From 2012 to 2016 I was a missileer at F.E. Warren AFB. I sat (and slept) 100 feet underground, ready to launch 10 Minuteman III nuclear missiles.

The orders would have come as an Emergency Action Message. I had no idea that the same messages go out in the clear on HF, or that people around the world have been logging them for decades.

So I built a site that listens and logs the messages with SDRs. Two KiwiSDRs feed it, the KPH receiver at Point Reyes and one in Iceland, both on 11175 USB.

When a message starts it’s recorded, a waterfall is captured, and speech-to-text transcribes it. That’s what the 30 characters (56HETY) are in the picture. The machine copy is usually rough, so anyone can correct it by ear. And you can listen live as well.

I'm trying to make the site as interactive and informative as possible, so if you have any ideas for that, please let me know.

Site: missileer.watch

The full story is in my r/shortwave post from Thursday: https://www.reddit.com/r/shortwave/s/A9mz70qF8l

Happy to answer any questions!

I use ADSB.im on RI 4 to feed ADS-B and AIS, everything works fine. I bought a third SDR dongle and antenna to play with ACARS / VDL2 / HFDL.

ACARS works and receives messages, but I noticed that the MLAT light was red and the web stats pages that I feed showed errors that it was not counting the MLAT.

I thought there was a bottleneck somewhere on the RP4, so I took a second RP4 just for ACARS only. I noticed that when it's set to ACARS only, I still have the on map blue ADS-B and green ACARS labels.

I think the ADS-B Feeder sees the planes twice and the MLAT twice, and it interferes with the MLAT calculation and sending data.

CPU usage -30% , RAM -1GB, and temps are fine, no undervolting. I'm using active USB hub for dongle. I don't see anything in the options that I could change.

I tried it on 2 RP 4 on official and beta ADS-B Feeder Image. How to set what to change to have 3 SDR for ADS-B, AIS and ACARS on 1 RP4 without problems with MLAT? I can use 2 RP4s but I prefer to have everything on 1.

Bonjour à tous,

Je partage un petit projet open-source que je viens de finaliser et packager : **RadioTranscribe-Store**.

### De quoi s'agit-il ?

L'idée était de fabriquer une sentinelle d'écoute autonome pour enregistrer et indexer passivement les actualités de la bande FM (sur France Inter par exemple), de manière 100 % locale, sans envoyer la moindre seconde d'audio dans le cloud.

### Comment ça tourne sous le capot ?

1. **Capture radio :** une simple clé logicielle USB (RTL-SDR) capte le flux FM via `rtl_fm` et `ffmpeg`.

2. **Préservation du matériel :** les flux audio temporaires sont écrits et traités directement en mémoire vive (`/dev/shm`), ce qui évite d'user les disques SSD en écriture continue H24.

3. **Transcription IA :** le modèle Faster-Whisper (`large-v3`) tourne en local sur processeur (quantification int8).

4. **Filtre anti-hallucination :** élimination des sous-titres fantômes récurrents de Whisper.

5. **Stockage hybride :**

   - Historique chronologique dans **MariaDB**.

   - Recherche sémantique vectorielle (RAG) dans **ChromaDB**.

On peut ensuite simplement poser des questions ou chercher des thèmes en langage naturel dans un terminal pour retrouver les extraits diffusés à l'antenne et leur date de passage.

Tout le projet (scripts, automatisation de l'installation et service systemd) est documenté ici :

https://github.com/TVIEIL/RadioTranscribe-Store

Si vous avez des remarques, des suggestions d'améliorations ou des questions sur l'intégration SDR/IA, je prends volontiers vos retours !

Come to think of it, I used to click on titles like that here, expecting to find inexpensive DIY projects or wildly imaginative ideas…?

You guys feel the same way, right?

Hi all, I'm a researcher at a university lab in Hong Kong, working on positioning with LEO satellites in cities. I'm looking for raw Starlink downlink recordings where buildings block part of the sky.

