RTL-SDR: the complete guide for hobbyists and pentesters

RTL-SDR is the cheapest sensible way to see radio as an image, not just hear it as sound. After plugging in a small USB receiver and launching SDR++, the FM band, ADS-B, AIS, APRS, Meteor-M or simple ISM devices start showing up on the waterfall as concrete signal traces. For a hobbyist it is an entry point into the world of radio engineering. For a pentester it is a passive way to reconnoiter wireless devices without transmitting anything on the air.

How RTL-SDR works: hardware and software

RTL-SDR relies on two key hardware components: the RTL2832U chip responsible for digitizing the signal, and a radio tuner, most often the R820T2 or Rafael Micro R828D. The frequency range depends on the model. Classic RTL-SDR dongles with the R820T/R820T2 tuner natively work usually from about 24-25 MHz to about 1.7 GHz. RTL-SDR Blog V3 lets you reach down into the HF bands through direct sampling, while RTL-SDR Blog V4 uses an additional HF path with an upconverter and covers the 500 kHz-1.766 GHz range. This includes, among others, the FM, aviation, marine and weather bands. The RTL2832U chip converts the analog signal into a digital IQ stream, which then goes to the computer over USB and is decoded by software.

Changing the modulation from AM to FM or SSB requires no hardware modification, you only change the settings in the SDR application. It is precisely this feature that makes an SDR receiver such a versatile tool compared to traditional radio scanners.

Step-by-step installation

The process of setting up RTL-SDR on various operating systems goes as follows:

1. Plug the dongle into a USB port and wait for the system to detect the device.

2. On Windows download the Zadig application and replace the default DVB-T driver with the WinUSB driver. Driver installation usually takes a few minutes.

3. On Linux add the entry blacklist dvb_usb_rtl28xxu to a file in the /etc/modprobe.d/ directory (e.g. create /etc/modprobe.d/rtl-sdr-blacklist.conf) to disable the default kernel module. After saving, unplug and plug the dongle back in.

4. Download SDR++ or SDR# and point the settings to the RTL-SDR device.

5. Set the frequency to 100 MHz (FM band) or 1090 MHz (ADS-B) and check whether the signal is visible on the waterfall.

SDR++ is recommended for beginners thanks to its simple interface and operation on Windows, Linux and macOS. SDR# offers an extensive plugin ecosystem but runs on Windows only. For tracking aircraft, dump1090 works best, decoding ADS-B signals and showing flight positions on a map.

Pro tip: Start by setting the gain to automatic or a low value. Too high a gain causes signal saturation and, paradoxically, worsens reception, especially near strong FM transmitters.

What you can receive with RTL-SDR: ADS-B, AIS, APRS, Meteor-M and IoT

Popular uses of RTL-SDR include FM reception, ADS-B aviation monitoring, decoding weather images from NOAA and Meteor satellites, and tracking ships via AIS. These projects can be carried out within the first hours after installing the receiver and software. This means the barrier to entry is exceptionally low even for people with no experience in radio engineering.

Here are the most important categories of use:

• ADS-B and aviation monitoring. The dump1090 or PlaneFinder application receives signals from aircraft transponders on 1090 MHz and shows them on a map in real time. With a good antenna the reception range reaches 200 km.

• AIS and ship tracking. On the 161.975 MHz and 162.025 MHz frequencies, ships broadcast their positions, speeds and identification data. SDR-AIS or OpenCPN software decodes this data and displays maritime traffic.

• NOAA and Meteor-M2 weather satellites. Historically one of the most popular RTL-SDR projects was receiving NOAA APT satellites on 137 MHz, but the legacy NOAA POES were shut down in 2025. In 2026 a more practical direction is the Meteor-M N2-3/N2-4 satellites broadcasting LRPT in the 137 MHz band, received through SatDump. WXtoImg is best treated as a legacy tool for archival NOAA APT recordings rather than as the main recommendation for new setups.

• RTL_433 and IoT monitoring. The RTL_433 tool decodes signals from hundreds of wireless devices: weather stations, temperature sensors, energy meters and alarm systems. This is particularly useful in the context of IoT security audits.

• APRS and amateur radio. On 144.800 MHz (European standard) GPS positions and text messages are broadcast in the APRS protocol. Direwolf is a popular decoder that works with RTL-SDR.

• Repeater and Airband monitoring. The 118 to 136 MHz band carries voice communication between pilots and air traffic controllers in AM modulation.

For pentesters and security specialists, RTL-SDR opens up the possibility of passively monitoring wireless protocols without actively interfering with the network. You can read more about SDR uses in penetration testing in the article on SDR hardware for pentesting.

RTL-SDR for pentesting and radio OSINT

For a pentester, RTL-SDR is above all a tool for passive spectrum reconnaissance. It lets you see which devices are transmitting around the target - from sensors in the 433 and 868 MHz ISM band, through remotes and alarm systems, to broadcast infrastructure - without emitting your own signal, which can matter where leaving no trace on the air counts.

