Readiness report
RTL-SDR ADS-B Feeder Station · 2026-09-03 18:34 · complete · 7 searches, 13 pages fetched
Cybersecurity — software & network: Do not place on an open network · 6 findings
Details in the Cybersecurity section of the report below.
Readiness: RTL-SDR ADS-B Feeder Station
Verdict: Ready with caveats · 2026-09-03 · est. parts cost $109–$137 (core station; each optional extra SDR adds $36–$95) Cybersecurity — software & network: Do not place on an open network
This is the cold check — the first readiness report for this lab, so it establishes the baseline every later report will measure drift against. All six bill-of-materials lines are commercial off-the-shelf retail items with no manufacturer part numbers, so the check was six retail price searches plus two manufacturer product pages read in full. Every line is buyable today from at least two sellers, and a working station comes to roughly $109–$137. Two things keep this off a clean "Ready". First, the specified SDR dongle (RTL-SDR Blog V4) turns up only in marketplace and reseller listings, priced from $33.24 to $83.00 for the same item, with no authorized-distributor listing to anchor the price — awkward for a purchase order. Second, no antenna listing found this run documents the VSWR ≤ 1.5:1 the lab asks for, and the one antenna product page read in full (the cheapest option, at $8.95) states 2:1 — below the lab's own spec.
Action required
| Part | Problem | Recommended action |
|---|---|---|
| RTL-SDR Blog V4 (primary SDR) | Same dongle priced $33.24 to $83.00 across marketplace and reseller listings; no authorized-distributor listing found this run | Budget about $52 from the mainstream listing ($51.80 · Walmart (HTOOL)), or buy the verified alternative — Nooelec NESDR SMArt v5, $44.95 · Nooelec, sold first-party and listed as supported by the feeder project (see Substitutes) |
| 1090 MHz ADS-B antenna | No listing checked documents the lab's VSWR ≤ 1.5:1; the cheapest option ($8.95 · Nooelec) states VSWR 2:1 on its own product page, and is a 3 dBi 11 cm whip rather than the 5.5 dBi outdoor collinear the lab describes | Ask the seller for the VSWR figure at 1090 MHz before ordering an outdoor collinear. Treat the $8.95 whip as a bench-only starter antenna, not the specified part |
Cybersecurity — software & network
Do not place on an open network — The configuration UI binds every interface with authentication off unless someone enables it, and the feeder's other services are unauthenticated by design, so the station is only safe on an isolated segment.
| Component | Version | How known | Support status |
|---|---|---|---|
| adsb-feeder-image (ADS-B Feeder project code) | not determined | unpinned (app-install.sh clones https://github.com/dirkhh/adsb-feeder-image.git and builds from the main branch unless the installer passes -t |
— |
| adsb-setup (Flask web configuration UI, port 1099) | not determined | unpinned (the adsb-setup directory holds only .py files and templates - no manifest or lockfile (list_repo_files, 10 entries, no manifest candidates); its Python dependencies come from the repository root pyproject.toml) | — |
| Flask (web framework behind the setup UI) | not determined | unpinned (declared twice in fetched/01-pyproject.toml, once with no constraint and once as a >= range, so no exact version is fixed) | — |
| Python dependency group (requests, cryptography, shapely, humanize, pyserial, python-kasa, aiohttp, FastAPI, uvicorn, slowapi and others) | not determined | unpinned (31 of 31 rows in fetched/01-pyproject.toml carry no constraint or only a >= floor) | — |
| Docker engine (container runtime) | not determined | unpinned (the install path pipes get.docker.com to a root shell, so whatever version is current is installed (fetched/03-app-install.sh)) | — |
| alpine (base container image) | 3.23.3 | read from project (ALPINE_CONTAINER=alpine:3.23.3 in fetched/02-docker.image.versions) | supported until 2027-11-01 |
| ghcr.io/sdr-enthusiasts/docker-adsb-ultrafeeder (1090 MHz decoder, map and MLAT) | latest-build-931 | read from project (ULTRAFEEDER_CONTAINER in fetched/02-docker.image.versions) | — |
| ghcr.io/sdr-enthusiasts/docker-reversewebproxy (reverse proxy in front of the web UIs) | latest-build-745 | read from project (WEBPROXY_CONTAINER in fetched/02-docker.image.versions) | — |
| ghcr.io/sdr-enthusiasts/docker-dump978 (978 MHz UAT decoder) | latest-build-795 | read from project (UAT978_CONTAINER in fetched/02-docker.image.versions) | — |
| ghcr.io/sdr-enthusiasts/docker-piaware (FlightAware feeder) | latest-build-658 | read from project (FA_CONTAINER in fetched/02-docker.image.versions) | — |
| ghcr.io/sdr-enthusiasts/docker-flightradar24 (Flightradar24 feeder) | latest-build-850 | read from project (FR24_CONTAINER in fetched/02-docker.image.versions) | — |
| ghcr.io/amir20/dozzle (container log viewer) | v10.6.2 | read from project (DOZZLE_CONTAINER in fetched/02-docker.image.versions) | — |
