Assessing a Structure

Reading a structure's power starts with open-source intelligence (OSINT): the public records anyone can pull before going near the site. From these alone you can name the utility that feeds the building, find where the service enters, read how much it carries, and check whether it is energized.

The utility feeds the structure through a transformer, past the meter, to the main panel; the panel then divides that supply into the branch circuits that serve the building and, sometimes, into subpanels deeper inside.

Start in OpenStreetMap, a free public map anyone can query: it carries the electrical grid, where the power key covers the facilities that generate and distribute electrical power,34 tagged as power=line, minor_line, tower, pole, transformer, and substation.34 Module 04 used Overpass Turbo (overpass-turbo.eu) to query OpenStreetMap for salvage sites; the same tool queries the grid. Paste this, move the map over the target, and press Run.

[out:json][timeout:60];
(
  nwr["power"="transformer"]({{bbox}});
  nwr["power"="pole"]({{bbox}});
  nwr["power"="tower"]({{bbox}});
  nwr["power"="line"]({{bbox}});
  nwr["power"="minor_line"]({{bbox}});
  nwr["power"="substation"]({{bbox}});
);
out center;

The query on the left, the result on the right. One run over Portland returns the mapped grid, transmission corridors showing as strings of towers. The status bar reports what came back: 591 points and 44 lines.

It plots poles, lines, transformers, and any substation, so you read which direction the feed comes from and whether it is overhead distribution or a nearby substation. Open Infrastructure Map renders the same data as a finished grid map. It draws the world's infrastructure from the OpenStreetMap database, sourcing all of its data there,35 so you trace a substation along its distribution lines to the target without writing a query.

OpenStreetMap uses power=substation for a facility that controls the flow of electricity in a power network using transformers, switchgear, or compensators,41 and its voltage tag records the substation's voltages ordered from highest to lowest.41 Read it in that order: the first number is the voltage coming in, the last the voltage going out. When run over inner Portland, the query returns Holladay Substation, operated by PacifiCorp, tagged substation=distribution with voltage=115000;12470:34 115 kV in, 12.47 kV out. That drop from transmission voltage to distribution voltage is the same one the next unit reads at the pole transformer; record both voltages before you go to the site. A substation tagged substation=transmission carrying a longer voltage list sits further up the chain and does not feed structures directly.

Querying by radius instead of map view narrows this from a city to one structure. The Overpass around filter selects every element within a radius in metres of the elements in the input set, and it measures from coordinates you supply instead of the input set when you give them.42 Give it a radius in meters, a latitude, and a longitude, and it returns only what stands near that point. The nwr at the start of each line is shorthand for nodes, ways, or relations,42 so one line covers all three element types.

[out:json][timeout:90];
// everything electrical within 300 m of one point
(
  nwr["power"="pole"](around:300,45.5152,-122.6784);
  nwr["power"="minor_line"](around:300,45.5152,-122.6784);
  nwr["power"="transformer"](around:300,45.5152,-122.6784);
  nwr["power"="substation"](around:300,45.5152,-122.6784);
  nwr["power"="generator"](around:300,45.5152,-122.6784);
  nwr["man_made"="street_cabinet"](around:300,45.5152,-122.6784);
);
out center;

Ground-level utility boxes are mapped as man_made=street_cabinet, a cabinet standing in the street that houses the technical equipment operating facilities such as electricity or street lights,43 narrowed by utility=power to a cabinet housing devices for electricity distribution.43 On-site generation is mapped as power=generator, a device that converts one form of energy to another, such as an electrical generator,44 with generator:source=solar naming the source. A structure with tagged generation has a second supply feeding its panel, covered in Unit 03.

Utilities publish live outage maps; use them to check whether a segment is energized without going near it. Florida Power and Light runs an online interactive map that shows where power is out anywhere in its service territory.45 The limit is granularity, and the utilities state it themselves. FPL withholds address-level detail, and says so: “for safety and security reasons, FPL's Power Tracker does not display outage information for specific street addresses.”45 Orange and Rockland places each outage symbol at a center point among all the customers that outage affects, so one symbol can stand for multiple homes and businesses and can cover several streets or, in a major event, miles, and the map updates every 15 to 30 minutes.46

For the transmission end, the Homeland Infrastructure Foundation-Level Data program publishes geospatial data sets of electric power transmission lines through data.gov as a United States government work.47 Confirm a portal is still live before relying on it. The U.S. Department of Homeland Security shut down HIFLD Open, its public data portal, in August 2025, and the open datasets were preserved in the Homeland Security Digital Library instead.48

Many jurisdictions publish assessor and electrical-permit records, which give the year built and sometimes the service size and inspection history. They are the paper trail behind the panel's “APPROVAL FOR ELECTRICAL” sticker. Availability varies by jurisdiction, so do not count on them. Sanborn fire-insurance maps, public-domain and held by the Library of Congress,36 give a building's footprint and construction, but they were drawn for fire underwriting and predate electrification in many editions, so they do not reliably show electrical service. No open database holds the structure's internal wiring, its branch-circuit layout; you read that on site, at the panel.

Test the coverage rather than trusting it. OpenStreetMap is contributed, not surveyed, so coverage varies by area and feature: a live query over the same Portland area returned 230 poles and 20 substations but no individual distribution transformers, which are mapped far less often than the lines and poles carrying them. An empty result means nobody has mapped it, not that nothing is there. Read every open source as a lead to confirm on the ground.

Open-source reconnaissance cannot give you the state of the service: for that you go and look, still without touching anything.

The service is everything that brings power from the utility to the building: “the conductors and equipment for delivering electric energy from the serving utility to the wiring system of the premises served.”24 It enters in one of two ways. In older and rural areas it comes overhead: high-voltage lines drop through a transformer to the property,17 then run down the wall in a conduit called the service mast, which caps at the masthead, or gooseneck, a fitting that caps the conduit so moisture cannot enter and that protects the conductors where they pass in.17 Newer areas bury the supply as an underground service lateral. Either way it reaches the meter, the utility's running count of energy in kilowatt-hours, and enters the panel.

An overhead service entrance: the drop lands on a mast above the roofline, capped by the masthead, conductors hanging in drip loops. Photos: Chetvorno, Wikimedia Commons, CC0; Weatherhead, CC0.

The service point divides the two sides: “the point of connection between the facilities of the serving utility and the premises wiring.”29 Everything upstream of it, the pole hardware or the pad, is the utility's equipment, carrying its voltages; the drop or lateral, the meter, and the service equipment are the premises side you read.

On a pole, the transformer feeding a structure hangs below the primary conductors, which run at medium voltage, typically 12 to 34.5 kV for local distribution.30 At a riser pole the protective hardware is visible from the ground, because a transition point between an aerial section and an underground section carries primary fuse cutouts and surge arresters.30 The drop off that transformer is the run of overhead service conductors from the last pole or other aerial support to the service-entrance conductors at the building.29

Underground, the transformer is a pad-mounted box at ground level, and the buried lateral reaches the structure through handholes or pull boxes. That lateral runs from the street main to the first point of connection to the service-entrance conductors.29 A service or meter pedestal stands away from the building it feeds; for a manufactured home the code sets that distance, requiring the service equipment be located “in sight from and not more than 9.0 m (30 ft) from the exterior wall of the mobile home it serves.”31

These are the two transformers that feed a structure. From the street, either one tells you whether the structure's supply is overhead or underground. On a pole, the single-phase can hangs below the primary conductors it taps. At ground level, the pad-mounted cabinet does the same job for a buried lateral; the caution label is the utility's, and the cabinet stays closed. Photos: Glogger, Wikimedia Commons, CC BY-SA 3.0; Simon-says-elkay, Wikimedia Commons, CC BY-SA 4.0.

“All lines are considered energized until they are completely disconnected and isolated from all electrical power sources,”25 and the medium-voltage side is beyond a lay operator: working on energized lines or equipment operating at 17,000 volts and above is not recommended.25 Identify the pole or pad to tell an overhead service from an underground one and to locate the service point; keep clear of the primary side.

You read whether a structure is drawing power before opening anything. A fire-service procedure for evaluating a vacant building makes this the first step: during the exterior survey, observe the status of the utility meters and valves on the outside of the building to determine whether electricity and water are available.32 The meter is the clearest sign. An older electromechanical meter carries an aluminum disc that turns at a speed proportional to the power passing through the meter, and each revolution passes a fixed amount of energy, the meter constant Kh, stated in watt-hours per revolution.33 A turning disc means current is flowing; a still disc means little or none. The Kh constant is printed on the nameplate: 3.6 watt-hours per revolution on the Westinghouse below. Read it to identify the meter, not to compute a load: this module reads the disc for state, whether the service is drawing or idle, and takes any current measurement at the panel with the clamp meter in Unit 03. A newer smart meter replaces the disc and dials with a digital register reading a cumulative total, and records consumption in intervals as fine as 15 minutes that it reports to the utility.20 Neither meter shows present demand as a number, so a turning disc is the only live reading on the glass.

1. Pointer dials. A running total of energy, read left to right. Not present demand.
2. Kh constant. Watt-hours per turn of the disc. This meter, 3.6.
3. Service rating. 240 volts, 3-wire: the split-phase supply (Unit 03) the panel divides.
4. Serial number. Identifies this meter to the utility.

The disc below the dials is the live indication, turning at a rate set by the load. Photo: Brian Cassidy, Wikimedia Commons, CC BY 2.0.

