Using the Flipper Zero's Sub-GHz Frequency Analyzer and RSSI to Find Unknown Signals Before You Capture

Most Sub-GHz tutorials assume you already know what frequency your remote or sensor transmits on. In practice you usually don't — a garage remote, weather station, or tire-pressure sensor rarely has its frequency printed anywhere obvious. The Flipper Zero's built-in Frequency Analyzer solves exactly this problem: it listens across a table of common frequencies and reports which one lights up when you press the button, before you ever hit Read.

Only test devices you own or have explicit permission to test. Reading and identifying your own remotes, sensors, and RF devices is the intended and legitimate use of this tool — see this site's other Sub-GHz content for the broader context on responsible use.

How the Frequency Analyzer Actually Works

• The Flipper's CC1101 radio can only listen to one frequency at a time — it isn't a true wideband spectrum analyzer that sees the whole band at once.
• Frequency Analyzer mode works around this by rapidly hopping through a preset list of the most common ISM-band frequencies (the ones regulatory bodies actually allocate for short-range devices) and measuring RSSI (signal strength) at each one.
• When you press the button on the remote you're trying to identify, whichever frequency in that hop list shows an RSSI spike above the noise floor is very likely the one your device transmits on.
• This is a practical shortcut, not a lab-grade tool — it only checks the frequencies in its preset list, so a device on an unusual or non-standard frequency won't be found this way.

Step-by-Step Usage

1. From the main menu, go to Sub-GHz → Frequency Analyzer.
2. Let it sit for a few seconds with nothing transmitting — note the baseline RSSI readings across the hop list. This is your noise floor; everything you read afterward should be judged relative to this baseline, not an absolute number.
3. Hold the Flipper close to the device you're identifying (within a few inches works best for weak transmitters like tire-pressure sensors) and press the device's button or trigger it.
4. Watch for the frequency reading to jump and hold — the display will show the frequency with the strongest detected signal along with its RSSI in dBm.
5. Repeat the button press 2-3 times to confirm you're getting a consistent frequency reading, not a one-off noise spike.
6. Once you have a confirmed frequency, switch to Read (for a recognized protocol) or Read RAW (for anything the built-in protocol library doesn't decode) and manually set that frequency to actually capture the signal.

Reading RSSI Values

RSSI (dBm)What it means -30 to -50Very strong — device is close or transmitting with real power (garage remotes, car fobs at close range) -50 to -70Moderate — typical range for most remotes at a few feet -70 to -90Weak — low-power sensors (weather stations, TPMS) or a remote at distance; still usable but you may need to get closer for a clean capture Below -90 / at noise floorNo real signal at that frequency — this is just ambient RF noise, not your device

Your noise floor baseline reading from step 2 above matters more than these absolute numbers — a "weak" -85 dBm signal against a -100 dBm noise floor is a clear, real detection; the same -85 dBm reading against a noisy -80 dBm floor might just be noise.

When the Frequency Isn't in the Preset List

If nothing shows a clean spike during Frequency Analyzer scanning, the device may be transmitting outside the common preset frequencies it checks. Two fallback approaches:

• Check the device's regulatory compliance label (FCC ID, CE marking) — looking up the FCC ID on the FCC database often reveals the exact operating frequency in the filed test report, which is both more precise and doesn't require guessing.
• Manual frequency stepping in Read RAW — set a specific frequency by hand and check for signal, then step through nearby frequencies (e.g., in 0.05-0.1 MHz increments around a suspected band) if you have a general idea of the region (315, 390, 433.92, or 868/915 MHz depending on your regulatory region and device class).

Common ISM Frequencies by Device Type (Reference)

FrequencyTypically used byRegion notes 315 MHzOlder US garage remotes, some TPMS sensorsCommon in North America 390 MHzOlder garage door openers (some Chamberlain/LiftMaster)North America, legacy devices 433.92 MHzWeather stations, doorbells, generic remotes, many EU/global devicesWidely used worldwide — the most common frequency you'll encounter 868 MHzEuropean short-range devices, some sensorsEU ISM band 915 MHzNorth American ISM devices, some TPMS, LoRa sensor nodesUS/Americas ISM band

Practical Workflow Combining Both Tools

1. Run Frequency Analyzer first on any unidentified device — this takes seconds and tells you where to point the more detailed capture tools.
2. Once you have a frequency, use Read for common protocols (it'll auto-decode known encodings like fixed-code or several rolling-code schemes) or Read RAW when Read doesn't recognize the protocol.
3. Label and save captures with the frequency noted in the filename or Flipper's save dialog — six months later "garage_remote" is a lot less useful than "garage_remote_315mhz."
4. If you're building a personal remote library across multiple devices, this site's Sub-GHz signal library content covers organizing captures long-term.

Troubleshooting

ProblemCauseFix No spike at all when pressing the remoteDevice is on a frequency outside the preset hop list, or you're too far awayMove within a few inches, retry; if still nothing, check the FCC ID for the actual frequency and try manual stepping Multiple frequencies spike simultaneouslyAmbient RF noise, or another nearby device transmitting at the same timeRe-run the baseline noise-floor check in a quieter RF environment, retest Reading is inconsistent between button pressesMarginal signal strength, weak battery in the target device, or antenna orientationGet closer, try reorienting the Flipper relative to the device, or replace the target device's battery if it's a sensor that's been in the field a while Found a frequency but Read won't decode itProtocol isn't in the built-in decode librarySwitch to Read RAW at that frequency to capture the raw signal even without protocol decoding

Frequency Analyzer is the tool that turns "point the Flipper at something and hope" into an actual methodical first step — five seconds of scanning saves a lot of blind frequency-guessing on every new device you're trying to read.