Decoders

Every mode is a channel. This page lists them, says how well each is tested, and covers the modes that need more than a frequency.

Catalog

+ Add lists every mode under Decoders, grouped as below.

A fixture catches decoding bugs but says little about drift, fading, or interference; the project's own modulator says nothing about what a real transmitter sends. The fixture library lists where each recording came from.

Experimental limits

Trunking

Add Trunk system, wire Device iq, and enter the control channel in MHz under Control. Set Protocol or leave it on Auto-detect. The node runs the channels it needs on the decoder picked under Decoder: DMR by default, or P25 Phase 1.

Range narrows the search. Channels can also be entered in the plan table. Learned channels are kept per site, by DMR colour code or P25 NAC.

Priority talkgroups take a receiver from other calls when all are busy, Lockout talkgroups are never followed, and Only these follows just the priority list. Each followed channel shows the talkgroup it was granted to. A control channel that goes quiet hands over to the site's other control channels the search found.

Following runs on the server with no browser open. Voice channels must fit inside the Device's window; a grant outside it is reported. To save call audio, see Record each call.

Voice privacy

Enter each key ID and its key under the decoder's Keys. The key's length picks the algorithm:

DMR Motorola Basic Privacy needs no key: the decoder reads it off the first silence frame, marked Basic Privacy and the key. A deciphered call names its cipher. A trunk node takes its own Keys, as key ID:hex key, for the calls it follows. A DMR call joined after its PI header starts once two superframes have carried their late-entry MI, if exactly one key fits. Calls without their key stay muted.

Vocoder chip

DMR, NXDN, dPMR, System Fusion, P25 Phase 1 and D-STAR voice plays through blip25 in software. Servers built with the dvsi feature (cargo build -p sdrmm --features dvsi) can use a DVSI AMBE-3000 or AMBE-3003 chip instead (ThumbDV, DV3000U, USB-3000, USB-3003): pick its serial port under Vocoder. A trunk node has its own Vocoder for the calls it follows.

The server finds the chip at 460800 or 921600 baud and shows its product under Vocoder. Each call takes one chip channel while it lasts: one on an AMBE-3000, three on an AMBE-3003. A call that finds every channel busy, or a chip that stops answering, plays through blip25 and the readout says so.

Tetrapol

The Tetrapol channel reads 12.5 kHz Tetrapol PMR downlinks. Tune the carrier; the scrambling code is found on its own, or set Scrambling to pin it. Pick VHF for 70 to 87 MHz systems.

On a control channel it logs cell system info, group activations with the traffic channel and its scrambling codes, group paging and the paging channel. On a traffic channel it logs group idle and end messages and the length of each voice burst; voice audio is not decoded. Frames that fail their checks count under Rejected. Uplinks are not decoded.

Inmarsat and Iridium

Inmarsat Classic Aero reads one Channel: P to aircraft, R/T bursts from aircraft, or C voice circuit signalling. It plays no audio.

Iridium decodes one 50 kHz channel. A Span of 1, 2.5, 5 or 10 MHz decodes bursts across a radio running at that sample rate, using the middle 80%.

Inmarsat STD-C draws each EGC call's sea area on a wired Map: a NAVAREA or METAREA by its limits, a coastal call by its NAVAREA, and rectangles and circles as sent. NAVAREA limits are simplified from the United States Coast Guard layer.

Pager text

Some German POCSAG networks send umlauts as { | } [ \ ] ~. SDRmm converts them inside lowercase words only: M}nchen becomes München, Stra~e becomes Straße. [ALARM] and all-caps messages stay as sent.

Swissphone pagers can carry IDEA-encrypted text. Enter the message key of each RIC and the organisation code from the pager programming (PSW900) under the POCSAG settings, and those messages decode as text marked IDEA. The seed includes the local date and hour, so the host clock, or a recording's capture time, has to be within the hour of the transmission. The pager checks twelve header bits that depend on no key; a page that fails them is dropped and counted as rejected. A wrong key gives noise, not an error.

