Application Note
Using Handheld Spectrum
Analyzers to Find Hidden Signals
Introduction
High performance handheld spectrum analyzers are ideal for detecting and locating hidden transmitters because
you can easily carry the instrument when hunting for the transmitter and use it to find many types of hidden
transmitters that may be difficult or impossible to even detect with lower performance tools.
Figure 1. Anritsu Handheld Spectrum Analyzer, MS2725C, 9 kHz to 32 GHz
Placing a bug near a high level signal can be a very effective way to make it very difficult to detect. There are
several potential reasons for this. Most handheld spectrum analyzers exhibit fairly poor phase noise
characteristics. These phase noise skirts are very effective at hiding a transmitter. Failure to have sufficiently
narrow resolution bandwidth filters makes it impossible to detect signals close to a strong carrier. The ability to
sweep quickly also provides major benefit since you can to a wide sweep without taking a long time. For example,
you can use the Anritsu MS2722C to get a 9 GHz sweep in less than 0.5 seconds. Those limitations in many
instruments make them ineffective for finding this sort of hidden transmitter.
Since sweep speed is often a big concern, a new way of sweeping was developed for the C- and E-series of
spectrum analyzers. It is called “Fast Sweep” and delivers sweep times that increase only slightly as the resolution
bandwidth is narrowed. As an example, for a 500 MHz span this table shows the sweep speeds for the Fast mode
on the MS2722C and MS2713E and the traditional sweep speed on an MS2721B. All other settings are at their
default values. You will note that the sweep time for a 1 kHz RBW on the MS2722C is 15 times faster than the
sweep time on the MS2721B, a major speed advantage.
RBW
MS2722C Sweep time
MS2713E Sweep time
MS2721B Sweep time
3 MHz
135 ms
254 ms
102 ms
1 MHz
133 ms
625 ms
203 ms
300 kHz
133 ms
1.88 s
912 ms
100 kHz
332 ms
608 ms
2.9 s
30 kHz
532 ms
1.99 s
18 s
10 kHz
900 ms
3.97 s
16.6 s
3 kHz
2s
16 s
51 s
1 kHz
9s
33 s
143 s
With a spectrum analyzer with low phase noise you can search for signals near a strong carrier with confidence
that such a transmitter can be found. For example, if a bug is placed very near the carrier of a strong AM signal,
a spectrum analyzer with poor phase noise will not be able to see it.
Here is a narrow band view of an AM signal shown with 3 different resolution bandwidths.
Figure 2. Effects of narrow RBW limitations.
By using 1 Hz RBW, the blue trace, It is not only easy to see power-line related sidebands, but if there is a signal
hidden in the area between the carrier (on the left edge of the screen) and the 60 Hz hum sideband, it would be
easy to see. The area from the AM carrier at the left edge of the screen and the 60 Hertz hum sideband would be
invisible to a handheld instrument with lesser phase noise performance, limited dynamic range or limited resolution
bandwidth choices.
Figure 3. Close-in AM signal measurement made using a 1 Hertz resolution bandwidth.
The carrier is at the left edge of the screen.
2
If the narrowest available resolution bandwidth were 100 Hertz, or even 30 Hz, there would be no way to make
this measurement. Even a 10 Hertz RBW isn’t good enough to do the job. See figures 2 and 4.
Figure 4. AM carrier measured with 10 Hz RBW
You need wide dynamic range so you can detect tiny signals in the presence of huge signals. In this measurement
the 60 Hz delta marker is at -70 dBc, beyond the dynamic range of many handheld instruments. This is important
because there may be large signals near the frequency of a hidden transmitter.
Flexibility in the selection of resolution bandwidth and video bandwidth are important for hidden transmitter hunting.
You can use a wide resolution bandwidth to go fast during an initial sweep for a hidden transmitter and if
necessary you can use a narrow resolution bandwidth to get a low noise floor. With the new fast sweep
capabilities of the MS272xC and MS271xE you can get a low noise floor (great sensitivity) without having to suffer
through very long sweep times.
As shown in figures 5 and 6, by using narrow video bandwidths you can smooth out noise on a trace and makes
signals near the noise floor more visible, that way you can be sure they are real signals, not just random noise
spikes. On the live trace the signal in figure 5 was bouncing up and down just like the noise was doing. It would
not be spotted as a signal.
Figure 5. Small signal can’t be seen with the default VBW
Figure 6. Narrow VBW clearly reveals the signal
There are several detector choices in Anritsu handheld spectrum analyzers. Of these, the peak, minimum and
average detectors are useful for hidden transmitter hunting. These detectors can be combined with several trace
display choices to help discover signals that are trying to hide.
