Your LoRa Board Can Track Airliners at 150 Nautical Miles

The datasheet stops at 960 MHz. The airplanes are at 1090. Somebody did the math anyway.

Somewhere over your house right now, a few dozen aircraft are shouting their names into the dark. Altitude, heading, a 24-bit hex identity, all of it on 1090 MHz, all of it plaintext, roughly twice a second, to anyone holding the right piece of copper. For about a decade the right piece of copper was an RTL-SDR dongle hanging off a Raspberry Pi. That arrangement still works. It's also no longer the cheapest way in.

On November 1, Hackaday covered a build by a developer who goes by thefatmoop: an ADS-B receiver made from a Meshnology W12 board, which pairs an ESP32-S3 with Semtech's new LR2021 LoRa transceiver. No SDR. No Linux. No Pi. The board demodulates the aircraft signal itself, checks the CRC, and serves live tracks on a web page from a chip the size of a postage stamp. The builder reports aircraft at around 150 nautical miles with an indoor antenna that was cut for the wrong band. Parts come in under $50.

That last detail is the interesting one. The radio was never sold to do this.

The Box Says 960 MHz

Pull up the LR2021 spec and you get two published frequency ranges: 150 to 960 MHz for the sub-GHz path, and 1600 to 2500 MHz for the 2.4 GHz and S-band side. ADS-B lives at 1090 MHz, which falls neatly in the gap between them, a dead zone on the marketing sheet.

The build tunes the sub-GHz path to 1090 anyway, and it hears airplanes.

There's a whole philosophy of hardware hiding in that sentence. A frequency range on a datasheet is a promise about performance across temperature, voltage and production lots. A warranty, basically. The synthesizer inside a modern transceiver usually has more headroom than the vendor wants to characterize, guarantee and support, so the published number lands where the lawyers and the test engineers are comfortable. Past that number you are on your own, which in practice means the thing usually works a little worse and nobody will help you when it doesn't.

Every interesting capability in computing started as a misuse. Wi-Fi chips became spectrum analyzers. TV tuner dongles became the RTL-SDR. Now a LoRa transceiver built for battery-powered sensor meshes is pulling Mode S out of the sky. The pins don't care what the box says. They care about tolerances.

The second reason this works is the modulation list. The LR2021 supports FSK, LoRa, LR-FHSS, FLRC, O-QPSK and OOK. That last one, on-off keying, is the whole trick, because ADS-B is pulses of carrier switched on and off. Strip away the aviation acronyms and an aircraft transponder is a very fast, very loud flashlight.

What a Plane Actually Says

ADS-B on 1090 MHz is called Extended Squitter. Each message opens with an 8 microsecond preamble: four short pulses at fixed offsets (0, 1.0, 3.5 and 4.5 microseconds) that work as a fingerprint for "a Mode S frame starts here." After the preamble comes the data block, 112 bits at one megabit per second.

The encoding is pulse position modulation. Each bit gets a 1 microsecond slot split into two halves. A pulse in the first half is a 1, a pulse in the second half is a 0. If that sounds like Manchester encoding riding on OOK, you've understood it, and that's exactly how the build's write-up describes it.

Inside those 112 bits:

DF   (5 bits)   downlink format, 17 for ADS-B from a transponder
CA   (3 bits)   capability
AA   (24 bits)  ICAO address, the aircraft's permanent hex identity
ME   (56 bits)  the payload: position, velocity, callsign, depending on type
PI   (24 bits)  CRC-24 parity

The CRC is your entire quality gate. At 1090 MHz you're listening to a crowded band full of overlapping replies, reflections and garbage, so the receiver lives or dies on rejecting frames that don't check out. The ESP32-S3 handles that in firmware: frames that fail the CRC go in the bin, frames that pass get decoded into tracks.

Note what's missing from that bit layout. There's no signature, no key and no nonce. The 2013 academic paper "On the Security of the Automatic Dependent Surveillance-Broadcast Protocol" said it plainly: the data link layer has no authentication. Anyone can listen, and nobody can tell you're listening. Keep that in mind, because it comes back at the end.

Flashing It

The project ships as a GPL-3.0 repository, esp32s3-lr2021-adsb-receiver, with a factory image in its releases. The flow is short enough to fit on a napkin:

1. flash the factory image (follow the repo's install guide)
2. join the W12-ADSB-SETUP wifi network the board broadcasts
3. browse to 192.168.4.1/setup and enter your own 2.4 GHz wifi creds
4. read the board's new IP off the 0.96" OLED
5. open that IP from any machine on the same network

Once it's on your LAN, check the receiver diagnostics page before you trust anything. The defaults use the LF (sub-GHz) input. Frequency correction starts in Observe mode, where it measures drift without acting on it. Let it watch real traffic for a while, then flip it to Apply. Cheap crystals drift, and a receiver that's slightly off-frequency looks exactly like a receiver with a bad antenna. People burn hours swapping antennas to fix a calibration problem.

Use a real USB-C data cable. The charge-only cable in your drawer will flash nothing and tell you nothing about why.

The Filter You Have to Kill

Here's where the build stops being a firmware install and turns into a hardware mod.

The W12's sub-GHz path has a SAW filter, U12, marked 2J1, sitting between the antenna port and the radio. Its job is to pass the LoRa band and reject everything else. It does that job well, which is the problem, because "everything else" includes 1090 MHz.

The README's fix is surgical. Remove U12, then bridge pads 1 and 4 with an insulated jumper so the antenna feeds the radio directly, and keep the jumper clear of pads 2, 3 and 5. Then connect your antenna to the LF/sub-GHz port.

