Signals Intelligence

Signals intelligence is the craft of learning about someone from the signals they give off — what they are saying, where they are, what gear they run — without them ever knowing you are there.¹ In this guide it serves two honest purposes: understanding the threat so you can defend against it, and the authorized monitoring of your own networks. It is not a license to eavesdrop, and the line between the two is sharp enough that the law comes first.

For most of its history signals intelligence meant a van full of equipment and a government budget. The RTL-SDR changed that — a thirty-dollar USB TV tuner that hobbyists found could receive almost any radio signal — and a laptop now does what a signals van once did.² Purpose-built kits like SIGpi pack a full collection setup onto a Raspberry Pi smaller than a paperback, and cheap machine learning now does the listening too, pulling signals out of the noise better than hand-written code. The gap between an agency and a motivated team narrows every year.²

SIGINT Categories

SIGINT splits by what it listens to. Communications intelligence (COMINT) is the traffic between people — voice, text, and data. Electronic intelligence (ELINT) is everything that emits but does not communicate: radar, navigation beacons, telemetry.¹ Two narrower categories round it out, one for instrumentation signals like missile telemetry and one for the faint, unintended emanations a device leaks.

The Intelligence Cycle

Collection is not the first step; thinking is. The intelligence cycle runs from planning and direction, through collection, processing, and analysis, to dissemination, and it begins by deciding what you need to know.¹ Before you place a single receiver, you answer three questions: what do you need to learn, which signals would tell you, and where and on what frequencies do those signals live?

Sources

1. MCRP 2-10A.1 Signals Intelligence (Light Fighter Library) — the SIGINT categories (COMINT, ELINT, FISINT), the intelligence cycle, and the passive nature of collection.
2. SIGINT for Anyone: The Growing Availability of Signals Intelligence in the Public Domain (RAND, Light Fighter Library) — the democratization of SIGINT by cheap software-defined radio.
3. FCC: Interception and Divulgence of Radio Communications & 18 U.S.C. §2511 (Wiretap Act) — receiving is broadly legal; intercepting private communications, and divulging or using what you hear, is not.

A software-defined radio throws out the fixed circuits of an ordinary radio and does the work in software instead. One small box of hardware feeds raw radio into a computer, and the program decides what it is — an FM station, an aircraft transponder, a pager, or a signal nobody has identified yet — so changing what you can hear becomes a matter of changing software, not soldering.¹

You do not need an expensive rig, or even Linux, to start. A thirty-dollar RTL-SDR dongle and a free program on the Windows or Mac laptop you already own will pull in most of the spectrum below 1.7 GHz, and that is plenty to learn on.^{1, 2} A wideband, transmit-capable radio like the HackRF, covered later, opens the rest of the band and the ability to replay signals, but it is a step up, not a starting point.²

SDR Architecture

Inside, an SDR is three stages. A radio front end filters and amplifies what the antenna brings in, an analog-to-digital converter turns that into numbers, and software does everything else.¹ Three figures describe what a given SDR can do: how wide a frequency range it tunes, how much spectrum it can grab at once (its bandwidth), and how finely it measures the signal (its bit depth).

Those figures trade against price. More bandwidth lets you watch more of the spectrum at once; more bits let you pick a weak signal out from beside a strong one; a wider tuning range reaches more bands. You pay for each, so you buy the radio that fits the job.¹

SDR Software Ecosystem

The hardware is only half of it; the software is what turned SDR from a lab instrument into something anyone can run.²

Sources

1. Introduction to Software-Defined Radio (LF-Course) (Light Fighter Library) — what an SDR is, its front-end / ADC / software architecture, the key specifications, and starting on a cheap RTL-SDR with free cross-platform tools.
2. RTL-SDR.com — the RTL-SDR Blog V4 (500 kHz–1766 MHz, native HF), the HackRF and HackRF Pro, and the SDR++ / SDR# / GQRX software.

