What is an RF spectrum analyzer, and how can a phone become one?

Every street is full of radio signals: FM stations, cell sites, Wi-Fi, two-way radios, smart meters, aircraft transponders. You can't see or hear them, but a spectrum analyzer can. This guide explains what an analyzer shows, how it works inside, which controls matter, how to recognise common signals on the screen, and how a phone with a small receiver can do the job on a walk.

What the display shows

A spectrum analyzer draws a graph with frequency across the bottom and amplitude (signal strength) up the side. Low frequencies are on the left and high frequencies on the right. Each transmitter shows up as a bump at its frequency: a narrow spike for a simple radio carrier, a wide flat block for an LTE or Wi-Fi channel. The flat, fuzzy line along the bottom is the noise floor, the receiver's own background hiss. Anything that rises clearly above it is a signal.

Radio frequencies are measured in hertz, the number of cycles per second. You'll mostly see MHz (millions of cycles per second) and GHz (billions). FM radio sits at 88–108 MHz, most cellular service between 600 MHz and 4 GHz, and Wi-Fi at 2.4, 5 and 6 GHz.

Amplitude is shown in decibels, a logarithmic scale. Every 10 dB step is a factor of ten in power, so a signal 30 dB above another is a thousand times more powerful. The log scale is what lets one screen show a strong broadcast station and a faint signal near the noise floor at the same time, even though their powers differ by a factor of millions. Two units are common:

• dBm is power relative to one milliwatt: 0 dBm is 1 mW, −30 dBm is a thousandth of a milliwatt, −90 dBm a billionth. It's an absolute power.
• dBFS is decibels relative to the receiver's full scale, the largest signal its digitiser can represent. 0 dBFS is full scale; everything else is negative. It's consistent from one measurement to the next with the same kit and settings, but it isn't an absolute power until the receiver is calibrated against a known source.

Our guide to dBm and other RF units goes into these in more detail.

The two axes are set by you

The horizontal axis is set by the centre frequency and span (or, equivalently, the start and stop frequencies). The vertical axis is set by the reference level at the top of the screen and the scale per division. Changing these doesn't change the signals; it changes which part of them you're looking at.

Time domain and frequency domain

An oscilloscope shows a signal in the time domain: voltage on the vertical axis, time on the horizontal. A spectrum analyzer shows the same kind of signal in the frequency domain: how much power there is at each frequency.

The two views describe the same thing. A pure tone, a perfect sine wave, looks like a smooth wave on an oscilloscope and a single narrow line on a spectrum analyzer. A square wave looks like a square on the oscilloscope and, on the analyzer, a line at its fundamental frequency plus a series of smaller lines at odd multiples of it, its harmonics.

The frequency domain is far more useful for radio, for a simple reason: the air around you carries many signals at once, all added together. In the time domain that sum is an unreadable jumble. In the frequency domain, each transmitter sits at its own frequency, separated from the others, and you can read off how strong each one is.

Some analyzers add a third dimension. A spectrogram or waterfall shows frequency across, time down, and amplitude as colour. It's the best way to see signals that come and go, such as a hopping Bluetooth link or a radio that keys up for a few seconds at a time.

How FFT analysis works

Most modern analyzers, and every SDR-based one, use the fast Fourier transform (FFT). It's an efficient way of calculating how much of each frequency is present in a block of samples. Understanding the few steps involved explains most of what you'll see on the screen.

Step 1: sampling

The receiver tunes to a centre frequency and converts a band around it into a stream of numbers, called samples. A receiver like the HackRF produces complex (I/Q) samples: each one is a pair of numbers that together describe both the size and phase of the signal. With complex sampling, a sample rate of 20 million samples per second (20 Msps) covers a band 20 MHz wide, from 10 MHz below the centre frequency to 10 MHz above it.

Step 2: a block of samples

The analyzer takes a block of samples, say 1,024 of them, and passes it to the FFT. The size of the block is the FFT size. At 20 Msps, a 1,024-sample block lasts 51.2 microseconds.

