Introduction

In past years Software Defined Radio got really poplair and devices got really affordable. The market is flooded with devices ranging from premium devices like Aaornia Spectran 6 to absolte bottom of the barrel devices such as RTL SDR which i bought in an upwelling.

I wanted to know if a COAX cable from a local ISP was connected to the neighbourhood cabinet, and i thought my RTL SDR would be great to look if the ISP was sending data over the COAX cable.

I installed the popular SDR++ but quickly came to conclusion it has very narrow bandwitdth of just 2.6 Mhz. But i wanted to check the complete spectrum from 1Mhz up tp 1.7 GHz. I concluded that i was under the naive impression i could use it as Spectrum Analyzer out of the box. I simply never heard of instationous bandwidth or PPL settling time before i started this project.

In order to know if needed a to make my RTL SDR a device that van sweep the whole specturm. Finally it led me to write my own Radikant-SA-C.

Bandwidth 

I thought i could solve the bandwitdth problem to just look at 2.6 Mhz at any moment in time and consecutively sweep the whole spectrum. I started to look for spectral analsysis software that supports the RTL SDR and found a few. Unfortunately all of them where difficult to get running or where only supported on other platforms than osx which i happen to use for my laptop. I tried running the windows Apps in a virtual machine using Parralels but i couldnt get the USB drivers for the RTL SDR to work trough the virtual machine after many attempts. 

Contituents

After spending about a day trying to get other solution to work i was so fed up with it i wanted a small simple clean solution that builds easily across my different OSX development machines. So i started to question what i would need to be able to get spectral analsysis for the RTL SDR over the full bandwith with a sweep and i wanted an easy build prefferably from c with no heavy dependencies.

Since the RTL SDR just pushes the amplitude ADC values like an osciliscope i needed a way untangle the frequency content and remember from another project that Fast Fourier Transform (FFT) is the way do to do this. After researching i found there are interesting options worth exploring like Esprit, Wavelet, Goertzel & CZT algorithms.

Since i already wasted a lot of time trying existing solutions on windows and complex builds I opted for fftw3 for its easy of build, c compatablity, outstanding track record and just to limit the scope for now. Next i needed a driver for my RTL-SDR, by looking into the source code of various SDR programs like SDR++ i found librtlsdr which is a c driver. Finally i needed an easy GUI solution that just builds i settled on ImGui + SDL2 which im already aquainted.

Sweeping

One of the first problems i noticed on the RTL SDR in SDR++ is next to that the maximum instanious bandwidth is just 3.2 Mhz and there seems to be also a rolloff on either side of the tuning frequency.

Figure 1  3.2 Mhz Window

Figure 2  1.7 Mhz Window

The falloff is depended on the Gain setting, and at maximum gain the Fall-Off is 3-4 dB. In the screenshot i have drawn a green line on a 1.7 Mhz Window, on a 3.2 Mhz window the difference gets more pronounced. 

Figure 3  Sweeping Windows

The falloff is depended on the Gain setting, and at maximum gain the Fall-Off is 3-4 dB. In the screenshot i have drawn a green line on a 1.7 Mhz Window, on a 3.2 Mhz window the difference gets more pronounced. 

The concept is to split the sweep range into smaller 2 Mhz Windows W¹, W², W³, Wⁿ as shown in Figure 3 and disregard the rolloff data on the edges of the window. So i would want to sweep from 100-112 Mhz i need just 6 windows of 2 Mhz. Each window is where the Frequency data lives in PowerBins. A PowerBin is a window where the total

Figure 4: 1.7 Mhz Window

I/Q Sampling

In-phase (I), Quadrature (Q) 8-bit sameples that are collected containing magnitude and phase information and send over usb to computer for further proccesing. An antenna physically produces only one analog voltage at any moment in time there is no IQ, no complex number. Inside the SDR there is a local clock-generated signal:

* cos(ωt) → for I
* sin(ωt)  → for Q ( 90° shifted)

IQ is created inside the receiver, not the antenna. It is made by mixing (multiplying) the signal with two local oscillators.

Software Testing

Figure 5  Testing with 20 Mhz

I finished the software in C++ and could use the sweeper and now could analyze the full range of the specturm of the RTL SDR from 1Mhz all the way up to 1.7 Ghz! Connected a Keysight signal generator and generated a 20 Mhz sine signal to my RTL SDR and it worked! I could see a sharp peak at 20 Mhz.

The second peak visible to the right is from the RTL clock 28.8 Mhz clock that leaks into the reciever.  I’m currently also not entirely sure why the area around the peak has such a sharp drop below the noise floor. 

Figure 6  Testing with 860 Mhz

Next i wanted to use a higer frequency signal, however my Keysight signal generator cannot generate nearr Ghz or beyond signals. I looked around the workshop and found that the LibreVNA would be the best option to generate a high frequency signal. A nice results that proves my poor mans Signal Analyzer is able to detect strong frequencies. 

Field Testing

Figure 7  Field testing

I connected my RTL SDR to the Ziggo Coax cable inside the meter cabinet and started to hunt for signals. I’m aware Ziggo deploys 75 ohm COAX cables in their network and the input impedance of the RTL SDR is 50 ohm but even if there is a mismatch i’d still be able to recieve intentional signals.

Figure 8  Interresting Signals

I preforrmed a full frequency sweep from 1 Mhz to 1.7 Ghz and made notes on  some interresting intentional signals. I prefformed another narrower sweep of a few ranges with strong signals. These signals where not present when the COAX was disconnected so they where definitly being transmitted trough the COAX.

Conclusion

After inspecting all the measurements, I concluded the signals recieved where to weak to be intentionallly radiated ISP Upstream of Downstream traffic. When i connected a broadband antenna to my RTL SDR I had identical results at the same frequencies, which means the COAX was acting as an antenna and picking up stray signals.

Not the result I was hoping for but it ruled out the coax was connected. Now convinced the cable was unconnected. I used TDR (Time Domain Reflectrometry) techniques to determine why the cable was not connected and if it possibly was severed.

Since my poor mans spectrum analyzer was written in c++ i also wanted a c version of this spectrum analyzer which led to the development of Radikant-SA-C. I’m really happy with the results because i don’t own a instrument grade Spectrum Analyzer yet and this software and control of the source allows be to have some RF eyes in the workshop at very low cost with high versatility.