How to Track Government Aircraft 200 Miles Away with a Raspberry Pi « Null Byte :: WonderHowTo

Aircraft equipped with ADS-B areconstantly shouting their location into the radio void, along with other useful unauthenticated and unencrypted data. In this guide, we will make an ADS-B receiver using a Raspberry Pi with a software-defined radio (SDR) dongle, which we can use to track aircraft anywhere in real time.In my last article, I covered how to track flights using publically sourced radio receiver data on your phone. However, using public source data has some limitations, like blocking some interesting private jets and government aircraft or lack of coverage at lower altitudes. Now, we can collect our own data!What's that, FlightAware? I can't track this plane? Right.The Raspberry Pi is a surprisingly versatile credit-card sized Linux computer, and just like the ubiquitous Lego blocks, people are constantly finding new uses for them includingwardriving,running Kali Linux, and even setting up arogue access pointandshooting down planes. We're going to put them to yet another use as a host computer for our very own 1090 MHz receiver. If you think you'reMacGyver, then you can try tobuild your own out of scrap parts.Previously:How to Track ADS-B Equipped Aircraft on Your SmartphoneThankfully there's no code to write. Most of the hard work has already been done for us by programs likedump1090on GitHub, and brancheslike this onecan even make a heat map of the aircraft locations. FlightAware made its own version calledPiAware, which is what we'll be using primarily today, although details for using Flightradar24's Pi image will be included if you prefer their service.If you're interested in what PiAware is doing under the hood, thishelpful block diagramshows what's going on. Our setup will have the Pi, SDR, and antenna directly connected without any analog cables between to minimize wires and maximize the efficiency of our system. Then, we'll only need to find a nice spot outside and plug in the power.Coverage ReconnaissanceA littlereconnaissancecan go a long way and save us trouble down the road. We're going to start off bylooking at the coverage. Once you click on that link, you'll be taken to a map of FlightAware's coverage, which should be fairly representative of other ADS-B aggregation services.The default is set to look at "Feeder Sites" such as the Pi-based receiver we are building in this guide. For example, looking at the following image of the Fort Worth and Dallas areas, we can tell that there is already a large number of such systems there.Each white dot represents a receiver just like the one we are about to build.Additionally, we need to take a quick glance at the "Data Coverage" tab on that map. By now, there are few holes in the coverage of the USA and Europe. If you live there and wanted to add new coverage, you're probably out of luck, but do check the sliding tab at the top left, as coverage below 20,000 feet and particularly below 10,000 feet is still quite sparse.If you do find yourself in a region with little-to-no coverage, be sure not to skip the free stuff step below, as it could save you a hundred dollars. If you aren't already familiar with the airports in your region, then tab over to "Airport Surface Coverage," too.Here you can see a map of the regions with coverage up to 60,000 feet and above.Radar Horizon ReconnaissanceHow far can we expect to be spotting aircraft once we get set up? Typical distances are between 100–300 miles. However, that can vary greatly depending on your setup.As we mentioned inour last article, ADS-B isline-of-sight propagating, which means that we need to keepradar horizonin mind or it could really limit our range. Since the Earth is a sphere and curves away from us in all directions, it creates regions at lower altitudes which are outside of line-of-sight with our receiver and cause us to have dead zones.Just like objects cast shadows in sunlight, objects like nearby trees, buildings, and mountains cast "radar shadows," further blocking the areas we will be able to spot aircraft. Think of the aircraft as the sun — you don't want your receiver to be in any cast shadows. Thankfully, there's a tool calledHeyWhatsThatto help us visualize this. On the HeyWhatsThat site, click the "New Panorama" tab at the top of the page, and then start filling in the information of your planned install location.This is also a good time to experiment with different locations you may have available to you, in order to sort out which is best. After you enter a suitable title and submit a request, it will take 2 to 3 minutes to build your map, and you should be taken to the view tab with your title selected.As you can see, the potential coverage area is quite large.Definitely play around on the page as there is quite a bit of useful information there. However, what we are interested in right now is that map.Scroll down to get to it and click on the "Up in the Air" tab in the map window. Just below the map will be two colored boxes which will be 10000 and 30000 by default. Change the first from 10000 to 18000, as 18,000 feet is the altitude at which all air traffic is required to have ADS-B. The second you can keep anywhere in the 30 - 40,000 range, as that represents the cruising altitude of typical airliners.Be aware you may have to zoom out on the map to actually see the rings appear. Those rings now represent the maximum range at which you can expect to be spotting aircraft at the given altitude.Apply for Free StuffIf you enjoy setting fire to money in your spare time, or simply don't perk up at the word free, then you can skip this bit. For the rest of you, keep reading. If you noticed you're in a gap in coverage in the previous recon section, then you will want to follow these links to apply for a free kit — complete ADS-B receiver sets including