Spread Spectrum Jamming
Spread Spectrum Jamming
Spread Spectrum Jamming
By
Edward Hwang
Karl Sanders
Senior Project
2012
TABLE OF CONTENTS
Section Page
Acknowledgements………………………………………………………………………………………………… i
Abstract…………………………………………………………………………………………………………………. ii
I. Introduction……………………………………………………………………………………………… 1
II. Requirements…………………………………………………………………………………………… 2
III. Design………………………………………………………………………………………………………. 3
V. Test Plans……………………………………………………………………………………………….... 16
VI. Conclusions………………………………………………………………………………………………. 27
VII. Bibliography……………………………………………………………………………………………… 29
Appendices
B. Parts List…………………………………………………………………………………………………….. 34
C. Time Allocation………………………………………………………………………………………….. 38
D. Schematic…………………………………………………………………………………………………… 39
i
ACKNOWLEDGEMENTS
We would first like to acknowledge Professor Helen Yu for being our advisor, helping us when
we needed help, and keeping us on track. Second, we would like to acknowledge our fellow Cal Poly San
Luis Obispo students Kevin Haskett and Angelo Ballungay for their contributions and time to the project.
Third is Mr. John Jacobs, our Raytheon Liaison. He introduced the project to us, supplied some much
needed information, and kept used motivated by pushing us and keeping us determined. At the same
time, we thank Raytheon for funding the project. Fourth, we would like to acknowledge Ms. Lani Woods
for purchasing the necessary components and equipment. Lastly, we would like to acknowledge Cal Poly
San Luis Obispo, for availability and access to the labs and their equipment. Special thanks to all these
ABSTRACT
Direct-sequence spread spectrum (DSSS) is a modulation technique that has been used in many
telecommunication devices. Unlike the case of a single frequency carrier, the modulated signal in DSSS
occupies a much wider bandwidth in order to reduce the possible interferences with narrow band
communication signals. Considering the fact that spread spectrum is generally used to resist jamming,
there are very few documented techniques or methods on jamming spread spectrum signals
In this project, we attempt to jam a remote control (RC) car (manufactured by Traxxas) that
employs DSSS. The multichannel transmitter of a Sony camera is used as a jammer. Experimental
results show that our attempt is successful in a limited range of distance. A directional antenna can be
added to improve the range of jamming for future works. It is expected that this method can be
further applied to jam mini unmanned aerial vehicles (UAVs) that may potentially be used as explosive
TABLE PAGE
Table I……………………………………………………………………………………………………………. 9
Table II………………………………………………………………………………………………………….. 9
Table III…………………………………………………………………………………………………………. 13
Table IV…………………………………………………………………………………………………………. 14
FIGURES
Figure 1……………………………………………………………………………………………………………. 5
Figure 2……………………………………………………………………………………………………………. 6
Figure 3……………………………………………………………………………………………………………. 7
Figure 4……………………………………………………………………………………………………………. 8
Figure 5……………………………………………………………………………………………………………. 9
Figure 6…………………………………………………………………………………………………………… 11
Figure 7…………………………………………………………………………………………………………… 11
Figure 8…………………………………………………………………………………………………………… 12
Figure 9…………………………………………………………………………………………………………… 12
Figure 10……………………………………………………………………………………………………….. 14
Figure 11……………………………………………………………………………………………………….. 14
Figure 12……………………………………………………………………………………………………….. 16
Figure 13………………………………………………………………………………………………………… 17
Figure 14………………………………………………………………………………………………………… 18
Figure 15………………………………………………………………………………………………………… 19
iv
Figure 16………………………………………………………………………………………………………….. 20
Figure 17………………………………………………………………………………………………………….. 21
Figure 18………………………………………………………………………………………………………….. 22
Figure 19………………………………………………………………………………………………………….. 22
Figure 20………………………………………………………………………………………………………….. 23
Figure 21………………………………………………………………………………………………………….. 24
Figure 22………………………………………………………………………………………………………….. 25
Figure 23………………………………………………………………………………………………………….. 26
Figure 24………………………………………………………………………………………………………….. 27
1
I. INTRODUCTION
Scenario
Within the last few years, there have been advancements in wireless technology. Products are
being designed with spread spectrum to minimize any signal interference for reliability and safety.
