OnAirDecode Wi-Fi HaLow (802.11ah) with an SDR
Wi-Fi HaLow / 802.11ah: the long-range sub-GHz networks around you from their beacons (receive only, no decryption).
- Group
- IoT & sensors
- Start frequency
- 863.5 MHz
- In the mode list
- IoT, sub-GHz
What Wi-Fi HaLow (802.11ah) is
Wi-Fi HaLow is IEEE 802.11ah, Wi-Fi in the sub-GHz bands (863 to 868 MHz in the EU, 902 to 928 MHz in the US). OnAir lists the networks from their open beacons, as a Wi-Fi list does.
Frequencies and settings
Sub-GHz S1G channels of 1, 2 and 4 MHz: 863 - 868 MHz (EU) and 902 - 928 MHz (US), one channel at a time or scanning the region's channel list, 4 Msps (1 and 2 MHz channels also from 2.4 Msps, an RTL-SDR).
| Start frequency | 863.5 MHz |
|---|---|
| Tuning range of the mode table | 755 to 928 MHz |
| Sample rate asked | 6 Msps |
| Lowest working rate | 2 Msps |
| Channel width | 4 MHz |
OnAir takes any frequency you type; the numbers above are the mode's starting point and the range its table describes. In the app the shortcut label is IoT, sub-GHz.
What OnAir shows
A table of the networks around from their S1G beacons and probe responses: SSID (full, or resolved from the compressed SSID), BSSID and vendor, S1G channel and frequency, bandwidth, MCS, the security type the network announces (WPA2-PSK, WPA3-SAE, OWE, open: information only), beacon interval and level, plus a live frame log and a frames-per-second plot. The preamble (short training field) is detected at every width, the SIG field is read and checked, and BPSK 1/2 frames (how beacons are sent) are decoded and FCS-checked; frames at faster rates are only counted. Legality: receive only. OnAir never transmits, probes, associates or joins a network, and it does not decrypt anything or try keys; it reads what a network broadcasts openly, as a phone's Wi-Fi list does. Receiving is legal in most places but the rules differ: check them where you live. Written from the published standard and tested only on its own synthetic signal, no live 802.11ah recording yet.
The mode's own tab has these views: Networks, Frames. The other tabs (Overview, Receiver, Scan, History) are described on the main window page.
Limits and what it was checked with
Checked with generated signals and impairments; recordings of real signals welcome.
Which radio you need
This mode sits at a high frequency, so check that your radio tunes it: a HackRF covers 1 MHz to 6 GHz, and RTL-SDR stops near 1.7 GHz. Some modes at these frequencies also need a fast radio (10 to 20 Msps) or a dish and an LNB.
Receiving and the law
Questions about Wi-Fi HaLow (802.11ah)
Can I decode Wi-Fi HaLow (802.11ah) with an RTL-SDR?
Probably not: an RTL-SDR tunes up to about 1.7 GHz. A HackRF (1 MHz to 6 GHz) or another wideband radio is the usual choice for this frequency range.
Is it legal to receive Wi-Fi HaLow (802.11ah)?
This mode is passive. It only receives, never connects, pairs or joins networks, and never decrypts payloads. Check the rules where you live.
Can I try Wi-Fi HaLow (802.11ah) in OnAir without a radio?
Yes. Most modes include a built-in synthetic test signal, so you can open the screen and try the controls before you own a radio.