🔎 Last updated · Editorial policy · Report an error
{
“@context”: “https://schema.org”,
“@type”: “Article”,
“headline”: “Decode ADS-B with dump1090 and Wireshark: Spoof-Test Your Own Aircraft Feed Safely”,
“description”: “Hands-on lab: capture and decode ADS-B with an RTL-SDR, dump1090, and Wireshark, then safely spoof-test your own feed to see why Mode S lacks authentication.”,
“publisher”: {“@type”: “Organization”, “name”: “Hmmnm – Cybersecurity Tutorials”, “url”: “https://hmmnm.com”}
}
TL;DR: Can ADS-B messages be spoofed, and how do you prove it safely?
Yes—ADS-B and its underlying Mode S protocol have no authentication or encryption whatsoever, and you can demonstrate this legally by injecting synthetic frames into your own local dump1090 feed without ever transmitting a single RF signal.
Aviation runs on trust. Every commercial aircraft in controlled airspace broadcasts its position, velocity, and identity on 1090 MHz, and every receiver—ground stations, other aircraft, hobbyist feeders—accepts those claims at face value. This is the same class of problem you see in unauthenticated industrial protocols; if you’ve read our coverage of ICS security, you know broadcast protocols without message authentication are an attacker’s gift that keeps giving. ADS-B is the aviation sector’s most consequential example, and today you’re going to prove it to yourself—legally, receive-only, on your own bench.
What you need: lab parts and legal guardrails
The hardware bill for this lab is trivially small:
- RTL-SDR dongle — any RTL2832U-based USB stick; the RTL-SDR Blog V3/V4 is the de facto standard (~$30–$40)
- 1090 MHz antenna — a dedicated 1090 MHz spider or a telescopic whip trimmed near resonance
- Linux host — physical or VM with USB passthrough; Ubuntu or Debian is easiest
- dump1090 — the open-source Mode S decoder (use a maintained fork like
dump1090-faordump1090_rs) - Wireshark — for inspecting the TCP streams dump1090 exposes
The guardrail matters more than the parts list. Receiving on 1090 MHz is legal essentially everywhere—it’s a broadcast downlink. Transmitting on 1090 MHz without an authorized test setup under your national regulator’s rules (FCC in the US, Ofcom in the UK, ETSI standards in the EU) violates radio regulations in virtually every jurisdiction, and doing it to simulate aircraft near an airport is the kind of thing that gets federal attention fast. Every technique in this article is receive-only or wired injection onto a private, disconnected network. There is no reason to touch a transmitter.
ADS-B and Mode S fundamentals for security practitioners
ADS-B (Automatic Dependent Surveillance–Broadcast) rides on top of the Mode S reply format, a protocol lineage reaching back to 1980s secondary surveillance radar. Aircraft transmit 112-bit extended squitter messages (Downlink Format 17, or DF18 for some equipage) on 1090 MHz, unprompted, roughly a few times per second plus position updates.
Each 112-bit frame packs a downlink format (DF) field, a capability field (CA), a 24-bit ICAO 24-bit aircraft address, and a 56-bit Main Extended Squitter (ME) field whose type codes (TC) tell you whether you’re looking at identification (TC 1–4), airborne position (TC 9–18), or velocity (TC 19). Position is encoded in Compact Position Reporting (CPR) format, which splits lat/lon across two interleaved message types.
Now the security-relevant fact: there is no MAC, no digital signature, no nonce, no challenge-response—nothing. An ADS-B message is a plaintext claim. Any receiver within radio range accepts any syntactically valid frame from any 24-bit address. Compare that to even the weakest authenticated protocol and the gap is stark: ADS-B isn’t poorly authenticated—it isn’t authenticated at all.
Setting up dump1090 on Linux with an RTL-SDR
Install dependencies and the decoder:
sudo apt update
sudo apt install git build-essential debhelper librtlsdr-dev libncurses-dev
git clone https://github.com/flightaware/dump1090.git
cd dump1090
make
Sanity-check the dongle first—this catches the classic DVB-T driver conflict where the kernel grabs the device before librtlsdr can:
sudo apt install rtl-sdr
rtl_test
If you see “Found 1 device(s)” and no throughput errors, blacklist the DVB modules (dvb_usb_rtl28xxu) if needed and move on. Then run dump1090 with networking enabled:
./dump1090 --net --gain 40 --interactive
The --net flag exposes the port family that makes this whole lab possible:
- 30001 — raw input
- 30002 — raw output (hex frames, one per line)
- 30003 — SBS/BaseStation formatted output (CSV-style)
- 30004 — Beast input
- 30005 — Beast binary output
Note that port 30001 is an input port. Remember that; it becomes the pivot for our safe spoof test later.