Remote controlled aircrafts fall under such category; it has become increasingly difficult to detect these
mini unmanned aerial vehicles (UAVs). These same UAVs could potentially be used to target explosive or
biological weapons at civilian populations, whether at range or upon impact. There need to be a
countermeasure to detect the UAV and jam it, to prevent it from reaching its targeted site and a
Client
Our client is Raytheon, a major defense contractor and industrial corporation. It has a core
manufacturing concentration in weapons, and military and commercial electronics. Raytheon produces
aircraft radar systems, weapon sights and targeting systems, communication and battle-management
systems, and satellite components. It is the world’s largest producer of guided missiles and has been
around for roughly 90 years while currently employing over 70,000 employees worldwide.
Project Summary
While working with a UAV would be ideal, we decided to scale it down for better mobility and
efficiency. During winter and spring quarter, we attempted to jam a remote controlled (RC) car that
employs similar spread spectrum signals as a UAV. The car employs a 2.4 GHZ radio system equipped
with Direct Sequence Spread Spectrum (DSSS). The RC car was developed and created by Traxxas, a
II. REQUIREMENTS
• Jam the spread spectrum RC car with minimal power at a specified frequency
By jamming the spread spectrum RC car, the receiver would be stopped from receiving any
signal from the transmitter, thus rendering the car uncontrollable. This would prevent any
communication between the transmitter and receiver of the car. By successfully jamming the RC car, we
would be able to take what we learn and possibly apply it to a UAV, therefore preventing a potential
III. DESIGN
To properly understand the procedure undertaken by this project, three theories need to be
understood: spread spectrum, pulse-width modulation, and jamming. Jamming encompasses the entire
project and is the main goal, while understanding spread spectrum and pulse-width modulation were
What is Jamming?
Jamming is a deliberate attempt to disrupt communication between the transmitter and the
receiver. A jamming device can often override the signal at the receiver if it is tuned to the same
frequency and with enough power. When jammed, a device can no longer receive information from the
Originally developed for the military purposes of securing radio transmissions, spread spectrum
is now used pervasively in most wireless products. It uses wide band, noise-like signals, which make it
difficult to detect and jam compared to narrowband signals. Since spread spectrum signals are wide,
they transmit at a much lower spectral power density, making it less likely to interfere with narrowband
communications. Spread spectrum signals are hard to detect on narrow band equipment because the
signal’s energy is spread over a bandwidth of about 100 times. It trades a wider signal bandwidth for a
better signal to noise ratio. Two major types of spread spectrum today are direct sequence and
frequency hopping.
minimize interference or jamming possibilities. The transmitter hops between available frequencies
4
according to a specified algorithm. The algorithm can be completely random or preplanned. The
transmitter operates in synchronization with a receiver, which remains tuned to the same center
frequency as the transmitter (the receiver changes as the transmitter changes). For every burst of data
transmitted both the transmitter and receiver change frequencies. Bursts of data can range from
fraction of bits to multiple bytes. Because of how it operates, frequency hopping requires a much wider
bandwidth to send the same information than a signal only using one carrier frequency.
Direct sequence uses a locally generated pseudo noise code to encode digital data to be
prepared for transmission. It breaks the data into small pieces and spreads them across the frequency
domain. A data signal at the point of transmission is combined with a higher data-rate bit sequence that
divides the data according to a spreading ratio. This enables the original data to be recovered if data bits
are damaged during transmission. By dividing the data and spreading it across multiple frequencies,
there is a greater resistance to any interference. In contrast to frequency hopping, direct sequence is
Pulse –width modulation is used commonly to control power to inertial electrical devices such as
RC cars. The average value of voltage fed to the load is controlled by turning the switch between supply
and load on and off at a fast pace. The longer the switch is on compared to the off periods, the higher
the power supplied to the load is. The greatest advantage of pulse-width modulation is that the power
The initial test plans were to collect data on the RC car’s transmitter and receiver and on how
they functioned and synchronized. The spectrum analyzer was connected via the antenna of the
transmitter (Traxxas link, high output 2.4GHz). For the initial test, the receiver and transmitter were off
to collect a baseline. The spectrum analyzer was concentrated on frequencies between 2.3 GHz and 2.5
GHz since those are near the frequencies the transmitter sends data. Figure 1 displays the initial baseline
for the spectrum analyzer with both the receiver and transmitter off.
