RTL-SDR: A tool for Visualizing Broadcast Satellite Signals

For people who chase broadcast satellite signals, we know that the vast majority of them are DVB-S/DVB-S2 signals, which can easily be scoped out with any CrazyScan capable tuner, such as the TBS6925. Even a regular blind-scan card gives you some information.

Crazyscan itself gives you an output which plots the signal level versus the frequency span. This can be sometimes quite perplexing, especially where you can see a strong signal but it just won’t lock. Sometimes the signals look “jumpy” or “furry” on these plots as well.


Most of the time, the IQ plot doesn’t give you much information either. In fact, it can be downright confusing …


It’s a great signal, but what is it!?

The reason for this is, while the plot gives you a picture of the signal power, it doesn’t give you the detail to appreciate what the spectral content is like. It is also a swept scan, so you don’t see what the signal is doing instantaneously.

RTL-SDR to the Rescue

If you want to visualize the spectrum properly, you’re going to need some way to get a software defined radio tuner to tune into the right frequencies. Broadcast satellite receivers work through a process of low-noise block downconversion, where the LNB mounted at the dish is powered through the cable and down-converts a block of frequencies through the use of a local oscillator into the L-band region of 950Mhz to 2150Mhz.


For reference, the IF from common LNB LOs are as follows:

  L-band LNB IF Table (950-2150MHz)
              Ku Band
SAT.f       LNB Local Oscillator
         9750    10600    10700    11300
10700    950     -       -       -
11700    1950    1100    1000    -
12250    -       1650    1550    950
12750    -       2150    2050    1450

  L-band LNB IF Table (950-2150MHz)
              C Band
SAT.f       LNB Local Oscillator
        5150    5750
3400    1750    -
3700    1450    2050
4200     950    1550

You will note that for C band, the band is “flipped” as the LO is above the signal frequency. These translate the frequency downward (LO frequency – incoming frequency = IF frequency). Using a “one-cable-solution” aka band-stack C-band LNB means no coverage in the 3400-3700Mhz “extended C-band”, as it stacks 5150Mhz LO for one polarity and 5750Mhz LO for the other polarity into one output.

For Ku band, things are a little bit more straightforward with the LO above the signal frequency. In Australia, 11300Mhz LNBs were popular, and continue to be for FTA satellite reception, however 10700Mhz “wideband” LNBs have become the new standard for Pay TV (Foxtel/Austar) viewers and remote (VAST/Aurora) satellite TV viewers. These single LO LNBs merely translate the block of frequencies downward (incoming frequency – LO frequency = IF frequency).

The more popular “universal” LNB used in US and Europe (in densely populated satellite TV slots especially) has two LO frequencies which are selected through the removal/application of a 22khz tone signal (0.5v p-p or thereabouts) to the cable on top of the DC supply voltage which selects polarity (13/18v) and powers the circuitry (typically up to 500mA), but otherwise, follows the same rules. Above 10700Mhz, the higher (10600Mhz) LO should be used, otherwise the 9750Mhz LO should be used.

At this point, it’s worth noting that due to the way the LNB IFs are, the L-band range is not covered entirely by any one RTL-SDR tuner. I was seeking the E4000, as I am using the “wideband” 10700Mhz LNB, and most satellites in the Ku band are in the 12250 to 12750mhz range, meaning the IF would be within the E4000’s tuning range, but mostly outside the R820T’s. Conversely, if I had used the 11300Mhz LNB, then the signals may be tunable by the R820T (although, I’m not sure of its overall performance over 1Ghz), but the signals will also fall into the 1200Mhz “hole” in the E4000’s tuner. So it may be advisable to have both the E4000 and R820T on hand if you require complete L-band coverage.

[Needless to say, my quest to purchase new E4000 tuners from eBay at reasonable prices is still fruitless, however, I was able to release three of my E4000 tuners from duty so I could use them for this experiment instead.]

The frequency reference of most LNBs are a dielectric resonator oscillator which is generally known for being unstable and sensitive to temperature variations. Drifts of 2+Mhz can be demonstrated, up to 10Mhz can be experienced in extremes. There are other types of LNB which use PLL oscillators which can have higher stability, but introduce their own issues in phase noise.

