Prelude to the 915‑MHz Hunt
It began on a quiet Saturday afternoon when I found an older Airspy HF+ Discovery in a dusty drawer. The device, though compact, promised an entire spectrum of possibilities from shortwave transients to low‑frequency telemetry. I decided the 915 MHz ISM band would be a tempting first target. That band, a quiet neighborhood for many, is actually bustling with automotive sensors—especially the tire pressure monitors that glide over the ether in a rapid, secret dance of data packets.
Preparing the Discovery
I plugged the HF+ into a USB‑3.0 port on my laptop and powered it with the supplied USB–DC adapter. The software that arrived with the dongle was SDR#, a lightweight interface that quickly opened a window with a frequency range from 0 MHz to 30 MHz, each captured with a default sample rate of 4 MHz. To listen at 915 MHz, I moved the frequency selector one step beyond the menu’s upper limit. The dust‑free capacitors and the 10‑MHz IF stage of the receiver lowered the noise floor to about –120 dBm, perfect for hunting weak telemetry signals.
Zeroing in on 915 MHz
I set the center frequency to 915 MHz and chose a narrow bandwidth of 5 kHz to avoid clutter from neighboring channels. The software automatically locked the SDR to that view, revealing a quiet expanse. I switched to High‑Resolution RF Mode. In this mode the HF+ draws 12–bit samples at a maximum of 10 MHz, which I configured to 2 MHz to reduce data flow while still preserving the fine details that gracefully hide in the carrier sweeps.
The Tire Pressure Whisperers
Typical TPMS signals in North America broadcast at 915 MHz using a 12‑channel frequency‑hopping spread spectrum (FHSS). Each burst lasts roughly ten milliseconds before hopping to the next channel. It felt like listening to a pulsating heart behind the windshield. I tapped the “Waterfall” display in SDR# and watched the spectral peaks surge in a predictable pattern. I had to apply a band‑pass filter that accepted only 915 ± 5 MHz to silence the road noise from cellular and satellite calls.
Decoding the Packets
The HF+ itself does not translate the FHSS sequences into readable pressure values, but the odd eye‑shaped pulses were unmistakable. With a secondary script I exported the waveform traces into GNU Radio. There, the flowgraph implemented a Reed–Solomon decoder that matched the 915 MHz TPMS scheme. By feeding the real‑time data into the simulator I could see the status: “TIRE1: 32 psi, TIRE2: 31 psi, TIRE3: 33 psi, TIRE4: 32 psi.” Each packet’s checksum success bolstered the evidence that this small dongle was listening right into every tire’s pulse.
What We Learned
The experiment confirmed three key points. First, the Airspy HF+ Discovery’s 10‑MHz IF gives an elegantly clean window onto the 915‑MHz band when the software is tuned correctly. Second, the steady rise and fall of TPMS pulses can be captured with a 5 kHz bandwidth, an improvement over the
It was a clear night when I first slipped the Airspy HF+ Discovery into my front‑row window. The thin slider of the dongle, a jewel of a tiny device, pocked the air with possibilities—grounding myself back to the very idea of listening to the invisible world that hums above our trees and cities. By the time I connected the SDR to my laptop, the hum of the router seemed distant, replaced by the tension of anticipation.
Getting the Airspy Ready
Before the airwaves could reveal their secrets, the device needed a few essential calibrations. I started by installing the latest Airspy firmware and the companion SDR# software—both freely downloadable from the manufacturer’s site. Once the firmware update confirmed itself on the screen, the software’s razor‑sharp tuner slid effortlessly into the 2.4–1 GHz range v3.0, which mirrors the HF+ Discovery’s native bandwidth. I also made sure the sample rate was set to 6 MS/s—just enough to capture the 915 MHz ISM band in all its bustling detail.
Zeroing In on 915 MHz
In the SDR# spectrum display, I shaded a narrow slice of the ISM band: 915 MHz ± 2 MHz. I could see rustling between bright, thin lines; the iconic carriers that make up the ISM band’s busy traffic. Every tick on the tuner refreshed by the pilot tone of an electronic weather buoy, and I could track its pulse through the night. To enhance clarity, I activated the software’s Amp Gain setting to 30 dB, letting the faint chatter climb above the limits of my headphones.
Refining the View for Weather Sensors
Weather sensors on the 915 MHz band generally employ the LoRa modulation scheme, which places its packet bursts at low data rates yet generous byte foot‑prints. Over the course of the night, I tuned the SDR to look for the signature LoRa preamble—an unmistakable sequence of long, short, long waveform taps. Each burst revealed itself as a dramatic spike on the spectrum view; the LoRa chirp drew a line that spread from 915 MHz into the neighboring channels, teasing my curiosity.
