So many satellites are moving and sitting over our heads, and the numbers are ever increasing. Using low cost software defined radio (SDR) and low cost DIY antennas you can make from materials at your local hardware store or garage, a world of fun can be explored. This is a beginners guide on how to get up and running. Exploring which projects to tackle first, from weather satellites, data over Inmarsat and Iridium, to listening to amateur radio and cube satellites. Learn about some hardware you can make or scout for online and use at home. A quick tour of the frequency bands requiring some bigger hardware will also be discussed.

1. A low cost guide to satellite receiving
BSides Canberra - April 2018 - Pamela O’Shea - @pamoshea

2. Disclaimer
Never ever transmit unless you are fully licenced Ham operator!

3. whoami
• Pamela O’Shea - @pamoshea
• Penetration tester at O’Shea Cyber Security
• Co-founder Matchme Microconsulting
• Lecturer at RMIT Melbourne
• Industry trainer
• Volunteer pen test classes for juniors
• Founder of CyberSpectrum Melbourne
• OWASP Conference (co-organiser) – Melbourne Oct 2018
• OzSecCon Conference (sponsorship organiser) – Melbourne June 2018
https://oshea.consulting

4. Rocket Lab’s Humanity Star
Highly reflective disco ball
 Designed to be seen by the naked eye
 Launched 21st Jan 2018 from Mahia Peninsula, New Zealand
 Orbited every 92 mins
 Re-entered 22nd March 2018 and crashed in the Arabian Sea
Source: https://www.radionz.co.nz/news/national/348866/high-tech-disco-ball-satellite-launched-from-rocket

5. Rocket Lab’s Humanity Star
Criticisms included…
“act of vandalism of the night sky”

6. Rocket Lab’s Humanity Star
Criticisms included…
“act of vandalism of the night sky”
“space graffiti”

7. Rocket Lab’s Humanity Star
Criticisms included…
“act of vandalism of the night sky”
“space graffiti”
“glittery space garbage”

8. Sci-fi or real life sound effects?
? ? ?

9. Satellite Signals as Art
 Uses satellite transmissions as art
 Played through speakers suspended form a ceiling
 Displayed at Wichita State University by artist Nicholas A. Knouf
 Recordings via the Satnogs project
 Transmissions: https://network-dev.satnogs.org/users/zeitkunst
Source: https://www.rtl-sdr.com/art-from-satellite-transmissions-satnogs-and-software-defined-radio-used-in-a-sound-art-
installation/

10. Satellite Signals as Art

11. Unauthorised launches...
• India's Polar Satellite Launch Vehicle on 12 January 2018
• Main cargo was an Indian mapping satellite
• Cubesats were used for rest for cargo
• Including 4 US cubesats:
• SpaceBee 1, 2, 3, 4
• by Swarm Technologies (IoT network)
“two-way satellite communications and data relay”
- Indian space agency ISRO
Source: https://spectrum.ieee.org/tech-talk/aerospace/satellites/fcc-accuses-stealthy-startup-of-launching-rogue-satellites
Image source: http://uvg.edu.gt/ingenieria/mecanica/actividades/CubeSat/index_en.html

12. Unauthorised launches...
Source: https://spectrum.ieee.org/tech-talk/aerospace/satellites/fcc-accuses-stealthy-startup-of-launching-rogue-satellites

13. The future for satellites is bright
 SpaceX’s Starlink constellation
 Authorised to launch 4,425 (12,000 is goal)
 Half will be launched in next 6 years
“unleash the power of satellite constellations to provide high-
speed Internet to rural Americans”
- FCC Chairman Ajit Pai
Source: https://techcrunch.com/2018/03/29/fcc-approves-spacex-plan-for-4425-satellite-broadband-network/

14. A little theory

15. Satellite Orbits
Name of Orbit Abbr. From To
Low Earth Orbit LEO 160 2000
Medium Earth Orbit MEO 2000 35786
High Earth Orbit HEO 35786
Geostationary Earth Orbit GEO 35786 35786
Highly Elliptical Orbit HEO
Molniya Orbit 40000
Tundra Orbit
Geosynchronous Orbit GSO
Graveyard Orbit 36000
Source: Technical Handbook for Satellite Monitoring by Roland Proesch – 2017 Edition (p. 29)

