Tuesday, January 21, 2014

Sniffing and decoding NRF24L01+ and Bluetooth LE packets for under $30

In this long post I am going to describe my journey to sniff and decode popular digital wireless protocols off the air for very cheap. So cheap practicality anyone can obtain the equipment quickly.

I was able to decode NRF24L01+ and Bluetooth Low Energy protocols using RTL-SDR. 
As far as I can see, this is the first time the NRF24L01+ is being decoded, especially considering the low entry price for the hardware. Given the extreme popularity of this transceiver, we are likely to see a wave of hackers attacking the security of many wireless gadgets, and they are likely to succeed as security is usually the last priority for hardware designers of such cheap gadgets.

A lot of work have been done to decode bluetooth using dedicated hardware and I am sure this software can be adapted to output the right format as input to the existing Bluetooth decoders such as Wireshark.
As far as I can see, this is also the first time BTLE can be decoded using a very cheap generic device.

The main software repository for this project is at https://github.com/omriiluz/NRF24-BTLE-Decoder

Developing a wireless mesh network challenges

Recently I've been working on a project to create a super cheap (<$5) sensor node that can be flexible and power efficient so I can just leave sensors everywhere and need absolutely no maintenance.
I decided to use the extremely popular NRF24L01+ transceiver from Nordics Semiconductor due to a balance of performance, power and price - and you'll be surprised how many hardware designers have taken the exact same decision once you start sniffing the air for packets. In my home alone I can see 15 addresses - wireless keyboards and mouse, remote controls, toys and appliances all use this tiny transceiver for wireless communication.

The sensor node with NRF24L01+ 
While working on the mesh network code, my progress slowed to nearly a halt. The code is extremely complex and depends on external conditions like signal strength, noise, etc. But worst of all? I was completely blind on what really happens once packets leave the safety of my micro controller using SPI to the transceiver. For normal (i.e. non-wireless) projects I'm used to being able to connect my scope or logic analyzer and "see" what happens on the wire. This makes debugging a breeze. Unfortunately this is not the case for wireless projects and I had absolutely no idea what happens between the transceivers. To make things worse, these transceivers work in the ISM band of 2.4Ghz. this is fast. much faster than any equipment I have available.

Enter Software Defined Radio (SDR) 

I assume you all know about the magic of SDR and specifically the cheap RTL-SDR. If not, take a break and head to http://sdr.osmocom.org/trac/wiki/rtl-sdr to read about it. For $13-18 (Amazon 1, Amazon 2) you open a world of possibilities that stretches far beyond analog radio into the 2.4Ghz digital space, as you'll read on this post.

Back to the problem of debugging - having experience with rtl-sdr, I immediately started thinking how can I use it to sniff packets off the air. This is impossible using any version of the rtl-sdr as the highest you can buy reach 2.2Ghz. just shy of the 2.4Ghz we need.

I started looking for a way to convert the signal down to a frequency usable by the rtl-sdr. Building one was a possibility, but I had no idea how and all the commercial/DIY products costs hundreds of dollars.

China to the rescue

Another option was to try and find an existing, mass produced and cheap product with my required specification. A quick search on Aliexpress.com found exactly that  - MMDS LNB.
MMDS is a digital broadcast system used in some countries for digital TV, and the LNB is part of the antenna. The MMDS LNB can be found for a variety of frequencies and LO frequencies.

Complete setup
The base frequency defines the filters on the device and the LO frequency defines by how much will it reduce the input frequency. 

Based on the specification, it would do EXACTLY what we need - take 2.2-2.4Ghz signal and down convert it to around 400Mhz. Then we can use the rtl-sdr and some code to decode packets off the air.

As it was very cheap ($12+shipping at Aliexpress) I took the chances and ordered one. About 10 days later it popped in my mail. I quickly hooked everything up and to my extreme surprise, after minutes -


I used SDR# with the new radio setup to see if I can find signals where I expect them to. The easiest one to find was my Logitech wireless mouse (which uses nrf of course). Tuning to 2,405Mhz (or 407Mhz after down conversion using LO of 1998Mhz) clearly show a strong signal when I move my mouse.

Developing the software to decode the packets was a bit of a headache, but once it started shaping up it was very easy to use it to capture and decode the packets.

So what do you need to make it work?

