Lately I've been experimenting with software-defined radio (SDR) and have come up with some heuristics by which I can visually identify certain kinds of signals by looking at their representation on a waterfall diagram. Certain obvious characteristics such as frequency and bandwidth can be measured, but how might one systematically go about determining such things as modulation and channel coding?

All of the books and papers I've read describe the process of transmitting or receiving a known signal, but none that talk about the identification and decoding of unknown signals. Is there a system or method? Are there papers, books or other documents that describe this?

Edit: Perhaps it wasn't clear enough from the original question, but what I'm looking for are techniques (read automatable techniques) that might be used to classify and demodulate an unknown signal that is received over the air. For example, by what method might one automate a method that would reliably identify 16QAM modulation?

  • 1
    This answer has some useful resources for using visual identification on waterfall displays. Perhaps looking at those will help you find a method that might meet your needs: ham.stackexchange.com/a/1045/9
    – Adam Davis
    Commented Mar 25, 2014 at 19:25

4 Answers 4


As atdre suggested, you might want to check on and learn how usual, known, modulations function. That way you'll usually be able to at least figure out what kind of modulation is in question. In most cases it will turn out to be some known modulation. Read on how AFSK or POCSAG work for example.

Carl Weisman did a series of introductory lessons on RF and wireless communication: Part 1 , Part 2, Part 3 , Part 4. The lessons cover different types of modulation.

Also , passing the signal trough a few known demodulators can sometimes yeild results. Multimon-ng is a handy tool.

Oona recently wrote an interesting blog post about reversing an unknown signal from a helicopter video so you might find some hints there too.


If you can't access the modulation specifics in the documentation or via FCC and patent searches, then you might want to reverse it out of the firmware or chip off.

If you can get an audio-out or oscilloscope visual of the signal, then you may be able to determine the type of modulation -- whether FSK, simple on/off keying, or another data format (especially easy to spot might be ones like POCGAG and Flex). Data will always sound like a dialed modem, and it might not be too difficult to pick out certain types of modulation just based on this sound.

The RTLSDRs, which can receive only in frequencies from 64 to 1700 MHz, with some gaps around 1100–1250 MHz -- isn't ideal to do this, but it certainly can be done with just a 20 USD device and GNU Radio Companion aka GRC (which supports two-level and four-level FSK signals out of the box, no money for additional "add-ons" involved). The Hak5 Youtube channel covers using RTLSDRs with GRC.

A simple alternative to SDR (besides straight hardware, but this option does require some hardware) is RFcat. You can see a 2FSK demodulation process from that Inguardians blog post, as well as more information on how to find the information from the FCC.

However, even if you prefer SDR -- there are a few more options currently (and soon to be) available. Coming soon is the HackRF device, which will let you transmit using GRC -- a step above the RTLSDR. Available now are the Funcube and the Ettus Research Universal Software Radio Peripherals (USRP), which also work with GRC.

  • While these are valid techniques, that answer doesn't really match the question. The question is about how to decode an UNKNOWN signal that is received over the air. Disassembling the transmitter is not an option; the type, purpose, owner, manufacturer and even the location of the transmitter is generally unknown in this instance.
    – Edward
    Commented Mar 25, 2014 at 17:22
  • Nah, if you know who owns the land or nearby land, this may reveal a company who owns a certain lieu of products some of which happen to use a certain RF chip that matches some known frequency range. Purpose may occasionally be revealed by band. It really depends on the situation. What is your situation?
    – atdre
    Commented Mar 25, 2014 at 17:52

RF signals are composed of three possible modulations: Amplitude, Frequency, and Phase.

Once you've determined the width and center frequency of the signal, analyze the amplitude changes, if any. Try to determine if the amplitude is periodic. Similarly, look at the frequency and phase.

Most radio systems conform to established standards, so once you've identified which modulations the signal is using, and whether they appear to be discrete or continuous, you can narrow them down to more specific possibilities.

Note that some will be very complex, and won't be easily discerned using this type of system. GPS can't be understood this way because you're receiving signals from many satellites simultaneously, and must separate them using code division techniques. Other new technologies such as MIMO are similarly complex, and won't easily succumb to any automated system looking at the above three modulations alone.

But it should give you a start.


After reading this excellent presentation

http://ewh.ieee.org/r5/denver/sscs/Presentations/2012_10_Agilent2.pdf ,

I have a much better understanding of where all the modes come from and that their decoding might not be so utterly complex. A lot of the apparent complexity comes from sloppy terminology, different points of view and several names for the same thing, as I read in CCC-editor where many modes use the same decoder

On the Wavecom website there is a lot of information (CCCeditor), examples and I suspect even decoders, that can be downloaded for free. From the information on the Sigmira and Sorcerer websites, and also Wavecom which appears to be no longer active, I get the idea that the various decoders are some-how or some-where available, or built into the software as modules and that they must just be activated, copied in or selected.

The Wavecom CCCeditor show a great many digital modes and the names of the decoders. Once the right decoder was selected, one only have to adjust one or two parameters, mainly baud rate, to decode the signal. Not that I know how to do this, or where to find the decoders, but it gives an idea.

Out of this will come decoded text, which may be freeform or arranged according to some protocol such as for POCSAG or ACARS and that might need further interpretation. The Constellation display and Eye-diagram can be used to determine when the right baud and other adjustments are selected.

If given the OK. I can write a page or two on how I think we can proceed from here, but I suggest that you look in great detail at the Wavecom/ Sigmira / Sorcerer approaches, do a bit of disassembly and see if one can discover the various decoders and hopefully re-use them or upgrade them. Them we simply need a GUI and GNURADIO could be a good starting point.

73 Henry ZS3HA

  • On the Wavwcom.ch web site, downloads, there are a lot of stuff and there may even be a working decoder etc., but it we need help to explore and understand what is there and how it functions together. For 1 person, I would say there is enough work for for 2 or 3 months. Download, Try out, Read manuals, Try again - Henry
    – Henry
    Commented Jun 23, 2017 at 6:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.