433.920 MHz · span 2400 kHz · 45 scanners running
Wireshark for the radio spectrum
Leave a cheap dongle on a band and WaveShark tells you what is transmitting around you, instead of what is on the one frequency somebody already told you about.
GPL-3.0 · RTL-SDR, HackRF, Airspy, LimeSDR, PLUTO · no account, no cloud · source
The dial is where you look. The span is what you collect.
Decoding does not follow the dial. Every scanner inside the sampled span runs all the time, so a sensor that transmits once a minute is caught whether or not you were pointing at it when it fired.
Everything heard goes in the list along the bottom, decoded or not: frequency, modulation, RSSI, SNR and what was made of it. Click a row for its envelope, its instantaneous frequency and a hex dump. A burst nothing claims still gets its coding inferred and its bits sliced out, which is enough to recognise the same device again and start reversing it.
app.waveshark.io
Or skip the download
The same receiver is compiled for the browser. Open app.waveshark.io in Chrome or Edge, plug in an RTL-SDR, a HackRF or an Airspy and hand the page the dongle over WebUSB. The decoders run on your own processor, across every core, and nothing is uploaded.
No radio? The page reads the public tuner directory from nostr and opens somebody else’s antenna over WebTransport or WebRTC. What the browser version can and cannot do.
The ones with nowhere else to go, first
What it hears
2.4 GHz
Wi-Fi and drones
802.11a/g/b and single-stream n: network names, the addresses talking, the rate each frame arrived at and whether an address is randomised. A drone broadcasting Remote ID gives up its serial, position and operator, and a DJI airframe gives up its home point too. Needs a HackRF or a LimeSDR, since one channel is 20 MHz wide.
UHF and Ku band
Television
A DVB-T multiplex, or a DVB-S2 transponder off a dish and LNB, read from its carriers down to its transport stream: the transmission parameters, every programme with now and next, and whichever one you pick playing in the window with its sound in step.
Band III and shortwave
DAB and DRM
A DAB ensemble and the stations in it, with the one you pick playing, DAB or DAB+, and a DRM multiplex on shortwave or medium wave with its services, languages and labels.
390-400 MHz
TETRA
The network, its cells and who is called, with clear calls heard as speech and a call carried by several sites listed once. The tea feature links the ciphers and a wgpu key search, so an enciphered channel can be worked on rather than only counted.
136-174 / 400-470 MHz
P25 and NXDN
P25 phase 1 gives the talkgroup, the radio id and the key a call is under. NXDN on the 12.5 and 6.25 kHz channels gives the system number, who called whom and whether the speech is enciphered, and the speech itself in a build with the ambe feature.
2.4 GHz
Bluetooth LE
Advertising, Bluetooth 5 Long Range included, and Open Drone ID carried in it.
2.4 GHz
Zigbee, Thread and Matter
IEEE 802.15.4 under all three: the addresses talking and the networks they belong to, on the channel each sits on, and under Zigbee each hop’s EUI-64 and vendor and the key in use.
868 / 908 MHz
Z-Wave
Door locks, sensors and plugs at 9.6, 40 and 100 kbit/s, on the European and US channels.
700 MHz - 2.7 GHz
GSM and LTE
Every cell on every carrier in the span: network, cell id, location or tracking area, band, bandwidth and level, drawn as hexagons on a map of the towers around you. GSM adds who a page is calling and the channel a phone is sent to.
2.4 GHz / 868 / 915 MHz
RC links
ExpressLRS with the sticks read live on the control view, plus FrSky ACCST, FlySky AFHDS-2A and XN297 remotes, address and payload included.
Any band
Voice
WFM with stereo and RDS, NFM, AM, USB, LSB and CW, several channels at once, with a noise blanker, noise reduction and an auto notch on the strip, and a local Whisper or Qwen3-ASR model writing the words down as they are spoken. Every over can be kept as Opus and played back from the call list.
1.2 / 2.4 / 5.8 GHz
FPV video
An analogue camera’s picture straight off the span, PAL or NTSC, in colour, with its audio subcarrier heard alongside, named with its channel: R1, F4, A5. A Walksnail Avatar digital link gives its channel, frame rate, modulation and MER, and the goggles’ bursts.
144.500 MHz
SSTV
Martin 1 and 2, Scottie 1, 2 and DX, Robot 36 and 72, drawn line by line as they arrive and saved to disc when the picture ends.
137 MHz and HF
Weather satellites
NOAA APT passes and Meteor-M LRPT, drawn on the video pane as they come down, plus HF weather fax charts. The satellites view has the passes over the station for the next day, and listening follows the downlink through Doppler until the satellite sets.
400-406 MHz
Radiosondes
Vaisala RS41, Graw DFM, Meteomodem M10 and M20, iMet, Meisei, MRZ and LMS6 balloons on the map with serial, height, climb rate and the air they were sent up to measure. The channel follows the transmitter as it drifts, and launch sites from SondeHub say when the next one goes up.