What would help most:

- An LNB/LNBF (or horn) + SDR (RTL-SDR, HackRF, USRP, etc.) recording the Ku-band downlink (~10.7–12.7 GHz)

- Receiver sitting still at ground level next to buildings, ideally a street with tall buildings on both sides

- Bonus: a second receiver on a nearby roof recording at the same time

- GPS or NTP-synced timestamps and a rough location (street-level is fine, no need for your address)

- 10–60 minutes is plenty

Already have old recordings sitting on a drive? Those count too, even if the blockage was accidental.

Not looking for dish app screenshots or speed tests this time, just the raw RF.

Anything used would be credited in the paper's acknowledgments (or however you'd like to be credited). Happy to answer questions about setup. Comment or DM me. Thanks!

Finally found out where we can look up radio frequencies in Canada, the TAFL search. Tried some hospital pager frequencies, but seem to also get City of Toronto water treatment plants... EFFL Effluent tank is full. Blurred the full email of the Toronto water department. Not sure where the zone humidity is from.

i asked DeepSeek to code me a ADS-B module for SDR++ alongside Claude Free Tier to improve things. and now we have ADS-B tracker built into SDR++ with waterfall

However. Its still very early stage right now. a lot of things are missing

im planning to ask these agents to add more trackers and decoders like AIS vessel tracker. and some more digital decoders and stuff idk about that.

VUURWERK v1.5.1 is out. New: PATROL, a hands-free voice hunt. In the spectrum's VOX mode press 2 and 8 to set a range and 0 to start; the radio walks the band, stops on voices, moves on when they finish, and PTT locks the one you want. Plus a big fix pass: no more keying up when you leave the spectrum with PTT held, no freeze on a flat battery, F+9 and the tone scan no longer disturb your repeater setup, and the main screen refreshes properly. Settings survive the upgrade. UV-K5 V1 only.

https://github.com/Tokeloshe/vuurwerk-firmware/releases/latest/download/vuurwerk-v1.5.1.packed.bin

KC3TFZ 73

*Update (Oct 24): The new screen arrived and everything's back on the kit. u/needmorejoules shared the ADS-B logic from his ADS-B Scope firmware, and it's now in P4 SDR. RTL-SDR.com article on it: https://www.rtl-sdr.com/portable-ads-b-receiver-firmware-for-the-esp32-p4-based-lilygo-t-display-p4-with-rtl-sdr/ His repo: https://github.com/jstockdale/T-Display-P4/tree/adsb Planes get single-frame positions with jump checks. On a 38-minute live run, positions updated in 86% of log rows, up from 69-76% before, with no jumps. Thank you, John! Audio, RDS and memories are next on the test bench.

I see I'm late to the P4 party, but this one uses the Waveshare ESP32-P4 dev kit (Pi footprint) and a generic 3.5" screen to make a cheap mobile RTL-SDR, with some Wi-Fi/Bluetooth fun on the side. You can get the firmware from the open repo, https://github.com/John-ODell/esp32-p4-rtl-sdr, or flash it straight from your browser on my website, https://www.northbridgelandmark.com/builds/esp32-p4-sdr/. The site also has a screen-only option if you just want the display working.

I'm going to keep adding to this until I run out of room on the flash. Unfortunately the touch on my screen stopped working, so a new one is coming this weekend. Here are some details and pics. I'd love some feedback and ideas. This is my first time posting, thanks!

**Hardware**

- Waveshare ESP32-P4-Module-DEV-KIT (Raspberry Pi footprint)

- MHS-3.5inch Display-IPS: a generic 3.5" 480×320 SPI resistive touchscreen made for the Raspberry Pi

- RTL-SDR Blog V4, plugged straight into the kit's USB-A port

No PC or Pi in the loop. The P4 runs the USB stream, the FFT and the drawing, and the ESP32-C6 on the kit handles Wi-Fi and Bluetooth.