Step 3: bins

The FFT output is a list of the same length as its input, each entry describing one narrow slice of frequency called a bin. The width of each bin is:

bin width = sample rate ÷ FFT size

At 20 Msps with a 1,024-point FFT, that's 20,000,000 ÷ 1,024 = 19,531.25 Hz, about 19.5 kHz per bin. A 4,096-point FFT at the same rate gives bins of about 4.9 kHz. Bigger FFTs give finer bins but take longer to fill with samples, so there's always a trade-off between frequency detail and time detail.

Step 4: windowing

The FFT assumes the block of samples repeats forever. Real signals don't line up neatly with the block edges, so the cut at each end looks like a sudden jump. That jump spreads energy from a strong signal into bins far from its true frequency, an effect called spectral leakage. On screen, leakage makes a strong, clean carrier look like it has wide "skirts", which can hide weak signals nearby.

The fix is a window: a smooth curve that fades the block in at the start and out at the end before the FFT. Common windows trade off differently:

The cost of a strong window is a wider effective bin. Its equivalent noise bandwidth (ENBW) says how wide a perfect rectangular filter would need to be to let through the same amount of noise. That figure is the true resolution bandwidth of the FFT. With a Blackman-Harris window, 1,024 points and 20 Msps, the RBW is about 2.0 × 19.53 kHz ≈ 39 kHz.

Consentiva uses a Blackman-Harris window, because walking surveys meet strong signals all the time, and suppressing leakage matters more than the finest possible resolution.

Step 5: power, averaging and peak hold

Each bin's output is converted to power, then to decibels. A single FFT is noisy, so analyzers usually combine several: averaging them gives a steadier picture of continuous signals, while keeping the maximum of each bin catches short bursts. Overlapping the blocks, so that each sample contributes to more than one FFT, makes better use of the samples when a window has faded out the block edges.

Step 6: stitching a wide sweep

An SDR can only take in a band as wide as its sample rate at a time, 20 MHz for the HackRF. To cover more, the software steps: tune, capture, FFT, retune to the next centre frequency, and repeat. The edges of each step are less reliable, because the receiver's filters roll off there, so good software keeps only the flat central part of each step and overlaps the steps to cover the gaps. Consentiva keeps the central three-quarters of each 20 MHz step, then summarises the fine bins into 1 MHz channels with a peak-hold and a channel-power figure for each.

Types of spectrum analyzer

All analyzers produce the same kind of graph, but they get there in different ways, and the differences show up in speed, accuracy and what they can catch.

Swept-tuned analyzers

The classic design is a superheterodyne receiver whose tuning sweeps steadily from the start frequency to the stop frequency. At each moment, a narrow filter, the resolution bandwidth filter, lets through just the slice of spectrum it's tuned to, and a detector measures its level. The trace is drawn point by point as the sweep moves across.

Swept analyzers can cover huge spans with excellent dynamic range. Their weakness is time. A narrow filter takes time to respond, so the sweep must slow down as the RBW narrows: sweep time grows with the span and with the inverse square of the RBW. Halve the RBW and the sweep takes about four times as long. And because the analyzer only looks at one slice at a time, it can miss a short burst that happens at a frequency it isn't currently tuned to.

FFT and real-time analyzers

An FFT analyzer digitises a whole band at once and calculates its spectrum in one go, as described above. Within that band, it sees everything simultaneously. A real-time analyzer goes further: it processes overlapping FFTs fast enough that no samples are dropped between them. That means that within its real-time bandwidth, it won't miss any event longer than a certain minimum duration. Real-time analyzers typically add displays such as persistence (where frequently seen signals glow brighter) and spectrograms, which make intermittent and hopping signals easy to see.

SDR-based analyzers

A software-defined radio such as the HackRF One is a general-purpose receiver that digitises a band and hands the samples to a computer or phone. The analysis is entirely in software. It's an FFT analyzer whose processing happens on a separate device, and which steps across a wider range by retuning.

A stepping SDR isn't gap-free across the whole range. While it's measuring one 20 MHz step it isn't measuring the others, so a burst at another frequency during that time is missed. Walking repeatedly through the same area, with peak hold, makes up for much of that in practice: a transmitter that is on regularly will be caught on some sweeps.

The key controls

Bench and handheld analyzers have a standard set of controls. SDR software exposes some of them directly and sets others for you, but they're all at work in every analyzer.