131.5 / 136.7 - 137 MHz
Airline datalink
ACARS on the airband channels and VDL Mode 2, the datalink most European traffic uses: the aircraft, the flight and the message it sent to the ground. Inmarsat Aero brings the satellite side of the same traffic off an L-band patch, the 10500 bit/s long-haul channels included.
1090 / 978 MHz
Aircraft
ADS-B and Mode S onto a map with a track table: callsign, altitude, speed, track, position. UAT at 978 MHz adds light aircraft and the ground stations’ weather and traffic uplink.
Marine VHF and L band
Shipping
AIS positions and vessel identity, on the same map as the aircraft, with Inmarsat STD-C carrying the EGC and SafetyNET broadcasts sent to them.
406 MHz
Distress beacons
COSPAS-SARSAT EPIRB, PLB and ELT identities, with the position they encode drawn on the map.
433 / 868 / 915 MHz
ISM devices
About 130 device descriptions, most from rtl_433’s family. Weather stations, thermometers, TPMS including Ford and Renault, door contacts, gate remotes, security sensors, shelf labels, mostly with a stable device ID you can follow.
868.95 / 915 MHz
Utility meters
Wireless M-Bus mode T with manufacturer, meter number, version and type, and Itron ERT SCM, SCM+ and IDM readings on the US band.
433 / 868 / 915 MHz
LoRa mesh
LoRaWAN join requests and addresses, Meshtastic text under the public keys, MeshCore adverts.
Amateur VHF and UHF
M17 and DMR
Who called whom, for how long, and on which talkgroup. M17 packet messages arrive in full with Codec 2 speech; DMR speech needs the ambe feature.
144.800 / 144.390 / 144.640
APRS and packet
Packet stations and vehicle trackers, Mic-E included, on the EU, US and JP calling frequencies. A KISS TNC on --kiss-listen hands the same traffic to any packet program, and keys AX.25 back through the radio.
Wherever you point it
Pagers and tones
POCSAG at 512, 1200 and 2400 bit/s and FLEX at 1600 and 3200 baud, message text in clear, plus the two-tone pair that opens a fire or ambulance pager and the MDC-1200 unit id a Motorola radio sends when its key goes down.
HF and VHF
Morse and teleprinter
A CW channel read as text at the speed it was sent, and RTTY in Baudot from 45.45 to 200 baud, either way up. EAS and SAME alert headers are read on the seven NOAA Weather Radio channels.
On a radio that can
Transmit
A microphone, a tone or a recorded capture into NFM, WFM or AM, keyed by hand or by voice, and six protocols this receiver already reads sent back out: POCSAG pages, APRS beacons, RTTY overs, BLE advertisements, SSTV pictures and RDS names. An over can end on a Quindar tone or the roger beep of a real radio, Flipper .sub files key at the frequency they name, and a whole DVB-T multiplex can be built from any file ffmpeg can open.
ISM coverage is the thin part: rtl_433 has roughly 250 device decoders and matching it is the job. Each protocol has a page of its own saying what it gives you, and the band guides say what is transmitting where. The registry is every protocol the receiver can reach, and the changelog is what landed last.
Ten tabs, Ctrl and a digit for each, Ctrl+` to go back
Sixteen views on one stream
Every decoded frame arrives in one place, and each view is a different reading of it. None of them knows a protocol: a DMR call, a TETRA call and an M17 call are the same row with different fields filled in, and an aircraft, a vessel and a mesh node are the same track. The packet list runs along the bottom of all of them, newest last, with the selected burst’s envelope, instantaneous frequency and hex dump beside it.
DashboardSpectrumSignal chainCallsTranscriptMessagesVideoMapDevicesTrilaterationData linksChannelsControlKeysSatellitesAgent
What each view holds, from the dashboard a fresh receiver opens on to the satellite passes nobody has heard yet.
One receiver, a different antenna and a different dial
What people use it for
433 / 868 / 915 MHz · RTL-SDR
Find every wireless device around you
Leave a dongle on an ISM band and collect the sensors, remotes, door contacts, meters and tyre sensors transmitting near you, each with the ID it keeps.
How it works →1090 / 978 / 131 MHz
Track aircraft and read what they send
ADS-B and Mode S on the map, UAT for light aircraft, and the ACARS, VDL Mode 2 and satellite messages crews exchange with the ground.
How it works →VHF and UHF · recorded and transcribed
Monitor a radio network and read it back later
DMR, TETRA, P25, NXDN, M17 and plain FM channels with who called whom, every over recorded as Opus and a local speech model writing down what was said.
