RTL_433 SDR IoT Sniffer

RTL_433 SDR IoT Sniffer

In this post I’ll be covering how to use SDR on Linux to capture data from wireless sensors using Benjamin Larrson’s RTL_433.  I’ll start by covering the required install steps followed by some rudimentary examples.  First you will need some kind of USB SDR hardware, this example we will be using the NooElec Nano.

Here are the steps to install the RTL_433 software.  Open a terminal window and enter in the following commands.

sudo apt-get install libtool libusb-1.0.0-dev librtlsdr-dev rtl-sdr build-essential autoconf cmake pkg-config git

git clone https://github.com/merbanan/rtl_433

cd rtl_433
mkdir build
cd build
cmake ../
make
make install

If any of the above fail, then run under “sudo”.  With the hardware connected to the computer, you should be ready to use the software.  With the terminal window open, enter the following command.

rtl_433 -G

You should get some readings from any devices within earshot of the SDR hardware.  The readings you see will depend on the devices transmitting at the time of your capture.  Here are some readings as an example.

2018-11-20 20:21:11 : Ambient Weather F007TH Thermo-Hygrometer
House Code: 59
Channel: 1
Battery: Low
Temperature: 48.5 F
Humidity: 78 %
Integrity: CRC
2018-11-20 20:24:09 : Acurite 606TX Sensor : -89
Battery: LOW
Temperature: 6.1 C
2018-11-20 20:29:23 : Thermopro TP12 Thermometer
Id: 92
Temperature 1 (Food): 253.0 C
Temperature 2 (Barbecue): 253.9 C
2018-11-20 20:29:23 : SimpliSafe Sensor
Device ID: 193YP
Sequence: 180
State: 2
Extra Data: Contact Closed

Here we have 4 different devices that were detected and decoded.  The first 2 are temperature sensors with the first providing more information.  The third device appears to be a smart oven, while the last looks like a proximity sensor.  The command we issued used all available decode methods.  If we wanted to narrow our results to a specific type of device, we would need to indicate that in the command.  Each of the devices above use a certain protocol.  To get a list of the protocols available in RTL_433, run this command in the terminal window.

rtl_433 --help

Each of the decode protocols are assigned and number.  In the example of devices above, if we search for the first device using the word “Ambient”, we find two protocols.

Registering protocol [20] "Ambient Weather Temperature Sensor"
Registering protocol [112] "Ambient Weather TX-8300 Temperature/Humidity Sensor"

Searching for the second device with the name “Acurite” results in 6 possible protocols.  We can narrow down our search by looking for “606TX”, which uses protocol number 55.

Registering protocol [55] "Acurite 606TX Temperature Sensor"

With the protocol numbers, we can narrow what RTL_433 decodes.  Here is the command to only decode the Acurite 606TX Sensor.

rtl_433 -q -R 55

The command switches used “-q” and “-R 55” display the only the results of decoded messages from protocol 55. The “-q” is quiet mode, that suppress non-data messages.  While “-R 55”, only the specified device is decoded.

This should be a good primer to get started using RTL_433, enjoy.

Comments are closed.