  • RTL-SDR dongle - ~$15. Easiest to buy on Amazon - (Amazon 1Amazon 2), but you can find it everywhere. I have both an E4000 and R820T dongles and they both work perfectly.
  • MMDS down converter - $12+shipping at Aliexpress. Buy one for 2.2-2.4Ghz with L.O. of 1998Mhz. If you buy from the link here, the seller will ask you for these details after you purchase.
  • (optional) Cables - Different rtl-sdr sticks have different input plug, you need to find a way to connect it to your down converter. This is really optional as I simply hacked some wire and it worked fine.
  • (optional) Power Injector - the down converter is an active component and requires 14-24V. I started by simply connecting my power supply to the wire and it worked fine. later I purchased a commercial power injector for less than $10. you can find one at Amazon or from the same Aliexpress seller.

Back to the comfort of software

From now one, all we need in order to get the packets is some clever software and the comfort of our computer (whether it's windows, linux, mac or RPi).

The NRF24L01+ (nrf from now on) uses GFSK modulation for the data. FSK (and it's derivatives like GFSK) is the digital cousin of FM. the modulator takes a bit stream, and emits one frequency to represent "1" and another frequency to represent "0".
Luckily for us, there is already a great library that does the basic rtl-sdr work and includes a software FM demodulator, rtl_fm.

Using the rtl_fm code on the incoming stream, I exported to excel a raw demodulated feed and filtered to find interesting results -

This is without a doubt an nrf packet. You can see:

  • Noise before (<80) and after (>395) the packet
  • Radio turn on time (85 to 125)
  • Preamble sequence of alternating bits (01010101 here) for the demodulator to detect a packet start and sync clocks (125 to 160)
  • Packet data (160 to 395)

In my code, I detect the preamble and calculate a Threshold number - anything above that number is considered a binary "1" and anything below is a "0". This provides a bit stream which represent the packet.
My code takes this bit stream, and manipulate it to recover the packet.
The last step is to take the packet, apply CRC and compare to the CRC in the last two bytes to verify that this is a valid packet. if the CRC match, we print a decoded packet.

For a detailed description of how I turn this bitstream into a decoded packet, I suggest you open my code over at https://github.com/omriiluz/NRF24-BTLE-Decoder, it is documented and should be relatively simple to understand.

Getting rtl_fm to output the right signal

Once you install the librtlsdr and have it working with your dongle, the basic command line for rtl_fm to product the bitstream we need as input is:
rtl_fm -f 402m -s 2000k -g 0 -p 239

The parameters are:

  • -f - frequency. remember to take the nrf channel frequency and reduce your down converter LO frequency. in the case here it's 2400-1998=402.
  • -s 2000k - mandatory. my code expects a 2M samples per seconds stream
  • -g 0 - to avoid noise, it's important to disable the auto gain control and reduce the gain as much as possible. I use 0 when everything is on my table and 10-15 when it's in my house.
  • -p defines the rtl-sdr permanent frequency drift. As a cheap device, the rtl-sdr is not calibrated. it's easy to calibrate it out of cellular signals using kalibrate-sdr

Sniffing NRF24L01+ packets

Once rtl_fm works, simply pipe the output into my software to see packets decoded -
rtl_fm -f 402m -s 2000k -g 0 -p 239 | nrf24-btle-decoder -d 1

2 simple parameters:
  • -t nrf | btle - should we decode nrf or bluetooth LE packets (more on this later)
  • -d 1 | 2 | 8 - select packet speed - the nrf can do 2mbps, 1mbps or 256kbps. you need to pick the right one.
Having my sensor node send one byte of data (an increment counter) with an acknowledgment from another node, the output would look like:

Sniffing 2Mbps NRF24L01+ traffic on channel 0 (2,400Mhz)

And now I'm not blind anymore when debugging!

Taking it further

As one smart blogger explained, the physical radio of the NRF24L01+ and Bluetooth Low Energy (btle from now one) are quite similar. This allowed me to quickly adapt my code to sniff btle packets as well.

Sniffing Bluetooth Low Energy advertisement channel 38 (2,426Mhz)
The code for sniffing btle is complete for the advertisement channels, but not for the data channels, it would be my next step to add it. The main issue is frequency hopping as required by btle, which I'm not sure our lowly rtl-sdr can do fast enough.


  1. There is also this option with a $49 USB dongle to sniff BT LE packets:

    1. You can do some other nice tricks with TI's RF sticks, a few of them can jam WiFi...

    2. Tell me more. :3

    3. You can probably jam WiFi by just continuously sending packets with the TI's RF sticks (perhaps you need to disable carrier sense first). Well we were even able to do it with ordinary WiFi dongles :D Shameless self plug: some of the code is at https://github.com/vanhoefm/modwifi

    4. Purely for the purposes of academic enquiry (because it's antisocial and childish to jam wifi) you'll have better results transmitting a CTS management frame after which all 802.11 stations are required by the standard to stop transmitting for upto 65535 microseconds.

