aperture: tracking ships and aircraft over SF Bay with a $25 SDR dongle

After a few days of 433 MHz weather sensors, I pointed the same RTL-SDR Blog V4 ($25, secondhand off Craigslist) at San Francisco Bay: three long AIS runs for ships (they broadcast around 162 MHz) and one ADS-B run for aircraft (1090 MHz). I’m an electrical engineer but new to software-defined radio, so parts of this are me finding things out; outside knowledge is linked inline. Where I could, I compared what the software decoded with something outside my own capture, and every run’s date and time is in the table at the end so my numbers can be checked.

Setup: bias tee off, no external LNA or filter, a Mac mini, dump1090-fa 11.1 and AIS-catcher v0.70. The dipole was vertical, 16 in per element (placement, height and cable not recorded), for the AIS runs and the ADS-B run. Times are PDT (UTC-7) unless they say UTC; after 17:00 PDT the UTC date is the next day. The first post has the versions and the rest of the setup.

ais: tracking ships on 162 MHz

The antenna-length formula from the first post also covers VHF: with the longer 1-3 foot elements it gives roughly 76 to 220 MHz. Marine AIS is on 161.975 and 162.025 MHz (USCG NAVCEN), for which the formula wants about 16.5 inches per element; I set 16. The dipole was vertical, which matches the vertically polarized antenna RTL-SDR Blog’s AIS tutorial calls for.

I had Claude Code build AIS-catcher from source rather than write a decoder. A 2-minute smoke test (run A1, Aug 6 from 09:27 PDT, 40.2 dB, 16 in elements) decoded three ships before I trusted it with 8 hours unattended. The three long runs in the table used the same settings (AIS-catcher, 40.2 dB, 16 in elements); the overnight haul was thin, so I reran the daytime window on day 2.

The other IDs are one shore base station (days 1 and 2) and seven aids to navigation (day 2; buoys and lights, such as POINT BONITA LT and MILE ROCKS). Days 1 and 2 had 0 decode failures, and day 1 had 16 IDs with names decoded from Type 5 static data. Day 2 logged more messages than day 1 and the overnight run combined from an identical setup; I don’t know why (my guess is that Bay traffic varies from day to day more than my hardware does, but I haven’t checked what was in range).

AIS-catcher -X off -gr TUNER 40.2 RTLAGC off -o 5 -f ais_8h.nmea

One receiver sees only part of the traffic: the three windows saw 61 distinct AIS IDs (53 ships, 1 shore base station and 7 aids to navigation), and 34 of them turned up in only one window. Commercial tracking sites combine many receivers, so I’d expect them to show more; I haven’t compared.

checking ships on vessel-tracking sites

I looked the MMSIs up on vessel-tracking sites instead of only trusting my own decode; the links below are VesselFinder pages. The table covers 16 vessels: five from day 1, six from the overnight run and five whose names were first decoded on day 2. “Heard” is first to last message in the run named (dates are in the run table above).

For the overnight six I compared more than a name: what each ship broadcast (IMO number, callsign, hull dimensions) against its listing.

The IMO numbers the five day-1 ships broadcast match the listing pages (7704930, 9604158, 9993896, 9550761, 9893814). Of the overnight six, four match on IMO, callsign and dimensions, and the declared destinations are all Bay and Delta ports. FORTUNE JADE, listed as built this year, is the one named ship I heard only overnight.

Two didn’t line up at first. JAKE SHEARER broadcasts 153 x 23 m and a tanker type code, but VesselFinder has the tug alone at about 35 x 24 m; my guess is an articulated tug-barge reporting its combined dimensions, and gCaptain describes JAKE SHEARER as pushing a fuel barge, which fits. ALEGRIA 1 broadcasts a Marshall Islands MMSI and callsign where older listings show Panamanian ones, for the same IMO number and hull, so I inferred a flag change; VesselFinder’s page lists the new MMSI, callsign and flag, with a flag entry in its history dated August 2026.

GEMINI’s MMSI had turned up unnamed on day 1 and overnight, and day 2 finally decoded the name.

what the ships’ speed reports say

AIS position reports also carry a speed-over-ground field (Wikipedia, 0.1-knot resolution), so I could compare what a ship said about itself with its listing. CAPE HUDSON reported exactly 0.0 kt on all 102 of its position reports (150 messages in all), consistent with a ship laid up in San Francisco. SCORPIO reported 24.7-27.2 kt, averaging 26.1 kt, on day 1. San Francisco Bay Ferry’s fleet page lists 26 knots for its Gemini-class boats, which include SCORPIO and GEMINI (a 2021 press release says 27).

