After i received the kit i ordered, i fiddled around with software, eventually figuring out i would install SDR++ (though SDR# and sdrangel are also good picks). I sat down, got a feel for the controls, installed a frequency band plan made by a French person, and started listening to the 120MHz-137MHz band, in AM mode. After a little while, spikes appeared. i happen to live not too far to an airport with a somewhat busy schedule, and i quickly figured out what was happening.

This post goes over everything i have learned to do to listen to and track airplanes and airports, so that you too can know these things and do them (unless you are German, apparently). There's one caveat, however, which is that while EU air traffic control has one common regulator (EUROCONTROL), ATC might look different in other places (or even differ slightly from one locality to another).

Voice Communication

Airplanes and airports communicate via radio waves.

Medium-sized and big airports will typically have a air control tower, with people working in there to communicate with individual airplanes, and broadcast information. There are also coordination centers across the country that operate communications. For clarity, i'll call people in there "controllers", regardless of the different positions they can have.

Voice information broadcast happens via AM mode, on a band between 118 MHz and 137 MHz, with a 10 KHz bandwidth. One consequence of the use of AM is that the voice signal can travel quite far away as long as the plane is in the air (where you are very likely to have line of sight even tens of kilometers away).

Airports will typically have multiple frequencies for airplanes coming into the airspace or needing information or needing to negotiate with controllers. The first of these sets of frequencies is called Approach frequencies. The next ones are typically called ATIS, or Automatic Terminal Information Service. The last ones are tower frequencies. Those are not the only types that exist, by any mean (depending on the airport there are others such as for taxiing on the apron, the area around gates, etc, and for passing way above the airport where you could not reasonably inconvenience anyone). As i have been informed, some of these frequencies are managed by the local airport, and some by the coordination centers in charge of air traffic control across the country.

When planes are about to enter the airspace of a nearby airport for landing, they need to announce themselves to the controllers via the dedicated frequency. In big airports, multiple of those can exist, and the appropriate one is picked depending on your hardware, your location, or other circumstances. Here at LFRN (the airport in Rennes, France), the distinction seems to be depending on your area of approach. Despite that, i have only ever heard one of the frequencies used (perhaps because of my direction with the airport). The pilot does not pick themselves however. What happens from their point of view is that the last controller they talk to before approaching the airport will tell them what frequency to tune in for approach before leaving them.

When planes want information about the state of an airport, they tune into the airport's ATIS frequency (for the language they want, if multiple are available). The ATIS frequencies broadcast voice recordings^[1] summing up a lot of information about the different runways, weather information, etc. Did you know that, as of October 2024, the ATIS for Charles-de-Gaulle and Orly airport, in Paris, use Text-to-speech for all languages? Now you do. Over where i live, LFRN uses a loop of a recorded human voice.

Finally, when planes need to negotiate with controllers to take off, land, or move around on the ground, they communicate on the Tower frequencies. This is where the bulk of activity will usually happen when you're next to a medium-sized airport. Every time an airplane takes off or lands, you will be able to hear a whole exchange giving landing authorization, or asking to loop around to wait. Controllers will provide direction, weather information, etc. They will also indicate what taxiway to take to exit the runway, and so on.

In all of these situations, the language used is fairly codified. This is done both for making sure everyone understands each other, but also for clarity: AM radio goes far away, but voice quality is shoddy. Telling apart a German saying "Nein" and an English-speaker saying "Nine" is hard, so we say "Niner" instead for the digit.

As an example, here is a small sample of a conversation between controllers at LFRN and a plane landing, roughly translated to English:

Controller: 80 44 Rennes good evening, runway 28 landing authorized, wind 180

degrees, 16 to 22 knots, runway is wet

plane (FMY8044): landing authorized 28, runway wet, FMY 8044

Controller: 8044 exit runway first left via delta, drive to ALAT parking, listen to 121 decimal 7 2 5 and call back when runway cleared

plane (FMY8044): we're driving to ALAT, 121 7 2 5 and call back when runway cleared. FMY8044

plane: (FMY8044): Runway cleared, end of service 8044.

Controller: Received 8044, call back ALAT for exit.

plane (FMY8044): We will call ALAT for exit. FMY 8044.

