Wi-Spy Spectrum Analyzer

I've been playing with a Wi-Spy Spectrum Analyzer for a few hours.

formatting link
$99 plus shipping. I installed it on my Panasonic M34 laptop running W2K and did some really crude testing. Some initial comments:

  1. It's fairly fast which is a BIG plus. It's much faster and better than my Proxim 7400 card. I set my access point to beacon once every second instead of the usual 10 times per second. It was easily detected but took a few sweeps for wi-spy to coincidentally end up on the same exact frequency as the access point. One can't see the sinx/x DSSS spectra, but it's close enough.

  1. It can easily pickup my Panasonic KX-TG2257 2.4GHz cordless phone and microwave oven from anywhere in the house (2 floors). Sensitivity, even with the tiny antenna, is quite impressive.

  2. Dynamic range sucks but that's understandable. The noise floor is about -60dBm while the SA saturates at about -32dBm. That's 28dB of dynamic range which is really bad compared to my ancient HP140T spectrum analyzer with about 60dB of dynamic range. However, I would not expect much more from such a unit. What this means is that there will need to be some form of attenuator to deal with close in sniffing, and possibly an adjustable gain amplifier for long range work.

I can just barely see my neighbors client radio at about 200ft with a

2dBi antenna and a tangle of wet trees in between. I'm sure that with an external antenna on the wi-spy, it would be detectable.

I had my neighbor across the street (about 50ft) fire up their Uniden something 2.4GHz cordless phone. I could see it, but just barely. Again, more antenna gain would be helpful.

  1. The software appears to be stable and quite useful. Whomever wrote it apparently has used commercial spectrum analyzers. I had some problems restarting the application after hibernation, but a reboot solved that. I can run my Netgear WG511v2 PCMCIA card at the same time. It makes for an interesting display, especially when the card is scanning for access points.

  1. I won't post any AVI recording files until I get a reproducible setup and possibly butcher the unit with a better antenna. The ones on the web site should be sufficient for now. |
    formatting link

  1. The display is either by channel number or by frequency. It will display all 14 UK channels, but when set to frequency, it reverts to the 11 US channels (2400 to 2483.5).

  1. I couldn't resist taking it apart and analyzing the hardware. It's actually a DSSS wireless mouse receiver. The radio module is made by Unigen: |
    formatting link
    had to apply for permission to download their secret data sheet. Maybe later.

Photos at: |

formatting link
square thing in the picture is a push button, usually used to synchronize a wireless mouse with a USB adapter. The RF chips is a Cypress Semi CYWUSB6934-48LFXC: |
formatting link
The antenna is the wiggly affair on the right of: |
formatting link
appears that I can easily attach a small coax pigtail for an external antenna. Of course, the usual coffee can or dish reflector can also be used. Some notes on the antenna design: |
formatting link
Bottom line is that it works and seems to work well enough. It will need some modifications to attach an external antenna in order to make it suitable for interference detection and location. It may take a while for me to use it in the field (it's raining). However, the fact that it can easily detect my leaky microwave oven and 2.4Ghz cordless phone means that it is sure to be useful.

Reply to
Jeff Liebermann
Loading thread data ...

formatting link
I had to apply for permission to download their secret data sheet.

formatting link

formatting link

Jeff, you're a gentleman and a scholar, I don't care what everybody else says. A $100 SA would be great if it works. Will stay tuned to see what else develops.

Reply to
Rôgêr

Thanks, Jeff, gotta get one on order!

Reply to
William P.N. Smith

formatting link
I had to apply for permission to download their secret data sheet.

formatting link

formatting link

Thanks for the update. Noticed this is in their forum ,so will watch with interest.

formatting link
I like this idea! Currently the average trace shows the average over all time or since the last time history was cleared. Your idea to scale the average in relation to the noisiest channel is good; another idea we have played with is just average the past 1-2 minutes of traffic. We will do further investigations into making the average trace more useful and will post a development build of version 1.1 sometime next week.

