Antennas · Volume 27

Spectrum Analyzers with Antennas

TinySA / TinySA Ultra, RSA306, R&S handhelds, Signal Hound USB — using a spectrum analyzer for antenna work (SWR sweep via tracking gen, harmonic measurement, EIRP estimation, near-field probing)

Contents

SectionTopic
1About this volume
2Spectrum analyzer vs VNA vs SDR — what each is for
3TinySA — pocket spectrum analyzer for hams and hackers
4TinySA Ultra — to 5.3 GHz, with tracking gen
5Tektronix RSA306 / RSA607
6Signal Hound USB analyzers — BB60C, SM200B
7R&S handheld spectrum analyzers — FSH4 / FSH8
8Used HP / Agilent benchtop spectrum analyzers
9Tracking generator basics — SWR sweep on a spectrum analyzer
10Harmonic measurement of a transmitter through an antenna
11EIRP estimation by reciprocity
12Near-field probing — E-field and H-field probes
13Pre-selectors and front-end filters for protecting the SA
14Commercial buys
15Common gotchas and myths
16Resources

1. About this volume

This volume covers the spectrum analyzer (SA) as it’s used in antenna and transmitter work — picking one, knowing what each tier actually does for the bench, and the workflows that turn power-vs-frequency traces into actionable data. The companion is Vol 24 (NanoVNA Deep Dive) (impedance and S-parameters) and Vol 26 (RF power, SWR & field-strength) (sig-gens, dummy loads, through-line wattmeters). Treat this trio as one toolkit: each instrument exists because the other two can’t do its job cleanly.

The spectrum analyzer is the instrument that answers “what’s at this frequency, and how much of it is there?” It does not, by itself, tell you anything about the cause of what’s there. Diagnosing the cause is a different skill, learned by reading thousands of traces across thousands of setups; this volume covers the gear and the workflows, and assumes the reader develops the diagnostic intuition through practice.

A philosophical note up front: the SA is the only piece of RF gear on the bench that is fundamentally lossy in its core function. Every spectrum analyzer is a calibrated receiver with attenuation in front of the mixer, deliberately desensitized to avoid front-end overload. The “instrument” is the calibrated transfer of input dBm to displayed dBm, across frequency, with a known frequency response. Every reading of “what’s at this frequency” is mediated by the resolution bandwidth (RBW) filter, the video bandwidth (VBW) filter, the sweep speed, the input attenuator, the IF gain, and the detector mode. Get any one of those wrong and the displayed power is off by tens of dB. The instrument is honest; the operator chooses what to ask.

2. Spectrum analyzer vs VNA vs SDR — what each is for

The central distinction worth internalizing before any equipment purchase is what kind of measurement primitive each instrument provides. The spectrum analyzer gives you power vs frequency — inject one signal, see one peak; inject many signals, see many peaks, each at its true displayed power. The vector network analyzer gives you S-parameters — you control both the stimulus and the response measurement, with magnitude and phase tracked at every frequency, giving you full impedance, transmission, reflection, and group-delay data. The SDR gives you complex baseband I/Q samples — you can FFT them into a spectrum, demodulate them into voice or data, or do arbitrary post-processing in software.

The three overlap heavily on the receive side. Any of them can show you “there’s a carrier at 100 MHz with about -50 dBm of energy.” But each does something the other two cannot do well. The SA gives calibrated absolute power across the full RF band without per-frequency cal data — that’s its core strength. The VNA gives phase information and S21 transmission measurements that an SA cannot make without a tracking gen plus a coupler kludge that’s never as clean. The SDR gives you the raw samples for post-processing, demodulation, and protocol analysis — neither SA nor VNA can hand you the IF as I/Q for software dissection.

Use caseSA winsVNA winsSDR wins
Antenna SWR / return loss sweepPossible with tracking gen + couplerNative — this is what the VNA was built forNo
Antenna gain by far-field comparisonYes — calibrated dBm at the RXPossible but cumbersomeYes if cal’d against a known source
Transmitter harmonic & spur surveyNative — wide span, calibrated absolute powerNo — VNA expects a passive 2-portPossible with low-IF SDR + cal table
Filter shape (insertion loss + bandwidth)Yes with tracking genNative — clean S21 trace, magnitude + phasePossible, less convenient
Cable impedance / TDRNoNative — time-domain transformNo
Intermittent interference huntingYes with real-time SA (Tek RSA / Signal Hound)No — VNA stimulates, doesn’t listenYes with waterfall, often the cheapest path
Demodulating a captured signalSome have modulation analysis options (R&S K-options)NoNative — the SDR is a demodulator by design
EMC pre-compliance (CISPR RBW filters)Yes with compliance-grade RBW filters (R&S, Keysight)NoInadequate — no certified RBW + detectors
Tuning a notch / matching networkYes with tracking gen for level adjustNative — Smith chart in real timePossible but slow
Field-strength survey (EIRP estimation)Native — calibrated dBm readingPossiblePossible with calibrated SDR

The decision tree in practice: if the measurement is “what’s the impedance of this antenna at 14.2 MHz” or “what’s the insertion loss of this filter at 432 MHz,” reach for the NanoVNA (Vol 24). If the measurement is “is my HF radio’s 2nd harmonic legal” or “what’s leaking out of this enclosure at 433 MHz,” reach for the SA. If the measurement is “what protocol is this thing speaking and can I decode it,” reach for the SDR. The owned HackRF One and RTL-SDR cover the SDR side; this volume covers the SA tier.

A practical observation from a half-century of bench work: most people who think they need an SA actually need a VNA, and vice versa. The two get conflated because the displays look superficially similar (a trace vs frequency on a graticule). The underlying measurement is fundamentally different. SA answers “how much power is there”; VNA answers “what does my circuit do to a signal I inject.” Buy the one that matches your question.