| ghcr.io/projecthorus/radiosonde_auto_rx (weather balloon decoder) | v1.8.2 | read from project (RADIOSONDE_CONTAINER in fetched/02-docker.image.versions) | — |
| ghcr.io/plane-watch/docker-plane-watch (Plane.watch feeder) | v0.0.9 | read from project (PW_CONTAINER in fetched/02-docker.image.versions) | — |
| Host operating system image (Raspberry Pi OS / DietPi / Debian in the VM images) | not determined | not determined (the lab's materials state no version or codename for any base image, and none was fetched this run) | — |
| CustomPiOS (image build framework) | not determined | not determined (referenced by repository URL only, with no version or tag, in the project README (snapshot)) | — |
| Raspberry Pi Imager (SD card writing utility) | not determined | not determined (the lab points at the releases page without naming a version (snapshot)) | — |
| Base Linux host packages installed with apt | not determined | unpinned (installed with unpinned apt commands by dietpi-software or by the operator; app-install.sh itself states it assumes the dependencies are already installed (fetched/03-app-install.sh)) | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| adsb-feeder-image install path | The documented install runs code straight from the internet as root - the project's app-install.sh is piped from the main branch into a root shell, and the same instructions install Docker by piping get.docker.com into another root shell - so whatever those pages serve at that moment runs with full privileges on the host. | posture | Mitigation only - download both scripts, read them, and install from a fixed release tag (app-install.sh accepts -t |
| adsb-setup (web configuration UI) | The configuration web UI listens on every network interface and its password protection is optional: when it is not switched on, the app treats every visitor as logged in, so anyone who can reach the feeder on the network can reconfigure the station. | posture | Mitigation only - switch on the built-in web UI password before the device leaves the bench, and keep the feeder on an isolated network segment. |
| Feeder network services | Sixteen raw data ports (30001 to 31006) plus the map interface on 8080 and the setup interface on 1099 are published on the host's own network interfaces, and none of them asks for a credential. | posture | Mitigation only - put the feeder on its own VLAN or behind a host firewall and expose only the map port to the classroom. |
| First-boot Wi-Fi hotspot | With no network configured, the feeder brings up an open Wi-Fi access point whose web page accepts the site's Wi-Fi name and password, so anyone within radio range during setup can join it and read or set that configuration. | posture | Mitigation only - configure the feeder over wired Ethernet where possible, or complete the hotspot step away from public areas and confirm the hotspot is gone once the device is on the network. |
| Outbound aggregator feeds | The station's purpose is to push decoded aircraft, ship and balloon data to external aggregators, and each enabled aggregator receives the station's configured location along with the data. | posture | Mitigation only - enable only the aggregators the course needs, and decide deliberately what location the station publishes before enrolling it. |
| Python dependency group (pyproject.toml) | Dependencies unpinned: 31 of 31 in pyproject.toml - the network-facing web UI's Flask, requests and cryptography carry no version constraint at all, so the versions that end up installed have no checkable security state and two builds of the same lab can differ. | posture | Mitigation only - pin the runtime dependencies or add a lockfile, then re-run this check against it. |
What this means for your lab
This station is built to be reachable: it puts a configuration website and about sixteen data ports on your network, and out of the box the configuration website has no password - the software only asks for one if someone turns that option on. Anyone else on the same network can therefore open it and change how the station is set up, including settings that run commands on the little computer itself. During first-time setup the device also broadcasts its own open Wi-Fi network so you can hand it your Wi-Fi password, which anyone in range can join while it is up. The practical answer is not to put this on the open campus or classroom network: give it its own segment or a firewalled port, turn on the web interface password immediately, and prefer wired Ethernet for setup. Talk to campus IT before connecting it, both about the isolated segment and about the fact that the station continuously sends aircraft data - and its own location - out to public aggregators. Note also that nothing here has been checked for known vulnerabilities: the Python packages are installed unpinned so there is no version to look up, and the container images, though pinned, use build tags no vulnerability database tracks. That is an unknown, not a clean bill of health.