Reply to
Rob

snipped-for-privacy@painkiller.example.tld (Moe Trin) hath wroth:

I've been reading the data sheet on the chip at: |

formatting link
channels are 1MHz wide. In theory, the receiver sensitivity is

-90dBm while the overload point (on pg 27) is -10dBm (typ). That should yield a theoretical 80dB dynamic range. However, the RSSI indicator starts at -95dBm with 1-10 units and saturates at -40dBm with 28 to 31 units. That's only 55dB at best (probably less). With a 1MHz receiver, the base line noise level is probably about -85dBm (my guess) yielding only 45dB of dynamic range. Since I based my guess(tm) of dynamic range on the Wi-Spy signal level readings, which may or may not be accurate, the dynamic range may actually be larger. When I stick an antenna on the radio, and do some real measuring, I'll be able to measure the dynamic range.

Reminder. That was from the on-screen calibration markings, which might be wrong.

The 1977 HP test equipment catalog prices the 8555 front end for $7700. Add $1475 for the 140T main frame and $3775 for the hi res IF section. That's what I use for a spectrum analyzer. However, I borrowed the 8555A RF section and am looking for a replacment.

formatting link
There's a complete 141T on eBay for $680 total. Tempting.
formatting link

Those were MMIC's and had a lousy noise figure. I make my own using a GaAs xsistor. However, if I can mount the radio very close to the antenna, it probably won't do much good.

San Lorenzo River levels:

formatting link
formatting link
palatial office is right next to the levee in Santa Cruz. Glug...

Reply to
Jeff Liebermann

Either that's a pretty wide bandwidth, or it's awfully noisy. Saturating at -32 sounds as if it's got something active in front of what ever is saturating. However, -32 out of a 3 dBi antenna isn't especially a weak signal in space.

I'll say

But then, a hundred bucks isn't going to pay for the power cord on that HP, and depending on the plug-in, the HP has a heck of a lot more scan width. Back when Marconi was still playing with spark gaps or something, I think we paid US$12k for the 8555 (10 KHz - 12.4 GHz).

Mini Circuits Lab used to make a nice low noise preamp - problem is the onezy cost is probably more than you paid for the Wi-Spy.

As long as the Mighty San Lorenzo is staying within it's banks (you guys are hogging all the precip - we got a 10% chance tonight, which would be the first rain since early November).

Old guy

Reply to
Moe Trin

Does it have any function in the Wi-Spy, or are they just putting their own cover over someone else's USB device? [Mine's on order!]

Reply to
William P.N. Smith

William P.N. Smith hath wroth:

The switch apparently doesn't do anything. There's no hole in the covers to get to it. It's usually used to "pair" the mouse and dongle, but that's not needed here. Might be useful to send an event that will trigger a macro that will start/stop the recorder.

Incidentally, forget about buying a wireless mouse and using the dongle part with the freely downloadable software. The firmware inside is highly customized.

I'm currently trying to figure out the best way to attach an external antenna without destroying it.

Reply to
Jeff Liebermann

FCC ID R8KUGQUBE1US Not much info yet.

Reply to
Rob

Looks like you could just cut the antenna away where C{2,3,4} come together and pick up a ground at a bunch of nearby points, just attach an SMA (or whatever) connector there.

I was also wondering about putting the whole thing inside a Pringles (or whatever) can for some gain and directivity...

Reply to
William P.N. Smith

In the 1970s, a "low cost" General Aviation avionics manufacturer got a contract to build prototypes of a microwave landing system receiver. The concept of MLS wanted a log IF, and the "high cost" General Aviation avionics was using discrete log amps - about US$20 a piece, five per receiver to get 96 dB of dynamic range. The "low cost" house design guy was thumbing through a data book, and came across the RCA CA3089 FM IF strip on a chip. It had a signal strength indication that (on the data sheet) looked within about 2 dB of a nice log curve over 90 dB. Lab tests on two or three samples confirmed, and they based their design on that. In unit quantities, you can get this for under a buck and a half - in quantity 1000, they probably give it away. Can you spell DIRT CHEAP? You can see it coming, right? When they bought for production, the best you could say was that the curve was monotonic. Huge flat spots separated by near verticals. They wound up with plastic versions of the discrete, at $6 a pop. They also had a fine time shoe-horning 6 mini-dips, 5 extra chokes, 10 or so caps in to space formerly occupied by a single 16 pin DIP, a toroid, and such. RCA got off the hook, because "that parameter is not specified".

