← All talks

ATGP - Better Spectrum Monitoring with Software Defined Radio - Michael Ossmann

BSides Las Vegas46:322.3K viewsPublished 2016-12Watch on YouTube ↗
About this talk
ATGP - Better Spectrum Monitoring with Software Defined Radio - Michael Ossmann Above the Ground Plane BSidesLV 2015 - Tuscany Hotel - August 05, 2015
Show transcript [en]

you know but lunch if you want to get up and then you just try to do it quietly respectfully we'll be all set so what thanks a lot Ron thank you everyone am i is it Mike getting me is it good can you hear me okay barely all right is that any better yeah okay so those of you who saw me last night know that I had no voice whatsoever so I now I have partial voice yay partial voice I get a little excited sometimes when I talk about SDR and when I talk to a big room full of people who are excited about SDR for four days straight sometimes I lose my voice apparently so

I want to talk about spectrum monitoring with software-defined radio hopefully everybody has a basic idea have you heard of software-defined radio before you have something I know okay right so it's just the application of digital signal processing to radio so I like to tell people who are new to software-defined radio that it's like a sound card for radio alright like your sound card can record arbitrary sounds produce arbitrary sounds replay whatever same kind of thing but with radio waves instead of sound waves and we have all these wonderful wonderful tools now for software-defined radio like I got this real tech dongle here and hack RF and all kinds of stuff but when people are new to software-defined radio one of the

things that they are probably very likely to see right off the bat is something like this a waterfall plot and a waterfall plot is a moving spectrogram and a spectrogram gives you time on one axis and frequency on another axis and then the relative power level is indicated by a color of a pixel so it's super informative if you haven't ever seen anything like this and you see it for the first time it's like wow amazing there's so much information there it's incredible and eye-opening and you can see a whole bunch of different signals so like in this case this is a actually a video that I pulled off of YouTube that was somebody using a hack RF to

tune into I think some cellular bands in Europe and you could see a whole bunch of different channels in use and a single channel ends up as a vertical line or a vertical row of little blips or something in the moving spectrogram and and it's it's so cool it contains so much information but over time if you use these things you might notice that well it's cool but it has some limitations - there's another example of a similar sort of display we're in the SDR our world is full of different software implementations that all use this popular kind of waterfall display so here's one called RF analyzer for Android and you can just plug in your

tablet or your phone right into RF or a real tech dongle and get a waterfall display right there it's really handy another one is the Porta pack for hack RF that Jared Boone here designed he was my co designer on hack RF one and now he's producing this add-on for hack RF one so this is like the regular hack RF one but then if you put his Porter pack on it oh gotta grab the battery thank you Mike so you have you have a little you know nice aluminum case and a and a front end board that has an LCD on it and so what do people want to do with the porter pack of course they want to look at a

waterfall display right everybody wants to look at a waterfall display it does other things too we can do like decoding and audio and stuff it's cool toy handheld SDR platform but probably the the main thing that most of the people are going to do most of the time with for tapak it's the same thing they do with every other SDR platform and there's stare at waterfall displays so these these wonderful displays are super awesome but they have some problems in my opinion or at least maybe maybe problems isn't the right word but limitations they have some limitations one of them is oops one of them is that transient events can be completely missing and this is something that

throws the people for a loop sometimes I think it looks like you have such a complete picture of what's going on but I want you to think about this with me do a little math in your head the hack RF for example is capturing 20 million samples per second it's measuring the signal on the antenna 20 million times per second okay 20 million it's a big number okay how many how many horizontal rows are in this LCD display or area in the display of any display on which you're watching a waterfall plot 320 Jared knows the answer exactly of course generally speaking you're gonna be looking at a water plot waterfall plot that has maybe