Centre frequency and span

The centre frequency is the middle of the screen; the span is the width shown. A span of 100 MHz centred on 98 MHz shows 48–148 MHz. You can also set the start and stop frequencies directly. Wide spans give an overview; narrow spans let you see detail around one signal.

Resolution bandwidth (RBW)

The RBW is the width of the slice the analyzer measures at each point. It controls three things at once:

• Resolution. Two signals closer together than about the RBW merge into one bump. A narrower RBW separates them.
• Noise floor. A narrower filter lets in less noise. The displayed noise floor drops by 10 × log10 of the RBW ratio dB: ten times narrower, 10 dB lower; half as wide, 3 dB lower.
• Speed. On a swept analyzer, narrower RBW means a slower sweep. On an FFT analyzer, a narrower RBW needs a bigger FFT, which needs a longer block of samples.

RBW also changes how different signals appear. A narrow carrier, narrower than the RBW, reads the same level whatever RBW you choose, because all of its power fits in the slice. A wideband signal, such as an LTE channel, reads lower at a narrow RBW, because each slice catches only a small part of its power. That's why a 10 MHz-wide LTE block can look weaker than a single FM station on the same screen even when its total power is greater.

Video bandwidth (VBW)

The VBW is a smoothing filter applied after the detector. It doesn't change what the analyzer can resolve; it reduces the jitter of the trace, especially the noise. A VBW much narrower than the RBW gives a smooth, steady trace that makes small signals near the noise floor easier to see. On swept analyzers, narrowing VBW also slows the sweep. In FFT software, the equivalent is averaging several FFTs together.

Reference level

The reference level is the amplitude at the top line of the display. On many analyzers it's tied to the input attenuation, so that a signal at the reference level is just within what the receiver can handle without overload. Set it a little above the strongest signal you expect.

Input attenuation and gain

Analyzers have an input attenuator to reduce strong signals before they reach the sensitive parts of the receiver. More attenuation protects against overload and distortion, but raises the noise floor by the same amount: 10 dB of attenuation makes weak signals 10 dB harder to see. SDRs work the other way round: instead of attenuation, they have gain stages. The HackRF has an LNA (0–40 dB), a VGA (0–62 dB) and an optional +14 dB RF amplifier. Lowering gain does the job of adding attenuation.

Finding the right setting is the central balancing act of spectrum analysis: enough gain to see weak signals, not so much that strong ones overload the receiver.

Detector modes

Each point on the display usually stands for many underlying measurements: many FFT bins, or many moments in a sweep. The detector decides which value represents them.

The difference between averaging on a log scale and a power scale matters. Averaging noise in decibels reads about 2.5 dB lower than its true average power, because the log scale gives the many low values more weight than the occasional high ones. RMS detectors avoid that bias, which is why power measurements of digital signals use them.

Sweep time

On a swept analyzer, sweep time is how long one pass across the span takes. Too fast for the chosen RBW and VBW, and the filters don't have time to respond, so signals read too low. Most analyzers set it automatically. On a stepping SDR, the equivalent is the time to retune and capture each step, which grows with the number of steps: a wider range takes longer.

Trace modes

• Clear/write (live): each sweep replaces the last.
• Max hold: each point keeps the highest value seen since you started. Catches intermittent signals; over time, also lifts the trace to the highest noise peaks.
• Min hold: each point keeps the lowest value seen.
• Average: each point is the average of recent sweeps. Smooths noise and bursts away, leaving steady signals.

Comparing max hold with average is one of the most informative things you can do. A signal that's high on max hold but low on average comes and goes. A signal that's high on both is on continuously. Consentiva records both kinds of figure for each 1 MHz channel: the peak (like max hold) and the channel power (like an average).

Noise floor, DANL and dynamic range

The noise floor

Every receiver adds noise. Some is thermal: any resistor at room temperature produces noise power of about −174 dBm per hertz of bandwidth. More comes from the receiver's own amplifiers, described by its noise figure. The noise floor on the screen is the sum of these, measured in the RBW you've chosen. In a 1 MHz bandwidth, thermal noise alone is about −174 + 60 = −114 dBm; a real receiver's floor is higher by its noise figure.

Displayed average noise level

Analyzer specifications quote the displayed average noise level (DANL): the noise floor shown with no signal connected, usually stated for a particular RBW or normalised to 1 Hz. It tells you the weakest signal the analyzer can show. Because the floor depends on RBW, compare DANL figures only at the same RBW, and adjust by 10 log of the ratio otherwise.

