(for any questions not answered hereunder, please refer to RTL1090 FAQ on https://rtl1090.jetvision.de)
Last revised: 19 MAY 2013
3. Using the app
3.1 Set up Planeplotter or another decoding software
3.2 Buttons and sliders
3.4 Status bar
3.5 List display during operation
3.5.3 Abbreviated flight list
4.1 Data formats
4.2 UDP data concentrator mode
4.3 Port assignments
4.4 Multilateration with Planeplotter
4.5 Port 30003 style TCP socket
4.6 Serial number programming and selective dongle operations
RTL1090 is a non tunable 1090 MHz receiver app for Mode-A/C or Mode-S
Mode-A/C and Mode-S cannot be output at the same time, however multiple apps/dongles can be chained.
RTL1090 has a strict format requirement that avoids high traffic loads and pipeline overload from too many garbage packets.
– TCP server with Planeplotter etc. compatible output format (Beast or AVR)
– Multi-dongle chained operation
– Log features
– Multilateration capability with Planeplotter-
– Selective dongle operations
E4000* or R820T and RTL2832U USB DVB-T Dongle
*ATTENTION: not all these devices cover 1090 MHz. You can explore the edges of your devices frequency coverage by using the MAX/MIN button after the
device was started.
– Download the “Zadig” installation package from
Vista, Win 7, Win 8 ONLY
For Windows XP ONLY:
– Plug-in your USB-TV-Stick, ignore and abort driver installation messages.
DO NOT INSTALL ANY DRIVER THAT MAY HAVE COME WITH THE DONGLE (on CD etc.)
– Execute “zadig.exe”
– Install the WinUSB driver and the driver for “Bulk-In Interface (Interface 0)”
(A more comprehensive list of installation instructions is here:
The installation MAY only be valid for one specific USB slot.
If you use another slot later you MAY need to repeat the installation later.
– Download and unzip the RTL1090 application files to a directory of your
– Download this file
and unzip and copy rtl-sdr-release/x32/ rtlsdr.dll, msvcr100.dll and libusb-1.0.dll
to your RTL1090 application folder
The following files should be in your folder now:
Now execute rtl1090.exe.
The application opens a TCP server on port 31001 (for the first dongle) and this will be
queried by the Windows Firewall. To run rtl1090 together with
Planeplotter this needs to be acknowledged.
For a quick start select RTL AGC and TUNER AGC.
This is the best setting for best range.
If you encounter doughnut problems from nearby targets, then switch
off TUNER AGC and select a high (if not the highest) gain value.
Several dongles can be operated in parallel by multiple instances of RTL1090.
Usually there is no need to re-install the ZADIG driver for each dongle/USB slot,
just plug-in the dongle and start another instance of the RTL1090 app.
The dongle should be found and connected automatically.
I do not know in which order dongles are enumerated, so I believe the device ID is in
order of instance starts.
TCP server ports: for a specific instance the port number is 31001 + n x 10.
I.e. device 0 is port 31001; device 1 is port 31011, etc. The current TCP
server port is shown in the status bar.
UDP receiver ports: for a specific instance the port number is 31002 + n x 10.
I.e. device 0 is port 31002; device 1 is port 31021, etc. The current UDP
receiver port is shown in the startup list.
If you start multiple instances from the same folder the same settings will
be used and the last settings of any instance will be stored in the same settings
file. It is highly recommended to use different folder for multiple instances.
All port assignments may be overwritten – see section 4
RTL1090 does not use the registry and any other folder outside its native app folder. You can delete the app folder and deinstallation is complete.
RTL1090 offers a choice of parameters to operate the app from a batch file.
The select parameter should be added to a Windows commandline or a Windows short cut icon caller entry, e.g.
“rtl1090 /run /min”
The order of parameters is of no relevance.
