OnAir

Receive TV, radio, aircraft, ships, satellites, two-way radio, pagers, time signals and more: 83 kinds of signal with one software-defined radio.
Free and open source, for macOS, Windows and Linux.

Website  ·  Download  ·  Overview video  ·  Discord  ·  Signal samples  ·  Channel list

OnAir turns a low-cost SDR (a HackRF, an RTL-SDR, an Airspy and many other radios) into a receiver for most of what is on the air: digital TV (DVB-T/T2, ATSC, ISDB-T, DTMB, DVB-S/S2, DVB-C), digital and analogue radio (DAB+, DRM, HD Radio, FM with RDS), aircraft and ships (ADS-B, ACARS, VDL2, HFDL, AIS), satellites (weather images from NOAA, Meteor and GOES, Inmarsat, Iridium, Orbcomm, GNSS), two-way radio (DMR, D-STAR, NXDN, dPMR, P25, M17, TETRA), pagers, HF data modes (FT8, WSPR, RTTY, PSK, SSTV, weather fax, NAVTEX), IoT (LoRa, Meshtastic, Zigbee, Bluetooth LE, Wi-Fi), time stations, cell towers and more. Every mode is receive-only. Plug in an antenna, pick a mode, and watch what happens inside: the spectrum, the sync, the error correction and the decoded data.

It is built for people who want a receiver that is both easy to use and honest about what is happening inside it.

Contents

• Install (and the development version)
• Quick start
• What it receives
• Features
• Supported radios (and network radios)
• Updates
• Good to know
• Build from source
• Support and community
• Supporting OnAir
• License

Install

Download the file for your system from the latest release. There is nothing to compile.

Windows USB drivers: for a HackRF, RTL-SDR, Airspy or Airspy HF+, install the WinUSB driver once with Zadig. A LimeSDR Mini needs FTDI's FT60x driver (see the README inside the download). A LimeSDR-USB (Cypress FX3) needs the Cypress/LimeSuite USB driver (CyUSB3, the one LimeGUI installs), not WinUSB: do not replace it with Zadig. OnAir's own LimeSuite has no FX3 support, so for a LimeSDR-USB also install PothosSDR or LimeSuite; OnAir finds its LimeSuite.dll by itself and the log (onair.log) says which copy saw the radio ("LimeSuite ...: N radio(s)").

Development version ("nightly")

Fixes and new features land on the main branch first, before they go into a release. To try them early, build OnAir from source from the latest main.

[!WARNING] The development version is not tested like a release. It can contain bugs, unfinished features or changes that stop parts of the app (or the whole app) from working. Use the latest release for everyday use, and if something breaks in a development build, please say so on Discord or in GitHub Issues, mentioning the commit you built.

Quick start

1. Connect your radio and antenna, then start OnAir. Connected radios appear in the source menu.
2. Pick what you want to receive in the mode list on the left.
3. Enter a frequency, or open the Scan tab to find channels automatically.
4. Press Start. When the receiver locks, the channels appear on the right: click one to watch or listen.
5. If the picture breaks up, use Auto-tune for the gain and watch the quality score while you move the antenna. Height and a clear view toward the transmitter matter more than anything else.

No radio yet? Press Tour: a friendly little TV walks you through OnAir using a built-in demo signal, so you can explore everything before buying a radio.

What it receives

The DVB standard is detected automatically.

Also receives (experimental)

These receivers are built from the published specifications and checked end to end on simulated signals, but have had little or no testing on real transmissions yet. Reports and recordings on Discord help a lot, and you can upload a recording to the signal sample library.

Experimental (the receivers exist and pass the synthetic, loopback and impairment tests in tests/, but they have had little or no checking against live broadcasts): HD Radio (FM and AM, hdr_*), CDR (China Digital Radio, cdr_*), Pagers (POCSAG, FLEX), APRS / Packet (AX.25) and HF digital (RTTY, SSTV, FreeDV).

iridium-parser.py output.bits > output.parsed

Signal workbench

The Signal workbench (mode list, GENERAL & TOOLS) takes a recording apart without a radio, in the spirit of Inspectrum, SigDigger and Universal Radio Hacker. Short walkthrough:

