S-0191 - Supplemental 191 - Receiver Hunting and Foxhunting Methods

Author: Patrick Luan de Mattos
Category Path: sdr-hacking
Audience Level: Advanced
Generated at: 2026-04-02T22:50:27.601Z

SUPPLEMENTAL CHAPTER

Supplemental Index: 191

Title: Receiver Hunting and Foxhunting Methods

Audience Level: Advanced

1) Position of this Supplemental Chapter in the Advanced SDR Roadmap

This supplemental chapter, "Receiver Hunting and Foxhunting Methods," sits at a critical juncture in an advanced SDR and RF security roadmap. Having mastered fundamental SDR principles, signal analysis, and potentially basic exploitation techniques, this chapter delves into the practical application of these skills for locating and identifying unintended or unauthorized radio transmissions. It bridges the gap between passive signal observation and active, directed investigation.

Advanced SDR Roadmap Placement:

• Foundational SDR Concepts: (e.g., Sampling, Quantization, Digital Downconversion)
• Signal Analysis & Characterization: (e.g., Spectrum Analysis, Modulation Identification, Protocol Decoding)
• SDR Implementation & Tooling: (e.g., GNU Radio, Python SDR Libraries, Hardware Interfacing)
• Advanced Signal Processing: (e.g., Adaptive Filtering, Beamforming, Advanced Demodulation)
• [Current Chapter] Receiver Hunting and Foxhunting Methods: (Applying signal analysis and directional techniques for localization)
• RF Vulnerability Assessment & Exploitation: (Leveraging found signals for security testing)
• Counter-RF & Interference Mitigation: (Developing strategies to protect against or disrupt RF threats)
• Advanced RF System Design & Security: (Designing secure RF systems from the ground up)

This chapter is particularly relevant for security professionals, researchers, and advanced hobbyists who need to understand how to pinpoint the source of RF emissions for various purposes, from locating rogue access points to identifying jamming sources or tracking illicit transmitters.

2) Deep Conceptual Explanation

Receiver hunting, often colloquially referred to as "foxhunting" in amateur radio contexts, is the art and science of locating the physical origin of an RF signal. This process is crucial in numerous scenarios:

• Security Audits: Identifying unauthorized or rogue transmitters (e.g., hidden listening devices, unauthorized Wi-Fi access points, illicit communication links).
• Interference Resolution: Pinpointing the source of harmful interference that is disrupting legitimate communications.
• Emergency Services: Locating distress beacons or lost individuals transmitting signals.
• Spectrum Management: Identifying illegal or unlicensed transmissions.
• Asset Tracking: Locating devices equipped with RF transmitters.

The core principle behind receiver hunting is direction finding (DF). By using specialized antennas and techniques, one can determine the direction from which a signal is strongest. Repeating this process from multiple locations or with different antenna configurations allows for the triangulation of the signal's source.

Key Concepts:

• Signal Strength Indication (RSSI): While not a direct indicator of direction, RSSI readings provide a quantitative measure of signal power received. As a hunter moves closer to a transmitter, RSSI typically increases, and as they move away, it decreases. This helps confirm proximity and the effectiveness of directional efforts.
• Antenna Directivity: Directional antennas are paramount. They are designed to receive signals most effectively from a specific direction while attenuating signals from other directions. The sharper the antenna's beamwidth, the more precise the directional estimation.
• Triangulation: This is the geometric method of locating a point based on bearings from two or more known points. In RF hunting, this translates to taking directional bearings to the signal source from at least two different, known locations. The intersection of these bearings (or lines of bearing) indicates the approximate location of the transmitter.
• Signal Characteristics: Understanding the nature of the signal (frequency, bandwidth, modulation, pulse characteristics) is vital for efficient hunting. Knowing what you're looking for helps filter out noise and identify the target signal amidst others.

3) Architecture and Signal Reasoning

The architecture for receiver hunting typically involves a combination of hardware and software components working in concert.

