# Building a Spectrum Analyser w/ nRF24L01 > Which channel works best for your Zigbee? By Zsolt Bizderi · Published 2026-10-07 Canonical: https://ambientnode.uk/spectrum-analyser-nrf24l01 The 2.4 GHz band can get saturated easily when your Wi-Fi, countless Bluetooth devices, the neighbour's baby monitor, and your entire Zigbee mesh are all crammed into the same 85 MHz of spectrum. When your smart home gets laggy, the usual advice is to move your Zigbee to a quieter channel. But how can you determine what is actually a quieter channel? Obviously, the answer completely depends on your environment, Channel 20 may work for some but is oversaturated for others. This post is about building a self-contained 2.4 GHz spectrum analyser using an ESP32, a pocket device to carry around the house, point at the band, and have it tell you the best channels to use for Wi-Fi and Zigbee in order to avoid overlap. ![](/media/d6d46413-a7ac-4664-9e82-5b54baee9421/745.webp) *** ## How it works The nRF24L01+ is not a spectrum analyser by any means and it was never meant to be one, it's just a cheap digital transceiver designed to transmit small packets. It has no FFT and no calibrated power measurement, but it does have a Received Power Detector. This is a single bit that goes high when there's a signal stronger than about -64 dBm on the channel you're listening to, and stays low otherwise. So per-channel, you get "busy" or "quiet" and this build piggybacks off of that feature. One bit on its own is pretty useless, but if you sample the same channel thirty times in a row and count how many come back busy, you can start building a pattern. Then, repeat this across all 126 channels and we get an approximate map of the band usage. The nRF24 divides the band into 126 channels spaced 1 MHz apart, where channel *n* sits at 2400 + *n* MHz. So channel 0 is 2400 MHz and channel 125 is 2525 MHz. Sweep and count all of them, and stream that array of 126 numbers out a few times a second. The ESP32 hosts its own Wi-Fi access point and a small web page that visualises the spectrum and gives you a channel recommendation. *** ## The hardware * **ESP-WROOM-32:** driving the radio over SPI, and running a Wi-Fi access point plus a web server plus a WebSocket stream. * **nRF24L01+PA+LNA with antenna:** The PA is a power amplifier for transmitting, which we don't care about here, but the LNA is a low-noise amplifier on the receive path, and that is the feature we use for this build as it makes the radio more sensitive. * **nRF24L01+ breakout adapter with 3.3V regulator:** Needed in order to power it at 5V straight off the ESP32 and delivers a stable 3.3V to the radio. *** ## What it can and can't do As mentioned, RPD gives us a rough estimate, but it is not a real dBm figure, so what we are reading is relative occupancy, not signal strength. In a professional setting, you'd definitely want a real spectrum analyser, but for surveying your property, this does the job, and it will tell you that channel X is a warzone and channel Y is empty, or that your Zigbee is using the same channel as your busiest Wi-Fi. *** ## Wiring the unit The radio needs to be wired up to the ESP32 over SPI. I'm using the default VSPI pins and the two control lines: | nRF24L01 pin | ESP32 pin | | ------------ | --------- | | VCC | 5V / VIN (into the adapter) | | GND | GND | | CE | GPIO4 | | CSN | GPIO5 | | SCK | GPIO18 | | MOSI | GPIO23 | | MISO | GPIO19 | | IRQ | not connected | *** ## The code The full code is available at the end of this post if you want to skip the explanation. The libraries you'll need are RF24 by TMRh20 and WebSockets by Markus Sattler. WiFi, WebServer and DNSServer uses ESP32 core. ### Libraries and globals ``` #include #include #include #include #include #include const char* AP_SSID = "Spectrum Analyser"; RF24 radio(4, 5); WebServer server(80); WebSocketsServer webSocket(81); DNSServer dnsServer; const byte DNS_PORT = 53; const uint8_t NUM_CHANNELS = 126; const uint8_t SAMPLES = 32; const uint16_t RPD_SETTLE_US = 130; uint8_t hits[NUM_CHANNELS]; ``` Four servers and a radio. `RF24 radio(4, 5)` sets CE on GPIO4 and CSN on GPIO5. The web server runs on port 80 to serve the page, the WebSocket on port 81 to stream data, and the DNS server on port 53 powers the captive portal we'll get to later. `SAMPLES` is how many times we read the detector on each channel: higher gives a better, slower sweep, lower gives a faster, jumpier one. `hits` holds the per-channel scores. ### Configuring the radio to detect energy ``` void setupRadio() { radio.begin(); radio.setAutoAck(false); radio.setDataRate(RF24_2MBPS); radio.disableCRC(); radio.setAddressWidth(2); radio.setPALevel(RF24_PA_MIN); } ``` We don't want the radio to acknowledge any packets (`setAutoAck(false)`), we don't want it validating checksums (`disableCRC`), as we're not actually trying to receive valid data at all, so the address handling is stripped down. `setPALevel(RF24_PA_MIN)` only affects transmitting, and we're only ever listening, so there's no reason to use it. ### Sweeping ``` void sweep() { for (uint8_t ch = 0; ch < NUM_CHANNELS; ch++) { radio.setChannel(ch); uint8_t count = 0; for (uint8_t s = 0; s < SAMPLES; s++) { radio.startListening(); delayMicroseconds(RPD_SETTLE_US); radio.stopListening(); if (radio.testRPD()) count++; } hits[ch] = count; dnsServer.processNextRequest(); server.handleClient(); webSocket.loop(); } } ``` We listen to each of the 126 channels then take 32 