Sounds similar. RCA never thought about using the meter output as a log IF (though it _sorta_ worked that way), and none but a house looking to build something for really low costs would have tried. Actually, I gave very high marks for the design attempt. It just didn't work out that way.

Sounds about right. Really _great_ product. Really expensive.

I can't remember what we got as a replacement in 1992, but it was more bells and whistles for a similar price. I'd never heard of the vendor, but you know government purchasing regs.

No, they had some nice ones, in addition to those three-terminal pieces of crap.

True - then you have to add a step attenuator, and this is _really_ getting expensive.

It didn't rain either, and there's none in the 7 day forecast now.

At least it's not the Russian. Seems like every couple of years, that place would flood to umpti-dump feet over flood stage, yet people would buy and build right next to the river time after time, flood after flood. I can't understand how any lender or insurance type would stand it.

Old guy

Reply to
Moe Trin

formatting link
I have some in my pile, somewhere, maybe. I'm a bit worried about mechanical strength. That's why I'm looking for semi-rigid coax pigtail. The long SMA connector looks like it will fit or work.

Yeah, that will work. I'm gonna mount the dongle inside a 1/2" or

3/4" cast aluminum electrical conduit entry box for RF shielding. I don't want RF leaking directly into the receiver.
Reply to
Jeff Liebermann

snipped-for-privacy@painkiller.example.tld (Moe Trin) hath wroth:

Argh. I was working for Intech designing marine radios at the time. Someone designed a CA3089 into a handheld to save board real estate. It seemed like a good chip, but was pure hell to stabilize with all that gain in one package. My favorite inside joke was that the design was cloned by several competitors, who probably had a difficult time making them work.

They were oscillating. We had the same problem but without the added difficulty of trying to get them to follow square law. We could tolerate 5-10% distortion which was approximately what the flakey product detector would produce when it wasn't oscillating.

Well, it wasn't specified. It's not a log amp and never will be. You can get 100dB log amps with Sounds similar. RCA never thought about using the meter output as a log

The 3089 could have been made to work as a narrow band log amp if the gain was reduced to less than 60dB(??) and not run as originally intended as a limitter, where noise would saturate the last IF stage. To get 60dB of dynamic range out of an amplifier with 60dB of gain, it would have required a perfect noise figure, which the CA30889 certainly did not have. I wouldn't give it any points for missing the obvious.

I won't mention how many times I accidentally transmitted into the front end and cooked the attenuator, mixer, or both. Expensive is an understatement.

The 3 terminal MMIC's are fine for gain blocks. However, they're not intended for front ends. I couldn't find any single band amplfiers in their catalog:

formatting link
don't want a broadband amplifier because it doesn't have the noise figure and will pickup junk that can overload the receiver. The lack of RX bandpass filtering on the Wi-Spy radio is going to cause a problem.

Step attenuator? Methinks my pile of SMA fixed attenuators (3dB, 6dB,

10dB) is sufficient. I just add them as needed. Also, I've built some nice PIN diode variable attenuators that are fairly accurate over a narrow frequency range. No need for an expensive step attenuator.

I found a new problem with Wi-Spy yesterday. I went to a strip mall for lunch. There were at least 3 wireless hot spots within 100ft. The display would merrily climb from it's usual base line noise level of

-60dB (indicated) to about -40dB within 5 minutes from all the microwave ovens, cordless phones, and wireless clients. The microwave oven in the restraunt was very obvious. I also tried it from a high location that overlooked a larger part of the strip mall with similar results. Without additional dynamic range (or narrower dispersion to improve the dynamic range), it's going to be difficult to see any relatively weak sources of noise in an outdoor environment.

The good news is that I can see interference. The bad news is that there's so much of it.

Reply to
Jeff Liebermann

Frank hath wroth:

TX is disabled in the custom firmware. I plan to remove the 3PF capacitor from the TX output pin to the antenna. It probably causes very little loss, but every little bit helps.

The long threaded SMA connector at:

formatting link
probably the best bet as it allows easy mounting inside a shielded metal box with a single hole.