3. TinySA — pocket spectrum analyzer for hams and hackers

The original TinySA was released in 2020 by Erik Kaashoek (the same designer behind several earlier NanoVNA forks), and remains the entry-point pocket spectrum analyzer at the bottom of the price ladder. Roughly 100 × 60 × 20 mm, 130 g with battery, it slips into a shirt pocket and runs ~2 hours on its internal LiPo. As of mid-2026 the original (now sometimes called TinySA “Basic” or TinySA “v1”) sells for $60-80 from authorized resellers; the gray-market clones on the major Chinese marketplaces drop to $40-50 but with the known counterfeit risks (off-spec attenuator, calibration drift, screen-protector substitution). Stick with R&L Electronics, Mirfield Electronics, or the original tindie store.

The hardware architecture is a deliberate two-mixer design that gives unusually broad coverage from cheap parts. The low-input path (the BNC marked LOW) covers 0.1-350 MHz directly using a Si4432 transceiver chip as the front-end mixer + IF stage — the same Si4432 family that drives many sub-GHz ISM radios, repurposed as a tunable IF receiver. The high-input path (BNC marked HIGH) covers a nominal 240-960 MHz by exploiting image-mode reception with a Mini-Circuits-style passive mixer — this gives a wider tuning range at the cost of more spurious responses and worse dynamic range. A PE4302 step attenuator (0-31.5 dB in 0.5 dB steps) sits at the front end of the low path to manage input level. The CPU is an MSP432 ARM (Cortex-M4F), and the display is a 2.8” 320×240 color resistive touchscreen.

RBW is selectable from 3 kHz to 600 kHz, with the narrowest RBW giving the best sensitivity at the cost of sweep speed (full 350 MHz span at 3 kHz RBW takes a couple of minutes; widen RBW or narrow span if you want a 1-3 Hz update rate). Noise floor is around -110 dBm/Hz at 3 kHz RBW after warmup, which is enough to see a -90 dBm tone with comfortable margin but not enough to chase third-order intermod products below -100 dBm. Dynamic range is around 90 dB if the input attenuator is set conservatively (10-20 dB attenuation in front of the mixer to prevent IMD); set the attenuator to 0 dB and try to look at strong signals and the displayed spectrum fills with mixer-IMD garbage that looks real but isn’t. See §13 (Pre-selectors) for the front-end-protection discussion that applies tenfold to a $70 SA.

The factory calibration is loaded once at the Si Labs production test station. Erik built in a self-cal routine driven by the device’s own internal CW source — running it once a month (or after any drop or environmental shock) keeps the absolute-level reading within ±2 dB across most of the band. The internal cal source is a square wave that emits strong odd harmonics out past 100 MHz; you connect a short SMA jumper from CAL output to the LOW input, run the routine, and the firmware re-fits the level-vs-frequency curve.

Real-world limitations that matter for antenna work. The noise floor at -110 dBm/Hz is not low enough for accurate receiver-sensitivity measurement — a typical ham radio’s MDS is -135 dBm or lower. The drift with temperature is real (a few hundred Hz of LO drift per °C); for narrow-RBW work, warm it up for 15 minutes before trusting frequency readings. There is no real-time mode — a one-microsecond pulse 100 MHz from your tuned center will be missed entirely unless the sweep happens to be passing through that frequency at exactly the right moment. The sweep is genuinely slow at narrow RBW; for survey work, widen to 100 kHz RBW and accept the resolution penalty.

What the original TinySA is genuinely good for: quick “is there a signal here” surveys, transmitter harmonic checks on HF (the 2nd through 5th of a 20m signal land within the 0.1-350 MHz primary range), checking a sub-GHz ISM transmitter for legal carrier output level, looking at the spectrum of a Flipper Zero or HackRF transmission for sanity, and EMI hunting at the workbench. As an HackRF One bench companion or a sanity-check instrument for the Quansheng UV-K5, it’s terrific value. For anything compliance-grade, see the next tier.

4. TinySA Ultra — to 5.3 GHz, with tracking gen

The TinySA Ultra (2022, in continuous incremental revision since) is the same designer’s follow-up to the original, and it is the single most cost-effective measurement instrument in the Hack Tools lineup at its price tier. At $130-180 mid-2026 (Mirfield Electronics, R&L, the verified tindie outlet), it gives you a 100 kHz - 5.3 GHz spectrum analyzer with a built-in tracking generator, a 4.0” color LCD, and enough sensitivity for real bench work. The form factor grows to ~130 × 80 × 25 mm and ~200 g — pocketable, not shirt-pocketable.

The architecture changes substantially from the original. The low-input path (100 kHz - 800 MHz) uses an ADF4351 PLL + IAM-91563 active mixer + Si5351 reference — the ADF4351 is the same low-cost wideband synthesizer that drives many hobbyist sig-gens (see Vol 26 (RF power, SWR & field-strength) for the ADF4351 as a sig-gen). The high path (800 MHz - 5.3 GHz) uses image-mode reception again, but with a substantially better mixer and a tighter pre-filter than the original, giving usable performance through the 2.4 GHz and 5 GHz Wi-Fi bands. The CPU is an STM32 H-series (Cortex-M7) — enough headroom to run the FFT-based RBW filtering that gives this generation its 200 Hz minimum RBW. The display is a 4.0” 480×320 color LCD with capacitive touch.