A few notes from the bench side of this:

• Use a fine tip or hot air. SAW filter packages are small and the pads lift if you get impatient. A tweezer-tip iron or a hot air station on low airflow is the civilized route.
• Thin wire, short run. A short length of 30 AWG Kynar wire is ideal. At a gigahertz, a long loop of jumper is a tiny antenna of its own.
• This is a one-way trip. Once U12 is gone, the LF path is unfiltered. LoRa use on that port gets noisier, and you're exposed to strong out-of-band signals that the filter used to eat. Treat the board as an ADS-B receiver from here on.

You can skip the mod. The HF/2.4 GHz input works without it. In the builder's testing, though, range was noticeably shorter on the unmodified path. The difference between 40 miles and 150 miles is one tiny filter and five minutes with a soldering iron.

Antennas, and the Wrong One That Works

The headline range came from an indoor 915 MHz antenna, the one cut for LoRa. That works because a 915 MHz whip is close enough to 1090 to resonate badly but usefully, and because airplanes are loud and high with nothing in the way.

You can do better for the price of a coffee. Wavelength at 1090 MHz is about 275 mm, so a quarter-wave element is about 69 mm. A quarter-wave ground plane (one 69 mm vertical element, four radials drooping at 45 degrees, all soldered to an SMA bulkhead connector) is a classic first antenna build for ADS-B, and it routinely beats store-bought whips. If you'd rather buy one, get something actually labeled for 1090 MHz with a 50 ohm feed.

Placement beats gain. Line of sight decides everything at this frequency. A cheap antenna in a top-floor window will outperform an expensive one on a desk surrounded by drywall, wiring and a monitor that leaks RF from every seam.

The optional GNSS module earns its slot here too. When the board knows where it is, range and bearing calculations make sense, and your track list stops being a list of numbers.

What You Give Up

This is a beautiful hack and an incomplete tool. Know the trade before you sell off your dongle.

A conventional RTL-SDR station, something like an RTL-SDR Blog V4 [AFFILIATE: RTL-SDR Blog V4] feeding readsb on a Pi, gives you a few things the W12 doesn't:

• MLAT. Multilateration locates aircraft that broadcast Mode S without position data by comparing arrival times across many receivers. That needs precise timestamps and a feeder network. The W12 is on its own.
• Feeding aggregators. The big community tracking networks expect standard decoder output. A custom ESP32 web page doesn't plug in without extra work.
• Everything else on the spectrum. An SDR is a general-purpose radio. Tomorrow it can be an AIS receiver, a weather satellite station or a pager decoder. The W12 does one thing.

What you get in exchange is a receiver that boots in seconds, sips power from a USB brick, has no SD card to corrupt and no OS to patch, and costs less than a decent dinner. As a permanent window-sill sensor, a field unit in a go-bag, or a second station somewhere you'd never park a Pi, that trade is easy to justify.

The project also has honest edges. It's experimental. It's not an official Meshnology or Semtech product. A commenter on the Hackaday piece reported the W12 is hard to find in the US and EU outside Amazon India. Check availability before you plan a weekend around it.

Plaintext Sky

Back to that missing signature.

ADS-B is a protocol that announces everything and authenticates nothing. That makes it great for hobbyists and quietly uncomfortable for everyone else. Every aircraft with a working transponder broadcasts a permanent 24-bit address. The address maps to a registration. The registration maps to an owner. Log it for a month from one window and you have a pattern of life: who flies, when, where they go and how often they come back.

That's the OSINT angle, and it's why aircraft tracking keeps turning up in investigative work. Corporate jets telegraph acquisitions. Government flights telegraph visits. Private planes telegraph exactly what their owners would prefer they didn't. A $50 receiver that logs every ICAO address it hears is a surprisingly sharp instrument once you start keeping notes. If you go that route, a structured intel log matters more than the radio does. The template set in Obsidian + Claude Daily Ops (numbpilled.gumroad.com/l/obsidian-claude) was built for exactly this kind of recon-notebook habit, where raw captures become something you can actually search six weeks later.

The same plaintext design that makes listening easy makes injection theoretically easy, and that's been a research topic for over a decade: ghost aircraft, spoofed positions, the lot. Leave it on the page. Receiving 1090 MHz is legal in most places. Transmitting on it is the kind of mistake that ends with very serious people at your door, because you'd be interfering with live air traffic safety systems. The W12's radio can transmit. Don't let it near 1090 on the way out.

Defenders have the mirror-image problem: a receiver network that trusts plaintext can be fooled. Plausibility checks, multilateration and cross-referencing against primary radar are how serious systems cope. A single-board receiver like this one makes a nice teaching tool for that conversation, because it shows you exactly how little stands between the sky and your screen.

Where to Take It

Build one, mod the filter, cut a 69 mm ground plane, stick it in the highest window you have, and let it run for a week. Then point something at the data. Log every ICAO address to a file, count unique aircraft per hour, and flag any address you've seen more than ten times. Within a few days you'll know which tail numbers own your sky.

If this build hit the part of your brain that likes turning cheap ESP32 boards into field sensors, the rest of that playbook lives in Hardware Hacking for OSINT: Raspberry Pi War-Driving Box (numbpilled.gumroad.com/l/pidriver). It's the long-form version of this post's instincts: RF capture, firmware, and turning passive collection into intelligence without paying anyone a subscription.

The datasheet said 960. The airplanes said 1090. The airplanes were right.

Sources: Hackaday, "Building An ADS-B Receiver For Less Than You Think" (Nov 1, 2026); github.com/thefatmoop/esp32s3-lr2021-adsb-receiver; CNX Software on the Semtech LR2021; Strohmeier, Lenders and Martinovic, "On the Security of the Automatic Dependent Surveillance-Broadcast Protocol" (arXiv:1307.3664).