Tutorial DECT cordless phones

Tutorial: DECT cordless phones

What it is. DECT is the cordless phone standard. A base station sends a beacon in every 10 ms frame, and handsets answer in time slots. In Europe the ten carriers run from 1881.792 to 1897.344 MHz. OnAir finds base stations from those beacons and shows their identity, level and burst activity.

Read this first. Activity and signalling only. Calls are encrypted; the voice is not decoded, nothing is sent, and OnAir does not try to break the encryption. Base station identifiers belong to people's homes and offices; do not publish them. Check your local rules. See Legal and Privacy.

What you need

• A radio that tunes about 1.9 GHz and runs at 5 Msps or more (the mode asks for 5 Msps; the lowest working rate is 4.608 Msps). An RTL-SDR (R820T, about 24 to 1700 MHz) cannot tune 1.9 GHz, and the tuner then says so using the radio's own range (and a converter, if set). A HackRF, PlutoSDR, LimeSDR or BladeRF reaches it, per the project documentation.
• A 1.9 GHz antenna.
• Frequencies: the ten European carriers 1897.344 MHz (channel 0) down in steps of 1.728 MHz to 1881.792 MHz (channel 9; the database lists them). The other DECT bands in the panel are the plans of the region.

Before you start

Use moderate gain; a phone in the same room is very strong. A base station transmits a beacon continuously on at least one carrier, so it is easy to find.

Step by step

1. In the mode list open IoT & sensors and choose the DECT entry (DECT cordless phones and base stations).
2. Pick a radio that reaches 1.9 GHz and start the receiver at 5 Msps or more.
3. In the Band list choose the band: Europe 1880-1900 MHz (default), US / Canada 1920-1930 MHz (DECT 6.0), Brazil 1910-1920 MHz, Latin America 1910-1930 MHz or US ISM 902-928 MHz (DECT in ISM). The carriers of the band appear as buttons you can press to tune them.
4. Press Scan band to step through the carriers (1.5 s each; it stays on one while bursts are heard). It becomes Stop scan.
5. Choose the view: Base stations or Bursts.

What you should see

Base stations appear with their RFPI (the identity), the manufacturer code and system number, level, slots used and the system-information tails. In Bursts you see base and handset bursts.

Reading the screen

• Base stations: RFPI, Bases, Heard, level (dBFS) and slots.
• Bursts: UTC, From (base or handset), Content, Tail.

Options and settings

Band, Scan band, Clear. A synthetic source can be chosen to try the screens.

Band notes from the project documentation: all DECT carriers lie on one 1.728 MHz raster at 1.152 Mbit/s GFSK. US / Canada DECT 6.0 is 1920 to 1930 MHz (5 carriers, 1921.536 to 1928.448 MHz). Brazil is 1910 to 1920 MHz (5 carriers, 1911.168 to 1918.080 MHz). Latin America 1910 to 1930 MHz (11 carriers). The US ISM entry (902 to 928 MHz) is for the rare standard DECT in ISM; products sold as 900 MHz or 2.4 GHz cordless phones are usually not DECT and are not decoded. "DECT 6.0" is 1.9 GHz, not 6 GHz.

Troubleshooting

• The tuner says the radio cannot tune this. Use a radio that reaches 1.9 GHz.
• Nothing heard. Check the band for your country and try Scan band.
• Very few slots shown. Some bases only transmit a beacon until a call is made.
• A "900 MHz" phone is not found. It is probably analogue or a proprietary system, not DECT.

Tips

Start a call on a handset to see the call slots appear in Bursts.

Legal and privacy notes

Never try to listen to calls; they are encrypted and not decoded here.

Under the hood

ETSI EN 300 175-2: 10 ms frames of 24 slots, GFSK at 1.152 Mbit/s, carriers 1.728 MHz apart. The RFPI is the base station's radio fixed part identity.

Related

Mode-DECT-cordless-phones, Tutorial-Bluetooth-LE, Tutorial-Zigbee-802-15-4, Modes, Main-window, Supported-radios, Troubleshooting, FAQ, Legal.