The big-deal feature is the built-in tracking generator: a synchronized CW output that sweeps in lockstep with the analyzer input, with selectable output level from typically -38 dBm to about 0 dBm in 1 dB steps. The TG output emerges from its own SMA on the side panel. With a directional coupler (the Mini-Circuits ZFDC-10-1 covers 1-1000 MHz at 10 dB coupling; the ZFBDC20-62HP+ covers 10-6000 MHz, both discussed in §9 (Tracking generator basics)) between TG output and the device under test, you have a scalar network analyzer that sweeps to 5.3 GHz. The phrase “scalar” is important — there is no phase information, so you cannot see Smith-chart impedance or distinguish capacitive from inductive reactance the way a NanoVNA (Vol 24) can. But for SWR-vs-frequency, filter shape, attenuator characterization, and amplifier gain-vs-frequency, it’s genuinely useful.

RBW spans 200 Hz to 850 kHz. Sweep update rate runs 1-3 Hz at narrow RBW (200-1000 Hz), 10+ Hz at wide RBW (100 kHz +). The noise floor at narrow RBW is around -115 dBm/Hz after warmup, dynamic range ~90 dB with proper attenuator management. The internal cal routine is similar to the original — internal CW source, short SMA jumper, run periodically. The Ultra also adds USB-C with a passable host-side capture program (TinySA-Saver, modeled after NanoVNA-Saver — see Vol 24 (NanoVNA Deep Dive) for the NanoVNA-side equivalent and the same author’s general design philosophy).

What the Ultra is genuinely good for: SWR-vs-frequency sweeps on any antenna in your collection from HF through 5 GHz (with a sub-band coupler swap), filter shape measurement on inline bandpass/notch filters, harmonic survey of any HF/VHF/UHF transmitter that fits in the device’s power-handling envelope (more on that in §10 (Harmonic measurement)), casual EMI hunting around a desktop bench, sanity-check measurements on commercial RF gear, and use as a quick “is the HackRF One actually transmitting at the level I think it is” sanity instrument. For Wi-Fi 5 GHz band measurements, it’s the cheapest device on the market that genuinely covers that range with reasonable accuracy.

What it is not good for: certified compliance measurements (no CISPR RBW filters, no peak/quasi-peak/average detector certification, no traceable cal cert), phase noise measurement (the PLL phase noise itself is too high to characterize anything cleaner than itself), absolute-power measurements where you need better than ±2 dB accuracy, and any measurement requiring real-time mode. The dynamic range is real but not lab-grade; the SM200B in §6 shows what 30 dB more dynamic range costs.

The Ultra is currently the recommended pocket SA for the Hack Tools lineup. If asked “I have $200 for a spectrum analyzer,” the answer is “buy the TinySA Ultra, save the rest for accessories — a Mini-Circuits ZFDC-10-1 coupler, a couple of fixed attenuators, a 50 Ω dummy load.” That kit gets you to genuinely useful antenna and transmitter measurements.

5. Tektronix RSA306 / RSA607

The Tektronix RSA306 and its sibling RSA607 represent the next tier up — the USB-controlled real-time spectrum analyzer (RTSA). The architecture is fundamentally different from a swept-tuned SA: the entire input bandwidth (up to 40 MHz wide instantaneously) is downconverted to baseband, digitized at high speed by a wideband ADC, and the resulting I/Q stream is FFT-processed in software (or in an internal FPGA, depending on the model) at high enough rates to catch every event within the real-time bandwidth window.

The RSA306B (the current shipping rev as of mid-2026) covers 9 kHz to 6.2 GHz with 40 MHz of real-time bandwidth (RT-BW), runs entirely USB-powered, and weighs about 1.2 kg. The RSA607A extends frequency coverage to 7.2 GHz, keeps the 40 MHz RT-BW, and adds a built-in tracking generator. Both require Tektronix’s SignalVu-PC software running on a Windows host (the basic SignalVu-PC license is included with the hardware; advanced modulation analysis and protocol decoder options are additional licenses at $1-5k each). Linux and macOS are not officially supported, although third-party Python bindings (libIQ, librsa) exist and work for basic I/Q capture.

Pricing as of mid-2026: RSA306B new is $2,500-3,500 from authorized Tek dealers; used on the secondary market $1,500-2,500 in good condition (units come up regularly when corporate EMC labs replace their portable kit). RSA607A new $3,000-4,000; used $2,000-3,000. The added cost over the RSA306B buys the extra GHz of coverage and the tracking gen — the tracking gen on the RSA607A is meaningfully cleaner than the TinySA Ultra’s, and the noise floor is genuinely lab-grade.

What “real-time” means in practice is worth spending a moment on, because it’s the architectural feature that justifies the price gap. A traditional swept-tuned SA tunes a narrowband filter across the span: at any instant, the receiver is listening to one narrow slice of the band, and signals outside that slice are invisible. A burst that’s shorter than the dwell time at its frequency is missed entirely. An RTSA, in contrast, samples the entire 40 MHz RT-BW continuously — if a signal is anywhere within that 40 MHz window for any non-zero duration, it gets captured. The RSA306B’s claim is 100% probability of intercept for any signal lasting >100 µs anywhere in the RT-BW. The persistence display (DPX in Tek terminology) shows a heatmap of which spectrum-vs-time bins have been hit, making intermittent interference visible by simply leaving the analyzer running and watching the colors saturate.

Use cases where this matters: hunting intermittent EMI from a switching power supply that only spikes for tens of microseconds at a time, characterizing frequency-hopping protocols like Bluetooth or older 2.4 GHz cordless phones, capturing burst transmissions like LoRa packets in flight, debugging digital pulse-train spurs from microcontroller activity, and forensic analysis of attack signals from devices like the Flipper Zero or HackRF One. For ordinary antenna SWR sweep or harmonic measurement, the RSA306B is wildly overpowered — the TinySA Ultra is fine. The RSA shines when you need to see what’s happening fast.

