One of the fun things you can do with RTL-SDR (well, SDR really) is that you can decode pager traffic, with the POCSAG protocol in particular. You'll be surprised to find that many hospitals still transmit unencrypted pager data over POCSAG.
Step 1. Identify a POCSAG signal
Use SDR software of your choice to locate POCSAG traffic. Frequencies to look for depend on your located jurisdiction. Familiarise yourself with the audio samples from the Signal Identification Wiki. POCSAG has a very distinctive start tone.
In the exmaple below, we saw a very strong POCSAG signal on 148.138Mhz.
Step 2. Install rtl_fm and multimon-ng
- rtl_fm, used to decode the FM signal, which we'll then pipe to multimon-ng.
- multimon-ng, a demodulation software that supports decoding a range of digital transmission modes, including Morse Code CW!
Step 3. Profit
Use the command:
$ rtl_fm -M fm -f 148.5565M -s 22050 -g 100 -l 310 \
| multimon-ng -t raw -a POCSAG512 -a POCSAG1200 -a POCSAG2400 -a scope /dev/stdin
rtl_fm arguments explained:
-M FM- demodulation in FM-f <freequency>- demodulation frequency-s 22050- re-sample output to 22050Hz, which is the only sampling rate supported by multimon-ng.-g <gain>- tuner gain (test and adjust)-l <squelch>- squelch level (test and adjust)
multimon-ng arguments explained:
-t raw- specify input type of raw-a <demod>- add(enable) POCSAG demodulators. POCSAG has three transmission rates: 512, 1200 or 2400Hz.-a scope- show samples in a oscilloscope. This makes it easier for debugging and monitoring./dev/stdin- tell multimon-ng to read from stdin, which we piped from rtl_fm.
Results
Run the above for a while then you might see some decoded POCSAG messages showing up in your terminal output[1], like below[2]
POCSAG1200: Address: XXXXXX Function: 2 Alpha: XXXXXXXX: Hi ------, can you give me a call, not urgent, ---- xxxxx/xxx thanks<NUL>