Dynamic range

Dynamic range is the span between the strongest signal the analyzer can handle cleanly and the weakest it can see, at the same time. It's limited at the top by distortion and overload and at the bottom by the noise floor.

An SDR's digitiser sets a hard limit. The HackRF has an 8-bit analogue-to-digital converter. The ideal signal-to-noise ratio of an N-bit converter for a full-scale sine wave is about 6.02 × N + 1.76 dB, which for 8 bits is about 50 dB across its full bandwidth. FFT processing spreads that noise across many bins, so the noise in each bin sits lower than that, and weak signals can be seen further down. But the core problem remains: a strong signal close to full scale leaves limited room for weak ones. Bench analyzers, with better converters and analogue front ends, offer far more dynamic range. This is the main practical difference between a lab instrument and an SDR, more than frequency range.

Things on the screen that aren't really there

Every analyzer shows some signals that are created inside it. Recognising them saves a lot of confusion.

Spurs

Spurs (spurious responses) are small, fixed signals created by the receiver's own clocks, oscillators and digital circuits. They appear at the same frequencies whatever the antenna is doing, and they're there even with the antenna removed. A simple test: disconnect the antenna (or replace it with a terminator) and look. Anything that's still there is internal.

Images

In a superheterodyne receiver, a signal at the image frequency (on the other side of the local oscillator, by twice the intermediate frequency) can appear as if it were at the tuned frequency. Good analyzers filter images out. In I/Q receivers such as the HackRF, a slightly different effect occurs: small imbalances between the I and Q paths create a weak mirror image of a strong signal, reflected about the centre of the captured band. A strong signal 3 MHz above the centre of a step may produce a faint copy 3 MHz below it. Mirror images move when the centre frequency changes, which a real signal does not.

The DC offset spike

Direct-conversion SDRs often show a spike right at the centre of each captured band, the DC spike. It comes from small DC offsets in the receiver and from the local oscillator leaking into the signal path, not from any transmitter. Because it sits at the centre of each step, it moves when you retune. Software usually removes it by ignoring or smoothing over the few bins at the centre; Consentiva blanks them with the level of their neighbours.

Overload and intermodulation

When a signal is too strong for the receiver, two things happen. The front end or the digitiser compresses or clips, so the strong signal reads lower than it should, and the whole spectrum may rise as clipping spreads energy everywhere. And signals mix together inside the receiver, creating intermodulation products at new frequencies. Two strong signals at frequencies f1 and f2 produce third-order products at 2f1 − f2 and 2f2 − f1. With signals at 100 MHz and 101 MHz, those appear at 99 MHz and 102 MHz. Some products land in empty spectrum and look like real transmitters.

The standard test is to reduce gain (or add attenuation) by a known amount, such as 10 dB. Real signals all drop by that amount. Third-order products drop by about three times as much in theory, because they grow by 3 dB for every 1 dB increase in the signals that create them. Signals that shrink much faster than the rest, or vanish, were created by overload. Our guide to surveying radio signals describes the test step by step for a walk.

Never connect a transmitter or a strong signal source directly to an analyzer's input. Every analyzer has a maximum safe input level; for the HackRF the maker specifies −5 dBm. Above that, the front end can be damaged permanently.

Antennas and their effect

An analyzer measures whatever arrives at its input. The antenna decides what that is, and it changes the result more than any setting.

• Frequency response. An antenna works best near the frequencies it was designed for. A simple whip is most effective when it's about a quarter of a wavelength long. The wavelength at 100 MHz is about 3 metres, so a quarter wave is about 75 cm; at 2.4 GHz, it's about 3.1 cm. A telescopic antenna can be adjusted, but at any given length it favours some frequencies over others.
• Wideband antennas. Antennas designed to work over a wide range give more even results across a sweep, which helps when you're comparing signals at very different frequencies.
• Polarisation. Radio waves have an orientation. A vertical antenna picks up less from a horizontally polarised signal, and the difference can be large. Many land-based services use vertical polarisation, while some broadcast services use horizontal or mixed polarisation.
• Directionality. Directional antennas, such as Yagis and log-periodics, pick up more from one direction. They're ideal for finding where a signal comes from, by rotating to find the strongest direction. A whip picks up roughly equally all round.
• Surroundings. Your body, a car roof, a metal railing or a wall near the antenna all change what it picks up.