    5. Great article, I 100% agree with your opinion and looking forward to the professional blogger update new contents, it must be amazing! details

    6. I might be jelous of you but you really can go high places atrair amigas sendo sedutor

  2. or the 120$ ubertooth, which you can possibly extend with custom firmware.

  3. The BTLE freq hopping code and other nice bits are in the ubertooth src repo, you could easily adapt it for use with the rtl-sdr

  4. Thanks to all the interest in the post, Amazon ran out of stock for products I pointed to. I modified to similar products on Amazon, hope they have more stock...

  5. You are right about the security implications. But anyone with a GoodFET has been able to sniff NRF24L01+ packets since 2011. http://travisgoodspeed.blogspot.com/2011/02/promiscuity-is-nrf24l01s-duty.html

  6. You can make a nice BTLE sniffer using the nRF51822-EK from Nordic Semiconductor. There is a Sniffer project listed on the Website. It is used in conjunction with WireShark. Wireshark is a network protocol analyzer for Unix and Windows. The -EK comes with a Evaluation board and a dongle for $99.00. Either of the devices can run the sniffer so you potentially you can have 2 sniffers made out of 1 kit.
    ~~~ JT

  7. "While working on the mesh network code [...]" - any success with that? Do you plan to publish the code? I'm looking for a ready for use "simple" mesh protocol. I was thinking about writing such a protocol, but it doesn't look easy (but no attempts yet).

  8. yes, some progress on the mesh network code. point to point and discovery are pretty much working. currently working on the wifi to nrf gateway code (hardware ready, software 50%) and the next step would be routing and multi hops.
    still a long way to go, will keep everyone posted.

    1. Very intersted in seeing that! Do you intend to publish this work? I'm actually following the same path. nrf24s, low cost sensor mesh, raspberry pi + openhab as a gateway. I managed to connect raspi to arduino nano using this modules, they are great.

    2. Hi,
      any success by finishing the code for routing and multihops as well as the nrf gateway hardware ?
      Would be nice if you could provide this to be used for enhanced mesh networks.
      Thanks for your reply.
      BR Mike

  9. Hi,

    I recently did a similar thing for NRF905 chipset traffic monitoring.
    It monitors sub 1GHz carrier, and does not require the conversion
    to use RTLSDR. A post is available here:



  10. Q? I'm building a home automation system using a network of NRF24L01+. I'd like the units to detect when someone walks into the room by measuring the BT 2.1 device name and RSI. This would trigger the lights and music to follow you through the house.

    Is this possible?

  11. I'm working on connectin nRF24L01+ to ANT devices, and it's basically working ;) Will publish soon.
    By the way, I have the same downconverter here (from alibaba), how the hell it is powered, is there only a connector? Do I need a specific power supply?

    1. you need to supply 18V on the RF cable. easiest method is using a power injector like the one described in the post - http://www.amazon.com/gp/product/B005AME7Y8/ref=as_li_ss_tl?ie=UTF8&camp=1789&creative=390957&creativeASIN=B005AME7Y8&linkCode=as2&tag=cybeblog-20

    2. I have a 12V PSU. In the antenna circuit, there's a 7808 so according to the datasheet it can work with voltages from 10.5V up to 23V. Inside the antenna, the DC is removed from the RF signal only with a 10uF capacitor. Maybe I can do the same on the dongle side. Even if I am not sure that parasitic components of the capacitor would not block the RF signal. I'll try and post the results.

    3. I had no issues just supplying 18v to multiple dongles. another option is to buy an RF splitter like this one:http://www.amazon.com/gp/product/B000Y97Q86/ref=as_li_ss_tl?ie=UTF8&camp=1789&creative=390957&creativeASIN=B000Y97Q86&linkCode=as2&tag=cybeblog-20
      and you can find them for less than $2 any local hardware store.

  12. Hi, I've noticed your donwconverter isn't exactly in 2.4GHz band, but I guess the filter aren't that sharp so you could still use it. Am I right? Do you think a downconverter with these parameters would also be OK?
    > RF INPUT: 2500 - 2700 MHz
    > IF OUTPUT 950 - 1150 MHz
    > GAIN: 65 dB
    > LO: 3650 MHz

  13. The filters are likely not to be tight to reject a strong signal in the 2.4 Ghz range.
    The downconverter parameters doesn't add up, could there have been a typo? usually RF - LO = IF.