From the baseline display, it was noticed that without anything connected, there were still some
minor spikes at approximately 2.413 and 2.46 GHz. It was determined that the spikes close to 2.4 GHz
6
- 40dBm.
The spectrum analyzer was connected to the antenna of the transmitter to measure and display
its frequency spectrum (Traxxas link, high output 2.4GHz). The ground wire from spectrum analyzer was
attached to the negative rail (0V) and the other wire to the antenna of the transmitter
transmitter..
It was noticed that the spike at 2.41 GHz seen in Figure 2 increased dramatically from -40dBm
(baseline value) to 0dBm. However, this same spike was inconsistent and appeared sporadically on the
average, the detector was set to trigger when the spike peaked above -30dBm to minimize any false
The comparison was performed with a max hold function on the spectrum analyzer: the highest
power was held at each specific frequency. There were noticeable differences between the baseline
and transmitter, particularly around 2.406 GHz, shown with marker 5 in Figure 3.
Linking Up
The next step was to see if there would be any changes or patterns to the transmitter’s
frequency spectrum when the linking process between the transmitter and receiver was being executed.
Any noticeable patterns would provide a method of knowing when the transmitter and receiver were
communicating. While observing the spectrum analyzer, the transmitter and car were simultaneously
activated. Unfortunately, the spectrum analyzer failed to display any spectral patterns: this meant the
In order to fully analyze the receiver (shown in Figure 4), each of the pins were probed to
determine their function. The receiver only utilized channel 2 and both of the channel 1 slots. After
testing the various probes, the receiver was found to run on 6 volts DC and the channel 1 slots affected
the steering of the car. Channel 2 was unable to be directly tested because once disconnected, the
Pulse-width modulation (PWM) signals were observed when connected to the channel 1 pins on
the receiver. The PWM signals varied when the car was steered in different directions. The frequency of
the signal was 100 Hz while the duty cycle changed depending on its direction. The PWM signal is shown
in Figure 5 and the data collected from probing channel 1 slots are shown in Table I and II. The data was
taken and compared by steering the car left and right, throttling, and at rest. The information was taken
in case the jamming does not pertain to the antenna, but instead to the wires or other hardware of the
car.
9
Previously, Chad Amonn, a graduate student contact of ours, had observed that the car jammed
when the transmitter of a Sony camera (900MHZ 1500mW Tx/Rx & 1/3-inch CCD Camera PAL 420TVL)
was turned on. He made this observation working with the same RC car as ours prior to us. In order to
replicate this jamming scenario, the same camera was ordered. The signal spectrum of the camera
needed to be analyzed for the particular frequencies responsible for jamming the car. This provided a
The first step was to find any constraints and ensure the camera’s safety while working with it.
Any losses would be costly both money and time wise. It was found that the voltage for the camera
The camera transmitter was then examined on the spectrum analyzer. The transmitter consisted
of 4 channels ranging from channel 0 to channel 3. Chad informed our group that he had managed to
jam his car with the transmitter on three channels: 0, 1, and 2. The spectrum of each of the 4 channels
These figures demonstrate that the 900 MHz camera has harmonics close to 2.4 GHz, which
could potentially lead to jamming the signal. Notice that these were the only signals observed by the
spectrum analyzer without a direct connection, and therefore this only shows the strongest signals.
Table III: MAIN HARMONICS OF CAMERA CHANNELS (the first harmonics are all larger than -10dBm)
Frequencies 0.912 1.824 2.73 0.977 1.962 2.94 1.008 2.022 1.038 2.082
(GHz)
To test for jamming, an antenna was attached to the camera transmitter and placed in the
vicinity of the car’s antenna. The transmitter managed to jam the RC car on all channels (0-3). However,
in order for it to jam, the antenna of the transmitter needed to be extremely close, within an inch, to the
antenna of the car. It was hypothesized that the harmonic of the camera closest to the 2.4 GHz range
was jamming the signal. While the camera transmitter jammed the car, once it was moved away from
Probing Channel 2
A small part of the wires for channel 2 probes were stripped to accurately gauge and measure
them. The red wire was measured to be 6V and the black wire was 0V. The wires to the probes are
shown in Figure 10. The white wire carried a pulse width modulation signal with specifications shown in
Table IV. The notches in the wires shown in Figure 10 are the parts that were stripped and connected for
measurements.
