TinySA Ultra – SIGINT SETUP, by GuerrillaLogistician

The TinySA Ultra is an interesting little device and the improvement over the TinySA.  While this is a spectrum analyzer, we can use it for signals intelligence. This article will be a basic guide for the beginner, as this thing honestly has more capabilities than this article could cover.  Some of you will find better ways to do things and I hope you will either send in your suggestions or I will meet you on the forums. The key here is research and experimentation, but for those of you who bought this and don’t know where to start this is the guide for you. Realistically you want to go to tinysa.org and find out its full potential. For the guerilla sigint guy this should get you started though.

1. On off switch
2. Menu switch that can be clicked inward or rotated left and right.
3. (Not pictured) USB-C jack.
4. (Not pictured) microSD card slot.
5. (Not pictured) 3.5 mm headphone jack.

https://tinysa.org/wiki/pmwiki.php?n=Main.FirstUse

The initial setup of one of these is easy and I will leave the instructions with the designer or possibly a dispatch article in case your internet goes dead.  Remember to attach the cables properly before doing the self-test and calibration, as pictured above.  There are several youtubers that run through the setup as well as the info provided by the website. A couple key points for you guys.  You will want to charge your device before you really play with it, you don’t want it dying halfway through the setup. The stylus that comes along with the device makes life a lot easier.  Anything can be used to touch the screen, just make sure it isn’t sharp or will leave marks on your screen. You can also access all the settings by pushing in on the swiveling toggle button next to the power switch if you don’t have a stylus or you are in gloves. A simple press in and then moving the tab left or right will get you to where you want to go.

This is the developers initial guide to the TinySA Ultra, goes into some stuff about the device that will help some of you get around.

https://tinysa.org/wiki/pmwiki.php?n=TinySA4.Ultra

The unlock code for Ultra mode is 4321 then click the x1 to confirm that number. I will assume at this point you have done a SELF TEST and CAL with the cable attached using the links above.

Understanding the initial screen

The main screen for the uninitiated will be a bit confusing but with time you’ll figure it out fast. I will focus on what I think you should know and why.

1. This tells you what trace your pip is on, the frequency it’s located on and your decibel level. You can have more than one pip and you will get similar information next to this one.  A second PIP will have a different number and possibly color.  I will leave that info out for brevity though, refer to the website for more.

2. This is your pip which gives you basic information on 1 such as frequency.

3. This number represents how fast your scan through the selected spectrum is. The slower this scan the longer it will take to detect and the more you will miss. On the image you will see about 700 milliseconds, but this can vary greatly depending on the bandwidth you are looking at. The more of the band the longer this takes, although some settings change the scan rate as well. If your scan is long, you will see a green bar at the base of your graph coming across as the data changes.

4. This is your start frequency in the bottom left corner, and this delineates where your search begins. The 100.0MHz/ next to it is the spacing between your vertical lines on your graph and will change depending on your setting.

5. This is the ending frequency of your scanning area.

SETUP INSTRUCTIONS

All setup starts from the main menu in case you get confused, bump into something wrong etc. If you are already in the sub directory jump to that point.  If you ever get confused use the BACK button and return to the original menu screen.  You will understand this later.  All MENU directions will be MENU > Next MENU, because some of the menu items aren’t intuitive.

My preferred SIGINT SETUP

My preferred setup for signals intelligence is straightforward. Anyone who’s run any radio like the G90 that has a waterfall knows how easy it is to see people talking.  Not only can you see the frequency to tune to, but you also have a good guess on how long ago they were on. The first thing you want to do is set up your trace. The trace is the line that is going across the screen, and you have an option of up to four traces at once. I prefer a setup where I can have the Max signal strength presented to me plus a current signal strength which shows me the current reception levels across the bands I’m looking at. Underneath your trace the waterfall is continuously flowing down like a sonar screen. We’ll start with setting up the traces because anytime you do anything on this device it resets the waterfall so that will be the last thing we do.

TRACE>CALC OFF> MAX HOLD This sets Trace 1 (yellow) to show the highest signal strength received while the device is on.

TRACE>TRACE 1>TRACE 2>ENABLE This sets the Trace 2 (green) like the default trace showing you current signal fluctuation.

DISPLAY>WATER FALL (note you can do this a second time and you can extend the waterfall compressing the trace line to about ¼ the screen.  If you are primarily interested in signals over time and viewing the waterfall this will help.)

