Before the conclusion,
understand the capture.
The signal is visible. The decoder is silent. Is the device secure—or is your receiver simply looking at the wrong thing?
In Part 1, we mapped the invisible attack surface. Now we slow down and examine the measurements behind it: frequency, power, bandwidth, modulation, antennas, and samples. These explain what a receiver can observe, not whether a system is vulnerable.
A weak capture, an overloaded front end, or an unsuitable filter can produce a convincing but incorrect story. Good RF research starts by knowing which variable changed, which assumption you made, and which claim the evidence supports.
Change one variable. Record the setup. Repeat the observation. Keep physical behavior separate from protocol security.
- Translate between frequency, period, and wavelength
- Distinguish power, phase, gain, and bandwidth
- Recognize sampling and antenna limitations
- Keep a repeatable, evidence-led capture notebook
Frequency, period & wavelength.
Frequency counts cycles per second. Period measures the time occupied by one cycle. Wavelength measures the distance occupied by one cycle in space. They describe the same repeating phenomenon from different viewpoints.
T = 1 / fλ = c / fUse seconds, hertz, and metres.
Free-space c = 299,792,458 m/s.
| Frequency | Period | Free-space wavelength |
|---|---|---|
| 1 MHz | 1 microsecond | ≈ 299.8 m |
| 100 MHz | 10 nanoseconds | ≈ 3.00 m |
| 300 MHz | ≈ 3.33 nanoseconds | ≈ 1.00 m |
| 2.4 GHz | ≈ 0.417 nanoseconds | ≈ 12.5 cm |
A carrier alone has no changing message here. Higher frequency means a shorter wavelength; amplitude changes wave height, not wavelength.
A faster carrier is not automatically faster data.
A 2.4 GHz carrier oscillates very quickly, but those oscillations are not the application’s bit rate. Data rate also depends on bandwidth, symbol rate, modulation, coding, signal quality, and overhead. A higher frequency is not automatically more secure, stronger at the receiver, or capable of reaching farther.
Amplitude, phase & power.
Amplitude describes magnitude. Phase describes position within a cycle relative to a reference. Power describes a rate of energy transfer. Changing one does not automatically change all the others.
The phase vector is normalized to unit amplitude; changing power updates the numeric power conversion, not the vector length. 0 dBm = 1 mW. Phase is relative to a reference, not a measure of confidentiality.
Separate a ratio from an absolute level.
dB expresses a logarithmic ratio. dBm expresses power relative to one milliwatt. For power, +10 dB means ten times as much; about +3 dB means twice as much. Voltage or amplitude comparisons use 20 log₁₀ when the relevant impedance conditions are the same, rather than the 10 log₁₀ power relationship.
Negative dBm values are normal at a receiver. They mean less than one milliwatt, not “negative energy.” A −65 dBm signal above −85 dBm noise has a 20 dB SNR, provided both measurements refer to compatible bandwidths and settings.
Give the whole signal room.
Center frequency tells you where you are looking. Bandwidth tells you how wide a slice you include. A signal’s occupied bandwidth and a receiver’s configured filter are related, but they are not the same quantity.
Make the receiver filter narrower than the signal in the next experiment. You exclude part of its frequency content. Make the filter much wider and you admit extra noise and possibly neighboring transmissions.
Illustrative spectral shape, not a measured signal or a practical filter response. Noise uses −174 dBm/Hz at approximately room temperature and a 5 dB noise figure. Span coverage is not retained power or decoding probability. More bandwidth includes more thermal noise; narrower is not automatically better.
Use the smallest suitable bandwidth, not the smallest possible number.
A practical filter has a transition region, ripple, and implementation limits. A nominal “200 kHz” setting is not a perfect brick-wall filter. Leave appropriate room for the signal, frequency error, and the receiver’s documented usable response.
Wider bandwidth may support a higher data rate under suitable conditions, but throughput also depends on SNR, modulation, coding, retransmissions, and overhead. Neither a wide channel nor a narrow trace establishes security.
Let the symbols change the wave.
Encoding gives information a representation. Modulation maps a representation onto a waveform. Select a modulation family, then change individual symbols to see how the same binary message changes the carrier.
OOK is on-off keying: a 1 enables the carrier and a 0 removes it in this ideal model. Symbol timing is illustrative. Real signals add filtering, synchronization, coding, and framing. None of these modes is encryption.
| Family | What varies | What to remember |
|---|---|---|
| AM / ASK / OOK | Amplitude or envelope | OOK is a simple on/off case of amplitude-shift keying. |
| FM / FSK | Instantaneous frequency or selected tones | Digital tones represent symbols; visual resemblance does not prove a protocol. |
| PSK / BPSK | Phase relative to a reference | BPSK has two phase states separated by 180°. |
| QAM | Combinations of amplitude and phase | Multiple constellation states represent symbols; practical decoding needs suitable synchronization and signal quality. |
Real systems add symbol timing, pulse shaping, synchronization, coding, interleaving, and framing. A waterfall can suggest a structure worth investigating, but it does not identify a protocol with certainty.
The antenna changes the observation.
