⏱️ Lectura: 11 min
QuadRF, a phased array radio built on a Raspberry Pi 5, costs 499 dollars in its basic kit and can already tell apart individual WiFi networks through the wall of a recording studio. YouTuber and Raspberry Pi expert Jeff Geerling tested it for a week alongside his father, a retired broadcast engineer, and confirmed that it also tracks drones in mid-flight.
📑 En este artículo
The project came from Martin McCormick, a former SpaceX engineer who worked on Starlink’s Dishy antenna, and it aims at something more ambitious: an antenna array scalable up to the size needed for Earth-Moon-Earth radio experiments.
TL;DR
- QuadRF is a phased array radio based on a Raspberry Pi 5 and an FPGA with picosecond timing.
- The basic kit costs $499 on Crowd Supply and has already passed its crowdfunding goal.
- It operates on 4.9 to 6 GHz, the same band where 5 GHz WiFi lives.
- It uses the Pi 5’s MIPI camera and display lanes (RP1 chip) to stream I/Q at more than 5 Gbps.
- Geerling and his father tested it for a week: it detected a DJI Mini Pro 4 in mid-flight without trouble.
- Its creator, Martin McCormick, a former SpaceX engineer (Dishy team), is targeting a lunar array of up to 1.15 MW EIRP.
- The Mobile Expansion Pack adds a battery and phone mount, designed for portable C-band analysis.
- The enclosure will move from 3D printing to injection molding after clearing the crowdfunding goal.
Introduction
Your home WiFi transmits over the air, not over a cable, so anyone with the right receiver can listen to that traffic without touching your router. That is what QuadRF demonstrates, a device that combines a Raspberry Pi 5 with an FPGA board and four antennas to do beamforming: aiming the sensitivity of reception toward a specific direction, like a radio-frequency flashlight.
Geerling sums it up with a line worth repeating: if the open source community got this far, imagine what governments already have. This is not a new threat (intelligence agencies have used antenna arrays for decades), but it is the first time that level of capability drops down to a 499-dollar device that fits in a backpack.
What happened with QuadRF
Geerling found QuadRF on Hackaday and reached out to Martin McCormick, who develops the project under the ScaleRF brand. McCormick sent him a prototype so that Geerling and his father could test it for a full week.
The result surprised them. They powered on the device, the Raspberry Pi 5 brought up its own WiFi hotspot, they connected from the browser to http://quadrf/ and accessed a VNC session with GNU Radio, SDR software and a custom augmented reality visualizer. That AR visualizer is the most striking piece: it overlays colored blobs onto the phone’s camera representing the radio-frequency energy detected in each direction.
In the tests, Geerling’s 5 GHz WiFi network (on channel 100, near 5.5 GHz) showed up as a light blue blob. The neighbors’ networks appeared in red and green. When they flew a DJI Mini Pro 4 behind the studio, QuadRF detected it without a problem, though they had to raise the gain manually as the drone moved away: it does not yet have automatic gain control (AGC).
Context and history
QuadRF was not born as an isolated hacker project: it is the visible part of something bigger. An antenna array scalable up to the size needed for EME (Earth-Moon-Earth) experiments, that is, bouncing radio signals off the Moon, and also amateur radio astronomy.
McCormick did not come to this topic by chance. He previously worked at SpaceX, on the team that built Dishy, Starlink’s first user terminal. The influence shows: instead of locking the phased array inside a proprietary satellite system, the idea is that licensed operators can chain several QuadRF modules for high-power radio experiments, with up to 1.15 MW EIRP (equivalent isotropically radiated power) by combining directional antenna gain.
The unit Geerling tested is the reduced, portable-sized version: without the power needed to reach the Moon, but useful for local SDR applications within its frequency range, 4.9 to 6 GHz.
