Technical Analysis of RTL-SDR and dump1090: Beyond Civil ADS-B Decoding
These days we hear so much about wars in the East and the West. Geographically, Italy has always played an important role, with its opening to the Mediterranean and strategic position. For months I've been interested in radio signals, and I realized how little material exists on the subject, or how niche this field is, especially in Italy. Everyone keeps talking about AI, but who talks about radio signals? I know it might be a forced question, yet my prediction, perhaps wrong, is that the skies will become increasingly central to attacks, given how easy it is to build kamikaze drones. Just look, for example, at the situation between Russia and Ukraine.
I have always been passionate about civil aviation. Now I am trying my hand at writing software that, using devices like RTL-SDR, alerts you if it detects suspicious signals through specific patterns. A simple example: if an aircraft abruptly changes altitude, it alerts you. Or: if it detects route anomalies, it flags the issue. Unlike dump1090, it doesn't limit itself to scanning civil frequencies, but also military ones (or at least it tries to), drones, and potential interference created. Thanks to a modular architecture, I can simultaneously scan signals, visualize them on a map, and tune into different frequencies. I don't claim to be doing something revolutionary. Surely there are private or military software systems that are far more sophisticated, with which Italy is equipped. Or maybe not. I just know that if someone thinks there are already better solutions than their own, they might as well stay on the couch watching TV, right?
Starting from this reflection, the need arises to analyze what concretely happens at an electromagnetic level in our skies and how we can extract actionable intelligence from radio signals. In this article, we will examine the RTL-SDR hardware, the signal mechanics of ADS-B and Mode S at 1090 MHz, the inner workings of the famous dump1090 decoder, and the architectural design of a modular system for radiofrequency and kinematic anomaly detection.
1. Hardware Architecture: The RTL-SDR Dongle and I/Q Sampling
The RTL-SDR hardware originally originated as a low-cost USB DVB-T TV tuner based on the Realtek RTL2832U chipset paired with silicon tuners like the Rafael Micro R820T2. The revolution in Software Defined Radio occurred when the community discovered that the RTL2832U chip could bypass its internal hardware TV decoding and directly stream raw digitized I/Q (In-phase and Quadrature) samples at 8 bits to the host computer.
Every high-frequency signal $s(t)$ captured by the antenna is downconverted to an intermediate frequency and split into two orthogonal components:
- In-phase (I): $I(t) = A(t) \cos(\phi(t))$
- Quadrature (Q): $Q(t) = A(t) \sin(\phi(t))$
Representing each sample on the complex plane $Z = I + jQ$, host software can calculate instantaneous magnitude $A(t) = \sqrt{I^2 + Q^2}$ and phase $\phi(t) = \arctan(Q / I)$. This enables software demodulation of virtually any modulation scheme (AM, FM, SSB, PSK, PPM) without requiring analog hardware changes.
2. The ADS-B and Mode S Protocol (1090 MHz)
ADS-B (Automatic Dependent Surveillance - Broadcast) is the civil aviation standard by which aircraft periodically broadcast their GPS position, altitude, airspeed, callsign, and operational status over a carrier frequency of 1090 MHz.
Mode S / ADS-B messages use Pulse Position Modulation (PPM) at a bit rate of 1 Mbit/s. Each frame transmitted has a strict timing structure:
- Synchronization Preamble (8 µs): A sequence of 4 high-energy pulses spaced with microsecond precision that signals the start of a valid message frame to the receiver.
- Data Payload (56 µs or 112 µs): A block containing either 56 bits (short Mode S) or 112 bits (Extended Squitter, DF17/DF18). The 112-bit payload contains the 24-bit unique ICAO aircraft address, Type Code, telemetry coordinates, and a 24-bit CRC polynomial field for error detection and correction.
3. Internal Mechanics of the dump1090 Decoder
dump1090 is one of the most widely used lightweight ADS-B decoders, originally written in C by Salvatore Sanfilippo (antirez). Unlike heavy software frameworks like GNU Radio, dump1090 is tailored to minimize CPU overhead and execute in real time on resource-constrained embedded hardware such as the Raspberry Pi.