An antenna couples electrical signals to electromagnetic fields and back again. Its behavior depends on frequency, geometry, matching, polarization, directionality, and the nearby environment—not just the connector on the SDR.
Ideal linearly polarized fields: coupled power ∝ cos²(θ). The lines represent field orientation, not universal antenna geometry. A quarter-wavelength estimate is not a complete antenna design. Reflections, cross-polarization, matching, ground planes, and installation change real behavior; a theoretical 90° null is not a guarantee of zero reception.
Length is a starting point, not the whole design.
At 433 MHz, a free-space quarter wavelength is about 17.3 cm. That is a useful scale, not a universal cut length. Practical designs account for geometry, conductors, dielectric effects, ground planes, feed arrangements, and matching.
A small movement can make a large difference.
Rotating the receive antenna changes polarization alignment. Moving it can change multipath: reflected copies may reinforce or partially cancel. Nearby metal, cables, walls, computers, and the operator can affect the observation.
Ideal free-space, far-field model. Both antenna gains are 0 dBi; extra losses are 0 dB. Walls, fading, interference, antenna orientation, and receiver sensitivity are not modeled. This is not a range or decodability guarantee.
The link-budget experiment is still an ideal far-field free-space estimate. A changed receive level could reflect placement or propagation rather than a changed device state. Keep antenna type, orientation, location, distance, and receiver settings attached to every comparison.
Sampling without the wrong picture.
A sample rate counts samples per second, not carrier cycles or application bits. The radio front end and tuning architecture determine which signal is actually presented to the digitizer and software.
For a real-valued, band-limited baseband signal, frequencies must lie below half the sample rate for ordinary reconstruction without aliasing. Complex I/Q retains two components and can represent signed frequency offsets across a total nominal span approaching the complex sample rate.
Dots are sample instants. Dashed gray is the original I/real component; the solid curve is a sampled-equivalent alias. For complex mode, I and Q distinguish signed offsets. This is a baseband teaching model, not direct GHz carrier sampling. The centered complex span is nominally Fs; practical filters reduce usable bandwidth. Storage always estimates raw complex I/Q with two components, decimal MB, no headers or compression. Nothing is recorded.
Apply the rule to the right signal.
A typical tuned SDR does not necessarily digitize a 2.4 GHz carrier directly at its RF frequency. It translates an RF region to an intermediate frequency or baseband first. Apply the sampling limit to the architecture and representation in use; consult the receiver documentation.
At an exact Nyquist boundary, samples may be ambiguous or depend on phase. Practical anti-alias filters require room beyond a simplistic limit. A nominal 2 MS/s complex stream therefore does not promise a perfectly clean 2 MHz usable receiver span.
Read the spectrum, not a story.
A spectrum shows frequency against a signal-level scale. A waterfall adds time, with color encoding the scale. A stable narrow trace, a short burst, and a broad transmission can look different, but the display is an observation—not an identity certificate.
Short bursts from low-power devices are common in this region. Allocations and permitted uses vary by country. This is an unshifted, single-sided real-signal FFT whose bins are mapped onto illustrative RF labels, not a physical I/Q capture. Exact Hann coherent-gain normalization gives a unit-peak coherent real tone 0 dBFS; this is a tone-amplitude scale, not power spectral density or calibrated dBm. The synthetic background is deterministic, not a measured thermal-noise floor. No radio is received or transmitted.
This browser display is synthetic and uses relative dBFS, not calibrated dBm. It receives no RF and does not access a microphone or radio. Its frequency labels are illustrative; selecting a band is not a statement that reception or transmission is permitted there in every country.
When a visible signal refuses to decode.
- Check tuning and whether the full signal lies inside the captured span.
- Compare gain settings and watch for front-end overload.
- Check antenna suitability, placement, polarization, and nearby interference.
- Check supported sample rate, usable bandwidth, and dropped samples.
- Consider burst timing, overlapping transmissions, modulation, synchronization, and framing.
- Keep encoding and encryption separate from capture quality.
A failed decode is not proof of strong security. A successful decode is not proof that authentication, confidentiality, or authorization failed.
One variable. Repeatable evidence.
Use a synthetic signal, a lawfully provided sample, or an explicitly authorized receive-only setup. Establish normal behavior first. Change one setting, repeat the observation, and write down both the result and the limits of the claim.
- 01
Define source and permission.
Record the permitted devices or file, location, time window, data handling, and stop conditions. Ownership of a receiver is not blanket permission to record everything it can hear.
- 02
Freeze a baseline.
Note hardware, software version, antenna, orientation, sample rate, filter, tuning, and gain. An offline I/Q file lets you revisit the same samples.
- 03
Change one variable.
Compare a gain step, filter width, or display setting while preserving the other conditions. A changed visualization scale can make the same data look different.
- 04
Repeat and bound the conclusion.
Separate “energy was visible,” “symbols were recovered,” and “the authorized test receiver accepted an unauthorized action.” Keep unknowns explicit.
Saved only in this browser, with an in-memory fallback when storage is blocked. Export before clearing browser data. Record only authorized observations; do not include secret keys, credentials, or unrelated private communications.
