Reading Codes Out of the Air: Software Defined Radio for Beginners

Quick answer: An RTL-SDR dongle costs about thirty dollars, receives roughly 500 kHz to 1.7 GHz, and cannot transmit. With it you can decode aircraft position reports, ship AIS, your neighbourhood's weather stations, and the tyre pressure sensors in your own car, all of which are broadcasting unencrypted. In the US, receiving is broadly lawful but not universally: cellular, encrypted public safety, and common-carrier paging are off the table, and divulging what you hear is a separate offence from hearing it. Also: the NOAA weather satellites every beginner tutorial starts with were switched off in August 2025.

The premise of this hobby is older than the hardware. Signals are passing through the room you are sitting in, most of them structured, many of them documented, and a surprising number of them unencrypted. The only thing that ever stopped you reading them was the cost of a receiver.

Then somebody noticed that a cheap European digital TV dongle, built around the Realtek RTL2832U, could be told to dump raw I/Q samples instead of decoding television. A chip designed to be a single-purpose appliance turned out to be a general-purpose radio, and it cost about as much as a pizza. That is a very 2600 story, and it is the reason this article exists.

The thing tutorials will not tell you: 137 MHz is dead

Start here, because if you follow almost any guide published before late 2025 you will build an antenna, point it at the sky, and hear nothing.

The NOAA polar-orbiting satellites transmitted weather images in an analogue mode called APT on frequencies around 137 MHz. They were the canonical first project: cheap, loud, and genuinely magical, because a picture of the clouds over your own house assembled itself line by line as the satellite passed.

They are gone. NOAA reclassified their output as "data of opportunity" in June 2025, which caused a wave of articles saying transmissions would continue for hobbyists. Then, over the following weeks, the satellites were actually passivated: NOAA-19 on 13 August 2025, NOAA-15 on 19 August. Conflating those two events is the single most common error in current writing about this hobby. The transmitters are off.

Worth a moment of respect: NOAA-15 launched on 13 May 1998 with a two-year design life. It ran for twenty-seven.

What replaced it is better in every way except charm. Meteor-M satellites carry LRPT, a digital mode, also near 137 MHz. The pictures are sharper. The trade is that APT failed gracefully, so a weak pass gave you a noisy but readable image, whereas LRPT uses Reed-Solomon error correction and simply discards frames it cannot fix. You get a clean image or you get nothing. If you see a signal on the waterfall and nothing decodes, the usual cause is the wrong symbol rate: decoders ship both 72k and 80k pipelines and the satellites do not all use the same one.

What you actually need

RTL-SDR Blog V4 dongle          ~$40    receive only, ~500 kHz - 1.7 GHz
Better antenna than the stock   ~$30    this matters more than the dongle
Total                           ~$70

Two honest notes on hardware. There is no V5 on the horizon; the V4 is the current generation and the recently introduced V4L is explicitly a one-year stopgap part. And if you are tempted by a HackRF, understand that it transmits, which moves you into licensed-operator territory and changes your legal position entirely. The Pro version is around $400 and has been shipping since January 2026. For everything in this article, you want the receive-only dongle.

The antenna is the limiting factor, not the radio. A half-wave dipole is two quarter-wave elements, and the length comes out of a simple formula: about 143 divided by the frequency in MHz gives metres, or 468 divided by MHz gives feet. The fudge factor in there, the velocity factor, is not a constant: it runs from about 0.98 for thin wire to 0.94 for thick elements, which is exactly why your calculated length and the length in somebody's build guide disagree by a centimetre.

The other thing nobody mentions is cable. At 750 MHz, thin RG-174 loses about 23.6 dB per hundred feet against 3.5 dB for LMR-400. That is roughly seven times the loss, and loss ahead of your amplifier is noise figure you can never get back. A short run of decent coax will outperform an expensive dongle on a long run of thin coax.

The legal line, which is not where people assume

This is US law, I am not a lawyer, and none of this is legal advice. But the shape of it is learnable and worth learning before you plug anything in.

The general principle is that listening is broadly permitted and specific classes are carved out. The carve-outs are what matter.

Cellular is off limits. So is anything encrypted, and note that decrypting is a separate act from receiving. Public-safety systems that are encrypted are not a grey area.

