RTL-SDR
The cheap USB dongle that turned a TV tuner chip into a wideband SDR receiver. RX only, roughly 24 to 1766 MHz, and the standard entry point into radio hacking.
RTL-SDR is the nickname for a family of cheap USB dongles, originally sold as DVB-T television tuners, that turned out to expose a raw sampling mode. That single quirk let hobbyists stream the tuner's IQ samples to a PC and build a general-purpose software radio for the price of a meal. It is receive-only and modest in every spec, and it is still the device almost everyone starts wireless security work on.
What it is
Inside a typical dongle sit two chips: a Rafael Micro R820T2 tuner that selects a frequency and down-converts it, and a Realtek RTL2832U that digitizes the result and pushes it over USB. The RTL2832U was designed to demodulate digital TV internally, but it also has a raw mode that hands the host the ADC's IQ samples directly. Point the librtlsdr driver at that mode and the host does all the demodulation in software (see wiki:sdr). Physically it is a USB stick with an antenna connector (SMA on the better "RTL-SDR Blog V3" units, MCX on older ones), and it appears to the OS as a generic USB device you claim with the SDR toolchain.
Frequency range and limits
The practical tuning range with the R820T2 is roughly 24 MHz to 1766 MHz, which already covers the 433 and 868/915 MHz ISM bands, pagers, ADS-B at 1090 MHz, and much consumer telemetry. Beyond that, know the ceilings:
| Property | Typical value |
|---|---|
| Tuning range | ~24 to 1766 MHz (R820T2) |
| Direction | receive only, cannot transmit |
| Max stable sample rate | ~2.4 Msps (so ~2.4 MHz of instantaneous bandwidth) |
| ADC resolution | 8-bit |
The V3 boards add a direct-sampling mode to reach down into the HF bands (below ~24 MHz) and a switchable bias-tee to power an external amplifier. None of that changes the two hard limits: it only receives, and it only shows a couple of MHz at a time.
How it is used
It is the front end for the whole SDR workflow, survey then capture then decode:
# Confirm the dongle and read its tuner/EEPROM info.
rtl_test -t
# Record raw IQ around a center frequency for offline analysis.
rtl_sdr -f 433920000 -s 2400000 -g 40 capture.iq
# Decode common 433/868 MHz device protocols straight from the air.
rtl_433 -f 433.92M
# Or open a waterfall and demodulate interactively.
gqrx
From there the samples go into GNU Radio, Universal Radio Hacker, or Wireshark-adjacent decoders. The RTL-SDR is where you learn to read a spectrum, identify a modulation, and pull bits out of a capture before you ever need pricier gear.
Alternatives
When the RTL-SDR runs out of road, the usual steps up are:
- HackRF One, half-duplex transmit and receive, ~1 MHz to 6 GHz, ~20 MHz bandwidth. The go-to when you need to transmit (replay, inject) or reach above 1.7 GHz.
- YARD Stick One, a sub-GHz (300 to 928 MHz) transceiver driven by rfcat. Not a general SDR but excellent for packet-level capture and replay of OOK/2-FSK remotes, where it is often simpler than an SDR flowgraph.
- LimeSDR / USRP, full-duplex, wider bandwidth, and higher dynamic range for serious protocol work, at a serious price.
Pitfalls
- Receive only. No amount of software makes an RTL-SDR transmit. Replay attacks need a HackRF, a YARD Stick One, or similar; the dongle can only prove the signal is there.
- 8-bit, narrow, and noisy. The 8-bit ADC and ~2.4 MHz window mean strong signals overload it and wide signals will not fit. It is a learning and reconnaissance tool, not a lab-grade instrument.
- Counterfeits and heat. Cheap clones use inferior tuners, drift with temperature, and mislabel their range. Prefer a known-good V3 board, and expect frequency drift until the dongle warms up.
- Antenna matters more than the dongle. The bundled whip is a compromise. Matching the antenna to your target band changes results far more than any driver tweak.