receiver, antenna, and cables.Flightradar24FlightAwareRadarbox24Even if your area is already covered, it's worth it to take a few minutes to apply in case they still need MLAT coverage, or even just for the 20% discount code Radarbox24 sends when it rejects your application. Don't forget to check your email for the follow-up emails that arrive within 24 hours, if not instantly.What You'll Need to Get StartedRaspberry Pi:Most importantly, you're going to need a Raspberry Pi. Any model will technically work. However, for this guide, you will want one with Wi-Fi built in. This guide uses a Pi 3 model B, but the Pi Zero W is also a good choice with some caveats. As the Pi Zero uses the chipset from the original Pi, it has limited computational power, and there are reports that it struggles when MLAT is running and or when it's viewing a large number of aircraft simultaneously. That being said, the Pi Zero is the cheapest option if you can get away with it. Use your own judgment, and the recon we are performing, to decide. If you don't have a Raspberry Pi yet and would like to follow along with our guides, thenthis kitwill get you up and running.MicroSD card:You need a 6 GB card minimum, but it's recommended to use one in the 16 to 32+ GB range.MicroSD card reader: Pretty much any one will work for our task today.Power supply:This is needed for the Raspberry Pi unit.Software-defined radio:We need any software-defined radio with an RTL2832 chip. If you already have an SDR, it should likely work. If you are buying specifically for 1090 MHz, thenthis SDRis the best choice and is what will be used in this guide. It has a built-in amplifier and 1090 MHz filter specially designed for our purpose.1090 MHz antenna:If you are using an SDR, you already have then you can use the supplied antenna, but you should be aware that it likely isn't optimized for the frequency we are using. While it will work for demonstration purposes, if you are hoping to have a more permanent installation, then you will be gravely disappointed by its performance. In this guide, we are usingthis antenna. While it is a little on the pricey side (being the most expensive single component in our build), it is also the most important to receiving a strong signal. If you're more interested in the details, here's anin-depth review. If you want to build your own, then look atthis guideorthis videoby Hak5.Antenna adapter:If you are using the same antenna as this guide, you will need an N type Male-to-SMA-Male converter. Otherwise, be sure you have the proper cable and adapter for your setup.Micro USB cable(optional):You only need this if you're using the Pi Zero WSecond 1090 MHz Filter(optional):This is rarely needed, as it's already built into the SDR we are using in this guide. However, it is helpful sometimes if you live in very close proximity to a radio transmitter such as a cell phone tower.Step 1: Download the Image for the Raspberry PiThere are two programs that we are going to look at downloading; they both achieve the same ends. It's mostly just a matter of personal preference which you choose. You can use Flightradar24 or FlightAware. If you want the quickest simplest setup, then go with Flightradar24, but if you want more access to your own data or are using a Pi Zero W, then go with FlightAware. Keep in mind, whichever you contribute data to will upgrade your account to their highest level of premium membership for free.Click on the link below that you want and extract the .zip file. If you just can't pick, thenuse both with BerryBoot.Flightradar24 (206 MB)FlightAware (305 MB)Step 2: Flash the Image to the MicroSD CardNow, we need to write the image to our microSD card. Best practice is to unplug any external hard drives or other USB devices you have, and then insert your microSD into its adapter and plug it in. This is important because you don't want to accidentally flash the wrong device.If you already have a program to flash the image to the card, then you can use that. Otherwise, downloadEtcher. It should detect what operating system you are using, but if not, make sure you download the correct version based on your operating system (OS) and follow the on-screen installation directions. Open Etcher (if it doesn't automatically after installation), and select the image you just downloaded and unzipped.Next, be sure the proper drive is selected and flash the image. Once it's done, it will safely eject the SD card.Step 3: Enable Wi-FiIf using the Flightradar24 image:The Flightradar24 build is intended to be used with Ethernet, however, we can enable Wi-Fi. Just remember, you will still need to run power to the Pi.First, insert the SD card into the slot at the bottom of your Raspberry Pi and plug the Pi into both Ethernet and power. Now, we need a program to open a Secure Shell, i.e., SSH into our Pi. This guide usesPuTTY(download), but you can SSH however you like.In Windows, open PuTTY and select SSH Port 22, and provide the Pi's IP address. The IP address can be found a number of ways, including opening your router's admin page and looking at connected devices or using a program likeNmaporFing.On a Mac, you can simply open a terminal window and type the following.ssh pi@(replace with Pi's IP address)Once you have a successful SSH connection, you will be prompted for a login and password. The default user name ispiand the password israspberry. Best practice would be to immediately run thepasswdcommand to change the password.So the Pi knows to automatically connect to the Wi-Fi, we need to edit the "wpa_supplicant.conf" file. Use the following command to open it in nano.sudo nano /etc/wpasupplicant/wpasupplicant.confArrow key to the bottom of the file, and add the following.network={ssid="YourWifi"psk="Password"}ReplaceYourWifiandPasswordwith the credentials of your system, but leave the quotes. Exit