Read the pattern.
Then test the explanation.
A bright trace is a place to begin. It is not a device identity, a decoded command, or a security finding.
Part 3 established a receive-side workflow. This installment examines the next question: what can time-domain samples, an FFT, a waterfall, and an I/Q constellation tell you about how information is represented?
The experiments here generate synthetic data entirely in your browser. You need no SDR, receiver driver, sample recording, or Python installation. The known generator settings let you compare an observation with its ground truth; they do not turn these tools into automatic classifiers for unknown signals.
Observation → candidate explanation → validation → bounded conclusion. Do not skip from a familiar-looking pattern to a protocol or vulnerability claim.
- Compare time samples and FFT bins
- Recognize noise, leakage, and phase effects
- Separate sample, symbol, bit, and payload rates
- Document evidence, alternatives, and limits
One signal. More than one view.
A simplified real carrier can be written as x(t) = A cos(2πft + φ). Amplitude A describes magnitude; frequency f describes cycles per second; phase φ describes position in a cycle relative to a reference. A communication system changes one or more properties to represent information.
A time plot makes changes in envelope, timing, and waveform visible. A frequency plot shows the distribution of energy across frequency. Neither is the complete story. The same samples can look different when you change the display span, scale, averaging, or FFT window.
Time domain
Ask whether activity is continuous, burst-like, periodic, or changing in amplitude. Preserve the sample-rate context before measuring timing.
Frequency domain
Ask where energy is concentrated, how broad it appears, and whether extra components might be harmonics, artifacts, interference, or leakage.
Complex I/Q
Use in-phase and quadrature components to represent magnitude and phase, including signed offsets around a tuned center.
Symbol decisions
A useful constellation generally needs filtering, timing, and carrier synchronization. Arbitrary raw samples are not automatically valid symbol points.
What the FFT can actually tell you.
The Fast Fourier Transform efficiently calculates a Discrete Fourier Transform. It maps a finite block of samples into frequency bins. For sample rate Fs and N samples, bin spacing is Fs / N and the observed block duration is N / Fs.
2,000,000 / 2048≈ 976.56 Hz between bins.
Not a promise of protocol identification.
FFT.js transforms generated samples; no RF is captured. The FFT uses coherent-gain window normalization with a unit complex-tone reference: a coherent complex tone is 0 dBFS, while a unit real cosine splits into symmetric components near −6.02 dB each. Time traces auto-scale vertically. Noise spread is per-component amplitude standard deviation, not a calibrated SNR. Bin spacing is not the same as resolving two nearby signals; windows change the main-lobe and leakage trade-off.
A narrower bin is not free information.
Increasing FFT size at a fixed rate observes a longer block and places bins closer together. It does not repair bad samples or manufacture detail from a short recording. Zero-padding alone produces more display samples, not the same resolving ability as observing a longer signal.
For a tone that is not centered on an FFT bin, a rectangular window can spread energy into distant bins: spectral leakage. A Hann window reduces distant sidelobes while broadening the main lobe. Window choice is a trade-off, not a universal “more accurate” button.
Add time without adding certainty.
A spectrum is a snapshot or averaged view. A waterfall stacks spectra over time. That can distinguish persistent energy from bursts or moving traces, but its colors depend on the application’s palette, range, gain, and processing.
Short bursts from low-power devices are common in this region. Allocations and permitted uses vary by country. This is an unshifted, single-sided real-signal FFT whose bins are mapped onto illustrative RF labels, not a physical I/Q capture. Exact Hann coherent-gain normalization gives a unit-peak coherent real tone 0 dBFS; this is a tone-amplitude scale, not power spectral density or calibrated dBm. The synthetic background is deterministic, not a measured thermal-noise floor. No radio is received or transmitted.
Describe what is present: a narrow component, broad energy, intermittent activity, repeated-looking bursts, or a frequency change. Do not turn those words into a unique protocol label. Local interference, front-end distortion, tuning errors, and filtering can also shape the display.
Keep the samples in context.
Complex data can be written as z(t) = I(t) + jQ(t). Before analyzing a recording, establish its sample rate, real/complex representation, precision, signedness, byte order, interleaving, channel arrangement, and available tuning metadata. A file extension is not enough.
Apply sampling limits to the appropriate baseband or intermediate-frequency representation. Real band-limited baseband sampling needs a rate above twice the highest represented frequency under ideal conditions. Complex sampling can represent a total centered span approaching Fs, with practical filtering reducing the usable region.
| Operation | Purpose | Condition to remember |
|---|---|---|
| Filtering | Attenuate unwanted components | It can also remove wanted signal content. |
| Frequency translation | Move a region to a different offset | Preserve the rate and tuning context. |
| Decimation | Reduce the sample rate | Use appropriate anti-alias filtering before discarding samples. |
| Interpolation | Increase the sample rate | It does not create missing original information. |
| Synchronization | Align timing, phase, and carrier reference | Incorrect alignment can ruin a constellation or decode. |
A failed analysis may be a metadata, aliasing, capture-quality, or synchronization problem. Keep that separate from whether a protocol uses cryptographic protection.