– “/run” automatically starts the app after a few seconds
– “/min” minimizes the app to systray after start
– “/ascii” Beast ASCII output format
– “/avr” outputs data at TCP port in AVR format instead of Beast binary format (supersedes “/ascii”)
– “/log” creates a logfile from the list display
Note: Logs are stored in the app folder when list refreshes. Please also note that list display and/or
log files slow down the system considerably and packets may get lost during thiskind of operation
– “/portbase=31020” sets a fixed port for TCP and UDP other than the default one (see chapter 4)
– “/udptarget=31110” sets a fixed port for the UDP chain target app (see chapter 4)
– “/multilat1” – enables Multilateration operation with Planeplotter
– “/30003” – the Basestation compatible TCP socket is hosted at port 30003
– “/eeprom” – enters EEPROM serial number programming mode (supersedes all other options)
– “/nohttp” – disables the internal HTTP data server
-“/ser=1” – the app runs with this serial number only, see section 4.6
– “/noupdate” – disables update checks
When starting by pressing the START button some parameters from the dongle(s) connected are displayed in the list display.
Special consideration should be taken for the following bold lines
rtl1090 V 0.3.0.57 (c) jetvision.de 2012
2 RTLSDR device(s) found. (at least 1 dongle must be found)
Index:0; Mfr:”Realtek”; Prod:”00000013″; Ser”:”
Device:”ezcap USB 2.0 DVB-T/DAB/FM dongle”
TCP server port opened: 31001
UDP receiver port opened: 31002
UDP target is: 127.0.0.1:31012
Device opened: “43843400” (anything else but a device opened message is a fatal error)
Tuner type: “Rafael R820T”
RTL Xtal Freq: “28800000 Hz”
TUNER Xtal Freq: “28800000 Hz”
Mfr:”Realtek”; Prod:”00000013″; Ser”:”
Gain: 0 dB
Sample rate: 2000000 S/s
RTL AGC set ON
Gain: 0 dB
Freq correction: 0 ppm
Freq set: “1090000000 Hz” (a freq set error means the dongle cannot set 1090 MHz, use the max/min test)
Refer to the FAQ to sort out other discrepancies.
The list display will be set to the last mode after the startup sequence was completed (LIST on or off).
If you want to view the start-up messages in detail then
– disconnect the antenna or
– minimize the gain
– press the LIST button, then
– restart the dongle
Alternatively set the “/log” command line parameter, restart the dongle and view the log file.
Please reconsider that the list display may slow down data acquisition and data packets may get lost.
If the app is minimized to systray the list display is halted automatically and max performance is available, except for “/log” is selected, in which case the list display continues and is saved to a log file periodically.
2.3 Max/min test
A test can be executed by pressing the MAX/MIN button at any time after the dongle has started operation. This test evaluates the boundaries of the reception range of your particular dongle. The result will be displayed in the list when the LIST button is ON, e.g. typical result for R820T tuner
Searching frequencies…please wait…
Lowest tuner freq set: “2010 kHz”
Highest HF freq set: “1769000 kHz”
Max/min/gap search completed…
The test is available for E4000 or R820T dongles only.
rtl1090 opens a TCP socket at port 31001 (for the first dongle and port 31001 + deviceID x 10 for other dongles)
In Planeplotter set “Mode-S receiver | Beast receiver | Setup TCP client” to IP
and this port 31001 -> 127.0.0.1:31001
Select “Mode-S/ADS-B” and “RTL DONGLE” in I/O dialog
(if you use the AVR data format then enter to
“Mode-S receiver | AVR receiver | Setup TCP client” and
select “Mode-S/ADS-B” and “AVR receiver TCP” in I/O dialog)
Press green button and wait for green led in rtl1090
A graphical description is available from the RTL1090 FAQ page
Number of valid data packets per sec
Data sent/received to/from UDP concentrator device
Client connected to 30003 type TCP socket
Planeplotter has connected on TCP port 310×1
A client has connected to the HTTP data server. The LED is red if the response is invalid.