  14. I really appreciate examining and subsequent your own submit when i see them very useful and intriguing. That submit will be every bit as useful together with intriguing. Appreciate it regarding facts you recently been sporting doing your website such an intriguing.Airline Codes

  15. The nRF24L01+ has a frequency range of 2400-2527 MHz - does your 2.2-2.4GHz downconverter have loose enough filters to accept 2.527 GHz signals without excessive attenuation?

    I do understand that for testing your mesh, you can just temporarily choose a lower frequency channel, even if you raise the channel number in production. But it would be cool if decoding higher frequencies were possible.

  16. This hack is broooootal!

    I really like the way you used the LNC (LNB) to convert the signal down.
    I am aiming for something similar but a bit different.

    I have a PL1167(datasheet see here http://www.datasheet-pdf.com/datasheet/POWERLINK/815377/PL1167.pdf.html) which works on 2.4GHz ISM band with FHSS....
    Do you think it might be possible to sniff this one with your great solution?
    I'm asking befause the frequence hopping of the PL1167 (FHSS)...
    Hope you can tell me something ^^

  17. Hello! I found this project to be inspiring.

    I ordered the same LNB from Aliexpress, plugged it all in... and YEAH! It worked perfectly and I could easily see everything I expected in the rage I expected it.

    Then I put it away, as there were many projects ahead of it.

    I recently pulled it out to mount on a dish and a motorized tilt/pan system... and I realized I must have thrown away that little metal rectangle that goes on the end of the LNB (or maybe it wasn't even in the box). I didn't even think about it at the time.

    Would it be possible to give the height/width/thickness/corner radius/hole measurements so I can whip one up? That would be totally swell!

    Keep up the good work.

    BTW... I have some idea to let the tilt/pan scan around and see what kind of intensity maps I can make at different frequencies... mapping where wifi is coming from or what degree of reflection there is... though it went back in the project cue when I realized I didn't have the little metal rectangle.

    1. Here are the measurements of my plate:
      98mm x 37mm x 0.4mm
      3 holes each with diameter of 3.2mm, gap between holes is 3mm. Center hole aligned horizontally and vertically.

      Great idea for a project, let me know how it works!

  18. Hi, you guys should check out the maidsafe.net project...basically the next internet via p2p. One of the things that would great is for the network to run over SDR Meshnet.

    I've put a post together on the forum, to pull all I could find on SDR together. It was inspired by a post I found named "Technology exists for everyone in the world to have high-bandwidth communications" that technology is SDR, but I'm not sure how it comes together when the author said

    "It completely solves the spectrum scarcity problem by finding, negotiating, and determining moment-by-moment, on the fly, the most efficient frequency for any given communication. This happens at the device level, so it renders the need for centrally controlling towers, and their bandwidth bottlenecks, completely obsolete. By bypassing these lower bandwidth cell towers, this decentralized, p2p, spectrum allocation protocol increases available bandwidth over traditional cell networks by three orders of magnitude. The result is profound – by ditching wireless service companies we gain a one thousand fold increase in wireless bandwidth"

    Check out the post, your input is welcomed: https://www.maidsafe.org/t/technology-exists-for-everyone-in-the-world-to-have-high-bandwidth-communications/2207

  19. I found that on aliexpress http://www.aliexpress.com/item/dogital-MMDS-downconverter-1998MHz-with-2-4-2-6GHz-Input-SDR-converter-for-2-4G-Wifi/2030074720.html do you think it will work better than the one you point out?

  20. Even though you said that filters are likely not to be tight to reject a strong signal in the 2.4 Ghz range, why you preferred the 2.2-2.4 GHz down converter instead of the 2.4-2.6 version ?

  21. Most makers either make their full inventory accessible to search online or they give a straightforward request shape that gives you a chance to demand a mail-request duplicate of their free list right from your home office.

  22. You are right about the security implications. But anyone with a GoodFET has been able to sniff NRF24L01+ packets since 2011

  23. the 120$ ubertooth, which you can possibly extend with custom firmware?

  24. The filters are likely not to be tight to reject a strong signal in the 2.4 Ghz range.
    The downconverter parameters doesn't add up, could there have been a typo? usually RF - LO = IF.

  25. Many manufacturers either make the full products accessible to search on the net or they furnish an easy obtain shape giving people to be able to demand a mail-request redundant of the cost-free number proper out of your home office.

  26. NRF24L01+ and Bluetooth LE packets is perfect for any decoding function. Because it is cheap and easy to use and handle.Thanks for your attractive review.