End-of-Train

The End-of-Train channel reads railroad telemetry. Tune 457.9375 MHz for the rear unit: brake pipe pressure, motion, marker light, battery and arming. Tune 452.9375 MHz for the locomotive: status requests and emergency brake commands. Australia uses 477.7 MHz, New Zealand 450.2625 MHz. Only frames whose BCH check passes are logged; Rejected counts the ones that failed.

ISM sensors

The ISM sensors channel reads OOK and FSK weather stations, thermometers, tyre sensors, remotes and door sensors on 315, 345, 433.92, 868 and 915 MHz. It splits each burst into pulses, slices them like rtl_433 and tries every decoder below. The channel is 240 kHz wide, so sensors a little off centre still decode. A repeat of the same message within 2 s is logged once.

Unknown logs a code no decoder knows when the same row repeats, with its coding and pulse widths. A burst whose checksum fails in every decoder counts under Rejected.

Wireless M-Bus

Reads water, heat, gas and electricity meters (EN 13757-4). One channel decodes modes T and C on 868.95 MHz; tune 868.3 MHz for mode S, tested only against our own modulator. Each frame shows the meter's manufacturer, ID and type, and the repeater it came through.

Most meters encrypt their readings. Add the meter ID and its AES key under Keys to open them; OMS security mode 5 and Kamstrup's ELL encryption are supported. Plain and decrypted frames list their records: volume, energy, power, flow, temperatures and dates. Only frames whose CRCs pass are logged; Rejected counts the ones that failed after a valid header.

406 MHz beacons

The 406 MHz beacon channel reads first-generation COSPAS-SARSAT EPIRBs, ELTs and PLBs. Each sends a half-second burst every 50 seconds. The default channel spans 20 kHz: centre it on 406.034 MHz to cover 406.025 to 406.040 MHz. It logs the 15-hex ID, country, protocol, beacon identity and, for location protocols, the encoded position, which the Map plots under Beacons. Self-test bursts are marked. A frame whose first BCH field fails counts under Rejected; a long frame whose second field fails is logged as PDF-2 failed with the coarse position only. Second-generation beacons are not decoded.

SSTV

Tune SSTV to the USB dial frequency. A picture takes from 36 seconds to four and a half minutes.

Modes: Robot 36 and 72, Martin M1 and M2, Scottie S1, S2 and DX, PD50, PD90, PD120, PD180, Wraase SC2-180.

Wire video to Video to watch a picture arrive. Finished pictures show in the Video node's gallery and are kept as PNG on the server for 24 hours, up to 512 pictures or 256 MB. Without a video wire nothing is kept.

Weather satellites

Meteor LRPT decodes the digital picture from Meteor-M on 137.9 MHz. It composes channels 64 and 65 into colour, or shows the strongest single channel. Set Mode to QPSK 72k, OQPSK 72k or OQPSK 80k to match the satellite; Meteor-M N2-4 sends OQPSK 72k.

NOAA APT decodes the analog picture on 137 MHz: both AVHRR channels side by side, with the channel numbers read from the telemetry wedges. Partial keeps a pass cut short. NOAA-15, 18 and 19 were decommissioned in 2025, so this is for recordings.

A picture starts when the signal locks and is saved when the pass ends, in the same store as SSTV. Use a Satellite node to follow Doppler and know when a pass begins.

WEFAX

Tune WEFAX to the USB carrier, 1.9 kHz below the published frequency. The start tone picks the IOC, phasing lines set the line start and straighten the slant, and the stop tone ends the chart.

Radiosondes

The Radiosonde channel reads RS41, DFM, M10, M20 and iMet-4 weather balloons. Sonde on Auto runs every type at once. Each frame gives serial, position, altitude, climb and, where the sonde sends it, temperature, humidity and pressure. Wire it to Map for the flight track and to Decoder log or Readout for the readings. RS41 temperature and humidity appear once its calibration data has arrived, about a minute after first lock.

