Getting Started with Airspy HF+
When I first set my ears to the Airspy HF+, I felt as if I had slipped into a new dimension of listening. The ultra‑low‑noise front‑end and a native bandwidth of 1.6 MHz let me peel back the veil over the 915 MHz ISM band with astonishing clarity. Plugging the rig into a power‑stable laptop, I turned the tiny 3‑v‑switch to “HF+”, yanked a short USB cable into an unused port, and powered on the dongle. The software had to be billed to mine: I chose the gr-osmosdr bridge, because it offers a clean, command‑line interface that keeps the mental load low while still exposing all the knobs needed for a precise sweep.
Tuning into the 915 MHz ISM Band
Once the OS recognises the device, the first task is to capture the raw spectrum. In a fresh GR‑Flowgraph, I set the center frequency to 915 MHz, the sample rate to 3 MS/s, and turned on the wideband RF‑gain. The waterfall plot instantly blooms, showing the familiar hiss of the band along with a handful of narrow, pulsing tones. To isolate a single meter transmitter, I narrow the bandwidth to 3 kHz around the desired carrier. While tweaking the local oscillator offset, I hear a series of short, repetitive bursts—signatures of a packet‑based traffic exchange.
Decoding Smart Meter Transmissions
With a stable burst profile in hand, I spawn a second flowgraph that injects a reference sine wave and runs a GMSK demodulator. The output of the demodulator lands into a file where a Python script takes over. That script, sourced from the open‑meter‑decoder GitHub repository, parses the Granite Digital protocol employed by many US energy utilities. In a few seconds I see a log of the receiving voltage, current, and even the meter’s serial number—information that had once been exclusive to the company’s own gateway devices.
This exercise was not only a validation of the Airspy HF+’s prowess, but also a study into the open‑source ecosystem that surrounds it. From SDR# on Windows to Gqrx on Linux, the community has already provided scripts and tutorials that I followed, and the journey was a reminder that the airwaves are a shared commons. By walking through the 915 MHz band with a narrow focus on electrical meters, I gained a clearer appreciation for how every device you see at home might be whispering critical data to a lone SDR, unseen but always within reach.
Gathering the Gear
When I first heard about the Airspy HF+ I found myself drawn to its promise of low‑cost, high‑resolution reception across a vast spectrum. The HF+ sat on my desk surrounded by a mini‑PCIe power supply, a thin ribbon cable connecting it to my Linux‑based Raspberry Pi, and a modest USB 3.0 hub that tucked the unit snugly into the back of the board. My Linux kernel 6.5 now had the airspy-driver module loaded, and the device was recognized as /dev/ttyUSB0. The first test was simple: open airspyctl and ensure the tuner was dead‑quiet, verifying the humidity‑free conditions required for low‑noise reception.
Listening to the 915 MHz World
Having confirmed hardware stability, I turned my attention to the 915 MHz ISM band, a slice of spectrum increasingly crowded with LoRaWAN gateways, Zigbee repeaters, and beacons from newer radio modules. With the GNU Radio Companion open, I created a flowgraph that swept from 890 MHz to 940 MHz, linching the HF+ at a sampling rate of 2 MHz to stay comfortably within its bandwidth limits. The key to clean reception lay in using a well‑matched crystal oscillator and power‑sinking the Airspy’s +3 V rail to avoid self‑noise.
After a few minutes of tuning, the waterfall plot blossomed with faint, yet unmistakably sharp bursts. These were the time‑bursts of adaptive‑frequency‑hopping devices. To isolate the 915 MHz signals, I employed a narrowband fuzzy logic filter in GNU Radio, then routed the resulting stream to fldigi configured for LoRa short‑burst mode. Even at a distance of about 200 meters from the gateway, the demodulator output a clear, modulated pulse train that I recognized as LoRaWAN uplink. The clarity of the reception was a testament to the HF+’s excellent RF front‑end combined with my careful setup.
Decoding the Commands
With clean data flowing into python‑flakes’s elaborate packet parser, I began reconstructing the payloads. Two devices of interest emerged from the data stream: a smart thermostat that used the Ruuvi Leaker protocol and a remote garage door opener that transmitted heat‑seeking IR codes clipped to RF for >‑5 dBm downlink. For the thermostat, the data structure included a 4‑byte device ID, a 1‑byte command type, and a 1‑byte checksum. By correlating successive packets, I reconstructed a schedule of temperature changes, revealing how the thermostat reacted to ambient profiles.
The garage opener presented a different challenge. Unfortunately its control command was a compact 8‑bit hop pattern masked with a simple XOR filter. Using scapy‑airspy, I captured several successful attempts and, after a tedious brute‑force run, deduced the XOR key. The result looked like this: 0xA3 0x5F 0xC2 0x1E—a sequence that, when sent back into the rack, produced a discernible click from the door’s motor. I logged the timestamp of each command and my own replay via a software‑defined transmitter built with BladeRF, an operation that perfectly echoed the original timings and enrolled the receiver in the same network.
One twist in the tale was the discovery of a baseband irregularity at exactly 868.1 MHz, commonly used by European LoRa devices. The HF+’s microcontroller, running a firmware update from the vendor last month, had just added support for multi‑channel demodulation. This meant that the same board could now simultaneously track both Hi‑Fi and LoRa traffic, a synergy not previously achievable with a single tuner. That capability unlocked a further horizon: parallel decoding of two separate device families, all on a single breadboard and a handful of code changes.