Comparing all three runs vessel by vessel turned up something no single capture could show: 12 vessels appear in every window. Their reported speed, averaged over all three runs, suggests why:

Six at rest, two tugs, four fast movers (two of them the ferries). SCORPIO’s readings range from 24.7 to 27.4 kt across the runs; none of the reports I heard had it stopped. EMMA C’s link goes to a tug listing that matches the callsign it broadcasts (WDP5200); I couldn’t find a page that shows the name next to its MMSI.

overnight against daytime

The overnight run heard mostly the same crowd. Checking every one of its 19 ships against both daytime runs, not just each day’s top 8 by message count (which undercounts overlap badly, since it drops anything that wasn’t among the loudest), shows that 16 also show up during the day. Only three are overnight-only: FORTUNE JADE (45 messages) and two single-message MMSIs with no static data.

What changes overnight is who talks: the ferries go quiet (see the counts above), while the ships at rest keep reporting all night. SCORPIO’s 2 messages and GEMINI’s 23 all came between 07:09 and 07:21 PDT, in the last hour of the run, roughly consistent with ferry service hours. SANDY BAY (170 messages) and FAIRCHEM VALOR (156, plus 39 by day) were the two loudest of the night.

the tracks on a map

Claude Code plotted the tracks over OpenStreetMap tiles with Leaflet, on a small local page. EVER LOYAL’s stationary point sits on the Port of Oakland container terminals, and (once the gaps described below were dealt with) the moving tracks stay over water. Map tiles and data: © OpenStreetMap contributors.

Putting the tracks on map tiles caught something the abstract plot hid: a couple of lines crossed straight over Alameda. They came from gaps in reception, one of them 76 minutes long, for MMSI 367380880 (GEMINI), from 10:58 to 12:14 PDT on Aug 6, and the plotting code was drawing a straight line between the two points on either side. A straight line across land in a 76-minute gap can’t be right, so the code now splits every track wherever consecutive messages were more than 15 minutes apart, rather than bridging it with a segment implying motion nobody observed.

Where SCORPIO drew a long, repeatedly-crossing line all day, most of the overnight top vessels are tight clusters, which I take to be ships at anchor. SANDY BAY, the loudest of the night, has one of the smallest footprints. FAIRCHEM VALOR, the second loudest, is the exception: its positions span about 7.5 km of the Bay (average speed 3.3 kt, up to 10.9 kt), so it was moving for part of the night.

Both later maps used the same 15-minute gap rule. For day 2 I also zoomed into the two spots with the longest lines rather than assuming the wide view was enough: both follow the shipping channel between the Bay Bridge and Jack London Square, and the Oakland/Alameda estuary, with no repeat of the land-crossing bug.

a limit: no free history for ships

I couldn’t find a free service that shows where a named ship was on a past date. As far as I can tell, MarineTraffic’s free tier shows about a day of past track and VesselFinder’s free plan one day. The free by-date source I found is NOAA’s US AIS archive, but its FAQ says new data arrive roughly 145 to 165 days after collection, so early-August captures like mine should show up around December or January (I haven’t checked). So the listing pages can confirm what a ship is (name, IMO, size, callsign, flag) but not where it was at the times in my tables.

aircraft: dump1090 and ADS-B

ADS-B is what aircraft broadcast on 1090 MHz (Wikipedia). I used dump1090-fa, FlightAware’s fork; Homebrew’s build has no web page.

An earlier rtl_adsb test (run B0, Aug 3 at 22:28 PDT, 140 seconds, 40.2 dB, 5.5 in elements in a V shape) picked up 253 raw frames, but rtl_adsb doesn’t appear to check CRCs and its 49 “distinct” addresses looked like bit errors, so I didn’t trust an aircraft count from it. With dump1090 I ran two untimed smoke tests: 30 seconds at 40.2 dB with the 16 in AIS elements still on found nothing, and 90 seconds at 49.6 dB gave 215 usable messages and one fully tracked aircraft (QXE2248). That changed both the gain and the time, so I can’t say which helped, and I didn’t try another antenna.

Then a longer run (run B2, dump1090 at 49.6 dB, 16 in elements) from 22:05 to 22:31 PDT on Aug 6, which is 05:05 to 05:31 UTC on Aug 7. I stopped it after about 26 of the 60 minutes I’d planned, to free the dongle for another test.

dump1090 --gain 49.6 --write-json <dir>

B2 logged 3,819 messages and 13 distinct aircraft by ICAO hex in the 30-second snapshots I saved (dump1090’s own summary at exit counted 14). Most had flight callsigns, altitude and squawk. I looked five up by hex in ADSBdb, a community-run aircraft database. It isn’t an official registry, but for these five US aircraft the FAA registry’s Mode S code field matches the hex in every case.

Each hex below links to that aircraft’s ADS-B Exchange trace for the UTC date, Aug 7. “Heard” runs from the first 30-second snapshot containing the aircraft to its last message, so it is only good to about 30 seconds.

