Goal and scope This tutorial shows how to receive and decode ADS-B transmissions for situational awareness in electronic warfare contexts. The aim is to treat ADS-B as a passive sensor: a cheap, line-of-sight air picture that helps correlate RF activity, detect anomalous tracks, and provide context for spectrum incidents. This is an observer guide only. Do not transmit on aviation bands, do not attempt to interfere with aircraft avionics, and follow local laws and service terms when sharing data.

Quick primer on what ADS-B is and why it matters to EW ADS-B Out is the broadcast of aircraft position, altitude, identity and velocity using Mode S Extended Squitter on 1090 MHz (and UAT 978 MHz in the U.S. for some general aviation). Messages are unencrypted broadcasts intended for line-of-sight reception by ground stations and other aircraft. Because it is open and ubiquitous, ADS-B is a high-value passive sensor for civil air traffic awareness but it has limits: not every aircraft broadcasts, the protocol has no built-in authentication, and spoofing or message injection is documented in the literature. Use ADS-B as one input among many and validate with independent sensors whenever possible.

Hardware and cost-effective receiver options

  • RTL-SDR dongles (RTL2832U-based) with a tuned 1090 MHz antenna are the lowest-cost entry point. They receive mode S / ADS-B reliably within tens of kilometers depending on antenna height.
  • FlightAware Pro Stick or other dedicated 1090 MHz front ends provide improved sensitivity and filtering for field or lab use.
  • SDRs with wider dynamic range (SDRplay, Airspy) are recommended if you intend to capture raw IQ for research or advanced signal analysis. Use an appropriate 1090 MHz antenna (collimated gain for distance, vertical polarization) and place it high and clear of obstructions. No transmitting gear is required for decoding.

Software stack and simple lab setup A common, practical stack for decoding and piping ADS-B data is:

  • dump1090-fa or readsb to decode 1090ES from the SDR and provide network outputs.
  • Optional: piaware/feeders or Docker images to forward to services if you choose to feed them. Do not feed external services without checking terms and privacy settings.
  • pyModeS or libmodes for programmatic decoding, CPR position computation and higher level processing in Python.

Minimal install and first run (example on Debian/Raspbian) 1) Install dependencies and the decoder. On Raspbian it is common to install dump1090-fa from FlightAware (package names and steps differ by distro). Example: sudo apt install dump1090-fa. Once running, dump1090-fa will listen on local network ports for clients. 2) Verify network outputs. dump1090 and derivatives provide multiple network outputs: SBS/BaseStation-format text (commonly on TCP port 30003) and Beast binary (commonly on TCP port 30005). You can inspect the human-readable SBS stream with: nc 127.0.0.1 30003 and watch CSV lines for aircraft updates. The Beast port is a binary stream used by many clients. 3) Use a web UI such as the built-in dump1090 web interface or tar1090/readsb web front ends to get quick situational awareness on a map. These are convenient for tuning antenna placement and coverage testing.

Data formats you will encounter

  • SBS/BaseStation CSV: readable text lines containing callsign, lat/lon, altitude, heading, speed. Good for quick scripts and debugging. Typically available on port 30003.
  • Beast binary: binary format with timestamps and signal metadata, used by many visualization and feeder tools. Typically on port 30005. Use a client library or an adapter to convert Beast to JSON/SBS if you need human readable output.
  • Raw Mode S frames: 56- or 112-bit frames including parity. Advanced users may capture raw frames or IQ to perform error analysis or forensics. Libraries such as libmodes and pyModeS help parse frames into fields.

ADS-B message anatomy and position decoding (what to expect) Civil ADS-B DF17 messages are 112 bits long and contain fields for ICAO address, message type code, payload and parity. The airborne position messages encode latitude and longitude in the Compact Position Reporting (CPR) format using 17-bit lat and lon fractions and a 1-bit even/odd flag. To recover a position you normally need an even/odd pair within a short time window, or a reference position for single-message local decoding. Libraries such as pyModeS implement CPR and helper functions to return lat/lon pairs from message pairs. Understanding even/odd CPR behavior is essential when you try to correlate tracks across sensors.

