SKADAR — hearing a drone before you see it

A drone is a flying transmitter

Every commercial drone keeps several radio links up at once: control, video, often separate telemetry in the sub-GHz bands. And since the EU regulations there is one more — Remote ID. A drone is required to broadcast, in the clear, its identifier, position, altitude and — most interestingly — the position of its operator. Unencrypted, in the ordinary 2.4 GHz bands, over Bluetooth and WiFi.

For a radio amateur the simplest comparison: Remote ID is APRS for drones. The frames go out over the air whether or not anyone is listening. In theory any smartphone can receive them. In practice the devil is in the range, in the transmission variants, and in the fact that not every drone plays nice — the more interesting cases transmit nothing, or lie.

Listen, don't transmit

SKADAR is fully passive — it monitors the spectrum but does not emit a single watt itself. That is not just engineering elegance. A passive system is invisible to the objects it detects, interferes with nothing around it and needs no transmission permits. A radar will tell you that “something is flying”. Radio listening tells you what is flying, whose it is, and where the pilot is standing.

The air around a drone is surprisingly chatty. SKADAR listens to more than a dozen different kinds of transmission at once — from the legally mandated Remote ID, through DJI's proprietary protocols, to the telemetry of cheap home builds and signals that don't come from the drone itself. Let's go through them one by one.

Remote ID — one standard, four paths

Remote ID (the ASTM F3411 standard) is a legal obligation: a drone must introduce itself. But it introduces itself over four different physical paths, and a proper detector has to handle each one — otherwise half the sky flies past unheard.

• Bluetooth Legacy — classic BLE advertising frames, the simplest and most common variant
• Bluetooth Long Range (Coded PHY) — long-range BLE 5, several times the reach of Legacy, but it needs hardware that can actually hear it
• WiFi Beacon — the drone's identity attached to ordinary WiFi beacon frames in the 2.4 and 5 GHz bands
• WiFi NaN — the neighbour-awareness flavour of WiFi that newer designs favour

And what do those frames carry? The drone's identifier (Basic ID — its serial or registration number), its position and altitude, and — in a separate system message — the operator's position. A smartphone handheld will catch the basic variant from a few metres; the exotic flavours (Coded PHY, NaN) and any real range are no longer a job for a phone.

DJI's proprietary world

DJI, the market's biggest player, runs its own ecosystem alongside Remote ID — and that is where it gets interesting. SKADAR recognises three of its signatures: DJI DroneID (a separate identity beacon, broadcast independently of Remote ID), the OcuSync / OFDM video link (the actual image transport in the 2.4 / 5.2 / 5.8 GHz bands, detected as an energy lift against the band's noise floor), and the WiFi signature itself — from the hardware address we can name the manufacturer (DJI, Parrot, Autel, Yuneec, Skydio) even when the drone gives away nothing about its identity.

Home builds, FPV and long range

Not every drone is a well-behaved DJI off the shelf. More and more common — both with hobbyists and with those for whom the hobby is no obstacle to breaking the law — are home builds that know nothing of Remote ID at all. What gives them away is the very character of their control and telemetry links:

• MAVLink / SiK telemetry — the links of autopilot and FPV drones in the 433 / 868 / 915 MHz bands
• ELRS / Crossfire — popular long-range control with frequency hopping, both in 2.4 GHz and sub-GHz (868 MHz)
• Analogue FPV video — the classic feed from a racing drone in the 5.8 GHz raceband

This is the hardest category today: without Remote ID there is no ready-made identifier and no position handed to you on a plate. All that is left is the shape of the signal in the spectrum — and that is exactly where the real amateur-radio craft begins.

