Capture and decode ADS-B messages

Mechanism

ADS-B ‘out’ is a periodic, one-way broadcast in which an aircraft reports its own state, identity, position, velocity, with no interrogation, no association, no encryption and no authentication [costin2012ghost][strohmeier2013survey]. Worldwide it rides the 1090 MHz Mode S Extended Squitter (1090ES); in the US, lower-altitude general aviation additionally uses a separate 978 MHz UAT link [strohmeier2017perception]. On 1090 MHz the signal is pulse-position modulation at 1 Mbps, and an Extended Squitter is a fixed 112-bit frame (an 8 µs preamble followed by 112 µs of data bits) [sun2021riddle]. There is no frequency hopping and no channelisation: every aircraft squitters on the same carrier, so a single ~2 MHz receiver sees the whole picture, and the only contention is overlapping bursts. On 1090 MHz the bit period is 1 µs (a pulse in the first half of the period is a 1, in the second half a 0), giving the 1 Mbps rate; the 978 MHz UAT link instead uses CPFSK at 1.041667 Mbps with a 272-bit long message [sun2021riddle].

The 112-bit frame begins with a 5-bit downlink format. ADS-B uses DF17 for transponder-equipped aircraft and DF18 for non-transponder / TIS-B transmitters; it then carries the 24-bit ICAO aircraft address and a 5-bit type code that selects the payload, aircraft identification (the 8-character callsign), airborne or surface position (latitude/longitude in Compact Position Reporting, CPR, encoding), or velocity [sun2021riddle]. A 24-bit parity field lets a receiver validate the frame. Crucially, none of the identifiers is authenticated: the ICAO address, callsign and CPR position are broadcast in the clear with no signature and no integrity over the source, so a receiver cannot tell a genuine aircraft from a forged one [costin2012ghost][strohmeier2013survey].

This control verifies only the receive-and-decode baseline, the passive eavesdropping that the literature established is trivially feasible with a cheap SDR [costin2012ghost]. That same absent authentication is what makes the active attack families possible: experimental work has demonstrated message injection (‘ghost aircraft’), track modification, jamming and flooding against ADS-B receivers [schafer2013experimental][strohmeier2017perception]. Those are legally sensitive transmit operations on protected aviation safety spectrum and are assessed under the Attack-layer control, not here; this PHY control stays receive-only.

Procedure

Receive-only throughout. Capturing and decoding ADS-B is passive and generally lawful, but transmitting on 1090/978 MHz is not, do not transmit at any step here.

1. Confirm the band is alive before committing a decoder. Tune an SDR to 1090 MHz in a waterfall viewer and watch for the short, bursty Extended-Squitter pulses (ADS-B sits above the noise floor, so they are visibly bursty):

   gqrx
   # set the device to your RTL-SDR, tune 1090.000 MHz, sample rate ~2.4 MSPS

   Expected: intermittent narrow pulses popping up at the carrier as aircraft squitter. If you see nothing, check the antenna/filter chain (a 1090 MHz band-pass filter + LNA dramatically lifts weak traffic) before blaming the decoder.

2. Decode the 1090ES link with a primary decoder. dump1090-fa demodulates the PPM bursts, validates the parity and decodes DF17/DF18, with an interactive table:

   dump1090-fa --device-type rtlsdr --gain -10 --interactive

   Expected: a live table of aircraft keyed by ICAO hex address, with callsign, altitude, position (once a CPR even/odd pair is collected) and speed. A handful of rows means a few local aircraft; a busy sky fills the table. --gain -10 selects the tuner’s automatic gain.

3. Serve the decoded feed for downstream tooling. For a permanent or busy receiver, run readsb and emit network output (Beast/raw/JSON) instead of (or as well as) the interactive view:

   readsb --device-type rtlsdr --net --write-json /run/readsb

   Expected: readsb starts, tracks many aircraft at once, and serves a JSON aircraft.json (consumed by a map such as tar1090) plus Beast/raw ports, the handoff point to the Application-layer air-picture and plausibility controls.