A typical workflow starts with reviewing the waterfall and the RTL_433 tool, which recognizes many simple ISM protocols. You do, however, need to stay realistic: detecting and identifying a transmission is not the same as decoding it. Some devices use rolling code, encoding or encryption, and merely seeing a packet does not grant access to its contents or the ability to replay it. RTL-SDR works well for inventorying and mapping devices, less so for active interference.

In the context of radio OSINT, RTL-SDR opens access to public but often overlooked data sources: aircraft positions from ADS-B, maritime traffic from AIS, or APRS station locations. This is openly broadcast information whose aggregation can be a valuable supplement to reconnaissance. The hardware limits are clear - reception only, a range up to about 1.7 GHz and a narrow instantaneous bandwidth - so for tasks beyond listening you reach for more powerful gear, as discussed below.

The most common beginner mistake: a bad antenna, not a bad receiver

Matching the antenna to the frequency is more important than the quality of the receiver itself. The antenna bundled with an RTL-SDR kit is a compromise designed for nothing in particular. Users who replace it with an antenna matched to the target frequency report a dramatic improvement in range and signal quality.

A V-dipole antenna for 137 MHz is one of the best value-for-money options for receiving weather satellites. Two arms 53.4 cm long, spread at a 120° angle, create an upward-facing radiation pattern that fits passing satellites perfectly. A collinear antenna for 1090 MHz built from sections of coaxial cable costs a few zlotys in materials and provides a range comparable to commercial solutions.

An LNA (Low Noise Amplifier) is worth adding with long antenna cables or weak signals. For ADS-B 1090 MHz use a filtered ADS-B LNA 1090 MHz (based on the MGA-13116 with two SAW filters). For general SDR experiments you can use a wideband SPF5189Z LNA, but it is best to combine it with an appropriate band-pass filter so as not to amplify unnecessary interference. A SAW filter for 137 MHz reduces interference from strong FM transmitters and clearly improves weather satellite reception.

Pro tip: Place the LNA as close to the antenna as possible, not next to the receiver. An LNA is best placed as close to the antenna as possible, because it then amplifies the useful signal before the cable losses. If the amplifier sits only at the receiver, the cable loss has already worsened the signal-to-noise ratio.

Which RTL-SDR to choose in 2026: V3 or V4, given that V4 is end-of-line?

RTL-SDR Blog V4 was one of the best models for beginners thanks to its 500 kHz-1.766 GHz range, built-in HF solution, TCXO and bias tee. As of May 2026, however, the V4 model has end-of-line status, so its availability depends on reseller stock. When buying, you have to watch out for fake V4 listings. As a currently produced alternative available in our offer we recommend the RTL-SDR Blog V3 (R820T2).

Key parameters when choosing a model:

• TCXO (Temperature Compensated Crystal Oscillator) stabilizes the frequency under temperature changes. Without a TCXO the receiver drifts by a few kHz, which makes receiving narrowband SSB and digital signals harder.

• Bias Tee delivers 4.5 V over the coaxial cable, powering an external LNA without a separate power supply.

• The SMA connector is more durable and more standard than MCX. MCX-to-SMA adapters cost a few zlotys, but every extra connection introduces signal loss.

RTL-SDR is a receive-only device. Transmitting signals requires devices such as HackRF Pro or LimeSDR, which are more expensive and more complicated to use. For most monitoring and educational uses, the RTL-SDR Blog V3 is fully sufficient.

When RTL-SDR is not enough and HackRF Pro is worth choosing?

RTL-SDR has three hard limitations: it receives but does not transmit, it reaches roughly up to 1.7 GHz, and it works with a narrow instantaneous bandwidth and an 8-bit converter. For listening, learning and most monitoring projects this is enough. The boundary appears when you need to transmit, experiment with RX/TX, work above 1.7 GHz or analyze wider chunks of the spectrum at once.

For such tasks you reach for HackRF Pro or LimeSDR class hardware. HackRF Pro is the current platform of the HackRF project: a 100 kHz-6 GHz range with tuning up to 7.1 GHz, USB-C, TCXO and an FPGA. It works in half-duplex mode, so it transmits or receives, not simultaneously - full duplex requires a LimeSDR. This is more expensive and more demanding gear, so treat it as the next step after RTL-SDR, not a first purchase. Availability of such devices can vary, so it is worth checking the current status in the shop before planning a project.

How to solve common RTL-SDR problems?

The most common RTL-SDR user problems have simple causes and solutions. Knowing these patterns saves hours of frustration.

• Frequency drift. Models without a TCXO drift by a few kHz while warming up. Solution: wait 15 minutes after plugging in, or use the PPM correction function in SDR++ and SDR#.

• FM interference. Strong FM transmitters in the 88 to 108 MHz band flood the receiver input and mask weaker signals. The Broadcast FM Band Stop filter eliminates this problem in hardware.

• Driver problems on Windows. If SDR++ does not detect the device, check in Device Manager whether the dongle is visible as WinUSB, not as DVB-T. Reinstalling the driver through Zadig solves most typical RTL-SDR detection problems on Windows.