– Number of USB data packets received. Should be ca. 492 for Mode-S, 502 for Mode-A/C
NOTE: if this number is significantly higher or lower or fluctuating your system has problems coping with the USB data rate of 32 MBit/s. Closing other apps may help.
– Number of valid data packets sent to Planeplotter
NOTE: RTL1090 does a strict pre-validation of data packets to not overload the data pipeline to the TCP port
– Automatic threshold in dB and as absolute [value] in hex, range 00…B5
NOTE: this threshold is determined contnously from the actual data stream
– Number of airplanes on list
For LIST=ON Mode-A/C
data are presented in a pseudo AVR formatted line. This is for
The signal strength of the data packet is shown in [ ] in decimal figures.
The possible range is from 00 to 255.
Mode A and C replies cannot be distinguished. However if a code falls into an allowable range of altitude between 0 and 47000 ft as FL indication will presented in ().
Note that any altitude data are always QNE, i.e. at 1013 mb
Consecutive codes of the same value are not displayed as a list entry, but as a dot.
For LIST=OFF a list of received Mode A/C codes will be shown. This list will be updated every 2 seconds. Codes timeout after 60 seconds.
3.5.2 Mode-S ([LIST] on)
Mode-S data are presented in a pseudo AVR formatted line. This is for information only. Contrary to the true AVR format the data packet is CRCed and the last three bytes are xored with the CRC.
The signal strength of the data packet is shown in  in decimal figures. The possible range is from 0 to 255.
If the LIST button is off, an abbreviated colored flight list will be displayed:
ICAO – 24 bit aircraft address in HEX
c/s – callsign
ALT..MCP – altitude (flight level) in 100 feet and selected altitude from MCP panel
V/S – vertical speed in 100 feet/min
GS – ground speed in knots
TT – true track in degrees true
SSR – Mode A squawk
G – on ground
* – position available
o – odd CPR position data available only
e – even CPR position data available only
~ – position timed out/lost
4 – BDS4,0 EHS reply seen
5 – BDS5,0 EHS reply seen
6 – BDS6,0 EHS reply seen
^ – DO 260A/B DF17 format seen:
DO260A/B format indicators:
Due to different font pages on Windows PCs the indicators may be different.
A indicator line is printed during the start up messages in the list, just before
the message “Started…”.
“DO 260A/B symbols: ” – Left to right is up to down in the above table.
The list will be updated every 2 secs
Inactive aircraft will be delete after 1 min.
Output data format on TCP port
rtl1090 uses the Beast binary data format
<0x1a> <“1”> 6 byte MLAT, 1 byte signal level, 2 byte Mode-AC
<0x1a> <“2”> 6 byte MLAT, 1 byte signal level, 7 byte Mode-S short frame
<0x1a> <“3”> 6 byte MLAT, 1 byte signal level, 14 byte Mode-S long frame
<0x1a><0x1a> true 0x1a
Signal level: 00..FF hex
As an command line option (“/ascii”) rtl1090 can use the Beast ASCII output format
<@><12 HEX BYTES MLAT COUNTER><4 OCTAL or 14 or 28 ASCII HEX BYTES><;><CR><LF>
As an command line option (“/avr”) rtl1090 can use the AVR ASCII output format
<*><4 OCTAL or 14 or 28 ASCII HEX BYTES><;><CR><LF>
MLAT: the counter has a resolution of 500 ns for Mode-S
Multiple dongles can be operated by RTL1090 in parallel on one or multiple computers. However, usually the display programs like Planeplotter can accept data from one data source only. Therefore RTL1090 can be operated in a chained mode, where one instance of RTL1090 serves as a concentrator and TCP server and all other instances send their data packet to this particular instance.
By this means you can combine traffic from several dongles in Mode-S or Mode-S and Mode-A/C combined.
Inter-instance data traffic uses UDP to avoid unnecessary protocol overhead. It is primarily intended to be used for same computer setups. However, the setup may be extended to between different PCs. In this case firewall considerations may apply.