How it works →Unclaimed bursts · captures · replay
Reverse engineer a remote, sensor or alarm
Capture the burst, see its envelope, timings and bits, replay it into new decoders as often as you like, and key it back out from a Flipper .sub file.
How it works →2.4 GHz · HackRF or LimeSDR
See drones, their operators and their handsets
Remote ID and DJI DroneID with serial, position, height and home point, plus the control link itself with the sticks drawn live.
How it works →137 MHz · 400-406 MHz · HF
Pull pictures and data out of the sky
NOAA APT and Meteor-M LRPT passes drawn as they arrive, HF weather fax charts, and radiosondes tracked from launch to burst.
How it works →
All 14 use cases, from a device survey to letting an agent drive the radio.
MCP on the loopback, and MQTT to the house
Something else can drive it
Every run serves the receiver over the Model Context Protocol at http://127.0.0.1:8931/mcp. It is the receiver on the screen, not a second one: what an agent tunes, opens or switches on appears in the window, and it can take a picture of that window to see what it did. It reads the spectrum, the packets, the calls, the transcript and the tracker, changes anything in the signal chain and draws the chain itself, and it reaches the settings: the scanner table, the memory bank, the station and the datasets. --mcp-listen off stops it listening.
A channel’s transmit source can be the agent itself. Give it a name and it answers when called: it hears the over, replies in its own voice and keeps the conversation going for half a minute without being named again.
Point --ha-broker at the MQTT broker Home Assistant already uses and every transmitter the decoders can name becomes a device there: a weather station’s temperature and humidity, a meter’s reading, a tyre sensor’s pressure, and the level each was heard at. --ha-spaces ism,wmbus keeps it to your own sensors and meters rather than a street full of passing phones.
Five radios, and any number over the network
Hardware
from about €30
Any RTL2832U dongle
Does the narrowband half of this page, driven by WaveShark’s own USB driver with no librtlsdr. On Linux the rtl-sdr package brings the udev rules; on Windows, bind WinUSB with Zadig first.
R2, Mini, HF+
Airspy
The R2 and Mini give the dongle’s range four times the span at 12 bit. The HF+ and HF+ Discovery read shortwave with no upconverter. No libairspy either.
1 MHz - 6 GHz
HackRF One
Spans wide enough for Wi-Fi, Bluetooth LE, DroneID, LTE and television, a transmitter, and a bias tee for a mast head amplifier.
USB and Mini
LimeSDR
Both of those below 3.8 GHz, plus full duplex and a span that holds two satellite transponders, on Linux, macOS and Windows.
USB or network
ADALM-PLUTO
Full duplex up to 4 MS/s, plugged in or sitting at the mast on the network.
--stream <host>
A tuner on another machine
IQStream, rtl_tcp, SpyServer and KiwiSDR servers show up as local radios, and the public ones are listed on a map. This receiver serves IQStream too, and several matching tuners stitch into one wider span.
Capture once, decode forever
A capture that decodes is a test fixture
--record writes each burst as an rtl_433 style capture, so both WaveShark and rtl_433 can read it back. Capture a band once, then replay after every change: no radio, same answer every time.
$ waveshark --tune 868.3 --record captures
$ waveshark --replay captures
--tune <mhz> start tuned and listening
--mode <mode> wfm, nfm, am, usb, lsb or cw
--span <khz> nearest span, narrowed in software
--stream <host> read a remote tuner: iqstream, rtl_tcp, spyserver, kiwisdr
--iqstream-listen serve this span to another machine, or a browser
--headless run with no window, scanning and logging
--mcp-listen <addr> where to serve MCP, or off
--kiss-listen <addr> serve a KISS TNC to packet software
--ha-broker <host> publish what is heard to Home Assistant
--survey keep a database of devices and where
--print-log print every packet as it arrivesStatus
Checked against other people’s decoders
97 recordings from rtl_433’s corpus are replayed field for field against what rtl_433 25.02 made of them, plus ADS-B against dump1090, ACARS against acarsdec, VDL Mode 2 against dumpvdl2, SSTV against colaclanth’s decoder, DAB against welle.io and a radiosonde against SDRangel. Off-air captures of M17, DMR, TETRA, Meshtastic, LTE and DVB-S2 are checked against what the transmission itself says.
About 130 ISM device descriptions where the goal is hundreds is the part that needs to grow. The code is the documentation: crates/app/src/chain.rs draws the graph the receiver runs.
GitHub Sponsors
Support the work
WaveShark is GPL-3.0 and free, with no account and nothing phoning home. Sponsorship pays for the radios, the test gear and the hours that go into the next batch of decoders.
Not in a position to sponsor? Filing a good bug with a capture attached is worth just as much, and a decoder that is wrong on real signals is the most useful thing you can send.
Plug in a radio and press play.
It opens on a dashboard, and the dial starts at 433.92 MHz where the devices it decodes are.
Download WaveShark