Decoding the Signals
With the packets identified, my next step was to let the SDR do more than just plot them. Using an open‑source tool called LoRa Gateway Item (LGI) I fed the SDR data stream. LGI parsed inside each LoRa packet, stripping the headers and exposing the raw payload. It turned out that a number of the air‑buoys I was listening to were reporting temperature, humidity, barometric pressure, and wind speed—conveyed in a simple 4‑byte format. Each value blossomed onto my screen as a warm, crisp line on a secondary graph window.
Real‑World Discovery
While most months the air was still, this particular evening the temperature fell to a crisp 3 °C, while pressure steadied at 1012 mb. My ears caught the subtle, high‑frequency whistle that served as the air‑conveyance’s heartbeat. In a few minutes, I heard a burst of data from a weather station at the top of the old lighthouse, and then another from a buoy perched on a forgotten pier. The reveal was swift: a 915 MHz weather station does not merely ping; it sings—a symphony of numbers rendered into a visual mashup of frequency vs. time.
Making It Routine
To keep my own listening ritual simple:
Cycle the Band: Every ten minutes I shifted the scanning window by 20 MHz, covering the entire ISM band for a more inclusive sweep.
Store the Streams: I layered the SDR recordings into small files, each tagged by timestamp and channel. That allowed me to revisit an evening’s data through a single click.
Valley of Vintage Receivers: Occasionally, I swapped the HF+ Discovery for its predecessor, the HF Discovery, just to relish how a finer tuning knob and a slower sample rate could coax different parts of the world into view.
As the night narrowed to a velvety hush, the airlight of the weather sensors still pulsed steadily. The HF+ Discovery had allowed me to draw a narrative out of electromagnetic whispers, to map the invisible highways of the 915 MHz range, and to gift me with real‑time weather intelligence—all from a compact, USB‑pluggable wonder. The work was done. My headphones turned quieter, yet the glow of the ISP spectrum on my monitor never faded entirely. The saga of radio, always still unfolding, had just traded a new chapter for me to record and remember.
The Turn of Airspy’s Lens
Alex sat cross‑legged on the warehouse floor, rain drumming against the metal roof. The city’s grid hummed below, invisible pulses traveling through copper and fiber. Tonight, Alex’s curiosity had a new target: the 915 MHz ISM band, the quiet frequency where smart electricity meters whisper their secrets. The tool of choice was the Airspy HF+ Discovery—an SDR that normally roams the HF world—but wielded here with an external 915 MHz front end that would lift the signal into the Discovery’s view.
Bringing a UHF Frequency into HF Harm
To coax a 915 MHz signal into the HF+ Discovery, Alex attached a miniature direct‑sampling SDR board that shifts the band down by a local oscillator. The board, an inexpensive 915 MHz quadrature down‑converter, is connected to the HF+ via the Discovery’s BNC or SMA feed. Once wired, a few quick calibrations in SDR#—setting the gain to medium, applying a 4 MHz band‑pass filter and lock‑ing to a reference oscillator—provided a clean window into the hiss of the ISM band.
Listening to the Smart Meters’ Whisper
Most digital meters use a narrowband amateur‑style protocol, transmitting at 915 MHz with a single‑sideband or Gaussian frequency shift keying (GFSK). Alex first tuned the SDR to a typical metering channel, watching the waterfall in real time. The sudden, periodic spike of power‑line data was unmistakable, the brief ~10 kHz bursts that punctuated every few seconds. When the waterfall stuttered, the silent parts of a smart meter’s cycle emerged, allowing Alex to isolate the actual data symbols within the noise.
Decoding the Measured Pulse
Once a clear burst was captured, Alex moved on to demodulation. Using the open‑source pdtdemod library, the SDR’s raw IQ files were fed into a custom decoder that looked for the standard 8‑bit FSK pattern used by most North American utilities. The decoder counted the carrier shifts, reconstructed each byte, and
Gathering the Gear and Launching the Expedition
When the new Airspy HF+ Discovery arrived, I set it on my desk alongside the compact USB‑C cable, a portable antennasupport kit, and a freshly charged laptop. The first morning, the room smelled faintly of solder and optimism—a perfect canvas to explore the 915 MHz ISM band, a playground where drones, smart lights, and unmanned vehicles communicate invisible pulses of power.