1. Register. A running total of energy delivered, not what the building draws now.
2. Optical port. The local read point. The same data also leaves this meter over the air, on 902 to 928 MHz, the signal Unit 07 identifies.
3. Class and form. The meter’s own current rating and socket form, not the service size. The service rating is set by the main disconnect, read in Unit 03.87
4. Utility. Names the operator, which you look up to find the tariff, the outage map, and the service territory.

Both meters state the same service, 240 volts and 3-wire, and each carries its own Kh constant: 3.6 on the Westinghouse, 10.0 on the Aclara. Photo: 277volts, Wikimedia Commons, CC BY-SA 4.0.

A drop still in place from the transformer to the masthead, or a lateral running from the pad to the structure, means the utility feed is connected. Whether the meter is seated in its socket or the socket stands empty is another sign. Utility practice on disconnecting a service varies, so an empty socket, a dark display, or a still disc is a reason to confirm, not proof the service is dead. Treat the service as energized until it is proven disconnected and isolated.25

The meter sits in one of two places. On the wall, the meter plugs into a socket enclosure and the utility seals the ring around it: the socket is the fixed half and the meter the removable one, which is why a socket can stand empty. On a pole, the same kind of enclosure stands apart from any building, so the service is read at the pole rather than at a wall. Photos: Famartin, Wikimedia Commons, CC BY-SA 4.0 (wall, pole).

The fuse cutout on the pole reads from the ground as well. A cutout is a protective device on the primary side, its rating set by the current necessary to protect the equipment or the feeder.30 An open-type cutout carries its fuse in a hinged holder that bridges two contacts, and from the ground you read its position: a seated holder is closed and in service, and a blown fuse drops the holder open so it hangs down. Because the cutout sits in the same line as what it protects (in series with it), an open one means that circuit is interrupted at the pole.

A fuse cutout in service: the tube bridges the contacts. When the fuse blows, it pivots open at the hinge and hangs down. Photo: Greensburger, Wikimedia Commons, public domain.

Read three things on a panel: the main disconnect, the branch breakers, the circuit directory on the door. Photo: Famartin, Wikimedia Commons, CC BY-SA 4.0.

The main disconnect, the single breaker or switch that cuts all power to the panel, sets the size of the service. Its amperage is stamped on it or printed on the panel label, and that number is the ceiling on everything the building draws at once; an inspector reads the amperage rating on the main service disconnect first, wherever it is labeled.3 Residential services commonly run from 100 to 200 amperes.17 The floor for a one-family dwelling is 100: “For a one-family dwelling, the service disconnecting means shall have a rating of not less than 100 amperes, 3-wire,” with 60 amperes the floor for other installations and 15 or 30 for one- and two-circuit services.1 When the main is not labeled, read the size from the service-entrance conductor, because a larger amperage requires a larger conductor:17 a 200-ampere service runs 2/0 copper (or 4/0 aluminum), a 100-ampere feed 3 AWG copper.17

Most homes take a 120/240-volt service, where the cable assembly carries two ungrounded (live or hot) conductors, each supplying 120 volts, and one neutral or grounded conductor that acts as the return.17 Either hot leg to the neutral is about 120 volts and runs the lights and outlets; the two hot legs across each other are about 240 volts and run the range, the dryer, and the other large loads. The transformer makes both by tapping the center of its secondary winding: the center tap is the grounded neutral, each half of the winding is one 120-volt leg, and the two legs across the whole winding are 240 volts. The amperage rating is how much the two legs carry together.

The transformer secondary is center-tapped: ends are hot legs L1 and L2, tap is neutral N. Leg to neutral 120 V, leg to leg 240 V.

From the main disconnect the panel divides the service into branch circuits, each protected by its own breaker, and the breaker rating is the circuit rating. A branch circuit takes the rating of its overcurrent device, and the code sets those ratings at 15, 20, 30, 40 and 50 amperes.2 A 15- or 20-ampere breaker feeds general lighting and receptacles; 30, 40, and 50 feed larger fixed loads. The breaker opens the circuit on overcurrent, the condition in which a circuit carries more than its rated load in amperes; fuses, circuit breakers and GFCIs are the devices that prevent it.4 That rating sets the circuit's ceiling, and the spare capacity left below what it already carries is the circuit's headroom. The code sizes a circuit with a margin for steady loads: the overcurrent device rating “shall not be less than the noncontinuous load plus 125 percent of the continuous load.”15 A continuous load should stay at or below 80 percent of the breaker rating, so a 20-ampere circuit holds about 16 amperes of steady draw.

Three protective devices: the plug fuse (older, now largely replaced), the circuit breaker, and the GFCI. Each opens on overcurrent. Photos, Wikimedia Commons: plug fuse by Jjeka (CC0); breaker by CyberXRef (CC BY-SA 3.0); GFCI by Wtshymanski (CC BY-SA 3.0).

A ground-fault circuit interrupter (GFCI) disconnects the circuit when the current in the energized conductor and the current returning on the neutral do not match, the leak that would flow through a person,18 and the code requires it on outlets in bathrooms, outdoors, unfinished basements, kitchens, and other wet or grounded locations.16 An arc-fault circuit interrupter (AFCI) de-energizes the circuit when it detects an arc fault,16 protecting the wiring against arcing. Both are still breakers, and you read them the same way. Some slots hold two thin tandem breakers instead of one, so count the circuits, not the slots.

A subpanel is a second panel fed from the main. A service panel that holds no disconnect is a distribution panel,17 and it sits elsewhere in the structure: a garage, a basement, an addition. When the directory marks a feed for a remote distribution panel,17 find it and read it too. A structure's power is the main panel plus every subpanel it feeds.

Some structures are not powered only from the grid: on-site generation (solar, a battery, or a generator) feeds the panel through an inverter, a transfer switch, or a backfed breaker. Where interconnected sources are present, “a permanent plaque or directory, denoting all electrical power sources on or in the premises, shall be installed at each service equipment location,”22 so the service equipment itself should name what else feeds it. A generator ties in through transfer equipment, required to be “designed and installed so as to prevent the inadvertent interconnection of normal and alternate sources of supply,”23 and an optional standby system supplies on-site generated power to selected loads.23 The transfer switch usually controls a subpanel that feeds a few circuits for lights, outlets and critical appliances.21 Whatever ties in this way stays live even when the grid goes down. This unit reads the common case, a single-family, grid-fed, 120/240-volt residential service;17 commercial and multi-unit buildings take heavier, often three-phase services, which you read with more legs and more panels.

To follow a circuit from the panel to where you would use it, read the wiring method. Conduit comes in a few identifiable types: rigid steel, thin-wall steel tubing (EMT), PVC, and flexible metal.5 The type and its route tell you where a circuit runs and where you can reach it.

Flexible metal conduit, jacket stripped to the armor. The other wiring methods that show where a circuit runs are rigid steel, EMT, and PVC.

To size a real draw you measure the current a circuit carries, not the breaker number, with a clamp meter. A clamp meter combines a digital multimeter with a current sensor: pressing the trigger opens the jaw, and you close it around one wire of the circuit without touching that wire, so the measurement is non-contact.7 The jaw is a current transformer: the hinged ferrite-iron jaws close into a ring that concentrates the magnetic field around the conductor, a coil wound on that core is the secondary winding, the conductor inside the jaw is the single-turn primary, and the induced current is scaled down and shown as amps.7 Clamp one conductor only, never a whole cord, or the line and neutral currents cancel out.

The clamp is a current transformer: the clamped conductor is the primary, a coil on the jaw the secondary. Clamp line and neutral together and it reads zero.

A tap point is an accessible connection to a branch circuit that has headroom. Which points you can use depends on your access:

• From outsideYou can reach GFCI-protected receptacles, which the code requires outdoors,16 the meter base on the exterior wall, and any disconnect mounted outside.
• From insideYou can reach every receptacle, switch box, junction box, and subpanel17 on a branch circuit, including interior circuits that are out of reach from outside, such as a bedroom's receptacles or a closet subpanel.

What is hardwired with no receptacle, a furnace or a dedicated 240-volt appliance run, is not a tap from either side. A breaker with headroom and a reachable point make a usable tap only when both are on the same circuit; confirm that by switching the breaker off and noting which receptacles and fixtures lose power.

Everything downstream of the meter is the load side, and current drawn there passes through the meter and adds to its count. A tap ahead of the meter, on the supply side, draws current that never passes through it, so nothing registers, though it is on the utility's conductors.

A tap can be detected three ways:

• Protective devicesA draw over the circuit's continuous limit trips the breaker;15 current that returns on a path other than the neutral trips a GFCI.18
• The meterSmart (AMI) meters record kilowatt-hour (kWh) consumption in intervals as short as 15 minutes,20 so a load-side tap shows as a step in the recorded profile. Keep the draw small against the structure's load profile, the ordinary rise and fall of its power use through the day; a supply-side tap shows nothing at the meter.
• The supplyA switch-mode supply pushes radio-frequency noise back onto the wiring; the FCC limits the radio-frequency voltage a device conducts back onto the AC power line across the band 150 kHz to 30 MHz.19 A worn or uncertified switch-mode supply is noisy both on the powerline and across the radio-frequency spectrum that the next unit surveys; a clean supply, whether a linear (non-switching) type or a battery, is quiet.

The clamp meter in the hand: the trigger opens the jaw to close around one conductor without breaking the circuit. Photo: K. Krallis, SV1XV, Wikimedia Commons, CC0.