The RTL-SDR is the dongle that started it all — a USB stick built to receive digital television that hobbyists discovered could be retuned to listen across the radio spectrum.¹ For about thirty dollars it covers roughly 500 kHz to 1.8 GHz, enough to hear aircraft, ships, weather satellites, pagers, and most of what a beginner wants to find, which is why it is where nearly everyone starts.²

Specifications

The current model, the RTL-SDR Blog V4, adds native HF reception to the original VHF and UHF coverage.²

Common Applications

What a thirty-dollar receiver can actually do is more than its price suggests.²

• FM broadcast and amateur radio monitoring
• Aviation communications (118-137 MHz) and ADS-B tracking (1090 MHz)
• Weather satellite imagery (137 MHz NOAA, 1.7 GHz GOES)
• Marine AIS vessel tracking (161-162 MHz)
• Trunked radio monitoring (P25, DMR, NXDN)
• ISM band device analysis (433 MHz, 915 MHz)
• Amateur radio digital modes (APRS, FT8, JS8Call)
• General spectrum survey and signal identification

Limitations

The price shows up in two places. The 8-bit converter gives it a narrow dynamic range, so a strong nearby transmitter can swamp the front end and bury the weak signal you were after, and the 2.4 MHz of bandwidth lets you watch only a thin slice of spectrum at a time.² It also cannot transmit. None of that makes it a toy — it stays the right tool for learning and for a surprising amount of real work — but it is why serious collection moves up to a better radio.¹

Sources

1. Introduction to Software-Defined Radio (LF-Course) (Light Fighter Library) — the RTL-SDR as the cheap entry point for learning SDR and SIGINT.
2. RTL-SDR.com — the RTL-SDR Blog V4 specifications (500 kHz–1766 MHz, 8-bit, 2.4 MHz bandwidth), common applications, and front-end filtering and LNA guidance.

The HackRF One is the radio you graduate to when an RTL-SDR is not enough. Where the dongle only listens over a narrow slice, the HackRF tunes from 1 MHz to 6 GHz, watches 20 MHz of spectrum at once, and — the real difference — can transmit as well as receive.¹ Created by Great Scott Gadgets with fully open hardware and firmware, it has become the standard tool of the security-research world.²

Specifications

SIGINT Applications

Its 20 MHz window makes it a fast surveyor: you can sweep a wide band, spot the signals that are active, and characterize them far quicker than a 2 MHz dongle.¹

Because it transmits, it also opens RF protocol work — capturing and decoding the proprietary links in key fobs, IoT devices, sensors, and other wireless gadgets to learn how they are built and where they are weak.²

That transmit ability is powerful and legally loaded. Replaying a captured signal to test a system is a real technique, but transmitting is regulated and can be a crime against systems you do not own, so keep it to your own gear, on a bench, with authorization — the law from the start of this section still applies.²

Accessories and Enhancements

A few add-ons turn it from a bench instrument into a field one, the most important being the PortaPack, which runs the HackRF as a standalone handheld with no computer at all.¹

Sources

1. HackRF with PortaPack Operation Guide (Light Fighter Library) — running the HackRF, and the PortaPack with Mayhem firmware for standalone, computer-free operation.
2. Great Scott Gadgets — the HackRF One (1 MHz–6 GHz, 20 MHz bandwidth, half-duplex transmit) and the HackRF Pro (100 kHz–6 GHz), open hardware and firmware.

Direction finding used to be a government capability; the KrakenSDR put it on a hobbyist's budget.² It is five RTL-SDR receivers locked to a single clock so they stay perfectly in step, wired to a calibrated five-antenna array, and from the tiny phase differences between those antennas the software computes the bearing to a transmitter — roughly 100 MHz to 1 GHz with the antennas it ships with.^{1, 2} It is the mirror of the threat from the chapter on direction finding: here the radio hunting an emitter is yours.

