When I started to play with SDR devices, I didn’t realize how many signals can be captured with these devices. We are surrounded by radio signals like WIFI, Bluetooth or 4G. These signals, although we don’t know exactly how they work, we are comfortable with them, but when you connect a device like the RTL SDR, you will notice that many devices are transmitting radio signals in many different bands, even devices that you didn’t realize they were.

Even though the radio spectrum is infinite, we can transmit from hundreds of kilohertz to dozens of Gigahertz, the spectrum is divided in different bands. each one with a specific purpose. The most known bands are maybe 2.4 and 5 GHz, since WIFI networks works in these two bands, about also in the 2.4 GHz band we can find wireless mice and keyboards or R/C toys. If we continue navigating though the spectrum, we can arrive to a sub Gigahertz frequencies, where we can find different bands. LoRa devices use the band of 989 MHz in EU, and in the band of 433 MHz we can find the ISM (Industrial-Scientific-Medical) band. Although the name could look like this band is used for high-technology devices, with very important missions, the truth is that this band is used for everything. From weather stations, remote controllers, wheel pressure sensors… The information that these devices are sharing is not classified as confidential, even if you spent hundreds of euros in the best weather station, so, in general, this information is transmitted without encryption, which means that anyone with an SDR device can read this information, and knowing the format of the message, even decode the message. There are a lot of devices that use this band, but knowing the format of the packet for everyone is a little bit difficult, but there is a very interesting project that actually knows the format of many different products, and allow us to read the information of the weather stations of your neighbors, and check the pressure of the wheels of their cars, this project is named rtl-433, which works with the RTL SDR device.

RTL SDR is a USB radio receiver based on the RTL2832U. This device allow us to capture frequencies from 500 kHz to 1.8 GHz, so we can acquire the ISM band. The cost of this device is around 20 euros, so it is a very interesting device to make your first steps in the SDR world.

RTL SDR

First of all, we are going to install the needed libraries to connect the RTL SDR to our computer. The commands I used are valid for a Linux installation. The packages we need to install are libusb-1.0.0-dev, git and cmake.

sudo apt-get install libusb-1.0-0-dev git cmake

Now, we need to clone the repository rtl-sdr, and execute the next commands to install it.

git clone git://git.osmocom.org/rtl-sdr.git
cd rtl-sdr/
mkdir build
cd build
cmake ../ -DINSTALL_UDEV_RULES=ON
make
sudo make install

Finally, we need to copy the rules file to be able to communicate with the RTL SDR.

sudo cp ../rtl-sdr.rules /etc/udev/rules.d/
sudo ldconfig

Once we have all installed, we can verify if all is correctly installed using the test command rtl_test.

pablo@miercoles:~$ rtl_test
Found 1 device(s):
  0:  Realtek, RTL2838UHIDIR, SN: 00000001

Using device 0: Generic RTL2832U OEM
Found Rafael Micro R820T tuner
Supported gain values (29): 0.0 0.9 1.4 2.7 3.7 7.7 8.7 12.5 14.4 15.7 16.6 19.7 20.7 22.9 25.4 28.0 29.7 32.8 33.8 36.4 37.2 38.6 40.2 42.1 43.4 43.9 44.5 48.0 49.6 
[R82XX] PLL not locked!
Sampling at 2048000 S/s.

Info: This tool will continuously read from the device, and report if
samples get lost. If you observe no further output, everything is fine.

Reading samples in async mode...

Once we have the RTL SDR drivers installed, now we have to install the rtl-433 application from the Ubuntu’s repository.

pablo@miercoles:~$ sudo apt install rtl-433

At this point, we are ready to execute the rtl-433, and start receiving data. To execute the application, we only need to execute the command rtl-433 in the terminal.

In my case, I detected two different weather stations, which I can use for reading temperature and humidity, which means that I have two different weather stations :).

pablo@miercoles:~$ rtl_433
rtl_433 version unknown inputs file rtl_tcp RTL-SDR SoapySDR
Use -h for usage help and see https://triq.org/ for documentation.
Trying conf file at "rtl_433.conf"...
Trying conf file at "/home/pablo/.config/rtl_433/rtl_433.conf"...
Trying conf file at "/usr/local/etc/rtl_433/rtl_433.conf"...
Trying conf file at "/etc/rtl_433/rtl_433.conf"...
Registered 122 out of 149 device decoding protocols [ 1-4 8 11-12 15-17 19-21 23 25-26 29-36 38-60 63 67-71 73-100 102-105 108-116 119 121 124-128 130-149 ]
Found Rafael Micro R820T tuner
Exact sample rate is: 250000.000414 Hz
[R82XX] PLL not locked!
Sample rate set to 250000 S/s.
Tuner gain set to Auto.
Tuned to 433.920MHz.
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-09-13 16:13:35
model     : LaCrosse-TX141THBv2                    Sensor ID : ee
Channel   : 00           Battery   : 1             Temperature: 26.80 C
Humidity  : 68 %         Test?     : No
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-09-13 16:14:04
model     : inFactory-TH ID        : 171
Channel   : 1            Temperature: 79.10 °F    Humidity  : 62 %
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-09-13 16:14:04
model     : inFactory-TH ID        : 171
Channel   : 1            Temperature: 79.10 °F    Humidity  : 62 %
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-09-13 16:14:04
model     : inFactory-TH ID        : 171
Channel   : 1            Temperature: 79.10 °F    Humidity  : 62 %
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-09-13 16:14:05
model     : inFactory-TH ID        : 171
Channel   : 1            Temperature: 79.10 °F    Humidity  : 62 %

As I mentioned before, we can find not only weather stations, from data acquisition systems to pressure sensors, send the information using the ISM band, and using rtl-433 we can decode many of them.