The lion kingdom somehow had exactly 1 CC1350 Launchpad from a day job.  It wasn't very useful without a 2nd CC1350 to talk to.  The CC1350 supports a wide band at 900Mhz & 2.4Ghz, making it pretty useful for scanning.  There was a long desire to make a spectrum analyzer out of a cheap radio like this.

It is possible to make a barely useful spectrum analyzer from a cheap radio. The trick is they only output a demodulated signal, so the only way to get the power level of a swath of frequencies is to sweep & measure the RSSI.  

Given enough time, however, it can measure more bandwidth at a higher resolution than a much more expensive spectrum analyzer from long ago.  Interestingly, sweeping & measuring RSSI is how the mighty Ubertooth works.  It does it a lot faster because it's expensive.

The user interface was derived from the mighty grapher program, which the lion kingdom may someday package.

After installing all 4GB required to compile programs for the CC1350 & hacking the grapher program, it was slowly plotting the spectrum.

Here, we have scanned the CC1350's entire low range.  852Mhz to 1128Mhz in 100khz steps, revealing cell phone traffic below 900Mhz, a home made remote control at 900Mhz, & silence in the ISM band.  This took 60 seconds.  The command was

specan -s 100

With the home made remote control off, we just see the cell phone traffic below 900Mhz.

Lacking reticules, the only way to estimate peak values is clicking on the graph & looking at the console.

specan -s 100 -b 852000 -t 915000

We can sweep just the region below 915Mhz to compare with & without the 900Mhz remote control.

specan -s 100 -d 2000 -b 852000 -t 915000 

The default is to take 1000 RSSI readings per frequency, but doubling it reveals a much fatter peak where the remote control is.  That's because the remote control has a large gap between packets & increasing the RSSI sample time increases the chance of hitting a packet.  If the RSSI sample time is too short, the RSSI sample times coincide with the off times of the transmitter, creating beating as the frequency sweeps.

specan -s 10 -d 1000 -b 852000 -t 915000 

Then of course, setting the frequency step to 10khz produces much higher frequency resolution, making those phone calls pop.  The RSSI readings were set to 1000 to make it finish in a reasonable time, but also yielding beating in the remote control frequencies.  This took 3 minutes to plot.

specan -s 10

Then, given 20 minutes, it can plot the full range in 10khz steps, with & without the remote control.  Compare to the same range plotted above, in 100khz steps.  That home made remote control makes a lot of interference. 

Frequency hopper plotted with different parameters. That's about as good as HackRF can get it, but slower.

The step size & the RSSI sample time greatly affect the plots.  The CC1350 measures its RSSI from a very narrow bandwidth, with no way to configure it.

The amount of plotting & tweeking possible with a cheap radio makes lions wonder what could be done with a full HackRF & what could be plotted from the great beyond.  Would almost say for watching TV, the $80 Chinese HackRF is a better deal than a DVB dongle.

After much fiddling, got the CC1350 launchpad to scan the 2.4Ghz band. It's limited to 2.360Ghz - 2.507Ghz in 1Mhz steps, but we have some flexibility in the number of RSSI samples per channel. Here the range is scanned with & without a 2.4Ghz RC controller nearby. It's quite packed with wifi.

The scanner is thus very useful for finding a gap for your router.  In this case, the apartment complex had wifi users below 2422 & above 2443, so after a simple adjustment.

The lion den was using the empty area.  It's quite clear that the neighbors watch TV all night using wifi.

Of course, more expensive routers automatically hop frequencies to find the best reception, but lions are still using manually configured hostapd.  The CC1350 launchpad could be used to automatically reconfigure hostapd as spectrum usage changed.  It would have to wait for times when the eth0 device wasn't being used.

The 900Mhz & 2.4Ghz bands are handled by different radios, what the CC1350 demos refer to as the proprietary radio & the BLE radio.  The proprietary radio has a lot more flexibility.  It would be amusing to scan both bands simultaneously, just to put this spectrum analyzer in a different league, but it would waste a lot of room on the GUI.

The source code was released as