DIY-Spy: a homebrew 2.4GHz wi-fi spectrum analyzer

I was reading the Thinkgeek catalog a while back and an interesting gadget caught my eye: “Wi-Spy”, a 2.4GHz spectrum analyzer on a USB stick. Coming from the world where “spectrum analyzer” refers to a big benchtop box with a name like Le Croyright, we can’t afford those Agilent on it, my first thought was, “A good spectrum analyzer in the GHz range is like a gazillion bucks; what’s really inside this thing?”

Not much, it turns out. After seeing the guts I would not use this device for anything remotely demanding accuracy, but on the bright side, it would be pretty straightforward to make your own that works just as well! Possibly with parts that are already on your board (*cough*XBee).

According to this review and a couple other tech sites, the innards of the original are nothing more than a Cypress WirelessUSB SoC (CYWUSB6934) and USB interface. According to this updated review, the latest version switches to TI/Chipcon’s CC2500 radio ($2.15 USD in quantity) and retails for $399.

The “WirelessUSB” and CC2500 radios are inexpensive 2.4GHz radio chips used in devices such as cordless mice, game controllers and remote controls. What it has in common with many other digital radios is an RSSI (Received Signal Strength Indication) register, which can be read out to provide a measure of how much signal (i.e. interference) is present on any given channel. Wireless gadgets normally use such a mechanism to find the cleanest channel to broadcast on. Most any radio chip with an RSSI readout should work here: XBee, TI/Chipcon’s CC25xx parts, Nordic, etc. I have a big nut going right now for Nordic’s nRF24L01, but unfortunately this does not have an RSSI measurement to speak of (there is a 1-bit “collision detect” flag that warns if the RF energy on the current channel is above a set threshold).

So essentially, the firmware running on the dongle consists of:

for (channel=0; channel<255; channel++)
{
WriteReg(RF_CHANNEL, channel);
signal=ReadReg(RSSI);
send_usb(signal);
}

Hell, why didn’t I think of selling $2 of chip and 4 lines of code for $400? ;-) (I’ve even used those old Cypress radios before on a work project – Unigen’s ready-made JUNO module shown here is about 7 bucks.)

The DIY-Spy

As proof of concept (and a cool toy for anyone who has one of these lying around), I have implemented a working Wi-Fi spectrum analyzer on TI’s ez430-RF2500 development kit ($50), a 2-part USB dongle which consists essentially of a CC2500 radio strapped to an MSP430 low-power microcontroller (detachable bottom half) and a USB interface which enumerates as a virtual serial port (top half). The top half doubles as a standalone MSP430 programmer, so this kit is a great cheap way to get started playing with them.

Being the lazy efficient person that I am, I grabbed mspgcc and an existing ez430 RF demo program (JM Kikori’s RF2500 test application – raw transceiver) and just tossed the infinite RSSI loop into the middle of it.

Here is the main addition (simple & sweet). Forgive WordPress’ complete mangling of the formatting.


static void dump_rssi()
{
int i;
char rssi;
for(i=0; i<256; i++)
{
hal_spi_radio_writeReg( MRFI_CC2500_SPI_REG_CHANNR, i); // Channel number. Default spacing is ~200KHz/channel
hal_spi_radio_cmdStrobe( 0x34 ); // enter Rx mode (not needed except to start autocal)
rssi = (hal_spi_radio_readReg(MRFI_CC2500_SPI_REG_RSSI));
uart0_polled_putc((rssi&0xFE) | (i==0)); // Cheap speed hack: write upper 7 bits of RSSI value (throw away LSB). Use LSB to signal start of 256-channel RSSI byte list
hal_spi_radio_cmdStrobe( 0x36 ); // enter IDLE mode (not needed except for autocal)
}
}

The only real divergence of this from the pseudocode loop above is that the CC2500 requires periodic (or frequent, depending who you ask) recalibration, which can be set to be performed automatically on certain conditions (such as entering Rx mode). This setting is enabled, and the code above toggles between Rx and Idle modes between each channel change to trigger auto-calibration. To make things faster (for me as well as the gadget ;-), rather than perform any kind of real serial handshaking to keep the dongle and the graphing script in sync, I just truncate the least significant bit of the RSSI reading (1/2dBm) and use it to flag the start of the 256-channel sweep.

A more efficient approach would be to perform such calibration once per channel and cache the results (writing them back along with each channel change), which would in theory allow for much faster channel changes. But it’s really a moot point since here the 9600-baud connection to the virtual COM port (MSP430 <–> USB controller) is the limiter of maximum speed.

Most of the time in this project went into tweaking around with the CC2500′s fifty billion or so configuration register bits, not all of which are really documented. In the end I just installed their win32 configuration wizard for the undocumented voodoo (e.g. correct IF setting) and annoying math, and hand-tweaked the remaining settings. For this I set the base frequency to 2400MHz, and the channel spacing to ~ 405KHz, providing the frequency range 2400MHz to 2505MHz across the 256 channel settings. This corresponds to the 2.4GHz ISM band and a little extra. All automatic gain control features are disabled.

Testing
I’ve actually been sitting on this project now for a couple months, since I wasn’t getting the results I expected initially (sitting close to my WiFi access point) and had no good way to test it. Luckily, as it turns out I was tasked with developing some RF gadgets (nRF24L01-based) at work, which could easily be set up to output a raw carrier wave at a programmable frequency. Sure enough, testing revealed some bugs in my initial CC2500 register settings, now corrected.

The video above shows the resulting spectrum output as the nRF’s naked carrier is swept through a handful of frequencies. As it progresses, it should also become evident where my WiFi access point is broadcasting. The green lines show instantaneous signal, the red shows the peak value at each frequency, and the blue shows a running average. The display script is written in Processing.