Put the reads together into one pass over a structure:

1. Find the meter. Outside, note whether the service comes in overhead (down a mast to the masthead) or underground.
2. Read the main disconnect. At the panel, with the dead front on, read its amperage. When it is not labeled, infer the size from the service-entrance conductor gauge.
3. Read the directory. Note which breakers feed what, and each breaker's rating.
4. Find the subpanels. Follow any feed marked for a distribution panel and read that panel the same way.
5. Measure a draw. With a clamp meter set to amps AC and a line splitter, clamp one conductor of a running load and read the amps it carries.7 The reading rises when the load turns on and falls when it turns off.
6. Compute the headroom. Take 80 percent of the breaker's rating as the continuous limit, then subtract the measured draw.
7. Locate the tap points. Given your access, list the reachable points that sit on circuits with headroom: from outside, exterior receptacles and any outside disconnect; from inside, receptacles, junction boxes, and subpanels. Confirm a point and a breaker are the same circuit before you count it.
8. Check it blends in. Keep the tap under the 80 percent limit and on one hot-and-neutral pair, so no breaker or GFCI trips; keep the steady draw small against the structure's load profile, so it does not step up an interval-recording meter; and use a clean supply, so it adds no powerline or RF noise.

With a point chosen and its headroom known, the tap is the connection itself: matched to the circuit, sized and protected for what it draws, and isolated from the utility. There are two ways to connect: plug into a receptacle, or splice into a box.

Make the tap in this order:

1. De-energize it, or plug in. At a receptacle you plug in and open nothing. To wire into a box or a fixture, switch the circuit off at its breaker and confirm it carries no voltage: “all lines are considered energized until they are completely disconnected and isolated from all electrical power sources,” so an “approved voltmeter, scope meter, or voltage detector must be used for this test.”25
2. Match conductor to conductor. Join hot to hot, neutral to neutral, ground to ground, with “splicing devices identified for the use”; the joint is covered “with an insulation equivalent to that of the conductors,”26 and the splice goes inside a box.27
3. Size your own conductor. Your tap's cord or wire carries the current, so size it to the load; conductors are “protected against overcurrent in accordance with their ampacities.”28
4. Fuse the tap. Put an overcurrent device in series with your hot leg, rated to your conductor and load. A fuse becomes part of the circuit once it is installed in series with the hot wire, and its element sets how much current passes before it opens.4
5. Never back-feed. Do not energize the premises wiring or the utility side from your own source. A generator connects only through transfer equipment, “designed and installed so as to prevent the inadvertent interconnection of normal and alternate sources of supply.”23
6. Stay under the headroom. Hold the draw under the circuit's 80 percent limit and the service ceiling you read, so no breaker or GFCI trips and nothing steps up on the meter.

The taps so far are load-side and reachable: a receptacle, a box, or a subpanel on a branch circuit, all downstream of the meter and inside the building. Reaching power from the outside is the harder case, and two things set its limits: which side of the meter you are on, and which voltage you are near.

Only the secondary side is approachable. The service drop, the service-entrance conductors, and the meter run at 120/240 volts, the same as the branch circuits inside. The primary side, which includes the pole lines, the transformer's high side, and the cutouts, runs at medium voltage, typically 12 to 34.5 kV for local distribution.30 It is lethal and utility-only, as Unit 02 established, and nothing on it is ever a tap.

A connection made ahead of the meter is a supply-side connection, and the code treats that location as a special case. Only a closed list of equipment is “permitted to be connected to the supply side of the service disconnecting means,”37 and that list is meters, current-limiting devices, instrument transformers, and specific standby and interconnection taps, not a load. A load drawn there is outside what the code permits, and because it sits ahead of the meter it is unmetered: the current never passes through the meter's counting register. It is also more dangerous than a load-side tap, because no breaker sits between you and the transformer, so the conductors are live and their current is unlimited, and they stay energized until proven isolated.25

Reaching an exterior drop or service point can mean working at height and near live conductors, and the hazard order there is fixed: the fall first, the voltage second. Above four feet on a pole or tower, fall protection is required, not optional: “each employee in elevated locations more than 1.2 meters (4 feet) above the ground on poles, towers, or similar structures shall use a personal fall arrest system, work-positioning equipment, or fall restraint system.”38

The standard for electrical protective equipment covers rubber insulating gloves among other equipment,39 and rates each glove by class to a maximum use voltage:

For 120/240-volt secondary work, Class 00 or Class 0 covers the voltage. The higher classes exist because line crews work on energized medium voltage with training, testing, and rescue backup that a lay operator does not have, and a glove's class rating supplies none of those things. “Under-rated protective equipment should not be used,”25 and no glove makes the primary side approachable.

The Dolos platform is a small computer that senses, communicates, and acts, and a sensor or comms node built on it draws very little. A Raspberry Pi Zero 2 W idles at about 100 mA (0.6 W) with its video and status LED off (third-party measured),40 a few thousandths of an amp at 120 volts. Against a branch circuit with several amperes of headroom, that draw fits under the 80 percent limit with room to spare and stays inside the structure's load profile, so an interval meter does not step up on it. Read the service, size the headroom, and make the tap under it; the structure's own power then runs the node. Dolos is one platform that fits there, not the only one; size any load the same way, against the headroom you read.

Unit 09's field exercise is read-only and does not ask you to make a tap. This unit is set down so you can size and plan one, and so you can read what a structure's supply would allow a load to draw; make a tap only where you have both the right and the reason.

In the United States every frequency is allocated to a service, and those allocations are published in the FCC's Table of Frequency Allocations,59 so you know before you arrive what each band is assigned to carry. Reading the spectrum at a site is an inventory, not a discovery: you go to find which of those allocated bands are actually in use, how strong they are, and how constant.

An allocation says what a band is for, not what is on it at your site. A rural fire frequency and a downtown trunked system are both Part 90; only one of them is likely to be active where you stand.

Every location has a noise floor, the background level of radio energy that sits beneath the individual signals. In a city that floor is raised by man-made noise, and the amount is not uniform. The International Telecommunication Union (ITU) records this as a straight-line relationship. For a city location the median man-made noise figure follows Fam = 76.8 − 27.7 log f, with f in megahertz, valid from 0.3 to 250 MHz,6 and a separate formula for business areas continues into the UHF region as Fam = 44.3 − 12.3 log f for 200 to 900 MHz.6 Both formulas show the same trend: man-made noise is worst at the low end of the spectrum and falls as frequency rises. Worked once with the city formula: at 5 MHz, log 5 is 0.70, so Fam is 76.8 minus 27.7 × 0.70, about 57 dB; at 150 MHz, log 150 is 2.18, so Fam is 76.8 minus 27.7 × 2.18, about 17 dB. The same city is roughly 40 dB noisier at 5 MHz than at 150 MHz. In practice a quiet rural site sits near −110 dBm, while a dense urban site runs −95 to −80 dBm, raised by the Wi-Fi, cellular and industrial emitters around it.67 A city location can therefore bury signals up to 30 dB fainter than a rural site would still detect.

Urban terrain degrades radio in two ways that field guidance sets out directly: buildings stand in the transmission path and block it, and paved surfaces conduct poorly.66 VHF suffers most, because a VHF set needs a line of sight between the two antennas, and at street level in a built-up area that line of sight is often not available.66 A band that is busy two streets away can read empty from a courtyard, so where you stand is part of the measurement, and one reading from one position does not describe the whole structure.

A sweep shows the two things you are reading for, what is occupied and what is vacant. Occupied spectrum is a strong, often constant return at a fixed frequency. Vacant spectrum is a quiet stretch sitting near the noise floor. A location's usable spectrum is the gap between the two.

The exact floor and the exact busy bands belong to the site and the time, so you do not take a number from a table; you measure. Sweep the bands at the structure, at more than one time of day where you can, and record the floor and the occupied ranges.

You read the sweep on two linked displays. The FFT plots signal strength against frequency, so it shows what is on the air right now. The waterfall stacks that same plot over time, so a signal that transmits continuously draws an unbroken track and one that keys on and off draws a broken one.13 Lower the display floor until the background flattens into an even band; the noise then sits at the bottom of the scale and weak signals stand above it as brighter tracks.13 The tools below are the open ones that do this without a license or a subscription.

An SDR++ sweep has two parts. Top, the FFT: strength against frequency, with an FM station near 91.7 MHz standing well above the flat noise floor at the edges. Bottom, the waterfall: the same over time, where the constant bright band is occupied spectrum and the dark-blue stretches either side are vacant spectrum sitting at the floor. SDR++ capture: Konung yaropolk, Wikimedia Commons, CC0.

What a receiver buys you for survey work is instantaneous bandwidth and dynamic range. Instantaneous bandwidth is how much spectrum the device digitizes at once, so a receiver that takes 2.4 MHz has to retune many times to cover a band that a 56 MHz receiver captures in one pass, and every retune is time during which the rest of the band is unobserved. Dynamic range, set largely by the converter's bit depth, is how faint a signal you can still resolve while a strong one sits nearby, which is the ordinary condition in a city. A cheap dongle is enough to learn on and to find the obvious occupants of a band. It is slower and coarser when many signals crowd a band at once, which the receivers below handle better.