Unfortunately, the board will probably need to be notched to accomidate this type of SMA PCB edge mount connector. Methinks a coax pigtail would be a better choice for initial tinkering.

Reply to
Jeff Liebermann

Thanks for all the info. Have they disabled the Tx or just set it for minimum op?

Frank

Reply to
Frank

They had to watch the location of the traces and chokes, especially in relation to the quadrature toroid. I vaguely recall "low cost" house initially using an unshielded toroid, and having to replace it with a more expensive shielded coil. The chip itself was in a egg crate type of deal, with the input leads in one compartment, and the rest of the stuff in another. I also recall they used a ferrite bead on the power lead to try and shut it up.

RCA had two fairly decent Application notes on the chip - one gave really decent hints on how to get it to run. Yes, gain was a problem.

I don't _think_ so. Certainly there was nothing of interest on the quadrature detector output. The 'signal strength' was used to get an AM video - signal strength as a beam was scanned back and forth across the runway centerline, while the quadrature detector output was used to recover a DPSK header that identified the guidance function and provided some digital data. The beast was working, it just wasn't a log IF curve. Multipath rejection of the guidance was based on watching the -3 dB width of the beam over time. These non-linearities played havoc with that.

With that much gain, you obviously have to be careful on the design, but it was working. This was a fairly narrow bandwidth - the channels were 300 KHz apart, and I _think_ they were running this at 21.4 MHz.

Agreed

This was 25 to 30 years ago and something is telling me... I vaguely remember SL521 being the number, and google sorta agrees, though the company (Zarlink Semiconductor) is a total unknown to me. Yeah, and the SL1521 was the cheap version, though I see I made a mistook on the stage gain (12 db vs 20). Well, that's just more stages.

The big problem is what do you call accuracy? A 'watts-guesser' is probably OK to a couple of dB - certainly link performance isn't going to be that critical.

Way back in about 1960, I was an Air Farce radar type, and the specs on the APG-30 radar wanted you to get some value - I dunno, +33 dBm average sounds about right. The trouble was they boxes were built to just pass the factory tests, and when you got out into the field with the very abused RG9 coax between the directional coupler and the power meter... hate to think how many magnetrons we replaced because (while working OK) they failed to read what-ever on the bench. It didn't help that the NCOIC of the radar shop taught us to use "3 db" for that thar piece of coax. Having my 1st Phone with Radar endorsement at the time, I managed to get the cable calibrated by the instrument shop, at 9.375 KMC/s^W GHz... make that the second cable, because the first was to flakey to use. The loss was not 3.0 dB. Hmmm.

I haven't seen the databook in 20 years. You've got me.

Oh $DEITY yes! I think the attenuator was rated at 2 Watts, and I had some _much_ more healthy TWTs to play with. We normally ran ours with one of those little HP PIN diode limiters directly connected as a sacrificial device, but I tended to be extra cautious with it. Still, I did toast a microwave counter that way.

I had to do some digging into dusty corners to find it. In the early

1990s, I was using a GAsFET preamp from JCA Technology Inc., Camarillo, CA. They had a selection, and vaguely I was using a stock or semi-stock product that was 9.0 - 9.4 GHz. These were three channel matched sets with a PIN diode limiter on the front end, and my notes say it had 20 dB of gain and a 2.9 dB noise figure.

Had this as a problem even with the 8555. You could buy a tracking preamp (and vaguely this was in the replacement unit I got in 1991), but this cost several dB - I wanna say something like 4 or 5 dB - in sensitivity.

Tektronix 491 - cost half as much as the 8555, and came with a selection of N attenuators from 6 to 40 dB.

But the staff are relatively cheap to replace ;-) How many ovens are using a choke joint on the door I wonder? I know the old Amana's were doing so, as you could even force the door open slightly (sheets of paper between the door and frame) and not see a significant change on the leakage. The door gap was a quarter wave away from the face, and another quarter wave to the bottom of the channel.

Narrowing things down is going to increase the required scan time. Might be a viable trade-off - might not be.

This is life.