The instrument usually makes several measurements made at slightly different frequencies for each display point. The
number of measurements depends primarily on the RBW and the span. There are 551 data points across the screen;
to make sure that there are no gaps in the frequency coverage, there are enough measurements taken so all
frequencies in the span are measured. The number of measurements needed to do this depends primarily on the
resolution bandwidth. The measurements are placed in one of the 551 display “buckets” for processing.
3
The detectors process the collected data points in different ways. The Peak detector displays the maximum signal for
each display point, the Minimum detector displays the smallest signal for each display point while the RMS Average
detector calculates and displays the average signal level for each display point.
There are several ways that trace data can be handled in the instrument. By combining the ways traces can be
displayed with the detector options, you have a very flexible instrument that can be set to help sort out the interesting
signals from all the rest. The trace options are Normal, Max Hold, Min Hold & Average, copy trace A to trace B, copy
trace A to trace C, swap traces B and C.
You can use trace math functions to subtract one trace from another. This can sometimes reveal hidden signals,
especially if one of the traces is a max hold trace and the other is a min hold trace. Using trace math you can have
the instrument subtract Trace B from Trace A (or subtract Trace A from Trace B) and show the results in Trace C.
You can combine the peak detector with the Min Hold trace setting. By doing this, signals that are present
continuously will remain visible while signals that come and go will drop away. By combining the peak detector with
the Max Hold trace setting any signal that is observed, even once, will remain visible. This can be a good way to
catch bursty or intermittent signals.
Figure 7. Peak Detector with Max hold
Figure 8. Peak detector with Min hold
You can combine the negative detector with the Min Hold trace setting. Signals that are present continuously will
remain visible while signals that come and go will drop away. For this to work, the signal that you are interested in
must be continuously above the noise floor. The noise floor tends to drop by about 15 dB for a reasonably wide
video bandwidth allowing you to see signals that are otherwise buried in the noise.
Figure 9. Negative detector with Max hold
4
By combining the negative detector with the Max Hold trace setting, any signal that is observed, even once, will
remain visible. This is a good way to catch bursty signals and is also useful for spectrum usage surveys. The
noise floor tends to be about 3 dB lower than with peak detection, giving a minor sensitivity advantage. The
spectrum shown in figure 9is occupied primarily by repeaters that are on the air for relatively short periods of time.
With this method it is easy to see all the signals that popped up, even briefly.
These two methods works best with reasonably wide video bandwidths – meaning a video bandwidth that is equal
to or greater than the resolution bandwidth. The larger noise variation is an advantage in this case since the
variation causes the max hold or min hold to get to stable values more quickly, thereby revealing steady-state
signals that are otherwise hard to see because of the noise.
In summary, here are the steps to detect small signals
1. Turn on the preamplifier
2. Use a smaller number of dB per division
3. Use Averaging
4. Use a linear display choice – watts or volts to make differences bigger
5. Use trace math to make signals more obvious
Here is an example where there might be something there.
Figure 10. There might be a small signal there.
First, turn on the preamplifier. This lowers the noise figure significantly – as much as 25 dB for some instruments.
Figure 11.With the preamplifier on the signal can be seen.
5
You can use trace averaging or a narrower video bandwidth to clean up the noise. Generally the net sweep speed
will be faster by using a narrower video bandwidth rather than taking several sweeps when averaging.
Figure 12. Trace averaging helps to clean up the trace
Use a narrower video bandwidth to further clean-up the noise. This doesn’t improve sensitivity, but does smooth
out the noise floor, making small signals more obvious.
Figure 13. Narrow video bandwidth also helps clean up the trace
Spread out the signal vertically by changing the scale to 5 dB per division. While this doesn’t improve sensitivity,
it makes small signals “pop out” more.
6
Figure 14. Use smaller scale such as 5 dB/division to spread out the signals vertically
If you want to strength the signal out even more you can Use the volts or Watts linear display choices to make
small variations stand out more.
Figure 15. Using a linear scale such as volts or watts per division can be used
to make smaller signals pop out of the noise more.
With the tips given in this application note, you will be able to make more effective use of the capabilities built into
your Anritsu handheld spectrum analyzer to do spectrum surveys and find signals that may difficult to see otherwise.
7
Anritsu Corporation
5-1-1 Onna, Atsugi-shi, Kanagawa, 243-8555 Japan
Phone: +81-46-223-1111
Fax: +81-46-296-1238
• U.S.A.
Anritsu Company
• Italy
Anritsu S.p.A.
• India
Anritsu Pte. Ltd.
India Branch Office
Via Elio Vittorini, 129, 00144 Roma, Italy
Phone: +39-06-509-9711
Fax: +39-06-502-2425
3rd Floor, Shri Lakshminarayan Niwas, #2726, 80 ft Road,
HAL 3rd Stage, Bangalore - 560 075, India
Phone: +91-80-4058-1300
Fax: +91-80-4058-1301
• Sweden
Anritsu AB
1155 East Collins Boulevard, Suite 100,
Richardson, TX, 75081 U.S.A.