The dynamic range is genuinely good: typical IIP3 +10 dBm with attenuator at 10 dB, noise floor around -150 dBm/Hz, phase noise -110 dBc/Hz at 10 kHz offset. Calibration is factory-only (no user cal procedure on the RSA306B; the RSA607A allows a tracking-gen normalization sweep). Tek’s calibration interval is 1 year for compliance work, longer if you don’t need traceable cert.

One operational consideration: the entire instrument lives at the end of a USB cable to a Windows laptop. That’s the form factor — small box, USB-3 to a PC, SignalVu-PC GUI. If you’re already running a Windows pentest/measurement laptop (such as the Parrot OS host’s Windows partition), the RSA306B integrates cleanly. If you’re a Linux-first operator, the third-party bindings work but you give up the SignalVu DPX persistence display and the advanced modulation analyzers.

6. Signal Hound USB analyzers — BB60C/SM200B

Signal Hound occupies the same architectural niche as Tektronix’s USB analyzers — externally-controlled, modular, USB-powered (or USB-3 + DC) — but with a noticeably different design philosophy. Where Tek aims for end-to-end SignalVu integration with deep protocol decoders, Signal Hound focuses on raw RF performance metrics (phase noise, dynamic range, IIP3) at the analyzer hardware level, with cleaner free Spike software and an excellent API for building custom measurement workflows.

The BB60C (current rev BB60D as of late 2024 supersedes the C; both shipping mid-2026, the D is the recommended buy for new purchases) covers 9 kHz - 6 GHz with 27 MHz of real-time bandwidth. It runs about $5,000 new from Signal Hound direct. The BB60D adds modest improvements: lower noise floor (-160 dBm/Hz vs -157 dBm/Hz), better phase noise (-105 dBc/Hz at 10 kHz offset vs -100), and a slightly higher first-IF for cleaner image rejection.

The SM200B is the bigger sibling: 100 kHz - 20 GHz, 110 MHz real-time bandwidth, ~$10,000 mid-2026. It steps up substantially in front-end quality — a tunable preselector covers the high-frequency range to suppress out-of-band signals before they reach the mixer, dramatically improving real-world dynamic range for crowded environments. Phase noise is -115 dBc/Hz at 10 kHz offset, IIP3 is +13 dBm, and the noise floor is -162 dBm/Hz. For the price, it competes credibly with $30-50k benchtop instruments from Keysight and R&S on every spec except absolute frequency range. The SM435 extends to 43.5 GHz for around $25,000, opening up the 24 GHz amateur band and Ka-band work.

Spike software (Windows, free with the hardware) is the standard interface. Linux support is officially listed as “limited” but in practice the Signal Hound API in C/C++/Python works fine on Linux with their userspace library. They also publish the binary protocol enough that third-party tools exist (notably the GNU Radio Signal Hound source blocks that let you treat the BB60D as a giant high-quality SDR for I/Q capture).

What the Signal Hound analyzers genuinely give you that’s hard to get elsewhere at this price: phase noise low enough to measure other PLLs’ phase noise (a TinySA Ultra cannot measure phase noise because its own LO is dirtier than what you’re trying to measure), absolute amplitude accuracy at ±0.5 dB with proper warmup and cal, IMD performance good enough to find genuine third-order intermod products in the receiver under test, and field-portability for serious work — both units are under 2 kg with the BB60D being genuinely backpackable.

Use cases that justify the spend: pre-compliance EMC measurement (with the optional CISPR-compliant RBW filter set; the BB60D supports CISPR Band B and C, the SM200B supports A through D), transmitter characterization for amateur experimental work where you need to verify spectral purity to dB-fraction precision, the GNU Radio “high-quality SDR” use case for software-defined experiments with 27 or 110 MHz of clean baseband bandwidth, and field surveys where laptop-portability and battery operation matter.

The Signal Hound boxes also play well with custom Python automation — their API exposes the analyzer as essentially a calibrated I/Q source plus a sweep engine, so the boundary between “spectrum analyzer” and “lab-grade SDR” gets blurry. A common workflow is to use Spike for interactive bench work and switch to the Python API for repeated measurement scripts or production-test workflows.

7. R&S handheld spectrum analyzers — FSH4/FSH8

The Rohde & Schwarz FSH series is the field-portable benchtop — the instrument you take up a tower to characterize a base station antenna, or out to a remote site for EMI investigation, or into a server room to track down RF interference with a transceiver in your other hand. Battery-powered, sun-readable color display, weather-resistant enclosure, with the calibration provenance of an R&S product.

The FSH4 covers 9 kHz - 3.6 GHz, the FSH8 extends to 8 GHz. Both run from a 6 Ah lithium battery for around 4 hours, and recharge via 12 V DC or AC adapter. The 6.5” sunlight-readable color display is genuinely usable on a sunny day in a parking lot. RBW is selectable from 100 Hz to 1 MHz with R&S’s CISPR-compliant filter set as a standard feature — this is the headline differentiator from the TinySA Ultra and even the Tek RSA306B; the FSH ships ready for EMI compliance pre-test work without buying optional filter licenses.

Built-in features that matter: integrated tracking generator (with normalization for through-loss compensation, giving true scalar S21 measurement), a built-in true-RMS power meter (with R&S NRP-Z series sensor heads as accessories — these are themselves $1,500-3,000 each but plug right into the FSH’s sensor port), a cable-and-antenna analyzer mode (essentially a frequency-domain reflectometer for testing tower feedlines without bringing a separate VNA), and a one-port distance-to-fault (DTF) function for locating coax breaks.