Old guy

Reply to
Moe Trin

Rob, Version 1.1 has just been posted. Instead of modifying the average (which will probably happen soon) a spectrogram view has been added, which shows the amplitude of each frequency over time. Right now it shows about two minutes worth of data in a waterfall view, but we will add the ability to adjust the time resolution, just wanted to get the initial version out and being used.

Ryan Woodings MetaGeek, LLC

Reply to
metageek

snipped-for-privacy@painkiller.example.tld (Moe Trin) hath wroth:

Lead lengths are way too long and will radiate. It has to be a tight layout. As I recall, the problem was that the CA8089 had so much gain, that it had to double and triple bypassed at several points. We also had to use shielded chokes. Shielding it just caused the shield to act as an antenna. Squirly little beast about a major advance in integration at the time.

Oh, I remember that app note. They bypassed everything to the power supply line rather than to ground. It would sorta work that way as a stand alone circuit, but as soon as implemented along with all the other leaky circuitry that sat on the same power supply, it would instantly go unstable. Someone in the lab actually built a prototype exactly per the app note and declared it worthless.

MLS system? Sounds familiar. I'll stand on my guess that the IF section was oscillating. The results were rather erratic AGC detected voltages. It could easily be seen on a spectrum analyzer attached to any unbypassed pin.

There's your problem. Nobody I knew could get it to work at 21.4Mhz. We were stuck with a dilemma in the marine radio biz. 10.7MHz was too low a frequency for a 156 to 163MHz receiver. Image rejection and spurious response was horrible with a 10.7 IF. However, none of the chips were stable at 21.4MHz, the next commonly available frequency. In addition, the fundamental mode 8 pole crystal filters of the time largely crapped out and jumped radically in price at about 15MHz. Another frequency had to be found.

At this point, one would assume that careful computer (Tymeshare) calculations and modeling were employed to select the IF frequency. Nope. It was a crisis decision that had to be made in order to get some parts on order so we could throw together a prototype. Sept 16 was someone's birthday, so it became 16.9Mhz. It turned out to be a rather bad choice as there were internal birdies on some of the international marine channels that later caused the 2nd IF to move from 455KHz to 446.25KHz. Sigh.

Anyway, at 16.9MHz, the CA8089 was fairly stable, and the crystal filter houses were willing to grind this frequency for not much more dollars than 10.7MHz.

It's a question of what is considered adequate accuracy. I'm used to Bird 43 wattmeters, with an accuracy of 5% of full scale. That means if I have a 100watt slug, the basic accuracy is 5 watts at any point on the meter. If the meter is reading 10 watts, then it could be anything between 5 and 15 watts. Yech.

It took me about 5 years to convert from cycles per second to Hz, and from micro-microfarads, to pico farads.

In the 60's, I was using 2K25 klystrons and 1N21/1N23 diodes. I still have my slotted line frequency meter and some ancient test equipment. Getting it to just work was considered adequate. If something useful could be measured, so much the better. Calibration was a luxury.

I still have all my design notes going back to about 1973. I can scan a copy of the data sheet if you want (please say no).

Those were nice but we didn't have any. The main problem we were dealing with was that the HP140T series of spectrum analyzers didn't have more than 60dB of dynamic range. We needed to see signals that were in the noise. So, we had some big cavities and tunable notch filters that would drop the carrier enough dB's to see into the noise. When doing so, one relys on the notch filter to actually do the notching or the full power of the xmitter appears on the spectrum analyzer input. The PIN diode limiters were nice, but I usually managed to blow up both the limiter and the front end mixer making the PIN diode limiter a marginal proposition. We kept score as to who did the most damage. I think I won in dollars category, but others blew up a wider variety of devices.

The entire door frame is a 3.12cm deep choke joint. However, without the slot type of construction, they still leak fairly badly. One of the fun tests is to put a 2.4Ghz cordless phone inside the oven, close the door, and hit the "call" button on the base. The phone will usually ring, which indicates the rather poor RF shielding.

I was going to suggest that the scan width be limited to one Wi-Fi channel instead of the entire band. Maybe down to a single 1Mhz wide RF channel, the minimum for the chip used. Then, a narrowing of the DSP IF should result in a substantial decrease in detected noise and an increase in dynamic range. There will be an increase in sweep time, but if the scan with and bandwidth reductions are kept proportional, the sweep time should remain constant.