RTL-SDR V4

Airspy

ANTSDR E200

Three points on the same ladder. The RTL-SDR is a receiver on a USB stick. The Airspy adds bandwidth and converter bits in a similar package. The ANTSDR E200 is a different class of device: a Zynq system-on-chip with its own Ethernet interface and its own Linux, so it runs the capture itself rather than depending on an attached computer.

HackRF One with PortaPack

tinySA Ultra

Two that need no laptop. A PortaPack gives a HackRF a screen, a control wheel and a battery, so the capture happens in the hand rather than on a machine beside it. The tinySA Ultra is a purpose-built analyzer: the readout names the center frequency and span at the bottom, the resolution bandwidth and attenuation down the left, and the input limits are printed on the case beside the socket, because exceeding them is how these instruments fail.

The survey method does not change with the hardware. soapy_power runs the same occupancy sweep this module uses on any supported device, producing a power spectrum from any device SoapySDR supports, including the RTL-SDR, Airspy, SDRplay, HackRF, bladeRF, USRP and LimeSDR,75 so a capture written for a dongle runs unchanged on better hardware and simply finishes sooner.

Anything of 50 ohms will connect: a 50 ohm antenna and its feeder mate to the receiver through a standard SMA connector.72 A wideband vertical such as a discone is the general-purpose choice for survey work because it receives across a broad range from every direction at once, which is what an inventory needs. A directional antenna receives further along one bearing and is what you reach for to locate a source rather than to survey. Orientation matters as much as type, because a transmission's waves are oriented a particular way, its polarization, and the antenna must be turned to match it. Rotating the antenna about its axis, to horizontal or to vertical, raises the received level markedly once it matches, and vertical is the position to start from.72

Most of a survey rig is these two parts. The receiver is a USB dongle whose tuner and demodulator chips replace equipment that once filled a rack. The antenna is a discone, whose disc and sloping cone give it usable response across a wide range of frequencies rather than at one, which is why it suits a survey. Photos: Dsimic, Wikimedia Commons, CC BY-SA 4.0; Adamantios, Wikimedia Commons, CC BY-SA 3.0.

An antenna is the visible half of an emitter, so identifying one on a rooftop or a tower tells you roughly what band it works in before you sweep anything. The chain is short and it has a hard limit: the antenna's shape and size narrow the frequency band, the band narrows the likely service, and the service is confirmed only by the database lookup of Unit 07 and a sweep. The antenna's form points you toward a band, but it does not name the service.

Size is set by the wavelength an antenna works at, and wavelength by frequency. The relationship is fixed: wavelength in meters is 300 divided by the frequency in megahertz.90 A resonant element is cut to a fraction of that wavelength: a half-wave element measures 468 divided by the frequency in megahertz, in feet,91 and on a ground-plane antenna each of the horizontal rods at its base, its radials, measures a quarter of a wavelength at the frequency the antenna is cut for.92 The consequence is the one thing to carry away from this unit: a physically long element resonates at a low frequency and a short one at a high frequency. A 2 m whip is a VHF antenna; a hand-sized patch is a microwave one.

The omnidirectional kind radiates equally toward the horizon in every direction, and looks like a single thin vertical rod or fiberglass tube. Stacking several rod sections in one line, a collinear array, concentrates the signal toward the horizon and so increases its reach. Stacking narrows the beam in elevation and leaves the pattern in azimuth, around the horizon, unchanged, and that narrowing is what yields gain above unity.89 One aimed along a single bearing is directional, and shows that aim in its shape: the parallel rungs of a Yagi, the flat face of a panel, the round face of a dish. A directional antenna on a building points to where its far end is.

A field key

These are the antennas an urban area actually carries, each read by the same two features, size and aim.

1. Cellular site. Flat vertical panel antennas in their weatherproof covers, called radomes, in a cluster, each cluster aimed on one of three bearings, so a mast carries three faces looking outward. This is still the three-sector layout: a mast commonly carries as few as nine antennas, three panels to each of the three sectors.89
2. The modern sign. A boxy remote radio unit now sits at the antenna rather than in a ground shelter, so a current site is a stack of panels and radios with thick fiber and power running up to them. A single active antenna covers many bands at once, so its size no longer marks one band.
3. Bands. US mobile spans low-band below 1 GHz, a mid-band tier around the Citizens Broadband Radio Service at “3550-3700 MHz”95 and the C-band just above it, and millimeter-wave in the tens of GHz for dense small sites.

A current cellular mast head: panels plus remote radios, not the bare single-band panels of a decade ago. Photo: Tony Webster, Wikimedia Commons, CC BY 2.0.

1. Small cell. A short pole-top cluster of canister or slab antennas with a radio box, filling coverage a macro site cannot reach. The FCC defines the class by size: mounted on structures “50 feet or less in height including their antennas,” each antenna “no more than three cubic feet in volume.”98 The agency’s own description is “antennas often no larger than a small backpack.”98
2. The sign. It is mounted on street furniture, a lamp post or a traffic-signal pole, at head height rather than on a tower. Read the pole-tops on a dense block, not just the skyline. It carries the same mid-band and millimeter-wave cellular spectrum as a macro site, close in.

A small cell on a streetlight pole: the same cellular service as a tower, shrunk onto street furniture. Photo: Tony Webster, Wikimedia Commons, CC BY-SA 2.0.

1. Point-to-point backhaul. A round dish, aimed at a matching dish on the horizon, carries a licensed point-to-point link. Under Part 101 those links run in bands such as “5925-6425” and “6525-6875” MHz, “10,700-11,700” MHz, and “21,200-23,600” MHz.93
2. Active dish or passive mirror. The photograph shows the common error: these are not dishes but passive reflectors: flat metallic surfaces set at an angle such that a beam arriving at one angle leaves at the matching angle.96 A reflector of this kind needs little maintenance and no electric power on site.96 The difference: an active dish carries a feed at its center and radio hardware and cabling behind it; a passive reflector is a bare panel with none.

Two passive reflectors, not dishes: bare panels that bounce a beam over the ridge, with no feed and no radio. Photo: Tony Webster, Wikimedia Commons, CC BY-SA 2.0.

1. GNSS timing antenna. A small low-profile dome or square, often on the roof of an equipment cabinet. It receives GPS, which broadcasts on 1575 MHz, the L1 signal, on 1227 MHz, L2, and on 1176 MHz.94 Its small size follows the high band.
2. Read. A GNSS puck means the site keeps disciplined time, which is what trunked radio, cellular, and utility systems need. It marks timing-critical infrastructure, not a link you can hear.

A GNSS antenna: the patch under the dome is a few centimeters across, set by the 1.2 to 1.6 GHz band. Photo: Vsatinet, Wikimedia Commons, CC BY-SA 4.0.

1. Utility collector. The hardest to see, because there is often no antenna to see. This meter is also a collector: it collects data from the neighboring smart meters over a 900 MHz frequency-hopping spread-spectrum radio, forming a local sensor network.101 The radio is inside the meter, so nothing projects from the wall.
2. Two forms. Some collectors are pole-mounted data-aggregation routers instead, running an IEEE 802.15.4g/e sensor network on the 900 MHz ISM channels at up to 1 watt.99 Either way it is the Wi-SUN field-area network that connects smart electricity, water and gas meters, in the North American 902 to 928 MHz band.100
3. The sign. With little or nothing to see, this one is confirmed by the 900 MHz sweep of Unit 05 rather than by sight. A steady scatter of brief 900 MHz bursts across a residential block is the meter network reporting.

A smart meter that is also a collector: the 900 MHz radio is internal, so there is no antenna on the wall. Photo: Zuzu, Wikimedia Commons, CC BY-SA 3.0.

A few more are worth knowing without a photograph to hand. A Yagi beam is a row of parallel rods on a boom, aimed end-on; only the driven element is fed, with a longer reflector behind it and shorter directors in front of it,88 and it serves fixed links, amateur stations, and older rooftop television, from VHF up to about 2.5 GHz. A collinear whip, a single tall fiberglass tube, is the omnidirectional base antenna of a land-mobile system, in the VHF 30 to 300 MHz or UHF 300 MHz to 3 GHz range.88 A broadcast array is a tall stack of like elements, called bays, high on a mast; FM runs 88 to 108 MHz and television the VHF and UHF bands.88 A Wi-Fi access point is a small dome or flat panel, indoors or on a wall, working the unlicensed 2.4, 5, and now the 6 GHz band the FCC opened across “5.925-7.125 GHz.”97

A sweep tells you a channel is busy, not what is using it. Identifying it depends on three things you can measure without decoding anything: where the signal sits, how wide it is, and how it behaves over time. A voice repeater keys up and drops again, a control channel runs continuously, and a telemetry device transmits for a fraction of a second, then is idle for minutes. Those patterns are visible in the waterfall before any demodulator is involved.

Two lookups do most of the work, and both are open-source reconnaissance in the sense of Unit 01. RadioReference records the major radio systems in use near a given place, from business systems to public safety.55 The Signal Identification Wiki works the other direction, from an unknown signal back to a name, by giving visual examples of what each kind of signal looks like in an SDR waterfall and audio clips of how it sounds.55 Look up the area first, then match what you actually hear against it. When a signal appears on a frequency where the database says a system operates, you have identified it well enough to confirm with one further check.