For a calibrated field-strength measurement, analyzers use antennas with a published antenna factor at each frequency, which converts the voltage at the input into field strength. Without that, readings show relative levels: useful for comparison, not for absolute values.

Reading common signal shapes

With practice, you can often tell the kind of signal from its shape on the screen. These are the shapes you'll see most on a city walk.

FM broadcast carrier

FM stations sit between 88 and 108 MHz, on channels 200 kHz apart in the US. Each one is a bump about 200 kHz wide whose shape shifts with the audio. On a wide span they look like a row of narrow spikes of different heights. In the US many stations also transmit HD Radio, which adds low, flat digital sidebands on either side of the analogue carrier. FM signals are continuous, so max hold and average read close together. They are the easiest check that an antenna is connected: in any city you should see them.

LTE and 5G blocks

Cellular downlinks (the signal from the cell site to the phone) look like flat-topped rectangles with steep sides. LTE channels are 1.4, 3, 5, 10, 15 or 20 MHz wide; 5G NR channels in the mid-band can be up to 100 MHz wide. The flat top is the signature of a modern digital signal, many closely spaced subcarriers carrying data at once. They're present continuously, with a level that varies with traffic. Several blocks side by side often belong to different operators or bands. The uplink (phone to cell site) appears in a separate band and is much more bursty, appearing only when phones nearby transmit. Our guide to 5G frequency bands covers where they sit, and finding cell towers near you explains how to match a block to a site.

Wi-Fi bursts

Wi-Fi in the 2.4 GHz band uses channels about 20 MHz wide; in the US most networks use channels 1, 6 and 11, centred on 2,412, 2,437 and 2,462 MHz. In the 5 GHz and 6 GHz bands, channels can be 20, 40, 80 or 160 MHz wide, and Wi-Fi 7 adds 320 MHz channels at 6 GHz. Wi-Fi transmits in short bursts, so on max hold it shows as a rounded block, and on average it is much lower or barely visible unless the network is busy. A big gap between peak and average at 2.4 GHz is a strong hint of Wi-Fi.

Bluetooth hopping

Bluetooth shares the 2.4 GHz band. Classic Bluetooth hops among 79 channels 1 MHz wide, from 2,402 to 2,480 MHz, many times a second; Bluetooth Low Energy uses 40 channels 2 MHz wide over the same range. On a live trace, Bluetooth appears as narrow blips that jump around; on max hold, they build up into a ragged carpet across the band; on a waterfall, they look like scattered dots.

Pulsed radar

Radars send very short, powerful pulses with long gaps in between. Air traffic and weather radars around 2.7–3.0 GHz are common examples within an SDR's range. On max hold, a radar can be one of the strongest signals in a sweep; on average, it may be almost invisible because it's off almost all the time. Many radars also rotate, so the level rises each time the beam points your way.

Broadband electrical noise

Arcing power-line hardware, faulty lighting, some LED drivers, switching power supplies and electric motors produce noise that isn't confined to a channel. It shows as a raised noise floor across a wide range, often strongest at lower frequencies and fading higher up, sometimes with a regular comb of peaks. Unlike a transmitter, it isn't tied to a licensed band. If the noise floor rises across a whole sweep in one spot and falls back as you walk away, look for an electrical source nearby.

For a tour of what you'll actually meet on a city street, see radio signals on a Miami street.

Worked example: reading a sweep

Here's how to read a sweep from a walk with the Common preset (70 MHz–2.7 GHz), uncalibrated, in dBFS. The numbers below are illustrative, chosen to show the reasoning; your own will differ with location, antenna and gain.

Step 1: find the noise floor

Most of the trace sits along a fuzzy line around −95 dBFS per 1 MHz channel. That's the noise floor for these settings. Anything well above it is a signal. Note that the floor isn't perfectly flat across 70 MHz–2.7 GHz: the receiver's gain and the antenna's response both vary with frequency.