To avoid unnecessary problems with the display app use the same data output format for all chained apps (either Beast or AVR).
Setup of concentrator
No special consideration is necessary for an RTL1090 app that runs as a concentrator and TCP server.
Whenever the concentrator receives traffic arrives from other clients its YELLOW LED is lit.
Setup target IP and port on UDP clients
For this purpose a dialog can be opened from the UDP CONF button. Enter the target IP and port of the concentrator here. Please be aware that this assignment may be overwritten by RTL1090 to avoid circular data conflicts. See section 4.3.
Enable traffic to concentrator
Press the UDP SEND button. Outbound traffic is announced by an ORANGE LED.
RTL1090 will assign ports automatically even in a multi-dongle environment.
To avoid circular data conflicts ports may be reassigned automatically from time to time.
Port assignments can be overridden by command line entries. A circular data conflict protection may be lost in this case.
Assignment rules as they apply:
– First RTL1090 instance gets DeviceID=0
– Second RTL1090 instance gets DeviceID=1
– Auto TCP server port assignment is PORT=31001 + DeviceID x 10
– Auto UDP concentrator inbound port assignment is PORT=31002 + DeviceID x 10
– Auto UDP concentrator outbund port assignment is PORT=31002 + ( DeviceID +1 ) x 10
– Auto 30003 style TCP socket port asignment is PORT=31004 + (DeviceID x 10)
Example for first RTL1090 instance:
TCP = 31001
UDP inbound = 31002
UDP target = 31012
TCP 30003 style = 31004
Example for second RTL1090 instance:
TCP = 31011
UDP inbound = 31012
UDP target = 31022
TCP 30003 style = 31014
UDP targets can be overwritten manually in the target dialog.
When RTL1090 is started from batch the assignment of the DeviceID may not be consistent. To ensure a reliable environment ports and targets can be assigned manually by command line parameters.
ATTENTION: circular data conflict protection is lost in this case
Numbering rules remain unaffected, i.e. TCP server is always portbase + 1, UDP concentrator port is always portbase + 2
Command line parameter:
– “/portbase=21100” – This sets the port base to 21100. I.e. the TCP server of the app would operate at port 21101 and the UDP concentrator port at port 21102.
– “/udptarget=40900” – This sets the UDP target port to 40902
This version includes support for Andys RTL1090 utility driving the RTL dongle.
You will find the RTL dongle selection at the end of the list of receiver types
in the PlanePlotter..Options..I/O settings dialog.
If you have build 62 of RTL1090, the RTL dongle can also be used as a Ground
Station. To do that, you have to start RTL1090 with the following command line
to turn on the time tags that are required for Mlats.
Having started RTL1090, make sure that you see the remark :
in the data box and then press the Start button.
If you want to automate the starting of RTL1090, you can use the command line :
“/multilat1 /run /min”
which enables the Mlat clock, starts processing and minimizes the RTL1090
In PlanePlotter, as well as defining the receiver type as “RTL dongle”, to be a
Ground Station you will also need to enable “Raw data” – both in the
PlanePlotter..Options..I/O settings dialog.
You can then start PlanePlotter processing and you can try performing the GS/MU
test in the Help dialog (PlanePlotter..Help..Test networking) to check that raw
data is being provided.
Please bear in mind that the RTL dongle cannot perform as well as a dedicated
Mode-S receiver but with a price tag that may be less than a tenth of other
receiver types, it enables you to try the system with your own local data.
This socket operates by default on port 31004
(resp. 31014, 31024 etc). A cyan LED shows when a client is connected.
A total of 5 clients can be served at a time.
