Slashdot Mirror

They're SDRs. Try something like this: https://www.ettus.com/product/details/UN210-KIT

For transmitting there's the HackRF which is a few mW output and is the one I've played with. Also another supplier that has cheaper, transmit only versions; the HackRF Blue
For quite a bit more, there's MIMO capable devices such as the Ettus USRP that lets you run your own GSM basestation among other things.
And for a more stand alone device, there's always the PortableSDR
I've got a HackRF and am having fun with it trying to make a network analyzer. The others, I've just heard about.

How very cool - they're using an Ettus Research software-defined radio! I'm not sure if they'll be using the GNURadio stack to interface to the radio or not, but it's nice to see such an Amateur Radio friendly company get some cred.

From their application, they're looking to use 10.95-11.05 GHz downlinks with an transmitter power of 4 W, an EIRP of 1.1 kW (which implies at least a 24.4 dBi antenna), a bandwidth of 85.8 MHz, and a modulation scheme that uses a single channel with amplitude and phase modulation (QAM, likely) and a mix of content - video, phone, etc.

They also have 8GHz low-power downlinks at 11.6 GHz bandwidth.

8027.50000000-8087.50000000 MHz MO 20.000000 W 19.300000 W P 0.00100000 % 11M6G1D

Test equipment is allowed to transmit and receive on those frequencies. If it looks like a radio, it can't. I have a number of cellular testers hanging around here that can act like base stations, mostly because I buy them used as spectrum analyzers and never use the (obsolete) cellular facilities. Government has different rules regarding what it can and can't do in the name of law enforcement, although FCC has been very reluctant to allow them to use cellular jammers.

If you can afford it, something from Ettus would better suit your application.

USRP
https://www.ettus.com/product

Software Defined Radio used to spoof Cell towers. Looks like NSA is deploying SDRs everywhere. This is more interesting than some google cookie.

Fat lot of good that will do. This attack wasn't (and probably can't be) done using a cellphone
They used one of these https://www.ettus.com/product/details/UB100-KIT

GNU Radio makes the FPGA very dumb and feeds all the data over a long-delay pipe---ethernet/usb, host operating system, userland process---so it can't make swift decisions.

IIRC, the default firmware for the FPGA does a simple transform and pipes the I/Q samples over USB or ethernet. That is not to say that you couldn't put more of the functionality on the FPGA. I disagree that fiddling with FPGAs is "almost designing real radios, if you're implementing on FPGA". If you're processing the signal in the digital domain, it's still SDR, even though the 'S' is burned into an FPGA. 'Real Radios (tm)' require arcane analog/RF knowledge - things like filter design, mixer design, VCO design, etc - all the stuff that is frequency-dependent. SDR requires Hilbert transforms, Hamming windows, that sort of thing.

If I were trying to implement a specific protocol, I might test the algorithm out in GNU Radio, but I'd use a module like the Ettus SBX and put the radio logic in an FPGA or (very) fast CPU.

My (layman's) understanding is that that varies: Given that all real components have various limitations and finite performance, nobody sells a 'DC-to-daylight' frequency range in a single package, just not in the cards. Some SDR products are explicitly modular(see 'Daughterboards Table' tab), some, generally in exchange for lower cost, support a single slice of spectrum and hope that your area of interest falls inside it.

This is a lot more expensive. This is why $300 is cheap for an SDR; but $30 is expensive for a wifi dongle.

As for protocol switching, that may actually be easier than the relatively broad spectrum support side of things, given how many distinct protocols boil down to various uses and misuses of frequencies right around 2.4GHz. The hard part, for general-purpose interaction with wireless data standards(as opposed to prodding them with specially formed inputs) is that you might find yourself needing some serious punch to do all the crunching in pure software fast enough that the device you are talking to doesn't give up on you and time out. Of course, you may end up with a $300 BT dongle that consumes a core or two of a modern CPU running at full tilt; but it should work(just remember to whistle innocently about any patents that you definitely aren't violating by implementing the standard...) This is why full SDR designs have largely lost out in consumer products. It sure would be elegant if my cellphone had a universal RF communications module that adapted to my requirements at any given moment; but shoving in Wifi and Bluetooth courtesy of broadcom and cellular courtesy of Qualcomm costs two factors of ten less, so which one am I going to pick?

Your cell phone and modem are basically software defined radios.

The idea with modern radio is to get the RF signal down to a frequency where it can be digitized and then do everything else in software. I have often said that, if you tried to implement a 3G cell phone in circuitry rather than software, it would occupy a rather large room.