Capturing ADS-B frames into Wireshark
Wireshark can’t demodulate RF—that’s dump1090’s job. What Wireshark can do is inspect the TCP streams dump1090 publishes, which is exactly how professional ADS-B monitoring setups work anyway. Start a capture on the loopback interface and apply a display filter:
tcp.port == 30002 || tcp.port == 30005
On port 30002 you’ll see ASCII payloads like:
*8D48417D6201962C670C151B8CBE;
The 8D prefix is your first decode: bits 1–5 encode DF=17, and the CA field follows. 48417D is the ICAO address. Feed the Beast stream on 30005 through Wireshark’s “Follow TCP Stream” and you’re looking at framed binary ADS-B data traversing a network—which should immediately raise blue-team thoughts about feeders exposing these ports beyond localhost. A quick nmap -p 30001-30005 sweep of a feeder’s LAN is a five-minute audit; our TCP port security coverage applies directly here. The default bind on most dump1090 builds is listen-all—change it or firewall it.
Parsing a real frame field by field
Take the frame above: 8D48417D6201962C670C151B8CBE. Breaking it down:
- DF=17, CA=5 — extended squitter from an airborne transponder
- ICAO 48417D — a German-registered aircraft (Germany holds the 3C0000–3FFFF block; 48417D sits in the 400000–4FFFF range assigned to Spain—check the public ICAO allocation tables)
- ME TC=0x62>>3 = 12 — airborne position (barometric altitude) message
- CPR odd/even flag, lat/lon fragments, altitude bits — the position payload
CPR is worth understanding because it’s a neat compression scheme and a common CTF exercise: latitude and longitude don’t fit in 56 bits at useful resolution, so each position message carries a 17-bit encoded fragment—one “even” frame and one “odd” frame—and the receiver combines pairs captured within 10 seconds globally (for airborne messages) to recover an unambiguous position. An attacker learns all of this—identity, position, altitude—with zero handshake, zero credentials, and zero cryptographic verification. Passive collection is the attack surface.
Why Mode S lacks authentication: design context
This isn’t an oversight; it’s archaeology. Mode S was standardized in the 1980s as an evolution of secondary surveillance radar, when the threat model was interference and bit errors—not adversaries with software-defined radios. ADS-B was layered on in the 1990s and mandated for European airspace (by 2020 per the EU mandate) and US airspace under the FAA’s ADS-B Out rule, effective January 1, 2020. Crypto retrofits were discussed—the academic community has published authenticated variants repeatedly—but retrofitting message authentication to a global broadcast protocol means touching every transponder, every ground station, and every bilateral agreement in worldwide ATC. There are no session keys because there are no sessions. It’s a one-to-many broadcast designed for interoperability above all. CISA and aviation-security researchers have flagged ADS-B’s lack of authentication in multiple advisories and papers; the consensus is that the protocol’s insecurity is structural, not patchable, and mitigation happens at the sensor and correlation layer instead.
Spoof-testing your own feed safely (no RF transmission)
Here’s the payoff, and it requires no transmitter at all. dump1090 accepts raw frames on TCP port 30001. Connect to it and write hex frames:
nc 127.0.0.1 30001
*8D406B902015A678D4D220AA4BDA;
That’s it. Your dump1090 web map now shows an aircraft that does not exist. Alternatively, replay recorded SBS data—capture an hour of real traffic on port 30003, then replay it at nc 127.0.0.1 30003 (or to a separate aggregator instance) and watch ghost tracks reappear on a private feed. Tools like dump1090‘s own test harnesses and the pyModeS Python library (from the Junzi Sun / TU Delft research line) let you synthesize DF17 frames with arbitrary ICAO addresses and CPR-encoded positions.
The security lesson lands immediately: the receiver cannot distinguish a synthetically injected frame from a demodulated one, because there is nothing to distinguish. You’ve demonstrated the acceptance of ghost aircraft end-to-end while remaining entirely on loopback.