The LNB requires power, namely 13/18v depending on the reception polarity desired. Universal LNBs (and multi-LNB set-ups using 22khz or DiSEqC switches) require the use of coded 22khz signals superimposed onto this to select which local oscillator or which LNB is required in the system.

The easiest way to provide this without building anything is simply to use a satellite receiver or tuner card with a loop out connection. The loop out connection passes the IF, but blocks all the DC and DiSEqC commands, and is perfect to hook up to the RTL-SDR. This can be achieved simply with a F to F cable (preferably quad shield RG-6 for these frequencies) and a F to MMCX adapter which plugs directly into the tuner stick.


This arrangement is easily achieved with the TBS6925 because it has the required loop-out connector, and merely running CrazyScan allows the selection of the appropriate DiSEqC settings. Doing a click-to-search blind-scan allows selection of Horizontal or Vertical polarity. Even better, you can identify the DVB-S/DVB-S2 carriers by blind-scanning first, and get the frequency of interesting areas with the LNB’s DRO drift taken into account!

This should allow us to see what is in those areas where we can’t lock with a regular tuner, although it will not be likely that we will encounter anything directly decodable in this digital age (analog carriers won’t be expected, and digital modulation mode parameters and demodulators are likely not to be readily available). But it will provide us some visual indicator of what is around and may inspire someone to experiment and develop the appropriate decoding strategy (especially in the case of narrow band carriers which may drift very severely, and many tuners have trouble locking onto).

The other thing to realize is that, for transponder efficiency, many of the digital signals you will encounter will have bandwidths much larger (say 27Mhz, 36Mhz, 72Mhz … transponder size) than the sample rate/bandwidth of the RTL-SDR and decoding them will never be a possibility.

It’s a superior solution to examining the signal with a narrow-band scanner like the IC-R20 (I did this as well, prior to owning a tuner which was CrazyScan capable) as such a solution doesn’t give you a clear picture above what CrazyScan can offer.

Visualizing the Signals

So lets begin the signal hunt. The IF level from the LNB through 30m of RG-6 Quad Shield was fairly strong, so the tuner was run with the AGC off, and the gain set to around 4-6dB. SDR# was used as the application for the RTL-SDR, with the CrazyScan result overlaid in some cases.

Radio Carrier 1 D2

The first thing to start off with is a “reference”. This is the narrowest DVB-S/S2 carrier I have access to at the moment, measuring a meagre 835kS/s (in EU, 300kS/s can be found). This is on Optus D2 and appears to carry data. Its spectral occupancy is just 1.002Mhz according to CrazyScan and according to the plot from SDR#, we’d have to agree! The modulation is QPSK, and due to its rate, it’s visible as a “hump” as expected. Given that the whole carrier fits within the passband of the SDR, it’s entirely possible that with the right software demodulation technique, one can actually use this as a tuner of narrowband DVB-S/S2 signals!

The indicated frequency by CrazyScan from the tuner front end is 12297.020Mhz, which given the 10700Mhz LO, results in an IF of 1597.02Mhz. It’s not exactly spot on (esp given that there is offset because of the tuner crystal offsets – a value of 34ppm was used which came from the kalibrate-rtl utility), but it’s as close as I expected.

Radio Carrier 2 D2

I tried it on a second narrow-band carrier, also on Optus D2, that I am aware of. This is used for ABC Digital Radio, and is listed on Lyngsat as being nominally 12296V 1644kS/s (note that Crazyscan symbol rate inaccuracy is normal, possibly due to system timer accuracy issues). The result from CrazyScan is 12295.173Mhz, which indicates the “offset” of the DRO in the LNB from the nominal 10700Mhz value. We can clearly see a peak that’s twice as wide in the spectrum, as the carrier is ~ 1.972Mhz wide. So we can be somewhat confident that we are seeing what’s expected.


If we needed more proof that the signals themselves are coming from the satellite, it’s easy to zoom into the spectrum and see the slant in the carriers which should be stable – this is the drift in the DRO, possibly as a result of “just” turning on the LNB for reception and its circuitry warming up.