On Map a climbing or falling sonde gets a dashed forecast path, a ring at the burst point and a landing mark. The forecast uses the winds the sonde measured on the way up. Burst is the altitude assumed while it still climbs; Ground is the altitude it lands at.

FT8, FT4 and WSPR

Each decode carries its UTC Slot and a Time offset (DT) from it, read from the time the radio's samples arrived, as WSJT-X reads its sound card. Keep the server clock synced (NTP). A recording played back is timed by when it plays.

A station heard in one period is looked for again one period later, at the same frequency, with the messages it is likely to send next. This confirms repeats too weak to decode blind, like the a7 pass in WSJT-X.

SAME alerts

The SAME alerts channel reads the headers NOAA Weather Radio and the Emergency Alert System send ahead of an announcement. Tune one of the seven NWR channels between 162.400 and 162.550 MHz. Each alert gives the event code and its name, the originator, the counties it covers, how long it stays valid and the station that sent it; the closing NNNN burst is logged as its own end-of-message entry. Wire events to Decoder log to keep them, or to an Event output to drive your own notifications.

A header is sent three times. Two matching copies settle it, and three copies that differ by a byte settle by majority vote. A burst that never finds a match inside 20 s is dropped and counted in Rejected. The channel reads no audio: add an NFM channel on the same frequency for the forecast voice, which the NOAA Weather Radio template does for you.

County names come from the NWS SAME code list; a code outside it is shown as its six digits.

Map

Wire the events of any decoder that reports positions, such as ADS-B, AIS or APRS, to Map. Each target draws its track. The gear at the bottom left picks the style, hides tracks, switches to a globe, or takes a custom URL: an XYZ template (https://…/{z}/{x}/{y}.png) or a MapLibre style URL, with any API key in the URL. The choice is kept in this browser.

APRS weather

The APRS channel reads weather reports, positioned or positionless, into wind, gust, temperature, rain, snow, humidity, pressure and luminosity in metric units. The APRS readout lists each weather station with its latest values and the extremes seen.

DAB and DAB+

Wire audio to a Speaker. Type limits the choice to DAB or DAB+. Mode picks transmission mode I to IV, or Auto detects it; it starts on I. Service picks a service; Auto plays the first playable one. All run at 2.048 MS/s. Tuner offsets up to 40 kHz are corrected and shown as frequency error.

A Readout shows the dynamic label and slideshow. The Decoder log keeps received MOT objects with a download link. Files are offered for download, never opened in the interface.

Packet services appear in the same list as audio services. IP services emit datagrams, see IP data.

DRM

Wire audio to a Speaker. Mode picks DRM30 (robustness A to D), DRM+ (E) or Auto. Auto covers the DRM+ width. BW sets the DRM30 channel, 4.5 to 20 kHz; tune to the DRM reference frequency. Service picks one of up to four services; Auto plays the first playable one.

AAC, HE-AAC, HE-AAC v2 and xHE-AAC play. The dynamic label shows the text message. SDC and text CRC failures count as data failures, broken audio frames as audio failures.

DVB

DVB-T/T2 and DVB-S/S2 play the chosen programme's first audio and video streams. Wire audio to a Speaker and video to a Video node. Service picks a discovered programme or takes its number; Auto plays the first.

DVB-T/T2: set Standard and BW. Everything else is read from the signal. Low priority picks the DVB-T LP stream. PLP picks a DVB-T2 pipe, or the first TS pipe if left empty. 1.7 MHz fits a 2.048 MS/s radio.

DVB-S/S2: set Rate from 100 kBd to 4 MBd. The radio must be wider than the carrier, symbol rate × (1 + roll-off): 2.7 MHz for 2 MBd at 0.35. On DVB-S, FEC sets the code rate or finds it on Auto, and roll-off is always 0.35. On DVB-S2, set Roll-off to match the transmitter; the MODCOD is found automatically, including VL-SNR. Stream picks one input stream on a multistream carrier. GSE packets can go to your network, see IP data.