samples. After each sample, we wait about 130 microseconds for the detector to settle, then read `testRPD()`. This call returns the Received Power Detector bit: true if there was something above roughly -64 dBm in that window, false if not. We count how many of the 32 came back true, and that count is the channel's score. The reason for the `startListening` / `stopListening` on every single sample is that the RPD uses the radio while it is in receive mode, so to get a fresh reading we need to drop out of receive and back in. ### Streaming the result ``` void sendSweep() { String json = "{\"max\":"; json += SAMPLES; json += ",\"data\":["; for (uint8_t ch = 0; ch < NUM_CHANNELS; ch++) { json += hits[ch]; if (ch < NUM_CHANNELS - 1) json += ","; } json += "]}"; webSocket.broadcastTXT(json); } ``` We package the 126 scores into a small JSON object that also carries the sample count, so we can visualise it later in terms of percentage and broadcast it to any connected browser. ### Self-contained access point and captive portal Recently I've been setting up captive portals for projects like this...because I keep forgetting the assigned IP. This way you don't need to navigate to the IP of the ESP32 after establishing connection, it just pops up like a regular captive portal. The ESP runs a DNS server that answers every lookup with its own address, and serves the page for the connectivity-check URLs each operating system pings to decide whether it has internet. ``` WiFi.mode(WIFI_AP); WiFi.softAP(AP_SSID); IPAddress ip = WiFi.softAPIP(); dnsServer.start(DNS_PORT, "*", ip); server.on("/", handleRoot); server.on("/generate_204", handleCaptive); server.on("/hotspot-detect.html", handleCaptive); server.on("/ncsi.txt", handleCaptive); server.onNotFound(handleRoot); server.begin(); webSocket.begin(); ``` No password makes it an open network, so joining is one tap. ``` void handleCaptive() { server.sendHeader("Location", "http://192.168.4.1/", true); server.send(302, "text/plain", ""); } ``` ### The main loop ``` void loop() { dnsServer.processNextRequest(); server.handleClient(); webSocket.loop(); sweep(); sendSweep(); } ``` Service the three servers, run a full sweep, broadcast it, repeat. ### The part that answers the Zigbee question Everything above gets us a live occupancy profile, and the 2.4 GHz Wi-Fi channel is 20 MHz wide. The three non-overlapping ones everybody should be using are 1, 6 and 11, centred at 2412, 2437 and 2462 MHz, which use the nRF24 channels 12, 37 and 62. Being 20 MHz wide, each one spans approx. ten nRF channels either side of its centre. A Zigbee channel is much narrower and the numbering runs 11 to 26. Channel *k* sits at 2405 + 5(*k* − 11) MHz, which simplifies to nRF24 channel 5*k* − 50. So Zigbee 15 is nRF channel 25, Zigbee 20 is channel 50, Zigbee 25 is channel 75 and Zigbee 26 is channel 80. The reason everyone suggests using Zigbee channel 15, 20, 25 or 26 is because those channels fall in the gaps between Wi-Fi 1, 6 and 11. To score a band, we just average the measured occupancy across the nRF channels it covers: ``` function bandAvg(center, half) { let s = 0, n = 0; for (let ch = center - half; ch <= center + half; ch++) { if (ch >= 0 && ch < NUM) { s += acc[ch]; n++; } } return (n && accCount) ? (s / n / accCount) : 0; } ``` `acc` is a running total of occupancy per channel accumulated over the whole survey, so `bandAvg` returns the long-run average airtime in a band rather than a noisy instant. Then picking a recommendation is just sorting: ``` const wifi = [[1, 12], [6, 37], [11, 62]].map(p => ({ ch: p[0], occ: bandAvg(p[1], 10) })); const bestWifi = [...wifi].sort((a, b) => a.occ - b.occ)[0]; const zb = [15, 20, 25, 26].map(k => ({ k, occ: bandAvg(5 * k - 50, 1) })); const bestZigbee = [...zb].sort((a, b) => a.occ - b.occ)[0]; ``` We measure the three Wi-Fi bands and the four Zigbee channels, sort each by occupancy, and the clearest one is the one you should use. ### Drawing the waterfall Each incoming sweep scrolls the existing image down by one pixel and paints the new row across the top, colouring each channel with an inferno-style palette where black is dead air and white-hot is saturated. ``` const img = wfx.getImageData(0, 0, NUM, WF_H - 1); wfx.putImageData(img, 0, 1); for (let x = 0; x < NUM; x++) { const c = inferno(norm[x]); wfx.fillStyle = `rgb(${c[0]},${c[1]},${c[2]})`; wfx.fillRect(x, 0, 1, 1); } ``` ## Using it Flash it, then join the Spectrum Analyser network, and the page loads itself. Set the Zigbee field to whatever channel your mesh currently uses, then leave it running for a few minutes. A longer survey will average it out better. When it's had time to settle, you get a line like "put your APs on channel 1, the clearest at 14% airtime; move Zigbee from 20 to channel 25." I do want to highlight that changing your coordinator's channel is not exactly a smooth experience when you've got a large mesh. Some mains-powered routers may jump to the new channel, but in my case, most of my Zigbee devices needed re-pairing afterwards. *** ## The full code ``` #include #include #include #include #include #include const char* AP_SSID = "Spectrum Analyser"; RF24 radio(4, 5); WebServer server(80); WebSocketsServer webSocket(81); DNSServer dnsServer; const byte DNS_PORT = 53; const uint8_t NUM_CHANNELS = 126; const uint8_t SAMPLES = 32; const uint16_t RPD_SETTLE_US = 130; uint8_t hits[NUM_CHANNELS]; const char INDEX_HTML[] PROGMEM = R"rawliteral( Spectrum Analyser

