SIGINT 101

The Invisible Spectrum

Right now, hundreds of devices around you are broadcasting radio signals you can't see, hear, or feel. Your neighbor's garage door. Every car in the parking lot. The weather station on someone's roof. The tire pressure sensors on every vehicle driving by. All of them are talking -- and with the right tools, you can listen.

692
Known Protocols
15
Device Categories
14
Frequency Bands
$25
Cost to Start

The Basics

What is Sub-GHz?

WiFi Mothership maps the spectrum above 2.4 GHz -- your WiFi routers, Bluetooth devices, and cell towers. But there's an entire world below that: the Sub-GHz band (300 MHz - 928 MHz).

Sub-GHz signals travel farther than WiFi, penetrate walls better, and use less power. That's why your garage door opener works from 50 feet away through a wall, but your WiFi drops when you walk to the kitchen.

These devices operate on ISM bands (Industrial, Scientific, Medical) -- unlicensed frequencies anyone can use. The trade-off: because they're unlicensed, most devices use simple protocols with minimal or no encryption. That means you can receive and decode them with cheap hardware.

THE SPECTRUM AT A GLANCE

██ 88-137 MHz -- FM Radio, Aviation, Satellites
██ 150-162 MHz -- Pagers, Marine, Weather Radio
██ 315 MHz -- Car Keys, Garage Doors (US)
██ 433 MHz -- IoT, Weather, Remotes (Global)
██ 450-512 MHz -- Business Radio, P25, DMR
██ 868 MHz -- Z-Wave, LoRa, Meters (EU)
██ 915 MHz -- Smart Meters, LoRa (US)
██ 850-900 MHz -- Cellular Towers
██ 978-1090 MHz -- Aircraft ADS-B
██ 1575 MHz -- GPS
██ 2400+ MHz -- WiFi, BT, Cell (WiFi Mothership)

What We Can Identify

15 Categories of Invisible Devices

Our database contains 692 protocol signatures across 40+ device categories. Every device below is constantly broadcasting a radio signal with a unique timing pattern -- like a fingerprint. Here's what's out there.