System Components

Direction Finding Technique

KrakenSDR finds direction the same way modern tactical sets do, by correlative interferometry.¹ All five antennas, set in a known pattern, hear the same signal at slightly different instants. A built-in noise source first calibrates the exact phase relationship between the five receivers, and then the software reads the phase differences across the array and solves for the angle the signal arrived from. One bearing points a line; bearings from two or three positions cross on the transmitter.

1. Antenna array receives signal simultaneously on all five elements
2. Noise source calibrates phase relationships between receivers
3. Software compares phase differences across antenna pairs
4. Correlative interferometry algorithm computes bearing
5. Bearing displayed on map overlay in mobile app
6. Multiple bearings from different locations triangulate transmitter position

Setup and Operation

1. Burn KrakenSDR DF image to SD card (8GB minimum for Pi4, 16GB for Pi5)
2. Mount antenna array on vehicle roof with proper spacing using paper templates
3. Connect antennas to KrakenSDR in correct order (numbering matters)
4. Power KrakenSDR and Raspberry Pi
5. Create WiFi hotspot on Android device (SSID: KrakenAndroid, Password: KrakenAndroid)
6. Access web interface to configure frequency and parameters
7. Enable noise source calibration before taking bearings
8. Drive to different positions to collect multiple bearings for triangulation

Practical Applications

• Locating interference sources affecting communications
• Amateur radio fox hunting and transmitter hunts
• Finding unauthorized transmitters or repeaters
• Tracking wildlife with radio collars
• Educational demonstration of RF direction finding
• Locating cellular towers and analyzing coverage

Sources

1. Direction Finding & Electronic Warfare Fundamentals (Light Fighter Library) — correlative-interferometry direction finding, bearings and triangulation, and the effect of multipath on accuracy.
2. KrakenRF — the KrakenSDR: five coherent RTL-SDR channels on one clock (24 MHz–1766 MHz), calibration hardware, and the five-element direction-finding antenna set.

Every signal looks and sounds like itself. An FM station is a fat symmetric blob on the waterfall, a pager fires short bursts, a frequency-hopping radio scatters across the band. Signal identification is the skill of reading those tells — bandwidth, modulation, timing, and how the frequency behaves — to name a transmission you have never seen before.¹

Signal Characteristics

Signal Identification Wiki (sigidwiki.com)

When the waterfall shows something you cannot place, the Signal Identification Wiki is the reference. It is a community catalog of more than five hundred signals, each with a waterfall picture, an audio clip, and its technical parameters, searchable by band and characteristic.² Capture a screenshot and a short recording of the mystery signal, note its frequency, bandwidth, and timing, and match it against the entries — the wiki even keeps Unknown categories for signals no one has identified yet.

When encountering an unknown signal, capture a waterfall screenshot and audio recording. Compare visual patterns and sound to database entries. Note the frequency, bandwidth, and any timing patterns. The wiki's Unknown Digital and Unknown Analog categories can help identify submissions or find similar unidentified signals.

Artemis Offline Database

Artemis carries that whole database offline, for the field where there is no internet. The current version, Artemis 4, is a full rewrite with the waterfalls and audio samples built in, and it lays the groundwork for automatic, machine-learning signal recognition.²

Common Signal Types

Sources

1. Electronic Warfare Fundamentals (Radio & Radar) (Light Fighter Library) — the signal characteristics that identify a transmission: bandwidth, modulation, timing, and frequency behavior.
2. Signal Identification Wiki & Artemis — the 500-plus-signal reference database with waterfalls and audio, and Artemis 4, its offline, machine-learning-ready companion.