16. Terminology
 Perigee: least distance to Earth
 Apogee: largest distance to Earth
Source: https://www.quora.com/What-are-appoge-and-perigee

17. Terminology
Kepler Elements
 Calculate the track of a satellite e.g. LEO
 Predict when the satellite can be received at a location
 8 elements
1. Epoch
2. Orbital Inclination
3. Right Ascension of Ascending Node
4. Argument of Perigee
5. Eccentricity
6. Mean Motion
7. Mean Anomaly
8. Drag
Source: Technical Handbook for Satellite Monitoring by Roland Proesch – 2017 Edition (p. 36)

18. Terminology
Kepler Elements
Two line mean elements set for the International Space Station
1 25544U 98067A 18094.51129658 .00016717 00000-0 10270-3 0 9006
2 25544 51.6409 26.0109 0001935 310.0788 50.0194 15.54192740 27051
Source: Technical Handbook for Satellite Monitoring by Roland Proesch – 2017 Edition (p. 36)

19. Satellite Frequency Bands
Frequency Range IEEE Band
300 – 3000 KHz Medium Frequency (MF)
3 – 30 MHz High Frequency (HF)
30 – 300 MHz Very High Frequency (VHF)
300 – 3000 MHz Ultra High Frequency (UHF)
1 - 2 GHz L Band
2 - 4 GHz S Band
4 – 8 GHz C Band
8 – 12 GHz X Band
12 – 18 GHz Ku Band
18 – 26 GHz K Band
26 – 40 GHz Ka Band
40 – 75 GHz V Band
75 – 111 GHz W Band
Source: Technical Handbook for Satellite Monitoring by Roland Proesch – 2017 Edition (p. 39)

20. Satellite Frequency Bands
IEEE Band Commonly used for
Very High Frequency (VHF) Meteorological e.g. NOAA, METEOR, Data e.g.
ORBCOMM, Ham Radio, Positioning, Time Service,
Military
Ultra High Frequency (UHF) RUS (inc. TV), CHN, Positioning, Time Service, Ham
Radio, Experimental, Meteorological and
Environmental
L Band Inmarsat, Thuraya
S Band Globalstar
C Band TV, Globalstar
X Band Military
Ku Band TV
K Band TV
Ka Band TV
V Band Military
Source: Technical Handbook for Satellite Monitoring by Roland Proesch – 2017 Edition (p. 40)

21. Satellite Names
Sources: http://frequencyplansatellites.altervista.org; https://www.jasondavies.com/wordcloud/

22. Doppler shift
• As a satellite approaches, the frequency appears raised
relative to the actual transmission frequency
• As it goes away, the frequency appears to be lowered
• At the time of closest approach, the transmitted and received
frequencies are usually the same
Source: http://www.zarya.info/Tracking/Doppler.php

23. Polarisation
• Orientation of the lines of electric flux in an EM field
• Need to consider the direction of the signal
• Linear polarisation
• Horizontal
• Vertical
• Circular polarisation
• Left hand
• Right hand
Sources: https://oscarliang.com/linear-circular-polarized-antenna-fpv; http://www.aerialsandtv.com/aerials.html

24. Polarisation
• Satellite LNB polarisation also needs to be set
• Also called LNB Skew
Sources: https://www.linksystems-uk.com/vsat-polarization; http://www.geosats.com/lookangle.html

25. Active vs Passive Antennas
• Passive antennas do not require power
• e.g. a yagi
• Active antennas require power e.g. 5V or 12V++
• e.g. a typical LNB requires at least 12V
• A TV set top box normally supplies this power over the coax
cable
• When working with SDR you can put a set top box in your
chain or
• Use a bias tee which allows power to the LNB but not power
backwards to the SDR receiver
• USB won’t be able to power beyond 5V
• Use a variable power supply with your bias tee for larger Vs
Source: http://www.zarya.info/Tracking/Doppler.php

26. Finding Satellites
GEO Stationary Satellites
• Known elevation and azimuth
• Work it out for your GPS location
LEO Moving Satellites
• Software like GPredict
• Works out the TLE and Doppler values for your GPS location
• AR apps like SatPointer are great too
Sources: http://www.sattvengg.com/2013/10/azimuth-and-elevation-angle-antenna.html; http://gpredict.oz9aec.net;