Not checked
- 28 pinned container images in docker.image.versions (ultrafeeder, dump978, piaware, flightradar24, acarshub and the rest): container build tags such as latest-build-931 map to no package ecosystem, so no vulnerability database can be queried for them; the tags are pinned, which is good practice, but pinned is not the same as checked
- Host operating system image (Raspberry Pi OS / DietPi / Debian): no version or codename is stated anywhere in the lab's materials, so neither a support-status nor an advisory lookup is possible
- Python dependencies declared in pyproject.toml: unpinned - there is no exact version to check against the advisory database
- Docker engine: installed by get.docker.com at whatever version is current; no version to check
- CustomPiOS image build framework: referenced without a version or tag; build-time tooling with nothing pinned to look up
- Raspberry Pi Imager: no version stated in the lab's materials
- Base Linux host packages installed with apt: installed unpinned from the distribution's repositories; the versions depend on the day the image is built
Parts
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Single-board computer — Raspberry Pi 4 Model B, 2 GB | BCM2711 quad-core ARMv8, 85 × 56 mm, 5.0–5.25 V via USB-C | readily available | listed | $55.00 · PiShop USA | PiShop USA — only listing in evidence that states the 2 GB variant; $45.00 · CanaKit lists "Raspberry Pi 4 Model B" without stating RAM |
| 5 V DC system power supply — official Raspberry Pi 15.3 W USB-C | AC wall adapter, 100–240 V in, 5.1 V ±5% / ≥ 3.0 A out, captive USB-C cable | readily available | listed | $8.00 · DigiKey | DigiKey; also $8.80 · PiShop USA. Third-party 5 V/3 A adapters run $5.95–$7.95, but the lab warns that cheap charger plugs cause MLAT timing failures |
| Primary USB SDR receiver (1090 MHz) — RTL-SDR Blog V4 | RTL2832U + R828D/R860, USB-A dongle, female SMA, 1 PPM TCXO, 250–450 mA on the 5 V USB rail | available; marketplace-priced | listed | $51.80 · Walmart (HTOOL) | Walmart marketplace seller HTOOL; cheapest exact match is $33.24 · eBay seller (individual eBay seller). The feeder project's supported-hardware page lists the v3 and v4 dongles and notes the v3 is slightly better for ADS-B |
| 1090 MHz ADS-B tuned antenna | 50 Ω, tuned 1090 MHz, VSWR ≤ 1.5:1, SMA-male or N-female | available; spec compliance not verified | listed | $8.95 · Nooelec | Nooelec 3 dBi whip — its product page states VSWR 2:1, below the lab's ≤ 1.5:1. Next options: $14.99 · Crew Dog Electronics (5 dBi set) — VSWR not stated in any evidence |
| MicroSD flash storage card — 16/32 GB Class 10 UHS-I, A1/A2 | 11 × 15 × 1 mm µSD, 3.3 V from the board, sustained write ≥ 10 MB/s | readily available | listed | $6.00 · Lensrentals | Lensrentals — Kingston Canvas Select Plus, one of the two cards the lab names. Cheapest: $4.00 · SHI International (Adata 32 GB Premier Pro UHS-I U3). No listing states the A1/A2 application class |
| Optional secondary protocol SDR dongle(s) and antenna(s) — 0 to 4 | RTL2832U USB-A dongle plus band-matched antenna; each adds 250–500 mA to the 5 V rail | readily available (optional) | listed | $94.94 · DigiKey | DigiKey — RTL-SDR Blog V3 with dipole antenna kit; the only authorized-distributor listing in this run, at roughly a 40% premium over marketplace kits. Dongle only: $35.99 · MTools Tec |
Substitutes
| For part | Substitute | Differences | Verified | Judgment |
|---|---|---|---|---|
| RTL-SDR Blog V4 (primary SDR) | Nooelec NESDR SMArt v5 — $44.95 · Nooelec | Same RTL2832U demodulator and R820T2/R860 tuner the lab requires; 0.1–1750 MHz covers 1090 MHz; 0.5 PPM TCXO exceeds the lab's ≤ 1 PPM requirement (better); female SMA input as specified; same 5 V USB bus power, no supply-rail change. One real difference: the product page lists no bias-tee, where the V4 has a software-switched 4.5 V bias-tee — if a mast-mounted preamp is powered over the coax, this dongle cannot feed it (Nooelec's SMArTee variant is the bias-tee model, also listed as supported; its price and stock were not checked this run) | verified: demodulator IC, tuner IC, frequency range, TCXO rating, antenna connector type (Nooelec product page fetched this run); supported-by-project status (adsb.im/supported fetched this run); price (shopping evidence). not verified: absence of a bias-tee (inferred from the page not listing one), enclosure dimensions, current draw | Acceptable as a drop-in for 1090 MHz ADS-B reception, and preferable if you need a first-party seller rather than a marketplace listing — unless the build powers an external preamp over the coax |