Is the government really having a fit over sdr? Not so much. For one thing, they can't do much about it. The hardware isn't too hard, as long as you aren't trying to stuff it in a small package. You don't even need high speed a/d converters for the most part. The gnuradio system uses the sound card in your computer. http://www.ettus.com/

The other thing is that most interesting signals are encrypted.

If you want to play, gnuradio-companion is great. You don't need to mess with code because you can drag and drop blocks in an interactive gui. Check out Sharlene Katz's sdr project page. You don't need hardware because you can run the software with files. http://www.csun.edu/~skatz/katzpage/sdr_project/sdrproject.html

this shopping season could prove to be very interesting for Forest City thanks to Ettus research, Gnu Radio, and the same wanton disregard for the privacy of major conglomerate shopping centers as the shopping centers themselves display toward private citizens.

http://gnuradio.org/redmine/projects/gnuradio/wiki http://www.ettus.com/products im not saying each cellphone is uniquely identifiable and that these characteristics could easily be script generated for an open source transceiver project that fits into a backpack with a netbook at a crowded shopping center, or that transmitting billions and billions of said cellular signatures may cause a cellphone tracking system to cave just as it would had you transmitted millions of malformed cellular signatures. Im just merely implying that once this system which is accessible through the malls ethernet and wireless network folds like a chair, it would allow various interesting exploits to be performed and data to be collected. and we all love to test the anonymity of data declared anonymous by a third party who collects it using their proprietary closed source appliance.

He actually gave a talk about this on Hak5. It seemed it could be accomplished using an USRP and OpenBootTS

http://gnuradio.org/redmine/wiki/gnuradio and http://www.ettus.com/ see also http://kks.cabal.fi/GNUSaunaradioaallot :P

I think a software defined radio would be the perfect thing for the OpenMoko phone that just was highlighted on Slashdot (it's open source). It'll work on any network than.

Absolutely, except, currently, software defined radio hardware to work with, e.g. the GNURadio stack, is gonna run you a bit under $1000US. But, that's what Moore's law is for, not to mention mass production! When that's a $30 part, it's probably a no-brainer for OpenMoko. Not just cellular - it can be an FM Radio, a GPS receiver, a Bluetooth device, WiFi, UWB, etc. etc.

http://www.ettus.com/
http://www.gnuradio.com/trac

a USRP (or soon to be released USRP 2) with a 2.4 GHz card will do the same..

GNU Radio is also a good example of the cost downside to SDR. The basic board, the USRP, costs $700. And then you gotta buy daughterboards.

I figure in a few more years we'll get cheap SDR.

You've seen http://gnuradio.org/trac and http://www.ettus.com/?

Thanks

Bruce

This product seems to receive the entire spectrum by default.

No. The USRP motherboard is capable of handling anything from DC to 2.9 GHz, but you need the matching daughterboards for specific ranges. Daughterboards include:

• BasicRX, 0.1-300 MHz receive
• BasicTX, 0.1-200 MHz transmit
• LFRX, DC-30 MHz receive
• LFTX, DC-30 MHz transmit
• TVRX, 50-860 MHz receive
• DBSRX, 800-2400 MHz receive
• RFX400, 400-500 MHz Transceiver
• RFX900, 800-1000 MHz Transceiver
• RFX1200, 1150-1400 MHz Transceiver
• RFX1800, 1500-2100 MHz Transceiver
• RFX2400, 2250-2900 MHz Transceiver

Also, you obviously need to have the matching antenna to actually receive something useful in a given frequency range.

Now, whether or not receiving particular frequencies is allowed or not will obviously depend on the FCC and similar regulatory organizations (in most, if not all countries, for instance, receiving police radio frquencies is illegal). Maybe the FCC regulation you mentioned is taking things a bit too far... cell phone standards like GSM are encrypted anyway (unless, of course, you go for a man in the middle attack).

As to your FCC quote, I suppose the question is whether being able to buy another daughterboard/antenna means it can be "readily altered to receive such frequencies." With respect to transmitting, the FAQ states that since it's sold as test equipment, you don't need a license. I wonder if the "test equipment" status supersedes that FCC statement as well?

This product seems to receive the entire spectrum by default.

No. The USRP motherboard is capable of handling anything from DC to 2.9 GHz, but you need the matching daughterboards for specific ranges. Daughterboards include:

• BasicRX, 0.1-300 MHz receive
• BasicTX, 0.1-200 MHz transmit
• LFRX, DC-30 MHz receive
• LFTX, DC-30 MHz transmit
• TVRX, 50-860 MHz receive
• DBSRX, 800-2400 MHz receive
• RFX400, 400-500 MHz Transceiver
• RFX900, 800-1000 MHz Transceiver
• RFX1200, 1150-1400 MHz Transceiver
• RFX1800, 1500-2100 MHz Transceiver
• RFX2400, 2250-2900 MHz Transceiver

Also, you obviously need to have the matching antenna to actually receive something useful in a given frequency range.