14
There was no change in the 15% duty cycle PWM when the transmitter was linked and the car
was steered in a direction without any throttle. When the car was throttled, the duty cycle was shown
to be 15.4%. When the car was put in reverse, the duty cycle decreased to 14.6%
The signal received from the camera transmitter that jammed the RC car is shown in Figure 11.
It was necessary to filter the signal to determine the correct and exact frequency range which
would properly jam the car. Using this frequency range, a signal generator could be used to disrupt the
Simple RC Filter
A first order high-pass filter with a 2.5 GHz cutoff frequency was constructed to pass high-
frequency signals, but attenuate signals with frequencies lower than 2.5GHz. To calculate the
capacitance, an equation was employed: frequency = . The filter consisted of a resistor (4.5Ω) and
࣊ࡾ
a capacitor in the pico-farad range. It was found that this cutoff frequency still jammed the car. The
placement of the filter in connection to the camera and camera antenna is shown in Figure 12. This
means that the jamming frequency is above 2.5GHz or there was not enough attenuation to the
jamming frequency
A 160 MHz low –pass filter was constructed to confirm that the car would not jam without its
high frequencies. The filter was applied between the camera transmitter and the antenna. This filter
worked successfully, by preventing the camera transmitter from jamming the R/C car.
17
Varying Filters
As seen from Figure 13 much of the signal originally peaking (Figure 11) was attenuated. This set
a definite jamming range from 160MHz to 2.5GHz. However, such a range was too large and needed to
be narrowed. This was accomplished by various filters with different cutoff frequencies. To vary the
frequency, the capacitor values were altered by placing more capacitors in parallel with the original
capacitor. Unfortunately, this method did not work and resulted in a lack of finding the correct jamming
frequency range. First-order filters did not offer enough attenuation; therefore higher order filters with
Calculating the capacitance and inductance values would cost too much time especially for high
order filters; a program, Elsie, was used instead to design the filter. Elsie is a computer design tool that
can design many types of analog filters. It provides options for different filters such as Bessel or
Chebyshev, and allows the user to input the corner frequency. Using the inputted data as well as filter
18
choice, it produces a schematic of the filter along with the capacitance and inductance values necessary.
These capacitances and inductances can be slightly adjusted to better fit a user’s needs: if a capacitance
was too small, it could be increased; however, this would change inductance values. The inductances
and capacitances for this project’s filters turned out to be very small (the inductance was always in
A fifth order filter was built to ascertain the jamming range. The schematic with the inductance
and capacitance values is shown in Figure 14. It was attempted to make the inductance as close of a
value as shown.
A Chebyshev filter was chosen because of its fast transition region characteristic. This means
that it has a fast roll off, after meeting its cutoff frequency (not many frequencies in the transition
region). With a fast transition region, it is easier to pinpoint the frequencies that could be jamming the
RC car. The filter in Figure 14 was built as a template for various fifth order filters. The same
configuration was used for other fifth order filters while the inductance and capacitance were changed
19
based on what was being tested. The input and output stayed constant no matter what filter was being
used.