Of course, you come across signals which CrazyScan won’t lock and wonder what they are. In some cases, you find very narrowband carriers, which are extremely closely spaced. These are likely to be data terminals, telemetry systems or slow-rate back-up networks used by utilities and larger organizations. Frequency accuracy and stability is extremely important with such narrow carriers, especially on transmission but also on reception, which is why it is popular to have high quality external 10Mhz reference signal sent up the cable for use by BUCs on transmission. Here we can see two different schemes, and what appears to be differences in signal strength (which likely indicates that each of these carriers emanates from a different uplink path, being affected differently by location, dish size and alignment and atmospheric conditions).


Noting that the satellite is merely a signal “downconverting” repeater, it’s possible to use virtually any form of modulation to send information with it. Due to the properties of the TWTA utilized in satellites, some modulations are better than others (AM for example isn’t that good of an idea), but here, we can see an insane number of FDM carriers just sitting next to each other. These may be the uplink channels for two-way satellite internet (and may explain the slow uploading that’s common to those systems). The downlinks may be (and often are) just regular DVB-S/DVB-S2 channels which use IP encapsulation or the newer “generic stream” format.


Of course, with FDMA, there is always the alternative of slotted transmission – i.e. TDMA. If you’ve seen jumpy scans on CrazyScan, it’s likely because the transponder was basically going on-off with each of the transmission slots, and so as it scanned along, it was both transmitting and not transmitting for some fraction of time. Here we see what appears to be a slotted TDMA narrow carrier system, with some “distinct” fixed patterns in some slots which (from my experience of digital modulation systems) indicate fixed function bit patterns (e.g. idle, flag).

Optus D2 TM1 TM2

You could also use such a system to receive and visualize the spacecraft’s telemetry beacons which are sent around the clock. This is Optus D2’s beacons, TM1 and TM2. The Payload Information guide gives comprehensive information about these signals – you can refer to the table on Page 18 which tells us the D2’s TM1 and TM2 beacons are at 12243.75Mhz and 12245.75Mhz respectively. That is separated by 2Mhz, in Horizontal polarity.

Of course, the format isn’t public, but it seems to remind me of AM modulation because it’s got an upper and lower mirrored sidebands. But in each side-band, it seems to have a pair of FSK signals. These signals aren’t documented, and information in spacecraft telemetry is usually kept fairly secret (as it’s operationally important for the business not to disclose this information), but I can be fairly certain that what we are seeing is indeed the beacons (due to their separation, and the fact that the frequency is within the DRO uncertainty band).


It seems that the RTL-SDR is extremely useful as a tool to analyze signals which were otherwise “out of the league” of inexpensive data acquisition devices. In this case, we have managed to directly view the spectrum of the L-band IF from a satellite LNB, allowing us to see the signals which our satellite tuners will not decode. It’s not exactly that useful in the sense of receiving these signals as decoders have not been developed and parameters might never be known, but it’s still educational in the ability to visualize the challenges of satellite operation, and the diversity of transmission modes despite the DVB-S/DVB-S2 “dominance” in general.

I can’t wait to see something “even better” appear in the future – more bandwidth, more dynamic range, and low price? Yes please! But for now, the RTL-SDR has me pretty damn chuffed.

About lui_gough

I'm a bit of a nut for electronics, computing, photography, radio, satellite and other technical hobbies. Click for more about me!
This entry was posted in Radio, Satellite and tagged , , . Bookmark the permalink.

4 Responses to RTL-SDR: A tool for Visualizing Broadcast Satellite Signals

  1. dario says:

    where you can find a list of all the services of the
    the satellite?(not only for broadcast channels)
    Example satellite eutelsat 7A

    • lui_gough says:

      As far as I know, there is no ‘full services list’ as such, as most are built up by our scanning efforts with bind scan cards. Many directories are not interested in non TV carriers, and will not list them. Only the satellite operator will know exactly who has paid for bandwidth and what they are using it for, but they don’t release this data for obvious reasons.

      – Gough

  2. dario says:

    using crazy scan – tbs 5925 connected to the output loop usrp1 8MHz band I saw scanning of small signals psk ..
    that services (telephony, networks, etc …)

  3. Pingback: Visualizing Broadcast Satellite Signals with the RTL-SDR - rtl-sdr.com

Error: Comment is Missing!