you know a few hundred lines at the most each line has loriel let's say how about this how many rows appear per second I don't know 30 ish something like that I know tens of rows at the most so you get okay let's say let's say let's give them the benefit of the doubt and think we're getting a lot of information here let's say you get a hundred rows and one second okay you're getting a hundred rows in one second but we measured and each row probably was computed over a few hundred or maybe let's say a thousand samples so a hundred that samples are getting this is like best case a hundred thousand measurements are

getting displayed on the screen in one second but there were 20 million measurements made in that second you're only seeing a hundred thousand out of twenty million and I'm and in most cases that's probably the best case scenario roughly speaking you're probably missing hundreds to maybe a thousand times of the information compared to what you're actually seeing on screen where does all that missing information go well it gets lost between the horizontal rows of your waterfall display you see a row and then some time elapses maybe it's only you know a tiny fraction of a second but then you see another row and in between those two horizontal rows in your waterfall display or those two time rose

you uh you completely miss things that can happen now you might think well you'd only miss very short things but guess what radio technology these days is full of very short things do you know how long a typical Bluetooth black packet lasts it lasts about 200 microseconds maybe 500 microseconds microseconds not milliseconds microseconds so and that's just one example our daily lives are full of more and more interesting wireless digital wireless technologies that use super super short packets of information and you can completely fail to observe them when even if they're right in the middle of what should be in your waterfall display because you didn't happen to get lucky enough for one of them to happen

at the right time to so you get a little tiny blip in one horizontal row of your waterfall Wow so transient events are very difficult to observe with this type of display another limitation of waterfall displays is that you only you can only see a certain limited period of time now you can like turn down the speed of the waterfall in which case the other problem becomes more severe but these are two sort of you have a trade-off there the faster your waterfall the less time you see and it sometimes it's nice to observe trends over time if you're only looking for at a few seconds of information at a time you can't really observe trends

very well another limitation of waterfalls is that you get limited bandwidth now hack RF for example operates over about 6 gigahertz of operating frequency range but the instantaneous bandwidth that it measures is only 20 megahertz so you see in the waterfall at the most about 20 million Hertz 20 megahertz out of 6 billion Hertz 6 gigahertz you're seeing a tiny fraction of its tuning range which can be nice 20 which is a lot for many purposes but wouldn't it be nice to use the hardware a little bit more effectively to serve a much more bandwidth and spectrum surveying respect your monitoring is something that is an important use of software-defined radio technology I think it's something that

is extremely useful for observing how we use spectrum measuring how we use spectrum checking up to see how good our spectrum management is like are we utilizing this public resource effectively and sharing and effectively are people abusing the spectrum and can we fix that how do we find and fix those problems this wide spectrum monitoring is useful for all sorts of things it's useful for radio astronomy it's useful for just all sorts of different applications and what we find is that there aren't a lot of tools or there haven't been a lot of tools until recently to do that kind of spectrum monitoring without using like high-end equipment very expensive equipment not lower-cost equipment like these so the

first thing I want to show you that I'm sure some of you have seen before is a wonderful piece of software called gr phosphor phosphor with an F gpu-accelerated waterfall display this is something you can use to solve one of those three limitations and that limitation is the problem observing transient events and this is some open source software from TMT in the Osmo comm group and check this out okay slightly faster or a lot faster and not only is the waterfall displays super fast not only is it moving super fast but also look at the kind of heat map spectrum display at the top if you look at like the little red line over the top

of things you can actually see things show up that we're so transient that you might not know that they've been able to see them at all and so it's sort of a guide for your eye shows you like the the probability of events or the duty cycle of events like things that happen super fast that you would never see with your eye on this kind of display actually get indicated as something that appears and then disappears it's amazing at capturing transient events and the reason it's able to do this is because it's GPU accelerated and just because the the author of the of the software decided to you know he set out to solve this problem of not not being able to