Weather Stations
Outdoor temperature, humidity, rain gauges, wind speed, barometric pressure. Brands: Acurite, Oregon Scientific, LaCrosse, Ambient Weather, Bresser, Fine Offset, Nexus. Most transmit every 30-60 seconds with no encryption.
433 MHz / 868 MHz -- 51 protocols
Temperature + Humidity Sensors
Indoor/outdoor thermometers, pool sensors, soil moisture probes, fridge/freezer monitors, hygrometers. Brands: ThermoPro, Auriol, Rubicson, Eurochron, Kedsum, Baldr. Separate from weather stations -- simpler, single-purpose devices.
433 MHz / 868 MHz -- 72 protocols
Garage Door + Gate Openers
Fixed code (Princeton, Linear, NICE FLO, CAME) and rolling code (KeeLoq, Security+, CAME Atomo, Hormann BiSecur). Fixed codes can be captured and replayed. Rolling codes change every press but are identifiable by timing signature.
315 MHz (US) / 433 MHz (EU) / 868 MHz -- 43 protocols
Automotive Key Fobs
Car key fobs from every major manufacturer: Ford, Toyota, Kia, BMW, VW/Audi, Hyundai, Subaru, Suzuki, Porsche, Honda, Fiat, Mazda, Mitsubishi, PSA (Peugeot/Citroen). Each uses distinct modulation and rolling code schemes. FCC ID traceable.
315 MHz (US) / 433 MHz (EU) -- 78 protocols
Remote Controls
PT2262/PT2260/EV1527 generic remotes, HCS301 (Microchip), ceiling fan remotes, LED strip controllers, outlet switches, projection screen remotes, fog machine triggers. The most common OOK devices in the wild.
315 MHz / 433 MHz -- 29 protocols
Security Sensors + Alarms
PIR motion detectors, door/window contacts, glass break sensors, smoke detectors, panic buttons, key finders. Brands: Honeywell, Paradox (Magellan), SimpliSafe, Hollarm. Most home security systems transmit sensor status wirelessly -- often unencrypted.
315 MHz / 433 MHz / 868 MHz -- 22 protocols
Tire Pressure Monitors (TPMS)
Every car manufactured after 2007 (US) has TPMS sensors broadcasting tire pressure, temperature, and a unique sensor ID. Makes: Toyota, BMW, Ford, Hyundai, Schrader, Continental, Renault, Porsche, Nissan, Citroen. Signals are unencrypted and unique per vehicle.
315 MHz (US) / 433 MHz (EU) -- 28 protocols
Utility Meters (Smart Meters)
Electric, gas, water, and heat meters broadcasting consumption data wirelessly. Protocols: ERT (SCM/SCM+/IDM), Wireless M-Bus, Apator, Arad Dialog3G. Utility trucks drive by to read them, but so can you. 200+ known meter protocols -- the largest category in our database.
868 MHz (EU) / 915 MHz (US) -- 99 protocols
Doorbells
Wireless doorbells from Honeywell, generic 433 MHz chimes, and wired-bridge smart doorbells. Simple OOK protocols with fixed codes -- among the easiest signals to capture and replay.
315 MHz / 433 MHz -- 2 protocols
Smart Home + Automation
Z-Wave switches/sensors (868 EU / 908 US), blinds/shutter motors (Somfy, Dooya, Jarolift, Legrand), smart plugs, light dimmers, X10 home automation. LoRa/LoRaWAN IoT devices (Helium, TTN, Meshtastic). The connected home runs on radio.
315-915 MHz -- 5 protocols
BBQ + Kitchen Thermometers
Wireless meat thermometers, grill monitors, smoker temperature probes. Brands: ThermoPro TP08/TP12/TP20/TP28b/TP829b, Inkbird, Amazon Basics, Burnhard. Transmit temperature readings every few seconds.
433 MHz / 868 MHz -- 4 protocols
Smoke Detectors + Safety
Wireless smoke alarms, CO detectors, water leak sensors. Many interconnected smoke detector systems use 433/915 MHz to trigger all units when one detects smoke. Often unencrypted status broadcasts.
433 MHz / 868 MHz / 915 MHz -- 22 protocols
Rolling Code Systems (KeeLoq)
KeeLoq/HCS200/HCS300 hopping code used by 50+ manufacturers: BFT, Aprimatic, Dea Mio, Sommer, AN-Motors, Nice Smilo, Beninca, Stilmatic, CAME Space, Hormann EcoStar, Novoferm. The most widely deployed rolling code in the world.
315 MHz / 433 MHz / 868 MHz -- 3 core + 50 manufacturer variants
Restaurant Pagers
Retekess T119, TD157, TD165, TD174 -- the buzzing pagers that restaurants give you when your table is ready. Simple protocols on 433 MHz. Also: customer service call buttons (Handicap assist, staff pagers).
433 MHz -- 2 protocols
Everything Else
Ceiling fans, LED light controllers, Govee light strands, fog machines, projection screens, cable/satellite boxes, vacuum cleaners, adjustable beds, fitness equipment (treadmills), training collars, pet finders, and things nobody has identified yet. If it's wireless and below 1 GHz, we probably have it.
315-915 MHz -- 89+ protocols

Beyond Sub-GHz

What Else Can You Receive?

An RTL-SDR dongle covers 24 MHz to 1.7 GHz. That means far more than just IoT devices -- you can track aircraft, decode ship positions, receive satellite images, and listen to first responders.

