Daniel Estévez

ourairports.com can search for closest airports to a lat/lon. It also has a CSV list that might be more convenient to search locally. Once you have the airfield, there are several online services to query the METAR or other WX info, but I don't know of one with a good API.

Read more: destevez.net/2026/02/esca...

A panel with four plots. Each row corresponds to one of the two spacecraft. The first column shows the rotation rate corresponding to some quaternions. The second column shows what appears to be gyroscope telemetry. We see a good match between the quaternions and the gyroscopes.

In this post I go over some details of the flight software, including file downlink, logs, and on board scripting. I also find some quaternion data and gyroscope data that are a good match, plus other quaternions that I don't know how to interpret.

New blog post: ESCAPADE telemetry. In November I posted about decoding the telemetry of this Mars twin orbiter mission. PistonMiner did additional reverse-engineering, and I wanted to revisit this and dig deeper in the telemetry.

VOYAGER-1 live on the YouTube stream from Bochum.

A Wireshark screenshot where we see packet analysis on a data transmission done with CSP and RDP.

Finally, a Wireshark dissector allows analyzing CSP and RDP packets (RDP is the reliable data protocol used in CSP for sequence-controlled delivery).

Read more: destevez.net/2026/01/tool...

There is a tool called csp-iperf that does throughput testing by using CSP ping packets, and a csp-ping-server that can be used in combination with that tool to reply to these packets. There is also cspdump, which captures and writes CSP packets to a PCAP file.

A screenshot of a terminal where we can see csp-iperf running and showing TX and RX rates and packet counts, round trip time measurements, and number of lost packets.

New blog post: Tooling for CSP. CSP is the cubesat space protocol. It is a network protocol used in cubesat buses, RF communications, and groundstations. Here I showcase some tooling to perform CSP network performance analysis and debugging that I have open sourced.

This beacon probably does the same, but I argue that this is not a security problem because the system security relies on the NAS encryption and integrity.

Read more: destevez.net/2026/01/v16-...

I have found a report from a security researcher that has opened a similar beacon and obtained access to a debug serial port, finding that it transmits unencrypted data in a UDP packet.

Then, every 100 seconds it transmits a data packet using the control plane CIoT EPS optimization which I explained in the previous post.

I decode all the uplink transmissions in the recording and analyze the packets with Wireshark. What I see is that the beacon registers to the cell network 40 seconds after power on in a rather run of the mill way.

A waterfall of the uplink transmissions of a beacon when it first begin transmitting. This is the message exchange that is needed to register the beacon in the cell network.

New blog post: V16 beacon full uplink conversation. A follow up about my decoding of NB-IoT-connected car beacon warning lights (which is a thing starting this year in Spain). This time I have made a longer recording starting before the beacon is powered on.

It saves them from the need to establish a full data plane connection as in regular LTE.

Read more: destevez.net/2025/12/deco...

The beacon uses something called control plane CIoT EPS optimization to transmit a user data message encapsulated in a NAS message as soon as it completes an RRC connection. This is a mechanism intended for IoT devices that transmit a small amount of data.

Blind decoding of NPUSCH transmissions without access to the scheduling grants in the downlink is tricky, because we have to guess many parameters, including the RNTI. I show how with some cleverness and some brute force searches of reduced complexity these can be found.

The list of decoded MAC PDUs shown in Wireshark. The main interest is the RRC connection setup complete message, which contains a control plane service request NAS message that embeds the beacon message.

In this post I analyze a recording of the B20 band NB-IoT uplink of a V16 beacon, showing how to decode the NPUSCH and obtain MAC PDUs that we can inspect in Wireshark.

A waterfall of the uplink of a V16 beacon. We can see an m-FSK signal that is the NPRACH, and then some single-tone and multi-tone NPUSCH transmissions.

New blog post: Decoding a V16 beacon. Starting in 2026, the V16 beacon mandatorily replaces the emergency triangles in road vehicles in Spain. This beacon has a strobe light and an NB-IoT connection to the cell network that it uses to send a message containing its GNSS location.

It's a good read if you want to learn about RISC-V trap handling, and how LLVM turns Rust code into assembly and performs move elimination optimizations.

Read more: destevez.net/2025/12/note...

New blog post: Notes on debugging Rust microcontroller stack usage. This is story about low-level debugging of a RISC-V baremetal application that was running out of stack depending on the compiler options.

I've released gr-satellites v5.9.0. gr-satellites is a collection of GNU Radio decoders for amateur satellites. This release adds support for recently launched satellites, as well as new blocks that can be used to put together an AX100-compatible modem with CSMA.

A plot of the cross ambiguity function of a GPS signal. We see a vertical streak that spans almost 700 Hz. This is caused by the receiver frequency drifting during the 300 ms integration that is used to make this plot.

Most of the recordings have a problem regarding a huge receiver frequency drift, as shown here. This limits the sensitivity of the acquisition algorithm.