withCtrl + Xand then save changes with theYkey. That's it, you should have Wi-Fi connected now, although sometimes it may take 2 to 3 minutes and require a reboot. If so, you can usesudo reboot. Useifconfig wlan0to check, and if it's working, you will see you have an "inet addr" there.When you have Wi-Fi up and running, safely shut off the Pi with:sudo shutdown -h nowIf using the FlightAware image:Etcher will have ejected your SD card, so you will need to physically remove it and reinsert it. The SD card should now be called PiAware. Navigate to it, and open the file labeled "piaware-config.txt." Scroll down until you see:ChangeMyWifiNetworkto your network's SSID, ands3cr3tto your network's password. Save the changes and close the file. If you want to be able to SSH into your Pi, create an empty file named "ssh" with no file extension, as PiAware disables SSH by default for safety. Safely eject the SD card.Step 4: Set Up Your AntennaThe rule of thumb to keep in mind is that the cable between the antenna and SDR should be as short as possible. This is super easy for us to do since we aren't using a cable.Image by Hoid/Null BytePlug your adapter into the base of the antenna, and then the SDR into the other side of the adapter. We do this because longer cables and more jumps weaken the analog signal, which makes it harder for the SDR to pick up the faint signals from distant aircraft.Put together it should look something like this.Image by Hoid/Null ByteStep 5: Start Your PiPlug the flashed SD card into the bottom of the Pi, and connect the SDR to one of the USB ports. Now, connect the power. You should see a solid red and a blinking green LED on the Raspberry Pi.Image by Hoid/Null ByteStep 6: Claim Your ReceiverWait 5 minutes for the Pi to boot and get the software running, then click on the appropriate link below for whichever service you are using. If the Pi doesn't show, be sure that you connected the Wi-Fi correctly and reboot.GPS-Coordinates.netis helpful if you don't already know your GPS coordinates, or are having trouble finding them, as both services will want to know this information. Additionally, once you claim your receiver, you should be upgraded to the highest level of membership for your given company.Activate on Flightradar24:Go toflightradar24.com/activate-raspberry-pi, then click on "Activate." You may have to log in first.Fill in your information and click "Verify application."Activate on FlightAware:Visitflightaware.com/adsb/piaware/claim. The claim page should look something like below. You may have to log in first.Once that is done, you can type you Pi's IP address, which can be found on the claim page, into your browser, and you'll be taken to a page like the one below. Green means that feature is working, red if it isn't. Click on "View your site statistics online" to go to your user page and configure MLAT, if you want to enable it. And now, we can use the pièce de résistance of FlightAware, click "Go to Map."This view allows you to see aircraft that are normally blocked in the app or on the website. It's really up to your own detective work to spot thespies in the skybut the FAA doeshelp you.It is also useful to turn off and on the "Show All Tracks" in the top right (e.g., a plane doing perfect circles right over your house might be suspicious).Step 7: Protect Your PiThe Pi is up and running, but not yet ready to go outside for the long term. If you only want to only use it for a few hours when it's nice out, then you don't really need any protection just mount it somewhere. However, if you are going with a long term 24/7 setup, it's recommended to use an environmentally sealed box such as a plastic electrical box (as metal ones will interfere with the Wi-Fi) found at the hardware store. It's up to you how to do this, as it will depend greatly on your mounting location. This should be as high as possible, with the antenna mounted vertically.When you're done, only the antenna should be exposed with a power cable running to the box.Step 8: View Your ADS-B StatisticsOnce you are up and running for some time, you can compare your stats with others around you and the leader board globally. This can help identify any range issues you've been having, and see how you rank collecting flight data.View your Flightradar24 stats.View your FlightAware stats.In a future article, we will look more closely at how to actually identify suspicious aircraft throughthe use of an "R" program.Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseScreenshots by Hoid/Null ByteRelatedHow To:Build a Portable Pen-Testing Pi BoxHow To:Discover & Attack Raspberry Pis Using Default Credentials with Rpi-hunterHow To:Set Up a Headless Raspberry Pi Hacking Platform Running Kali LinuxThe Hacks of Mr. Robot:How to Build a Hacking Raspberry PiHow To:Enable Monitor Mode & Packet Injection on the Raspberry PiHow To:Log into Your Raspberry Pi Using a USB-to-TTL Serial CableOpen Sesame:Make Siri Open Your Garage Door via Raspberry PiHow To:Build a Beginner Hacking Kit with the Raspberry Pi 3 Model B+How To:Lock Down Your DNS with a Pi-Hole to Avoid Trackers, Phishing Sites & MoreHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgRaspberry Pi:Hacking PlatformHow To:Load Kali Linux on the Raspberry Pi 4 for the Ultimate Miniature Hacking StationNews:Smart Home Proof of Concept Uses a Raspberry Pi to Control Air Conditioner with HoloLensHow To:Boot Multiple Operating Systems on the Raspberry Pi with BerryBootHow To:Build an Off-Grid Wi-Fi Voice Communication System with Android & Raspberry PiRaspberry Pi Alternatives:10 Single-Board Computers Worthy of Hacking Projects Big & SmallHow To:Set Up Kali Linux on the New $10 Raspberry Pi Zero WHow To:Use VNC to Remotely Access Your Raspberry Pi from Other DevicesRaspberry Pi:Physical Backdoor Part 1News:LEGO Aircraft CarrierNews:Airline Pet Policies