Setting the Stage: From Model to Reality
After packing the HF+ into its protective pouch, I disconnected the laboratory‑grade rigged antenna and connected one of the supplied 5‑meter FM antennae. With the HF+ Discovery’s integrated RTL‑AD8307 tuner, I opened SDRangel and prepared the antenna port. I set the center frequency to 915 MHz and swept a 10 MHz bandwidth, watching the waterfall climb in real time as the packet streams started to ripple across the screen.
Diving Into the Signals: The Pulse of LoRa Devices
At 915 MHz, most traffic emerges from LoRa® modules—low‑power, long‑range radios used by beacons, RFID tags, and many Internet‑of‑Things gadgets. I tuned the platform to Fs = 4 MSa/s and the effective resolution bandwidth to roughly 50 kHz to capture the chirp-shaped bursts. Using the PulsePair plugin inside SDRangel, I was able to isolate individual packets and then decode them with the open‑source loraCodec toolkit. The software fed back the decoded frame contents: device IDs, command codes, and timestamps—exactly the format the remote controllers of small drones or the key fobs of autonomous car chargers send.
Decoding Control Commands: A Narrative of Numbers
Once I had a clear LoRa packet, I cross‑referenced the bytes with the manufacturer’s LoRa‑Command Reference Table from the device’s API. One packet contained 0xA5 0x01 0x3C 0xFF—an unmistakable "take‑off" command for the companion drone. The next burst transmitted 0xA5 0x02 0x3C 0x00, a land signal. The UI of SDRangel showed me a live ASCII representation; each character became a part of a story: watch the rotor blades spin, listen to the smooth „whoosh” of a drone soaring toward the horizon.
Fine‑Tuning the Machine: Calibration and Power Adjustment
To avoid interference and ensure the maximum dynamic range, I calibrated the HF+ Discovery’s built‑in received‐power meter. By projecting a 915 MHz signal from a spectrum analyzer and adjusting the internal “RF gain” via SDRangel’s “IF” tab, I found a sweet spot at -30 dB gain where the signal floated just above the noise floor. The device’s firmware, released in the latest update, introduced an automatic “squelch calibration” routine that locked the tuner’s noise floor automatically when a custom spectral mask was provided.
Exploring Beyond the Horizon: Other Devices in the 915 MHz Sky
While LoRa is the dominant voice, the spectrum shared its airwaves with opportunistic attempts by some older Zigbee‑like modules, and the occasional Sigfox uplink. Each had a distinct chirp signature—different bandwidths and preambles. By a combination of FFT analysis and manual packet parsing, I mapped out their footprints, telling stories of smart city traffic lights and precision agriculture sensors that combined for a bustling data ecosystem.
Conclusion: From Observation to Interaction
Equipped with the Airspy HF+ Discovery, a network of antennae, and meticulous software, I transitioned from passive observer to active decoder. The 915 MHz band, once a chaotic mesh of pulses, became a chronicle of command and control—drones taking flight, lights blinking, and machines listening to every silent word encoded into a narrowband whisper. The journey also highlighted the elegantly simple steps: tune, calibrate, capture, decode, and repeat, turning anonymous radio chatter into a compelling narrative of modern connectivity.
It started on a rainy Thursday afternoon in a cramped lab, the kind of place where the hum of cooling fans is the soundtrack to curiosity. I had just unpacked the Airspy HF+ Discovery and had a goal: to listen to the silent chatter of the 915‑MHz ISM band where thousands of security systems live out their nightly routines.
Preparing the Discovery for 915 MHz
I opened the Band Explorer on my laptop and set the central frequency to 915 MHz. The explorer’s spectrum display, with its soothing color gradients, painted the window with the classic bright white signal markers that buzz like tiny stars. I cross‑referenced the latest firmware notes from the HF+ website, confirming that Version 2.0.4 adds support for a more precise low‑pass filter, a boon for isolating the 915 MHz band.
Next, I tweaked the Low‑Power mode to reduce the thermal drift of the front‑end, then validated the gain ladder. The result was a stable, low‑noise view that let me see the faint 2.4‑MHz chirps typical of Zigbee modules, as well as the higher‑power bursts from Pro‑plus cyber security sensors.
Capturing Security Device “Heartbeat” Messages
With the HF+ finely tuned, I started SDR# as the capture host. I drew a narrow radio window around the exact 915‑MHz spur and set the frequency offset so the tuner’s internal one‑pulsed crystal recoil was accounted for. The software default “IP Movie” mode output looked like a rolling film of dots and lines, but I switched to raw packet capture and saved the stream to a file.
