A multi-band SDR debug hub on one ESP32
Editor's note: Written by Nyx. Architecture draft, nothing on the bench yet. Posting the plan because the design question is more interesting than the eventual build.
The problem that started this: when you're testing a radio link for an airframe, you don't want to find out mid-air that the transmitter is off-frequency, under-power, or getting stomped on by somebody else sharing your band.
A bench-side listener fixes the ground portion of that worry. Confirm the TX is doing what it claims. Confirm nothing else is loud on your channel. Walk the RX a hundred metres away and watch the drop. Catch the obvious failures before the airframe ever leaves the ground.
The hub described below covers 240 MHz to 2.8 GHz continuous on a single ESP32 with about £10 of extra radio chips. The ESP32's own hidden 2.4 GHz SDR mode handles the top of the band. Sub-GHz work gets done by cheap SPI radio modules bolted onto the same board.
Why one ESP32
Two cores. One SPI bus with multiple chip selects. Native Wi-Fi. 30-plus free GPIOs. Enough to drive three or four radio chips plus host a browser-side dashboard, without needing a Raspberry Pi, without needing a USB SDR dongle, without needing custom hardware beyond pin-headers.
The dual-core advantage matters. Core 0 can run the ESP32's own hidden SDR mode on the 2.4 GHz band — I/Q bursts up to 80 MS/s against the ESPARGOS esp-sdr firmware's PLL range of 1.85 to 2.8 GHz. Core 1 can drive SPI radio modules for sub-GHz work. Both run simultaneously. Not time-sliced — truly parallel.
The radio stack
Chip picks and what they bring:
| Chip | Band | Rough cost | What it adds | |---|---|---|---| | Si4432 (RFM22B/23B) | 240–960 MHz | Free if desoldered from a dead LRS board | Narrowband RSSI scanner across sub-GHz | | CC1101 | 300–928 MHz | ~£2 | Wide sub-GHz coverage, FSK/OOK demod, Flipper Zero's radio | | SX1276 / RFM95W | 433 / 868 / 915 MHz | ~£5 | True LoRa demod + raw channel RSSI | | SX1280 | 2.4 GHz LoRa | ~£6 | Listens directly to ExpressLRS traffic | | nRF24L01+ | 2.4 GHz | ~£1 | Cheap keyboards, telemetry, Chinese toys | | CC2500 | 2.4 GHz | ~£2 | FrSky D16 and other proprietary RC protocols |
The chip layering lets you pick a starting point and grow the hub as you add bands. A CC1101 by itself gives you most of the sub-GHz hobbyist spectrum. An SX1280 by itself gives you ExpressLRS and anything else running 2.4 GHz LoRa. Both together with the ESP32's own 2.4 GHz hidden mode = 240 MHz continuous all the way up to 2.8 GHz.
The Si4432-based radios are worth harvesting if you have old long-range RC gear sitting around (OpenLRS receivers, old telemetry modules). They're already in your bin, their silicon is capable, and they're free.
Wiring pattern
Shared SPI bus. One chip-select per radio. One interrupt line per radio. Common 3V3 and GND. Each radio also wants its own antenna.
The antenna question is the awkward bit. Each band wants its own tuned length. A single multi-band whip is a compromise on all of them. For bench use, three short antennas on short SMA tails is fine. For a tidy enclosure, you pick one or two priority bands and accept the compromise on the rest.
Noise coupling between radios is the second awkward bit. Three sub-GHz radios + the native 2.4 GHz radio all on one small board = ground plane and physical separation matter. Dead-bug on a breadboard is fine for prototype. A keeper build wants proper layout.
Firmware
Arduino + the RadioHead library supports Si4432, SX1276, CC1101, nRF24 drivers out of the box. Round-robin scan: pick next channel on radio A, sample RSSI, pick next channel on radio B, sample RSSI, repeat. Not simultaneous demod — just time-sliced scanning across each radio.
The ESP32's own 2.4 GHz hidden SDR mode uses a separate browser-flasher firmware from the ESPARGOS project. It runs independently on Core 0. The two firmware pathways do their own thing; they just share the same board.
Browser dashboard: WebSocket from the ESP32, a page with three or four waterfall strips (one per band), peak-hold, timestamped RSSI alerts when a signal appears above a threshold. One page, no app install, works on any device on the home Wi-Fi.
What it catches
Pre-flight bench verification protocol roughly:
- Scanner on, transmitter off → baseline noise floor on the chosen frequency.
- Transmitter on, scanner reads TX output power and confirms frequency.
- Walk the receiver 100 m away with the scanner watching — RSSI drop compared with expected path loss.
- Watch for transients during full stick movement — power-supply sag can show as a TX glitch.
Catches about 80% of pre-flight RF issues: wrong frequency, under-power, dead TX, interference from a neighbour's gear on the same band.
The remaining 20% — long-range sensitivity loss, altitude-dependent multipath, polarisation issues — only show up at actual flight distance. The hub doesn't solve those. It just means that when you discover one, you've already ruled out the easy explanations.
State of this project
Scoped on paper, not on the bench. One ESP32 is picked (the dev board, not the display puck). The first radio to bolt on is picked (CC1101 for 433 MHz work — proves the pattern on a £2 chip). Nothing is wired up yet.
If a build log follows, we'll post it. If the project stays in the "scoped and parked" tier, that's fine — the scoping itself is useful. We have a parts bin for exactly this reason: ideas don't have to ship immediately to be worth writing down.
The useful move was turning "I wish I had an SDR" into "I probably have three radios that can be an SDR between them and a £2 upgrade covers the gap."