Listening to the spectrum and collecting intelligence from it are not the same thing. Listening is turning the dial and hearing what is there. Collection is a plan: you decide what you need to know, sweep to find it, record it the same way every time, and protect the fact that you were ever there. The hardware barely matters; the discipline does.¹

Spectrum Survey

Start wide. Before you can target anything you have to know what the air around you normally holds, so scan whole bands and watch which frequencies stay busy, which sit quiet, and how that shifts through the day. That picture is your baseline — once you know what normal looks like, a new signal or a sudden silence stands out.¹

1. Define frequency ranges of interest based on intelligence requirements
2. Configure SDR for maximum bandwidth to scan quickly
3. Record waterfall displays to capture time-varying patterns
4. Note signal frequencies, bandwidths, and timing characteristics
5. Identify signals for detailed analysis or continued monitoring
6. Document the RF environment as a baseline for detecting changes

Targeted Collection

Once a signal is worth a closer look, narrow down onto it. Set the frequency range tight around the target, adjust the gain until the signal comes in clean without overloading the receiver, and record the raw IQ stream so you can process it later — or demodulate it live if you already know what it is.¹

Traffic Analysis

You do not have to break the message to learn from it. When a transmission happens, how long it runs, and whether traffic rises or falls all carry meaning on their own. Line that activity up against events you already know about, and the adversary's schedule, operating rhythm, and chain of command start to show through the pattern.¹

Geolocation

A single receiver tells you a signal exists; several receivers tell you where it is. The KrakenSDR — a five-channel coherent receiver running on a Raspberry Pi — does this automatically, using direction-finding math to point at a transmitter and even navigate you to it, accurate to within tens of meters under good conditions.² Without that gear, take a directional bearing from two or three separate positions and plot where the lines cross.¹

Sources

1. Introduction to Software-Defined Radio (Light Fighter Library) — the collection workflow: spectrum survey, targeted collection, traffic analysis, and collection OPSEC.
2. KrakenSDR (KrakenRF) — the five-channel coherent receiver for automatic radio direction finding and passive geolocation, runs on a Raspberry Pi 4 or 5.

Every radio you turn on cuts both ways. The same signal that reaches your own people also reaches anyone listening for it, so the analysis that protects you and the analysis that targets the enemy are the same questions asked from two seats. Work the framework below against your own emissions to shrink what you give away, and against the adversary's to read what they are giving away.¹

Propagation Analysis

• How far do emissions propagate under current conditions?
• How will terrain features affect signal coverage?
• What impact does weather have on propagation?
• How will reducing transmit power affect detection range?
• How will directional antennas concentrate or mask emissions?

Local RF Environment

• What frequencies does the local population use?
• Can RF usage be adjusted to blend with normal local traffic?
• How will your RF usage affect the local environment?
• How will adversary RF usage affect your systems?
• What unintentional interference risks exist?

Communications Architecture

• Are there automatic link establishment or 'always on' systems that emit without user action?
• How can units minimize emissions inside threat weapons engagement zones?
• What receive-only communications assets exist?
• Can forward units operate receive-only while inside threat WEZ?
• What is minimum information required to complete critical tasks?

Threat Assessment

• What adversary SIGINT capability exists in the area?
• What is the likely detection range for your emissions?
• How quickly can the adversary geolocate transmitters?
• What response capabilities does the adversary possess?
• What emissions can the adversary correlate with your activities?

Signature Management

Every transmission leaves a signature — a detectable fingerprint of when, where, and how you key up. You manage it the way you manage any other exposure: key up for as little time as possible, run the lowest power that still does the job, put terrain between you and the listener, vary your patterns so they cannot be predicted, and time your emissions so they do not line up with the activity you are trying to hide.¹

Sources

1. Electronic Warfare Fundamentals (Radio & Radar) (Light Fighter Library) — emission control (EMCON), signature management, and the threat-assessment framework for friendly and adversary emissions.