The dump1090 Processing Pipeline
- I/Q Buffer Acquisition: The RTL-SDR dongle is configured to sample at 2.0 MSps. The 8-bit unsigned I/Q stream is continuously loaded into a circular memory buffer.
- Magnitude Vector Conversion: The software converts every $(I, Q)$ byte pair into an absolute magnitude value $M = \sqrt{I^2 + Q^2}$. This converts complex signal numbers into an array of scalar amplitudes, accelerating pulse detection.
- Preamble Pattern Matching: dump1090 scans the magnitude array looking for energy peaks at specific pulse delays (0.0, 1.0, 3.5, and 4.5 microseconds). If the peak ratios satisfy preamble criteria and clear the squelch threshold, frame decoding begins.
- PPM Demodulation & CRC Checksum: For each of the subsequent 112 bits, the decoder compares energy levels in the first half-microsecond against the second half. Once assembled, the 24-bit CRC syndrome is verified to drop corrupted frames.
4. Limitations of dump1090 and the Need for Advanced Systems
While dump1090 excels at passive tracking of commercial airliners, it exhibits structural limitations when deployed for security monitoring or multi-band signal analysis:
| Feature / Capability | Standard dump1090 | Modular Anomaly Detection System |
|---|---|---|
| Operating Frequencies | Locked strictly to 1090 MHz (Civil Mode S). | Multi-frequency (1090 MHz, 978 MHz UAT, VHF Airband, 433/868 MHz VTX). |
| Spectrum Processing | Limited to pulse amplitude demodulation. | FFT spectral analysis, noise floor monitoring, and RF power profiling. |
| Kinematic Analysis | None (displays raw current position/altitude). | Pattern Matching: anomalous climb/descent rate ($|\Delta h/\Delta t|$), abrupt vector changes. |
| Drone / Non-Civil Tracking | Incapable if target lacks an active ADS-B transponder. | Detects uncoordinated RF transmissions, VTX video links, and spectral anomalies. |
| Software Architecture | Monolithic C program with embedded HTTP server. | Modular (C++ Multithreaded DSP Engine, WebSocket Event Bus, Reactive Dashboard). |
5. Architecture of a Modular Anomaly Detection System
To move beyond passive frame decoding and build a proactive airspace monitoring platform, system components should be decoupled into isolated processing modules:
Trackable Anomaly Patterns
The analytics engine continually processes target state vectors and RF spectrum metrics, triggering immediate alerts when anomalies occur:
- Abrupt Altitude Variations ($\Delta h / \Delta t$): Commercial aircraft follow predictable climb and descent gradients (typically within 2,000–3,000 ft/min). Rapid vertical rates exceeding safety thresholds flag potential dive maneuvers or emergency loss of control.
- Emergency Squawk Transponder Codes: Real-time interception of emergency Mode A/C squawks:
7500: Aircraft Hijacking.7600: Radio Communication Failure.7700: General Emergency.
- Sudden Signal Disappearance (Track Loss Anomaly): If an aircraft at high altitude stops transmitting without a corresponding decay in Received Signal Strength Indicator (RSSI), the system registers an unexpected track termination alert.
- RF Interference & Jamming Detection: Continuous Fast Fourier Transform (FFT) noise floor monitoring flags deliberate jamming attempts or high-power narrowband interference on aviation bands.
6. Conclusion
Active observation of the electromagnetic spectrum and airspace monitoring need not remain locked behind proprietary industrial or defense systems. The democratization of Software Defined Radio hardware, paired with custom signal processing algorithms and modular software design, unlocks massive opportunities for independent research and technical exploration.
Building custom tools, experimenting with real-time kinematic analysis, and probing beneath surface-level protocols is at the very heart of software engineering and curiosity.
What are your thoughts on SDR development and radio frequency monitoring? Feel free to share your questions and ideas in the comments section below!
L'Italia è coperta in caso di attacchi aerei?
by u/Giuseppe_Puleri in Italia