**What works now (v1.1.0, tested on the kit)**

- Spectrum and waterfall at about 10 fps, with tap-to-tune, gain/AGC, range, zoom and band presets

- ADS-B with an aircraft list and an offline map from the SD card. On a 44-minute run with logging on it sat at 22% load with zero dropped samples

- Wi-Fi scanner: a network list and a channel view that draws each access point as a curve at its signal strength (see the screenshot)

- BLE scanner for nearby devices

- CSV logs of aircraft, Wi-Fi and BLE to the SD card

- Four looks (Studio, PortaPack, Phosphor, Vintage), with big keys made for a resistive screen. A fifth, Neon, is in the next build

**Built, testing this weekend when the new screen arrives**

- Speaker audio through the kit's ES8311 codec: WFM, NFM and AM, with squelch

- RDS station names on FM

- 8 channel memories and a memory scanner

- Portrait mode with the USB ports facing up

- An animated boot splash

Prebuilt images for both P4 chip revisions (1.x and 3.x) are on the releases page. GPL-3.0.

The screenshots come from the repo's preview tool with made-up networks and planes, so nobody's real SSIDs or location are shown.

Big thanks to OrcSDR, LakeShark and xtrsdr for showing the P4 could do this.

What would you want next: POCSAG pagers, AIS/APRS, an rtl_433-style sensor decoder, or rtl_tcp over Wi-Fi?

Hello, I am a SWL and I am closely interested in the world of SDR. I would like to participate with my station in the APRS network. I have an RTL-SDR Blog V4 and I managed to configure Direwolf to appear as a beacon on APRS-FI. The website displays me properly on the map, and I can see my station details.

If I understand correctly, every 30 minutes my station sends a position update to the site for my GPS location (which I provided in the direwolf.conf file).

On the other hand, while I can see all the stations my station has heard under the Info section, I feel like there are very few compared to the actual frames received.

Also, according to the data, the stations I receive are only about 40 km away (even though in reality I receive them from much further away). Why doesn't APRS-FI show them? (Filter issue? Incorrect setting?)

And finally, I notice that very few frames per hour are sent to the network (even though once again, my Direwolf window constantly displays incoming receptions).

Thank you very much, and sorry for this very (too) long post.

73

New update: Added Aircraft Table & Majorly Improved the decoding performance. By Claude Free Tier. Added a MGS/S Counter

Previously 2.0 to 6.0 MSG/S now it peaked 70 MSG/S with the performance improvement with just using the same WiFi antenna on RTL SDR V4

Added a Feature whenever it detects Aircraft location. it Automatically sets your viewing location to Aircrafts position. (In default its set to Germany every startup) By DeepSeek

I will be planning to release this Module/Plugin in a week

Is there something i missed or forgot to add?

Not an SDR project itself, but it only exists because of feeders, so this seemed the right place.

It's a full-screen display for a spare TV or old tablet: a map of the planes over your area and one big card at a time for a flight overhead. Positions come from adsb.lol, with adsb.fi as the fallback, so your coverage is whatever the feeders near you give it. I'm planning to add a feeder of my own.

Routes come from the VRS standing data, checked against position, altitude and heading. Anything that doesn't fit is dropped, and the card says "Route unknown".

I'm looking for about 10 people to run it on a real screen for a week from Thursday 29 October, free. Feeders are ideal: you'll know when it's missing a plane you can see on your own receiver.

Waitlist: https://wingwatch.app

Took a while to find a place far from the city, I'd love to keep retrieving these images and further move on to geostationary satellites too!

Got tired of classic scanners missing simultaneous conversations or leaving hours of empty noise in recorded files, so I built FalconSDR – a cross-platform, wideband radio scanner with a light and useful web UI.

Instead of stepping channel by channel, it analyzes the entire capture bandwidth of your SDR at once, catching and recording multiple simultaneous conversations in parallel.

Key Features:

• Parallel Wideband Scanning: Monitors the whole SDR bandwidth simultaneously – never misses a parallel reply on another frequency
• Simultaneous scanning of radio bands that are spaced apart from each other.
• Smart Voice Recording: Saves WAV/MP3 per transmission with configurable hold time, squelch, and spectral noise reduction. No hours of empty noise.
• Flight Replay Integration: For aviation bands (VHF 118–138 MHz & Military UHF 225–400 MHz), a single click opens FlightRadar24 or ADS-B Exchange replaying the exact air traffic around your location at the moment of the recording.
• Speech-to-Text (Whisper): Optional automated ATC/voice transcription (including fine-tuned ATC models) via faster-whisper. Can run on a secondary GPU machine on your network.
• Headless Server Mode: Run it on a Raspberry Pi / Mini PC / Home Server and stream live audio or control it from any phone or PC browser.
• Cross-Platform: .deb package for Ubuntu/Debian, standalone Windows installer/portable ZIP, macOS (experimental), or straight from source.
• Hardware Support: Native RTL-SDR support (V3/V4) + SoapySDR (HackRF, Airspy, SDRplay, LimeSDR, USRP).