*Optional* CONFIG>MORE>EXPERT CONFIG> HAM BANDS (This displays the ham bands in your spectrum as grey vertical lines

FREQ SELECTION

All frequency selection is done by two main steps for the purposes we need. When you click on the frequency button.  The only settings you need to worry about are START and STOP.  Everything else updates itself and is of no real consequence. You’ll want to be careful of your scanning speed as it can take a long time to scan the full capabilities of this device. The slower the scan the more you will miss transmissions, especially those quick digital transmissions.  You may watch a large portion of the spectrum and then want to focus on certain areas, every time you change your frequency settings the waterfall and data reset.

START/STOP you will need to set the Start Stop on your frequency tab to the spectrum you would like to be scanning. The less frequency bandwidth used in between these two numbers the faster your scan rate, and greater chance of catching fast transmissions, or accidental key ups. This also will give you a better detailed waterfall and allow you to see each signal in more detail. If you know someone is only working with FRS GMRS radios, you can dial down to that frequency.

NUMB PAD – I have marked the number pad in the image for ease of understanding. The letters represent GIGA MEGA and KILO hertz respectively. The backspace arrow returns you to the previous screen, and the x1 is basically a confirmation or enter key.  Clicking G,M,K acts just like the x1 key and sets the frequency. I love this feature because if you don’t know anything about frequencies and somebody tells you a specific frequency to look at, you can punch it in without trying to do math in your head.  You might be half asleep in a makeshift TOC out of coffee and reliably work this device. I feel like this feature really takes the Fudd out of the equation, at least in the frequency department.

FREQ CHOICES

For the beginning SIGINT Operator, I have left a link to the US reference of band allocations. Honestly for the purposes of learning this device and seeing what’s out there zero to 800 megahertz is absolutely a great starting point. This will cover most VHF/UHF radios all the way up to cellphone signals which will stick out.  This device, however, will get up very high and you can pick up some of the civilian commercial drones very easily with this device. That said you may want to adjust your frequencies to specific areas of interest.  Also, if you happen to have two of these devices you can run one as a broad-spectrum visual aid and then set the other one to this specific band and homemade Yagi antenna for direction finding. The more you practice the more you will understand and the more adapted you will be to finding people trying to hide.

https://upload.wikimedia.org/wikipedia/commons/c/c7/United_States_Frequency_Allocations_Chart_2016_-_The_Radio_Spectrum.pdf

SAVING your Settings

When you shut off your TinySA Ultra all the settings go back to stock, so you will want to know how to set this back up.  You will also want to save your PRESET which you will have 4 empty slots for that purpose.  The settings will be stored with the frequency as reference so if you play with your settings change your frequency to know which is which.

PRESET>STORE> STORE #

You can setup your presets for them to load on startup if you wish.  I keep my startup stock personally, but this is an option.  Once you have stored your settings to load them is easy.

PRESET>Ex. 0Hz 800MHz (frequency range you selected)

Extra Knowledge

DISPLAY>SWEEP ACCURACY>

NORMAL sets the default sweeping mode

PRECISE sets the precise scanning mode.

FAST sets the fast-sweeping mode.

NOISE SOURCE optimizes the wide span scanning of noise sources.

SPEEDUP allows setting the acceleration factor for fast sweeping.

RBW – sets the scanning resolution.  I recommend setting it to auto unless you have a specific reason.

Rotate Display – Use this to flip the screen 180 degrees.  Maybe you want to mount this on something and want toredirect the USB-C cable up or you are left-handed.

MEASURE

AM settings to optimize observations of AM modulation
FM settings to optimize observations of FM modulation

LEVEL>LNA Turns on and off the Low Noise Amplifier. The built-in LNA provides up to 16dB noise level reduction. The LNA is easily overloaded and has reduced gain above 4GHz.

LEVEL>LISTEN (toggles on and off) This allows you to listen to basic radio signal both FM/AM modulation.  This wont replace a good scanner it does just the basics, but you can listen to certain signals.

CONFIG>USB used to connect to a computer with software and run the TinySA Ultra by the software.

STORAGE>SAVE CAPTURE will save an image of your trace, you can also use LOAD CAPTURE to displace your trace.  I suggest for ease of operation to have AUTO NAME checked on.  It will not save waterfall information.

LESSONS you can visualize.

The last little bit of knowledge I want to present comes from instructions out of the Guerillas Guide to Baofeng.

Lesson 1 Transmission Length – Try sending a transmission using analog/digital in voice, then use either a text message feature or text with a tablet.  Compare the length of time.  If you want to really flex your SIGINT skills have a friend select the frequency, and try to tack them down.

Lesson 2 Antenna Polarization – Try watching a person who is talking the radio from vertical and horizontal antenna positions. Using a stubby antenna and getting some distance will show you how the signal strength changes.  You can also try guessing how the radio is being held with the stock antenna by moving it from vertical to horizontal.