  27. Hey you guys, I stumbled across a bunch of these down converters, they are available on amazon, they come complete with the plate.

  28. looking for the best plantar fasciitis night splint ? here is best choose

  29. This is a great information about decoding NRF24Lo1+ and how to decode a bluetooth LE by using a cheap generic device. This is very useful posting, thanks for sharing!

  30. great information thanks!
    Post more about NRF24Lo1

  31. Simply its a nice blog. Lots of information we can get from here.

  32. This is a great post share. I've learned many new things here. Thank so much !

  33. I think it could have been explained in a little more simpler tone.

  34. I only wish I fully understood all of it!

  35. China to the rescue!!
    They often rescue many situations if the truth be known.

  36. hey,
    I think wireless mesh is really a challenge to develop. Really nice article.
    Thanks for sharing.

  37. Wow that's a wonderfull blog having all details & helpful. China power cords

  38. You're an extremely helpful website; couldn't make it without ya!

  39. Your blog is very informative. I have solved my many problems with the help of your articles. In the way, you write is very amazing, it increases my interest and I read more and more. Thanks.

  40. I was surfing net and fortunately came across this site and found very interesting stuff here. Its really fun to read. I enjoyed a lot. Thanks for sharing this wonderful information.

  41. What a fantabulous post this has been. Never seen this kind of useful post. I am grateful to you and expect more number of posts like these. Thank you very much.
    download tv shows

  42. Favorable website, where did u develop the info on this posting?I have checked out a few of the posts on your site now, and I really like your design. Thanks a million and please maintain the reliable http://bingoandgames.com/ work.

  43. The BTLE freq hopping code and other nice bits are in the ubertooth src repo, you could easily adapt it for use with the rtl-sdr

  44. This comment has been removed by the author.

  45. I was surfing net and fortunately came across this site and found very interesting stuff here. Its really fun to read. I enjoyed a lot. Thanks for sharing this wonderful information.
    Mia @ Hoops Report

  46. User friendly interface that enabled me to quickly configure 100s of computers at once. this site. Did you just try to show off by throwing a grape into the air and catching it in your mouth.

  47. | Version: Homestar Runner Toolbar for Internet Explorer 2 Look for it How to Enjoy the Full Edition of This App Operate smoothly by scrolling the screen, and enjoy turn of the seasons.

  48. Rates are subject to change without notice due to currency fluctuations or others. downlodable ebooks - Hear song clips as you swipe through music packs.

  49. You can no longer get the rtl-sdr recievers you suggested on amazon. could anyone suggest another one that works well?

  50. REMINDERIf you use MyLibrarian Backup to backup your books, you must downloaded the latest version, 1. downlodable ebooks Tutti Fruity encourages matching and strategy thought processes as the player is having fun building sets.

  51. Steer the car by moving your iPhone to the sides (the game uses the iPhone accelerometer). download software From Magno Urbano: Plan and draw your team winning tactics in 22 different sports using TacticsBoard a best seller application in 43 countries.

  52. sizegenetics We are the only penis enlargement device to show you REAL customer testimonials. Why? Because SizeGenetics™ really works! Learn more.

  53. Thank you for reading our blog, Daniel! I hope you will find some useful tips applicable to your business.

  54. male extra pills are famous on the market. But you have to know some side effects and results. My prof review will help you.

  55. At the same time, you will be showed the next question. this site. During testing, the program completed the icon applying process quickly and without any glitches.

  56. Many women also consider v tight gel after having children. During natural childbirth the vaginal muscles expand to form the birth canal for your baby.

  57. best scan tool thanks for good information.
    obdhightech thanks for good information.

  58. professional logo design re-enforces things that most of us in the design world have heard before, introduces us to some new things, but all the information is great to read nevertheless. It is good to reminded of those basics so we can sometimes step back and examine how we can improve ourselves.

  59. Want to know the latest news, unique, interesting and terheboh, let's visit our site ,,, !!!
    to visit here midiapublicitaria

  60. RedNeckOmeter - Introductory price for a limited time. pudhu vellai mazhai ringtone If a folder or a Quick Start screen is not configured as the startup page, the home page will load by default when you log in to your profile.

  61. Dafr jede Menge Freiraum, um sich richtig wohlzufhlen. web site! High performance - even if you have over 1000 contacts, search is instant.

  62. buy sizegenetics We are the only penis enlargement device to show you REAL customer testimonials. Why? Because SizeGenetics™ really works! Learn more.