That match is only as good as your receiver's frequency accuracy, and a cheap dongle's often is not. An inexpensive RTL-SDR dongle sometimes carries an oscillator that is neither stable nor well aligned, and that oscillator is what sets the tuned frequency. Better dongles use a temperature-controlled crystal oscillator; generic ones do not, so the frequency they pass to the SDR software is incorrect.13 The fix is a correction figure in parts per million, and you find that figure with the rtl_test utility, which ships with the same rtl-sdr drivers Unit 08 installs.13 Size the error before dismissing it: at 460 MHz one part per million is 460 Hz, so a receiver 50 ppm out reads 23 kHz away from the truth, nearly two of the 12.5 kHz bins the UHF run uses. An uncalibrated dongle can put a signal in the wrong channel and match it to the wrong system, so calibrate before you identify anything by frequency.

Artemis is a program for identifying and storing radio frequency signals. It carries a database of over 520 recognized signals, each record holding parameters such as frequency, bandwidth, and modulation alongside spectrum waterfalls, audio samples, and documents.84 That database is sourced directly from the Signal Identification Wiki.85 The program is released under the GPL-3 license,84 and holding the reference locally rather than in a browser tab matters for the same reason the open-source reconnaissance in Unit 01 happens before you arrive: identifying a signal you have just found should not require asking a website about it.

Much public-safety traffic is trunked, which changes what you are looking at. In a trunked system every radio monitors one control channel, and multiple talk groups, such as fire, police, and EMS, share a pool of frequencies.55 The continuously busy channel you found is likely the control channel, not a conversation; the conversations move across the pool under its direction. Local governments in major metropolitan areas run digital trunked systems.55

You will not be handed a labeled screenshot in the field, so the exercise below presents each signal as a measurement, the form it takes in the field. Each one gives a center frequency, an occupied bandwidth, and a behavior over time, and asks you to narrow from those three to a service. All six are things an ordinary residential block carries, and one of them is the meter Unit 02 read on the wall.

A single sweep records only the moment it was taken, and occupancy changes with the hour, so a band that reads clear at three in the afternoon can be full at seven the next morning. To record what a location actually carries, you leave a receiver running and measure the same channels repeatedly across a set period.

The threshold rule is the core of occupancy measurement: “if a signal is received above the threshold level, the channel is considered to be occupied.”49 The receiver repeats that test across as many channels as it can, as fast as it can. Each estimate covers an integration time, normally 5 or 15 minutes, and the whole run is the duration of monitoring, the total time the measurement is carried out. The peak matters as much as the average: the busy hour is the highest occupancy a channel reaches in any 60-minute period.49

The recommendation is specific about how long to run the capture. Where no time distribution pattern is known, an initial evaluation should run for at least 24 hours or a multiple of 24 hours, and one week of monitoring shows how occupancy differs across the days of the week.49 A 24 to 48 hour capture is the minimum, not the ideal: it catches the daily cycle but not the difference between a Tuesday and a Sunday. Record which your baseline covers, and do not claim the other.

Coverage and resolution trade against each other, and the same recommendation gives the relationship. Revisit time equals observation time multiplied by the number of channels of identical bandwidth, plus processing time, so slow equipment holds a short revisit time only by measuring fewer channels.49 Sweep a wide range in coarse bins and you return to each channel often while resolving little. Narrow the range or the bins and you resolve more while returning less often. Decide which one the assessment needs before you start the run, because you cannot recover the other from the recording.

The tool is rtl_power, a wideband spectrum monitor utility.50 You give it a range and a bin size as -f lower:upper:bin_size, an integration interval with -i, a run length with -e, and the tuner gain with -g, which defaults to automatic gain;50 the runs below set -g 40 so every sweep across the capture uses the same gain. Its output is a CSV file, a plain-text table of comma-separated values, whose columns are “date, time, Hz low, Hz high, Hz step, samples, dbm, dbm, ...”50 That file is an occupancy record in the ITU's own terms: a channel, a time, and a level to compare against a threshold. Its -i 15m option lands exactly on the integration time the ITU recommends.

None of this tooling ships with a desktop system, so install it before you go rather than at the site. rtl_power comes from the rtl-sdr package;50 heatmap.py is a script inside the rtl-sdr-misc repository;76 rtl_power_fftw is built from source against libfftw3, libtclap, and librtlsdr;77 and Kismet installs from the project's own package repository.103 Match that repository line to your own distribution release, because installing packages built for another distribution often fails with errors about missing library packages.103 soapy_power is a Python program and requires Python 3, NumPy, SimpleSoapy, and SimpleSpectral. Its project advises installing SciPy or pyFFTW as well, because NumPy's own FFT uses far more memory and runs much slower.75

# rtl_power: from the rtl-sdr package
sudo apt install rtl-sdr

# heatmap.py: a script in the rtl-sdr-misc repository
git clone https://github.com/keenerd/rtl-sdr-misc

# rtl_power_fftw: build it against its libraries
sudo apt-get install libfftw3-dev libtclap-dev librtlsdr-dev pkg-config
mkdir build && cd build && cmake .. && make

# Kismet: the project's own repository.
wget -O - https://www.kismetwireless.net/repos/kismet-release.gpg.key --quiet | gpg --dearmor | sudo tee /usr/share/keyrings/kismet-archive-keyring.gpg >/dev/null
# Below, 'jammy' appears TWICE and is the Ubuntu 22.04 codename. Replace both with
# your own release codename (lsb_release -cs) or apt will fail on missing libraries.
echo 'deb [signed-by=/usr/share/keyrings/kismet-archive-keyring.gpg] https://www.kismetwireless.net/repos/apt/release/jammy jammy main' | sudo tee /etc/apt/sources.list.d/kismet.list >/dev/null
sudo apt update && sudo apt install kismet
sudo usermod -aG kismet your-user-here

# 48-hour occupancy baseline, 100 MHz to 1 GHz, 1 MHz bins,
# 15-minute integration to match the ITU integration time
rtl_power -f 100M:1G:1M -i 15m -e 48h -g 40 baseline.csv

# narrower and finer: one band, 12.5 kHz bins, same window
rtl_power -f 450M:470M:12500 -i 15m -e 48h -g 40 uhf-baseline.csv

The CSV is a table, not a picture, so render it. heatmap.py from the rtl-sdr tools converts rtl_power CSV files into graphics, and its --ytick option marks the Y axis at a chosen interval,76 which turns two days of rows into a readable image with the hours down the side. If the sweep runs slowly on the sensor's small computer, rtl_power_fftw does the same job through the faster FFTW library,77 and soapy_power does it across other hardware.75

Kismet is a passive Wi-Fi, Bluetooth, and RF sniffer:51 it identifies networks by passively collecting packets, uncovers hidden networks given time, and detects networks that never announce themselves by reading their ordinary data traffic,52 and it works best in a stationary setup,52 which is what an emplaced sensor is. WiGLE is its open-source counterpart, a central database of wireless networks worldwide that you can query over the web,53 so check what it already holds for a location before you go. Its terms limit reuse: WiGLE prohibits using the data for unlicensed commercial gain and is not currently granting commercial licenses.53

With an rtl-sdr and the rtl_433 tool, Kismet collects information from RF sensors, weather stations, tire pressure monitors, power meters, gas meters, and water meters.78 The metering you read on the wall in Unit 02 is, on many installations, also transmitting, and the same node that logs spectrum occupancy records it.

The kismetdb log is one file holding packets, non-packet data, devices, location, system messages, datasource records, historical trends, and nearly everything else Kismet tracks,79 so a two-day run leaves a single artifact to carry away and read later rather than a directory of fragments.

Kismet supports remote capture using the same sources it captures with locally, so a node in the field feeds a server elsewhere.80 A fixed sensor launches its remote-capture tool with the --fixed-gps argument, which tags every packet with that location.80 A reporting node then only has to keep running, not be recovered.

Where you place the sensor determines both how much it can receive and how likely it is to be found. A remote sensor extends surveillance range without requiring anyone to stay physically present in the surveillance area,54 which is the whole reason to leave one rather than sit beside it. The doctrine names the same tradeoff among its siting factors: a concealed position gives cover and concealment to sensors and relays, but it can restrict where the antenna goes and block the line of sight the link needs.54 The position that conceals best often receives least, and choosing between them is the siting decision. Detection resistance is a property of the emplacement rather than the hardware, because a properly emplaced remote sensor is extremely difficult to detect.54

A survey receiver transmits nothing, because the instrument is passive and emits nothing.72 A sensor is therefore found by its antenna and feed line, not by its emissions. Concealing a receive antenna is a physical problem rather than an emissions problem, and it is solved by looking rather than by measuring.

The doctrine for hiding an antenna was written for transmitting stations, but its physical half transfers without change. Work the room first. Check the walls and ceiling for reinforcing bars or beams, metal lath plaster, or any other substance that conducts electricity, and run the field-expedient test by holding a compass close to the walls and ceiling to detect metallic objects. The compass will not detect nonmagnetic metal, so inspect the room thoroughly as well.86 Steel reinforcement and foil-backed insulation turn a well-chosen room into a shielded box, and a compass finds most of it in a minute. Height helps for the same reason it helps outdoors, so select the highest floor available in the chosen building, which keeps other close buildings from interfering.86

Then hide it in what is already there. Indoors, check the moldings, baseboards, and window frames of the room for means of concealing and supporting the antenna and its transmission lines.86 Outdoors, the doctrine lists the fixtures a building already offers: wooden exterior steps, guy wires for signs, rain gutters, and clotheslines.86 Urban radio guidance says the same in fewer words, that water towers, existing civilian antennas, and steeples conceal an antenna.66 The standard to work to is absolute: “ensure no evidence of the antenna, to include wire elements, transmission line, halyard, and insulators, is visible or unnatural to the location.”86 The feed line and its fixings reveal a sensor as readily as the element does, and the test is not whether the antenna is hidden but whether anything about the spot looks unnatural to someone who lives there.