Pagers are more complicated than the internet claims. Federal law excludes "any communication made through a tone-only paging device" from the definition of an electronic communication, and people cite that as though it blesses pager decoding generally. It does not. The alphanumeric pagers people actually decode, POCSAG and FLEX, carry text, are electronic communications, and are typically carried by a common carrier. Communications carried on a common carrier system are specifically not treated as "readily accessible to the general public," and no carve-out covers them. Treat pager traffic as legally fraught, whatever a forum post says.

Receiving and repeating are different acts. There is a longstanding prohibition on divulging or publishing the contents of intercepted radio communications. You can be entirely lawful in hearing something and unlawful in posting it. This is the part hobbyists most often get wrong, and it is the reason a responsible write-up shows you decoded telemetry rather than someone's traffic.

Transmitting requires a licence. A receive-only dongle keeps you on the safe side of that line by construction, which is a good reason to start there.

State law adds a layer. Several states restrict scanners in vehicles. Check your own before you mount anything in a car.

What is worth listening to

Two details for the pedants, both of which will make you look like you know what you are doing. Aircraft Mode S is a 1 Mbit/s signal; the 2 MHz figure repeated everywhere is the sample rate decoders use, two samples per bit, because each bit is a 0.5 microsecond pulse in one half of a 1 microsecond window. And in the navigation band from 108 to 112 MHz, US practice distinguishes services by the first decimal digit: even hundreds of kHz are VOR, odd are ILS.

How far can you hear an aircraft? The radio horizon is about 1.41 times the square root of the height in feet, in statute miles. An aircraft at 35,000 feet gives 264 miles; add a receiver thirty feet up and you get about 271 statute miles. There is a lovely trap in that constant: the geometric horizon uses 1.23, and the radio horizon in nautical miles also works out to about 1.23, which is why aviation and amateur radio sources appear to contradict each other and do not.

Your car is broadcasting a unique ID right now

This is the part that turns a toy into an education.

Every car sold in the US since the 2008 model year has tyre pressure monitoring, because a federal safety standard requires the warning. That standard never mandated radio. But direct pressure measurement was the only method accurate enough to comply, and a sensor sealed inside a rotating wheel has no way to report except over the air. A safety regulation put a battery-powered radio transmitter in every wheel in the country.

Then Part 15 decided what kind of radio it could be. The rules for the 433 MHz band forbid transmitting at regular predetermined intervals under the general provision, and the provision that does allow periodic transmission caps each burst at one second and demands a silent period of at least thirty times the burst length. A protocol that must fit in a sub-second burst, repeated rarely, with a silence budget thirty times its own length, cannot do a cryptographic handshake. There is no room.

The silicon agrees. Many cheap devices in this band use a dedicated encoder chip whose entire frame is twenty-four bits and which has no data input pin at all: it is transmit-only by construction, so there is no handshake path and nowhere to put a key. Even a modern automotive sensor from 2024, built around a real microcontroller core, ships a datasheet with no mention of AES, encryption, or secure boot, and its only receiver is a 125 kHz wake-up circuit rather than a back-channel. Its published current draw tells you why: transmitting costs about 5.5 mA, listening on the wake-up receiver costs about 3.3 microamps. That is a factor of roughly 1,400. Instead of acknowledgements, it repeats the message up to fifteen times and hopes.

So the sensors broadcast a static identifier in the clear. The research is more nuanced than the headlines. Reading a tyre sensor at forty metres required a low-noise amplifier; with a plain antenna it was closer to ten. And the academics who tried to build a highway tracking system concluded it was not economical, because useful roadside range was about nine metres and covering a minute of traffic would need over a hundred receivers.

The genuinely uncomfortable finding is elsewhere. One decoder's documentation notes that a particular manufacturer's sensors transmit once after the car stops, and then every six hours thereafter, for months. A parked car keeps announcing a unique, unchanging identifier into an empty street, twice a day, all year. Not a tracking network. Just a stationary beacon on your driveway that you did not know was running.

No production sensor is known to rotate its ID. Every proposed fix, randomisation, encryption, authentication, is an academic paper, not a product.

Where this goes if you keep pulling

If you want the ceiling of "reading codes out of the air," it was demonstrated in 2025 by researchers at UC San Diego and the University of Maryland, and it won a distinguished paper award.

