Another solution in search of problems, right?
I work every day with spectrum analyzers and receivers – so it’s natural that they would have a place on my workbench. When aligning radios and checking performance, they are invaluable.
One issue is that even older SAs hold some value, and, let’s face it… I’m cheap.
A number of years ago, I fell into the RTL-SDR world for 60 – 1700 MHz spectrum work. They’re great, BUT… they have a 1 – 2 MHz maximum bandwidth, so in order to use them for searching for signals over a wide band (say 430 – 480 MHz) to see where (or IF) a transmitter is working, the user has a lot of clicking to do in order to advance the frequency. If it’s a periodic emitter, it can be even longer while one waits for the emitter to operate.
Spektrum (link) https://www.rtl-sdr.com/tag/spektrum/ was a good advancement, since it captures data for a range, steps the receiver, and captures again – allowing the RTL-SDR to act like a wideband analyzer. There are 2 downsides…. 1) it requires a specific Java installation, and 2) the RTL-SDR has a habit of being a little off frequency. The frequency correction CAN be accounted for, and is probably minor enough to ignore for most purposes. As a matter of fact, it has greatly advanced in many ways, and could still be viable as a tool for the workbench. I REALLY need to come up with a way to relatively calibrate one to make them useful for quantitative measurements.
Recently, I stumbled on a site that discussed the fact that many cable modems have a spectrum analyzer built in . (https://volpefirm.com/cable-haunt-exploiting-docsis-modems/ has some info) – and this makes sense, since cable systems, both for TV and for internet, utilize a large swath of RF (54 – 800 MHz) within the enclosed cable system (https://volpefirm.com/docsis101_rf-fundamentals/). Alright, I’ll bite… so I dusted off the two cable modems I had that were ready for the trash, and tried to access 192.168.100.1:8080…. One had no response, and the other went to a page that said “Spectrum Analyzer” at the top of the tab, then timed out. More digging revealed that the fix for the Cable Haunt vulnerability, among other things, removed access to this window. Struck out… for now. I put a call out for what people had sitting on the shelf – and I got a DOCSIS 2.0 modem… still no dice. It has the functionality under the hood, I think (individual channel analysis), but no SA GUI.
Finally, I dd manage to acquire an Arris SB6183. Score. As a “user-procured” device, the cable companies couldn’t (or didn’t) push a fix into it. I connected the Ethernet cable to my Toughbook, logged in to the web interface (192.168.100.1:8080), and was instantly granted access to the spectrum analyzer function. I keyed up a nearby handheld transmitter in the VHF band (154 MHz), and saw the spectrum respond accordingly! Obviously, with no antenna connected, I expected very little in terms of performance.
Once I got home, I added couple RF adaptors, then had an SMA magnet mount scanner antenna connected to the F type connector.
For grins, I centered the span at 100 MHz, and set it for a 20 MHz span to see what the FM spectrum looked like – and it worked like a champ.
And, just for grins, I took a peek at the cellular portion of the spectrum (below 1 GHz)
Now – lets not pretend there are no Limitations. There is never a completely free lunch. The analyzer is capable, but has some limitations. Here’s the basic feature rundown that mine has-
- Amplitude reporting units: dBm
- Noise floor: Approximately -100 dBm
- Maximum Span: 1 – 1000 MHz
- Minimum Span: 6 MHz
- Clear Write / Max Hold modes, with video averaging available
- Max input level unknown, I would guess 0 dBm would be a safe maximum.
- Input impedance: 75 ohms
- Automatic marker will follow a mouse pointer over the trace
- mouse click-to-drag to change center frequency on the fly
Regarding the amplitude capability: The noise floor appears to be around -100 dBm (+7 dBuV) in the 75 ohm system. This is not too bad, actually – many commercial spectrum analyzers have higher noise floors than this (though they usually have narrower RBWs, better selectivity, and are more accurate). Definitely good enough to locate a transmitter.
I would tend to think the accuracy of the cable modem would be a bit better than an RTL-SDR, since the Broadcom chipset is responsible for making sure that latency, errors, etc., are minimized when this device is acting as a transceiver for getting the user’s high bandwidth internet connection synchronized with the server on the other end. As I said before, the RTL-SDR often suffers from some offset, which varies from unit to unit. The cursors are somewhat limited, and it would seem that the channelized nature of the spectrum analyzer on the Broadcom chips has some degree of error – though it is quite repeatable, where I have seen some RTL-SDRs drift.
As I mentioned above, this is set up for 75 ohm CATV systems, NOT the 50 ohm typical impedance used in test equipment or radio gear… Generally, this mismatch loss is not too bad, so we have to assume there’s ~1.2 dB of mismatch loss. It is possible to match it using coax sections, but the combined loss of connectors and the cable will likely exceed the mismatch loss anyway.
OK… so where do we stand?
The RTL-SDR has
- a narrower minimum span
- an adjustable RBW
- comparable sensitivity
- demodulator capability
- multiple software packages to emulate the wide-band spectrum analyzer functionality
- the same 75 ohm input impedance (generally, some specialized variants at least provide a 50 ohm SMA connector)
The cable modem has one major distinct advantage, if spectrum analysis is the only purpose it is serving:
- Software and Hardware independent. Any PC with an ethernet connector and browser will work, whether Mac, Windows, Linux, ChromeOS, Raspberry Pi…
Will the DOCSIS3 modem replace a benchtop spectrum analyzer (whether Agilent, R&S, or Rigol)? NO. It was never intended for that purpose, and, well, neither will an RTL-SDR. They’re not even in the same league, let alone the same ball game.
What purpose does it serve? Well, simply put, it’s a PC driven spectrum analyzer that I don’t need drivers or special software to run.
Where to go from here?
Well, I had a couple thoughts for implementation-
- Can the Ethernet portion be configured to look like a device on a network? i.e., can the unit be used as a remote spectrum monitor?
- Can the uplink portion of the modem be disabled, so it cannot generate RF that might unintentionally emanate while connected to an antenna? I’ll need to do some digging to see if this is really an issue or not – likely using an RTL or other device to monitor what is coming off of an antenna.
- Out of curiosity, what limitations does the actual Broadcom chip have? Can it (theoretically) work with narrower bandwidths? Are there other ports into these devices to access smore in-depth functions? Realistically, I doubt I have the patience to go digging this far into the device, but it’s still food for thought.