1. Open a file with Open... (or drop it on the window). Audio files (WAV, MP3, FLAC, OGG, M4A) are decoded with the FFmpeg libraries OnAir already uses and treated as a real signal; a stereo file can be read as I/Q with "stereo is I/Q" (left = I, right = Q). IQ files are read from disk as they are, so 100 MB and larger files open at once: .cs8 .cu8 .cf32 .ci16 .cu16 need the sample rate (a name like capture_2Msps.cs8 gives it) and optionally the centre frequency; SigMF and IQ WAV files describe themselves. "Demo signal" makes a recording to try the tools on.
2. Look. An overview of the whole file, the waveform of what is in view and a large spectrogram (FFT size, window, overlap, colour map and range are set above it). Mouse wheel zooms time, Ctrl + wheel zooms frequency, right-drag pans, a click puts the cursor (time, frequency and level are read out), a drag selects a time range and a band (Shift + drag: time only; the boxes above the plots take exact values), double click clears. Only what is in view is computed, so the screen stays fast on long files.
3. Measure. On the Measure tab press Measure selection: the strongest peaks (frequency, level, width), bandwidth at -3 dB, at -20 dB and the 99 % occupied band, the carrier offset, SNR, a symbol-rate estimate from the lines of the envelope and the frequency steps, the signal identifier's modulation guess with candidates, the power over time and the bursts (start, length, level; click one to select it).
4. Demodulate. On the Demodulate tab choose the demodulator and, for digital ones, the baud rate (Auto-detect finds it from the selection), then Demodulate selection: the band you selected is moved to baseband, filtered and demodulated. The result shows the instantaneous frequency, phase and magnitude, the eye diagram, the constellation (PSK) or the histogram of the soft symbols (FSK, ASK) and the recovered bits. Carrier recovery, a Gardner timing loop, the matched-filter roll-off, differential coding, AFSK tones and FM-first are options. Listen plays the audio of the demodulator (OnAir's audio output, with the app's volume and mute).
5. Read the bits. The Bits tab applies invert, differential decode, NRZI, Manchester (IEEE 802.3 and G.E. Thomas), byte reversal and byte alignment, shows the stream as hex, binary or ASCII, searches a pattern (also inverted, with some wrong bits allowed) and copies or saves the bits as text or binary.
6. Export. The Export tab saves the selection as .wav, .cf32 or SigMF (a selected band is written at baseband and a lower rate), the demodulated audio as .wav, the bits as .txt or .bin and the peak table as CSV.

wbtool (built with the tests) does the same on the command line: wbtool gen out.cf32 --kind qpsk --rate 250000 --baud 12500 makes a test recording with known bits, wbtool analyze file --rate R, wbtool demod file --kind fsk2 --baud 9600 --band f0 f1.

Cell tower map (OpenCelliD key)

Cell towers broadcast who they are (operator, area code, cell id) but not where they stand. The Cells mode can look each decoded LTE cell up in OpenCelliD, an open, crowd-sourced tower database, and put it on the map:

1. Sign up (free) at https://opencellid.org and confirm your e-mail.
2. Log in and open your account page (My Account / API access); copy your API token.
3. In OnAir, open Cells → Map and paste it into OpenCelliD API key (the "?" next to it repeats these steps).

Lookups need internet and run in the background at most once a second; only the cell identity (MCC, MNC, TAC, cell id) and your key are sent. Answers are cached on disk, so the map also works offline afterwards. A CSV downloaded from OpenCelliD still works instead (Load tower file). Tower data © OpenCelliD, CC BY-SA 4.0.

TETRA network information

The TETRA mode lists the TETRA base stations it hears, with what each one broadcasts in the clear to every terminal: the network code (MCC, MNC), colour code, location area, the main carrier, uplink and duplex spacing, the services the cell offers, its neighbour cells, the network time, and whether the network uses air interface encryption. The same information is shown by open-source tools such as osmo-tetra. Scan steps the radio over a span (390 - 395 MHz, 410 - 430, 450 - 470 or your own) and lists every carrier found.

It is receive only and standards based. It does not decrypt anything, does not transmit, does not join or disturb any network, and does not decode or play voice, short data messages or subscriber identities: encrypted signalling is only counted and reported as encrypted, and traffic timeslots are skipped. You are responsible for following your country's rules on receiving radio signals.

LoRaWAN monitor

The LoRaWAN entry (in the Mesh family) shows what every LoRaWAN gateway in range receives in the clear: the message type (join request, (un)confirmed uplink or downlink, proprietary), the DevAddr with the network its NetID belongs to (The Things Network, Helium, Orange, ...), the FCtrl flags, the frame counter, the MAC commands of LoRaWAN 1.0 FOpts, the port, the length of the encrypted payload and the MIC; for join requests the JoinEUI, the DevEUI (with its maker when the OUI is in a short table) and the DevNonce. All spreading factors of every channel in the capture are searched at once.

It is receive only. The application payloads and join accepts are encrypted with the devices' own keys and stay encrypted: OnAir never decrypts them, never checks a MIC and never transmits. These are other people's devices; you are responsible for following your country's rules on receiving radio signals.

LoRa (raw) monitor

Shows plain LoRa frames between two radios (SX127x / SX126x style point-to-point links, sensors, Arduino and ESP32 projects): the frame as hex and text, spreading factor, bandwidth, coding rate, CRC result, SNR, level and carrier offset. Set the parameters of the link, or choose Auto for the spreading factor and bandwidth to search them all at once (more CPU). Implicit-header links carry no header, so their length, coding rate and CRC must be set by hand.