QuadRF technical details and performance
The most interesting part from an engineering standpoint is how QuadRF moves data. Instead of using USB, the usual path in SDR devices, the ScaleRF team designed the system to stream I/Q samples (In-phase/Quadrature, the standard representation of a digitized radio signal) through the MIPI FFC connectors that the Raspberry Pi normally reserves for camera and display.
According to the documentation cited by Geerling, that MIPI link goes through the Pi 5’s RP1 chip (the input/output coprocessor Raspberry Pi introduced in that model) and sustains more than 5 Gbps with low latency and full-duplex, enough for hundreds of millions of samples per second without loss. To pull it off, the team had to reverse-engineer the MIPI protocol the RP1 uses, because it is not a use officially documented by Raspberry Pi.
The advantage over USB is twofold: it adds almost no hardware cost to the RF board, and it frees up the Pi 5’s PCIe connector for other things, like fast storage or networking. On top of that, the architecture allows chaining several QuadRF modules in cascade, where each one computes its own signal phase shift to add directional gain in a distributed way.
flowchart TD
A["Array de 4 antenas (4.9-6 GHz)"] --> B["FPGA: beamforming y timing"]
B --> C["Raspberry Pi 5 via MIPI (chip RP1)"]
C --> D["GNU Radio / software SDR"]
D --> E[("Visualizador AR en el navegador")]For anyone who wants to understand what GNU Radio does with that data, here is what a minimal flow in Python would look like, opening the device’s I/Q stream and dumping it to a file for later analysis:
from gnuradio import gr, blocks
import osmosdr
class QuadRFCapture(gr.top_block):
def __init__(self, freq=5.5e9, samp_rate=20e6, gain=30):
gr.top_block.__init__(self, "QuadRF IQ Capture")
self.source = osmosdr.source(args="quadrf")
self.source.set_sample_rate(samp_rate)
self.source.set_center_freq(freq)
self.source.set_gain(gain)
self.sink = blocks.file_sink(gr.sizeof_gr_complex, "iq_capture.dat")
self.connect(self.source, self.sink)
if __name__ == "__main__":
tb = QuadRFCapture()
tb.start()
input("Grabando IQ en iq_capture.dat, Enter para detener...")
tb.stop()This script opens the osmosdr.source block pointed at the QuadRF device, sets the center frequency to 5.5 GHz (WiFi channel 100) and saves the raw samples to disk to inspect them later with Wireshark or a custom FFT script.
To confirm that the MIPI link is actually active and did not drop to a slower compatibility mode, the QuadRF manual recommends checking the kernel log on the Raspberry Pi itself: dmesg | grep -i rp1 should show the video driver recognizing the data channel at the expected speed.
How to test it
The path to trying QuadRF today runs through reserving a kit on Crowd Supply, but if you already have one (or got access to a prototype like Geerling did), the startup flow is the same on Windows, macOS and Linux, because everything runs inside the browser via VNC:
# 1. Encendé el QuadRF: la Raspberry Pi 5 crea un hotspot WiFi propio
# Linux
nmcli device wifi connect "QuadRF-XXXX" --ask
# macOS
networksetup -setairportnetwork en0 "QuadRF-XXXX"
# Windows (PowerShell)
netsh wlan connect name="QuadRF-XXXX"
# 2. Con cualquier sistema, abrí el navegador en la sesión VNC embebida
# y desde ahí lanzás GNU Radio Companion o el visualizador AR
http://quadrf/Once inside the VNC session, which runs entirely on the Pi itself with nothing installed locally, the user chooses between launching GNU Radio Companion, standard SDR tools or ScaleRF’s own AR visualizer. That visualizer does not yet show a numeric signal scale, something Geerling flags as pending, so for now it works better for exploring the RF environment than for making precision measurements.
💡 Tip: If you plan to walk around with the gear, ask for the Mobile Expansion Pack: without its own battery, the basic kit depends on a power bank cabled to the Raspberry Pi.