Communications intelligence, COMINT, is the work of listening in on traffic between people. The content is the obvious prize, but even a message you cannot read still tells you who is talking, when, and how often — and that metadata is intelligence on its own. The skill is knowing how the common systems work and where they leak.¹

Voice Communications

Old-fashioned analog voice — AM, FM, single sideband — comes straight out of an SDR with the right demodulation; what is said is right there in the clear. Digital voice modes like P25, DMR, NXDN, and D-STAR need decoding software first, but a great deal of that traffic still runs unencrypted, so once you decode it you can follow it. Encrypted traffic, AES-256, stays closed without the key.¹

Data Communications

A surprising amount of data goes out in the clear. Aircraft positions (ADS-B), ship positions (AIS), amateur position beacons (APRS), and pager messages (POCSAG and FLEX) all decode with off-the-shelf software, and cheap Internet-of-Things gadgets often use sloppy protocols that quietly broadcast facts about the people who own them.¹

Trunked Radio Systems

A trunked system does not park each group on a fixed channel; it hands out whatever channel is free and announces the assignment on a separate control channel. To follow a conversation you have to follow those announcements, which is exactly what SDRTrunk automates — it watches the control channel and the voice channels at once and stitches the talk group back together.²

Network Identification

Radio networks give away their own shape. DMR systems stamp every transmission with a radio ID and a talk-group ID; P25 carries a Network Access Code and talk-group information. Log those identifiers over time and the organization's structure — who reports to whom, which units talk to which — starts to assemble itself.²

Sources

1. Introduction to Software-Defined Radio (Light Fighter Library) — analog versus digital voice, and the data protocols that transmit in the clear.
2. SDRTrunk & RTL-SDR digital-voice decoding guide — following trunked systems by control channel and reading network identifiers; the DSD+, OP25, and SDRTrunk decoders.

Not every emission is a conversation. Radars, jammers, and beacons pour out signals that carry no message yet say a great deal about the machine behind them. Electronic intelligence, ELINT, reads those non-communication emissions — mostly radar — to work out what a system is, what it is for (searching, tracking, or guiding a missile), and where it sits. Done right it is early warning: it tells you a threat is looking before it shoots.¹

Radar Signal Parameters

Common Radar Types

Radars come in families by job. Surveillance radars sweep a wide area at lower frequencies — the L, S, and C bands — trading resolution for range so they can see far. Fire-control radars narrow to a tight beam at higher frequencies, the X and Ku bands, for the precision needed to track one target. Missile-guidance radars go a step further, lighting up a target so a missile can ride the reflection home.¹

Radar Warning Receiver Concepts

A radar warning receiver does for a cockpit what your ears do in the dark: it catches an emission, classifies it, and tells the crew a threat is out there. SDR-based ELINT works on the same principle — match a captured signal against a library of known emitter parameters to name the radar, and watch for changes in that signal as a sign the threat picture is shifting.¹

• Surveillance radar scanning past your position: periodic illumination
• Track radar locked onto your position: continuous illumination
• Missile guidance radar active: imminent threat
• New emitters appearing: changing tactical situation
• Emitters going silent: possible EMCON, repositioning

SDR Limitations for ELINT

A consumer SDR can only reach so far. Many radars work above 6 GHz, past the top of a HackRF, and a wideband radar pulse can be wider than the slice of spectrum the SDR can see at once. Professional ELINT runs on specialized wideband receivers backed by deep signal libraries. SDR ELINT is real and worth learning, but treat it as a teaching tool and a limited capability, not dependable threat warning.¹

Sources

1. Electronic Warfare Fundamentals (Radio & Radar) (Light Fighter Library) — radar signal parameters, radar families, the radar-warning-receiver concept, and the limits of SDR-based ELINT.
2. KrakenSDR (KrakenRF) — using existing broadcasts as illuminators for basic passive-radar detection without emitting.

These are the tools that keep coming up across SIGINT work. None is the single right answer; each earns its place at a particular job, so the tables below lay out what every receiver, program, and reference is actually good for. Prices are approximate street prices and drift with stock and chip costs.¹

Hardware Platforms

Software Tools

Online Resources

Sources

1. Introduction to Software-Defined Radio (Light Fighter Library) — the SDR hardware tiers, the receiver and analysis software, and the learn-on-known-signals starting path.
2. RTL-SDR Blog & Signal Identification Wiki — current hardware availability and street pricing, and the signal-identification reference; prices reconfirmed 2026-06-19.