Hardware Components:

1. SDR Receiver: A wideband or tunable SDR capable of receiving the target signal's frequency range.
2. Directional Antennas: This is the most critical component. Examples include:
   • Yagi-Uda Antennas: Highly directional, offering good gain and a narrow beamwidth.
   • Log-Periodic Antennas: Wideband and directional, suitable for scanning across a range of frequencies.
   • Helical Antennas: Can be used for circular polarization and provide some directionality.
   • Phased Arrays (more complex): Allow for electronic beam steering without physical movement.
3. Rotary Joints/Switches (for multi-element antennas): If using antennas with multiple elements that are switched or phased, these components are necessary.
4. GPS Receiver: For accurately logging the hunter's location and potentially the bearing angles.
5. Compass/IMU: To provide an accurate heading reference for the directional antenna.
6. Data Logging Device: A laptop or tablet to run the SDR software and record data.

Software Components & Signal Reasoning:

The software stack is responsible for:

1. Signal Acquisition & Tuning: The SDR software tunes to the suspected frequency of the target signal.
2. Spectrum Analysis: Visualizing the RF spectrum to identify the target signal and its characteristics (frequency, bandwidth, power).
3. RSSI Monitoring: Continuously or periodically measuring the RSSI of the target signal. This is the primary metric for assessing signal strength.
4. Directional Antenna Control/Integration: If using an antenna with multiple elements or a steerable array, the software may integrate with control mechanisms. More commonly, the software will display RSSI while the operator manually rotates and aims the directional antenna.
5. Data Logging: Recording signal parameters (frequency, RSSI, timestamp) and the hunter's location and antenna bearing.
6. Visualization: Displaying signal strength plots, spectrum waterfalls, and potentially mapping the hunter's path and bearing data.

Signal Reasoning in Practice:

• Initial Sweep: The hunter starts by scanning the suspected frequency band. The spectrum waterfall is invaluable here, showing transient signals as well as continuous ones.
• Target Identification: Once a candidate signal is found, its characteristics are analyzed. Is it pulsed? Modulated? Does it match expected patterns?
• Directional Sweep: With a directional antenna, the hunter slowly rotates it, observing the RSSI. The direction where RSSI peaks is the approximate bearing to the transmitter.
• Signal Attenuation: As the hunter moves, they observe RSSI. If they are moving towards the transmitter, RSSI should increase. If they are moving away, it should decrease. This helps confirm they are on the right track.
• "Attenuation Tricks": These are techniques to refine direction finding:
  • "Nulling" the Antenna: Instead of finding the peak, some methods involve finding the point where the signal is weakest (the null). This can be more precise with certain antenna designs.
  • "Peaking" the Antenna: The standard method of rotating to find the maximum signal strength.
  • Multiple Bearings: Taking bearings from different locations is essential for triangulation.
  • "Homing" In: Moving in a direction that consistently increases RSSI.
  • "Cross-Bearing": Moving to a new location and taking another bearing. The intersection of the two bearings is the estimated location.

Example Signal Diagram (Conceptual):

Imagine hunting for a rogue Wi-Fi access point on 2.4 GHz.

         ^ North
         |
  (Hunter Loc A) ----- Bearings ---> (Signal Source - Rogue AP)
         |                                      /
         |                                     /
         |                                    /
         |                                   /
         |                                  /
         |                                 /
         |                                /
         |                               /
         |                              /
         |                             /
         |                            /
         |                           /
         |                          /
         |                         /
         |                        /
         |                       /
         |                      /
         |                     /
         |                    /
         |                   /
         |                  /
         |                 /
         |                /
         |               /
         |              /
         |             /
         |            /
         |           /
         |          /
         |         /
         |        /
         |       /
         |      /
         |     /
         |    /
         |   /
         |  /
         | /
         -----------------------------> East
         (Hunter Loc B)

In this diagram, Hunter Loc A takes a bearing towards the Signal Source. Hunter Loc B, at a different known location, also takes a bearing. The intersection of these two lines of bearing approximates the location of the rogue AP.

4) Python Examples When Applicable

Python, combined with SDR libraries like pyrtlsdr or SoapySDR, is excellent for automating signal acquisition, RSSI monitoring, and data logging.