see transient events it's just a better water flaw than most waterfall displays now for certain purposes though it might not be better like the limited time displayed problem right we're we're seeing even less time displayed on the waterfall now and we use phosphor but if your concern is to see transient events phosphor is amazing and gr phosphor is a very similar display to something you might have seen before on real-time spectrum analyzers if you've ever bought a spectrum analyzer a piece of RF test equipment you first of all you spend a lot of money probably and second of all you you you probably bought a traditional or swept spectrum analyzer unless you really spend a lot of money and you got

a real times it's hurt and these things start somewhere in the tens of thousands of dollars and a real-time spectrum analyzer does exactly what gr phosphor does it tries to show you everything that happened during a limited window of time and frequency and if you look under the hood of a real-time spectrum analyzer you'll find something very similar to this it is simply a high-end SDR platform with software on the front of it that is similar to gr phosphor so how about the limited time display how do we observe spectrum over a longer period of time traditionally when people start to solve these problems like observing spectrum over a longer period of time or observing spectrum over what

much wider bandwidth they turn to a spectrum analyzer and this is the cheapest spectrum analyzer I could find that has as much bandwidth operating frequency range I should say as a hack our app and it is I think eight thousand dollars something like that so it's a big jump in cost to go to some of these more traditional solutions for spectrum monitoring but here's how they work assuming that you're using a swept spectrum analyzer or the lower-cost type of spectrum analyzers you know like this one as opposed to the real-time spectrum analyzers it works like this over time it Tunes a radio receiver it sweeps the frequency and so the red line here in this plot shows you how the frequency is

increased over time and then it jumps back to the beginning and it's increased over time and then it jumps back to the beginning and it's increased over time it's only really measuring the radio energy at one frequency at one time it's not actually measuring all frequencies all the time which is something I'm not even sure a lot of first-time users of spectrum analyzers realize that those things have limitations to again these kinds of devices can have problems picking up transient events because if an event at a particular frequency happens between two sweeps which is misses it completely but they're super good at at sweeping over a very wide range of frequencies really good at that

and that's one of the best reasons to use a traditional spectrum analyzer and you can also often configure these things to give you data over a longer period of time in some way so they're good for those things and they have a nice you know front-end and everything but sweeping with these smooth analog curves or lines is is not the only way you can also sweep in steps or do digital sweeping you can measure the range of frequencies we're usually a pretty narrow range and then and then step to the next range of frequencies and then step to the next range and then step to the next and effectively you get a very you get the same type of

measurement if you're looking over a wide wide bandwidth and this is a very easy sort of thing to implement on for example low cost digital radio transceivers like the I am me my favorite pink toy and now everyone's favorite pink toy since Sammy well the the I am me Y was introduced to by Travis Goodspeed and he taught me how to program it and then I said hey I could build a spectrum analyzer out of this so I wrote software to to be a spectrum analyzer and what it does is it Tunes this little radio chip to one frequency takes a measurement of the radio energy then plotz one pixel to the screen or one column of pixels to the screen then

it shifts over to the next frequency and it Tunes the radio it takes a measurement of the energy and plots a column to the screen and so forth and it sweeps across this 130 character display or 130 pixel display many times per second of 20 20 sometimes per second something like that so it's actually able to do this quite fast it responds very well it's a very quick quick thing and it's actually pretty good at capturing transient events it turns out that even though this is really in some ways crude compared to say this and it's using this type of technique where I tune in to one frequency take a measurement tune to the next take a

measurement I'm tuning very fast so this sort of gets compressed vertically and I'm sleeping across very very quickly and there's less time for transient events to get lost between the sweeps so for a while I had this you know I always have one in my bag or whatever and for a while I had a piece of testing my bench that was like this $40,000 oscilloscope slash spectrum analyzer combo and I was trying to pick up some packets that were very short from some digital radio system and I was having trouble catching them with my $40,000 test gear and I pulled out my I am me turned it on oh there it is like the I am me was able to