Superframes enables DVB-S2X Annex E, formats 0 to 7. Walsh-Hadamard rows are found automatically. Set Ref code and Data code when the carrier does not use the default scrambling, or turn on Code search to find them on a clean signal.

DECT

The DECT channel surveys base stations (identity, capabilities, security) and plays unencrypted calls.

It needs a radio that reaches 1.9 GHz and is wider than one 1.728 MHz carrier. HackRF and SDRplay work, RTL-SDR does not.

Carriers are 1.728 MHz apart. EU carrier 0 is 1897.344 MHz and the numbers count down. US carriers count up from 1921.536 MHz.

For Band, tune the channel to the band centre: 1889.568 MHz (EU) or 1924.992 MHz (US). The radio needs 20 MS/s for all ten EU carriers and 10 MS/s for the five US ones. Off centre, the channel reads the carriers the radio reaches.

Each record lists the base identity (RFPI), system information, capabilities, advertised and observed security, and handset IDs seen during encryption setup. Capabilities include the extended messages (Q header 4, C and E); DSAA2 and DSC2 come from part 2. Encryption is marked active only after a grant is seen. Advertised support does not prove a call was encrypted, and missing signalling does not prove it was not.

Calls use 32 kbit/s ADPCM (G.726). The channel plays both directions of the first clear call it hears and holds it until it goes quiet. Encrypted bearers stay muted. Voice before the first multiframe marker cannot be descrambled; those frames, X-CRC errors, and late frames are counted in the record.

GSM downlink

The GSM channel logs one cell, like OsmocomBB's cell monitor. Tune it to a downlink carrier (C0); band and ARFCN follow from the frequency. It runs at 541.667 kS/s over 200 kHz.

It locks on FCCH and SCH, then decodes BCCH and CCCH: system information (cell identity, neighbours, CCCH layout), paging identities and immediate assignments.

Follow decodes a non-hopping SDCCH/8 or SDCCH/4 on the same ARFCN until release, ciphering or silence. Records show LAPDm frames, RR, MM, CC, SS and SMS message names, identities, and the A5 algorithm from a Ciphering Mode Command. Ciphered traffic, hopping channels and other carriers are not decoded. Blocks that fail CRC count as rejected.

TETRA

The TETRA channel reads one 25 kHz downlink carrier. It needs no settings.

Voice is not decoded. Air-encrypted cells report only their identity. Control blocks that fail their CRC are counted as rejected.

LoRa

The LoRa channel reads LoRa packets and decodes LoRaWAN, Meshtastic and MeshCore inside them. Tune to the centre of the LoRa channel. A sender up to a third of the bandwidth off still decodes, and its clock drift is followed from the preamble.

Meshtastic's default key on every preset channel name and the MeshCore Public channel are built in. Add others under Keys:

The LoRa readout lists each node heard, keyed by Meshtastic node ID, MeshCore name or LoRaWAN DevAddr. Meshtastic positions, waypoints and map reports and MeshCore adverts with a location appear on Map. Meshtastic direct messages and MeshCore private messages are end-to-end encrypted and show as such. The signal generator sends Meshtastic, MeshCore and LoRaWAN test packets.

Drone Remote ID

The Drone Remote ID channel reads what drones broadcast under ASTM F3411 and EN 4709-002: serial number, position, height, speed, pilot position, operator ID and self ID. It also reads the French beacon format and DJI's own DroneID beacons.

It needs a radio that reaches 2.4 GHz. HackRF, SDRplay and Pluto work, RTL-SDR does not.

The Drone Remote ID and Drone Remote ID · Wi-Fi templates set this up.

Tune Bluetooth to an advertising channel: 2402, 2426 or 2480 MHz. Tune Wi-Fi to the channel centre, usually channel 6 at 2437 MHz, or 2412, 2462 or 5745 MHz.