Spectrum Analyser

SWEEP RATE — /s PEAK CH — PEAK FREQ — MHz OCCUPANCY —
QUIET
SATURATED
Channel Advisor survey 0s · 0 sweeps

WiFi 2.4 GHz

Zigbee

Collecting data… let the survey run a few minutes for a reliable suggestion.
Channel n = 2400 + n MHz · cyan = WiFi 20 MHz bands (ch 1/6/11), pink = your Zigbee channel.
)rawliteral"; void onWsEvent(uint8_t num, WStype_t type, uint8_t* payload, size_t len) { if (type == WStype_CONNECTED) Serial.printf("WS client %u connected\n", num); } void handleRoot() { server.send_P(200, "text/html", INDEX_HTML); } void handleCaptive() { server.sendHeader("Location", "http://192.168.4.1/", true); server.send(302, "text/plain", ""); } void setupRadio() { radio.begin(); radio.setAutoAck(false); radio.setDataRate(RF24_2MBPS); radio.disableCRC(); radio.setAddressWidth(2); radio.setPALevel(RF24_PA_MIN); } void setup() { Serial.begin(115200); delay(500); if (!radio.begin()) { Serial.println("radio.begin() failed - check wiring/power."); while (1) {} } setupRadio(); WiFi.mode(WIFI_AP); WiFi.softAP(AP_SSID); IPAddress ip = WiFi.softAPIP(); Serial.println("Access point up."); Serial.printf(" Join WiFi: %s (open network)\n", AP_SSID); Serial.printf(" Portal should pop automatically; else browse http://%s\n", ip.toString().c_str()); dnsServer.start(DNS_PORT, "*", ip); server.on("/", handleRoot); server.on("/generate_204", handleCaptive); server.on("/gen_204", handleCaptive); server.on("/hotspot-detect.html", handleCaptive); server.on("/library/test/success.html", handleCaptive); server.on("/ncsi.txt", handleCaptive); server.on("/connecttest.txt", handleCaptive); server.on("/fwlink", handleCaptive); server.onNotFound(handleRoot); server.begin(); webSocket.begin(); webSocket.onEvent(onWsEvent); } void sweep() { for (uint8_t ch = 0; ch < NUM_CHANNELS; ch++) { radio.setChannel(ch); uint8_t count = 0; for (uint8_t s = 0; s < SAMPLES; s++) { radio.startListening(); delayMicroseconds(RPD_SETTLE_US); radio.stopListening(); if (radio.testRPD()) count++; } hits[ch] = count; dnsServer.processNextRequest(); server.handleClient(); webSocket.loop(); } } void sendSweep() { String json = "{\"max\":"; json += SAMPLES; json += ",\"data\":["; for (uint8_t ch = 0; ch < NUM_CHANNELS; ch++) { json += hits[ch]; if (ch < NUM_CHANNELS - 1) json += ","; } json += "]}"; webSocket.broadcastTXT(json); } void loop() { dnsServer.processNextRequest(); server.handleClient(); webSocket.loop(); sweep(); sendSweep(); } ``` So now I have an over-engineered one-time pocket spectrum survey tool that runs off a single board, costs about the price of a coffee in parts, and answers the Zigbee channel question with an approximate measurement.