It is receive only. It does not transmit, does not decrypt, and does not interpret payloads (use the LoRaWAN or Mesh modes for those protocols). These are other people's devices and may carry private data: you are responsible for following your country's rules on receiving radio signals and on what you may do with what you receive.

Channel scanner and shared channel list

The TV channel scanner covers DVB, ATSC, ATSC 3.0, ISDB-T and DTMB. Scan results can be shared with other users through a public, crowd-sourced channel list, picked by country and city. You can also browse it on GitHub: adswill/OnAir-channels.

Notes on the newer TV standards

Features

Watch and listen

• Live player with picture, sound, subtitles, teletext, programme guide and multiple audio tracks.
• Automatic repair of short signal dropouts, so weak reception stays watchable.

See your signal

• Spectrum and waterfall, every constellation, signal-to-noise and error figures.
• A single quality score, and an echo (multipath) detector.
• DAB transmitter map: OnAir reads the transmitter identification (TII) that DAB networks send and lists the transmitters you receive with their relative strength. With a transmitter list (dab-transmitters.csv in OnAir's data folder: eid,main,sub,lat,lon,name,country,power_kw) they appear on a map with distance and bearing.

Get the best reception

• A channel scanner, automatic gain tuning, and a direction finder that helps you aim the antenna.
• Your radio, set up properly: every antenna input is its own entry in the source list, and Radio settings offers what the radio has: frequency correction (ppm), notch filters, gain modes, direct sampling for HF and more.
• Up-converters and LNBs: pick Ham It Up, SpyVerter, a QO-100 / Bullseye TCXO / Ku LNB or a custom LO (with ppm and spectrum inversion) in Radio settings; the whole app then shows and takes the frequency at the antenna (7.074 MHz, 10489.55 MHz) while the radio is tuned to the IF, with I/Q swapped when the converter mirrors the spectrum.
• DC spike handling: leave the radio's centre spike alone, remove it, or keep it off the channel by tuning just beside it. Optional IQ imbalance correction.

Share it

• A built-in network tuner streams your channels to VLC, phones, Plex or Jellyfin over your home network, as a plain stream or as HLS for browsers and phones.
• On a Mac, cast the playing service to an Apple TV or AirPlay TV.
• Record to a file, or send the stream out over UDP.

Comfortable to use

• Mouse wheel on any slider: hover a volume, gain, squelch or bandwidth slider and scroll to change it by one step (Shift = fine, Ctrl = coarse); the window does not scroll meanwhile.
• Logbook export: "Save results..." writes CSV or JSON, an ADIF logbook (call, grid, band, mode, RST / SNR, UTC) for the ham modes, and KML or GPX for anything with positions (ADS-B, AIS, APRS, FLARM, sondes); pick the format and "since start" or "all".
• Light mode (View → Light) next to the dark palettes; the layout adapts to small windows and 125 % / 150 % display scaling.
• Fast: error correction runs on the GPU where available, and with optimised vector code on the CPU everywhere else.

Supported radios

OnAir supports the HackRF One and HackRF Pro natively, and drives these radios directly too (marked "experimental" in the radio list):

• The libraries these radios need are included in the downloads, except as noted above.
• A TV channel needs a radio that samples fast enough: roughly 1 million samples per second per MHz of channel width. If a radio cannot reach the rate or frequency a mode needs, OnAir says so next to the source.
• The radios other than the HackRF have had less real-world testing. Notes for specific radios are in DEVICES.md.

Network radios

Radios on another computer or on the network are added from the source list: pick Add network radio…, choose the type, type its address and press Connect. OnAir tries the connection for a few seconds and says why when it gets no answer; the radios added are remembered and listed with the others (remove them in the same window).

• A Pluto on a real network (not its USB cable) is offered its full sample rate; how much of it arrives depends on the network.
• rtl_tcp carries 8-bit samples at up to about 2.5 Msps; when the connection drops, OnAir connects again and counts the samples that were missed.
• SoapyRemote needs a build with SoapySDR and the SoapyRemote module on both computers. OnAir asks the server which radios it has and lists each one (sound cards are hidden); if it picks the wrong one or lists none, type the radio's driver (for example mirisdr) in "Remote driver".
• SpyServer is spoken natively (protocol 2.0.1700): OnAir asks for the full IQ stream (8-bit or 16-bit), takes the sample-rate list from the server's decimation stages, and controls frequency and gain. Do not confuse its port 5555 with the SoapyRemote port 55132.
• Choosing Hermes Lite 2 searches this computer's networks for one (openHPSDR discovery) and fills in its address; Search looks again. It receives up to 38.4 MHz at 48 to 384 ksps, so only HF and narrow modes fit; the N2ADR filter board's band filters are switched with the frequency (a setting of the radio turns that off).