Practical decoding example using pyModeS (Python)

  • Capture SBS output (port 30003) or connect to dump1090’s Beast port via a parser. For prototyping you can use the SBS stream: connect with a TCP client and parse CSV fields. Once you have hex Mode S messages, pyModeS can parse fields:

Example snippet:

import pyModeS as pms msg = “8D40621D58C382D690C8AC2863A7” # example 112-bit hex message icao = pms.icao(msg) if pms.df(msg) == 17: tc = pms.adsb.typecode(msg) if 1 <= tc <= 4: callsign = pms.adsb.callsign(msg) elif 9 <= tc <= 18 or 20 <= tc <= 22: # position messages are encoded; need even/odd pairs to recover lat/lon # keep messages per ICAO and combine even/odd via pms.adsb.position pass

pyModeS exposes pms.adsb.position and pms.adsb.airborne_position helpers that implement the CPR calculations; integrate these into a per-ICAO state machine to produce continuous tracks.

Using ADS-B for EW situational awareness: tactics and caveats

  • Correlation. Use ADS-B to correlate emissions, flight plans and observed radar or comms activity. ADS-B gives an identity and altitude that help prioritize targets for spectrum monitoring. - Limitations: military and sensitive flights may turn off ADS-B Out, use non-broadcast surveillance, or appear with privacy addresses. Do not assume absence of an ADS-B track equals absence of an aircraft.
  • Integrity concerns. ADS-B lacks cryptographic authentication. Academic and operational research shows spoofing and injection are feasible with modest RF gear. Treat ADS-B as untrusted telemetry for high-consequence decisions unless validated by independent sensors such as primary radar, multilateration (MLAT) results, or RF direction finding. Implement sanity checks such as expected flight corridors, altitude continuity, speed/acceleration thresholds and cross-sensor validation.
  • Privacy and ethics. Some operators use the FAA Privacy ICAO Address program or data-blocking services to limit public association of position to registration. When you publish or share ADS-B-derived tracks, respect these programs and the data recipients’ terms.

Signal-level and RF hygiene tips

  • Antenna height beats gain. Raising a simple vertical antenna will usually outperform a higher-gain antenna at low mounting height because line-of-sight matters. - Watch receiver front-end overload. Strong nearby transmitters can desensitize low-cost SDRs. Use filtering or a front-end with better dynamic range for operations near airports or strong UHF sources. - Timestamping matters. Beast-format outputs include receive timestamps and signal metadata that help multilateration and correlation with RF captures. If you plan EW analysis, preserve timestamps and signal strength metadata for each decoded frame.

Operational example workflows for EW teams

  • Passive baseline: run a network of receivers to build an area air picture. Export aircraft lists in JSON or CSV and feed them to your situation displays. - Event correlation: when you detect unexpected emissions on a frequency or see a suspected jamming event, query historical ADS-B tracks for aircraft in the area to rule in or out friendly traffic. - Anomaly detection: compute velocity and heading residuals, check for duplicate ICAO codes, and flag ghost tracks or implausible maneuvers for operator review. Again, validate with independent sensors where possible.

Legal and safety reminder Receiving ADS-B with off-the-shelf receivers is widely practiced and supported by regulators as part of public surveillance. ADS-B is broadcast in the clear and can be received with consumer equipment. However, transmitting, jamming, replaying, injecting or otherwise interfering with aviation communications is illegal and dangerous. Respect the FAA’s equipage rules, the privacy programs in place, and local telecommunications regulations. If your work moves from passive monitoring to any active RF work, secure proper authorization.

Closing notes and next steps ADS-B is a powerful passive layer for EW awareness when used correctly. Start with an RTL-SDR and dump1090 to get a feel for coverage, move to better front-ends and multiple receivers for reliability, and build a small processing pipeline with pyModeS for CPR decoding and sanity checks. Combine ADS-B with RF direction finding, primary radar feeds, and human reporting for a resilient picture. If you will incorporate ADS-B into operational decision chains, plan for data validation and treat ADS-B as one of several corroborating sources.