;
Candela Technologies Logo
Network Testing and Emulation Solutions

Using CT712 RF Noise Generator and RADAR Simulator to test DFS channels

Goal: Generate RF pulses that simulate RADAR and cause an AP using DFS to exercise its detection and response abilities.

DFS (Dynamic Frequency Selection) allows an AP to use channels in the same spectrum that some RADAR systems use and provide a method of changing channels when RADAR signals are detected. In this example, we will use a LANforge CT712 which is our customized script and integrated GUI control for the HackRF-One Software-Defined Radio (SDR) to generate the RF pulses that simulate RADAR signals and cause a third-party AP under test to detect and change channels. It is recommended that this type of testing be done in a RF isolation chamber to limit interference to production WLAN and RADAR systems in use.
 
  1. Verify a client is connected to a third-party AP using a DFS channel.

    2. For more information see
    Wikipedia: 5GHz Channels
    WLAN Pros WiFi Channel Reference

  2. On the RF Generator tab, modify the device that corresponds to the CT712 USB device to set the desired channel and pulse characteristics.
    NOTE: The different RADAR types are defined as described in the document FCC DFS Compliance Procedures. RF pulses defined outside of these parameters can be used for other RF noise and interference tests.
    screenshot
  3. Select a FCC RADAR type preset button or enter specific values to set the desired pulse characteristics, then set the transmit frequency, then select OK. screenshot
  4. Highlight the RF Generator entry and select the Start+ button to start transmitting.
    In some versions, you may have to select Start+ twice in order to start transmitting screenshot
  5. When the CT712 is activated, the Status will show Started and the HackRF-One device's TX LED should show a red light. The AP under test should detect RADAR within 10 seconds, change to an available channel and not be able to use the previous channel again for 30 minutes.

    6. For more information see
    WiFi Alliance: DFS Best Practices

  6. An alternate method of controlling the CT712 HackRF-One device is to use the rf_helper script in the /home/lanforge directory:
    1. Open a terminal window on the LANforge system.
    2. cd to /home/lanforge 


    3. ./rf_helper --help

      Usage FCC0-4:
      ./rf_helper --sdr_serial_num= --freq=5320000 --gain=50 --rf_type=FCC0,,,, -log_level debug

      FCC0-4 Sample Commands
      ./rf_helper --sdr_serial_num=22276763 --freq=5320000 --gain=50 --rf_type=FCC0,1,1428,18,10 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=FCC1,1,3066,18,20 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=FCC2,5,230,23,5 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=FCC3,10,500,18,5 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=FCC4,20,500,16,5 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage FCC5: --rf_type=,,,,,,,
      ./rf_helper --sdr_serial_num=22276763  --rf_type=FCC5,14,10,0,0,20,10,20 --freq=5320000 --gain=50 --log_level=debug


      Usage FCC6: --rf_type=, :
      ./rf_helper --sdr_serial_num=22276763  --rf_type=FCC6 --freq=5320000 --gain=50 --log_level=debug --one_burst
       FCC6 the sample rate is 10 Mhz


      Usage ETSI0-4:  --rftype=,,,
      ETSI0-4 Sample Commands
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSI0,1,700,5 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSI1,.5,1000,10 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSI2,.5,1600,10 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSI3,.5,2300,10 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSI4,20,2000,20 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage ETSIP Generic Pulse --rftype=,,,,
      ETSIC (chirp) Sample Commands
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSIP,15,700,5,20 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage ETSIC: Generic Chirp --rftype=,,,,
      ETSIC (chirp) Sample Commands
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSIC,10,700,6,20 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage ETSIHP: HOP Pulse --rftype=,,,./rf_helper --sdr_serial_num=22276763  --rf_type=ETSIHP,20,8 --freq=5320000 --gain=50 --log_level=debug --one_burst
      NOTE: set tx sample rate is 10 for 10 Mhz for proper functionality
      NOTE: if sample rate not passed in sample rate will default to 10 Mhz