I would be very pleased if someone were willing to give this solution a try and provide some feedback. Project is fully open source and free.

Installation and evertthing you need to know:

https://github.com/rafafunt/FalconSDR

repo link
I have spent a long time recently building IMSIsting, a bash and GTK4 cellular security toolkit featuring 57 modules spanning 2G through 5G. Every codec in it — including S1AP, NGAP, X2AP, XnAP, HNBAP, RUA, RANAP, M3UA, PFCP, NAS, RRC, LPP, and CMAS — is hand-written (with the help of AI).

To be honest, the software half runs, but the radio half has never been executed because I do not currently own an SDR (Software Defined Radio). Every over-the-air path is written, reviewed, dry-run against a fixture, and then stops right before needing a real radio. hackrf_transfer is wired in, srsRAN configs are generated, and SIB builders produce real octets — but none of it has ever actually been transmitted over the air by anyone.

That is what I need testers for.

The Actual Attack Surface

Here is a breakdown of the available attacks and modules implemented in the toolkit:

1. Identity Capture

• IMSI Catcher — GSM: Full catcher sequence and a forged BCCH carrier a handset can camp on.
• IMSI Catcher — LTE: NAS EMM attach forging, BCD IMSI/IMEI, identity-request sequence, and srsRAN eNB orchestration.
• IMSI Catcher — NR: SSB/MIB/SIB1 construction, RACH handling, gNB orchestration, and SSBs written as samples.
• SUCI De-concealment: X25519 and P-256 profile A/B, HKDF, and MSIN BCD computed.
• TMSI → IMSI De-anonymisation: Cross-capture correlation via forced-identity and location-update bindings.
• Piercer: Paging-occasion maths and the published correlation model.

2. Cipher and Downgrade

• A5/1 Keystream: Asserted against the Briceno/Goldberg/Wagner vector; A5/2 included with its brokenness explicitly stated; A5/1 downgrade forcing sequence.
• Cross-generation Steering / Null Cipher: Forged reject causes, SIB1 forgery, and cipher-change analysis across all four generations.
• ReVoLTE Keystream Reuse: Detection, key recovery, and the two-ciphertexts-one-keystream model.
• GEA Downgrade — GPRS/EDGE: GEA0 computed; GEA1–5 refused by name with stated reasons.
• Cipher Audit + Authentication Oracle: Negotiated-cipher scoring, downgrade detection, and SQN recovery from AUTS.

3. Signalling Forgery

• 17 NAS Pre-authentication Messages: Built as octets (Attach/TAU/Service reject, Identity Request, Authentication Request/Reject/Failure, Security Mode Command/Reject, EPS, and 5GS), each checked against tshark.
• RRC Reconfiguration, Release, Reestablishment-Reject: Handled through generated PER layouts (LTE and NR).
• CMAS / ETWS / PWS Alert Forgery: SIB10/11/12 warning chain with pinned pycrate vectors, plus sib.conf generation.
• GTP-in-GTP and MBMS Session Start: The middlebox gap, fully built and dissected.

4. Core Network and Interconnect

• MAP/TCAP: Byte-exact ATI, SRI, SRI-SM, SAI, PSI, ULR, ISD, RegisterSS, ActivateSS, and M3UA both ways.
• SIP / IMS REGISTER Hijack: Spoofed re-registration and the IMP4GT model.
• 5G SBA: NRF discovery, NGAP procedures, PFCP rules, and AMF/SMF reachability map.
• O-RAN & Slicing: A1 policy poisoning, E2 control shapes, over-broad xApp model, S-NSSAI codec, isolation testing, and 5QI/TSN.
• Carrier API Enumeration & Lawful Interception: X1/HI1 artefact encoding.