27. Lab Cat
Everyone needs a lab cat!

28. Starter Projects

29. Project: Amateur Radio Satellites

30. Amateur Radio Satellites
Source: https://www.amsat.org

31. Amateur Radio Satellites
Source: http://www.satview.org/lista_sat.php?cat=amateur

32. Amateur Radio Satellites
Source: https://www.amsat.org/oscar-numbers-policy

33. Amateur Radio Satellites
 Cheap Baofeng radio
 Extended whip antenna
 Tune to frequency
 Use GPredict to see when the satellite is over your location
 Point your antenna at the moving LEO and adjust for polarisation
 Frequency will need to change as it passes over for doppler effect
+

34. Amateur Radio Satellites
References
 https://www.amsat.org/
 http://www.satview.org/lista_sat.php?cat=amateur
 http://www.wia.org.au/clubs/vk1/AmsatAustralia
 https://www.youtube.com/watch?v=mv4K41Ztax8
 https://www.friendlyskies.net/hamradio/using-a-baofeng-
handheld-transceiver-to-work-amateur-radio-satellites-amsat

35. Project: International Space Station
(ISS)

36. International Space Station (ISS)
Voice
Packet (text messages)
Slow Scan TV (SSTV)
Source: https://spaceflight.nasa.gov/station/reference/radio; https://www.nasa.gov/mission_pages/station/main/index.html

37. International Space Station (ISS)
 Cheap Baofeng handheld radio
 Antenna options:
 1/4 wave antenna (ISS has a strong signal), or
 Make a directional antenna (yagi)
 Track and listen by hand as it moves over your location
Sources: https://baofengtech.com/baofeng-radio; http://wa5vjb.com/references.html
+

38. International Space Station (ISS)
Yagi materials:
 Wood
 Wire e.g. Al/Cu …
 Soldering iron
 Cable
 Connector
Sources: https://baofengtech.com/baofeng-radio; http://wa5vjb.com/references.html

39. International Space Station (ISS)
 Plug your new yagi into the Baofeng radio and turn to the freq
 Use GPredict to see when the ISS is over your location
 Point your antenna at the moving ISS and adjust for
polarisation
 Frequency will need to change as it passes over for doppler
effect
Sources: https://www.lifehacker.com.au/2010/02/macgyver-of-the-day-ham-radio-hacker-diana-eng

40. International Space Station (ISS)
References
 DIY Yagi designs: http://wa5vjb.com/references.html - See section
“Cheap Antennas for Low Earth Orbit”
 https://www.rtl-sdr.com/receiving-iss-data-comms-rtl-sdr
 https://www.rtl-sdr.com/tag/international-space-station (uses
LNA4ALL and V-dipole antenna)
 https://amsat-uk.org/2015/01/29/iss-sstv-this-weekend/
Source: https://baofengtech.com/baofeng-radio

41. Project: Cubesats

42. Cubesats
 Miniature satellites
 10x10x10 cm cubes
 Low Earth Orbit (LEO)
 Research purposes
 Over 800 launched so far
Source: https://en.wikipedia.org/wiki/CubeSat#/media/File:CubeSat_in_hand.jpg

43. Cubesats
 The same technique can be done with cubesats!
Source: https://www.lifehacker.com.au/2010/02/macgyver-of-the-day-ham-radio-hacker-diana-eng/

44. Cubesats
Funcube
 FUNcube-1 satellite (AO-73)
 Launched in 2013
 For educational purposes
 Funcube dongle
 Dashboard software for telemetry
Source: http://www.funcubedongle.com
Function Frequency Range
Uplink 435.150 – 435.130 MHz
Downlink 145.950 – 145.970 MHz
Telemetry 145.935 MHz BPSK

45. Cubesats
Decoding Funcube Telemetry
Source: https://funcube.org.uk/space-segment/antennas; http://www.digitalrust.co.uk/funcube-satellite.html
+

46. Cubesats
References
 https://www.rtl-sdr.com/tag/cubesat
 http://destevez.net/2017/05/a-tour-of-qb50
 http://www.funcubedongle.com
 https://www.rtl-sdr.com/how-to-receive-the-funcube-satellite-with-
an-rtl-sdr/
Source: https://baofengtech.com/baofeng-radio