Turn the RF quantities into engineering decisions
Use numerical examples to keep power, noise, polarization, sampling, and receiver limits separate.
Worked example: power is not the whole margin
Assume an ideal 2.4 GHz, 100 m, far-field free-space link, 10 dBm transmit power, zero-dBi antennas, and no extra losses. The estimated received power is approximately −70.05 dBm. Now suppose a hypothetical receiver requires −90 dBm under a specified mode and error-rate criterion.
- Ideal margin
- The arithmetic margin is about −70.05 − (−90) = 19.95 dB. The sensitivity is an example, not a universal receiver threshold.
- Unmodeled losses
- If an installation adds 8 dB of combined losses under an explicitly stated model, the remaining example margin is about 11.95 dB. Multipath or interference may change behavior in ways a fixed loss does not capture.
- Distance comparison
- Doubling distance in the original free-space model adds about 6.02 dB of loss. That relationship does not guarantee the same change through a real building.
- Security boundary
- A favorable margin may help reception. It says nothing by itself about encryption, authenticated commands, replay resistance, or authorized access.
A link budget is an engineering estimate with assumptions, not a range guarantee, a vulnerability score, or proof of a protocol’s reliability.
Worked example: changing the measurement bandwidth
Using the approximate room-temperature thermal noise density of −174 dBm/Hz and a 5 dB receiver noise figure, a 100 kHz bandwidth gives an estimated receiver noise level of −119 dBm. A 1 MHz bandwidth gives −109 dBm.
- Why the change is 10 dB
- The second bandwidth is ten times wider. The integrated white-noise power rises by 10 log₁₀(10) = 10 dB under the stated assumptions.
- An SNR comparison
- If the wanted signal power is −95 dBm and is preserved by both suitable measurements, the example SNRs are 24 dB and 14 dB. Real interference may dominate either estimate.
- The filter trade-off
- A narrower filter can exclude noise, but it can also remove wanted signal components. Confirm occupied bandwidth and practical transition bands rather than shrinking the filter until the plot looks clean.
- Like-for-like measurements
- Record gain, bandwidth, detector/averaging settings, sample rate, and the receiver reference. Relative dBFS values do not become absolute dBm through subtraction alone.
Compare power levels measured under compatible conditions. “The peak got brighter” and “the signal became more usable” are different claims.
Questions worth keeping beside the experiment.
Why is 0 dBm not an empty signal?
dBm uses one milliwatt as its reference: 0 dBm is 1 mW, 10 dBm is 10 mW, and −10 dBm is 0.1 mW. A negative logarithmic level does not mean negative physical power.
Can I rotate an antenna to guarantee no reception?
No. The ideal linear-field relationship gives cos² mismatch and a theoretical null at 90°, but reflections, cross-polarization, antenna imperfections, and installation effects can produce nonzero reception. Do not build a security boundary from a theoretical null.
Why is the RF carrier not the number used blindly in a Nyquist rule?
A tuned SDR commonly translates a selected RF region to baseband or an intermediate frequency. Apply sampling limits to the actual representation and receiver architecture. Complex I/Q retains signed offsets; the nominal complex span and clean usable bandwidth can differ.
Put the chapter to work.
Three controlled assignments connect the explanation to a repeatable observation. Record a prediction, change one variable, compare the result, and check the reasoning.
Find the filter trade-off
Compare span coverage with the extra noise admitted by wider receiver settings.
Procedure
- Set the occupied signal span to 200 kHz.
- Set the receiver filter to 100 kHz and record the coverage warning.
- Increase the receiver to 200 kHz, then 400 kHz. Compare noise estimates without changing the signal.
Expected observation
A 100 kHz filter includes only half of the nominal span. From 200 to 400 kHz, estimated white-noise power rises by about 3.01 dB.
Read the related chapterExperiment record
Predictions, observations, and answer-check progress stay in this browser. Export before clearing site data. Do not enter secret keys, credentials, or unrelated communications. Passing a check is a learning result, not a certification or real-world security finding.
Check the fundamentals.
Three questions about the quantities and assumptions behind the capture. Your Part 2 best score is stored separately from Part 1.
Good RF security starts with good measurement.
Frequency, power, bandwidth, antennas, modulation, and sampling explain different parts of the observation. None of them, alone, establishes that a system is secure or vulnerable. A useful researcher records the setup and follows the evidence across the system’s trust boundaries.
Observe carefully.
Keep your claims precise.
Keep a source beside the signal.
Adapted and expanded from your Beyond the Wire — Part 2: RF Fundamentals for Security Researchers manuscript. The experiments use idealized synthetic teaching models, not equipment measurements. The unedited source document remains available in the archive below.
Original source archive176 source paragraphs retained separately.
The edited reading edition above includes the technical clarifications and corrections. This Word document is preserved as supplied for provenance; its wording, illustrations, code formatting, and external setup advice are not silently rewritten. Treat it as an unedited source archive, not a second corrected edition.
Download the original Word documentBuild your receive-side lab.
Entry-level hardware, SDR software, lawful recordings, and a repeatable workflow.