A modulation family is not a protocol.
AM changes amplitude, FM changes instantaneous frequency, and PM changes phase. Their digital relatives use discrete states: ASK/OOK, FSK, and PSK. QAM combines amplitude and phase states.
OOK is on-off keying: a 1 enables the carrier and a 0 removes it in this ideal model. Symbol timing is illustrative. Real signals add filtering, synchronization, coding, and framing. None of these modes is encryption.
OOK can be consistent with switched carrier amplitude. FSK can be consistent with distinct tone states. BPSK can use two phase states separated by 180°. QPSK has four ideal states and can represent two bits per symbol. QAM alphabets combine amplitude and phase; their practical recovery depends on signal quality and synchronization.
Points need timing and a reference.
A constellation places in-phase values horizontally and quadrature values vertically. Ideal BPSK has two states, QPSK four, and 16-QAM sixteen. Real symbol estimates may spread, rotate, or trace arcs because of noise and imperfect references.
Outlined markers are a normalized ideal alphabet; dots are 192 known symbol-spaced samples with deterministic Gaussian noise and rotation. Axes auto-scale. Drift represents total phase change across the displayed sequence, not a measured frequency offset. This assumes symbol timing is already known; plotting arbitrary raw I/Q samples is not equivalent to a synchronized constellation. No classifier, decoder, or security claim is produced.
The dashed circle is a unit-magnitude reference. I and Q use equal coordinate scales, and each ideal alphabet is normalized to unit average symbol power—not unit peak amplitude. QAM points therefore need not all lie on the circle. Automatic axis scaling can conceal an absolute change in spread; use the stated model settings rather than visual size alone.
The experiment knows the transmitted symbols and samples directly at symbol instants. A real receiver has to establish timing, filter appropriately, and track its carrier reference. Without that work, a raw I/Q cloud may not resemble the ideal alphabet at all.
Noise is not the only explanation for a cloud.
Carrier offset, phase drift, timing errors, clipping, channel effects, and filtering can all affect the picture. The noise control here is a normalized per-component spread, not a calibrated SNR setting. A noisier plot should lead to better questions, not a more confident attribution.
Count symbols, bits, and overhead separately.
Symbol rate is measured in baud: symbols per second. If an alphabet has M equally available states, an ideal symbol can represent log₂(M) bits. The gross uncoded bit rate is baud × bits per symbol. Sample rate is a different quantity.
Uncoded rate = baud × log₂(alphabet size). The coding figure is an arithmetic example, not an implemented code or payload throughput; framing, pilots, retransmissions, and other overhead are excluded. Bandwidth ≈ baud × (1 + roll-off) is an ideal raised-cosine model for suitable linear PSK/QAM signaling, not a universal rule for FSK, OFDM, or every real transmitter. More states generally demand better signal quality and synchronization.
For this ideal raised-cosine model, the full two-sided span is Rs × (1 + β). Its complex baseband edges are ±Rs × (1 + β) / 2. At 100 kbaud with roll-off 0.35, that means a 135 kHz total span, from −67.5 to +67.5 kHz. This theoretical support is not a universal measured occupied-bandwidth definition or a guarantee about practical filters.
At 100 kbaud, ideal QPSK carries 200 kbit/s before coding and protocol overhead. Framing, pilots, error correction, retransmissions, and access scheduling affect useful throughput. Occupied bandwidth also depends on pulse shaping and implementation, not just bit rate.
Higher-order schemes offer more bits per symbol but generally need cleaner conditions and more accurate synchronization. “More states” is not a promise of better range, stronger security, or higher application throughput.
Build the case, not a guess.
Start with the source and sampling assumptions. Compare envelope, bandwidth, timing, and phase behavior. Record a candidate modulation and alternatives, then choose a suitable method to test the candidate. Keep what was observed separate from what was inferred.
Keep observations, candidate explanations, and validation results separate.
Stored in this browser only. This records your review, not permission, automatic signal identification, protocol attribution, or proof of a vulnerability.
A useful hypothesis can be wrong.
For example: “The sample is consistent with two-tone FSK under the current settings.” That statement can be tested against timing, filtering, and a suitable demodulator. “This is a particular brand’s insecure sensor” skips several unvalidated layers.
GNU Radio can generate a synthetic source and display its time and frequency views. URH and Inspectrum can inspect suitable recorded samples. Check source permission, file metadata, software support, and licensing before importing or sharing recordings. No tool automatically turns every capture into a meaningful protocol.
Make the analysis repeatable.
Keep source and simulation status, software versions, rate, format, FFT settings, window, gain where relevant, and the observations that led to each hypothesis. Document the validation result even if it did not confirm the candidate.
Saved only in this browser, with an in-memory fallback when storage is blocked. Export before clearing browser data. Record only authorized observations; do not include secret keys, credentials, or unrelated private communications.
These notes are separate from earlier parts and shared with Part 4’s standalone lab. Export them as a convenience, not as a substitute for secure evidence handling. Do not include unrelated private communications or secrets.
“Four clusters appear after the stated synthetic symbol sampling and reference correction.”
“The live target uses this exact protocol and accepts forged commands.” That needs different evidence and an authorized validation method.