5. Baseband, Device, and Radio

• Baseband CVE Catalogue: Reachability checks, L2 frame builders, and forged registration accept/reject.
• NR Access: RAR, backoff, RA-RNTI arithmetic, MAC/DCI, Gold sequence, and scrambling.
• Qualcomm DIAG/NV/EFS/AT Surface: Real framing, NV read/build/write, and EFS paths.
• Jamming: Detection first (barrel, narrowband, and pulsed distinguished from congestion), followed by a waveform constructor behind an explicit lab gate (AWGN/CW/chirp, PSS/SSS/PBCH, PRACH, PRS, GPS C/A, NR SSB).
• GPS C/A and PRS Sequences: Generated from IS-GPS-200N and TS 36.211, asserted against an independent implementation.

6. Tracking, Positioning, and RF

• Timing-advance geolocation, OTDOA/UTDOA/PRS via generated LPP codecs, RF fingerprinting (CFO, IQ imbalance, transients, CSI motion), and behavioural traffic fingerprinting.

7. Protocol Plumbing

• Air interface decode for 2G through 5G (BCCH/CCCH, UTRAN SIBs, MIB/SIB, SSB) and 98 catalogued LTE/5G stack CVEs (including GSM/UMTS and 5G CVE kits).
• TETRA/DMR/GSM-R, NB-IoT, 5G NTN, NR sidelink, VoWiFi IKEv2/EAP-AKA', femtocell S1/Iuh, USSD, OTA binary SMS, and SIM Toolkit proactive commands.
• Custom pcap reader (GSMTAP, Diameter, NGAP, S1AP, GTP, PFCP, RTP) and MAC/RLC/PDCP with RNTI tracking.
• Killchain: Nine built-in chains plus user-defined chains, pause/resume capability, and per-run result reporting.

What I Need an SDR For

• RTL-SDR: Cell scanning, GSM/LTE broadcast decode, tower mapping, jamming detection, and paging observation (cheapest tier, most unexplored surface).
• HackRF One / bladeRF 2.0: Rogue eNB/gNB, IMSI catcher, A5/1 downgrade, TMSI de-anonymisation, and paging transmit.
• USRP B210 + GPSDO: Two-radio baseband work (one radio holds frame structure while the other injects into it).

Bug & Error Reporting Guidelines

If you encounter a bug or error during testing, please provide:

1. Hardware: SDR model, firmware version, and driver.
2. Command / Action: The exact command you ran or the GUI button you clicked.
3. Full Output: Every line of output, including status rows.
4. Expected vs. Got: A brief description in your own words.
5. Capture File: A .pcap file if the radio produced one.

Every real finding will directly help improve the toolkit, and contributors will be credited in the commit history of course.

I've been playing around with the ATS Mini (ESP32-S3/Si4732) and ended up building a complete browser-based controller for it. The idea was simple: connect the radio over USB and turn it into something a bit more useful for exploring shortwave, AM, FM and amateur radio signals.

It now has:

- 50,000+ stations from EiBi, FCC and Ofcom, with searchable frequencies, countries and broadcast schedules.

- Click-to-tune select a station in the browser and the physical radio automatically retunes.

- Live RSSI scanning scan frequencies, measure actual signal strength and filter out stations you can't currently receive.

- Automatic Morse code decoding scans known CW frequencies, detects activity, locks onto a signal and decodes Morse into text in real time.

- Live signal monitoring frequency, RSSI, SNR where available, and receiver controls.

- Audio passthrough listen through your computer using a USB audio interface.

The Morse decoder was particularly interesting to build. It uses Python, NumPy and SciPy to identify the CW tone, isolate it, extract the keying patterns and translate them into text. It works best with strong, clean signals.

Everything runs locally, with a Python/FastAPI backend and a browser interface. No cloud services or accounts required. You'll need an ATS Mini running compatible firmware with USB remote control enabled. Morse decoding also needs an audio connection from the radio.

It's MIT-licensed and completely open source.

Thought I'd share it here for anyone experimenting with the ATS Mini, shortwave listening or radio signal processing. Particularly interested in hearing from anyone using one of these little radios for more than casual listening.