Their equipment was a one-metre satellite dish and a consumer TV tuner card. About eight hundred dollars. Pointed at geostationary satellites, they found 411 transponders across 39 satellites carrying traffic in the clear: cellular backhaul including calls, texts and encryption keys; government and military voice from ships; in-flight passenger wifi; corporate email and credentials; and industrial control traffic. One major carrier turned on encryption quickly once told.

Sit with the shape of that. Not an exploit, not a broken cipher. Operators assumed nobody was pointing a dish at the downlink, and for decades nobody with a disclosure process was.

It is also the clearest possible illustration of where the line sits, and why the line is not about difficulty. Much of what that dish received is common-carrier traffic, which the law specifically says is not readily accessible to the general public. The researchers had institutional review and a disclosure process. The gap between "technically receivable" and "lawful for you to receive" is the entire subject, and it is wider at the top end than at the bottom. Decoding your own tyre sensors is a weekend. Pointing a dish at a telecom backhaul is a felony with a research exemption you do not have.

Start here, in this order

1. ADS-B. Plug in, run a decoder, watch aircraft appear on a map of your own area within ten minutes. Feed your data to an aggregator if you like; one of them gives feeders a free enterprise account.
2. rtl_433 pointed at your own house. This is the one that changes how you see things. It decodes hundreds of device protocols, and the numbers are worth stating precisely: the current development tree carries roughly 384 decoders, of which about 335 are enabled by default, while the last tagged release from December 2025 shipped around 290. Run it and watch your neighbourhood's weather stations, doorbells, and tyre sensors scroll past.
3. Utility meters, if you are curious. rtl_433 decodes several meter protocols natively; a specialist tool goes deeper on the American ERT standard. Read your own.
4. Satellites. Meteor LRPT for weather, ISS slow-scan TV when they run an event. The space station's 2025 World Space Week event produced nearly nine thousand received images from more than 3,600 people.

Then read the FCC rules for the band you are sitting in. The reason 900 MHz devices chatter constantly while 433 MHz devices stay quiet is that they are governed by different rules: one is capped by field strength alone with no duty cycle, the other by that one-second-and-thirty-times-silence budget. Once you see that, the spectrum stops being noise and starts being a set of design decisions, each with a regulation behind it and a reason it turned out that way.

That is the actual hobby. Not eavesdropping. Reading the infrastructure.

If this is your sort of thing, two neighbours on this site scratch the same itch. How the six-digit code in your authenticator is generated is the same exercise applied to twenty bytes of hash instead of a radio band, and the craft of character art is what happens when the channel is a grid of glyphs. Both are about reading a protocol instead of trusting it.

A word on gear, since people ask. A receive-only RTL-SDR dongle and a telescopic dipole antenna kit are the whole starter kit. Buy the antenna kit rather than relying on whatever whip ships in the box; as noted above, it is the part that decides what you can hear.

Frequently Asked Questions

Is it legal to listen with an SDR?

In the US, receiving is broadly lawful with specific exclusions. Cellular, encrypted traffic, and common-carrier paging are off limits, and decrypting is a separate offence from receiving. Divulging or publishing what you intercept is also treated separately from listening to it, so a lawful reception can become an unlawful disclosure. Several states additionally restrict scanners in vehicles. A receive-only dongle keeps you clear of transmitting rules, which require a licence.

Why can I not receive NOAA weather satellites any more?

Because they were switched off. NOAA-19 was passivated on 13 August 2025 and NOAA-15 on 19 August 2025, ending analogue APT transmissions. Guides published before then are stale, including some that are still the top search results. Meteor-M satellites carry digital LRPT near the same frequencies and are the current target.

What can an RTL-SDR actually decode?

Aircraft ADS-B at 1090 MHz, ship AIS, AM airband voice, hundreds of home sensor protocols on 433 and 915 MHz including weather stations and tyre pressure monitors, utility meters, weather satellite imagery, and slow-scan television from the space station. It receives roughly 500 kHz to 1.7 GHz and cannot transmit.

Can someone track my car through its tyre sensors?

In principle each sensor broadcasts a static identifier in the clear, and researchers have read them at up to about forty metres with an amplifier. Building a road-network tracking system out of that was found to be uneconomical, needing over a hundred receivers to cover a minute of highway. The more realistic concern is a fixed location: some sensors keep transmitting every six hours for months after a car is parked.