The security question comes later.
RF analysis supports later investigation of confidentiality, authentication, integrity, freshness, availability, and operational leakage. A spectrum cannot independently establish a weakness in any of them.
When a security issue is tested, name the exact control, expected behavior, authorized method, repeatable result, impact, and limitations. A known modulation is the beginning of that investigation, not its conclusion.
Use several views without overclaiming the result
Follow finite-sample and synchronization assumptions all the way from a plot to an analysis report.
Worked example: bins, time, and window trade-offs
At 64 kS/s, a 512-sample block spans 8 ms and has 125 Hz bin spacing. A 2048-sample block spans 32 ms and has 31.25 Hz spacing. The second observation contains more samples over more time; it is not just a finer label on the same measurement.
- Observation duration
- A longer block can help distinguish nearby stable components, but may blur changes that happen during that longer interval. Time and frequency localization trade off.
- A non-bin-centered tone
- A tone such as 5,432 Hz does not land exactly on a bin in the 64 kS/s examples. Its finite observation can leak energy into neighboring and more distant bins.
- Window choice
- A Hann window reduces distant sidelobes while broadening the main lobe. Coherent-gain normalization helps compare tones, but noise measurements also depend on window characteristics and bandwidth.
- Zero padding
- Adding zeros to an existing fixed capture gives a more finely sampled display of its transform. It does not create the same independent information as observing a longer signal.
State sample rate, actual observation length, FFT size, window, and display scale. Do not claim resolving ability from the bin labels alone.
Case file: four clusters do not name a protocol
Four symbol-spaced clusters appear in a known synthetic example after timing is supplied by the generator. QPSK is a plausible description of that alphabet. It does not identify a live device, a frame format, a manufacturer, or a security control.
- Timing assumption
- The explorer starts at known symbol instants. A real receiver must establish timing and filtering; arbitrary raw I/Q samples are not automatically constellation decisions.
- Reference ambiguity
- A 90° rotation can leave an unordered QPSK alphabet looking equivalent while changing which labels a receiver associates with points. Resolve mapping and synchronization through suitable protocol evidence.
- Noise and drift
- Spreading or rotating points may reflect noise, carrier/phase error, timing, clipping, or the channel. The displayed synthetic noise spread is not a calibrated SNR input.
- The next claim
- A validated demodulation may recover a symbol or frame representation. Authentication, freshness, encryption, and acceptance of an action still require separate investigation.
Treat a constellation as one piece of evidence with assumptions, not as an automatic classification, identity certificate, or vulnerability detector.
Questions worth keeping beside the experiment.
Is the strongest FFT bin the exact transmitted frequency?
Not necessarily. A finite observation, bin spacing, window, drift, noise, and other components affect the estimate. The strongest-bin readout names a bin in the stated model, not a calibrated high-precision frequency measurement.
Why distinguish a code-rate example from payload throughput?
A code-rate multiplication accounts for one arithmetic factor only. Framing, pilots, scheduling, retransmission, synchronization, and other overhead affect useful payload rate. The calculator does not implement a real coding scheme or network.
What would validate a modulation hypothesis?
Use supported sample metadata, adequate capture quality, appropriate filtering and synchronization, and a suitable analysis or demodulation method. Record alternatives and negative results. Identifying a family still does not establish the exact protocol or security impact.
Put the chapter to work.
Three controlled assignments connect the explanation to a repeatable observation. Record a prediction, change one variable, compare the result, and check the reasoning.
Trade observation time for bin spacing
Compare actual sample-block duration, bin spacing, and window leakage.
Procedure
- Use 64 kS/s and a 512-sample FFT; record duration and bin spacing.
- Change to 2048 samples while preserving the sample rate.
- Set an off-bin tone such as 5,432 Hz and compare Hann with Rectangular without changing the generated source.
Expected observation
The displayed duration changes from 8 to 32 ms and bin spacing from 125 to 31.25 Hz. The Hann window reduces distant leakage while broadening the main lobe.
Read the related chapterExperiment record
Predictions, observations, and answer-check progress stay in this browser. Export before clearing site data. Do not enter secret keys, credentials, or unrelated communications. Passing a check is a learning result, not a certification or real-world security finding.
Check the analysis habits.
Check the numerical relationships and the limit of a modulation claim. Part 4 has its own saved best score.
Understand. Investigate. Evaluate.
Use each view for the question it can answer. Preserve the original samples and their context, explain alternative interpretations, and keep the path from observation to conclusion visible.
Understand the signal.
Question the conclusion.
Keep a reference beside the plot.
Adapted and expanded from your Beyond the Wire — Part 4: Signal Analysis and Modulation Identification manuscript. Browser plots are original synthetic simulations, not hardware captures or third-party application screenshots. The unedited source is retained separately and downloadable below.
Original source archive228 source paragraphs retained separately.
The edited reading edition above includes the technical clarifications and corrections. This Word document is preserved as supplied for provenance; its wording, illustrations, code formatting, and external setup advice are not silently rewritten. Treat it as an unedited source archive, not a second corrected edition.
Download the original Word document