catch these transient events much better than the $40,000 scope and spectrum analyzer so because of this one thing is this it's cheap it doesn't have a very wide operating frequency range it's only it's crude in some ways but it does one thing very well and that's tuned quickly and move on in the next frequency so we can do the same types of things actually and with all kinds of radio systems that are either digital radio systems or digitally controlled radio systems and the first thing I want to show you that is a tool that that can do this sort of digital sweeping for for SDR platforms is a program called Ozma comm spectrum sense so in this case it's not

very fast but it's using this technique of digitally sweeping or of taking a tuning to a frequency taking a measurement retuning the radio and then taking a measurement then retuning the radio and taking a measurement doing this over and over again and it's a sign it works with all of the different all the different platforms that are supported by gr Osmo SDR the abstraction layer that supports hack RF and Realtek dongles and various other hardware platforms the I can't remember if I know I don't have a display of the output here but it's very similar to the next tool that I'm going to show you RTL power now this one's specifically designed for just the realtek dongle and I don't

think it supports any other hardware platform at this time but it does basically the same thing it Tunes the radio take some measurement Tunes the radio take some measurement now this takes time tuning the radio of a device like one of these SDR peripherals it takes a lot more time than tuning the radio in the I am me and the main reason for that is that we have to control these things over USB and there's some USB communication latency every single time we tell the radio to tune and so it isn't good this technique is not good at all for capturing transient events but it's super awesome for sweeping over a very wide range of frequencies and for

doing it indefinitely for as long as we want to so here's an example of the output from RTL power whoo exciting right yeah everybody loves a text file sexy and that's what it gives you it just gives you like dumps these two tools get dump data to standard output they give you like a timestamp and a little information about how it was tuned or how the radio was configured and then the output of a measurement and that's it so what do you do with this information well you probably want to visualize it in some way maybe you'd dump these measurements into a new plot or something there's a cool tool and suddenly the name is

escaping me is it heat map heat map P why is that all it's called yeah okay thank you this is an example of one let's see when was this taken is this

oh I'm having trouble okay so this is one that I took the first time I gave this talk was a invention in May and today I'm giving a slightly extended version of it but when I went to hand vention I was preparing this talk I I ran RTL power I think it was overnight for about eight hours in my hotel room night before the talk and I monitored over the entire range of a real tech dongle which is close to two gigahertz so this is two gigahertz wide and it is the that's the the width in Hertz and that's also the horizontal scale of this plot and it's about eight hours tall now can you see

the moment in time when I stopped working on my slides and I turned my phone into airplane mode and went to bed suddenly think it's got a lot quieter through all this section over here characteristic change and I think they're I think the radio receiver became more sensitive at that time to some things that were at higher frequencies which is kind of interesting but there was a lot of kind of wideband noise because I had this closed ring tively high-powered device in my pocket or something while I was working and then I didn't want anything to wait and interrupt me while I was catching a few hours sleep so I turned it into airplane mode went to bed woke up in the morning

and found this plot now if we zoom in a little bit you can see that this is extremely rich in information this right here I'm zooming in around one gigahertz so you can see a lot of stuff in the upper 800 that's a lot of cellular bands you can see stuff the nine the lower nine hundreds are pretty quiet which is but there's a little bit of activity in that 900 megahertz is M band and then like the first really brights bright little blips in the that first kind of big bright vertical line north 900 megahertz is probably pagers around nine hundred nine hundred and thirty megahertz pagers are still around and they have pretty powerful signals and so

you can see all kinds of different things and you can see how the spectrum is utilized over time now this was just like with a stupid little telescopic antenna nothing special not tuned particularly well for most of this frequency range but even with that I thought I find this to be an extremely valuable tool and you get this the very rich data set out of it all I did was turn on a script when I went to bed wake up dump the output into a little program that created this graphic so here's probably an even better one and this is this is a similar one that was done I think with a better antenna by somebody