• Too much noise. The computer, power supply and USB cables generate electromagnetic interference. Move the dongle further from the computer using a USB extension cable, or use a wideband preamplifier SPF5189Z with filtering.

• No signal on the waterfall. Check in order: whether the antenna is connected, whether the gain is not set to zero, whether the frequency is correct, whether the driver is working.

The r/RTLSDR community on Reddit is the fastest source of help with non-standard problems. Users share antenna settings, software configurations and projects there, which significantly speeds up learning.

Pro tip: With interference problems, first disconnect the antenna and check the noise level of the receiver itself. If the waterfall is clean without an antenna, the problem lies in the RF environment, not in the hardware.

Key takeaways

RTL-SDR is the most cost-effective tool for passive radio monitoring, provided you match the antenna and software to the specific use case.

My experience with RTL-SDR after years of working with SDR hardware

When I first plugged in an RTL-SDR, I expected a toy. I got a tool that changed the way I think about wireless security. The biggest surprise? How many signals are easy to detect, and sometimes also to decode. You do, however, have to distinguish the presence of a signal on the waterfall from a real understanding of the protocol - some remotes, alarms and meters use rolling code, encoding or encryption.

The most common myth I hear: "RTL-SDR is just a toy for radio amateurs." That is not true. The RTL_433 tool combined with a good antenna is a real instrument for passive auditing of many simple IoT devices in the ISM bands. You do have to remember, though, that detecting a signal does not automatically mean the ability to decode every protocol or bypass protections such as rolling code or encryption. I have seen professional penetration test reports in which RTL-SDR was the only hardware tool used to identify vulnerabilities in wireless systems.

For beginners I have one piece of advice: do not buy the cheapest clone from auction sites. The difference between a model without a TCXO and the RTL-SDR Blog V3 is clear when working with narrowband digital signals. You will save 20 zlotys and lose hours fighting frequency drift.

Trends in SDR are heading toward ARM platforms and real-time signal processing on the Raspberry Pi. Advanced users already use specialized drivers to handle high throughput on ARM platforms, which opens up the possibility of stationary monitoring systems without a full-fledged computer. RTL-SDR will remain relevant for many years to come as the entry point into this ecosystem.

RTL-SDR hardware and accessories available at Sapsan-sklep

Sapsan-sklep offers a full set of SDR hardware for hobbyists and professionals, with delivery across the EU and the USA. At SAPSAN the safest starting point right now is the RTL-SDR Blog V3: a branded receiver with TCXO, a metal enclosure, SMA and bias tee. If you plan to receive ADS-B, AIS, APRS, Meteor-M or ISM bands, pick the right antenna, filter and LNA at once - they often make a bigger difference than swapping the dongle itself.

Every SDR project needs the right antenna and filtering. Sapsan-sklep supplies RTL-SDR antenna kits with an LNA filter and preamplifier, antenna sets for various bands, and FM Band Stop filters that eliminate interference. The hardware comes from proven manufacturers, and technical support is available directly through the shop. For those looking for a complete starter kit, the Sapsan-sklep offer covers everything from the receiver to antenna accessories in one place.

FAQ

What is RTL-SDR and what is it for?

RTL-SDR is a family of inexpensive USB receivers usually based on the RTL2832U and a radio tuner. The range depends on the specific model: RTL-SDR Blog V3 works natively around 24-1766 MHz and supports HF through direct sampling, while RTL-SDR Blog V4 offered 500 kHz-1.766 GHz thanks to an additional HF path, but in 2026 it has end-of-line status. It is used for ADS-B aviation monitoring, weather satellite reception, AIS ship tracking, decoding IoT signals and many other applications.

What software works with RTL-SDR?

SDR++ runs on Windows, Linux and macOS and is recommended for beginners. SDR# offers extensive plugins on Windows. For specific uses you reach for dump1090 (ADS-B), SatDump (current Meteor-M LRPT projects) and RTL_433 (IoT devices). WXtoImg remains a legacy tool for archival NOAA APT recordings.

Can RTL-SDR transmit signals?

RTL-SDR is a receive-only device and does not support transmitting. Transmitting and RX/TX experiments require devices such as HackRF Pro or LimeSDR, which cost many times more. HackRF Pro works in half-duplex mode, so it does not transmit and receive at the same time.

Which antenna is best for RTL-SDR?

There is no single best antenna. For ADS-B (1090 MHz) a collinear or Spider works well. For receiving weather satellites in the 137 MHz band, especially Meteor-M LRPT, a V-dipole antenna is a good starting point. With weaker passes and harder locations it is worth considering a QFH, turnstile or a directional Yagi antenna. For AIS (162 MHz) a vertical dipole is enough. An antenna matched to the frequency always beats the antenna bundled with the kit.

How to install RTL-SDR on Windows?

Plug in the USB dongle, download the Zadig application and replace the default DVB-T driver with the WinUSB driver. Then download SDR++ or SDR# and select RTL-SDR as the signal source. The whole process usually takes a few minutes.