Example 1: Basic RSSI Monitoring with pyrtlsdr

This example demonstrates how to tune an RTL-SDR dongle to a specific frequency and continuously read its RSSI.

from rtlsdr import RtlSdr
import time
import math

# --- Configuration ---
SAMPLE_RATE = 2.4e6  # Hz
CENTER_FREQ = 433.92e6 # Hz (Example: common ISM band frequency)
GAIN = 'auto'        # or a specific gain value like 30
NUM_SAMPLES = 1024   # Number of samples to read per burst
DURATION = 60        # Seconds to run the monitor

# --- Initialize SDR ---
try:
    sdr = RtlSdr()
    sdr.sample_rate = SAMPLE_RATE
    sdr.center_freq = CENTER_FREQ
    sdr.gain = GAIN
    print(f"SDR initialized. Tuning to {CENTER_FREQ / 1e6:.2f} MHz at {SAMPLE_RATE / 1e6:.2f} MSps.")
except Exception as e:
    print(f"Error initializing SDR: {e}")
    exit()

# --- RSSI Calculation Helper ---
# RSSI is typically provided in dBFS (dB Full Scale).
# To convert to dBm, you often need a calibration factor or a lookup table
# specific to the SDR hardware and gain setting.
# For simplicity, we'll just work with dBFS here, which is proportional to power.
# A more accurate conversion would involve:
# dBm = dBFS + gain_setting_in_dB + calibration_offset_in_dB

def calculate_rssi_dbfs(samples):
    """Calculates the RSSI in dBFS from a block of IQ samples."""
    # Power is proportional to the mean of the squared magnitudes
    power = sum([abs(s)**2 for s in samples]) / len(samples)
    if power == 0:
        return -float('inf') # Avoid log(0)
    # Convert power to dBFS. The reference is the maximum possible power.
    # For a 16-bit ADC, max power is (2^15)^2 * 2 = 2^31
    # For RTL-SDR (8-bit), max power is (2^7)^2 * 2 = 2^15
    # A simpler approach is to use the SDR's reported RSSI if available,
    # or work with relative power.
    # For a rough dBFS estimate:
    # Max theoretical power for 8-bit unsigned is (127.5)^2 * 2.
    # A common empirical approach for RTL-SDR without calibration:
    # Use the mean of the squared magnitudes directly, or a simpler approximation.
    # Many SDRs provide a direct RSSI value. RTL-SDR doesn't directly expose dBFS this way.
    # We can approximate by taking the log of the average power.
    # A common approximation for RTL-SDR: RSSI_dBFS = 10 * log10(mean_squared_magnitude) - C
    # Where C is an empirically determined constant.
    # For this example, we'll return a value proportional to power.
    # A more robust approach would involve using a calibrated conversion.

    # Let's use a common empirical approximation for RTL-SDR:
    # The SDR's internal RSSI value (often in dB units) is a good proxy.
    # If not directly available, calculate from samples.
    # For demonstration, we'll use a simplified relative power indicator:
    # Average magnitude squared.
    avg_power_magnitude = sum(abs(x)**2 for x in samples) / len(samples)
    if avg_power_magnitude == 0:
        return -float('inf')
    return 10 * math.log10(avg_power_magnitude) # This is NOT dBFS but proportional

# --- Main Hunting Loop ---
print("Starting receiver hunt. Press Ctrl+C to stop.")
start_time = time.time()

try:
    while time.time() - start_time < DURATION:
        iq_samples = sdr.read_samples(NUM_SAMPLES)
        rssi = calculate_rssi_dbfs(iq_samples) # This is a relative power indicator

        # A more direct way for some SDRs (like HackRF, LimeSDR) might be:
        # rssi_direct = sdr.read_rssi() # If the library/hardware supports it

        current_time = time.time()
        print(f"Time: {current_time:.2f}, Relative RSSI: {rssi:.2f} dB (proportional)")
        time.sleep(0.1) # Small delay to avoid overwhelming the console/CPU

except KeyboardInterrupt:
    print("\nStopping receiver hunt.")
except Exception as e:
    print(f"An error occurred during hunting: {e}")
finally:
    sdr.close()
    print("SDR closed.")

Explanation:

• This script initializes an RTL-SDR dongle.
• It tunes to a CENTER_FREQ and sets a SAMPLE_RATE.
• The read_samples function captures a block of IQ data.
• calculate_rssi_dbfs attempts to estimate signal strength. Important Note: Directly calculating dBFS from raw IQ samples without proper calibration for the specific SDR and gain setting is complex. The example provides a proportional value. In a real-world scenario, you'd either rely on an SDR that provides direct RSSI readings in dBm, or perform careful calibration.
• The loop continuously reads samples and prints the relative RSSI.
• By manually moving and aiming a directional antenna while observing these RSSI readings, you can find the direction of maximum signal strength.