A discone on a mast is the wrong antenna for an emplacement. It is the correct one for a survey, but it is a recognizable instrument mounted where instruments are not. What you emplace instead is a length of wire, and its size follows the frequency. A wavelength in metres is 300 divided by the frequency in megahertz;90 a half-wave wire element in feet is 468 divided by the frequency in megahertz.91 Near 460 MHz, the UHF land-mobile band a structure usually carries, that element is about a foot; near 155 MHz in VHF it is about three feet. Anything shorter, a stub or a short whip, needs a counterpoise to work against, radials “each measuring 1/4 wavelength of the desired frequency” standing in for a ground,92 so the whip is only half of the antenna. Cut the wire for the band you most want to hear, from the ones the survey found, and accept that it receives the rest less well.

Conceal it the way the clandestine-antenna doctrine already directs, by routing the wire along what the structure offers. The fixtures the doctrine lists, wooden exterior steps, guy wires for signs, rain gutters, and clotheslines outdoors, and moldings, baseboards, and window frames indoors, are named as a means to support and conceal the antenna and its transmission line,86 not as the antenna itself: you run a thin wire along the gutter or the window frame, you do not clip a lead to the gutter and call it the antenna. The wire is chosen to disappear, stranded copper of 26 to 28 AWG in brown, black, or dark green, which is nearly invisible at 20 feet,102 run along a fence line or a window frame. Route it at least 12 inches clear of any household electrical cable,102 because a receive wire run against the mains picks up noise directly from that wiring.102 The standard is the absolute one from the start of the unit, that “no evidence of the antenna, to include wire elements, transmission line, halyard, and insulators, is visible or unnatural to the location.”86 A discone or a whip in the open receives more and reads as an instrument; a thin wire tucked along a frame receives less and reads as nothing. Choose the antenna against the concealment the place actually gives you, and accept the loss of sensitivity as its price.

How long the sensor can keep running sets how much of the occupancy record you get, so plan the power supply before the receiver. In the sensor doctrine, battery life is the primary factor limiting how long a sensor or relay endures,54 and it is the same here: a receiver and a small computer running for two days need a power source that lasts the whole run. Unit 04's tap solves it: a small computer drawing on the order of a watt40 sits far below the headroom of any circuit you measured, so a tapped supply removes the runtime ceiling a battery imposes.

Whether the computer can process the incoming data fast enough is a separate question from power, and it is worth settling before you leave a node anywhere. A Raspberry Pi Zero 2 W carries a 1 GHz quad-core 64-bit Arm Cortex-A53 CPU, 512 MB of SDRAM, and one micro USB On-The-Go port.81 That one bus carries the receiver's sample stream while the same board writes the log, on half a gigabyte of memory. Whether it sustains a two-day capture without dropping samples is not answerable from a datasheet or any published benchmark, so run a full-length capture on the bench before you trust one in place. A Pi 4, with a quad-core Cortex-A72 (ARM v8) 64-bit SoC at 1.8 GHz and 2 USB 3.0 ports,82 removes both of those limits, giving the receiver its own bus and more memory, and draws more power. Read the rtl_power_fftw remark about “simple processors such as raspberryPi”77 in its own context: that project dates from 2015, years before the Zero 2 W existed, so it is not a statement about that board.

On the ANTSDR E200 the processing system, meaning its CPU, runs a custom-built buildroot Linux,83 so the radio and the capture host are one device on an Ethernet drop rather than a dongle tethered to a separate board.

Dolos is a different tool and should not be mistaken for this one. The series scopes it as a platform that senses, deceives, actuates, and communicates, and the instance built in Module 03 is a tamper sensor with a relay and a buzzer: a trigger and a decoy. It is not a spectrum-capture host, and nothing here asks it to be. Size any load you emplace the same way regardless of what it is, against the headroom you read at the panel.

Task: Assess the place you live and its block across every domain this module reads (the power service, the meter, the panel, the antennas, and the RF spectrum), then turn the readings into a baseline: a dated record of what is normal for the site.
Condition: Given the home, apartment, or block where you live, open sources (a mapping service, the serving utility's outage map, and the local assessor's records), a clamp meter and a multimeter, and a receiver with an antenna. Work only where you have every right to be, and touch nothing you are not permitted to touch.
Standard: Core (no radio equipment needed). The serving utility named and the feed traced from open sources; the service called overhead or underground, the meter's type and state read, and the service point located from outside; the main disconnect rating read at the panel with the cover on and one branch circuit's headroom computed with the clamp meter; and the antennas visible on the structure and the block identified to a band by their form. Every reader completes the core.
Extension (with the receiver and antenna from Unit 05). A sweep run and the bands present inventoried, with at least three signals identified by frequency, bandwidth, and behavior, each confirmed against RadioReference for the area or worked back to a name on the Signal Identification Wiki;55 and, with the logging setup from Unit 08, an occupancy capture of at least 24 to 48 hours recorded, with the window it covers stated and not generalized beyond.49 Add the extension when the kit is in hand; the core baseline stands on its own until then. Every stage photographed as you go. The product of this exercise is the completed field exercise worksheet, dated and carrying every reading with its photographs: the utility and feed, the service type, the meter, the service point, the main disconnect rating and the branch headroom you computed, and the antennas you identified to a band, plus the sweep and the occupancy capture if you ran the extension. The completed sheet is the baseline: it states what is normal for this site on this date, and it is what a later survey is measured against.

Download the field exercise worksheet (PDF)

Task: Complete the Module 07 test.
Condition: Given ten questions covering units one through eight, without reference to the module units or notes.
Standard: Answer at least eight of ten questions correctly. For each question missed, reread the unit named in the feedback and retake the test until the standard is met.

AMI (advanced metering infrastructure)

A smart-meter system that records consumption in short intervals and often carries its own 900 MHz radio, so there is no separate antenna on the wall.

Bandwidth

How wide a signal is in frequency; on an FFT, the width of the peak that stands above the noise floor.

Branch circuit

A circuit downstream of the main disconnect, protected by its own breaker; the breaker rating (15, 20, 30, 40, or 50 amperes) is the circuit's ceiling.

Control channel

In a trunked system, the continuously busy channel that directs traffic; the conversations move across a pool of other frequencies under it.

Discone

A wideband antenna, a disc above a sloping cone, with usable response across a wide range of frequencies rather than at one, which is why it suits a survey.

Fam

The median man-made noise figure: how far a location's man-made noise sits above the quiet baseline at a given frequency. Highest in the low bands, falling as frequency rises.

FFT

A view of signal strength against frequency at one moment; a peak above the noise floor is an occupied channel, a stretch near the floor is open.

Headroom

The spare capacity left on a circuit below its limit; a continuous load should stay at or below 80 percent of the breaker rating.

Kh constant

The meter constant on an analog meter: the watt-hours registered per revolution of the disc (for example 3.6 or 10.0).

Main disconnect

The service-size breaker at the top of the panel; its ampere rating is the ceiling on what the whole structure can draw.

Medium voltage

Distribution voltage above 1 kV; the primary side feeding a structure is typically 12 to 34.5 kV, and is lethal and utility-only.

Noise floor

The background level of radio energy beneath the individual signals; a signal is detectable only when it rises above it.

Occupancy baseline

A spectrum capture run over at least 24 to 48 hours, showing which bands carry traffic and when; a full week shows weekday against weekend.

Open-source reconnaissance (OSINT)

The public records anyone can pull before going near a site: mapping imagery, utility service and outage data, and assessor and permit records.

Service drop

The overhead service conductors from the last pole to the building; the buried equivalent is the service lateral.

Service point

The boundary where the utility's conductors meet the premises wiring: the demarcation between what the utility owns and what the structure owns.

Small cell

A cellular antenna and radio shrunk onto street furniture, a lamp post or a signal pole at head height, carrying the same spectrum as a macro site.

Supply-side connection

A connection made ahead of the meter; it is unmetered and, with no breaker between it and the transformer, more dangerous than a load-side tap.

Trunked system

A radio system in which talk groups share a pool of frequencies directed by a control channel; common for metropolitan public-safety traffic.

Waterfall

A view of the same frequencies stacked over time, so a signal's behavior, constant or bursting, is visible before any demodulation.

Weatherhead (masthead)

The fitting that caps the service mast where an overhead drop lands; the conductors hang below it in drip loops so water drips off before it can run into the conduit.

