Tracking Aircraft with an RTL-SDR: ADS-B on 1090 MHz

Of all the signals you can pull out of the air with a cheap dongle, ADS-B is the one that turns a spare RTL-SDR into something people who do not care about radio still find impressive. Point an antenna at the sky and within seconds you have a live map of every aircraft for a hundred miles, each one reporting its own position, altitude, heading, and callsign. Unlike most of what I write up here, there is nothing adversarial about it. The aircraft are broadcasting this on purpose, in the clear, because the air traffic system depends on them doing so. This is the cleanest first "real" SDR project after the RTL-SDR beginner's guide, and it is worth understanding rather than just running.

What ADS-B actually is

ADS-B stands for Automatic Dependent Surveillance-Broadcast. Modern aircraft determine their own position from GNSS and then broadcast it, along with identity and velocity, roughly once a second. It rides on the 1090 MHz Mode S transponder as an Extended Squitter, which is a 112-bit message. The relevant downlink format is DF17 (DF18 for non-transponder emitters), and inside each message a type code says what it carries: aircraft identification and callsign, an airborne position, or a velocity report.

The one part that trips people up is the position encoding. ADS-B does not send raw latitude and longitude. It uses Compact Position Reporting, CPR, which encodes position in a way that saves bits but means a single message is ambiguous. To resolve a global position you need an even-format and an odd-format frame from the same aircraft within a few seconds, or a known reference position near the receiver to do a local decode. The decoder handles all of this; you just need to know that is why an aircraft sometimes appears a beat after it starts transmitting.

The receive chain

You can do this with any RTL-SDR, but 1090 MHz is high enough that the antenna and front-end matter more than they do down at 433. My setup:

  • RTL-SDR Blog V4 dongle. Any RTL2832U dongle works, but the V4's front end is a bit better up here.
  • A 1090 MHz tuned antenna. The RTL-SDR Blog multipurpose dipole set to roughly 69 mm per leg gets you started. A purpose-built 1090 collinear or a spider antenna up high does far better.
  • A 1090 MHz LNA with a SAW filter, mounted at the antenna. This is the single biggest upgrade. 1090 is a weak, distant signal and the band is crowded; a filtered low-noise amplifier at the antenna, before the coax loss, is the difference between fifty miles and two hundred.

[Photo: RTL-SDR Blog V4 connected through a green 1090 MHz LNA/filter to a collinear antenna clamped to a chimney, with a laptop showing the tar1090 map behind it]

Height beats everything else. ADS-B is line-of-sight, so the horizon is your hard limit and every metre of antenna elevation buys range. A mediocre antenna on the roof outperforms a good one in the loft.

The software

The decoder everyone starts with is dump1090. The original was Salvatore Sanfilippo's, and the actively maintained fork most people run now is readsb, which decodes the Mode S stream and serves a web map. Install it, point it at your dongle, and it does the demodulation, CPR decoding, and aircraft tracking for you. For a quick look without a browser you can run it interactively:

dump1090 --interactive

That gives you a live terminal table of ICAO addresses, callsigns, altitudes, and positions. For the map, readsb pairs with tar1090, which is the interface you have probably seen on other people's screens: aircraft as little labelled arrows creeping across a map with their trails behind them. The ICAO 24-bit address in each row is the permanent identifier for the airframe; you can look it up to see what type of aircraft it is.

Getting real range

Once it works, the fun becomes chasing range. In order of what pays off:

  1. Get the antenna high and outside. Every obstruction is a wall at these frequencies.
  2. Filter and amplify at the antenna. The LNA-with-SAW-filter above, mounted at the mast, not at the dongle.
  3. Use good coax and keep it short, because loss at 1090 MHz is brutal and it happens before any amplification you add indoors can help.

With a filtered LNA and a collinear on a chimney I see aircraft past two hundred nautical miles on a good day, limited by the curve of the earth rather than by sensitivity.

A note on the law, briefly

Unlike the pager or cellular signals I am careful about, ADS-B needs almost no caveat. It is an unencrypted broadcast that aircraft are required to transmit, intended to be received by anyone, and receiving it is legal essentially everywhere. Transmitting on the band is emphatically not, and 1090 MHz is a safety-of-life frequency, so this stays firmly receive-only. Beyond that, watch what flies over your house to your heart's content.

The decoders and a great deal of setup detail live at the readsb repository, and if you want to go deeper on the message format itself, The 1090 Megahertz Riddle is the clearest free reference on Mode S and ADS-B decoding I know of. Get a receiver running first, watch the map fill in, then go read how the bits actually work.

strcpy