47. Project: NOAA
Source: https://en.wikipedia.org/wiki/NOAA-18

48. NOAA
Weather Satellites
 NOAA: National Oceanic and Atmospheric Administration
 Images of clouds, surface features, atmospheric
temperature, ozone data
 GOES: Geostationary Operational Environmental Satellite
 Atmospheric, surface measurements, severe storm tracking,
space weather monitoring and meteorological research
 Meteor:
 Russian weather satellite for weather forecasting, climate
change monitoring, sea water monitoring/forecasting and
space weather analysis/prediction, 12 times greater image
quality than NOAA
 Fēngyún:
 Chinese weather satellites

49. NOAA
Frequencies
NOAA 15 - 137.620 MHz
NOAA 18 - 137.9125 MHz
NOAA 19 - 137.1 MHz

50. NOAA
Antenna Options
Turnstile
QFH: Quadrifilar Helix Antenna
Discone

51. NOAA
Receiver Options
RTL SDR
HackRF
+

52. NOAA
Linux Software Options
GPredict - predict where the LEO Satellite will be
GQRX - record the signal
Audacity - edit the wav file for decoding
WxToImage - convert the wav file to an image

53. NOAA
GPredict
 Set your ground station location
 Update the TLE: Two Line Element
 Wait for them to pass over your location
 Don’t forget about Doppler
 As satellite moves away from your: frequency will appear
lower
 As satellite moves closer to you: frequency will appear be
higher
 GPredict can auto-calculate the doppler
 Also has rotator support

54. NOAAGQRX
• 42KHz wide approx; Listen and record as the signal comes into
view and get as clear as possible

55. NOAA
Audacity
• Import your recorded wav file from GQRX into Audacity
• Note: remove noise at either side for best results
• Merge stereo tracks into 1 mono track
• Normalise
• Change sample rate to 1105
• Normalise
• Export audio as PCM 11025 wav file

56. NOAA
WxToImage
• $ wxtoimage filename-11025.wav filename.png
• Volia and check your work!

57. NOAA
Results can vary…

58. Project: Iridium

59. Iridium
 Motorola – 1990s
 World wide coverage
 LEOs but so many there is plenty of coverage (spot beams)
 Carries messages, voice, internet data, mobile data, mobile
voice, emergency, marine, aircraft, tracking, fleet management
 Researchers Stefan and Schneider (CCC and Hope
conferences) have done great RE work on the protocol and
recommendations for DIY receivers
 Lots of DIY antenna options
 Filters are advisable
 Iridium toolkit for voice and text decoding
 Frequencies
 1616 MHz and 1626.5 MHz.

60. Iridium
Source: https://www.sigidwiki.com

61. Iridium
Receiver options
+ OR
OR

62. Iridium
 Amplifier x 2 e.g. LNA4ALL
 May be optional,
depending on your area
 http://lna4all.blogspot.com.au/

63. Iridium
Antenna option: Modified GPS antenna

64. Iridium
Antenna option: Modified Inmarsat antenna

65. Iridium
Antenna option: Real iridium antenna

66. Iridium
Antenna option: Hiding receiver hardware from the sun

67. Iridium
 Extracting good bits from the sky
$ iridium-extractor -D 4 /home/sdr/tools/iridium/gr-iridium-
master/examples/hackrf.conf | grep "A:OK" > output.bit
 Parsing the bits
$ python iridium-parser.py output.bit > output.parsed
 Checking message types
$ ./stats-parsed output.parsed

68. Iridium
Some captured message types

69. Iridium
Decoding voice

70. Project: Inmarsat

71. Inmarsat
 UK company
 World wide mobile services
 Phone and data services
 Aircraft (Inmarsat Aero)
 13 GEO satellites
 Frequencies
 Uplink: 1626.5 - 1660.5 MHz
 Downlink: 1525.0 - 1559.0 MHz.