What a transmitted spoof would look like (theory only)
For completeness: an adversary with an SDR capable of transmission (a HackRF or bladeRF class device) and libraries that generate Mode S baseband could emit DF17 frames claiming an arbitrary ICAO address, position, and altitude. Since ADS-B receivers prioritize signal strength and validity checks—not authenticity—a sufficiently strong signal wins. This is why glyph-injection attacks against air traffic displays have been demonstrated by researchers at universities and think tanks, and why agencies including CISA and the FAA treat it as a known risk. We will not provide transmission instructions. Doing this without a licensed experimental authorization is illegal in essentially every jurisdiction and near real infrastructure it’s reckless in ways that outstrip ordinary radio violations. Your loopback lab proves the same architectural point with zero risk.
Detection and mitigation for blue teams
If the protocol can’t be fixed at the wire, detection moves to the correlation layer. Practical controls:
- Multilateration cross-check — MLAT derives position from time-difference-of-arrival across multiple receivers; a spoofed aircraft’s claimed position won’t match its physics-derived position. If your feed aggregator supports MLAT, enable it and compare.
- Plausibility filtering — flag impossible speeds, altitude/vertical-rate inconsistencies, position jumps exceeding aircraft performance envelopes, and ICAO addresses outside allocated national blocks.
- Multi-sensor agreement — ghost aircraft appear on exactly one receiver; real aircraft appear on many with consistent timing. Consensus scoring across independent sensors is the workhorse defense.
- Monitor your own receivers — unusual frame rates, duplicate ICAO addresses with divergent positions, or messages arriving on your input ports when nothing should be sending are red flags. Treat 30001–30005 like any other management interface: localhost binding, firewall rules, no internet exposure.
Practice lab: CTF-style challenges and next steps
Once the base lab works, level up:
- Identify the odd aircraft: inject three synthetic frames with one ICAO address outside any allocated block; find it using the ICAO allocation tables.
- Replay a track: capture 30 minutes of SBS output and replay it into a private aggregator; verify the tracks render identically.
- Compute CPR yourself: decode a position pair by hand or with
pyModeSand verify against dump1090’s output. - Build the detector: write a script that flags ICAO addresses seen from only one of your two (virtual) receivers—you’ve now built a toy multi-sensor spoof detector.
Verdict: what this lab proves about ADS-B security
Two hours and $40 of hardware gets you end-to-end proof that the aviation surveillance system your flight data depends on accepts unauthenticated claims by design. ADS-B isn’t broken—it was never secured. The defenses that matter are multilateration, plausibility checks, and sensor consensus, all of which you can prototype on your bench. Keep exploring RF security from the receive-only side: our SDR and ICS security guides are the natural next stops, and the academic literature on ADS-B authentication (starting with the well-known cost analyses of crypto retrofits) will fill in the protocol politics this article skipped.
Frequently Asked Questions
Is it legal to spoof ADS-B messages?
No. Transmitting on 1090 MHz without authorization violates national radio regulations (FCC, Ofcom, and equivalents worldwide), and transmitting spoofed aircraft data near real infrastructure can trigger serious enforcement. Safe testing stays on local feeds—loopback injection into dump1090’s input port or SBS replay on a disconnected network.
What hardware do I need to capture ADS-B?
An RTL-SDR USB dongle (RTL2832U-based, ~$30) with an antenna resonant at 1090 MHz, plus a Linux host running dump1090. That’s the entire receive chain.
Does ADS-B use encryption?
No. Mode S extended squitter messages are broadcast in the clear with no MAC and no signatures. The protocol inherits its unauthenticated design from 1980s-era secondary surveillance radar, and no session keys exist because the architecture is broadcast-only.
How do receivers detect spoofed aircraft?
Through cross-validation: multilateration compares claimed positions against time-difference-of-arrival physics, plausibility filters catch impossible performance envelopes, and consensus across multiple independent sensors exposes ghosts that appear on only one receiver.
Can Wireshark natively decode ADS-B?
Not the RF itself. Wireshark inspects the TCP streams dump1090 exposes (raw hex on 30002, Beast binary on 30005, SBS on 30003); frame decoding is done by dump1090, or by ADS-B dissector scripts and libraries like pyModeS operating on the captured payloads.
Related reading
- Exploit BOLA and IDOR in Your Own MCP Server: A Burp Suite Agent-Tool Lab
- Anatomy of a Modern SOC: Alert Triage, Tiering and the Metrics That Expose Real Gaps
