GNU Radio module for La Crosse weather stations.
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.


A sample GNU Radio based application for listening to a Lacrosse weather station with an RTL-SDR. The design is more intended to be intuitive to new users, instead of a tested and proven application.

Example scripts are also provided for transmitting using an Ettus B200.


For Transmitting

Packet Structure

Packets contain a 24 bit ID, the temperature, a checksum, and a few unknown fields. In detail below:

  • Access Code: 0x10 (First 2 MSB don't quite get sent)
  • Preamble: 0xaaaaaaaa
  • ID: 24 bits (Least sig. nibble seems to decrement on subsequent powerups)
  • ???: 4 bits
  • Temp Scale: 4 bits
  • Temp: 8 bits (Approx 0.06 C per bit)
  • ???: 8 bits
  • Checksum: 8 bits
  • Postamble?: 0xaa00

Checksum is CRC-8-Dallas/Maxim


Monitoring the temperature sensor with an RTL-SDR:

Not much visual feedback implemented. Haven't done any range testing. I now have a DC block to help for tuning offsets.

cd ./apps

2015-12-24 11:14:47.410101
Packet:   2dd49466376a95

ID?       2dd494
Cfg?      0x66 (Temp Scale: 6)
Temp:     0x37 ( 55)
Humidity? 0x6a (106)
Checksum: 0x95 (149) [ crcmod not present ]

23.6 C / 74.4 F

Monitoring the temperature sensor with a .cfile capture:

If you have a capture you want to analyze, you can use the following program. The default setup expects the capture file to be tuned to 915 MHz, with a sample rate of 1 MSPS. These variables can be modified on the command line. Use --help to see more options.

cd ./apps
./ -f <your_cfile>

Spoofing packets with a USRP B200

This works intermittently. Using the burst tagger from gr-mac has dramatically improved reliability, although some temperatures don't want to print. The scale is also off... so 40.0 F shows up as 40.2 F.

The La Crosse WS-9160U-IT looks for sensors the first ~2 minutes after boot. During this time, will sporadically work and set the temperature. However, after the ~2 minute period, the receiver only listens at ~15 sec intervals. My guess is if you aren't transmitting exactly when it's listening, your packet gets dropped.

Perhaps, at 1 minute, the station starts looking at 920 MHz... more later.

cd ./apps
# This starts the USRP host, and listens for packets
./ &

# This builds and sends a packet to the host, which is then transmitted
# over 915 MHz
./ 73.2

Getting this to work with other hardware!

It shouldn't be too difficult to make hardware like the HackRF and bladeRF work with this radio as well. Look at examples/temp_mon.grc as a reference implementation. You may need to add gain control specific to your radio, or add an offset tune to avoid the DC Spike. Please submit a pull request if you get it working!