Long range drones send their data on any of 37 data channels. BT band covers about 8 of them, so it hears about a fifth of those packets.

A Bluetooth 4 advert carries one message, so the readout joins each drone's adverts into one row keyed by serial number. Map shows the drone and its track; the detail lists the pilot and the distance to them. Frames that fail their checksum after the header are counted as rejected.

Tested on real Bluetooth and Wi-Fi captures and on real Remote ID frames from packet captures. No public IQ recording of a real Remote ID transmission exists yet.

BLE advertisements

The BLE channel lists Bluetooth LE devices: address and its type, name, vendor, services, Tx power, and beacons: iBeacon, AltBeacon, Eddystone, Find My, Fast Pair and Exposure Notification. Scan requests and connection requests show who asked whom.

Tune Channel to an advertising channel: 2402, 2426 or 2480 MHz. A device that repeats itself is shown once a second, with the count of repeats. Packets that fail their CRC are counted as rejected. The BLE devices template sets this up.

2.4 GHz survey and Wi-Fi occupancy

Both read energy only and report once a second. Neither decodes a packet.

2.4 GHz survey sorts every burst by width, length and channel grid into Wi-Fi, Bluetooth, 802.15.4 (Zigbee, Thread), microwave oven, narrowband, wideband and continuous. It reports bursts, airtime, typical length and where they sit. A carrier that never stops shows as continuous.

Wi-Fi occupancy gives the busy time of each 20 MHz Wi-Fi channel fully in view, with its level and noise floor. It works on 2.4, 5 and 6 GHz.

Margin sets how far over the noise floor counts as busy. The floor is learnt in the first eighth of a second and follows the band slowly upward, at once downward. The 2.4 GHz survey and Wi-Fi occupancy templates set them up. The signal generator sends BLE beacons and mixed 2.4 GHz traffic.

Tested on recordings: a USRP X310 at 100 MS/s beside a DJI Mini 4 Pro (RFUAV) and a 40 MS/s Bluetooth capture with OmniSIG labels, where the survey counted 138 Bluetooth bursts against 137 labelled.

HF modems

The STANAG modem identifier names HF data modems from USB audio: STANAG 4285, STANAG 4529, MIL-STD-188-110A serial, STANAG 4539 (110B Appendix C), 39-tone, 16-tone and 2G ALE. Put the channel on the USB dial. Each report gives the modem, its carrier and the frequency; for 110A the rate and interleave come from the preamble. A modem that stops is reported gone.

Window is how much signal each verdict uses, 2 to 12 s; longer finds weaker signals. A busy channel that matches no modem counts as rejected. The HF data modems template sets it up.

Tested on 49 sigidwiki recordings, including all 14 MIL-STD-188-110A rates.

Measurements

Noise figure uses the Y-factor method. Connect a calibrated noise source, set ENR to its value at this frequency and switch it on and off. Each level is averaged over 400 kHz once it holds for half a second; the higher one is the source on. The report gives NF, noise temperature and Y. Keep gain fixed while measuring. The LO spike is left out.

PER tester counts numbered 2-FSK test frames: 32 bit preamble, sync 1ACFFC1D, 32 bit sequence number, a PRBS9 payload and CRC-16/CCITT. Gaps in the sequence count as missed, a failed CRC as rejected, and every payload bit is compared against PRBS9 for the BER. A sequence that jumps back counts as a restart. Set Baud and Payload to match the sender. The signal generator sends PER test frames at the defaults; lower its level or add noise to find where frames start to drop.

SID monitor follows the VLF transmitters between 16 and 46 kHz that fall in its 42 kHz window and reports their level and SNR every interval. A level that moves more than Threshold from its 30 minute baseline for 30 s is flagged as a sudden ionospheric disturbance; the baseline holds while it lasts. Leave it running through the day with a long wire or loop.

The Noise figure, PER tester and SID monitor templates set them up. The signal generator also sends a switched noise source and VLF stations around 30 kHz.