who posted it online I think tollens the name of the person and and actually annotated it so like I'm having trouble navigating but you can see that this has actually been navigating there's like or sorry this has been notated so you can actually see like on the right hand side it's kind of the most interesting vertical band of blips is dect forest not far from the right hand side there's some mobile phone bands and then DECT phones kind of right in the middle there DECT is the protocol that's used for home wireless phones all right not your mobile phones but your home cordless phones DECT is dect is the protocol that's used for pretty much all those things there's a

little gap in the middle of no information because that particular tuner on the realtek dongle that was in use has a tuning gap and isn't capable of measuring those frequencies there's a bunch of mobile phone bands that's most of the bright stuff you see just to the left of that gap and you can see some like public safety radio system amateur radio stuff all sorts of cool stuff so like here you can see zooming in a little bit you can see like LTE and GSM and really get a good idea using this super easy-to-use tool and super low cost platform you can do this I suspect you're monitoring now all of this is uh oh oh and here's something

that I actually don't know a whole lot about but I found it online and was like wow people ought to know about this I guess it's a this program that's a spectrum analyzer software for SDR hardware and again it's sort of the idea of let's take these low cost hardware platforms that we have and try to reproduce maybe not reproduce but try to build new software for them that takes advantages of their capabilities and lets people take measurements maybe in ways that they hadn't thought of using tools other than high-end RF test equipment like spectrum analyzers and you can actually use an SDR platform as a spectrum analyzer you can think of SDR platforms and I often do as low-cost RF test

equipment effectively that's what it is we have low-cost uncalibrated signal analyzer and signal generator right here and we should be able to do a lot of the same things that people have historically used very high cost tools to do so looking a little bit closer at the the digital sweeping let's assume that we're digitally sweeping a something like a hack RF that means and that means we're tuning it to a certain frequency taking the measurement then tuning it to another frequency taking the measurement and so forth over time we tuned to different frequencies and each time in our time versus frequency plot which is what really kind of similar to what we're looking at in a

waterfall display we only get a finite sort of tangle of information and the horizontal width of that rectangle for the bandwidth of thereat rectangle is a function of the instantaneous bandwidth of the SDR platform and the instantaneous bandwidth is equal to its sample rate normally so in the case of a car app that that little rectangle is at a maximum 20 megahertz wide you get 20 megahertz window and which is about 10 times what you get with a real Tecton Bowl around a 2 megahertz window at maximum depending on your sample rate that your SDR platform supports that's what limits the width of that rectangle that window the width of that window now the height of that window is a function

of how long your may you remain tuned to that frequency and that's both of those things to some extent are your choice you but there's some maximum limit to how what your sample rate is or what your instantaneous bandwidth is and then there's some gap in time between when you stop measuring it one in one window and then you tuned in to the next window and that is that is the tuning time how long it takes you to reconfigure the radio for a new frequency if the tuning time is very long then we're missing a lot of information that we could otherwise gather if we were able to tune faster so tools like RTL power and aa

spoke Ozma comm spectrum sense are pretty neat and they let us get very wide bandwidth over a very long period of time but we may also be able to improve our ability to resolve or measure transient events if we're able to reduce that tuning time so we have the instantaneous bandwidth we have the capture time and we have the tuning time and those are the three things that affect like what percentage of this big grid is covered by measurement question oh good question yeah these things are so low-cost why not use a whole bunch of them that's a good idea and I think now I can't remember for sure but I think one or more of those

tools like RTL power my out of the box have some support for dealing with multiple dongles and even if they don't that's not hard to script right if you have different if you have like one device monitoring this 100 megahertz chunk and another device monitoring this under megahertz chunk you can do that you have a question oh sorry excellent point you could run into problems with calibration in that case like all of these things have little clocks in them and the and they all you can't really trust any clock ever right like you know the old thing about a man with two watches is never sure what time it is but the guy with one knows exactly what