1. National Electrical Code (NFPA 70), §230.79 “Rating of Service Disconnecting Means,” 2005 ed. Full text via Public.Resource.Org, archive.org.
2. National Electrical Code (NFPA 70), §210.3 “Branch circuits — Rating,” 2005 ed.
3. InterNACHI, Standards of Practice (§3.7 Electrical) and “Inspecting the Main Electrical Panelboard.” Via the Wayback Machine, web.archive.org.
4. US Army Engineer Course, Electricity VII — Install Circuit Protective Devices (EN5146). US Government work, public domain.
5. US Army Engineer Course, Electricity IV — Install Conduit Systems (EN5143). US Government work, public domain.
6. Recommendation ITU-R P.372 (Radio noise), man-made noise median curves. International Telecommunication Union, itu.int/rec/R-REC-P.372. The city curve is curve A, Fam = 76.8 − 27.7 log f, valid 0.3 to 250 MHz; the business-area fit for 200 to 900 MHz is Fam = 44.3 − 12.3 log f.
7. Fluke, “ABCs of Clamp Meters” and “Inside Current Transformer (ac) Clamp Meters,” fluke.com.
8. IoTaWatt, Open WiFi Electric Power Monitor, iotawatt.com (open-source hardware + firmware).
9. OpenEnergyMonitor, “CT Sensors — Introduction,” docs.openenergymonitor.org (open-source energy monitoring).
10. RTL-SDR Blog V4 Datasheet v1.0 (December 2024), rtl-sdr.com. Tuner R828D with RTL2832U, 8 bits, “500 kHz to 1.766 GHz.”
11. Great Scott Gadgets, HackRF One, greatscottgadgets.com (open-source hardware).
12. tinySA, Specification, tinysa.org (open-hardware spectrum analyzer).
13. John Donkersley (G0OXO), SDR++ User Guide, for SDR++ up to version 1.1, December 2022, with contributions from Alexandre Rouma (ON5RYZ), who created SDR++. sdrpp.org. The guide is cited for the FFT and waterfall display, and for RTL-SDR oscillator error and the PPM correction figure found with rtl_test; quoted here with the author's permission. The project site is cited for the description of SDR++ itself, “a cross-platform and open source SDR software with the aim of being bloat free and simple to use.” The guide documents version 1.1; later releases may differ.
14. Gqrx SDR, gqrx.dk (GNU GPL, GNU Radio-based SDR receiver).
15. National Electrical Code (NFPA 70), §210.19(A)(1) and §210.20(A) (continuous-load sizing: 125 percent of the continuous load), 2005 ed. Full text via Public.Resource.Org, archive.org.
16. National Electrical Code (NFPA 70), §210.12 (arc-fault protection) and §210.8 (ground-fault protection for personnel), 2005 ed.
17. InterNACHI, How to Perform Residential Electrical Inspections, 4th ed., revised December 2013: service entrance, mast and masthead, 120/240 cable assembly, service-conductor sizing, and distribution (sub-) panels. nachi.org.
18. InterNACHI, “Ground-Fault Circuit Interrupters (GFCIs).” Via the Wayback Machine.
19. FCC, Title 47 CFR §15.107 “Conducted limits” (radio-frequency voltage conducted onto the AC power line, 150 kHz to 30 MHz; battery-only exemption). Via Cornell Law LII, law.cornell.edu.
20. U.S. Energy Information Administration, “An Assessment of Interval Data and Their Potential Application to Residential Electricity End-Use Modeling,” eia.gov.
21. When the Power Goes Out (2007): generator connection and transfer switches. Light Fighter Library.
22. National Electrical Code (NFPA 70), §705.10 “Directory” and §705.12 “Point of Connection” (interconnected electric power production sources), 2005 ed. Full text via Public.Resource.Org, archive.org.
23. National Electrical Code (NFPA 70), §702.2 (optional standby systems, definition) and §702.6 “Transfer Equipment,” 2005 ed.
24. National Electrical Code (NFPA 70), Article 100 Definitions, “Service,” 2005 ed. Full text via Public.Resource.Org, archive.org.
25. US Army, TM 5-682, Facilities Engineering: Electrical Facilities Safety (de-energizing and verifying a circuit dead; job preparation and protective equipment). US Government work, public domain.
26. National Electrical Code (NFPA 70), §110.14(B) “Splices,” 2005 ed.
27. National Electrical Code (NFPA 70), §300.15 (box installed at each splice, outlet, or junction point), 2005 ed.
28. National Electrical Code (NFPA 70), §240.4 (protection of conductors in accordance with their ampacities) and §400.5 (flexible cord and cable ampacity), 2005 ed.
29. National Electrical Code (NFPA 70), Article 100 Definitions: “Service Point,” “Service Drop,” “Service Lateral,” and “Service Equipment,” 2005 ed. Full text via Public.Resource.Org, archive.org.
30. US Army, TM 5-811-1, Electrical Power Supply and Distribution (primary distribution voltage class; riser-pole fuse cutouts and surge arresters). US Government work, public domain.
31. National Electrical Code (NFPA 70), §550.32(A) (mobile-home service-equipment location), 2005 ed.
32. U.S. Fire Administration (FEMA), Basic Evaluation Procedures for Abandoned and Vacant Buildings (April 2018) — exterior survey, observing utility-meter status. US Government work, public domain. usfa.fema.gov.
33. “Electricity meter,” Wikipedia (electromechanical induction meter: disc speed proportional to power; meter constant Kh in watt-hours per revolution), en.wikipedia.org.
34. OpenStreetMap Wiki, “Key:power” (grid infrastructure tagging: line, minor_line, tower, pole, transformer, substation), wiki.openstreetmap.org. Data licensed under the Open Database License (ODbL).
35. Open Infrastructure Map, “About” (a view of the world's infrastructure from OpenStreetMap data), openinframap.org.
36. Library of Congress, Sanborn Maps Collection (public-domain fire-insurance maps: building footprint and construction), loc.gov.
37. National Electrical Code (NFPA 70), §230.82 “Equipment Connected to the Supply Side of Service Disconnect,” 2005 ed. Full text via Public.Resource.Org, archive.org.
38. OSHA, 29 CFR §1910.269(g)(2) “Fall protection” (personal fall arrest, work-positioning, or fall restraint above 1.2 m / 4 ft on poles and towers). Via Cornell Law LII, law.cornell.edu.
39. OSHA, 29 CFR §1910.137 “Electrical protective equipment” (rubber insulating gloves; Table I-4 class and maximum use voltage). Via Cornell Law LII, law.cornell.edu.
40. Jeff Geerling, Raspberry Pi Dramble, “Power Consumption Benchmarks” (Raspberry Pi Zero 2 W idle, 100 mA / 0.6 W), pidramble.com.
41. OpenStreetMap Wiki, “Tag:power=substation” (substation definition; voltage ordered highest to lowest), wiki.openstreetmap.org.
42. OpenStreetMap Wiki, “Overpass API/Overpass QL” (the around radius filter; nwr shorthand), wiki.openstreetmap.org.
43. OpenStreetMap Wiki, “Tag:man_made=street_cabinet” (street cabinets; utility=power), wiki.openstreetmap.org.
44. OpenStreetMap Wiki, “Tag:power=generator” (generator definition; generator:source), wiki.openstreetmap.org.
45. Florida Power & Light, “Power Tracker Map FAQ” (what the outage map shows; no street-address detail), fpl.com.
46. Orange & Rockland Utilities, “Outage Map FAQ” (outage symbol placed at a center point; update interval), oru.com.
47. Homeland Infrastructure Foundation-Level Data (HIFLD), “Electric Power Transmission Lines,” via catalog.data.gov. US Government work.
48. Homeland Security Digital Library, “HIFLD” (August 2025 shutdown of the HIFLD Open portal; datasets preserved in HSDL), hsdl.org.
49. Recommendation ITU-R SM.1880-2 (09/2017), “Spectrum occupancy measurement and evaluation” (threshold method; integration time; duration of monitoring; busy hour; revisit time). International Telecommunication Union, itu.int.
50. rtl_power(1) man page, osmocom rtl-sdr project (wideband spectrum monitor; -f/-i/-e options; CSV output columns), manpages.debian.org.
51. Kismet, project home page (sniffer, WIDS and wardriving tool for Wi-Fi, Bluetooth, Zigbee and RF), kismetwireless.net.
52. US Army Special Forces Command (Airborne), Introduction to Aircrack-ng and Kismet (passive collection; stationary versus wardriving use). Light Fighter Library.
53. WiGLE, “Frequently Asked Questions” (consolidated database of wireless networks; reuse and commercial-licensing terms), wigle.net.
54. US Marine Corps, MCRP 2-24B, Remote Sensor Operations (remote surveillance without physical presence; siting factors; stealth; battery life as the endurance limit). US Government work, public domain. Light Fighter Library.
55. Noah Axon, Introduction to Software Defined Radio supplement, rev 0.9.1 (2024-05-05) — SigIDWiki and RadioReference as lookup references; trunked-system control channel; civilian scanning and its legal caveats. Light Fighter Homefront course material.
56. 18 U.S.C. §2510(16), definition of “readily accessible to the general public” (excludes scrambled or encrypted communications). Via Cornell Law LII, law.cornell.edu.
57. 18 U.S.C. §2511(2)(g), lawful interception of radio readily accessible to the general public, including public-safety, amateur, citizens band, GMRS, marine and aeronautical systems. Via Cornell Law LII, law.cornell.edu.
58. 47 U.S.C. §605(a), Communications Act (prohibition on divulging or publishing intercepted communications, and its exception for general-public, distress, amateur and citizens band radio). Via Cornell Law LII, law.cornell.edu.
