TL;DR
An RTL-SDR is an inexpensive USB dongle that turns your Kali box into a wideband radio receiver. Plug it in, install the toolchain (rtl-sdr, gqrx, rtl_433), and you can decode the wireless sensors around your house and track planes overhead with ADS-B in an afternoon. It is receive-only, which keeps you on the right side of the law — you can listen to a huge range of signals legally, but transmitting needs a licence and different hardware. You cannot follow this guide without a dongle; if you do not own one yet, the Nooelec NESDR SMArt v5 bundle is the one I reach for now (the once-standard RTL-SDR Blog V4 is discontinued and getting scarce).
The first time I watched my own weather station's temperature reading scroll up a terminal — pulled out of thin air with a cheap dongle I hadn't even configured properly — something clicked. There is a whole invisible layer of radio traffic humming around you right now: doorbell sensors, tyre-pressure monitors, car key fobs, remote thermometers, aircraft transponders. A software-defined radio (SDR) lets you see it.
This guide is deliberately hands-on. We will install the toolchain on Kali, confirm the dongle works, then do two real projects: decoding home-IoT sensors with rtl_433, and tracking aircraft with ADS-B. It is beginner-friendly but assumes you are comfortable in a terminal — if you are not yet, start with my Kali Linux commands for beginners guide and come back.
What is an SDR (and what can you legally do with it)?
Traditional radios do their signal processing in fixed hardware — a chip tuned to FM, a chip tuned to your car remote's frequency, and so on. A software-defined radio pushes that work into software. The hardware just grabs a slice of raw radio spectrum and hands the samples to your computer, where code decides what to do with them. One cheap device can therefore listen to FM radio, weather sensors, pagers, aircraft, marine AIS, and dozens of other signals — you just point different software at it.
The RTL-SDR story is a happy accident. These dongles were designed as cheap DVB-T TV tuners, until someone discovered the Realtek RTL2832U chip could be coaxed into streaming raw I/Q samples straight to the host. Overnight, a cheap TV stick became the world's most popular entry-level SDR. The RTL-SDR Blog V4 and the Nooelec NESDR are modern, purpose-built versions of that same idea — better oscillators, better shielding, proper antennas in the box.
Things people legally do with an RTL-SDR every day: listen to broadcast FM and airband, watch their own weather station report, track aircraft with ADS-B, receive weather-satellite images (NOAA APT), decode marine AIS ship positions, and monitor unencrypted amateur-radio and utility signals. It is a fun, low-stakes way to build radio intuition before you spend real money on gear.
Which dongle to buy first
You cannot do any of this without hardware — the dongle is the whole point. Here is what I recommend, and why. Skip this section if you already own an RTL-SDR.
| Product | Best for | Key spec | Link |
|---|---|---|---|
| RTL-SDR Blog V4 starter kit | The classic — now discontinued | RTL2832U + R828D, TCXO, antenna kit included — receive only | View on Amazon → |
| Nooelec NESDR SMArt v5 | Best in-stock beginner pick | RTL2832U, TCXO, aluminium case, antenna bundle — receive only | View on Amazon → |
| 1090 MHz ADS-B antenna | Serious plane tracking | Resonant at 1090 MHz, high-gain omni + long coax — accessory, not a receiver | View on Amazon → |
| HackRF One | Transmit and replay experiments | ~1 MHz–6 GHz, half-duplex TX + RX — licensed/own-gear use only | View on Amazon → |
RTL-SDR Blog V4 starter kit
For years this was the one I put in a beginner's hands: the R828D tuner, a proper TCXO for frequency stability, and a multi-piece antenna kit in the box. The catch in 2026 is that its R828D tuner chip is out of production, so the V4 is officially end-of-line and stock is drying up. If you can still find the kit it's excellent and works out of the box on Kali — but if it's sold out, buy the Nooelec below instead.
Why it earned its reputation
- Stable TCXO oscillator — your frequencies don't drift as it warms up
- Antenna kit included, so you can start on day one
- Best-documented dongle; almost every tutorial online assumes it
Nooelec NESDR SMArt v5
With the V4 winding down, this is the dongle I now recommend first. Nooelec's NESDR line is the other reputable brand, still in full production, and the SMArt v5 bundle ships with an aluminium enclosure, a TCXO, and a set of antennas — everything you need to follow this guide on day one. Same RTL2832U foundation as the V4, and functionally a wash for every project here.
Why it's my pick now
- Solid aluminium case helps a little with heat and shielding
- Bundle includes antenna base and telescopic whips
- Interchangeable with the V4 for every project below
Affiliate links — I may earn a commission at no extra cost to you. Full disclosure.
Installing the SDR toolchain on Kali
Kali's repositories carry everything we need. Update first, then install the core driver package, the GUI spectrum viewer (gqrx), and the sensor decoder (rtl_433).
The rtl-sdr package gives you the low-level driver plus command-line tools like rtl_test, rtl_fm, and rtl_sdr. gqrx-sdr is a graphical "waterfall" receiver — the fastest way to see that radio exists. rtl-433 is the star of our first project.