time it is but and that's the case in all digital electronics like everything has a clock and some of them are closer to being right than others really hard to take measurements unless they're all synchronized in some way and that's that's one thing that hack RF can give you that Realtek dongles can't is there's a clock input and output so you can clock synchronize multiple devices but that's only part of the calibration problem there's also and then having having I should say that having synchronized clocks means that their frequency measurements will all agree with each other but or their frequency configurations will all agree with each other very very precisely but there's also the problem of their power

measurements the power calibrating the power level is something that is another problem that you probably have to actually go through some active step to calibrate your equipment and see like oh this one fix things up at this frequency 1d Bhide are hotter than this other device does and so you have to like come up with some measured calibration measurements and use that to normalize your data in some way so you have to deal with calibration of both both power levels and time time and frequency so those are excellent points and this is that's a good suggestion you can mitigate these problems a little bit by having some redundancy by like overlapping the windows from one device

with another device or even if you're using one device you might actually overlap the frequency windows instead of having one start exactly where the other one ends there's a lot of opportunity there there's also some opportunity for like massively parallel lysing this kind of thing right if you've seen the sat Knox project super awesome project that's working on on building low-cost satellite ground stations with open source hardware and low-cost SDR platforms and they're building a distributed network of these things around the globe but that project has the potential to grow into more than just satellite ground stations it's a distributed array of software-defined global distributed array of software-defined radios so in the long run it might be super cool to use the

SATA Nog's network to do like global spectrum monitoring or astronomical observations now the problems of calibration and clock synchronization and that sort of thing become greater but I would say that's a good problem to have if we have if we have massively parallel sources of data now one of the things I've been looking at lately is I know that I I can choose any capture time that I want and I know that I can choose any instantaneous bandwidth I want up to the limit of the hardware platform but what about the tuning time can I improve the tuning time for the most part that's kind of a fixed thing like if you're using your real tech

dongle you can't change that a whole lot but what if using an open-source hardware platform like hack RF and you could actually run code on the microcontroller instead of running code on the host computer and control and having to do USB transactions every time you want to change the frequency ah and if you want to know more about writing code for the microcontroller specifically for software defined radio definitely come to Jared's talk this afternoon because he's going to talk about all the code he wrote for the Porta pack which is running on the hack RF microcontroller and all the amazing digital signal processing he was able to do in a very constrained CPU but I've been

experimenting a little bit and I don't have any amazing results to show you but I can say that the tuning time that I'm getting like out of the box with hack RF without having really optimal time in anyway if I do it on the microcontroller instead of over USB I get a tuning time about a maximum tuning time worst case tuning time of about 750 microseconds which is considerably less that I can get over USB with some optimization so in my best case I think it's about a hundred and fifty microseconds so in certain frequency bands they really can tune super fast and reduce a lot of that transient time or sorry that time during which I can

miss transients and and if I can reduce that tuning time to a bare minimum then this this grid becomes more and more full of pink rectangles right we get we get a higher duty cycle a higher percentage of the available information is getting captured so this is something that I think we should be doing more of and it's something that I think would be good to work on for the Porta Pak to which sure it'll talk about this afternoon so I'm using the micro controller in the hack our app and there are other software defined radio platforms where we enabled we should be able to do this to any SDR platform where you have control of the tuning

from the from the device itself from the embedded device itself has a to control interface like USB generally speaking I think hacker have the lowest cost device at least it's the lowest cost transceiver that gives us that capability unfortunately the real tech dongles I don't think have a way to give us that capability although it'd be cool somebody figured out a way to hack that in but so to get you an idea of how much we can fill that grid with those rectangles the instantaneous bandwidth of hack RF one is about 20 megahertz so that means every rectangle is wider and and with an RTL SDR we can get about 2.5 megahertz the instant the hops per second with a

real tech dongle now I when I was trying RTL power and stuff I seem to only get I don't know maybe about 10 hops per second something like that but I've heard accounts that people with some tweaking of the software can get something or at like around 40 hots per second so that's 40 week tunings per second which is definitely useful but it's way way way less than we can get by running on a microcontroller and hacker so at 750 microseconds of tuning time I can very easily achieve upwards of a thousand hops per second and that means that we have much greater capability to make this observation if you think of this two-dimensional this this imaginary

