$750 and a Weekend Passive Direction Finding with KrakenSDR
This recording is not on YouTube. It plays from the DEF CON media server; the button opens the file there.
Where
Radio Frequency Village
DEF CON 34
Duration
28 min
Follows a hobbyist's urban radio direction-finding project, using a five-antenna KrakenSDR to bearing ham and FM transmitters in Portland.
Summary
The speaker set out to explore ground-based radio navigation as a cheap, GPS-like alternative, drawing on Cold War systems and research on Mars rover navigation. Using a KrakenSDR receiver with five antennas on a Raspberry Pi, they took bearings on transmitters around Portland, Oregon, including a hospital ham beacon that identifies itself every ten minutes. Most of the work was physical: finding sites where they were allowed to set up and trying to get clear sight lines.
Results varied widely. A professor's test from a tall building was accurate to about four degrees, while the speaker's early attempts were off by around eleven. Setup mattered more than software. Ground planes, antenna height (a music stand made a large difference), and metal and concrete reflections all changed the readings. Confusing true north with magnetic north also cost them data. Accuracy degraded past roughly half a mile, and multipath produced twin lobes in the plots.
The main takeaway is that a roughly 750 dollar kit can produce useful bearings, but urban environments make site selection and line of sight the dominant factors. The Q&A raised doubts about whether a strong peak came from the speaker's own transmitter or from the headphones being tested, and the speaker agreed localization might have been on the transmitter.
Materials
Related talks
Radio Frequency Village·27 min
Dalton
Shows how a HackRF-based tool passively observes Bluetooth Classic and Low Energy traffic, recovering piconet clocks and device addresses over the air.
Radio Frequency Village·40 min
Erwin Karincic
Shows how an AI assistant driving GNU Radio through a custom MCP server can detect SDRs, build flow graphs, and demodulate a proprietary sub-GHz protocol.
Radio Frequency Village·16 min
John
Shows how a cheap Bluetooth Low Energy tracker built on an off-the-shelf M5Stack can follow a beacon's MAC address through a crowded venue using signal strength.