Pricing mid-2026: FSH4 new is $7,000-15,000 depending on options; used $2,500-6,000 in good condition from secondhand instrument dealers (Test Equipment Depot, EquipNet, ValueTronics, eBay business sellers like Aceman or RF Test Solutions). The FSH8 adds $2-4k over the FSH4 at every price tier. Options that matter — and these are typically $1-3k each, can be retrofitted to a used unit by R&S service:

  • K7 (FM demodulator) for tuning broadcast bands and checking deviation
  • K9 (CISPR EMI receiver) for true EMC pre-compliance
  • K42 (vector signal analyzer) for I/Q capture
  • K72/K73 (3G/LTE demod) for cellular work — relevant if you’re doing IMSI-catcher detection alongside Rayhunter
  • K130 (LTE/5G FR1) for current-generation cellular characterization

The Keysight FieldFox N9912A/N9914A/N9915A/N9916A/N9917A/N9918A series is the direct competitor — same form factor, same field-portable mission, with broadly equivalent specs at each frequency band. The FieldFox includes spectrum analyzer + VNA + power meter in one box, where the R&S FSH separates SA and VNA into different product lines (FSH for SA, ZVH for VNA). Operator preference between R&S and Keysight is mostly cultural — both companies build outstanding field instruments. Used Keysight FieldFox prices track R&S FSH prices closely.

Real-world utility: this is the instrument you use to commission a commercial tower-top antenna installation, run a CISPR pre-compliance sweep on a product before sending it to a certification lab, hunt EMI in an industrial environment, or do site survey work for a planned base station installation. For a home lab focused on amateur experimentation, it’s overkill — the TinySA Ultra plus a NanoVNA (Vol 24) covers the same ground for 1/30th the cost, with the tradeoff being slower workflows and no compliance certification.

8. Used HP/Agilent benchtop spectrum analyzers

The used benchtop market is its own ecosystem with its own buying knowledge, and for the bench-bound experimenter who doesn’t need field portability, it’s often the highest-performance-per-dollar route to a real spectrum analyzer. The same Hewlett-Packard (later Agilent, then Keysight) instruments that defined the bench in the 1990s-2000s are now available used at 5-10% of their original price, often still meeting full spec.

The HP 8590 series (8590A/B/E and 8591A/B/E) is the workhorse: 9 kHz - 1.8 GHz, swept-tuned, CRT or (later 8591E) flat-panel display, GPIB control, and built like military equipment. The 8590A is the older monochrome CRT variant ($300-800 used); the 8590B and 8591A added improvements through the late ’80s ($400-1,000); the 8590E and 8591E (1996-era) are the most desirable as they have the more modern firmware, better front-panel ergonomics, and most often include the Option 010 tracking generator ($800-1,500 used in good shape). Almost all 8590-series units have the option 021/022 (HP-IB/IEEE-488) installed — useful for automation via GPIB-to-USB or GPIB-to-Ethernet adapters (NI, Prologix, Agilent E5810B).

The 8590-series tracking generator (Option 010) is a meaningfully useful feature for antenna work — it covers the full 9 kHz - 1.8 GHz range, outputs typically -10 to 0 dBm, and synchronizes cleanly with the analyzer sweep. A coupler in front of it gives you the same SWR-vs-frequency sweep workflow as the TinySA Ultra, but with the absolute-power calibration of an HP benchtop. Pay the $200-400 premium for an Option-010 unit if you’re buying used.

The HP 8593E/8594E/8595E extends the range — 8593E to 22 GHz, 8595E to 26.5 GHz. These were $25-50k new in the late ’90s; used they run $1,500-3,500 in working condition. The high-frequency models use a YIG-tuned filter (YTF) as a pre-selector to suppress out-of-band signals from confusing the mixer, which is itself a useful piece of education for understanding why high-frequency SAs need pre-selectors (touched on in §13).

The Agilent ESA E4407A/E4407B/E4408A/E4408B is the next-generation benchtop (early 2000s): 9 kHz - 26.5 GHz (E4407 stops at 9 GHz, E4408 goes to 26.5 GHz; the B-suffix units have improved phase noise and IF), color LCD display, GPIB + LAN, USB-A for printer/storage. New $30-50k, used $1,500-4,000 in good condition. These are the most modern instruments in the “affordable used benchtop” tier as of mid-2026 — the firmware is more capable, the display is easier on the eyes than a CRT, and the calibration is more easily traceable through current Keysight service.

Known failure modes to look for when buying used:

  • YIG oscillator drift — the YIG-tuned LO in high-frequency 8590-series and ESA units can drift with age. The fix is a re-tune to spec by a calibration shop ($300-600), or for benchtop work, lock the SA to an external 10 MHz GPS-disciplined oscillator (GPSDO — Leo Bodnar Mini-GPS-PPS $130, or used Trimble Thunderbolt $200) which makes the frequency reading rock-solid independent of LO drift.
  • Aging quartz reference oscillator — long-term frequency drift, fixed by GPSDO lock or by replacing the OCXO module (a $400-800 part for HP/Agilent units).
  • CRT phosphor burn-in — cosmetic only on most 8590-series units, but watch for severe burn that obscures the graticule. Reproduction CRT replacements exist for the popular 8591E ($300-500 from specialty CRT shops); video conversion boards that swap a CRT for an LCD ($150-300) are also available for the most popular models.
  • HP-IB drum-and-flop — HP-IB interface boards can degrade with age. Symptom: occasional GPIB hangs or non-response. Cleaning the card-edge connectors with isopropyl + contact cleaner usually restores function; replacement cards run $100-200 on the used market.
  • Capacitor aging on switching power supplies — any HP/Agilent gear older than 25 years should be assumed to need PSU recap. The HP 8591E PSU has well-documented service notes for recap; expect to spend an evening with a soldering iron and $40 of capacitors.
  • Front-panel rotary encoder wear — the spinner-knob on the 8590-series can develop bad spots. Replacement encoders are still available from HP/Keysight parts ($60-120) or generic substitutes work with minor wiring tweaks.