72. Inmarsat IsatM2M and Inmarsat D
Source: https://www.sigidwiki.com

73. Inmarsat
 Aeronautical (Classic Aero): analog voice/fax/data services
for aircraft.
 Inmarsat-C: "satellite telex" with store-and-forward, polling etc.
 Inmarsat-M: voice services
 Fleet: voice, fax/data, ISDN, shared-channel IP packet-
switched data services, Mobile Packet Data Service (MPDS)
 Swift 64: voice, fax/data, ISDN and MPDS services (for private,
business, and commercial aircraft)
 Inmarsat D/D+/IsatM2M: pager type traffic (mainly used for
tracking trucks and buoys)
 IsatPhone: voice, fax/data

74. Inmarsat
Antenna Option
 Outernet used to be on Inmarsat until recently
 Patch antennas and filters are great value
 Amplifier x 2 e.g. LNA4ALL (optional depending on your area)

75. Inmarsat
Software
Windows
 http://www.inmarsatdecoder.com
 http://www.tekmanoid.com/egc.shtml

76. Inmarsat
References
 https://en.wikipedia.org/wiki/Inmarsat
 https://www.rtl-sdr.com/rtl-sdr-tutorial-decoding-inmarsat-std-c-
egc-messages

77. Lab Cat
Everyone needs a lab cat (part 2)!

78. Project: Ku Band

79. Ku Band
Hardware
SDR > 2GHz may be required e.g. HackRF
Bias Tee (12V++) - not USB which only supplies 5V
Target freq minus local oscillator freq (LO)
LNB quality
Note: Excellent value bias tee’s can be purchased from GPIO Labs (iseebluewhale on ebay)

80. Ku Band
Software
GQRX / SDRSharp
SatPointer
GNU Radio Companion
- Balint’s flow graphs
- gr-satellite
Example using Optus D1 - http://frequencyplansatellites.altervista.org/Optus/Optus_D1.pdf

81. Ku Band
Setup
Sources: aaa
+

82. Ku Band
Variables
Azimuth – measure exactly or move into position
Elevation – measure along LNB support beam exactly
Polarisation – check in the spec
Power to LNB
LNB quality
Cable quality

83. Ku Band
Finding Satellites with a Dish
Elevation – measure the bar holding the LNB
Azimuth - compass
Iphone App and show pix
Sat Finder box

84. Ku Band
Recording Signals
GQRX

85. Ku Band
Recording Signals
GQRX

86. Ku Band
Identifying and demodulating signals
Balint Seeber – Blind Signal Analysis Videos and GNU Radio Flow
Graphs:
• http://wiki.spench.net/wiki/Presentations#Blind_Signal_Analy
sis
• https://www.youtube.com/watch?v=drsgh_PZmJ8
• http://static1.1.sqspcdn.com/static/f/679473/21011155/13532
78929180/Seeber-BlindSignalAnalysis.pdf

87. Satnogs

88. Satnogs
Open Source global network of satellite ground-stations
Bill of Materials
3D printable and off the shelf parts

89. Satnogs
Ground stations and scheduling

90. Satnogs
References
• https://satnogs.org
• https://network.satnogs.org
• https://network.satnogs.org/stations
• https://wiki.satnogs.org/Build

91. Retail therapy

92. Gumtree & eBay Gems
Satellite shopping is fun!
There are lots of interesting receivers to be found…
I bought an older “portable” Inmarsat UltraLite – but its 26 Kg!
Space collectables
News vans
Source: https://www.globalsecurity.org/space/systems/inmarsat.htm; http://www.onvision.co.uk/vehicles/fully-redundant-hd-
dsng-1-1-with-1-8m-antenna-spectra-uk-built

93. Lessons Learned
Start with small projects!
Start with GEOs!
Start with a small dish!
You will need lots of connectors!
Use good cables!
USB Bias Tee’s are only 5V!
Don’t forget about polarisation!

94. More Projects
Use motors to follow LEOs
• Satnogs uses Yagis but can scale up into dishes
• Travis Goodspeed’s Project “Hillbilly Tracking of Low Earth Orbit
Satellites”
• http://travisgoodspeed.blogspot.com.au/2013/07/hillbilly-
tracking-of-low-earth-orbit.html
Bigger dishes
• C Band > 1.2m
• X Band
• Endless funtimes…

95. Where can I learn more?
https://www.rtl-sdr.com/category/satellite
https://www.sigidwiki.com
https://satnogs.org
Any videos by Balint Seeber
ARRL Satellite Handbook
Roland Proesch Books
#hearsat on starchat irc
##rtlsdr on freenode irc

96. Australian Meetup Groups
Cyberspectrum Melbourne
Cyberspectrum Canberra
Cyberspectrum Sydney
SDR Meetup Hobart
Local HAM groups
Local HackerSpaces

97. Questions
Source: http://gemssty.com/2007/06/27/pimp-my-satellite-dish/