Impact and analysis
| Configuration | When to use it | Advantage | Limitation |
|---|---|---|---|
| Basic kit ($499) | Explore SDR and beamforming on the workbench | Lower entry cost, software included | No built-in battery, has to be plugged in |
| Mobile Expansion Pack | Portable C-band analysis while walking | Battery and phone mount | Raises the price and weight of the set |
| Chained multi-module array | High directional gain projects with a license | Up to 1.15 MW EIRP by combining modules | Requires an operator license and several modules |
The immediate use case Geerling shows, seeing your own WiFi as a colored blob in an AR visualizer, is eye-catching but secondary. What matters is that open source engineering now solves, with consumer hardware, a problem that until recently demanded lab equipment: processing RF signals in real time with enough bandwidth to do useful beamforming.
This has an uncomfortable side. An antenna array capable of detecting WiFi traffic through a wall, without physical access to the network, is also a surveillance tool. Geerling says it plainly: this is not new, governments have had capabilities like this for years, and it is better for the open source community to expose what is possible than to have useful tools banned out of fear.
📌 Note: Detecting the presence of a WiFi network from its spectrum is not the same as decrypting its traffic: that requires breaking WPA2 or WPA3 encryption, something QuadRF does not do on its own.
⚠️ Heads up: This is pre-production hardware. The current enclosure is 3D printed and the Crowd Supply campaign does not guarantee a delivery date: as with any crowdfunding, do not expect it to arrive overnight.
What’s next
McCormick plans to move the enclosure from 3D printing to injection molding, thanks to the Crowd Supply campaign already passing its funding goal. The next technical step is to add automatic gain control (AGC), the piece missing during Geerling’s test for tracking the drone without adjusting the gain by hand.
In the medium term, the stated goal is to prove that chained QuadRF modules can sustain Earth-Moon-Earth experiments, something that today is almost the exclusive domain of amateur radio stations with huge parabolic antennas. If the cascade architecture, each module computing its own phase shift, works at scale, it would be a real change in accessibility for amateur radio astronomy.
Try it yourself: head to the QuadRF campaign on Crowd Supply and review the technical documentation of the MIPI link before the pre-order price rises with the move to injection molding.
📖 Summary on Telegram: View summary
Frequently Asked Questions
What is a phased array radio?
It is a set of antennas that combines their signals with calculated phase shifts to aim the reception sensitivity, or the transmission power, toward a specific direction, without physically moving anything.
Can QuadRF decrypt my network’s WiFi traffic?
Not directly. It detects the presence and approximate location of the signal, but the content stays protected by your router’s WPA2 or WPA3 encryption.
Do you need a license to use QuadRF?
To receive and visualize signals in the 4.9 to 6 GHz range, no, in most countries. Chaining modules to transmit at high power, like the 1.15 MW EIRP of the lunar project, does require a radio operator license.
Why does it use the Raspberry Pi’s camera pins instead of USB?
Because the Pi 5’s MIPI connector, through the RP1 chip, sustains more than 5 Gbps with low latency and full-duplex, faster and more stable than USB for this volume of I/Q data.
How much does it cost and where do you get it?
The basic kit is on pre-order at Crowd Supply for 499 dollars. The Mobile Expansion Pack, with battery and phone mount, is sold as an additional accessory.
Is QuadRF ready for production yet?
No. The unit Jeff Geerling tested is a prototype with a 3D-printed enclosure. The team plans to move to injection molding after the success of the crowdfunding campaign.
References
- Jeff Geerling: QuadRF can spot drones and see WiFi through my wall: the original article with the full test of the device.
- Hackaday: the site where Geerling first discovered the QuadRF project.
- Crowd Supply: the crowdfunding platform where the QuadRF kit campaign is active.
- Raspberry Pi: the official site of the maker of the Raspberry Pi 5, the base board of QuadRF.
- GNU Radio: the SDR software framework used inside QuadRF’s VNC environment.
📱 Do you like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day. @programacion
Imagen destacada: Foto de Louis Reed en Unsplash
0 Comments