Where to buy used: ValueTronics, Test Equipment Depot, Test Equity, EquipNet, Apex Waves, Aceman (eBay business seller, US-based, mostly Agilent/Keysight), and the specialty calibration shops that take in equipment as service trade-ins. Avoid generic eBay listings without seller reputation — “untested, powers on” is a synonym for “I don’t know if it works.” A good used dealer offers 30-90 day warranty and basic verification that the instrument hits its spec.

The mid-2026 sweet-spot recommendation for a bench-bound experimenter: a clean HP 8591E with Option 010 tracking generator from ValueTronics or similar dealer, $800-1,200 delivered with 90-day warranty. You get a fully calibrated 9 kHz - 1.8 GHz SA + tracking gen, GPIB-controllable for automation, with phase noise and dynamic range that exceed the TinySA Ultra in every dimension. The CRT is the price you pay; warm it up properly and it’s a fine display.

9. Tracking generator basics — SWR sweep on a spectrum analyzer

A tracking generator is conceptually simple: a CW source whose frequency tracks the spectrum analyzer’s input frequency in lockstep, typically with zero offset (the TG transmits exactly the frequency the SA is currently tuned to). The TG output is generally a clean sinusoid at a known level, adjustable from typically -30 dBm to 0 dBm or sometimes higher.

Why this is useful: drive the TG output into the input of a device under test (DUT — a filter, an attenuator, an amplifier), bring the DUT’s output back to the SA input, and the SA displays the DUT’s frequency response (S21 magnitude) as the TG sweeps. With a directional coupler between TG output and an antenna, the reflected energy from the antenna’s input impedance flows back through the coupler’s coupled port to the SA, and the SA displays return loss (RL) as a function of frequency. From return loss, SWR follows by the standard relationship:

SWR = (1 + 10^(-RL/20)) / (1 - 10^(-RL/20))

(where RL is the return loss in dB as a positive number; an antenna with -10 dB return loss has SWR = 1.92, which is the well-known 2:1 threshold many radio operators use). The conversion table is worth committing to memory or printing on a card (see Vol 33 (Cheatsheet & glossary) for the full table):

Return Loss (dB)SWR% Power Reflected
-35.8550.1%
-63.0125.1%
-101.9210.0%
-141.504.0%
-201.221.0%
-261.110.25%
-301.070.1%

The cross-link to Vol 4 (Antenna theory) and Vol 3 (dB and dBm) carries the SWR-and-reflection-coefficient theory; this section is the workflow.

The coupler is the critical link. A directional coupler has three relevant specs:

  • Coupling factor — typically 10 dB or 20 dB. A 10 dB coupler sends 10 dB of stimulus power to the DUT and 10 dB to the coupled port (reflected back to the SA), with the rest absorbed in the coupler’s internal load. A 20 dB coupler trades stimulus power for more isolation between forward and reverse paths.
  • Directivity — how cleanly the coupler separates forward and reflected energy. A directivity of 30 dB means the coupler shows a forward signal as 30 dB lower at the coupled (reverse) port than the actual reverse signal would be. Higher is better; >30 dB is ideal for accurate return-loss measurement, >20 dB is acceptable for general bench work, <15 dB and your measurements get noisy.
  • Insertion loss — the loss on the through path from input to DUT, typically 0.5-2 dB depending on coupler type and frequency.

Bench-standard couplers worth knowing:

CouplerRangeCouplingDirectivityApprox Price (mid-2026)
Mini-Circuits ZFDC-10-11-1000 MHz10 dB28 dB typ$80
Mini-Circuits ZFDC-20-30.04-1000 MHz20 dB25 dB typ$90
Mini-Circuits ZFBDC20-62HP+10-6000 MHz20 dB18-25 dB$200
Mini-Circuits ZGBDC30-372HP+30-3700 MHz30 dB22 dB typ$250
Narda 4222-201-2000 MHz20 dB30 dB typ$180 used
HP 11692D2-18 GHz20 dB26 dB typ$400-700 used

For amateur HF + VHF/UHF work, a ZFDC-10-1 covers up to 6m (the high end is at 1 GHz, comfortably above 70 cm). For 2m + 70 cm + 23 cm + 13 cm + 9 cm + 5 cm work, the ZFBDC20-62HP+ is the right choice — pricey at $200 but covers everything through the 5.8 GHz band.

Worked example: TinySA Ultra TG output set to -10 dBm, ZFDC-10-1 coupler in line, antenna under test connected to the DUT port. Sweep 14.0-14.4 MHz (20m amateur band). Expected display:

  • TG output: -10 dBm into coupler input
  • Through-path loss: 1 dB → -11 dBm reaches antenna
  • Antenna SWR 1.5 at center = return loss 14 dB → reflected power = -25 dBm at antenna feedpoint
  • Reflected path through coupler: 10 dB coupling factor → -35 dBm at SA input

So the SA reading would be -35 dBm at the center frequency of a 1.5:1 SWR match. Wider-frequency sweep would show the return-loss curve dipping deeper at resonance (lower SWR, higher return loss = more negative trace value) and rising at band edges (worse match).

The procedure: cal first by replacing the antenna with a known-good 50 Ω load (the antenna position should show essentially no reflected power — anything you see is residual coupler directivity error, typically -25 to -30 dB depending on coupler quality), then replace the load with the antenna, and read the trace. A modern SA with tracking-gen normalization can subtract the no-load (or open/short) reference sweep from the live trace, giving you a clean return-loss display directly.