Read more: destevez.net/2025/12/firs...

An image showing the cross ambiguity function of a GPS signal. The correlation peak has high SNR and is clearly visible.

New blog post: First analysis of the Lunar GNSS Receiver Experiment data. I have developed a high-sensitivity GPS acquisition algorithm in CUDA and ran it on the experiment datasets. 1 to 3 satellites are detected in 60% of the recordings.

This takes a minute to do and benefits everyone. Thank you for your support!

I occasionally see SatYAML files shared in social media or forums, but it is hard to keep track of them in this way. If you have a SatYAML file that works for a given recording, please send a pull request to get it upstreamed, linking the recording you used to test it.

I've added SatYAML (configuration) files to gr-satellites for 24 satellites launched during 2025 that transmit on amateur radio spectrum. I'd like to request help from the community to keep gr-satellites updated with new launches, as it is hard for me to keep track of everything.

Some log messages extracted from the telemetry: /mnt/mmc0/logs/compton/inv_sts/inv_sts-1763132730.mtc.gz /mnt/mmc0/logs/compton/inv_eps/inv_eps-1762763341.mtc.gz /mnt/mmc0/logs/compton/inv_cdh_spoc_misc/inv_cdh_spoc_misc-1762770516.mtc.gz E_CMD_HIST: [ OK ] EPS_SPOC_DIO_ST_OCP_EN ENABLE_STATE=[0, Off] E_CMD_HIST: [ OK ] CDH_SPOC_IO_GPIO_STATE_SET IDX=[109] STATE=[0, E_Low] E_CMD_HIST: [ OK ] FJ_ABORT, Proc: CommsFallback E_INFO: set_st_power_state: End sequence E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: echo 'WAIT(2)' >> /tmp/BackorbDownload.fj E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: sed -i '$d' /tmp/BackorbDownload.fj E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: rm /tmp/*_files_list.txt E_CMD_HIST: [ OK ] MISC_CONFIG_PARSE, String: tlm_master.set_apid_freq(620, 0.05); E_CMD_HIST: [ OK ] FJ_START_ABS, Time: 1763146080.000000, File: CommsFallback, Args: E_CMD_HIST: [ OK ] FJ_START_REL, Seconds: 3600.000000, File: DisableComponents, Args: STA E_CMD_HIST: [ OK ] FJ_START_REL, Seconds: 0.000000, File: BackorbInit, Args: E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: echo PROC BackorbDownload > /tmp/BackorbDownload.fj E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: echo \'CMD "MISC_SYSTEM" ("gzip -c -f -k /tmp/BackorbDownload.fj > /tmp/BackorbDownload.gz")\' >> /tmp/BackorbDownload.fj E_WARNING: LoadProc (File: FJExecute.cpp Line: 1205): Procedure found in working directory, executing: /tmp/BackorbDownload.fj E_INFO: SetThermostatMode: Setting thermostat 'EESA' to mode ClosedLoop E_INFO: SetThermostatSetpointsClosedLoop: new setpoints for ON -35.000000 deg C. OFF -30.000000 deg C.

The telemetry packets contain many interesting strings with log messages, which appear to be generated by a Linux system running Rocket Lab's MAX flight software.

Read more: destevez.net/2025/11/deco...

A waterfall of the ESCAPADE-Gold telemetry signal. It shows that there are significant changes in power over time. There is a gap caused by a problem with the recording. The signal resumes at a slower data rate after the gap.

New blog post: Decoding ESCAPADE. Here I decode a recording of the ESCAPADE spacecraft that I did with an Allen Telescope Array antenna the day after they were launched. The modulation is PCM/PSK/PM with rate=1/2 Turbo code. The telemetry uses CCSDS TM frames and Space Packets.

Release Maia SDR Pluto firmware v0.8.2 · maia-sdr/plutosdr-fw Changelog Changed Update Maia SDR to v0.12.0. Updates dependencies. Update IQEngine to latest main. Add IPv6 link-local address fe80::1/64 to simplify connecting to the Pluto by ssh before the IPv...

Head over to github.com/maia-sdr/plu... to download the firmware and to github.com/maia-sdr/mai... for updated information about connecting to an Android phone.

The release changelog. Update Maia SDR to v0.12.0. Updates dependencies. Update IQEngine to latest main. Add IPv6 link-local address fe80::1/64 to simplify connecting to the Pluto by ssh before the IPv4 network is configured (for instance this can be used in Android devices that use an address of the form 10.xxx.yyy.zzz/24, which is not covered by the ipaddrmulti feature) Include IP from fw_printenv ipaddr in the Subject Alternative Names of the maia-httpd SSL certificate.

I have made a new release of the Maia SDR firmware. This is a maintenance release that updates dependencies and includes some USB Ethernet connectivity improvements to Android devices.