4. (US only) Add the 978 MHz UAT link. The 1090 decoders do not cover UAT; tune a second SDR to 978 MHz and run dump978 alongside:

   dump978-fa --sdr driver=rtlsdr | readsb --net --net-only --uat-in-port 30978

   Expected: UAT downlink frames from lower-altitude general aviation, merged into the same aircraft picture.

5. Verify decode correctness on individual frames with pyModeS, the decode you can reason about by hand. Feed a hex frame to the CLI:

   modes decode 8D406B902015A678D4D220AA4BDA

   Expected: df 17, icao 406B90, typecode 4 (identification), callsign EZY85MH, confirming the demodulated bits decode to a sensible identity. This is the per-frame ground truth behind the live table.

6. (Optional) Demodulate inside a flowgraph instead of a black-box decoder, when you want to see each DSP stage (preamble correlation, bit slicing):

   uhd_modes.py     # gr-air-modes receiver, or run its GNU Radio flowgraph

   Expected: the same DF17/DF18 decode, with the signal processing exposed for inspection or modification.

Field case

A reproducible bench check using pyModeS’s own published example frames (no air capture or transmitter required), confirming the decode chain end to end. Decode a matched CPR even/odd airborne-position pair plus an identification and a velocity frame:

modes decode 8D40058B58C901375147EFD09357,8D40058B58C904A87F402D3B8C59,8D406B902015A678D4D220AA4BDA

The two 8D40058B… frames are the even and odd halves of one CPR position for ICAO 40058B; together they resolve to a single latitude/longitude. The 8D406B902015A678D4D220AA4BDA frame is a DF17 type-code-4 identification for ICAO 406B90, decoding to callsign EZY85MH. A globally-referenced position decode for a single even frame (no pair needed) confirms the CPR maths against a known receiver location:

modes decode 8D40058B58C901375147EFD09357 --reference 49.0 6.0

These are the canonical pyModeS test vectors, so the expected outputs are stable: a 40058B position near the 49.0 N, 6.0 E reference and the 406B90 / EZY85MH identity. This is the verifiable, reproducible core of the field case, the decode chain confirmed against fixed, published frames, with no air capture or transmitter required.

Illustrative walkthrough, substitute the values you capture: on a real over-the-air session you would replace these vectors with live frames from step 2/3 and record the receiver-side numbers for the local environment. No author-measured live ADS-B capture is recorded here; the representative over-the-air figures, distinct aircraft seen over a session, fraction of frames passing parity, maximum range with/without a 1090 MHz LNA+filter, are [FILL: measured receiver statistics], to be filled from an authorised on-site capture.

Remediation

ADS-B’s exposure is architectural, the link is plaintext and unauthenticated by design [costin2012ghost][strohmeier2013survey], so “remediation” at this layer is about not over-trusting the feed rather than securing the radio.

• Developer (avionics / receiver firmware): do not treat a decoded DF17/DF18 frame as a trusted assertion of position or identity. Parity (the 24-bit CRC) proves the frame arrived intact, not that it came from the aircraft it names [sun2021riddle]. Where feasible, design toward the authenticated/integrity-protected ADS-B extensions and broadcast-authentication schemes proposed in the literature rather than the bare link [strohmeier2017perception].

• Integrator (tracking / display / fusion systems): never rely on ADS-B as a sole source of truth. Fuse it with independent sensors (primary/secondary radar, multilateration that times the same frame at several stations to fix an aircraft independently of what it claims) and run plausibility checks, impossible kinematics, positions inconsistent across receivers, ICAO addresses that should not be airborne [schafer2013experimental][strohmeier2017perception]. These detections are implemented at the Application layer; this PHY capture is their input.

• Operator (researcher / SOC running a receiver): keep receive-only, capturing and decoding ADS-B is passive and generally lawful, but transmitting on 1090/978 MHz is protected aviation safety spectrum and must never be radiated; any spoofing/ injection assessment belongs to the Attack-layer control and is done only on authorised research equipment over a conducted (cabled) or shielded (Faraday) path, never on-air [strohmeier2017perception]. Log receiver statistics so an anomalous flood or a ghost track is visible against a known baseline.