Tutorial DJI drones

Tutorial: DJI drones (wideband links and DroneID)

What it is

DJI drones use wideband OFDM links on 2.4 and 5.8 GHz. OnAir looks at the bursts and classifies them by shape (OcuSync-like, Lightbridge-like or unknown OFDM), with a confidence and a clear note that this is a guess from the signal. Some DJI models also broadcast DroneID, which OnAir can decode to the serial number, position, home point and pilot position as sent in the clear. Receive only. The encrypted video link is never decoded.

What you need

• A radio that samples 16 Msps or more: HackRF at 20 Msps, Pluto, bladeRF or USRP. Airspy R2 (10 Msps) and Mini (6 Msps), RTL-SDR and Airspy HF+ cannot run it fully; 40 MHz links can only be seen in part. See Supported radios.
• A 2.4 or 5.8 GHz antenna.
• Frequencies: the mode starts at 2440 MHz and the table spans 2300 to 6000 MHz with a 20 MHz channel. A drone must fly and transmit inside the 20 MHz you tuned.

Before you start

Understand what you can claim: a shape classification is not an identification. Only a DroneID packet that passes its CRC identifies a drone. DroneID is broadcast only by some models and firmware; many drones, and all new ones that DJI has changed, may not send it in this form.

Step by step

1. Choose the group Aviation, entry Drones, 2.4 / 5.8 GHz (mode DJI drones).
2. Tune 2440 MHz or any frequency where a drone may transmit, with 20 Msps. Use the filter choices to narrow what you want: "OcuSync-like only", "Lightbridge-like only", "Wi-Fi-like only", "DroneID only", "DroneID with Wi-Fi collisions", or "everything".
3. Tick Decode DroneID if you want packets decoded. A "DroneID bursts without the first symbol" option handles the Mavic 2 and older OcuSync drones.
4. Press Start. The panel is headed SIGNALS.

What you should see

Nothing until a drone flies nearby. Then wideband bursts appear in Signals, with width, period, duty cycle and class. A DroneID packet adds a row in DroneID.

Reading the screen

• Signals: Class, Frequency, Width, Period, Duty, Conf. (confidence) and Last seen.
• DroneID: Serial, device type, Position, altitude and height, speed and heading (raw), home point, pilot (phone or controller), GPS time and the check state ("inner CRC-16 ok" or "inner CRC-16 differs (the CRC-24 passed)"). Copy position copies a position; the panel offers a link to open the Drone Remote ID mode.
• Bursts: the burst train with a level-over-time chart (one point per 0.25 s with a burst) and the noise floor. "ZC found, CRC failed" and "tried, no ZC symbols" tell you how far the decoder got.

Troubleshooting

• "no wideband burst yet": no drone is transmitting inside the tuned 20 MHz, or the gain is wrong.
• Bursts but no DroneID: the model does not broadcast it, or the signal is weak. Wi-Fi collisions: choose "DroneID with Wi-Fi collisions".
• Class keeps changing: it is a guess; treat it as a hint.
• Radio too slow: you need 16 Msps or more.

Tips

Run the Drone Remote ID mode too: it covers the legally required broadcast.

Legal and privacy notes

DroneID contains the pilot's location. Use it only for lawful purposes such as detecting a drone in your own airspace; do not publish or pass on a person's position. Receiving may be restricted in some countries. OnAir does not send drone operator locations to the public map. See Legal and Privacy.

Under the hood

DJI DroneID (the OcuSync 2 broadcast): OFDM symbols with Zadoff-Chu roots 600 and 147, turbo-coded payload, CRC-24 (and an inner CRC-16). Wideband bursts are classified from width, burst period, duty cycle and cyclic-prefix correlation.

Related

DJI drones mode page, Tutorial: Drone Remote ID, Live map.