      Usage ETSI5-6:  --rftype=,,,,,
      ETSI5-6 Sample Commands
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSI5,2,300,320,340,5 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSI5,2,300,320,0,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSI6,2,400,480,560,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=ETSI6,2,400,480,0,4 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage KOREA1-3: --rf_type=,,,
      ./rf_helper --sdr_serial_num=22276763  --rf_type=KOREA,1,700,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=KOREA1,1,700,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=KOREA2,1,1800,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=KOREA3,2,330,4 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage KOREA1-3 with pulse_count: --rf_type=,,,,
      ./rf_helper --sdr_serial_num=22276763  --rf_type=KOREA,1,700,15,10 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=KOREA1,1,700,15,10 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=KOREA2,1,1800,15,10 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=KOREA3,2,330,15,10 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage KOREA4: --rf_type=,
      ./rf_helper --sdr_serial_num=22276763  --rf_type=KOREA4,100 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage CHINA0-4: --rf_type=,,,
      ./rf_helper --sdr_serial_num=22276763  --rf_type=CHINA0,1,1000,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=CHINA1,.5,200,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=CHINA2,15,1600,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=CHINA3,15,2300,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=CHINA4,20,2000,4 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage CHINA5-6: --rf_type=,,,,,  note: prf3 = 0, two pulses, prf2/prf3 = 0 , one pulse 
      ./rf_helper --sdr_serial_num=22276763  --rf_type=CHINA5,2,300,320,340,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=CHINA5,2,300,320,0,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=CHINA6,2,400,480,560,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=CHINA6,2,400,480,0,4 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage W53PULSE: --rf_type=,,,,
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W53PULSE,1,840,18,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W53PULSE,2.7,260,18,10 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W53PULSE,.5,200,10,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W53PULSE,15,200,15,4 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage W53CHIRP: --rf_type=,,,,,,,
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W53CHIRP,5,70,20,2,200,22,5320,20 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W53CHIRP,.5,120,20,2,200,22,5320,20 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage W56PULSE: --rf_type=W56PULSE,,,,
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W56PULSE,.5,720,18,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W56PULSE,1,700,18,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W56PULSE,2,250,18,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W56PULSE,5,4347,23,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W56PULSE,6,2000,18,4 --freq=5320000 --gain=50 --log_level=debug --one_burst
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W56PULSE,11,2000,12,4 --freq=5320000 --gain=50 --log_level=debug --one_burst


      Usage W56CHIRP: --rf_type=,,,,,,,
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W56CHIRP,14,10,0,0,20,10,20 --freq=5320000 --gain=50 --log_level=debug


      Usage: W56HOP: --rf_type=,
      ./rf_helper --sdr_serial_num=22276763  --rf_type=W56HOP,100 --freq=5320000 --gain=50 --log_level=debug --one_burst


      There are two gain parameters --if_gain and --gain for the hackrf for tx
       RF gain which is 0 or ~11 dB, RF gain is an on/off value
       IF gain which is 0 to 47 in 1 dB
       The maximum gain is about 48 dBm, setting higher has no effect 
       This code is based off SoapySDR which only has one paramter for gain
       The --gain will be split between the RF gain and IF gain parameters
       The gain value goes to the RF gain first then the rest is passed to IF gain
       Example --gain=51 , will be a RF gain of 11 dB and IF gain of 40 dB

      command parameters: 
      --sdr_serial_num= or --lf_hackrf=
      --one_burst  stored True for sending one burst
      --rf_type=
      --freq=

      --gain=
      --iter=
      --pid_file=
      --mgt_pipe=
      Compilation Date: Jan 28 2026 09:55:12
Candela  Technologies, 2417 Main Street, Suite 201, Ferndale, WA 98248, USA
www.candelatech.com | sales@candelatech.com | +1.360.380.1618
Facebook | LinkedIn | Blog