Why not just use a NanoVNA. The NanoVNA does this exact measurement natively, with a directional coupler built in (the R-channel detector inside the NanoVNA front end). The VNA additionally gives you phase information, so you can see what kind of mismatch the antenna has — capacitive (electrically too short) vs inductive (electrically too long) — and act on it directly. The SA + TG approach is scalar only: you see SWR or return loss, but you don’t see whether to lengthen or shorten the radiator. For most antenna work, the NanoVNA (Vol 24) is the cleaner and faster instrument. The SA + TG approach is useful when you already have the SA on the bench (because you bought it primarily for harmonic and EMI work), don’t have a NanoVNA available, and you need a rough SWR-vs-frequency curve — it’s a backup workflow, not the primary one.

10. Harmonic measurement of a transmitter through an antenna

Harmonic suppression is the gating regulatory requirement for transmitter operation in every regulated radio service. The FCC’s Part 97.307(d) sets the limits for amateur radio: harmonic and spurious emissions must be at least 43 dB below the mean output power for transmitters operating below 30 MHz at ≥5 W (the formula is actually -43 dB - 10·log₁₀(P/W), so a 100W transmitter needs harmonic emissions ≥63 dB below carrier; this is the standard “dBc” plus power-correction formula). Above 30 MHz the requirement tightens to ≥60 dB below mean output power. For ≥5 W transmitters above 30 MHz, the spec is essentially -60 dBc regardless of power level. Different services (Part 90 LMR, Part 22 cellular, Part 80 maritime) have their own specs, generally tighter than amateur.

The standard measurement setup: transmitter → directional coupler (or dummy load + tap) → spectrum analyzer. The directional coupler in this role serves two functions: it presents a 50 Ω load to the transmitter (so the TX sees a clean termination), and it taps a small fraction of the forward power to the SA (10 or 20 dB coupling, attenuated to a safe level for the SA’s mixer). Never connect a transmitter directly to a spectrum analyzer’s RF input — even +20 dBm (100 mW) is enough to damage the mixer in some instruments. The SA’s spec sheet has an “absolute maximum RF input” rating, typically +20 to +30 dBm; the working-level rating for accurate measurement is much lower, typically -20 to -10 dBm at the mixer.

Two alternative setups:

  1. TX → directional coupler → 50 Ω dummy load (with the coupler’s coupled port routing 1/10 or 1/100 of forward power to the SA). The dummy load absorbs the transmit power; no radiation, no spectrum impact, fully lawful. This is the standard bench setup. The Bird 43 with its 25 W or 100 W slug in the through line plus a sensor head is an industry-standard variant — see Vol 26 (RF power, SWR & field-strength).
  2. TX → coupler → antenna (lawful transmission per Part 97 on your authorized bands). The coupler taps forward power to the SA while the antenna radiates. The advantage is you measure the actual operating condition; the disadvantage is the antenna’s impedance match affects the SA reading, and you must of course be transmitting lawfully (correct frequency, ID, mode).

For the harmonic survey itself, configure the SA:

  • Span: 0 to 6× fundamental (catches 2nd through 5th harmonics with margin). For a 14.2 MHz fundamental, span 0-85 MHz works. For 144 MHz, span 0-900 MHz.
  • RBW: 1 kHz for narrow CW or SSB signals; widen to 10 kHz for AM/FM/digital modes; widen to 100 kHz for spread-spectrum.
  • VBW: typically RBW/3 or less for smoother trace; equal to RBW for fast sweep.
  • Reference level: set to peak carrier level + 5 dB headroom.
  • Detector: peak for harmonic search (worst-case display), average for compliance-grade measurement.
  • Input attenuator: 10-20 dB minimum. The coupler already attenuates the forward power tap, but adding SA attenuation gives mixer headroom.

Read the carrier level at the fundamental, then read each harmonic. The harmonic levels in dBc (decibels below carrier) are:

harmonic_dBc = harmonic_dBm - fundamental_dBm

This is always negative for a passing measurement. For a 100W (=+50 dBm) transmitter:

  • Fundamental at 14.200 MHz: SA reads (say) -10 dBm (after coupler + attenuation, a known offset)
  • 2nd harmonic at 28.400 MHz: SA reads -60 dBm → 2nd is 50 dB below fundamental → -50 dBc
  • 3rd harmonic at 42.600 MHz: SA reads -65 dBm → -55 dBc
  • 4th harmonic at 56.800 MHz: SA reads -70 dBm → -60 dBc
  • 5th harmonic at 71.000 MHz: SA reads -75 dBm → -65 dBc

The Part 97 spec for 100 W below 30 MHz is -43 dBc - 10·log(100/1) = -43 - 20 = -63 dBc. So the 2nd harmonic at -50 dBc fails the spec by 13 dB; the radio has insufficient harmonic suppression. The likely cause is the radio’s harmonic filter is mistuned, damaged, or absent (homebrew rig). Most modern commercial HF radios spec their harmonics at -50 to -65 dBc with the built-in harmonic filter engaged, which passes the spec for 100 W operation with margin.

For homebrew or modified equipment, harmonic measurement is the gate test that determines whether you can legally operate. A surplus or homebrew amplifier without an output low-pass filter will typically show 2nd and 3rd harmonics in the -20 to -35 dBc range, which is wildly out of spec — adding a band-specific output low-pass filter (W3NQN or QRP-Labs designs are well-known, with 5-section Chebyshev typically giving ~30-50 dB of additional 2nd-harmonic attenuation) brings the harmonics into compliance.

Cross-link to Vol 31 (Regulatory & RF safety) for the full FCC Part 97 spectral-purity ruleset including the corner cases (5 W threshold, ≤5 W relaxation, the difference between mean and PEP measurement for SSB), and to Vol 16 (BALUNs and UNUNs) for the filter-circuit construction details. For automated batch harmonic surveys on multiple transmitters, the GPIB-controllable HP 8591E + a Python script using PyVISA is the bench workhorse — see §8 (Used HP/Agilent).