Downloads

Fairly undocumented; use at your own risk.
diyspy.zip – Source code and .elf binary for ez430 kit (use mspgcc to build from source), .inf file for virtual COM port (win32 only), and Processing script for display.

20 Responses to “DIY-Spy: a homebrew 2.4GHz wi-fi spectrum analyzer”

  1. [...] made a “DIY-Spy: a homebrew 2.4GHz wi-fi spectrum analyzer” – he writes… I was reading the Thinkgeek catalog a while back and an interesting gadget [...]

  2. [...] at all. Just a simple wireless receiver. He decided that rather than spending the $399 for one, he would toss one together using an Xbee. His total cost ended up at roughly $50 for basically the same unit. While he [...]

  3. ki says:

    Any chance of a schematic? I would be interested in trying this for myself…
    cheers,
    K.

  4. Bob says:

    I wonder if one can emulate wi-spy with real wifi hardware, such as D-Link dwa-160, since it has open firmware (and does 5 ghz, but I don’t know if the USB interface can be suitably coerced to pretend to be serial). OTOH, if you can get packets there’s always Radiotap.

  5. [...] at all. Just a simple wireless receiver. He decided that rather than spending the $399 for one, he would toss one together using an Xbee. His total cost ended up at roughly $50 for basically the same unit. While he [...]

  6. Cail says:

    Bob: whether it can be done with other hardware really comes down to whether the hardware supports digital RSSI reporting. Some wifi cards do, some don’t. Two old-school cards that include spectrum analyzers which operate in this exact same way are the Proxim and Symbol FHSS cards (802.11-FHSS, pre-802.11b). The Proxim one offers the SA software as part of the Windows driver package; the Symbol one requires a custom firmware flashed on the card and then use of a DOS app.

    Proxim example:
    http://cognetixgroup.com/products/proxim.htm

  7. [...] DIY-Spy: a homebrew 2.4GHz wi-fi spectrum analyzer                Related Posts: [...]

  8. Clark says:

    @ki, check out the documentation for the ez430-RF2500 from the TI website. There is a schematic and board layout shown in the docs.

    This is a nice little use for the ez430-RF2500, the only downside that i see is that the antenna design on these boards were poorly designed. With a better antenna design, this analyzer could do very well. Keep it up!

  9. dragorn says:

    If you did a little more research, you’d see that only the original wi-spy unit (sold for $99) uses the Cypress chip.

    The more expensive model (2.4x) uses a custom chip with significantly higher resolution and controllable resolution (ie, hardware zooming). The 2.4i uses the same custom board with an internal antenna.

    Not a bad hack at recreating the original unit, but you’re a bit disingenuous when you say the $400 model is based on the same chip.

    FYI I’m not affiliated with the makers of the wi-spy at all, however I do write the open source drivers and tools for the wi-spy devices.

    -dragorn

  10. [...] at all. Just a simple wireless receiver. He decided that rather than spending the $399 for one, he would toss one together using an Xbee. His total cost ended up at roughly $50 for basically the same unit. While he [...]

  11. [...] Outguessing the machine » DIY-Spy: a homebrew 2.4GHz wi-fi … [...]

  12. [...] at all. Just a simple wireless receiver. He decided that rather than spending the $399 for one, he would toss one together using an Xbee. His total cost ended up at roughly $50 for basically the same unit. While he [...]

  13. [...] is the original:  Outguessing the machine » DIY-Spy: a homebrew 2.4GHz wi-fi … var AdBrite_Title_Color = '0000FF'; var AdBrite_Text_Color = '000000'; var [...]

  14. Tim says:

    @dragorn: Just going by the results of smallnetbuilder.com’s teardown. According to them, the RF frontend of the 2.4x is a CC2500. The chip labeling isn’t visible in the photo of the board they posted, but the pinout (e.g. location of RF output and bias-resistor pins) is consistent with a CC2500. This chip would support hardware zooming like you describe by adjusting the channel bandwidth, base frequency and channel spacing regs so that the 256 channel bins cover an arbitrary frequency range.

  15. dragorn says:

    @tim – Fair enough, anyhow, the wispy1 is definitely a cypress. Subsequent models are definitely not. I suspect smallnetbuilder was only looking at the original model from several years ago.

  16. bmitol says:

    Very interesting! Are there any radios that frequencies can be incremented in finer steps? Im wondering if anyone has interfaced this with labview or matlab to implement more analyzing functions to the data. Im waiting for my zigbee development kit and the TI kit. Also has anyone broke open the airview to add an external antenna jack. I hate to pay an extra $20 for a connector.

  17. jer says:

    Actually, the Wi-Spy 2.4x uses a Chipcon CC2500, the first W-Spy is as Dragorn says, and I’m not sure what the DBx uses. Though talking with Dragorn on other mediums, he suggests that it’s a custom chip and I tend to believe that.

  18. [...] Outguessing the machine » DIY-Spy: a homebrew 2.4GHz wi-fi spectrum analyzer (tags: analyser msp430 embedded xbee ez430 wispy network geek arduino hack radio analyzer hacks article spectrum avr hacking security dev diy hardware electronics howto wireless wifi) [...]

  19. [...] Here is the original:  Outguessing the machine » DIY-Spy: a homebrew 2.4GHz wi-fi … [...]

  20. nicholas says:

    Hello,

    I am interesting to buy a complete set of what it is needed for that DIY – SPY project; is that posible?

Leave a Reply

This blog is protected by Dave\'s Spam Karma 2: 511597 Spams eaten and counting...