Toll Free: 1-800-ANRITSU (267-4878)
Phone: +1-972-644-1777
Fax: +1-972-671-1877
Borgafjordsgatan 13, 164 40 KISTA, Sweden
Phone: +46-8-534-707-00
Fax: +46-8-534-707-30
• Finland
Anritsu AB
• Canada
Anritsu Electronics Ltd.
700 Silver Seven Road, Suite 120, Kanata,
Ontario K2V 1C3, Canada
Phone: +1-613-591-2003
Fax: +1-613-591-1006
• Brazil
Anritsu Electrônica Ltda.
Praça Amadeu Amaral, 27 - 1 Andar
01327-010 - Bela Vista - São Paulo - SP - Brasil
Phone: +55-11-3283-2511
Fax: +55-11-3288-6940
• Mexico
Anritsu Company, S.A. de C.V.
Av. Ejército Nacional No. 579 Piso 9, Col. Granada
11520 México, D.F., México
Phone: +52-55-1101-2370
Fax: +52-55-5254-3147
• U.K.
Anritsu EMEA Ltd.
200 Capability Green, Luton, Bedfordshire LU1 3LU, U.K.
Phone: +44-1582-433280
Fax: +44-1582-731303
• France
Anritsu S.A.
12 Avenue du Québec,
Bâtiment Iris 1-Silic 638,
91140 VILLEBON SUR YVETTE, France
Phone: +33-1-60-92-15-50
Fax: +33-1-64-46-10-65
• Germany
Anritsu GmbH
Teknobulevardi 3-5, FI-01530 VANTAA, Finland
Phone: +358-20-741-8100
Fax: +358-20-741-8111
• Denmark
Anritsu A/S (for Service Assurance)
Anritsu AB (for Test & Measurement)
Kirkebjerg Allé 90 DK-2605 Brøndby, Denmark
Phone: +45-7211-2200
Fax: +45-7211-2210
• Russia
Anritsu EMEA Ltd.
Representation Office in Russia
• P. R. China (Hong Kong)
Anritsu Company Ltd.
Units 4 & 5, 28th Floor, Greenfield Tower, Concordia Plaza,
No. 1 Science Museum Road, Tsim Sha Tsui East,
Kowloon, Hong Kong, P.R. China
Phone: +852-2301-4980
Fax: +852-2301-3545
• P. R. China (Beijing)
Anritsu Company Ltd.
Beijing Representative Office
Room 2008, Beijing Fortune Building,
No. 5 , Dong-San-Huan Bei Road,
Chao-Yang District, Beijing 100004, P.R. China
Phone: +86-10-6590-9230
Fax: +86-10-6590-9235
• Korea
Anritsu Corporation, Ltd.
8F Hyunjuk Bldg. 832-41, Yeoksam-Dong,
Kangnam-ku, Seoul, 135-080, Korea
Phone: +82-2-553-6603
Fax: +82-2-553-6604
Tverskaya str. 16/2, bld. 1, 7th floor.
Russia, 125009, Moscow
Phone: +7-495-363-1694
Fax: +7-495-935-8962
• Australia
Anritsu Pty Ltd.
• United Arab Emirates
Anritsu EMEA Ltd.
Dubai Liaison Office
P O Box 500413 - Dubai Internet City
Al Thuraya Building, Tower 1, Suite 701, 7th Floor
Dubai, United Arab Emirates
Phone: +971-4-3670352
Fax: +971-4-3688460
• Singapore
Anritsu Pte. Ltd.
Unit 21/270 Ferntree Gully Road, Notting Hill
Victoria, 3168, Australia
Phone: +61-3-9558-8177
Fax: +61-3-9558-8255
• Taiwan
Anritsu Company Inc.
7F, No. 316, Sec. 1, Neihu Rd., Taipei 114, Taiwan
Phone: +886-2-8751-1816
Fax: +886-2-8751-1817
60 Alexandra Terrace, #02-08, The Comtech (Lobby A)
Singapore 118502
Phone: +65-6282-2400
Fax: +65-6282-2533
Nemetschek Haus, Konrad-Zuse-Platz 1
81829 München, Germany
Phone: +49 (0) 89 442308-0
Fax: +49 (0) 89 442308-55
®Anritsu All trademarks are registered trademarks of
their respective companies. Data subject to change
without notice. For the most recent specifications visit:
www.anritsu.com
Application Note No. 11410-00590, Rev. A Printed in United States 2010-10
©2010 Anritsu Company. All Rights Reserved.