When a plane receives orders, they will have to repeat the information to tell controllers that it was understood. Similarly, when they enter an airspace, they must announce themselves. Otherwise, the pilot will quickly start noticing that a fighter tail is telling them, and they should expect to be arrested and stripped of their license immediately after landing. In the exchanges above, plane FMY8044 received authorization to land, as well as information about wind and runway conditions. They acknowledged back. The controllers then told them what taxiway to use to exit the runway through, and where to go and what frequency to listen for information. Controllers tell the plane to call them back when the runway is cleared, which they do later, announcing the end of their service for the day. Controllers announce who they need to call to exit the taxiways, and they acknowledge, repeating their call sign every time (although i could not hear the start properly so i just pasted FMY8044 in its entirety, they tend to shorten them as does the controller). For context, ALAT is the acronym of Aviation Légère de l'Armée de Terre, or lightweight aviation division of the french ground army. Do of that information what you will.

Now, in terms of voice communications i also receive next to an airport, tower controllers can also communicate with marshallers (the french call them "sécurité" but they are not exactly security, more like on-ground personnel on the runways making sure everything goes correctly). They may be tasked with doing sweeps of the runways, guide airplanes to follow them, etc. Sometimes they also get to hold glowing sticks. Neat. The marshallers team at my airport once had a very confused discussion with controllers after a departing airplane absolutely bodied a seagull. They retrieved the corpse of the poor thing, of course. In order to do that, even they had to get permission from Tower to move around. In that situation, airplanes always have the right of way, even in an emergency.

And how do you what frequencies correspond to which airport and vice versa? Pilots have documents for that purpose, and complicated instruments. i personally have SkyVector, a global database of airport information. Say you want to tune into the french-speaking ATIS for Lyon's LFLL, aka Lyon Saint-Exupery, you'd read that it is at 126.18 MHz. Tune your SDR, deploy a roughly 60cm long straight dipole antenna looking at the airport, and boom: you have audio of people talking.

Now, receiving voice is harder when you are far from an airport. Receiving voice from airplanes is easier, but they need to be somewhat close to somewhere that needs them to talk in order for any speech to happen.

Most of what i talked about here also apply to small aviation clubs, especially as they depend on a local airport for operating. The aviation club in my city also talks with controllers, and uses the same runways and taxiways as commercial airplanes. From the interactions i have heard, i am fairly sure they know each other.

And that's roughly it for voice. It is not technically complex to listen to airplanes. If you do not live next to an airport, websites such as LiveATC offer you archives and live audio of air traffic control frequencies (except in Germany, of course, because Germany is spiritually opposed to people having fun).

But in order to know what airplanes are up to, you kind of need to know where they are? Don't worry, i also got you covered.

Aircraft Transponders

Airborne vessels of basically all kinds need to tell the ground and others flying where they are, at least in terms more precise than "above you, silly".

They are equipped with transponders. These things will just broadcast information about the vessel including: flight number, aircraft altitude, heading, latitude, longitude, and status code (also called squawk).

These transponders mostly use the Automatic Dependent System Broadcast (ADS-B) protocol in Europe and Northern America, at least. In Europe, planes broadcast information at 1090 MHz. Americans are incapable of managing their band plans and, therefore, they have ADS-B at 978 MHz, which once raised concerns about cellular phones^[2].

ADS-B Antenna Setup

My own setup for listening to ADS-B uses the following items:

• RTL-SDR dongle
• Wideband Low-Noise Amplifier (i could use the ADS-B specific one sold by RTL-SDR, but i only have the wideband variant)
• Antenna kit: small antenna set, pulled all the way out, in a straight dipole

Optionally, i also add a reflector. This can be any plate of metal, or an aluminium sheet behind the antenna in the direction you target. Because i have immense brainrot and find it pleasant to be treated like an animal by others, i even have my own para-bowl-ic antenna:

Listening to Transponders

ADS-B carries a ton of information, as stated above. Because it is transmitted in the UHF range, the signal penetrates buildings pretty badly. Several tools available online allow you to receive and decode ADS-B on 1090 MHz. The keyword to search for them is usually something like "1090". Personally, i tried readsb, rtl_adsb and dump1090 (specifically the FlightAware variant^[3]). In the end i kept using dump1090, because readsb was a pain to get working, and i learned about rtl_adsb after using dump1090 for a while (and the former needs a bit more processing and software to actually read the ADS-B messages).

For visualization, i initially looked into tar1090, but quickly realized that it is closer in taxonomy to a distribution for creating a small ADS-B collection computer on a Raspberry Pi or other micro computer rather than a single piece of software^[4]. Therefore, i ended up using viz1090, which despite being more minimal, actually works with a single small binary i can compile.

