A satellite like UNNE-1B is, at heart, a small radio station circling the Earth. To listen to it you only need an antenna, an inexpensive SDR receiver and free software.
The key idea
Radio wavesUNNE-1B transmits on 436.888 MHz (UHF, 70 cm band) and listens on 145.925 MHz (VHF). The waves travel at the speed of light: they arrive in thousandths of a second.
PassesIt flies about 520 km up and completes an orbit every ~95 minutes. You only hear it while it is above your horizon: 10–15 minutes per pass, several times a day.
Doppler effectBecause it moves at 27,000 km/h, the frequency you receive shifts by up to ±10 kHz: higher as it approaches, lower as it moves away.
See it in action in the pass simulator of the Radio module.
What you need
Item
Recommended option
What it is for
SDR receiver
A USB RTL-SDR-type dongle (≈ 30–40 €)
Turns the radio signal into data the computer can process
70 cm antenna
Home-made V-dipole (two rods of ~17 cm) or a portable Yagi
Captures the signal. It is the part that improves reception the most
Pass prediction
Gpredict (free) or Heavens-Above
Know when the satellite passes and correct the Doppler shift
SDR software
SDR++ (free, Windows/Linux/macOS) or GQRX (free, Linux/macOS)
Tune, watch the waterfall and record the signal
No equipment?
The SatNOGS network publishes recordings from stations all over the world. You can download the audio of a UNNE-1B pass and work with it without an antenna.
Step by step with SDR++
Install the receiver. On Windows, plug in the SDR and use Zadig to install the WinUSB driver. On Linux and macOS it usually works out of the box.
Open SDR++ and choose the RTL-SDR source. Press ▶ to start receiving.
Tune to 436.888 MHz in NFM (narrow FM) mode, with a bandwidth of about 12 kHz.
Find the next pass in Gpredict. The higher the maximum elevation, the better the signal.
During the pass, watch the waterfall: you will see the signal drift because of Doppler. Keep correcting the frequency or let Gpredict do it.
Record. Save the audio as WAV (and, if you can, the IQ signal). You will need it in the next pill to extract the bits.
Challenge of the week
Set up your station and practise before UNNE-1B starts transmitting: find a pass of the ISS (145.800 MHz) or of an AMSAT-EA satellite and record the signal. Once UNNE-1B is catalogued, it will appear in Gpredict and SatNOGS.
Week 2 · 9 Oct 2026
FSK: the signal is binary
What you recorded last week sounds like a beep jumping between two notes. Each jump is a bit. Understanding that is understanding how UNNE-1B talks.
Two tones, ones and zeros
UNNE-1B uses FSK (Frequency Shift Keying): it sends a 1 on one frequency and a 0 on another, 1125 Hz apart. The lower one (mark) is 1; the higher one (space) is 0. It sends 200 bits per second: each bit lasts 5 milliseconds.
FSK labTap the bits to flip them and listen to how they sound.
Binary—
Hexadecimal—
Decimal—
ASCII character—
From bits to bytes
Bits are grouped in eights to form bytes, and sent most significant bit first (MSB). To write them compactly we use hexadecimal: each group of 4 bits is one digit from 0 to F.
1011111100110101
BF35
This is the UNNE-1B sync word, 0xBF35: the receiver looks for it in the bit stream to know where each packet begins.
From audio to bits, in practice
You don't have to do it by hand. AMSAT-EA publishes in its projects section the ground station software for its satellites: a ready-configured demodulator (UZ7HO Soundmodem), SatNOGS-compatible decoders and the detailed description of each transmission, with the CRC and scrambler code. The UNNE-1B ones are published there.
For the curious
With GNU Radio (free) you can build your own FSK demodulator: filter, FM demodulator, clock recovery and bit slicer. It is the best way to understand what happens inside.
Challenge of the week · find the packet
This is a fragment of received bits. Look for the sync word 0xBF35. Which byte comes right after it, in hexadecimal? Hint: it contains the packet type and the satellite address.
You already know how to turn tones into bits. But those bits travel «scrambled» and may arrive with errors. This week you learn to unscramble them and to check that the packet arrived intact.
Two problems of sending bits by radio
Long runsIf the satellite sends many zeros in a row, the signal stays on a single tone and the receiver loses track of where each bit begins. It needs frequent changes to keep the rhythm.
NoiseA click, interference or a weak signal at the end of the pass can turn a 0 into a 1. We need a way to know whether the packet arrived correctly.
The solutionThe scrambler shuffles the bits so there are no long runs; the CRC adds a 16-bit «fingerprint» that reveals any error.
The scrambler: shuffling to transmit better
UNNE-1B uses a multiplicative scrambler defined by the polynomial G(x) = x¹⁷ + x¹² + 1. The idea is simple: each outgoing bit is combined (with an XOR) with the bits sent 12 and 17 positions earlier. The result looks random, even if the input is all zeros.
Best of all, it is undone with the same rule: the receiver keeps the last 17 bits received and applies the XOR again. No key is needed. That is why it is not encryption: anyone who knows the polynomial can undo it.
Scrambler labChoose an input and watch it come out scrambled and get recovered.
Input
Scrambled (transmitted)
Recovered on the ground
A demonstration of the principle with G(x) = x¹⁷ + x¹² + 1. The initial register state and which UNNE-1B fields are scrambled (everything except training, sync, type, address and CRC) are in the AMSAT-EA transmissions overview, together with their code.
The CRC: the packet's fingerprint
The CRC (Cyclic Redundancy Check) is a 16-bit number the satellite computes from the whole packet and appends at the end. On the ground, the receiver computes it again from the received bits: if it matches, the packet is good; if not, it is discarded. It works like the check letter of an ID number, but much stronger: it detects every one- or two-bit error and any burst of up to 16 consecutive bits.
UNNE-1B uses the CRC-CCITT-FALSE variant: polynomial 0x1021, initial value 0xFFFF and no final XOR. It is computed from the type field to the last data byte.
CRC-CCITT-FALSE calculatorType text or hexadecimal bytes.
CRC—
Check the calculator against the reference examples: «EASAT-2» gives 0x7D58 (example from the AMSAT-EA document) and «123456789» gives 0x29B1 (the standard check value of this variant).
Real data is already here
Look at the data registry: decoded receptions start with 1C, 2C, 3C… The first digit is the packet type and the C is the UNNE-1B address: the same thing you found in last week's challenge. The decoding software normally undoes the scrambler and checks the CRC before showing those bytes.
Challenge of the week · the message fingerprint
The Space Cowboy II signed its messages with its name. What is the CRC-CCITT-FALSE of the text SPACE COWBOY (upper case, with the space)? Write it in hexadecimal.
Week 4 · 23 OctFrom packet to message
First steps to decrypt the Space Cowboy II string of numbers.