Example 2: Integrating with a Directional Antenna (Conceptual)

This example shows how you might integrate with a hypothetical antenna system that provides bearing data. This is more of a conceptual illustration as real-world integration depends heavily on the antenna controller's API.

# This is a conceptual example. Actual integration requires a specific
# antenna controller's API and communication protocol (e.g., serial, network).

import time
from rtlsdr import RtlSdr # Assuming RTL-SDR for signal reception

# --- Mock Antenna Controller ---
class MockAntennaController:
    def __init__(self):
        self.current_azimuth = 0 # Degrees
        self.current_elevation = 0 # Degrees
        print("Mock Antenna Controller initialized.")

    def set_direction(self, azimuth, elevation=0):
        """Sets the antenna to a specific direction."""
        self.current_azimuth = azimuth
        self.current_elevation = elevation
        print(f"Antenna set to Azimuth: {self.current_azimuth:.1f} deg")
        # In a real system, this would command hardware to move.
        # Simulate a slight delay for antenna movement.
        time.sleep(0.2)
        return True

    def get_current_direction(self):
        return self.current_azimuth, self.current_elevation

# --- Configuration ---
SAMPLE_RATE = 2.4e6
CENTER_FREQ = 433.92e6
GAIN = 'auto'
NUM_SAMPLES = 1024

# --- Initialize SDR ---
try:
    sdr = RtlSdr()
    sdr.sample_rate = SAMPLE_RATE
    sdr.center_freq = CENTER_FREQ
    sdr.gain = GAIN
    print(f"SDR initialized. Tuning to {CENTER_FREQ / 1e6:.2f} MHz.")
except Exception as e:
    print(f"Error initializing SDR: {e}")
    exit()

# --- Initialize Mock Antenna Controller ---
antenna_controller = MockAntennaController()

# --- Hunting Function ---
def hunt_for_signal(start_az, end_az, step_az, target_freq):
    """
    Sweeps antenna across azimuths and logs strongest signal direction.
    """
    print(f"Starting directional sweep from {start_az} to {end_az} degrees.")
    best_az = -1
    max_rssi = -float('inf')
    sdr.center_freq = target_freq # Ensure SDR is tuned to target

    for azimuth in range(start_az, end_az, step_az):
        antenna_controller.set_direction(azimuth)
        current_az, _ = antenna_controller.get_current_direction()

        try:
            iq_samples = sdr.read_samples(NUM_SAMPLES)
            # Using the same simplified RSSI calculation as before
            avg_power_magnitude = sum(abs(x)**2 for x in iq_samples) / len(iq_samples)
            if avg_power_magnitude == 0:
                rssi = -float('inf')
            else:
                rssi = 10 * math.log10(avg_power_magnitude)

            print(f"  Azimuth: {current_az:.1f} deg, Relative RSSI: {rssi:.2f} dB")

            if rssi > max_rssi:
                max_rssi = rssi
                best_az = current_az

        except Exception as e:
            print(f"Error reading samples at {current_az} deg: {e}")
            continue # Move to next azimuth

    print(f"\nSweep complete. Strongest signal at Azimuth: {best_az:.1f} deg with RSSI: {max_rssi:.2f} dB")
    return best_az, max_rssi

# --- Main Execution ---
if __name__ == "__main__":
    try:
        # Simulate a sweep from 0 to 360 degrees with 10 degree steps
        # In a real hunt, you'd do this from multiple locations.
        strongest_azimuth, signal_strength = hunt_for_signal(0, 360, 10, CENTER_FREQ)

        if strongest_azimuth != -1:
            print(f"Initial bearing to transmitter: {strongest_azimuth} degrees.")
            # Now, one would move to a new location and repeat the process
            # to triangulate the source.
    except KeyboardInterrupt:
        print("\nHunt interrupted.")
    finally:
        sdr.close()
        print("SDR closed.")

Explanation:

• This script introduces a MockAntennaController. In a real setup, this class would interface with a hardware antenna rotator.
• The hunt_for_signal function iterates through a range of azimuths, commanding the antenna to point in each direction.
• For each direction, it reads samples from the SDR and calculates RSSI.
• It logs the azimuth that yielded the highest RSSI.
• This is a simplified representation of a single directional sweep. A full foxhunt would involve repeating this from multiple locations to triangulate.