First, start running dump1090 somewhere. You will need multiple arguments:

dump1090 --net --gnss

The arguments mean:

• --net expose the data via the Beast protocol, by default on 127.0.0.1 and a bunch of ports (including 30005, the Beast output port)
• --gnss tells the program to resolve altitudes via the Height Above Ellipsoid (HAE) system (most like WGS84, i assume).

Technically you do not need anything beyond --net for this to work. You can also add --stats, --stats-range and --stats-every [time] to get stats about the distance of planes observed when the program exits, and every [time] seconds, respectively. If you want these statistics, you will need to provide your reference position using --lat/--lon, otherwise dump1090 has no idea where you are located.

If you are using a Low-Noise Amplifier on your transmission line, like i do, set the gain down at around 28.0 dB, so that the LNA does not saturate your signal (otherwise you will get nothing). For reference, i went from receiving no signal when dump1090 cranked the gain all the way to maximum with my LNA, to receiving information about planes 350+km away from me while indoors with --gain 28.0 (or play with it to figure out the sweet spot for your reception setup).

The output of dump1090 should be a stream of messages that look something like this:

*8d4cae4c58c383b3af7f10137192;
CRC: 000000
RSSI: -24.5 dBFS
Score: 27 (DF17_KNOWN)
Time: 16462495.58us
DF:17 AA:4CAE4C CA:5 ME:58C383B3AF7F10
 Extended Squitter Airborne position (barometric altitude) (11) (reliable)
  ICAO Address:  4CAE4C (Mode S / ADS-B)
  Air/Ground:    airborne
  Baro altitude: 38000 ft
  CPR type:      Airborne
  CPR odd flag:  even
  CPR latitude:  47.55281 (121303)
  CPR longitude: -2.26648 (98064)
  CPR decoding:  global
  NIC:           8
  Rc:            0.186 km / 0.1 NM
  NIC-B:         0

*5d4ca80200c875;
CRC: 00000f
RSSI: -23.2 dBFS
Score: 20 (DF11_IID_KNOWN)
Time: 16466780.75us
DF:11 AA:4CA802 IID:15 CA:5
 All Call Reply
  ICAO Address:  4CA802 (Mode S / ADS-B)
  Air/Ground:    airborne

Some messages carry information about GPS location, some give you the state of the airplane, etc. All messages are supposed to contain what is called an ICAO Address (from the International Civil Aviation Organization), which is a unique international transponder identifier. When you receive these messages correctly, you should have hundreds of them, or even thousands, flying in your terminal every second.

Now, after building viz1090, you can run it as follows:

./viz1090 --lat [latitude] --lon [longitude] --metric --fullscreen

With:

• --lat/--lon as the reference position on start
• --metric to use units that make sense
• --fullscreen if you want the resulting window to be fullscreen

In my case, i see something like this:

The different planes that were recently seen are yellow, and they get greyer the longer you don't need any message about them. As soon as position data is received, the plane appears. Information such as flight number, speed, and altitude, are added and refreshed whenever relevant messages are seen. When that happens, a circle appears the airplanes.

You can also use view1090, which comes with the dump1090-fa-git AUR package on Arch Linux:

 Tot:  14 Vis:  14 RSSI: Max -24.2+ Mean -31.3 Min -35.1-  MaxD:    0.0nm+     /
 Hex    Mode  Sqwk  Flight   Alt    Spd  Hdg    Lat      Long   RSSI  Msgs  Ti
────────────────────────────────────────────────────────────────────────────────
 406F86 S                                                      -35.1-    7 12
 346611 A2    2362  VOE2828   2307  548  234   47.121   -1.845 -24.2+  179 01
 4CA6C4 A0    6324           11278                             -31.2    22 03
 020095 A2    7154  RAM839J  11880  890  224   45.951   -2.415 -32.4    94 08
 4952CC S                    11590                             -34.4    13 19
 44CC42 A0    2364                  805  035                   -34.8    75 21
 4952C3 A2    2227  TAP76G   11575  781  019   46.988   -2.784 -31.5   280 05
 47A218 A2    2210  NOZ9034  10661  853  205   47.751   -3.559 -30.9   479 11
 4CA216 A2    2255  EIN464   11278  803  147   47.713   -2.190 -26.2  2595 00
 4409C0 A0    7624           10669  877  221   45.661   -2.916 -34.6   182 78
 48663E A2          TRA46R                                     -34.5   687 80
 4CA852 A2    7463  RYR5716  10973  764  021   47.342   -2.423 -28.1  2387 0
 440185 A2    2356  EJU4787  10951  840  195   45.442   -2.644 -31.2  4607 0
 4CADC2 A2    7462  RYR601Y  12184  813  021   48.242   -1.904 -29.3 14201 1