Command line switch “/30003” can override the default port setting to port 30003,
but be sure no other application (e.g. Basestation) has port 30003 opened at the same
This socket is widely compatible to Basestation TCP port 30003 format, with the
– The socket will deliver data in Flight Table mode only. This is to protect system performance
– For performance reasons the socket sends data only every two seconds for each
aircraft in the flight table. Only the most up-to-date message per message type
will be sent, if this message was updated since the last transmission. However the latest even and the latest odd position messages can be both be sent.
The following deviations from Port 30003 standard format exist:
– STA => only RM, OK and AD submessages are sent
– SEL, CLK => not sent at all
– Session, aircraft and flight database fields are filled with 111,1111,111111
s as in Planeplotter
– Time is in full seconds only
– GS and True Track are in full knots/degrees only
– DF18 TIS-B modes may not be supported
Entry of a Home Position (optionally for port 30003 messages only)
The home position can be entered in the [CONFIG] dialog. Entry of a home
position accelerates aircraft position finding. Just copy your entry from
Planeplotter into the fields of the Config dialog.
The use of the home position can be disabled, e.g. for mobile use,
by unchecking the [USE] box.
For airport use of RTL1090 the surface position cannot be determined unambigously
without entry of a home position. Without a home position aircraft surface positions
may be displaced by 90°, 180° or 270° of longitude.
This chapter is only interesting to those users that operate more than one dongle
intheir installation AND want to assign specific RTL1090 instances to a specific dongle
and/or a specific TCP port. If you operate one dongle only, this chapter does not
contain any additonal information.
1) (Re-)Programming a serial number
R820T dongles come with a serial number “13” usually
– I strongly recommend not to alter the serial number of the first dongle you
operate. Leave it at “13”
– For any other dongles that you want to operate select a serial number of your
choice between 0 and 999
– It is strongly recommended to note the serial number on the dongle, e.g. with
– To reprogram a serial number disconnect all RTL2832U devices from your computer.
Then reconnect the dongle that you want to program.
– Close all open instances of RTL1090, then restart RTL1090 with command line
option “/eeprom”. All other options can remain in your command line, but will be ignored during
– START RTL1090 as usual
– From the dialog change the serial number to your desired value.
– Acknowledge disclaimers or abort as desired
– Once reprogramming is completed or aborted, close RTL1090. Remove the “/eeprom” option from
the command line
2) Operating with select serial numbered devices
Create icons for your dongles that you want to run with RTL1090 simultaneously. Setup
the start-up data for each icon individually, so that the icons will start their individual
Enter the serial number into your command line after the switch “/ser=”. E.g. a dongle with
serial number 14 would get a “/ser=14” entry.
For the typical R820T dongle (the one you have not touched) the command line entry would be “/ser=13”
If you want to assign a specific TCP root port to a specific RTL1090 use the “/portbase=” option
First dongle command line: “C:/dongle/rtl1090.exe /ser=13 (more options…)”
Second dongle command line: “C:/dongle/rtl1090.exe /ser=14 (more options…)”
Effective version 100 RTL1090 contains a comprehensive HTTP server configuration in order to draw Mode-S and ADS-B data from other user-made applications.
The HTTP server provides data for its RTL1090 instance only. Data received from other instances by UDP are not provided. However multiple RTL1090 instances can be interrogated by their individual HTTP server.
The HTTP server is available at port number “Portbase + 8”. I.e. in default installations the port number is 31008. In multiple installations without assignment of a dedicated portbase the port number is 310×8, where x is the number of the installation.
If you access the server from an outside network it may be necessary to open your local firewall for the assigned port. The server access uses http or TCP protocol only.
The HTTP server is enabled by default. It can be disabled on program start by command line option “/nohttp”.
The server sends valid data only if
- MODE-S button is pressed
- LIST button is not pressed
I.e. the server does not deliver data in Mode A/C mode or when the list display is showing messages.
The server is active without restrictions when the application is minimized.
The server provides data on a HTTP request to one of four tables. The tables are organized as if they were folders on the server and can be called by their name.