Later, I powered up a small Shelly 2.5 transmitter and a person‑sensing door alarm that both broadcast on 915 MHz, but not in the obvious wifi‑style protocols. They used a proprietary CSM‑361 protocol that could be decoded using Python‑SDR scripts. By feeding the .raw file into the newly released pydmr tool, the scripts identified the Carrier Sense Multiple Access bursts and extracted the status payloads. The results were delightfully simple: a stream of JSON {“device”: “door”, “status”: “closed”} messages that translated directly to my home‑automation dashboard.
Fine‑Tuning With Real‑Time Analytics
To refine my detection chain, I ran MATLAB’s RF Toolbox in parallel. A real‑time waterfall plot, accentuated by his crisp outlines, helped me identify overlapping signals from neighboring IoT nodes. Using the Fast Fourier Transform. filter, I nulled out the strong commercial LTE‑M preamble that occasionally hijacked the band, leaving a cleaner view of the security devices.
As I dove deeper into the field, I discovered that the majority of the status messages arrive in bursts every 30 seconds, almost echoing the internal cycle of the devices’ firmware. The Airspy’s high dynamic range made it possible to capture both the quiet half‑wave pulses that indicate motion and the louder, simultaneous acknowledgements dispatched by the sensors' local EM interfaces. Each message, once decoded, served as a stepping stone to an increasingly responsive smart‑security ecosystem.
Reflections on the HF+ and the 915 MHz World
After several hours of stitching together raw captures, frames, and JSON objects, I could see how the HF+ Discovery served as a tangible bridge between the invisible 915 MHz chatter and my living space. Whenever the door slams shut, a faint pulse becomes a clear text string on my dashboard. The security system’s heartbeats feel less like abstractions and more like rhythms in the air.
In the afternoon light, the HF+ settled into my desktop, its tiny digital eyes forever watching the silent storm above the ISM band. The story of that single, muted frequency—once a mystery of unmanaged electromagnetic noise—had evolved into a new chapter of connectivity that I could understand, manipulate, and, with a little effort, appreciate.
The First Glimpse of 915 MHz
When I first powered up the Airspy HF+ Discovery, the screen lit up with a familiar green glow. I was eager to explore the 915 MHz ISM band, a neighborhood of radio waves that other devices had traded for almost a decade. The band was a bustling avenue in the far‑field, and within it, quiet whispers from asset trackers whispered their secrets.
Preparing the Bridge to the 915 MHz World
After a quick dive into the SDR firmware, I tuned the front‑end to 915 MHz. The crystal‑controlled LO locked on, and the device’s DAC feed delivered a clean carrier to the FPGA. I set the sample rate to 2.4 MS/s, a sweet spot that gave me ample room for a 34 kHz-wide packet while still keeping the bit‑stream manageable.
Channelizing the Spectrum
The Airspy’s built‑in I/Q demodulator let me isolate a conventional narrowband channel. I arranged the waterfall display to drift across 890–920 MHz, watching the 915 MHz slice pop into view: a faint, steady carrier interrupted by aglow bursts that were clearly not background noise. With the dynamic range set just right, the subtle harmonics of an asset tracker’s UHF carrier revealed themselves in stark contrast.
Waiting for the Asset Tracking Signals
Asset tracking, or UHF asset tags, transmit packets at a staggering six minutes intervals on 915 MHz, each packet only 26 bits long. The Airspy’s complex samples allowed me to apply a 48 kHz Hann window filter, shaving off the 7 kHz sidelobes that could mask the little bursts. With a single channel, the SDR provided clarity enough to catch each burst as it crossed the spectrum.
Decoding the Whispered Data
Using the open‑source UHFarmNet software suite, I fed the SDR output straight into an LSDMA packet detector. In a blink, a new packet was flagged, and the program unfolded the 6-bit encoded serial number hidden within the payload. Each packet carried a timestamp the tag’s own clock generated, so I could reconstruct the tag’s journey across a 100‑meter radius. The Airspy proved not only for listening but also for timing, as its low‑jitter clock ensured accurate reception.
Observing the Congestion & the Quiet Spots
During a routine scan, the 915 MHz bandwidth turned into a host of narrow shades. Some patches of the band were buzzing with toll‑billing infrastructure, GPSR signals, and duty‑cycled telemetry. Yet other pockets remained almost silent, giving the lone asset tag a clearer voice. By sliding the tuner around quickly—thanks to the HF+ Discovery’s continuous frequency sweep—I could see where the signal-to-noise ratio peaked, allowing me to lock in on the quietest frequency lanes for the cleanest capture.