1090 MHz
ADS-B -- AIRCRAFT TRACKING
Every commercial aircraft broadcasts its position, altitude, speed, and callsign in real-time. With a $25 RTL-SDR and a simple antenna, you can track every plane within ~250 miles. This is how FlightRadar24 and FlightAware get their data -- from volunteers running receivers exactly like this.
162 MHz
AIS -- SHIP TRACKING
Every vessel over 300 tons broadcasts its position, heading, speed, name, and MMSI number via Automatic Identification System. If you live near a coast, river, or lake, you can see every ship in range. This is how MarineTraffic.com works.
137 MHz
NOAA / METEOR -- WEATHER SATELLITES
NOAA 15/18/19 and Russian Meteor M2 satellites pass overhead several times daily, broadcasting live weather imagery you can receive with a simple V-dipole antenna. You get real cloud cover photos of your region taken from space -- in real time, decoded on your computer.
150-160 MHz
POCSAG -- PAGER MESSAGES
Pagers are still used heavily by hospitals, fire departments, and emergency services. Most POCSAG messages are transmitted in plaintext -- completely unencrypted. With an RTL-SDR, you can read them in real time. This includes patient codes, dispatch alerts, and emergency notifications.
915 MHz
SMART METERS -- UTILITY MONITORING
Your electric, gas, and water meters broadcast usage data wirelessly using protocols like ERT (SCM/SCM+/IDM). Utility trucks drive by to read them, but you can too. Each meter has a unique ID and reports consumption in real-time. There are 200+ known meter protocols.
450-512 MHz
P25 / DMR -- FIRST RESPONDERS
Police, fire, and EMS communicate on trunked radio systems using P25 (digital) and DMR protocols. While many agencies have migrated to encrypted P25, a significant number still broadcast in the clear. Scanner enthusiasts have been listening to these bands for decades.

Reference

Complete RF Frequency Guide

Everything receivable with an RTL-SDR dongle (24 MHz - 1.7 GHz). All passive -- receive only, no transmitting.

FrequencyBand NameWhat You ReceiveAntenna (1/4 wave)
88-108 MHzFM BroadcastCommercial radio stations with RDS data~30 in
108-137 MHzAviationAir traffic control, pilot voice, ATIS~24 in
129-136 MHzACARSAircraft text messages (gate, fuel, weather, delays)~23 in
137 MHzWeather SatellitesNOAA APT + Meteor M2 LRPT images from space~22 in
150-160 MHzPagersPOCSAG/FLEX -- hospitals, fire, EMS (plaintext)~18 in
162 MHzMarine + WeatherAIS ship tracking + NOAA weather radio + EAS alerts~18 in
315 MHzISM (US)Car keyfobs, garage doors, TPMS, security sensors~9 in
433 MHzISM (Global)Weather stations, IoT, doorbells, remotes, keyfobs~7 in
450-512 MHzUHF / TrunkedP25, DMR, business radio, FRS/GMRS walkie-talkies~6 in
850-900 MHzCellularCell tower mapping + coverage analysis~3.5 in
868 MHzISM (EU)Z-Wave, LoRa, smart meters, security (Europe)~3.4 in
915 MHzISM (US)Smart meters (AMR/AMI), LoRa, Z-Wave, Meshtastic~3.2 in
978 MHzADS-B UATAircraft below 18,000ft (US), FIS-B weather, TIS-B traffic~3 in
1090 MHzADS-B ESAircraft position, altitude, callsign, speed (worldwide)~2.7 in
1575 MHzGPS L1Navigation signals, spoofing/jamming detection~1.9 in

Get Started

What You Need

FOR SUB-GHZ DEVICE IDENTIFICATION

Flipper Zero (~$170) -- Captures .sub files you can analyze on our RF Spectrum page

OR

ESP32 + CC1101 module (~$15) -- Same frequencies, DIY approach

OR

RTL-SDR + rtl_433 (~$25) -- Passive receive, auto-decodes 280+ devices

FOR WIFI / BLUETOOTH / CELL WARDRIVING

Android phone + WiGLE app (free) -- Walk or drive, auto-logs every network

OR

Kismet + WiFi adapter -- More powerful, passive monitor mode

Upload your data to WiFi Mothership and earn points on the leaderboard

FOR AIRCRAFT / SHIP / SATELLITE

RTL-SDR Blog V4 (~$35) -- Best bang for buck SDR dongle

Software: dump1090 (aircraft), AIS-catcher (ships), WXtoImg (satellites), SDR++ or GQRX (general)

Antenna: Quarter-wave whip for the band you want. Lengths in the table above.

Explore

WiFi Mothership Tools

RF Spectrum Analyzer Network Map Upload Data Device Intelligence Stats Leaderboard