In pt 1 the goal was just to see the spectrum. Plug things in, fix permissions, stop being intimidated by waterfalls. The obvious next move was to leave it running and see what three weeks of my own house actually looks like on the air.
So that’s what this is. One RTL-SDR, one Raspberry Pi, parked on 433.92 MHz for three weeks. No walking around pressing buttons, no triggering things on purpose. Just leave it alone and read back what came in.
The rule, same as always: receive, never transmit. No jamming, no replay, no touching anyone’s gate. Passive only.
The setup
An RTL-SDR is a cheap USB TV-tuner dongle that hobbyists repurpose as a software-defined radio. I plugged one into a Pi, ran a bit of wire for an antenna, and pointed it at 433.92 MHz. That’s the unlicensed ISM band where most of the cheap wireless stuff in a South African home lives: gate remotes, garage buttons, ceiling-fan controllers, weather gadgets, doorbells.
A small systemd service ran rtl_433 around the clock, decoding anything it recognised into a line of JSON. A nightly cron job paused the logger, swept 24–1000 MHz with rtl_power, and painted a spectrum waterfall so I could see where the energy was even when nothing decoded. One dongle can’t log and sweep at the same time, hence the pause-and-resume dance.
The logger service, the nightly sweep, and the scripts I used to chew through the results are all on GitHub: taffy210/rtl-sdr-house-listener.
Just over three weeks later I had 673 decoded transmissions sitting in a JSONL file. Then I made the mistake of believing them.
Most of what it heard was a lie
My first summary proudly reported 238 distinct devices. My house, apparently, is a small city of radios.
It isn’t. rtl_433 ships decoders for around 200 protocols, and it will happily match random background noise against one of them and hand you a “device” that never existed. Last round I got excited and started building an inventory. This time I actually checked it, and most of the inventory evaporated.
The tells are in the details:
- A “Cardin S466” gate remote showed up 164 times, with 163 different dip-switch settings. A real fixed-code remote sends the same code every single press. 163 different ones means the decoder invented a remote out of static.
- A “Philips” temperature sensor reported −50 °C.
- A “Fine Offset” weather station claimed 281 km/h wind and 1091 mm of rain.
None of those are devices. They’re the radio equivalent of seeing faces in clouds. Throw them out and the neighbourhood gets a lot smaller, and a lot more honest.
That’s the real lesson of this whole round, and it’s the one nobody puts on the box: the hard part of RF isn’t hearing signals. It’s not kidding yourself about what you heard.
What actually survived
Two things held up under scrutiny, because they repeat consistently with plausible data. Everything else was one-off phantoms.
The fan remotes
The chattiest real device in the house is a set of Regency fan/light controllers. 140 transmissions across 16 channels, every one a light or fan command: light_intensity, fan_speed, fan_direction, light_delay. Someone dimming lights and nudging fan speeds, logged as a quiet heartbeat of ordinary evenings. The busy hours were noon and 8–9 pm: lunch, and settling in for the night. You can read the rhythm of a household in a band it never meant to broadcast on.
The gate fobs, and why they’re safe
The interesting ones are four KeeLoq gate fobs, built on Microchip HCS200 chips. Watch what happens when the same fob gets pressed over and over:
fob 1AE2178 — 72 logged transmissions → 20 distinct codes (first five shown):
10F5EE94 6549AE9F 9A6F6EA8 CDADFEFA F4313DFA
Every press ships a different encrypted number. That’s a rolling code. The fob and the gate share a secret, both step a counter forward on each press, and the transmitted code is that counter encrypted. The gate accepts the next few counts in sequence and never the same one twice.
Which means my three weeks of patient listening is worthless to anyone who wanted to misuse it. I captured twenty valid codes from that one fob, and every one of them is already dead. Replay any of them at the gate and nothing happens. Rolling codes turn a recording into a fistful of expired tickets.
Contrast that with the fixed-code remotes still on shelves today, which send the identical code forever. Capture one, replay it, you’re in. My noise-hallucinated “Cardin” happened to be a fixed-code protocol, and if that had been a real fixed-code gate this post would have a very different and much more uncomfortable ending.
If you’re buying a gate motor in this country, that’s the one question worth asking: is it rolling code (KeeLoq or similar)? It’s the difference between a lock and a photograph of a lock.
Half the band was empty
I’d also parked a receiver on 868 MHz for the whole run, the other European/SA ISM band. The split: 669 decodes on 433, exactly 2 on 868. In my house, 868 is a ghost town, so I gave 433 its airtime back.
Sometimes the finding is “there’s nothing here,” and that’s still worth writing down. It saves you from spending next month convinced you’re missing something on a band that’s just quiet.
The spectrum, for what it’s worth
The nightly sweeps produced two views. Occupancy is what’s loud: where energy sits on average. Activity is what changed between sweeps, which is closer to where the interesting bursts happen.
The waterfall is for finding signals. The decoder is for identifying them. Once you know roughly where things live, you stop staring at the waterfall and start reading the JSONL. Both images above are basically confirmation that 433 earns its keep and most of the rest of the band, in my little corner of it, does not.
What surprised me
The gap between “decoded” and “real” is enormous. I expected some junk. I did not expect 203 of 238 “devices” to be phantoms. If I’d taken the first summary at face value I’d have published a neighbourhood census made mostly of static.
The sensitive system was the one already protected. The gate is the thing you’d actually care about, and rolling codes were quietly doing their job the entire time, no input from me.
The mundane stuff is the most identifying. Nobody’s gate got exposed, but the fan remotes trace out when the house is awake and moving. That’s not an attack, but it’s information, and it leaks whether anyone meant it to or not.
Lessons
Sanity-check before you believe. A fixed-code remote must send the same code every press; many different “codes” from one model is noise. Sensor values have to be physical; −50 °C and 281 km/h wind are not devices. Real devices repeat with a stable ID.
Consistency is the whole signal. One decode means nothing. The same ID showing up on a plausible cadence, over and over, is a device. Everything else is the decoder being helpful to a fault.
“Nothing here” is a result. The empty 868 run told me where not to spend effort, which is worth as much as any capture.
What’s next
Baking the phantom-filtering into the summary itself, so the fake devices never make it into the numbers in the first place. Some real time on 868 with a better antenna, just to be sure the ghost town really is empty and not something I’m failing to hear. And a small last-seen page that reads the JSONL and shows only the devices that survived the reality check: the honest inventory, not the hallucinated one.
The best thing I got out of this round wasn’t the receiver. It was the reflex of asking, about every blinking “device,” is this real, and what could someone actually do with it? Most of the time the answer is nothing. Knowing which time is the whole game.
Legal
Everything here was passive reception of my own devices, on unlicensed ISM bands, on equipment I own. No transmissions, no replay, no third-party kit. Rolling-code captures are useless for replay by design; fixed-code ones are not, which is the whole point of the write-up. Don’t decode signals you don’t have permission to, and never transmit on a band you aren’t licensed for.