Signal analyzer ISM 868 - voxo22/hackrf-spectrum-analyzer GitHub Wiki

ISM 868 MHz refers to the use of the 868 MHz frequency range for applications associated with the ISM (Industrial, Scientific and Medical) radio bands and related short-range wireless communication systems. In Europe, the 868 MHz range is widely used for low-power wireless devices, remote monitoring, telemetry, and Internet of Things (IoT) applications.

Unlike conventional radio broadcasting systems, wireless systems operating around 868 MHz are typically designed to transmit small amounts of data between devices. The specific frequencies, permitted transmit power, duty cycle, and access requirements depend on the applicable European regulations and the particular sub-band being used.

Common applications

  • Smart metering: Remote reading of electricity, gas, and water meters.
  • Home automation: Wireless sensors, switches, alarms, and control systems.
  • Internet of Things (IoT): Communication between connected devices and gateways.
  • Industrial monitoring: Transmission of sensor measurements and equipment status.
  • Remote control and telemetry: Monitoring and controlling devices over a wireless link.
  • Smart agriculture: Wireless monitoring of soil moisture, temperature, and environmental conditions.

The ISM 868 analyzer discovers and decodes short-range devices in the 863-870 MHz band.

Acquisition and protocol confirmation

The analyzer first measures active emissions and estimates their center frequency, occupied bandwidth, dBFS level and SNR. Frequency, bandwidth and modulation can produce a protocol candidate, but do not by themselves prove the protocol. A plain candidate row can therefore represent interference or another device using similar RF parameters.

A protocol-specific name is used only after the corresponding synchronization and integrity checks succeed. The center-frequency DC spike is excluded from spectral detection, so the receiver's persistent zero-frequency artifact does not create a table row.

For wide recordings, a background polyphase channelizer follows multiple narrow signals across the visible band. Continuous I/Q history prevents short packets from falling between GUI refreshes.

Supported decoders

Wireless M-Bus

  • S mode at 32.768 kchip/s using Manchester coding.
  • C mode at 100 kbit/s using NRZ coding.
  • T mode at 100 kchip/s using 3-of-6 coding.
  • EN 13757 format A and format B, including synchronization, coding and validation of every data-link CRC block.
  • Manufacturer, meter ID, device/medium, version, C, CI, access number, frame format and security information.
  • Clear OMS DIF/VIF records for readings, dates, energy, volume, power, flow and temperatures.
  • Meter-specific support for Techem, Qundis/Siemens, Apator, Kamstrup heat/cooling meters, Ista heat/HCA devices and LSE water/heat devices.

Encrypted application data is identified but is not decrypted without the appropriate meter key. The RF/link-layer row can therefore be valid even when reading columns remain empty.

LoRa and LoRaWAN

The native LoRa receiver supports 125 kHz and 250 kHz bandwidths, spreading factors SF7-SF12, explicit PHY headers, coding-rate recovery and payload CRC validation when a CRC is present. A preamble lock may appear while the analyzer is still collecting the complete frame.

For recognizable LoRaWAN frames, the table can show the message class, DevAddr or DevEUI-based identifier, FCnt, FCtrl, FPort and FOpts length. LoRaWAN MIC verification and application-payload decryption require session keys and are not performed.

Other supported devices for now:

  • Fine Offset WH65B-compatible weather-station packets, with CRC/checksum validation and columns for temperature, humidity, wind, rain, UV/UVI, light and battery state.
  • Renault TPMS packets, with sensor ID, tyre pressure, temperature and CRC validation.
  • Automotive key-fob-like FSK/biphase bursts. This is a waveform classification only; rolling-code payloads are not interpreted and the row remains a candidate.
  • Other unknown SRD, FSK, OOK and LoRa-like emissions remain candidate rows with RF diagnostics.

Table columns and counters

The left side identifies the signal or device: frequency, meter/device ID, manufacturer, protocol, medium, Wireless M-Bus link fields, security and application driver. Reading and environmental columns follow, then the common RF/statistics columns.

  • RSSI - relative input level in dBFS, not calibrated dBm.
  • SNR - estimated signal-to-noise ratio in the captured I/Q stream.
  • Received - distinct observations assigned to the row. Repeated analysis of the same overlapping Wireless M-Bus telegram is suppressed by access number or payload timing.
  • Missed - Wireless M-Bus telegrams inferred from gaps in the modulo-256 access number.
  • Tx period - average interval between observations. It is calculated after at least two received events for decoded devices as well as unidentified frequency/protocol rows. Wireless M-Bus access number gaps are included, so a missed reception does not make the transmitter look slower.
  • CRC - OK means the decoder's frame integrity check succeeded. Candidate rows show --.
  • Last seen - elapsed wall-clock time since the latest row insertion or update. During WAV replay it deliberately does not use the recording's original timestamp.

The default sort is ascending frequency. Click a column heading to change sorting and drag headings or their edges to rearrange and resize columns. Column order, widths and sorting are saved under the ism868.table.* keys in hackrf-iq-analyzer.ini and restored the next time the analyzer opens.

Row colors, updates and tracking

Confirmed protocols and common manufacturers have different background tints. LoRa is blue; Techem T mode is red and Techem C mode is orange. Qundis, Kamstrup, Apator and ista rows have their own manufacturer colors.

Every existing row briefly flashes neutral gray for 300 ms when a distinct new observation updates it. Click a row to highlight it with a light background and black text. The highlight is persistent across table refreshes and sorting; a subsequent update of that tracked row also plays a chime. The message below the table summarizes this behavior.

Capture setup

To see the complete band in one recording, use a center near 866.5 MHz and at least 8 MS/s. Narrower live channels and recordings are also valid; the status line reports the exact portion of 863-870 MHz currently visible. A signal must fall inside that visible interval to be detected.

Use enough gain for a clear SNR without clipping the I/Q samples. The displayed power is dBFS and cannot be interpreted as absolute RF power until the receiver, gain and frequency response are calibrated.

Interpretation notes

  • A row labelled candidate is not a decoded protocol frame.
  • A valid Wireless M-Bus or LoRa PHY frame does not imply that encrypted application data can be read.
  • Several devices may share one nominal frequency; decoded IDs keep their rows separate.
  • Very short, weak or partially captured packets may be measured as RF activity without reaching a protocol decoder.