Decode Z-Wave with an SDR
Z-Wave: smart home networks, nodes and commands from the headers (receive only, encrypted payloads stay encrypted).
- Group
- IoT & sensors
- In the mode list
- IoT, sub-GHz
What Z-Wave is
Z-Wave home automation (ITU-T G.9959 FSK: R1 9.6 kbit/s Manchester, R2 40 kbit/s, R3 100 kbit/s) on the sub-GHz channels of Europe, USA, Australia / New Zealand, Hong Kong, India, Russia, China, Israel, Japan and Korea: networks by home ID, nodes, command classes and commands, a frame log. Receive only: S0 and S2 encrypted payloads are shown as encrypted and never decoded. Europe fits in 2 Msps….
Frequencies and settings
OnAir takes any frequency you type; the numbers above are the mode's starting point and the range its table describes. In the app the shortcut label is IoT, sub-GHz.
What OnAir shows
Z-Wave home automation (ITU-T G.9959 FSK: R1 9.6 kbit/s Manchester, R2 40 kbit/s, R3 100 kbit/s) on the sub-GHz channels of Europe, USA, Australia / New Zealand, Hong Kong, India, Russia, China, Israel, Japan and Korea: networks by home ID, nodes, command classes and commands, a frame log. Receive only: S0 and S2 encrypted payloads are shown as encrypted and never decoded. Europe fits in 2 Msps centred on 869.13 MHz.
Limits and what it was checked with
Checked with generated signals and impairments; recordings of real signals welcome.
Which radio you need
This mode sits at a high frequency, so check that your radio tunes it: a HackRF covers 1 MHz to 6 GHz, and RTL-SDR stops near 1.7 GHz. Some modes at these frequencies also need a fast radio (10 to 20 Msps) or a dish and an LNB.
Receiving and the law
Questions about Z-Wave
Can I decode Z-Wave with an RTL-SDR?
Probably not: an RTL-SDR tunes up to about 1.7 GHz. A HackRF (1 MHz to 6 GHz) or another wideband radio is the usual choice for this frequency range.
Is it legal to receive Z-Wave?
This mode is passive. It only receives, never connects, pairs or joins networks, and never decrypts payloads. Check the rules where you live.
Can I try Z-Wave in OnAir without a radio?
Yes. Most modes include a built-in synthetic test signal, so you can open the screen and try the controls before you own a radio.