Updates

OnAir checks GitHub for a newer version a few seconds after it starts (then at most once a day), downloads the package for your system in the background, verifies it against the SHA-256 that GitHub lists, and installs it when you close the program.

• The version button at the top right shows the state and has the settings: turn the check off, turn automatic install off (you then get a button instead), or leave out pre-releases.
• macOS replaces OnAir.app; Windows runs the installer quietly (Windows asks for permission); Linux replaces the portable folder, and a .deb install asks for your password through the system's installer.
• Only github.com is contacted, and nothing is sent but the usual request.

Discord status

Off by default. View > Show in Discord shows on your Discord profile that you are using OnAir, the mode and (optionally, Show the frequency) the frequency. It needs the Discord desktop app running, talks only to it on your computer, and sends nothing else anywhere.

The official builds ship with the Application ID of the OnAir Discord application. To use your own (a fork): create an application named OnAir at https://discord.com/developers/applications, copy its Application ID into kDiscordAppId in app/discord_rpc.cpp (or set the environment variable ONAIR_DISCORD_APP_ID), and upload the icon (assets/onair.svg rendered to PNG) as a Rich Presence art asset named onair.

Good to know

• Encrypted (scrambled) services cannot be decoded.
• Some voice and audio codecs are not shipped with OnAir (codec2 for FreeDV; AMBE, HDC and DRA+ are patented). docs/CODECS.md says how to install the ones you can, and what to use for the others. The ? button next to the sound of each such mode says the same.
• Saving DRA sound. OnAir cannot decode DRA, but it can save it. In the CDR Radio tab, and in the Player section of the TV tab for a DTMB service whose sound is DRA (or any service with MPEG audio), press Save stream. The raw audio elementary stream goes to audio-streams/<name>_<date>_<time>.dra (.mp2 for MPEG audio) in OnAir's data folder, and the path is shown under the button. Press Stop saving (or pick another service) to close the file. Play it with an FFmpeg that has DRA support; user YZYMC reported a build of FFmpeg 7.1.2 with a DRA patch. The commands, assuming such a build:

  ffplay stream.dra                 # listen
  ffmpeg -i stream.dra stream.wav   # convert to WAV

  If FFmpeg does not recognise the file, name the format: ffplay -f dra stream.dra. A normal FFmpeg cannot read .dra; .mp2 files play in any FFmpeg (ffplay stream.mp2).
• Reception depends heavily on your antenna and location. A weak or echo-filled signal is the usual cause of a broken picture; the quality score and echo detector are there to help you improve it.
• Receiving broadcasts is legal in most places, but laws differ. Check the rules where you live.

Build from source

# macOS
brew install cmake pkg-config hackrf soapysdr libusb ffmpeg glfw
# Debian / Ubuntu
sudo apt install build-essential cmake pkg-config libhackrf-dev libsoapysdr-dev libusb-1.0-0-dev \
  libglfw3-dev libavformat-dev libavcodec-dev libavutil-dev libswscale-dev libswresample-dev

cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DDECT2_BUILD_APP=ON
cmake --build build -j "$(getconf _NPROCESSORS_ONLN)"   # one job per core (a bare -j starts hundreds and can run out of memory)
ctest --test-dir build          # run the test suite

build/dect2cli --file capture.cs8 --rate 10 --format cs8 --play <service id>

Support and community

• Discord: support, feature requests, questions, and sharing what you receive.
• GitHub Issues: bug reports. Attach an IQ recording of the problem: press Record IQ in the Source panel (or run onair-cli --record auto --secs 10); files go to the recordings folder of the app data folder, and Show recording opens it. With SigMF ticked (the default) every recording also gets a .sigmf-meta file (sample rate, data type, centre frequency, time) and the same data under a .sigmf-data name (a hard link, no second copy), so it opens directly in IQEngine and other SigMF tools.
• Signal sample library: IQ and audio recordings of real signals, shared by users and tagged by mode (for example #dvb-t2). Upload your own: every file is checked and reviewed before it appears, and recordings of modes marked experimental are the most useful.
• Pull requests are welcome.

Supporting OnAir

I'm a bit embarrassed to ask this, but here goes. OnAir is free and always will be. I build it in my spare time, along with the radios, antennas and test equipment it needs. If it's useful to you and you'd like to help, a small tip on Ko-fi really does help and keeps new modes coming. If you'd rather not, that's completely fine: bug reports, recordings and kind words help just as much. Thank you!

License

OnAir is released under the GNU General Public License v3.0 or later, see LICENSE. It includes Dear ImGui and miniaudio, each under its own permissive license, and uses FFmpeg, GLFW, libusb and libhackrf.