59. 47 CFR §2.106, Table of Frequency Allocations (US allocation authority; FM broadcasting in the band 88-108 MHz). Via Cornell Law LII, law.cornell.edu.
60. 47 CFR §87.173, Aviation Services frequencies (VHF omni-range, ILS localizer, air traffic control channels, 121.500 MHz emergency and distress). Via Cornell Law LII, law.cornell.edu.
61. 47 CFR §80.373, Maritime Services VHF frequencies. Via Cornell Law LII, law.cornell.edu.
62. 47 CFR Part 95, Personal Radio Services: §95.563 (FRS channels) and §95.2763 (MURS channels). Via Cornell Law LII, law.cornell.edu.
63. 47 CFR §97.301, Amateur Radio Service authorized frequency bands. Via Cornell Law LII, law.cornell.edu.
64. 47 CFR §15.247, unlicensed operation within the bands 902-928 MHz, 2400-2483.5 MHz, and 5725-5850 MHz. Via Cornell Law LII, law.cornell.edu.
65. 47 CFR §90.20, Public Safety Pool (Private Land Mobile Radio Services). Via Cornell Law LII, law.cornell.edu.
66. US Army, FM 24-18, Tactical Single-Channel Radio Communications Techniques (1987), §7-18 Radio Communications in Urbanized Terrain. US Government work, public domain. Light Fighter Library.
67. Light Fighter Homefront course material, RF Intelligence for Drone and Communication Operations in Urban Environments (urban versus rural noise-floor levels). Light Fighter Library.
68. tinySA Ultra (tinySA4) Specification — frequency coverage, resolution filters, input attenuation, battery. tinysa.org.
69. tinySA, “Ultra mode” — low-pass filter bypass above roughly 800 MHz, calibrated level range, and sensitivity roll-off with frequency. tinysa.org.
70. MicroPhase, ANTSDR E200 RF parameters (AD9361/3 variants; 70 MHz to 6.0 GHz receive; 56 MHz bandwidth; ZYNQ XC7Z020). antsdr-docs.microphase.cn.
71. Airspy R2 product specification, airspy.com.
72. Sergey Beskrestnov, Practical Application of the Spectrum Analyzer tinySA Ultra (Ground Forces Training Command, Kyiv, October 2023) — the instrument is passive and emits nothing; battery endurance and external power; internal LNA versus an external amplifier; 50-ohm SMA input and antenna polarization. Light Fighter Library. Cited for instrument handling only.
73. SDRplay RSPdx product specification, sdrplay.com.
74. Ettus Research, USRP B200 product page, ettus.com.
75. soapy_power, “Obtain power spectrum from SoapySDR devices,” github.com/xmikos/soapy_power.
76. heatmap.py, rtl-sdr-misc tools (renders rtl_power CSV sweeps into heatmap images), github.com/keenerd/rtl-sdr-misc.
77. rtl-power-fftw (FFTW-based power spectrum from RTL devices; GPL-3.0), github.com/AD-Vega/rtl-power-fftw.
78. Kismet documentation, “Sensor — SDR rtl_433” datasource, kismetwireless.net.
79. Kismet documentation, “Kismetdb” log format, kismetwireless.net.
80. Kismet documentation, “Remote Capture” (transparent remote capture; --fixed-gps for fixed sensors), kismetwireless.net.
81. Raspberry Pi Zero 2 W product specification (Cortex-A53, 512MB SDRAM, single micro USB OTG port), raspberrypi.com.
82. Raspberry Pi 4 Model B specifications (Cortex-A72 at 1.8GHz; 2 USB 3.0 and 2 USB 2.0 ports), raspberrypi.com.
83. MicroPhase, ANTSDR E200 Getting Started Guide (the processing system runs a buildroot Linux operating system), antsdr-doc-en.readthedocs.io.
84. AresValley, Artemis (RF signal identification and storage; GPL-3), github.com/AresValley/Artemis and aresvalley.github.io/Artemis.
85. Artemis documentation, “SigID database” (sourced from the Signal Identification Wiki), aresvalley.github.io.
86. US Army, STP 31-18E34, Special Forces Communications Sergeant, Skill Levels 3 and 4, task 331-18E-3042 “Construct a Clandestine Antenna” (site and room selection, checking for conductive structure, concealment in existing fixtures). US Government work, public domain. Light Fighter Library. Written for transmitting stations; cited here for physical concealment only.
87. Aclara (Hubbell), Aclara I-210+ Smart Grid Meter, specification sheet ACL-PID12662472-SPEC-EN, rev. 7/2025. hubbellcdn.com. Current Rating “Class 20, 200, and 320 A”; Available Forms “CL200 : 1S, 2S, 12S, 25S”; “Compliant with ANSI C12.1, C12.10, C12.20, C37.90.1 standards.” Manufacturer datasheet for the meter photographed in Unit 02.
88. US Army Electronic Warfare NCO Course, Commercial Antenna Types (Fort Sill; references MCRP 3-40.3C Antenna Handbook, MCWP 3-40.3B Radio Operator’s Handbook, NAVEDTRA 14183/14189). US Government work, public domain. Light Fighter Library. Yagi element roles, “general purpose” use to 2.5 GHz; FM “88MHz to 108MHz”; television VHF/UHF and the note that UHF Band V’s “644-890 MHz… upper portion has gone to LMRS (Land Mobile Radio Service) and cell phone services”; VHF/UHF range definitions.
89. US Army, Electronic Warfare Fundamentals Student Guide, Volume I: Radio Fundamentals. US Government work, public domain. Light Fighter Library. Omnidirectional collinear vertical array; sectored cellular sites “as few as nine antennas to an antenna mast (three panel antennas per sector).”
90. US Army SIGINT/SOF, RF Theory and Antenna Fundamentals (3-Day Course). Light Fighter Library. “Wavelength (meters) = 300 ÷ Frequency (MHz).”
91. US Army SOF, Simple Wire HF Antenna. Light Fighter Library. Half-wave dipole length in feet, “468/f in MHz.”
92. US Army Special Warfare SIGINT Course, RF Theory Read Ahead: Fundamentals of Electricity. Light Fighter Library. Ground-plane radials “each measuring 1/4 wavelength of the desired frequency”; patch antenna form.
93. 47 CFR 101.101, Frequency availability (fixed point-to-point microwave, Part 101), via the Cornell Legal Information Institute, law.cornell.edu/cfr/text/47/101.101. Common-carrier point-to-point bands including “5925-6425,” “6525-6875,” “10,700-11,700,” and “21,200-23,600” MHz.
94. National Coordination Office for Space-Based PNT, New Civil Signals, gps.gov/new-civil-signals. GPS carrier frequencies “1575 MHz, or L1,” “1227 MHz, or L2,” and “1176 MHz” (L5).
95. 47 CFR 96.11, Frequencies (Citizens Broadband Radio Service), via the Cornell Legal Information Institute, law.cornell.edu/cfr/text/47/96.11. “The Citizens Broadband Radio Service is authorized in the 3550-3700 MHz frequency band.”
96. Passive repeater, Wikipedia, en.wikipedia.org/wiki/Passive_repeater. Flat billboard reflector: “flat surfaces of metallic material… arranged so that the angle of incoming beam corresponds to the angle of the outcoming signal”; a passive repeater “needs little maintenance and no on-site electric power.” Aggregator source, used for the reflector mechanism only.
97. 47 CFR 15.407, General technical requirements (Unlicensed National Information Infrastructure devices), via the Cornell Legal Information Institute, law.cornell.edu/cfr/text/47/15.407. Unlicensed 6 GHz operation across the “5.925-7.125 GHz band.”
98. Kismet, “Packages” (official package repository for Debian and Ubuntu: signing key, repository line, apt install kismet, and the usermod -aG kismet step), kismetwireless.net/packages. Warns that installing packages from another distribution “often results in errors about missing library packages.”
99. Ham Radio Base (Ham CQ DX), Build an Attic & Stealth Dipole Antenna: HOA and Apartment Guide, hamradiobase.com. Stealth wire selection, “#26–28 AWG stranded copper: nearly invisible at 20 feet when dark-colored” in “brown, black, and dark green”; routing “at least 12 inches away from any household electrical cable (Romex, conduit)” because close routing “picks up noise directly from the wiring”; and a wire “running along a 6-foot wooden privacy fence.” Amateur transmit guide; cited here for receive-antenna concealment and noise routing only.
100. FCC 18-133, Accelerating Wireless Broadband Deployment by Removing Barriers to Infrastructure Investment, Declaratory Ruling and Third Report and Order, WT Docket 17-79, released 2018-09-27. docs.fcc.gov. Small wireless facility: mounted on structures “50 feet or less in height including their antennas,” each antenna “no more than three cubic feet in volume” (para. 9); small cells have “antennas often no larger than a small backpack” (para. 3). The controlling federal definition as of 2026.
101. Itron, OpenWay Riva Adaptive Communications Technology Module for the Cisco Connected Grid Router, datasheet 101391SP-02, 2016. na.itron.com. “RF Operational Bands 900 MHz ISM Channels”; “RF links implement IEEE 802.15.4 g/e standard”; “RF Output Power 1 Watt Maximum”; a “custom mounting bracket that integrates with the CGR1240 pole mount kit.” Manufacturer datasheet for a utility RF-mesh collector.
102. Wi-SUN Alliance, Wi-SUN FAN FAQ, wi-sun.org/faqs. Field Area Networks “provide a communications infrastructure for very large-scale outdoor networks” for “Connecting smart electricity, water, and gas meters”; North America band “902-928MHz.”
103. Elster A3 Alpha Type A30 electricity meter collector, photograph and description by Zuzu, Wikimedia Commons, CC BY-SA 3.0. Identified as a “smart meter / collector” that “collects data from neighboring REX smart meters using a 900MHz Frequency Hopping Spread Spectrum (FHSS)… mesh network.”