Messages From Space: Intercepting Satellite ACARS
If you remember the recent satellite dish article, where we looked at how old dishes can be repurposed, you might recall that we specifically called out ACARS as a system that was inherently insecure. This is a real-world legacy protocol that has been examined, pulled apart and looked at in detail by volunteer researchers.
The response to the article was entirely predictable, as a bunch of you wanted to figure out how to do it for yourself.
Ask, and you shall receive, because today, we’ll take a look at intercepting satellite ACARS via L-band transmissions.
What Is ACARS?
The Aircraft Communications and Reporting System (ACARS) is the global messaging protocol that underpins the modern aviation network. Covering things like Position reports, weather updates, engine telemetry, gate assignments and fuel loads, ACARS allows pilots to use digital transmissions to help ease the load on the Air Traffic Control network.
It was designed in 1978. Like a lot of other protocols, the security model has not kept pace with the times.
VHF ACARS is well documented, widely decoded and trivial to receive with a basic whip antenna and an RTL-SDR. So let’s not waste time on it. We’re going to chase the interesting one.
L-Band Satellite ACARS
With VHF struggling to propagate beyond the radio horizon, satellite ACARS changes this entirely by providing a legitimate, long-range system that’s actually functional. To do this, it will leverage the Inmarsat network to extend the range of transmissions.
This is the same protocol, with the same messaging format. The only difference between L-band and the lower VHF ACARS that is used in populated regions is that L-band transmissions will bounce through a satellite more than 35,000 km away.
For reception, this changes the equation entirely. Rather than needing aircraft within the view of your radio horizon, we can simply orient our antenna system towards the satellite and pick up an entire region’s worth of ACARS data.
Transatlantic flights, Pacific crossings and routes that will never pass within range of a VHF station are just some of the types of traffic you will see.
To get started, we’ll need the following equipment:
- RTL-SDR dongle
- A 1.5 GHz patch antenna
- JAERO software
- A clear view of the sky toward your nearest Inmarsat satellite
- Tracking Software (gPredict, Look4Sat, ISS Detector)
Note: Satellites will vary according to your location. Ensure that you pick one with good elevation in relation to your horizon and carry out some checks online to ensure that it is active and still currently sending data.
Once you’ve identified your satellite of interest, we’ll need to set up our receiving station to capture the data. We can do this by pointing our panel antenna towards the area of the satellite and optimising the antenna to ensure it is roughly at the correct azimuth/elevation.
Next, we’ll tune to a known ACARS frequency of 1545.9Mhz and hit start on our SDR software to ensure that it starts correctly. If your antenna is oriented correctly, you should start to see a carrier signal from the satellite drift down into the waterfall.
If you can’t find the satellite, you might like to ensure that your station is working correctly and your antenna is functional. A good way to verify this is to lock onto a GPS satellite signal. GPS transmits at 1575.42 MHz, which is close enough to our L-band target that a clean GPS lock confirms your patch antenna, SDR and signal chain are all functioning as expected.
If you can see GPS, you’re ready to go searching. 
Audio Piping & Routing
Because Jaero won’t access our RTL-SDR device directly, we’ll need to ensure that we’ve piped our audio into Jaero via GQRX so that it can be decoded.
The bridge for this is pretty easy, we’ll use a simple SDR audio pipe between your SDR program of choice and Jaero. The setup for this is simple.
Set your SDR software to output audio to the virtual cable, then point JAERO’s audio input at the same virtual device. Then, set the audio output to your virtual cable in the GQRX settings, launch JAERO and select the matching virtual input. Once the pipe is in place, JAERO receives the demodulated audio stream and handles all of the decoding from there.
VB-Audio Virtual Cable is the go-to free option for Windows. For Linux users, PulseAudio handles the same job natively, making it quick and easy to deploy.
Provided you’ve managed to lock onto your desired satellite and have piped your audio cable correctly into Jaero, you should see messages and frames start to appear on your dashboard.
What You’re Looking At
While the satellites that carry ACARS traffic can carry some forms of restricted data, for the most part, receiving satellite ACARS transmissions is free and unregulated in many jurisdictions. We’re setting up a station to capture broadcast transmissions, not intercepting commercially sensitive data. However, it’s worth understanding the laws that are relevant to your location to ensure you are staying legal.
It’s also worth considering what it is we are actually looking at once your feed is established. When looking at satellite ACARS, it’s important to understand that contextually, we are looking at one side of the picture only.
Satellite ACARS will use C-band for communications from air to ground and L-Band for ground to air. To gain the full picture of what is happening, you’ll need to capture and aggregate both feeds.
However, if you’re capturing L-band only, you should still be able to get a bit of an idea regarding what is going on within the satellite's footprint.
Over To You
Intercepting L-band transmissions is a much more detailed process than the previous VHF signals we’ve looked at in other projects. Antennas, feedlines, and even the choice of SDR dongle you decide to use will all have an impact on the success of your project.
Satellite ACARS is well documented at this point, and some people might ask why we might choose to tackle a project like this when it’s been covered so extensively before.
The reality is that for those making their entry into L-band, this documentation is a key part of being able to deploy a station that works. Should you encounter problems, you can use this to troubleshoot, fault-find or modify your way out of trouble without it becoming an exercise in frustration.
The L-band also helps to highlight one final point that is important for those interested in the wireless research side of things. The fact that L-band messages exist in plaintext and can be read by those with the appropriate hardware was discovered by hobbyist and civilian researchers carrying out research projects, just like this one.
Space is fun.
Investigator515 explores the RF spectrum, cybersecurity, and the hidden tech behind modern espionage.
Follow for new content weekly
Bluesky • X • Substack
You might also like,
- OSINT Investigators Guide to Self Care & Resilience
- Spies In The Mud: The RF-111 Aardvark