Using a network analyzer, the magnitude response of the fifth order filter was displayed as
shown in Figure 15. The magnitude response demonstrates a large amount of attenuation roughly
between frequencies 10 MHz and 1.3 GHz with a magnitude of at least 38.397 dB. The magnitude at
2.409 GHz still has an attenuation of 23.9 dB. This caused the camera transmitter to be unable to jam
the RC car. This Chebyshev fifth-order filter attenuates too much of the signal from the camera
transmitter. It was speculated that a filter with less attenuation between 1 GHz and 2 GHz may allow the
Figure 15: Magnitude Response with Fifth-Order Filter using Network Analyzer
20
The next fifth-order filter allowed the camera transmitter to jam the RC car. The magnitude
response is shown in Figure 16. The largest attenuations are located at 1.303 GHZ and 2.409 GHz with
magnitudes of 20.457 dB and 20.306 dB respectfully. Between these two frequencies, there was at least
an attenuation of 10 dB except for the frequency around 1.8 GHz where the attenuation was at least 5
dB. This filter demonstrated that the frequencies between 1GHz and 2.4 GHz are most likely responsible
In order to properly compare the two fifth order filters, the responses were overlapped as seen
in Figure 17. The upper magnitude response corresponds to the filter that enabled jamming, while the
lower magnitude response corresponds to the filter that prevented jamming. While there are
differences in attenuation between the two filters, there are also similarities. These similarities can be
seen at very low frequencies and very high frequencies: the magnitudes at these frequencies are close
for the two filters. This shows that very low frequencies do not jam the RC car and at the same time the
probable frequencies enabling the jamming are between 1 GHz and 2.4 GHz. The filters provided a much
Figure 18: Tunable Filter Original Figure 19: Tunable Filter Adjusted
This tunable filter can easily change or “tune” the band-pass frequency by adjusting the
cylindrical length of copper. The copper length can be seen within the box and moved in Figures 18 and
19. The length can be decreased by pulling the copper out as seen in the transition from Figure 18 to
Figure 19. The longer the length of copper is in the box, the lower the band-pass frequency. At the same
time the shorter the length, the higher the band-pass frequency. This is the easiest filter to use once it
is created since no discrete components such as inductors, capacitors, or resistors needed to be added
or changed.
23
The output of the camera transmitter was put through this tunable filter. The copper length of
the filter was then decreased starting from maximum length until the transmitter is no longer able to
jam the RC car. This narrowed the frequencies that were responsible for jamming the car and reduced
the need to construct multiple filters, thus saving time. Figure 20 shows the lower frequency limit that
The copper length of the filter was adjusted again to find the upper limits. The frequency of the
upper limit was found to be 1.14 GHz as shown in Figure 21. This frequency also prevents the
transmitter from jamming the RC car. The signal that the camera transmitter uses to jam the RC car was
To verify the frequencies that jammed the RC car, the camera transmitter spectrum was passed
through the tunable filter with the same jamming frequencies and displayed on the spectrum analyzer
It was necessary to mimic this signal with a signal generator: this would provide a signal, independent of
the camera,
mera, which would successfully jam the RC car accomplishing the goal of the project.
Figure 22: Signal from the camera’s transmitter after being filtered
26
Using the center frequency of 1.039 GHz, a single pulse was generated at this frequency with
the signal generator. However, this failed to jam the RC car and it was decided that the signal would be
modulated with a square wave to widen the signal bandwidth as shown in Figure 23. The square wave
provided the extra peaks to the left and right of the original pulse signal at 1.039 GHz. The modulated
To narrow the signal from Figure 23, the signal was unmodulated and the signal generator was
set to 20 dBm with a center frequency of 1.02 GHZ. This frequency would be the main lobe. The side
lobes are shown to be roughly 1.01 GHz and 1.03 GHz. These frequencies are able to successfully jam
the car. The final spectrum used to jam the RC car can be seen in Figure 24.
27
Figure 24:: Final Spectrum using Signal Generator with Center Frequency of 1.02 GHz
This spectrum is similar to that of the camera transmitter.. The main frequency was
concentrated at 1.02 GHz and the side lobes were at roughly 1.0175 GHz and 1.025GHz.
025GHz. This signal
generator successfully jammed the car without the use of the camera transmitter.
28
VI. CONCLUSION
Overall, the project involved many hours of hands on work and testing. The final result was
successful due to isolation of frequencies that contributed specifically to jamming the car. The principal
jamming ranges were from roughly 970 MHz to 1.07 GHz. A power of at least 18dBm was required to
jam the car along these frequencies. The bandwidth for these signals was a reasonable 20 MHz. The
particular frequencies that jam the RC car are interesting in the fact that none of them are harmonics of
the original signal sent by the transmitter. Some internal hardware within the receiving device for the
A disappointing aspect of this project was the range of the jamming. The antenna connected to
the signal generator needed to be within inches of the RC car receiver in order to jam the car. However,
it is possible that the range of jamming could be increased by using a power amplifier and a directional
antenna. This could increase the overall power delivered through the antenna and thus dramatically
increase the range of the jamming signal. This method would be more useful for instances when the
jamming device needs to be hundreds of feet or more from the receiver. This would apply more to UAV
or other devices used at large ranges that could potentially endanger civilians.