5) GNU Radio Examples When Applicable

GNU Radio, with its graphical flowgraph design and Python integration, is exceptionally well-suited for building sophisticated receiver hunting tools.

Conceptual Flowgraph: Directional Antenna Sweep

This flowgraph illustrates a common approach using a directional antenna. The key idea is to sweep the antenna across different directions and correlate the signal strength with the antenna's current bearing.

+-----------------+      +---------------------+      +-------------------+      +--------------------+
|      SDR Source |----->|      Complex To Mag |----->|     Moving Avg    |----->|     Const. Sink    |
| (e.g., RTL-SDR) |      |     (Magnitude^2)   |      |      Filter       |      | (e.g., File Sink   |
|                 |      |                     |      |      (RSSI est.)  |      |  or GUI Widget)    |
+-----------------+      +---------------------+      +-------------------+      +--------------------+
        |
        | (Control/Metadata)
        |
        v
+--------------------+
| Antenna Controller |
|   (Python Block)   |
|                    |
| - Set Azimuth      |
| - Get Current Az   |
+--------------------+
        |
        | (External - e.g., Serial/Network)
        |
        v
+--------------------+
| Hardware Antenna   |
|      Rotator       |
+--------------------+

Explanation of Blocks:

1. SDR Source: This block interfaces with your SDR hardware (e.g., RTL-SDR, HackRF). It outputs complex IQ samples.
2. Complex To Mag (or equivalent): This block takes the complex IQ samples (I + jQ) and calculates their magnitude squared (I^2 + Q^2). This value is directly proportional to the signal power.
3. Moving Average Filter: A moving average filter is applied to the power estimates. This smooths out fluctuations in RSSI, making it easier to identify the peak. The output of this block is a more stable estimate of the signal's power.
4. Const. Sink (or GUI): This block can either log the RSSI estimates along with the current antenna bearing to a file, or display it in real-time on a GUI widget (like a scope or a plot).
5. Antenna Controller (Python Block): This is a custom Python block that acts as an intermediary. It receives commands (e.g., "set azimuth to 45 degrees") and potentially sends them to a hardware antenna rotator via a serial port or network. It also needs to know the current azimuth of the antenna. This block would encapsulate the logic for communicating with the rotator.

GNU Radio Python Block Example (for Antenna Control):

Let's imagine a Python block that controls a serial-based antenna rotator.

# Inside GNU Radio Companion, you'd create a Python Block.
# This is the Python code that would go into the block's "Code" tab.

import numpy as np
import serial
import time

class GRAntennaController(gr.sync_block):
    def __init__(self, port='/dev/ttyUSB0', baudrate=9600):
        gr.sync_block.__init__(
            self,
            name='Antenna Controller',
            in_sig=None, # No input signals for this block
            out_sig=[(np.float32, 'azimuth'), (np.float32, 'rssi')] # Outputting current azimuth and estimated RSSI
        )
        self.port = port
        self.baudrate = baudrate
        self.ser = None
        self.current_azimuth = 0.0
        self.last_rssi_estimate = -np.inf

        try:
            self.ser = serial.Serial(self.port, self.baudrate, timeout=1)
            print(f"Antenna Controller: Connected to {self.port} at {self.baudrate} baud.")
            # Potentially send initialization commands to rotator here
            # e.g., self.ser.write(b'INIT\n')
        except serial.SerialException as e:
            print(f"Antenna Controller: Error connecting to serial port {self.port}: {e}")
            self.ser = None # Ensure ser is None if connection fails

    def work(self, input_items, output_items):
        # This is where the logic for controlling the antenna and reporting
        # its status would go.
        # In a typical flowgraph:
        # 1. The flowgraph would periodically command this block to move the antenna.
        # 2. This block would send commands to the rotator.
        # 3. It would then need to read back the current azimuth or estimate it.
        # 4. It would also receive the RSSI estimate from upstream blocks.

        # For demonstration, let's assume this block *receives* the RSSI estimate
        # and *outputs* the current azimuth. The actual RSSI calculation happens upstream.
        # In a real flowgraph, you might have an input port for RSSI from the
        # moving average filter.

        # This example is highly simplified. A real block might:
        # - Receive a command to set azimuth (e.g., via a message port).
        # - Send the command to the serial port.
        # - Read back the current azimuth from the rotator.
        # - Output the current azimuth.
        # - Receive RSSI from another block and potentially log it with the azimuth.