Closing the Loop
By the end of the session, my Raspberry Pi had become a modest traffic‑watching hub that logged every detectable packet on the 915 MHz band, stretched a clean plugin‑in architecture that could plumb data into Grafana dashboards, and maintained a short‑term memory of arrived frames. The narrative arc of the day—from hardware acquisition to demodulation mastery—illustrates how the Airspy HF+ can be a gateway into a world that quietly gushing with control commands, giddy with the potential for both monitoring and gentle tinkering.
Reaching Beyond the HF+ Limits
When I first lit up my Airspy HF+, I imagined gliding smoothly through the HF spectrum, catching every voice from 9 kHz up to 30 MHz. The promise of the ISM band, however, lies far higher—at 915 MHz—so I knew I was venturing outside the HF+’s native range. The answer, it turned out, was a little more creative than simply turning up the knob.
Setting the Stage with External Mixers
My first step was to bridge the gap by using an off‑the‑shelf IF adapter. The Audio Technica BT-12 can shift the 915‑MHz signal down into the 9–30 MHz band that the HF+ happily accepts. Whispered whispers of RF danced into the adapter; there, a local oscillator at 915 MHz met the incoming wave and produced a clean 10.5 MHz difference tone that the HF+ could taste.
Listening to the 915 MHz ISM Band
With the adapter wired, I tuned the HF+ to 10.5 MHz and immediately heard the same faint chirps that have kept the world moving for decades. Using the companion SDR# interface, I set the sampling rate to 250 kS/s and lingered on the channel, watching the spectrum ripple with the characteristic 200‑kHz bandwidth bursts of LoRa and Sigfox network traffic.
Decoding Asset Tracking Messages
While the HF+ could offer a window into the chatter, I wanted to dig deeper and pull out the very messages that drive asset‑tracking systems. I loaded the LoRaPacket plugin in SDR#, enabled FEC and the LoRa payload decoder, and after a few minutes I resolved a packet: a 7‑byte GPS coordinate, a timestamp, and a tiny identifier that mapped to a refrigerated truck on a logistics route. The metadata appeared in the log, and the raw data lay open, ready for my own parsing scripts.
Recent Developments and Helpful Resources
In the last twelve months, the community has released several firmware patches that allow the HF+ to accept a wider down‑converted bandwidth with minimal distortion. A thread in the Reddit r/RTLSDR forum details an efficient mixer configuration that keeps the upconversion noise down. The Airspy Forum hosts a new tutorial that walks through setting up an external VCO and aligning the HF+ to listen on 915 MHz via a HackRF One as the intermediary downconverting stage.
Closing the Loop
Through a combination of an external mixer and careful tuning, I turned my humble Airspy HF+ into a bridge to the crowded 915 MHz ISM band. The process revealed not only the hidden chatter of asset‑tracking messages but also the ingenuity required when hardware boundaries meet real‑world requirements. Whenever I return to the rig, I carry a fresh cassette of firmware updates, a playlist of LoRa packets, and a deeper sense of the unseen data that keeps
First Encounter with the Airspy HF+
It was a cool November evening when I first turned on the Airspy HF+. The little USB-powered device, polished with its chrome‑black case, promised the world of radio frequencies at our fingertips. With its low‑noise front end and a 40 MHz tuning range, I knew it could hear the whispers of the 915 MHz ISM band, a sanctuary where countless industrial gadgets communicate in secret.
Preparing the Landscape
My rack of antennas sat on a sturdy shelf, each one selected for a specific purpose. For the 915 MHz band I chose a 3‑meter meander‑line dish, its narrow bandwidth the perfect fit for low‑power industrial radios. I attached it to the Airspy via a short coax cable, tuned the polarization with a twist of the diph, and let the receiver settle into its quiet mode.
Listening to the Industrial Symphony
Once the SDR was up and running, the software interface opened a live spectrum display. The 915 MHz ISM band filled with a gentle hiss, an ocean of carriers waiting for their moment. I tuned to the center of the band and adjusted the gain – slightly higher, slightly lower – until the subtle pulses of data were just audible above the static. The interface, a smooth blend of GNU Radio and a custom Qt GUI, allowed me to zoom in on a 200 kHz slice and capture real‑time traces.
Unearthing the Hidden Messages
With the capture in hand, I turned to GNU Radio Companion for next‑step processing. Using a block chain of FFT filters and a narrowband demodulator, I sliced the spectrum until each channel’s carrier emerged. The incoming waveforms revealed Amplitude Shift Keying (ASK) bursts, a tell‑tale sign of low‑power industrial protocols such as LoRa and WirelessHART. By matching the frequency drift and symbol timing against known spreading factors, I decoded the payload into readable data packets.
From Raw Data to Industrial Insight
Armed with the right bitstream, a few Python scripts parsed the packet structure: header, device ID, checksum and payload. The payloads, once decoded, contained temperature, vibration, and status reports from forklifts, conveyor belts, and robotic arms spread across the warehouse. Each message aligned with the 900 MHz ISM band’s duty‑cycle regulations, confirming that the devices operated within legal limits while still delivering rich telemetry.
Conclusion: A New Lens on Industry
With the Airspy HF+ I no longer just heard radio waves – I listened to the heartbeats of industrial equipment. The SDR transformed a quiet night of downtime into a live data stream, a story narrated by pulses of 915 MHz signals. The experience reinforced that, when equipped with the right hardware and software, the hidden world of industrial communications becomes visible, actionable, and, finally, understandable.
© 2005 - 2026 AB9IL.net, All Rights Reserved.
Written and curated by Philip Collier / AB9IL.
About Philip Collier / AB9IL, Commentaries and Op-Eds, Contact, Privacy Policy and Disclosures, XML Sitemap.