By default these table calls are, e.g. for a local installation:
- Table 1: http://127.0.0.1/somename1
- Table 2: http://127.0.0.1/somename2
- Table 3: http://127.0.0.1/somename3
- Table 4: http://127.0.0.1/somename4
“somename1” aso. are arbitrary table names assigned when RTL1090 version >=100 is launched for the first time. These names are selected in order to inhibit outside server access for existing installation.
Table names can be changed in the RTL1090 CONFIG dialog at the users discretion, e.g. they can be remembered easily. The maximum length of a tablename is 8 characters. Only A-Z, a-z and 0-9 are allowed to be part of the tablename.
It is strongly recommended to select the table names properly if you operate RTL1090 on a public network. You should consider them as being a password to your installation.
If an unknown table name was addressed the server responses with a default message:
Good day, this is your RTL1090 V 18.104.22.168 web server. You have requested page /tablex, which is not recognized. We wish you a nice day. All rights reserved (c) jetvision.de 2013
If Mode-S is not selected or RTL1090 is in the list mode, then ther server responds with: NODATA
Valid responses consists of ASCII data string packets with ":" as a separator between data fields. Each ASCII data string represents one active flight from the RTL1090 flight table. ASCII data strings are separated by an ASCII line feed character. Sample - Table1: BER411:::3C6305:53.52958:10.263250:F103:332:340:-23:7652::TEST THY2QG:::4BAA4E:53.72831:10.372063:F070:301:293:-13:6617::TEST :::440529:::::::::TEST NAX2MC:::478760:53.83859:10.764011:F350:204:420:0:0740::TEST For data field definitions please refer to the Table 1 directory here. Sample - Table2 (line feeds inserted into strings for better readibility): 3C6305:A-:BER411:0:5:0:0:7652:53.60700:10.192801:8:0:F084:8375:0:0:-450::0:-2112:-21::331: 328:0:279::344:492:0:0:0:30::1007:0::0::::0:0:0::0:3:0:5:17:1:1:1:0:0:0::::1:1:9:1:1351:1: 3:7:::1::::7:5:7:9:9:21:::1363505819:58:TEST 4BAA4E:A-:THY2QG:0:5:0:0:6617:53.75102:10.308891:8:2:F058:5800:0:0:-375::0:-1536:-15::302:294: 0:250::289:424:0:0:0:40::1007:0::0::::0:0:0::0:3:0:5:17:1:1:1:0:0:0::::3:7:19:13::17:17:25::: 13::::7:19:7:21:19:33:439::1363505817:56:TEST 440529:::0:5:0:0:::::2:F094:9400:0:0:-350::1:-1856:-18::314::0:287::353::::::::::0::::0:0:0:: 0:3:0:5:17:0:0:0:0:0:0::::17:47:377:33:1365:258:309:311:::47::::331:309:349:309:377:860:::1363505803:42:TEST For data field definitions please refer to the Table 2 directory here (Part I) and here (Part II).
Not all Mode-S and ADS-B packets are unambiguously defined at this time. Transponder standards differ significantly across the world airplane fleet. To enable users in observing and decoding data formats that are not properly decoded by RTL1090, table 3 provides a collection of undecoded packets for flights for who at least one of those packets were observed.
Sample – Table3
7805A9::80818330901B071EF7E5B11AD1B7::::: For data field definitions please refer to the Table 3 directory here.
Table 3 displays data packets in hex ASCII format, each 28 bytes long.
The following packets are presented:
- DF17, 18 19 (ADS-B message): any packet with a format type other than 0 to 19, 28, 30, 31
- DF16 (ACAS long air-air message): any packet received
- DF20, 21 (Mode-S EHS message): any packet that was not identified as BDS 2,0, 4,0, 5,0, 6,0
Table 4 shows configuration data for the current RTL1090 installation and can be used for rempote debugging purposes.
If you are planning to use the tables 1-3 for your own software please note that the current format version of each of these tables is presented by table 4.
(c) jetvision.de 2012, 2013