These are community aggregators, and they can change how long they keep data; my own captures are the primary record.

what’s still open

Five ships were heard exactly once and never sent a name or other static data (MMSIs 207410164 and 546710303 overnight; 466745504, 367373280 and 367122220 in the daytime runs). I only tried to look up the two overnight ones, and MMSI searches turned up nothing. I also haven’t checked NOAA’s archive for these dates (see the limit above).

update, Sep 25: a second, longer ADS-B run

On Sep 25, with the dongle free again (I’d cut a planned three-hour 902-928 MHz decode to two hours, described in the mystery-signal post), I ran dump1090 for 45 minutes: run B3, from 10:34 PDT (17:34 UTC) at 49.6 dB, with the antenna vertical at 9.5 in per element, the setting from my AM and VHF tests the day before. Neither this length nor the 16 in one was chosen for 1090 MHz, and I can’t say which matched it better.

dump1090 --gain 49.6 --write-json <dir> --quiet

It logged 10,145 messages and 26 aircraft in the 30-second snapshots (a 27th, hex AA1368, shows up only in dump1090’s final aircraft.json). Run 1 heard 13 aircraft in about 26 minutes, so run 2 heard twice as many in 1.75 times the time: about 0.58 aircraft per minute against 0.50, and 225 messages per minute against 148. The runs were also at very different times (run 1 on Thursday night, Aug 6, from 22:05 PDT; run 2 on Friday morning from 10:34 PDT). I’d guess the time of day does more than the antenna to set how many aircraft are overhead, but I can’t separate the two.

The gain test in the what’s-on-the-air post showed the noise floor in a quiet UHF band (930-958 MHz) moving only about 1.4 dB while the gain fell nearly 20 dB. That suggests the floor is set after the tuner’s gain, probably by the 8-bit analog-to-digital converter. 1090 MHz takes the same UHF input (driver source), so more gain lifts weak signals above the floor until something clips, which may be part of why 49.6 dB beat 40.2 dB in my smoke tests.

The legend counts snapshot points, which repeat a position when no new fix had arrived, so SIA12’s “6 pts” is four distinct positions.

Six from run 2 were checked the same way. Their traces use the UTC date Sep 25, which is also the PDT date:

ADS-B Exchange labels B-18773’s type code as a 777-200LR while ADSBdb says 777F, which isn’t a conflict: the ICAO type designator B77L covers both (Wikipedia’s list), and the freighter shares the -200LR’s airframe (Wikipedia). N46LY is a private aircraft, so I haven’t linked a registry page for it. The FAA registry’s Mode S field matches the hex for the three US aircraft here too, which makes eight of eight across both runs.

One was worth chasing further: hex 76CDC1, flight SIA12, cruising at 37,000 ft on a 148-degree (southeast) track at about 493 to 496 knots. Its four distinct position fixes (18:03:13 to 18:04:40 UTC) walk it from 37.956, -122.402 to 37.787, -122.271: straight down the Bay. SIA12 is Singapore Airlines' Singapore-Tokyo Narita-Los Angeles flight, one flight number on both legs (FlightAware’s history for SIA12), and the receiver caught the Narita to LAX leg. The ADS-B Exchange trace of the same airframe has it leaving Narita at about 10:05 UTC, passing the Bay at about 18:03-18:05 UTC and landing at LAX at about 18:55 UTC, which agrees with my fixes once a few seconds of time offset are allowed for. FlightAware’s page for that flight also shows the Narita to LAX leg, though its free history only goes back about two weeks, so that page may stop loading.

update, Sep 28: links re-checked

On 2026-09-28 I re-opened the VesselFinder pages linked above (each shows the ship’s name and MMSI, plus its IMO number for the ships that broadcast one) and the ADS-B Exchange traces. The FlightAware page for SIA12’s Sep 25 flight only loads for about two weeks, so it should stop working around Oct 9.

more from this project

This is one of four posts from the same RTL-SDR project. One thread runs through all four: more than once, what I was chasing turned out to be my own tools, from the dongle’s DC spike to a clipping front end to a decoder’s default threshold. The other three:

• aperture: three 433 MHz weather sensors, and a clock that tracks temperature - an antenna-length calculation, a gain sweep, an eight-hour 433 MHz census, and a sensor clock that tracks temperature (Aug 3-4)
• aperture: what’s on the air from 500 kHz to 1.77 GHz - a full-spectrum sweep, whether strong FM stations overload the receiver, and an AM station that was an empty channel (Aug 3 to Sep 24)
• aperture: the mystery signal at 916 MHz was my own dongle - a 916 MHz “carrier” that looked like LoRa and turned out to be the dongle’s own DC spike, plus a 2-hour hopping decode (Aug 3 to Sep 25)

How this was built: Claude Code wrote the capture scripts, the analysis, the maps and the figures, and drafted this post from our session logs. I set the antenna lengths, moved the antenna, directed every run, reviewed the results, and chose what to check against outside sources. Tested: every count here is from a run on the dongle listed in the table, and the vessels and aircraft were checked against public listings. Not tested: where the ships were at the times I heard them (I found no free history to check against), and who the five ships heard only once were.