        # Let's simulate receiving RSSI and *requesting* a new azimuth.
        # This requires a more complex flowgraph setup with message passing or
        # multiple ports.

        # A more common pattern in GRC is to have a 'Python Block' that *receives*
        # RSSI and *outputs* the azimuth that yielded the highest RSSI during a sweep.
        # Or, a block that *receives* a commanded azimuth and *outputs* the RSSI
        # measured at that azimuth.

        # Let's refine: Assume this block is responsible for *sweeping* and
        # finding the best azimuth, then reporting it.
        # This implies it would need to control the antenna, read RSSI, and decide.

        # A better approach for GRC would be:
        # 1. SDR Source -> ComplexToMag -> MovingAvgFilter (outputs RSSI estimate)
        # 2. A separate Python Block (e.g., 'DirectionFinder') that:
        #    - Receives RSSI estimates.
        #    - Controls the antenna rotator (via serial).
        #    - Increments azimuth, waits, reads RSSI, records.
        #    - After a full sweep, reports the best azimuth.

        # Let's stick to the conceptual GRC flowgraph described above where
        # 'Antenna Controller' is a Python block that *interfaces* with hardware.

        # If this block has output ports for azimuth and rssi, it needs to populate them.
        # Let's assume it's *commanded* to a specific azimuth and then reports
        # the RSSI it measured *at* that azimuth.

        # This block would typically be driven by an external trigger or message.
        # For this example, we'll just output some placeholder values.
        # In a real GRC flowgraph, you'd connect the output of the Moving Avg Filter
        # to an input port of this Antenna Controller block, or use message passing.

        azimuth_out = output_items[0]
        rssi_out = output_items[1]

        # Placeholder: In a real scenario, this block would be commanded to move.
        # Let's assume we are in a sweep and have just measured RSSI.
        # The 'work' function is called when data is available to be processed.
        # We'll simulate receiving the RSSI estimate from an upstream block.
        # For simplicity, let's assume the RSSI input is implicitly available.

        # This block might be triggered to move to a new azimuth.
        # Let's assume it's part of a loop that calls it to move and then
        # the upstream blocks provide the RSSI for that position.

        # --- Simplified Simulation ---
        # Imagine this block is commanded to move to 'self.current_azimuth'
        # and the upstream blocks have already measured RSSI at this azimuth.
        # This block's job is to report the azimuth it's currently at, and
        # the RSSI it measured.

        # We'll try to read the RSSI from an input_item, if available.
        # This requires defining an input port for RSSI in the block definition.
        # Let's redefine the block to accept RSSI as input.

        # Redefining class to accept RSSI input:
        # class GRDirectionFinder(gr.sync_block):
        #     def __init__(self, port='/dev/ttyUSB0', baudrate=9600):
        #         gr.sync_block.__init__(
        #             name='Direction Finder',
        #             in_sig=[(np.float32, 'rssi_in')], # Input for RSSI
        #             out_sig=[(np.float32, 'best_azimuth')] # Output best azimuth
        #         )
        #         ... [serial setup] ...
        #         self.best_az = -1.0
        #         self.max_rssi = -np.inf
        #         self.current_sweep_az = 0.0 # To track sweep progress

        #     def work(self, input_items, output_items):
        #         rssi_in = input_items[0][0]
        #         best_az_out = output_items[0]

        #         # Log RSSI and current azimuth (which we'd need to track)
        #         print(f"  Measured RSSI: {rssi_in:.2f} at Azimuth: {self.current_sweep_az:.1f}")

        #         if rssi_in > self.max_rssi:
        #             self.max_rssi = rssi_in
        #             self.best_az = self.current_sweep_az

        #         # Command rotator to move to the next azimuth
        #         self.current_sweep_az += 10.0 # Example step
        #         if self.current_sweep_az >= 360.0:
        #             # Sweep finished, report best azimuth
        #             best_az_out[0] = self.best_az
        #             print(f"Sweep finished. Best Azimuth: {self.best_az}")
        #             # Reset for next sweep if needed
        #             self.best_az = -1.0
        #             self.max_rssi = -np.inf
        #             self.current_sweep_az = 0.0
        #             # Send command to rotator for self.current_sweep_az
        #             # ... serial write command ...
        #             return 1 # Processed one item
        #         else:
        #             # Send command to rotator for self.current_sweep_az
        #             # ... serial write command ...
        #             # Return 0 to indicate no output item ready yet, wait for more RSSI
        #             return 0