Waiting for my consignment of "borrowed" SMA connectors so I can attach a connector to the Wi-Spy receiver and do some bench testing.

Reply to
Jeff Liebermann

Nice hack, though it needs more colors to show amplitude. And yeah, something about the average and peak lines on the time display, though I'm not sure what would be better...

Please don't call it 1.1, when it's 2006.1.5, it's hard enough to know that I'm at the latest rev (well, the "Update software" under help really helps.

Nice toy, mine just arrived, I loaded the latest software off the WWWeb and it fired right up! I need it for Monday for a client site, so I'm a happy camper!

Is there any firmware upgrade? I'm at 1.0

Reply to
William P.N. Smith

AGC wasn't used (needed that "log" function", and you're dealing with two or more transmitters time sharing the same frequency for azimuth and elevation guidance).

It's been quite a few years, but I don't recall seeing any indication, and we certainly would have been looking.

Well, MLS was 5.06 GHz - I know this was a double conversion, with the first IF around 160 MHz. (You're making me remember more about this than I thought possible - the second IF _was_ 10.7 MHz, not 21.4.) You'd have enjoyed seeing the mess they had for the first converter. The LO started life around 150 MHz, was doubled and sent to the remote antenna assembly. There, they had a power amp, which then kicked the snot out of a small varactor diode (Japanese, meant for UHF TV tuner) to get it up to 4.9+ GHz., and stuck that output into a 3 stage interdigital filter leading to the mixer. The RF in also hit an interdigital filter (4 stage as I recall), which was another part of the problem. You had an insertion loss, and the filter being printer circuit was not thermally stable. Bear in mind the active antenna (in a black radome no less) was to be mounted on top of the aircraft... sun loading? Wazzat? (You didn't want to mount it on the bottom of the aircraft, as that was usually oil smeared, and subject to propeller blown debris.) I'm intentionally not naming the company, but they really are a "solid" engineering outfit in spite of these interesting concepts. What I'm calling the "high cost" company's design was a triple conversion setup, with everything in a 1/4 ATR Short (ARINC) box - meaning they also had to pipe the RF from the antenna to the receiver. Remember what the loss of RG214 is at 5 GHz?

That's why the multiple conversion - the "high cost" house was using a stage or two at 220 MHz, dropping to 21.4, with the DPSK detection at 1.9 MHz.

Your channels were much closer together though, so you needed the selectivity. Ours were 300 KHz apart, and in principle, you wouldn't have another nearby transmitter on the adjacent three channels either way. Makes a difference.

Yeah, but I'm also used to having slugs for 10 and 30 Watts as well.

;-) (Hey, that was quicker than I did it.)

I dunno - how does a slotted line get out of (frequency) calibration?

No thanks. I'm trying to remember which box out in the garage has my old RCA and GE tube manuals.

I know your site is LearnByDestroying.com, but the government took a dim view of us torching their gear. Not that it didn't happen. It's just that they never were able to prove anything ;-)

I'm not sure I follow you. I mean something where there is a gap between the wall and door 3 cm long, then a slot back into the frame an additional

3 cm. The bottom of the slot is a half wavelength from the face of the 'joint'. The mechanical junction between the door and the frame is a quarter wave, which means it should disappear. (But yeah, I also recall that we had to make sure those bolts on the waveguide joints were tight even if they were choke joints.)

All of my cordless are 900 MHz, but that does seem rather shoddy. I'd expect that permitted leakage is down in the milliwatt range, meaning you'd want at least 50 dB. Depending how far you are from the base station, 50 dB isn't that big of a deal - that's a 300:1 in absolute range.

One is stuck with mathematical limitations as well as the desires of the user. I'm sure you recall the 2 seconds/cm sweep speed capability that you could even slow down further with the vernier. I used that capability doing surveys often enough looking at hilltop relay sites. Seems like all of the desirable places already have a ton of RF floating about.

I know the manufacturer has to do all they can to keep the costs down, but having it come with a connector and removable antenna is _so_ much more usable. Being able to install a directional antenna for testing would help.

Old guy

Reply to
Moe Trin

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.