Here is a little example of many planes, showing their ICAO address, squawk, flight number, etc. The flight numbers are also transmitted via ADS-B. For the meaning of squawk numbers, i'd encourage you to go read the Wikipedia page. Oddly enough, French Wikipedia has a more thorough list of codes. You can see that some lines are missing information: because all of the information about a plane is not transmitted at once in every message, you will get partial information until you receive the rest of the information. For example, the plane with hexadecimal ICAO address 4409C0 above does not show a flight number. Most likely, i just did not receive any message with that information in the 182 messages i got from that plane (or they were malformed and useless). Some are missing squawk, some do not have GPS coordinates yet. Good reception will improve the number of messages correctly decoded, and increase the amount of information you can get about planes.

Feeding Global ADS-B Antenna Networks

Considering that you can receive all of that information on a budget of less than 40€, it seems natural that people around the world banded together to crowd-source them.

There are multiple online networks of ADS-B antennas, and even other protocols, and i haven't contributed to any yet. It will certainly be a future topic of investigation on my end, which might warrant a small spin-off post in the future.

The network i use the most for online plane world maps, FlightRadar24, pools information from around the world to display a gigantic map and provide archives of plane and flight information. They even tell you how to build your own receiver, and you can even apply to get a free one if you live in a zone with poor coverage. By contributing data to their network, whether with your own hardware or not, you can also get their otherwise very expensive premium plan for free.

i also know of FlightAware, a multinational company that operates a similar service to FlightRadar24, at a larger scale, with a very large coverage.

ADS-B Exchange is another network, with less paywalls. i haven't used it as thoroughly as the other two but it seems to have the basic features of maps, resolving aircraft information, and flight archives. It runs tar1090, which i mentioned above. It is very decent software and does its job, although i wish i could switch units from imperial to metric (if i can, i haven't found how to yet, and i know pilots use imperial units for elevation).

Conclusion

This is more or less the entire gamut of radio observations possible on commercial and civilian aircrafts i know of, for now. Military stuff is a little more complex, even though some of these aircrafts also have regular transponders that you can also listen to.

i could spend a good amount of time just sitting down, listening to air traffic control, and vibe. It's a genuinely pleasant activity. i would, however, not recommend you pull up next to an airport and get out a big antenna; cops, in general, really do not like that.

Hopefully you learned something. i glossed over a lot of details for the sake of readability and not drowning you, the reader, in technical minutiae that you may not care about. Let me know if this was of any help, or made you learn something interesting about those flying metal birds in the sky.

I'd like to thank folks who helped me write this post: rail, who helped proofread, MagicLike for contributing his knowledge about air traffic control, and kloenk for helping me figure out where the hell German law says you can't listen to any radio communication you are not the recipient of.

1. There is now a more modern digital ATIS which can apparently be beamed into airplanes to give them information? Awesome. it seems to use other means than radio, however. My airport does not advertise digital ATIS, so i have not looked into it. ↩

2. Yes, that's very close to the E/R-GSM-900 bands, for cellphone data. Yes, that's one of the reasons airplane mode exists, even though more modern standards should not interfere with transponders, and even though the concern about interference was apparently always out of an abundance of precaution. That is to say: you do not want to say "it's unlikely to happen" and then be in the 1 in a gazillion flight where a concordance of reasons make it so that vital instruments used for a complicated take-off or landing are jammed this one time by a group of cellphones conveniently all screaming to connect to a GSM base transmission station. Still, you should use airplane mode to save battery and not overload cell towers underneath you with tons of hand-over requests (unless your plane is designed to include a cellular "pico-cell", which is the case in Europe) ↩

3. It seems, from my understanding, that at some point in the distant past, one fella made a program called dump1090. It seems like it used to dump data via JSON or the Beast protocol, which other tools could feed off of (such as tar1090). Now, at some point, the original tool seems to have been abandoned, and many people made their own forks. One of them replaced JSON output with a protobuff output, and others kept JSON and rewrote parts of the tool. I picked one of the variants, by the folks behind FlightAware, which kept the JSON output. ↩

4. tar1090 seems cool, but the problem is that it is essentially a collection of scripts and Nginx configs and PHP scripts that gets installed, with a new created user, and so on and so on. It's kind of a lot to ask for just a software that shows me plane information on a map. ↩