Step 2: the FM band

Between 88 and 108 MHz there's a row of peaks, the strongest at about −40 dBFS. Each is an FM station. They're 55 dB above the floor, which is a factor of about 300,000 in power, and the peak and channel-power figures are close together, which fits a continuous broadcast. If the strongest of them were near 0 dBFS, the receiver would be close to overload and it would be worth lowering the gain.

Step 3: an LTE block

Around 2,110–2,120 MHz there's a flat-topped shape 10 MHz wide, with each of its 1 MHz channels at about −70 dBFS channel power. That flat top and steep sides suggest a cellular downlink. Its peak in any one channel is lower than the FM stations, but it occupies ten channels. Adding up ten channels of equal power gives 10 × the power of one, which is 10 dB more: about −60 dBFS in total. So the LTE block carries more total power than its height suggests. That's the RBW effect in action: a wide signal spread across many slices looks lower in each slice.

Step 4: Wi-Fi

Around 2,427–2,447 MHz, the peak figures rise to about −55 dBFS, but the channel power is only around −85 dBFS, close to the floor. A 30 dB gap between peak and average means a signal that's present only a small fraction of the time. The position matches Wi-Fi channel 6, centred on 2,437 MHz. It's probably a network in a nearby building, sending beacons and occasional data.

Step 5: check for artefacts

Two small peaks appear near the FM band, at frequencies where no station is listed but where third-order products of two strong FM stations (2f1 − f2) would fall. Before you read anything into them, run the checks: do they appear on other sweeps at the same spot? Do they move when the step centres change, as images and DC spikes do? Do they drop by much more than 10 dB when the LNA gain is lowered by 10 dB, as intermodulation would? In this example, both fall away with less gain: they were created by the FM stations overloading the front end.

Step 6: compare with normal

A single sweep tells you what's present, not whether it's unusual. A strong signal at 2,115 MHz isn't surprising if a cell site is on the next roof. That's why Consentiva compares each sweep with what is typical for that block of about 150 metres and that time of day, and flags only what stands out. Reading a Consentiva report explains how those comparisons appear in a walk's report.

What spectrum analyzers are used for

EMC testing

Electromagnetic compatibility (EMC) testing checks that electronic products don't emit too much unintended radio energy and aren't easily upset by others. In the US, the FCC's Part 15 rules cover devices such as computers and chargers. Formal compliance testing uses calibrated analyzers or EMI receivers, specified antennas and test sites. Engineers also do pre-compliance checks on the bench, with an analyzer and a near-field probe, to find a noisy circuit before the formal test.

Interference hunting

When a radio service suffers interference, an analyzer shows what's in the band and how strong it is. A directional antenna and a handheld analyzer let you walk or drive towards the source. Our guide to documenting radio interference for an FCC complaint covers how to record what you find.

Site surveys

Before installing a wireless network or a radio link, engineers survey the site to see which frequencies are busy and which are clear. Mapping signals as you move, as Consentiva does on a walk, is a form of site survey.

Education

Seeing the spectrum makes radio concrete: the FM band, the cellular blocks, Wi-Fi bursts and Bluetooth hops all become visible. An SDR-based analyzer is one of the cheapest ways to learn how radio actually works.

Choosing an analyzer

Ask yourself three questions:

1. Do I need absolute, certified numbers? If you're testing against a regulation or a contract, you need a calibrated instrument and probably a qualified engineer. No SDR replaces that.
2. Do I need to compare over time and place? For "is this different from usual?", consistency matters more than absolute accuracy, and an SDR used with fixed settings does the job well.
3. Do I need to see weak signals next to strong ones? If so, dynamic range matters, and a better front end is worth paying for.

A simple RF meter is another option, and it answers a different question: how much total RF energy is here? Our comparison of RF meters and spectrum analyzers explains when each one is the right tool.

From lab instrument to pocket

Consentiva is an SDR-based analyzer built for walking. A HackRF One, covering 1 MHz–6 GHz with an 8-bit converter at up to 20 Msps, plugs into an Android phone. The software runs in Chrome, which talks to the HackRF through WebUSB; there's no app to install. The phone provides the screen, GPS and microphone; the HackRF provides the radio. On iPhone, which doesn't allow web pages to talk to USB devices, you can log marks and GPS but not drive the receiver. Our HackRF One and Android setup guide walks through the kit.

