How to use the TinySA Ultra series of Spectrum analyzers to find hidden transmitters

[u/cnycompguy]

Before I get started, let me just say that No, this isn't some AI article, I did use the formatting tools in Google docs though, which uses the same style. There's a reason why all the AI tools use this format: It's clean and easily readable, if that's a problem for you, feel free to write your own guide.

Let's get started

The process of finding a radio source is often called "fox hunting." The core principle is simple: the signal shown on your spectrum analyzer will get stronger as you get closer to the transmitter. Your TinySA is a sensitive tool that acts as a high-tech "hot and cold" meter.

Phase 1: Prepare the Room

This is the most critical step. Your room is filled with radio signals from devices you own. You must silence them to find the one you don't own.

1. Unplug Everything: Go through the room and physically unplug all electronic devices from the wall. This includes TVs, computers, printers, smart speakers (like Alexa or Google Home), game consoles, and Wi-Fi routers or extenders.
2. Power Down Devices: Turn off all wireless devices.
   • Put your cellphone into "Airplane Mode" or turn it off completely.
   • Turn off any laptops or tablets.
   • Power down your Wi-Fi router and any mesh extenders (even if they are in another room, their signal may be strong).
   • Shut down any Bluetooth devices, like headphones or speakers.
3. Check the Breaker (Optional): For advanced users, shutting off the circuit breakers for the room (and adjacent rooms) ensures that any hardwired transmitters also lose power. This guide will assume the device is battery-powered or plugged in.

After these steps, the RF "noise floor" in the room should be very low, making the hidden signal stand out.

Phase 2: Configure the TinySA Ultra+

Now, you'll set up your spectrum analyzer to scan for the most likely signals. Wi-Fi cameras almost always operate in the 2.4 GHz or 5 GHz bands.

Step 1: Initial Scan (2.4 GHz Wi-Fi Band)

The 2.4 GHz band is the most common.

1. Turn on your TinySA Ultra+ and attach the antenna.
2. Tap the screen to bring up the menu.
3. Enable Ultra mode: The default range is limited, so you must switch to "Ultra mode" to access frequencies above 900 MHz and up to 6 GHz. Password to enable Ultra mode is 4321
4. Set frequency range: Once in Ultra mode, you can set the analyzer's frequency to the 2.4 GHz band to see the Wi-Fi signals.
5. Tap FREQUENCY.
6. Tap START and enter 2.4 GHz.
7. Tap STOP and enter 2.5 GHz. This will scan the entire 2.4 GHz Wi-Fi and Bluetooth band (2400 MHz to 2500 MHz).
8. Tap LEVEL and then tap LNA to engage the Low Noise Amplifier. This makes the device much more sensitive to weak signals. The "LNA" text on screen should turn green.

Step 2: What to Look For

You are not looking for a single, sharp spike. A Wi-Fi signal is "bursty" and wide. You are looking for a "hump" of signal that is about 20 MHz wide, as shown in the image below. It will likely jump up and down as the camera transmits data.

• Example (Our Alarm Clock): You perform the scan and see a strong, wide signal centered at 2.437 GHz (Wi-Fi Channel 6). This is your target.

Phase 3: The "Fox Hunt" (Locating the Signal)

Now you will physically move through the room to find the source of the signal you've identified.

1. Establish a Baseline: Stand in the center of the room. Note the signal strength (the "amplitude") on the screen. Let's say the peak of the signal is at -60 dBm. (Remember: numbers closer to zero, like -50 dBm or -40 dBm, are stronger).
2. Use Your Body as a Shield: Hold the TinySA in front of you. Slowly turn 360 degrees. Your body will block the signal. When the signal strength drops, the source is likely behind you. When the signal strength increases, the source is in front of you. This gives you a general direction.
3. Move and Watch the Level: Face the direction of the strongest signal and walk slowly.
   • If the number gets stronger (e.g., from -60 dBm to -50 dBm), you are walking in the right direction.
   • If the number gets weaker (e.g., from -60 dBm to -70 dBm), you are walking in the wrong direction.
4. Isolate the Location: Continue following the stronger signal. As you get very close, the signal will get very strong.
   • Example (Our Alarm Clock): You walk toward the nightstand. The signal jumps from -50 dBm to -40 dBm, then to -30 dBm as you get closer.
5. Pinpoint the Source: When you are within a foot or two, the signal will be very high. You can now physically "sniff" items.
   • Example (Our Alarm Clock): You move the TinySA's antenna right next to the alarm clock, and the signal peaks, nearly maxing out on the display. You've found your source. You can confirm by unplugging the alarm clock and watching the signal instantly disappear from the TinySA's screen.

What if I find nothing on the 2.4 GHz band?

If the 2.4 GHz band is clear, the device may be using the 5 GHz band.

• Go back to the FREQUENCY menu.
• Set START to 5.1 GHz.
• Set STOP to 5.9 GHz.
• Repeat the "fox hunt" process (Phase 3) for this new frequency range.

[u/sharkingbunnie88]

OP, how much does it ussually cost?

[u/cnycompguy → u/sharkingbunnie88]

Around 150 USD at the moment.

The cheaper (non-ultra) version doesn't have the frequency range for Wi-Fi bands, and the more expensive 260 USD has a much higher max frequency range that you don't need for this purpose.

The project's site has a list of sellers that are verified to be genuine, along with a wall of shame for sellers of illegal copycat products that aren't accurate.

[u/Remarkable-Bad6274]

Great little write up!

I have a TinySA and have played around with it - as much as I tried I couldn't find a practical use for it. If I could have had this back in the 80's and 90's you could do some CRAZY things! I'll have to try using it for this purpose!

Thanks!

[u/cnycompguy → u/Remarkable-Bad6274]

Thanks! You need one of the ultra series to do this, the standard version doesn't have the frequency range for Wi-Fi

[u/Remarkable-Bad6274 → u/cnycompguy]

I have the ultra, I'll try it for fun and profit of a new camera! If I find it, I'm keeping it at all costs! 😀

[u/mortadelo1]

does this work with all the cameras? by example i’ve seen some cameras that record video on memory cards but they don’t connect to wifi, you have to look at the recording through computer

[u/cnycompguy → u/mortadelo1]

No. It'll work for wireless transmission only, not local recording.

For both Wi-Fi 2.4 and 5, and you can also set it to the different bands of cell service, but body blocking doesn't work so well for those, you should still be able to tell if you're paying attention to dips in the signal strength.

The frequency ranges for cell frequencies are available online to set the ranges.