        # The above is a more realistic GRC Python block for direction finding.
        # For the current conceptual diagram, we'll just output placeholders.

        azimuth_out[:] = self.current_azimuth
        rssi_out[:] = self.last_rssi_estimate # Placeholder

        # In a real GRC flowgraph, the 'work' method is called when data is ready.
        # The data flow would dictate what this block does.
        # For instance, if it receives an 'azimuth_command' message, it moves the antenna.
        # If it receives RSSI data, it might log it with the current azimuth.

        # Since this is a conceptual example, we'll assume a simplified mechanism
        # where this block is called periodically to update its output.
        # In a real GRC flowgraph, you would connect the output of the Moving Avg Filter
        # to an input of this block, and then this block would output the best azimuth found.

        # To make this function actually *do* something in GRC, it needs to interact
        # with upstream/downstream blocks or message ports.
        # This example is more illustrative of the *concept* of a Python block.

        return 1 # Indicate that one output item has been produced.

# Example of how this block might be used in a GRC flowgraph:
# A 'Message Source' block might send 'set_azimuth' messages.
# This Python block would receive these messages, command the rotator,
# and then the 'SDR Source' -> 'Complex To Mag' -> 'Moving Avg' chain
# would measure RSSI. The RSSI would then be fed back to this block (or another)
# to determine the best azimuth.

Practical Workflow in GRC:

1. Set up SDR Source: Configure your SDR hardware (e.g., RTL-SDR) with the correct sample rate and center frequency.
2. Power Calculation: Use ComplexToMag or ComplexToReal followed by squaring to get power estimates from IQ samples.
3. RSSI Smoothing: Employ a Moving Average or Low Pass Filter to smooth the power estimates.
4. Antenna Control (Python Block): Create a Python block that interfaces with your antenna rotator. This block should be able to:
   • Receive commands to set a specific azimuth.
   • Send commands to the hardware rotator.
   • (Ideally) Read back the current azimuth from the rotator.
5. Data Logging/Visualization: Use File Sink to log RSSI and corresponding azimuths, or QT GUI widgets (like Number Sink or Scope Sink) to visualize RSSI as the antenna sweeps.
6. Sweep Logic: The overall logic for sweeping the antenna and identifying the peak RSSI might be managed by a Python block, a message passing system, or a combination. For a full sweep (0-360 degrees):
   • The Python block commands the rotator to move to 0 degrees.
   • The flowgraph proceeds to measure RSSI at 0 degrees.
   • The Python block receives this RSSI (or it's logged with the azimuth).
   • The Python block commands the rotator to move to 10 degrees.
   • This repeats for all desired azimuth steps.
   • Finally, the block analyzes the logged data to find the azimuth with the highest RSSI.

6) Visual Examples

Visual Example 1: Spectrum Analyzer with Directional Antenna

Imagine you are using a spectrum analyzer (or a GNU Radio flowgraph with a waterfall display) and a directional antenna.

      ^ Frequency
      |
      |       +---------------------+
      |       |                     |
      |       |                     |  <-- Target Signal
      |       |                     |
      |       +---------------------+
      |----------------------------------------> Time (Waterfall)
      |
      +---------------------------------------->

When you point your directional antenna towards the signal source, the target signal will appear prominently in the spectrum and the waterfall. As you move the antenna away, the signal's power (represented by the height of the trace or the intensity in the waterfall) will decrease.

Visual Example 2: RSSI Plot During Antenna Sweep

This is a conceptual plot showing RSSI (vertical axis) as the antenna is rotated (horizontal axis, representing azimuth).

      ^ RSSI (dB)
      |
      |      /----\     /----\
      |     /      \   /      \
      |    /        \ /        \
      |---/----------\----------\----
      |
      +-------------------------------------> Azimuth (Degrees)
        0         90        180       270       360

In this plot, you can see peaks in RSSI at certain azimuths. The highest peak indicates the direction from which the signal is strongest. A hunter would record these peak azimuths.

**Visual Example

This chapter is educational, lab-oriented, and constrained to lawful, defensive, and controlled research contexts.