Blacklist the DVB-T TV driver
Because these dongles were born as TV tuners, Linux still ships a kernel driver (dvb_usb_rtl28xxu) that grabs the device on plug-in and stops the SDR tools from using it. You almost always need to blacklist it once.
Unplug and replug the dongle after this (or reboot). Now confirm the OS sees it:
The one test that proves it works: rtl_test
Before touching any project, run rtl_test. It confirms the driver, tuner, and USB path are all healthy — and it prints how much your sample clock drifts (ppm), which matters later.
rtl_test can't find the dongle inside Kali but lsusb on the host can, passthrough is your problem, not the driver.A 60-second sanity check in gqrx
Launch gqrx, pick your RTL device on the first-run dialog, hit play, and tune to a strong local FM broadcast station (e.g. 100.3 MHz) with WFM mode selected. If you hear music and see a bright signal on the waterfall, your whole chain works. That is the hard part done. Everything after this is just pointing better software at the same hardware.
Project 1 — Decode home IoT sensors with rtl_433
This is the project that hooks people. A huge amount of cheap consumer hardware — weather stations, wireless thermometers, soil sensors, doorbells, some tyre-pressure monitors — chatters away unencrypted in the 433.92 MHz ISM band (and 868/915 MHz depending on region). rtl_433 knows the protocols for over 200 such devices and decodes them into plain text.
Screw on the antenna, then just run it:
Now wait. Within a few minutes — faster if you have a weather station or wireless thermometer nearby — decoded packets start scrolling:
That is real data from real devices near you, pulled out of the air with no pairing and no password. It drives home how much consumer IoT still gets broadcast in the clear.
Logging to JSON for later analysis
Watching packets scroll is fun; logging them is useful. rtl_433 can emit structured JSON, which you can pipe into a file and analyse (or feed into home automation). Let it run for a while and you can chart your own sensors over time.
rtl_433 -f 915M (North America) or -f 868M (Europe), raise the antenna and get it near a window, and make sure you have a 433 MHz device in the house in the first place. If all your sensors are Zigbee or Wi-Fi, there is nothing to hear on 433.Project 2 — Track planes with ADS-B (dump1090)
The second classic project feels like magic: watch live aircraft appear on a map, decoded from the transponder signals they broadcast at 1090 MHz. This is ADS-B (Automatic Dependent Surveillance–Broadcast), and every airliner overhead is shouting its position, altitude, and callsign in the clear. The tool that decodes it is dump1090.
Run it in interactive mode to get a live table of aircraft right in your terminal:
Each row is a real aircraft in range. For the full experience, run dump1090 with its built-in web map so you can watch planes move in a browser:
Then open http://localhost:8080/ in your browser and watch the aircraft plot themselves in real time. On the packaged build the map is served automatically; if your distro splits it out, the --net flag exposes the data feed the web front-end reads.
Why your antenna decides your range
ADS-B lives at 1090 MHz, which is much higher than the 433 MHz sensor band — and the little whip antenna in your starter kit is not tuned for it. This is the single biggest factor in how many planes you see. A cheap 1090 MHz-tuned ADS-B antenna can take you from "a couple of nearby planes" to "everything within 150+ miles", and it is the one accessory worth buying once ADS-B grabs you.
1090 MHz ADS-B antenna
A dedicated antenna cut for the 1090 MHz aircraft band — the high-gain fiberglass omni type comes with a long coax run so you can mount it high, by a window or up on a balcony rail, well away from your desk. The range improvement over the bundled whip is not subtle. It is the difference between a toy and a receiver you'd happily feed to a flight-tracking network. If Project 2 is the reason you're here, buy this alongside the dongle.
Why it's worth it
- Resonant at 1090 MHz — the whip in your kit is not
- Mag-mount + coax means you can get it high and by a window
- Cheap, and the biggest single range gain you can buy
Affiliate links — I may earn a commission at no extra cost to you. Full disclosure.
The legal and ethical line (read this)
The single most important thing to understand about SDR is the difference between receiving and transmitting.
Receiving with an RTL-SDR is, in most countries, broadly legal for the kinds of signals in this guide — broadcast radio, ADS-B, unencrypted ISM-band sensors, amateur radio. The dongle physically cannot transmit, so you are not putting anything on the air. That said, "I received it" is not a blanket licence: many places draw a line around acting on the contents of certain private communications, and decoding, decrypting, or redistributing traffic that isn't meant for the public can cross legal lines. Passive, personal learning on public/your-own signals is the safe zone.
The ethical version is simpler: listen to your own things and public broadcasts, don't weaponise what you hear about other people. Decoding your own weather station is a hobby. Logging a neighbour's sensors to infer when they're home is not. Watching airliners on ADS-B is public data by design. Treat the receive-only nature of the dongle as a feature that keeps you honest, not a loophole.