The same method used on the direct sequence spread spectrum (DSSS) RC car for this project
could be implemented with an unmanned aerial vehicle (UAV). The first attempt would be to find a
broadband jammer that could be filtered and have its frequencies isolated. The tuning cavity filter was
an extremely convenient filter and most likely the optimal candidate for isolating frequencies. The
isolated frequencies can then independently be sent to the receiver and attempt to jam the
communication.
29
The project provided experience of everything, including wireless devices communicate, how
processing down converts a particular high frequency signal, and how to create accurate analog filters. A
possible addition to the project could be creating a detector to detect the usage of the RC car. This
would provide an alert that a wireless device was in use and motion. This would allow for automated
detection and jamming of the car and could be used to prevent the need for manual approach.
While analyzing the various signals, creating multiple filters, and trying to isolate the frequency
range took much time and resources, the success of jamming the DSSS RC car exceeds the hardships
VII. BIBLIOGRAPHY
APPENDIX A
Karl Sanders
The project was aimed to have the capability of jamming a spread spectrum RC vehicle. It was
hoped that once this was done, it could be applied on a larger scale: to other spread spectrum devices
Primary Constraints
Spread spectrum in itself was one of the main obstacles of this project. The concept of spread
spectrum was meant to prevent and mitigate any jamming. However, this was the challenge that we
were aiming to overcome. Another limitation was the equipment for the project. In order to study the
spread spectrum, a signal analyzer was required. However, the frequency for the spread spectrum RC
car was 2.4 GHz; this meant that the signal analyzer needed to be able to reach such frequency. There
were very few signal analyzers on campus that reached such a high frequency and those that could were
unavailable most of the time. No oscilloscopes would even go close to 2.4GHz so a real time view of the
transmitter was never observed. The remaining hindrance dealt with time constraints: the parts that
32
needed to be shipped took time to arrive. Unfortunately sometimes progress could only be made when
Economic
Final Bill:
The cost of the project included buying the targeted device, which in this case was the RC car.
The other main cost would be obtaining equipment that would measure high frequency. We were able
to find such a signal analyzer in Cal Poly’s Computer Network and Communications lab. Luckily for us,
the project was being sponsored by Raytheon, which covered any of the project’s costs.
Spread spectrum jamming would not have such a large impact economic wise. It would mainly
be marketed to defense contractors and the military. In reality, it is not a commercial product that an
average consumer would purchase. It is a countermeasure against potential threats. The main people
who would profit monetarily from this would be defense contractors; however, at the same time the
civilians would profit from this safety-wise. This countermeasure can be used to protect citizens from
any attacks.
This type of project was not done in mind to generate billions in revenue; it was construed to be
Environmental
There will not be any major environmental impacts, considering how much of the work deals
with signals rather than physical products. The equipment needed only consist of those that can detect
Manufacturability
The main issue would be creating a device to detect such a high frequency and to transmit a
similar frequency. The equipment such as a spectrum analyzer can be manufactured and a greater scale,
Sustainability
The system would only require a transmitter and detector so the main issue would be
maintaining these equipment. There would not be any effects to natural resources and ecosystems. It
would also not affect any other species. In contrast, the system would prevent potential destruction if
used properly.
Ethical
The main ethical implications would be if someone decided to use the information from the
project to illegally jam signals. This includes any forms of public communication or even possibly
military.
The only health and safety concerns would be setting up the system, and even then the
concerns would be very minor. The equipment would need to be manufactured properly for there to be
no malfunctions. The largest risk would be not being able to jam a dangerous incoming UAV.
34
The project’s only impact on stakeholders would be if it successfully worked and jammed the
targeted the device. It is a countermeasure meant to prevent any harm not to cause it. Other than its
Development
The project provided the opportunity for a much greater study and in depth look at spread
spectrum. It allowed for analysis of direct sequence spread spectrum as well as the equipment
necessary to examine it. This includes spectrum analyzers, oscillators, modulators, and various filters.
Through this project, various filters were studied and designed including low pass, high pass, and band
APPENDIX B:
PARTS LIST
RC Car Components
Camera Components
SONY CCD 1/3 inch Camera 900 MHz 8 Channel Video Transmitter (1500 mW)
Network Analyzer
Signal Generator
39
APPENDIX C
TIME ALLOCATION:
40
APPENDIX D
SCHEMATICS