| 1090 MHz ADS-B tuned antenna | Nooelec 1090 MHz ADS-B Antenna, 3 dBi, SMA — $8.95 · Nooelec | Centre frequency 1090 MHz as required; male SMA mates with the dongle's female SMA; VSWR "2:1 or better" against the lab's ≤ 1.5:1 — falls short of a stated requirement; 3 dBi against the 5.5 dBi example — falls short; 11 cm portable whip, not a mast-mounted outdoor collinear | verified: centre frequency, VSWR figure, gain, connector gender, physical size (Nooelec product page fetched this run). not verified: 50 Ω impedance is not stated numerically on the page; no outdoor/weatherproof rating stated | Acceptable only as a bench or indoor starter antenna to get a first signal. Not acceptable as the specified outdoor collinear — a 2:1 match costs receive range against the lab's spec |
Check any substitute against the manufacturer's datasheet before ordering.
Other dependencies
- Feeder image releases page (github.com/dirkhh/adsb-feeder-image/releases/latest) — reachable this run; images are published and the page carries the project's own boot-test table. Two things worth knowing before you buy a board: the project says it has "significantly reduced the number of images provided", and one of the x86-64 virtual-machine images in the current release is marked as having failed its automated boot test. Confirm an image exists for the exact board or VM platform you intend to buy.
- ADSB.im project site (adsb.im/home) — reachable this run; documents the install paths and the aggregators a station can feed.
- ADSB.im supported-hardware page (adsb.im/supported) — reachable this run; its current lists of supported single-board computers and supported SDRs match this lab's bill of materials, and it repeats the warning that the Raspberry Pi Zero W will not work. It also recommends a 5 V/4 A supply for boards more capable than the Pi 3 class.
- ADSB.im hotspot page (adsb.im/hotspot) — not checked this run.
- my.adsb.im redirect service — not checked this run.
- Open ADS-B historical flight data (github.com/adsblol/globe_history) — reachable this run; daily releases under the Open Database License. Optional teaching dataset; nothing in the build depends on it.
- Fabrication — none required. No custom PCB; the station is assembled entirely from off-the-shelf boards, dongles and antennas.
Watch list
- RTL-SDR Blog V4 — the part most likely to move. It has no authorized-distributor listing in this run's evidence, so its price is set by marketplace sellers and swung 2.5x between listings on the same day. Re-price it every check; if the cheap listings vanish, the Nooelec alternative is the fallback.
- 1090 MHz antenna — the lab's VSWR ≤ 1.5:1 requirement is not documented by any listing found. Until a compliant antenna is identified by model, this line is a spec gap rather than a supply gap.
- Raspberry Pi 4 Model B, 2 GB — only one listing in this run confirmed the 2 GB variant, at $55.00, above the $45.00 asked for a board whose RAM the listing does not state. Pi 4 pricing and variant availability have historically been volatile; watch both the price and whether 2 GB boards stay listed as the Pi 5 takes over.
- Power supply headroom — the official 3.0 A supply sits exactly at the lab's stated minimum, while the project's own guidance recommends 5 V/4 A for more capable boards. Adding a second SDR dongle (250–500 mA each) is what will push a marginal build into MLAT instability; plan a powered hub or a larger supply at that point.
- microSD application class — no listing checked states the A1/A2 class the lab asks for. Cards are cheap and plentiful, so this is a specification check at ordering time, not a sourcing risk.