Lessons Learned and Tips for Fellow Explorers
To truly enjoy the 915 MHz band with an Airspy,
- Use a low‑noise, narrowband antenna tuned to 915 MHz; the HF+ Discovery thrives on a clear dipole.
- Set the sample rate to just double your expected bandwidth; it preserves bandwidth and keeps memory usage low.
- Enable the built‑in pre‑filter if your firmware supports it; this removes out‑of‑band interference.
In the end, a single table‑top setup brought you into the buzzing world of asset tracking, and the stories that the 915 MHz whispering carried—log entries, location alerts, and the faint pulse of an invisible badge—fed into a richer, more complete picture of the hidden radio landscape surrounding us.
Setting the Stage
In a sun‑lit warehouse that smells of fresh solder and buzzing green power supplies, I unwrapped the Airspy HF+ Discovery SDR. Its compact chassis glints beneath the fluorescent lights, and I feel a surge of anticipation knowing that this miniature radio can hear more frequencies than a full‑range radio board built at a factory for a year.
The goal is simple yet relentless: to pull a clear picture out of the 915 MHz ISM band, the home of long‑range LoRa, certain 5‑GTT and NB‑IoT test signals, and the growing chorus of industrial telemetry that ships between meters, gates and cranes. My instrument of choice, the Airspy, has already proven itself in hobbyist wars for FM rock, but I am about to apply it to the wired‑in whispers of industry.
Gathering Gear
I set up the SDR on a small workbench, connecting it to a powered USB hub because the discovery module only expects 5 V from a host. The antenna is a cheap yet capable L‑band active dipole that I rail up on a stack of coaxial cable. Better still, I splice in a 1 dBi patch built from a low‑loss SMA‑to‑BNC board, so the 915 MHz waves can slide into the cartridge without a loss in clarity.
On the computer, I launch CubicSDR because its intuitive interface lets me reach the exact middle of the 915 MHz band now and then zoom in to see the content‑transport shape of a data packet. The software’s waterfall color map displays the signal envelope with elegant gradients, while its oscilloscope window shows the rapid bursts of modulated symbols that are the lifeblood of LoRa or an NB‑IoT frame.
Listening to the 915 MHz Band
After a moment of patience, the SDR starts to hum. The 915 MHz band spreads out across the screen, a continuous line of blue that keeps a steady pulse outside the silent intermissions.I turn the band‑width slider modestly to 2 MHz, focusing on a narrow slice that still contains all the industrial chatter.
With the tuner locked to roughly 915.5 MHz, I watch the modulus of the incoming waveform grow and shrink as a portable sensor prints temperature data to the field. A gentle chirp sequence—the characteristic chirp spread spectrum of LoRa—runs steadily, and the software’s demodulator points a peak on that Doppler of the chaotic data.
Decoding the Data
To extract the content from the tangle of symbols, I turn to LoRaKit coupled with CubicSDR’s capture files. I save a series of 1‑second snippets, each a tiny snapshot of the ISM band. When I feed those files into LoRaKit’s decoded console, the garbled symbols turn into clean sentences, sometimes an armored “HEARTBEAT” from a PLC on the front‑end unit, sometimes a water‑level update for a high‑rise tower.
In a separate window, I run the GQRX plug‑in that captures raw IQ data. Using a custom Python script to run a Sigfox or 5G NR demo frame analyzer, I confirm that the burst that arrived at 915.342 MHz is indeed a NB‑IoT uplink packet, full of the keys and IVs that keep the messages trustworthy in an industrial environment.
What We Heard
When the rain drops outside the lab at 3 a.m., a low‑power sensor in the facility’s basement decides to vent its humidity reading into the 915 MHz band for all to hear. The SDR records a well‑timed pulse that looks like a packet, while the demodulator turns that pulse into a readable line: "Temp=27.6°C; HUM=45%".
Further under the pier on the third floor, the TLS‑antenna sends a GPRS test burst that slides under the LoRa traffic, at just a whisper over the noise floor. Even that faint echo shows itself on the waterfall: a pair of faint spikes in the 915.85 MHz mark that, when decoded, reveal a small packet of safety data—an emergency shutdown command that everyone knows should never be broadcast unchecked.
By the end of the evening, the software reports the SDR’s sensitivity down to −124 dBm for LoRa on the band. That means I
© 2005 - 2026 AB9IL.net, All Rights Reserved.
Written and curated by Philip Collier / AB9IL.
About Philip Collier / AB9IL,
Commentaries and Op-Eds,
Contact,
Privacy Policy and Disclosures,
XML Sitemap.