perfect waterfall plot in the sky that has a frequency on one axis and time on another axis and you think how much of that big plot are we really measuring well by tuning much much faster we should be able to fill that in and measure a lot more and come visit me at grey sky guidance comm if you're interested in this stuff I definitely recommend checking out the SDR video series that I've been working on it was it's an outgrowth of the the in-person training that I wrecked my voice doing the last four days and and it's getting on adding more videos from time to time so if this stuff intrigues you and you are

new to SDR I hope you'll check out the the software-defined radio video series there are there any other questions or comments we had some really good ones so far

ah yeah the question is uh if we eliminate USB from the tuning time what is the limiting factor why does it take any time at all to tune and and yes it is primarily the the PLL lock time of the frequency synthesizer that is producing the signal now it's on the case of the hack our app is complicated by the fact that we have a dual conversion architecture and so we have two different mixers to tune in some cases we might be able to just not tune one of them leave it's fixed and only tune the other one and save a whole lot of time so there's the time that it takes for it to come in the lock and

then there's also the time that takes to configure it we have some kind of a serial interface between the microcontroller and the synthesis the synthesizer chip and we have to take some finite amount of time to actually give it a command just like it takes a finite finite amount of time to give a command over USB but it's much less than the time it takes to give a command over USB so those are the kinds of the two limiting factors is the serial interfaces to control those synthesizers and the lock time that it takes for them to walk into a new frequency other questions yes

multiple antenna like batter does it not make a big difference to have just a single antenna as opposed to multiple antennas I would say it really depends a lot on the very particulars of your gear application there are some antennas that antenna designs that are very wideband like like that measurement that I took in a hotel room I would have been much better off using a disc own then I would using a telescopic antenna but the difference is that dis cone doesn't fit in my backpack so that's not what I had at the time there are horn antennas and various designs that are that are specifically designed to give you a good response over very wide frequency range and but

generally speaking any into any antenna only has good performance over a limited frequency range and you know every intent is different so if you can kind of have a set of antennas that are all used effective like if you're doing the array kind of stuff array of multiple receivers and each one has its own antenna that's better for that particular frequency band you might get much better performance also things to consider like the polarization of the signal is it horizontally vertically circularly polarised where what direction is the signal coming from oh there are all kinds of measurements we can make beyond just the stuff that I've been talking about if we want to monitor spectrum on a large scale and observe

how it's used like it might be nice to know where the signals are in addition to what they are as detected from a given point so all those things can be accomplished theoretically with multi antenna techniques either by switching between antennas one at a time or by using antennas many antennas simultaneously one more Oh a little program called heat map to create those images out of the RTL power output okay two more I have not done that question is oh and thank you for loaning me your real tech dongle the question is have I like tried to characterize the the output that I get from RTL power by like putting a dummy load on a device maybe throwing in a

Faraday cage or something like that and taking measurements so I get some sort of a baseline of what this device gives me even without any radio signals present I haven't done that personally it's a good idea to do that and that ties in with some of our comments earlier about calibration that that could be an excellent way I think that if you play with RTL power a little bit or osmocon spectrum sends or gr phosphor or some of these tools that I talked about today I think you'll find that you're able to explore stuff that you weren't able to explore before and I encourage you to start playing around see what you can see because before you

get too hung up on like calibration and is my measurement perfect it's so cool just to have the ability to visualize these things and make observations one and one of my goals like in making hack RF for example is to give people unto uncalibrated test equipment because yeah you can go through the effort and calibrate it later but you shouldn't have to pay for all that calibration now you should be more accessible for people to start exploring and and look around and see what you can find around you I hope you have a good time with it thanks very much [Applause] you