Is it legal to own a transmit-capable SDR?

Owning one is legal in most countries. Transmitting is regulated: you generally need a licence (for example an amateur radio licence, used only within its rules) or must stay within the limits of licence-exempt bands, and some frequencies must never be transmitted on. Check your national regulator's rules before connecting an antenna to a transmitter.

Which SDR should a beginner buy?

A receive-only RTL2832U-based dongle from a reputable maker. It covers a wide range of the spectrum used by IoT devices, is supported by every major tool and costs little. Move to a wider-band or transmit-capable device only when a specific test requires it.

Can I test a wireless device without radiating anything?

Yes. Connect the transmitter and receiver with coaxial cable through suitable attenuators, or work inside a shielded enclosure. This keeps signals off the air, protects your SDR's front end and makes measurements repeatable.

Software-defined radio for security research

A software-defined radio (SDR) moves most of a radio's work into software: the hardware tunes, filters and digitizes a slice of spectrum, and your computer does the demodulation. For security practitioners, that means one device can observe the sub-GHz links used by alarm sensors and meters, look at the signals an IoT device emits, verify that a product uses the protocol its datasheet claims, or monitor the spectrum around a sensitive site.

This guide explains the specifications that matter, which class of device fits which task, and how to run a radio lab that stays within the law.

The specifications that matter

Specification	What it means	Why it matters
Frequency range	Lowest to highest frequency the tuner covers	Must include the bands of the devices you study (for example 315/433/868/915 MHz, 2.4 GHz, 5 GHz)
Instantaneous bandwidth	Width of spectrum captured at once (tied to sample rate)	Wideband protocols and frequency hopping need more bandwidth
ADC resolution	Bits per sample	More bits means more dynamic range: weak signals next to strong ones
Duplex	RX only, half duplex (RX or TX) or full duplex (both at once)	Full duplex is needed for some protocol emulation and measurement setups
TX capability and power	Whether and how strongly it can transmit	Regulated; powerful enough to cause interference if misused
Frequency stability	Oscillator accuracy (TCXO, external clock input)	Narrowband signals drift out of view on unstable clocks
Host interface	USB 2.0, USB 3.0, Ethernet	Limits sustained sample rate
Software support	Drivers for GNU Radio, SoapySDR, SDR++, GQRX	Determines what tools you can actually use

Device classes

The market falls into a few recognizable tiers. Specifications below are the manufacturers' published figures for common models.

Class	Example	Range (approx.)	Bandwidth	ADC	TX
Entry receiver	RTL2832U + R820T2/R828D dongles	~24 MHz to ~1.7 GHz	~2.4 MHz usable	8-bit	No
Improved receivers	Airspy, SDRplay families	Model-dependent, HF to ~1.7-2 GHz	Up to ~10 MHz	12 to 14-bit	No
Wideband half-duplex	HackRF One	1 MHz to 6 GHz	Up to 20 MHz	8-bit	Yes, half duplex, low power
Learning full duplex	ADALM-Pluto	325 MHz to 3.8 GHz stock	Up to 20 MHz	12-bit	Yes
Research full duplex	Ettus USRP B200 series, LimeSDR	~70 MHz to 6 GHz (B200 series)	Up to 56 MHz (B200 series)	12-bit	Yes

How to read this table:

For monitoring and learning, an entry receiver covers most IoT sub-GHz bands and costs far less than anything else.
For analyzing a device's transmissions across bands, including 2.4 GHz and 5 GHz, you need a wideband receiver.
For lab protocol testing where you must both receive and respond, a full-duplex device with good dynamic range is the tool, used on cable or in a shielded box.

Software

GQRX and SDR++: spectrum and waterfall views with common demodulators; the starting point for exploring.
GNU Radio: a flow-graph framework for building custom receivers and signal processing chains.
Universal Radio Hacker (URH) and inspectrum: capture, visualize and analyze digital signals; infer modulation, symbol rate and packet structure.
rtl_433: decodes hundreds of consumer sub-GHz devices (weather stations, sensors, tire pressure monitors).
Kismet with suitable adapters for Wi-Fi and Bluetooth monitoring (standard Wi-Fi and Bluetooth analysis is usually done with dedicated radios rather than general SDRs).

Quick checks with an RTL-SDR:

# Verify the dongle and check for dropped samples (Ctrl-C to stop)
rtl_test -s 2400000

# Decode sensors around 433.92 MHz for 60 seconds and print JSON
rtl_433 -f 433.92M -T 60 -F json

# Power survey from 400 to 450 MHz in 10 kHz bins for 5 minutes
rtl_power -f 400M:450M:10k -i 10 -e 5m survey.csv

Defensive uses

IoT procurement testing. Verify what a device transmits, how often, on which band and whether traffic appears to be encrypted or trivially repetitive. A sensor that sends identical frames for "armed" and "disarmed" is a design weakness worth raising with the vendor.
Regulatory and privacy checks. Confirm a product only transmits when it claims to.
Spectrum monitoring. Baseline the RF environment of a site to detect unexpected transmitters.
Training. Teach how modulation, encoding and framing work so engineers design better wireless products.

Receiving and analyzing signals from your own devices is standard practice. Interfering with, jamming, or replaying signals to devices you do not own, or intercepting communications not meant for you, is illegal in most jurisdictions and outside the scope of this site.

The legal guard rails

Rules vary by country, but a few principles are nearly universal:

Receiving is widely permitted, but many countries restrict the interception, use or disclosure of the content of private communications (for example cellular, private radio or encrypted traffic).
Transmitting requires authorization. That means an appropriate licence used within its rules, or staying within licence-exempt (ISM/SRD) band limits on power, duty cycle and permitted use.
Some bands are protected: aviation, maritime, emergency services, GNSS and cellular. Never transmit on them.
Jamming is illegal almost everywhere, including jamming your own devices over the air.

When unsure, consult the national regulator (FCC in the United States, Ofcom in the United Kingdom, ANFR/Arcep in France, BNetzA in Germany) or a lawyer.

RF lab setup

A small investment keeps experiments on the bench and your equipment intact:

Item	Purpose
SMA coaxial cables and adapters	Direct connection between transmitter and receiver
Fixed attenuators (for example 20 dB and 30 dB)	Protect receiver front ends; set realistic signal levels
DC block	Prevent DC on the line from damaging the SDR
50-ohm dummy load	Terminate transmitters without radiating
Shielded enclosure or RF test box	Test devices with their own antennas without radiating
Band-appropriate antennas	Better reception for monitoring
GPS-disciplined or external reference clock	Stable frequency for narrowband work

Most receive-only SDRs specify a maximum safe input power; a strong nearby transmitter or a direct cable connection without attenuation can exceed it and damage the front end.

Choosing, in short

Start with a reputable receive-only dongle and learn with GQRX, rtl_433 and URH.
Add a wideband device when your target bands exceed ~1.7 GHz or you need more bandwidth.
Add a full-duplex device only when a lab test requires transmit and receive together, and plan for cables, attenuators and shielding at the same time.
Keep a written record of what you transmitted, where, when and under which authorization.