The upgrade path: HackRF for transmit and replay
Sooner or later you'll hit the wall of receive-only. You'll want to replay a captured signal to your own garage remote, experiment with your own devices, or explore GNU Radio flowgraphs that transmit. That is where you graduate from a receive-only dongle to a proper transceiver — and for most people that means the HackRF One.
HackRF One
The HackRF One is the go-to half-duplex transceiver: it covers roughly 1 MHz to 6 GHz and, unlike an RTL-SDR, it can transmit as well as receive. That opens up replay experiments, signal generation, and the full sweep of GNU Radio and Portapack projects. It is a serious jump in price from an RTL-SDR, and it comes with serious responsibility — everything in the legal section applies double. Buy it when you have a specific, legal reason to transmit (your own hardware, a licensed band), not just because it's the shiny option.
What it unlocks
- Transmit + receive, ~1 MHz–6 GHz, so almost any project is on the table
- Huge community, tooling, and add-ons (Portapack, GNU Radio)
- The standard platform for learning TX responsibly on your own gear
Affiliate links — I may earn a commission at no extra cost to you. Full disclosure.
My honest advice: spend real time with the RTL-SDR first. Almost everyone who buys a HackRF too early ends up learning the fundamentals on the cheap dongle anyway. Master receiving — antennas, gain, frequencies, decoding — and you'll get far more out of a transceiver when you do buy one.
Where to go next
Once the two projects above feel routine, the rabbit hole is deep: NOAA weather-satellite images with rtl_fm and a decoder, marine AIS ship tracking, POCSAG pager decoding, trunked-radio monitoring, and building GNU Radio flowgraphs from scratch. SDR also pairs naturally with the rest of a security toolkit — capturing traffic in Wireshark, and understanding wireless attacks like the ones in my WPA2 cracking walkthrough. If you're still assembling your Kali setup, my top 10 Kali Linux tools roundup is a good companion to this dongle.
The dongle is cheap, the software is free, and the spectrum around you is already full of things to decode. Plug in, run rtl_433, and go find your first signal.
New to SDR? Buy the Nooelec NESDR SMArt v5 bundle — it is in stock, the antennas are in the box, and it works out of the box on Kali. Grab the RTL-SDR Blog V4 instead only if you can still find one (it is discontinued), add a 1090 MHz antenna if plane-tracking hooks you, and leave the HackRF until you have a real, legal reason to transmit.
- Nooelec NESDR SMArt v5 — Best in-stock beginner pick, antennas included View on Amazon →
- RTL-SDR Blog V4 starter kit — The classic — grab if you can still find it View on Amazon →
- 1090 MHz ADS-B antenna — Big range boost for plane tracking View on Amazon →
- HackRF One — Only when you need transmit View on Amazon →
Affiliate links — I may earn a commission at no extra cost to you. Full disclosure.
Frequently Asked Questions
Is it legal to use an RTL-SDR?
Owning and using an RTL-SDR to receive is broadly legal in most countries — the device is receive-only and cannot transmit. What varies by jurisdiction is what you're allowed to do with certain private communications you happen to receive (decoding, acting on, or redistributing them). Receiving public broadcasts, ADS-B, and your own unencrypted sensors is the safe zone. Transmitting is a separate matter and requires a licence.
Do I need a special antenna, or is the included one fine?
The antenna kit that ships with the RTL-SDR Blog V4 or Nooelec NESDR is fine for getting started with FM, 433 MHz sensors, and basic ADS-B. For serious plane tracking, though, a dedicated 1090 MHz-tuned antenna makes a night-and-day difference to range. The antenna matters as much as the dongle — it is not an afterthought.
rtl_test says "usb_claim_interface error" — what's wrong?
Almost always the DVB-T TV tuner kernel driver has grabbed the device. Blacklist it (echo 'blacklist dvb_usb_rtl28xxu' | sudo tee /etc/modprobe.d/blacklist-rtl.conf), then run sudo rmmod dvb_usb_rtl28xxu and replug the dongle. If you're in a VM, make sure the USB device is passed through to Kali.
Can an RTL-SDR transmit or jam signals?
No. RTL-SDR dongles are receive-only — there is no transmitter in the hardware. That is exactly why they're a safe way to learn. If you want to transmit (for legal, licensed experiments on your own equipment), you need a transceiver like the HackRF One and the appropriate licence for the band.
Why am I not decoding any 433 MHz sensors?
Three usual causes: you have no 433 MHz devices in range (many modern sensors use Zigbee or Wi-Fi instead), your region uses 868/915 MHz (try rtl_433 -f 868M or -f 915M), or antenna placement is poor. Move the antenna near a window, raise it up, and give it ten minutes near a known weather station or thermometer.
Does the RTL-SDR work with Kali in a virtual machine?
Yes, as long as you pass the USB device through to the guest. In VirtualBox, install the Extension Pack, enable USB 3.0, and add a USB filter for the Realtek device. If lsusb on the host sees the dongle but rtl_test inside Kali doesn't, passthrough is the problem, not the driver.