Context from the sky, and a jamming alarm

Two signals that don't actually come from the drone itself, yet without them the situational picture is incomplete:

• ADS-B (1090 MHz) — the transponders of aeroplanes and helicopters. SKADAR listens to them not to chase them, but to tell legitimate air traffic apart from an intruder and avoid raising an alarm over a passing airliner
• GNSS jamming (the GPS L1 band, 1575.42 MHz) — when the satellite-navigation band gets suspiciously loud, that is often the prelude to an attack or cover for a drone. The system raises an alert and protects its own navigation

How it knows where the drone — and the pilot — is

When a drone broadcasts Remote ID, the drone and operator positions come “for free” — you just parse the message. It gets more interesting when the target does not cooperate. In a multi-sensor configuration (three or more nodes) SKADAR localises the transmitter via TDOA — from the differences in signal arrival time at the individual sensors, regardless of the platform's goodwill. A single node with a directional antenna provides a bearing to the target with accuracy on the order of ±0.1°.

The operator position is the real prize in this game anyway. You can wait a drone out — but the responders arriving on scene want to know where the person with the controller is standing, not just which way the aircraft flew.

Numbers that matter

Radio honesty requires a footnote: these are line-of-sight figures for consumer drones at 2.4 GHz. Range always depends on transmitter power and terrain, and in WiFi-dense environments the detection thresholds need tuning — physics can't be cheated, and anyone promising otherwise isn't telling the truth.

How do you test counter-drone without an army of drones?

The most interesting workshop problem of this project: to check whether the system can handle dozens of simultaneous targets, you would have to hire a squadron. Instead we built a pocket transmitter that impersonates an entire fleet — it emits standard-compliant Remote ID frames of dozens of virtual drones scattered around the test operator's real position. The console has to swallow it all: sort detections into tracks, plot trajectories, raise alerts. On top of that come sorties with real aircraft in the field — because simulation is simulation, and propagation out in the open always adds its own commentary.

Four variants, one approach

The same core system works in four configurations, depending on where it is meant to serve:

• SKADAR-S (fixed) — 24/7 protection of a site from a mast or rooftop, mains or solar-plus-battery power
• SKADAR-M (vehicle-mounted) — installed on a vehicle, monitoring even on the move
• SKADAR-P (man-portable) — a backpack or case kit for a single operator, plus a smartphone handheld variant
• SKADAR-N (naval) — a salt- and humidity-resistant enclosure, vessel motion compensation, bridge integration

The variants don't live in isolation: every patrol with a handheld detector can feed the central instance live. The more ears in the field, the tighter the net.

Not an island — SKADAR talks to the rest of the world

Detection is only half the job. The alert has to reach someone who will act on it — an existing control room, a CCTV system, a tactical map. That is why SKADAR is not a closed box: it exposes its data through open, secured interfaces and speaks the same languages as the rest of the security world.

• An open real-time API (REST + WebSocket) with authentication and role-based access control — an event stream, webhooks to alarm-management centres and CCTV, incident export
• TETRA — statuses and SDS messages plus dynamic group assignment (DGNA) straight into the services' digital comms
• SCADA (Modbus TCP / OPC-UA) — hooking into the control systems of critical infrastructure
• ATAK / Cursor-on-Target — target markers on the military and service tactical map, aligned with the WarDragon / DragonSync ecosystem
• NMEA 0183 and CSV / KMZ export — integration with the navigation bridge and archiving of incidents
• An API for third-party sensors — a simple report connects any external detector, and every patrol becomes a mobile node with its own identity

For me personally, the most satisfying single item on that list is TETRA. My whole body of work around digital trunked radio — the very same I have been writing about on this site for years — plugs in here as a ready-made output channel for the counter-drone system. Projects really do feed one another.

From the shack to the rooftop

SKADAR grew straight out of amateur radio. The same skills I have been pouring into TETRA projects for years — patiently listening for weak signals, antennas, understanding other people's protocols — turned out to be exactly what drone detection needs. We develop the system as the SP8MB team within InterOne's R&D programme, entirely in Poland, on an open architecture that can be extended with further sensors — acoustic, optical or radar — without replacing the foundation.