During a walk, the app steps across the chosen range, calculates FFT spectra with a Blackman-Harris window, and summarises each sweep into 1 MHz channels with a peak and a channel-power figure. Each sweep is tagged with time and GPS, and compared with a baseline learned for each block of about 150 metres, separately for night, morning, afternoon and evening. Levels are in uncalibrated dBFS unless you enter a calibration offset, in which case they're shown in dBm. You can explore example output on the samples page.

What an SDR analyzer can and can't tell you

• It can show which signals are present, how strong they are relative to each other and to the same place on another day, and roughly where they were strongest.
• It can't, without calibration and a known antenna, give a certified absolute field strength. Its readings aren't an exposure measurement; RF exposure limits explained covers how exposure is assessed.
• It can be fooled by overload, images, spurs and the DC spike, which is why you should lower the gain near strong transmitters and repeat any surprising measurement.
• It doesn't identify who is transmitting. It tells you the frequency, and from that the kind of service it most likely belongs to.

Glossary

• Amplitude: signal strength, the vertical axis of the display.
• Bin: one frequency slice of an FFT, sample rate ÷ FFT size wide.
• Channel power: the total power within a stated bandwidth.
• dBFS: decibels relative to the digitiser's full scale.
• dBm: decibels relative to one milliwatt.
• DANL: displayed average noise level, the noise floor with no input signal, at a stated RBW.
• DC spike: a false peak at the centre of each captured band in a direct-conversion receiver.
• Detector: the rule for choosing which value each display point shows (peak, sample, average, RMS).
• Dynamic range: the span between the strongest and weakest signals that can be measured at once.
• ENBW: equivalent noise bandwidth, the effective width of a window or filter for noise.
• FFT: fast Fourier transform, the calculation that turns a block of samples into a spectrum.
• Image: a false copy of a signal at another frequency created by the receiver's mixing process.
• Intermodulation: new signals created when strong signals mix inside an overloaded receiver.
• I/Q samples: pairs of numbers describing a signal's size and phase, covering a band as wide as the sample rate.
• Max hold: a trace that keeps the highest value seen at each point.
• Noise floor: the background level of noise on the display.
• RBW: resolution bandwidth, the width of the slice measured at each point.
• Reference level: the amplitude at the top of the display.
• Spectral leakage: energy from a signal spreading into nearby bins because of the block edges.
• Span: the width of frequency shown.
• Spur: a small false signal created inside the receiver.
• VBW: video bandwidth, the smoothing applied to the trace after detection.
• Window: a curve applied to a block of samples before the FFT to reduce leakage.

Common questions

What does a spectrum analyzer measure?

It shows how much signal power there is at each frequency across a chosen range. Frequency runs along the bottom and amplitude up the side, so each transmitter appears as a bump at its own frequency.

What is resolution bandwidth (RBW)?

RBW is the width of the frequency slice the analyzer measures at each point. A narrower RBW separates close signals and lowers the noise floor, but takes longer to measure.

How do I work out the FFT bin width?

Divide the sample rate by the FFT size. At 20 million samples per second with a 1,024-point FFT, each bin is about 19.5 kHz wide; the window then makes the effective RBW somewhat wider.

Why does an SDR show a spike in the middle of the screen?

Direct-conversion receivers such as the HackRF often show a DC spike at the centre of each captured band, caused by small DC offsets and local oscillator leakage. It isn't a transmitter, and software usually blanks it.

How can I tell whether a signal is caused by receiver overload?

Lower the gain by a known amount, such as 10 dB. Real signals drop by that amount; intermodulation products drop by much more or disappear.

What is the difference between max hold and average?

Max hold keeps the highest level seen at each frequency, so it catches short bursts. Average smooths them away, so a signal high on max hold but low on average comes and goes, like Wi-Fi or radar.

Can a phone and a HackRF replace a bench spectrum analyzer?

For comparing signals over time and place, yes, provided you keep settings fixed. It can't give certified absolute measurements without calibration, and its 8-bit converter gives much less dynamic range than a bench instrument.

Does a spectrum analyzer measure RF exposure?

Not by itself. Exposure assessment needs calibrated equipment, known antenna factors and a defined method; an uncalibrated SDR shows relative signal levels only.