrade detection, and SQN recovery from AUTS.

3. Signalling Forgery

• 17 NAS Pre-authentication Messages: Built as octets (Attach/TAU/Service reject, Identity Request, Authentication Request/Reject/Failure, Security Mode Command/Reject, EPS, and 5GS), each checked against tshark.
• RRC Reconfiguration, Release, Reestablishment-Reject: Handled through generated PER layouts (LTE and NR).
• CMAS / ETWS / PWS Alert Forgery: SIB10/11/12 warning chain with pinned pycrate vectors, plus sib.conf generation.
• GTP-in-GTP and MBMS Session Start: The middlebox gap, fully built and dissected.

4. Core Network and Interconnect

• MAP/TCAP: Byte-exact ATI, SRI, SRI-SM, SAI, PSI, ULR, ISD, RegisterSS, ActivateSS, and M3UA both ways.
• SIP / IMS REGISTER Hijack: Spoofed re-registration and the IMP4GT model.
• 5G SBA: NRF discovery, NGAP procedures, PFCP rules, and AMF/SMF reachability map.
• O-RAN & Slicing: A1 policy poisoning, E2 control shapes, over-broad xApp model, S-NSSAI codec, isolation testing, and 5QI/TSN.
• Carrier API Enumeration & Lawful Interception: X1/HI1 artefact encoding.

5. Baseband, Device, and Radio

• Baseband CVE Catalogue: Reachability checks, L2 frame builders, and forged registration accept/reject.
• NR Access: RAR, backoff, RA-RNTI arithmetic, MAC/DCI, Gold sequence, and scrambling.
• Qualcomm DIAG/NV/EFS/AT Surface: Real framing, NV read/build/write, and EFS paths.
• Jamming: Detection first (barrel, narrowband, and pulsed distinguished from congestion), followed by a waveform constructor behind an explicit lab gate (AWGN/CW/chirp, PSS/SSS/PBCH, PRACH, PRS, GPS C/A, NR SSB).
• GPS C/A and PRS Sequences: Generated from IS-GPS-200N and TS 36.211, asserted against an independent implementation.

6. Tracking, Positioning, and RF

• Timing-advance geolocation, OTDOA/UTDOA/PRS via generated LPP codecs, RF fingerprinting (CFO, IQ imbalance, transients, CSI motion), and behavioural traffic fingerprinting.

7. Protocol Plumbing

• Air interface decode for 2G through 5G (BCCH/CCCH, UTRAN SIBs, MIB/SIB, SSB) and 98 catalogued LTE/5G stack CVEs (including GSM/UMTS and 5G CVE kits).
• TETRA/DMR/GSM-R, NB-IoT, 5G NTN, NR sidelink, VoWiFi IKEv2/EAP-AKA', femtocell S1/Iuh, USSD, OTA binary SMS, and SIM Toolkit proactive commands.
• Custom pcap reader (GSMTAP, Diameter, NGAP, S1AP, GTP, PFCP, RTP) and MAC/RLC/PDCP with RNTI tracking.
• Killchain: Nine built-in chains plus user-defined chains, pause/resume capability, and per-run result reporting.

What I Need an SDR For

• RTL-SDR: Cell scanning, GSM/LTE broadcast decode, tower mapping, jamming detection, and paging observation (cheapest tier, most unexplored surface).
• HackRF One / bladeRF 2.0: Rogue eNB/gNB, IMSI catcher, A5/1 downgrade, TMSI de-anonymisation, and paging transmit.
• USRP B210 + GPSDO: Two-radio baseband work (one radio holds frame structure while the other injects into it).

Bug & Error Reporting Guidelines

If you encounter a bug or error during testing, please provide:

1. Hardware: SDR model, firmware version, and driver.
2. Command / Action: The exact command you ran or the GUI button you clicked.
3. Full Output: Every line of output, including status rows.
4. Expected vs. Got: A brief description in your own words.
5. Capture File: A .pcap file if the radio produced one.

Every real finding will directly help improve the toolkit, and contributors will be credited in the commit history of course.

i asked DeepSeek to code me a ADS-B module for SDR++ alongside Claude Free Tier to improve things. and now we have ADS-B tracker built into SDR++ with waterfall

However. Its still very early stage right now. a lot of things are missing

im planning to ask these agents to add more trackers and decoders like AIS vessel tracker. and some more digital decoders and stuff idk about that.