Visualizing WiFi RF channels with a HackRF One and QSpectrumAnalyzer

[@notsrynot]

Radio tech here, Awesome video! Exactly what I was looking for. I'm after analyzing the main street that runs through my town as the local public safety facility went heavy on cameras but not so much on the microwave system operating on 5GHz. I think its all the businesses and apartments above those businesses causing a ton of interference. My Freedom Service monitor battery is trash and I haven't yet cracked into this HackRF since I bought it so this is a perfect first test.

[@mrr2880]

Really impressed with the capability of the HackRf 1.. thanks for this demo

[@SarahC2]

I didn't realise they all transmit at fractions of a second - eyeballing the channels doesn't give a clear view of what's happening after all... thanks for the informative video!

[@idarwin]

Thank you! Generally once a client finds a good channel it will stay there. Most likely all the short bursts are actually Bluetooth, which share the same radio frequency space as WiFi.

[@bojo8981]

I wonder if those red peaks could be Bluetooth channels. I think there are two protocols. One uses 40 channels and the other 79 and they operate in the same frequency band as wifi.....Thanks for the video. It helps a lot.

[@mrr2880]

Defo Bluetooth channel hopping .. the 802.11 hump looks like Ch11

[@idarwin]

You nailed it, they are Bluetooth channels :) I've learned quite a bit since posting this video so long ago.

[@cvetelingeorgiev1527]

Cool. I need sweep, but to transmit. I generate noise with 20Nhz span and I want to sweep it to for example 120Mhz span fast with hackrf. I need this not for jamming, but for tuning RF filters which have wide or spread notches that I cannot see at once. Any idea ?

[@idarwin]

While the current firmware doesn't support transmitting in sweep mode, I don't see why it wouldn't technically be possible with the hardware with a firmware update. This mode could be potentially destructive though, as sweeping a large area without the a proper filter/load/shunt attached might result in extremely high SWR.

[@nl8212]

May i know where to get executable hackrf sweep for qspectrum analyzer? Thank you in advancee

[@idarwin]

Hi there, the hackrf_sweep executable comes with the standard hackrf tools. There are a few ways to get this, you can use the pre-built executable that come with the Pothos downloads here: downloads.myriadrf.org/builds/PothosSDR/ but beware that a new firmware and tooling version has come out since the last release. You can also build the latest tools directly from the HackRF GitHub repository here: github.com/greatscottgadgets/hackrf or if you're not comfortable building from source, I think there are plans in the future to post the Windows binaries as part of the release. The Great Scott Gadgets community on discord (discord.gg/rsfMw3rsU8) is a great place to get help, as well as the very detailed documentation here: hackrf.readthedocs.io/

[@ADH-DIY]

Out of curiosity, what modifications did you make to the sweep script?

[@idarwin]

It was actually a bug fix: There was a problem a long time ago where newline/carriage return characters were being incorrectly inserted into the binary stream of data returned by hackrf_sweep.exe, but only on the Windows platform (due to the way Microsoft's implementation of the C++ standard library handles text streams.)

[@ADH-DIY]

@@idarwin thanks for the reply!

[@tobiasbouma4071]

The one thing I'm missing is taking a slice of the waterfall to analyse specifically. I'm literally getting overloaded with data using this method.

[@idarwin]

This method of scanning a huge area of spectrum is really only good for a high level overview. If you want to take only a smaller slice and get good data out of it, you'll need to scan and capture a much smaller area using a different tool like SDR++ or SDR#. Then depending on the bandwidth/sampling rate available by your SDR hardware (20MHz in the case of the HackRF One) you can take a small slice of that to analyze the actual data. Using QSpectrumAnalyzer will not get you usable data, just an overview.

[@tobiasbouma4071]

@@idarwin Horses for courses indeed! Just wished an all-in-one solution existed, and QSA was pretty close if not for that.

[@parentsbasementwrestlingfe5945]

Ok but what can you do with this data?

[@idarwin]

This was mostly an exercise in radio frequency domain analysis, and not WiFi optimization/hacking. I suppose it depends on what you mean by "data": You could use the information learned to get an idea of what channels are in heavy/active use, and set your router to a different one to avoid them for a better/faster WiFi connection. Many modern WiFi access points will do this automatically to some extent. but sometimes it helps to pin your access point to a particular channel.

[@CUAUHTEMOCVEGATORRES]

i still dont get it why stupid wifi alliance/mafia does not get extended wifi 2.4ghz spectrum. why they cant use 2ghz to 3 ghz?! there are a looooooooot of home appliances using 2.4 cuz their chips are not able to handle 5 ghz or 6ghz. and im mad cuz there is a lot of interference and a lot of delay on my wifi security cams, smart light bulbs, contactors, wifi enabled water pump, etc. i hate this so much.

[@FulcrumMason]

i have some experience in this and wifi is a busy protocol so its a interesting watch but without decoding etc its pointless. wireshark is the right tool. i didnt know about the sweep function of my hack rf or porta hack so that was interesting. overall knowledagable and a good watch regardless of the pointlesness.

[@paranoidzkitszo]

Was gona say....Wireshark and a wifi device capable of 'promiscuous mode'

[@DemocracyManifest-vc5jn]

Kismet is great too

[@idarwin]

It all depends on your end-goal. If your goal is to decode the WiFi data, then yes of course there are more specialized tools for doing just that. SDRs are not a great choice for WiFi hacking/decoding as the bandwidth requirements are huge and the latency is too high (unless you have an FPGA implementation of a WiFi stack.) But if your goal is just observe possible RF congestion issues, or gain an understanding of how WiFi channels are spread out or how Bluetooth frequency hopping works, then the sweep function can certainly be useful learning tool!

[@DemocracyManifest-vc5jn]

Great video. Subscribe