Now, whether or not receiving particular frequencies is allowed or not will obviously depend on the FCC and similar regulatory organizations (in most, if not all countries, for instance, receiving police radio frquencies is illegal). Maybe the FCC regulation you mentioned is taking things a bit too far... cell phone standards like GSM are encrypted anyway (unless, of course, you go for a man in the middle attack).

As to your FCC quote, I suppose the question is whether being able to buy another daughterboard/antenna means it can be "readily altered to receive such frequencies." With respect to transmitting, the FAQ states that since it's sold as test equipment, you don't need a license. I wonder if the "test equipment" status supersedes that FCC statement as well?

Note also that if you intend to do any FPGA programming with the USRP, according to this faqyou will need to spend and additional $300 to get 2 of each of the BasicRX and BasicTX boards for debugging purposes.

Ok, reading further (on the USRP FAQ page), i see that they are selling transmitters (and transceivers). They push the legal compliance to the user which might not hold up, but let's see...

From their FAQ... http://www.ettus.com/faq.html

Are there any license requirement for the transmit or transecive daughterboards?

The USRP is sold as test equipment, which has no licensing requirements. If you choose to use your USRP and daughterboards to transmit using an antenna, it is your responsibility to make sure that you are in compliance with all laws for the country, frequency, and power levels in which the device is used.

"If HF, the natural limitations of the frequency mean that you need a HUMONGOUS 'chunk of spectrum' for a high-speed transmission. Wider than most modern transmitters can do, reasonably."

I've got a transmitter that will do 30MHz. Right now. 60 if I go quadrature. 12 bits effective. How much do you want?

"Not trying to discourage you but I saw your posting about a $600 cost to manufacture your dream device today -- so where is it?"

Click on the link already. Here's a direct link to where you can order from Ettus Research. I have 6 of them right now and a bunch of students playing with them. They work great.

"Somehow I missed clicking on your link, but I assume it's a software-defined radio kit. Seen 'em... most have horrible sensitivity and can't meet basic 3rd order harmonic specs to keep from interfereing with things around them without add-on filters, yet. You end up eating massive amounts of DSP horsepower to chew through the garbage that the non-selective receiver hears, and putting out spurious and cruddy signals on the transmitter unless you add filtering or keep the power levels very low."

You've given a great critique of a hypothetical device I might have owned. The actual Ettus Research device has great specs. Because there's enough bandwidth to massively oversample in normal applications, there's no need for fancy analog filtering. Because there's a current-generation FPGA on board, transmission and reception don't need to load the CPU unreasonably.

This is not 80s spread-spectrum. Computers and electronics have advanced a bit since then, as witnessed by 802.11, CDMA, etc. There are already hundreds, if not thousands, of real experimenters playing with the Ettus device. It currently works as an HDTV receiver, and my students are well along in a variety of other applications as well.

Anyway, thanks for giving me something to investigate as far as current regs in your other post. I'll ask around.

There's a move afoot to restrict the sale of high-bandwidth analog-to-digital and digital-to-analog converters in the US, since they are used by open software-defined radio (SDR) manufacturers to produce hardware that could easily circumvent the broadcast flag. This is scary and ridiculous at the same time: I'm not sure whether to hope the restriction fails (and ubiquitous SDR solves the broadcast flag problem) or succeeds (and the US becomes an noncompetitive joke in a whole range of industries, providing a valuable object lesson). No, wait---I'll take the first thing.

Offtopic: why does slashcode elide so many HTML entities, including — ? It's really annoying, and seems totally gratuitous to me.

The FPGA contains digital up and down converters

The FPGA is not an analog RF front-end, but is for programmable digital logic (gate arrays).

The FPGA can only modify digital signals that have been through the ADC (or before they go through the DAC).

The USRP cannot transmit a RF signal greater than the ADC and basicTX module can handle. "... the BasicTX will put out about 1mW up to about 50 MHz ..." (Source: USRP FAQ).

Integer - 2400M MACs/sec
FP - 550M MACs/sec
Cost - $300-600+ for 1k Unit quantity

Intel 2GHz P4

Integer - 4000M+ MACs/sec
FP - 2000M MACs/sec
Cost - $158 for 2 GHz, $550 for 2.8 GHz (today)

(Source: DCC Sunday Seminar 2002 Software Defined Radio )