11. EIRP estimation by reciprocity

The spectrum analyzer can be used to estimate the effective isotropic radiated power (EIRP) of a transmitter-antenna combination by measuring received power at a known distance with a known-gain antenna, then back-solving the Friis transmission equation. This is the standard far-field measurement technique used by EMC labs and amateurs alike.

The Friis equation, rearranged for EIRP:

EIRP(dBm) = P_RX(dBm) + FSPL(dB) - G_RX(dBi)

where FSPL is the free-space path loss between transmitter and receiver:

FSPL(dB) = 20·log₁₀(d_meters) + 20·log₁₀(f_MHz) - 27.55

The constant -27.55 absorbs the units and the 4π² factors when distance is in meters and frequency in MHz. Some references use -32.45 for distance in km, or +36.6 for distance in miles + frequency in MHz; pick one form and stick to it.

The setup requires several controlled conditions:

  • Far-field criterion: distance d > 2·D²/λ, where D is the largest dimension of either antenna. For a small whip at 1 GHz (λ = 30 cm, D ≈ 7.5 cm), d > 2·(0.075)²/0.30 = 0.038 m, easily satisfied at any practical distance. For a 4-element Yagi at 144 MHz (λ = 2.08 m, D ≈ 1.5 m), d > 2·(1.5)²/2.08 = 2.16 m — close but not impossible at lab scale. For a large dish at 10 GHz, the far-field distance gets long quickly.
  • Known-gain receive antenna: this is the calibration anchor. A calibrated log-periodic from an EMC test lab (e.g., a Schwarzbeck VULP9118D, which is the European EMC bench standard at 200 MHz - 5 GHz, $3-6k new), or a known-geometry half-wave dipole (which is 2.15 dBi by definition), or a calibrated horn (high-frequency work). The gain figure must be accurate to within ±1 dB for the EIRP estimate to be useful.
  • Clear line-of-sight + low multipath environment: outdoor open area, or a properly damped anechoic chamber. Indoor measurements bounce off walls and floors, leading to multi-dB errors from constructive/destructive interference. The classic compromise is an outdoor measurement on a grass field at 3 m or 10 m separation (the standard CISPR test distances).
  • Calibrated coax + connector loss accounting: the FSPL formula assumes zero loss from transmit antenna feedpoint to mixer. Coax loss between RX antenna and SA must be added back: P_RX_actual_at_antenna = P_SA_reading + L_coax_dB. The Vol 5 (Transmission lines) loss tables give the coax-loss numbers for common cable types.

Worked example: amateur 1 GHz experimental transmission. RX antenna is a 6 dBi log-periodic at 10 m horizontal distance. SA reading at 1.000 GHz: -42 dBm. Coax from RX antenna to SA: 3 m of LMR-240, ~1 dB loss at 1 GHz → P_RX_at_antenna = -41 dBm.

FSPL at 1 GHz, 10 m:

FSPL = 20·log(10) + 20·log(1000) - 27.55
     = 20 + 60 - 27.55
     = 52.45 dB

EIRP:

EIRP = -41 + 52.45 - 6
     = +5.45 dBm
     ≈ 3.5 mW

So the transmitter-antenna combination is putting out about 3.5 mW EIRP. For a low-power experimental device, that’s plausible.

Reverse the workflow: if you want to verify a commercial Wi-Fi access point is putting out the claimed 100 mW (+20 dBm) EIRP, with a 5 dBi receive antenna at 5 m at 2.4 GHz:

FSPL(2400 MHz, 5 m) = 20·log(5) + 20·log(2400) - 27.55
                    = 14 + 67.6 - 27.55 = 54 dB
P_RX_expected = EIRP - FSPL + G_RX
              = +20 - 54 + 5 = -29 dBm

If your SA reads about -29 dBm at 5 m on a calibrated 5 dBi antenna, the AP is producing roughly its claimed EIRP. If it reads -40 dBm, either the AP is putting out less than claimed, or there’s a multipath null, or your antenna gain is wrong, or the path is partially obstructed.

The reciprocity principle works in both directions: the same antenna pair can be used to measure transmit power or to measure receive antenna gain (drive the “receive” antenna with a known signal source, measure at the calibrated antenna’s position, back-solve for the first antenna’s effective area).

Cross-link to Vol 31 (Regulatory & RF safety) for MPE (Maximum Permissible Exposure) compliance: the +5.45 dBm EIRP in our example is so far below any MPE concern (which kicks in at +20 dBm EIRP at close range on 2.4 GHz Wi-Fi, +30 dBm on amateur 70 cm at typical mounting heights) that it’s irrelevant. But at higher power, the same EIRP-measurement workflow is the basis of OET-65 compliance calculations for amateur stations.

Cross-link to Vol 11 (Yagi-Uda) for the measurement of Yagi gain by reciprocity (a primary use case): drive a calibrated reference antenna, measure with the Yagi at the test distance, back-solve. Easier than it sounds, and a standard amateur-club activity around field-day prep.

12. Near-field probing — E-field and H-field probes

Far-field measurements like EIRP estimation in §11 tell you the total radiated power from a transmitter-antenna combination. Near-field probing tells you where on the circuit the RF is leaking out — complementary, not competing, with the far-field measurement. EMC pre-compliance debugging almost always starts with a far-field overage report and proceeds to near-field probing to find the offending trace, IC pin, ribbon cable, or enclosure seam.

There are two flavors of near-field probe. The E-field probe is a short whip or thin loop of bare wire (typically 3-10 mm long) at the end of a high-impedance shielded line. It picks up the local electric field around active circuit nodes — high-impedance traces, signal-driving pins, antenna-tap points — and presents the signal at its output. Sensitive but easily overloaded by strong nearby fields, and indiscriminate (it picks up everything within a couple of centimeters).

The H-field probe is a small shielded loop (typically 5-25 mm diameter copper wire formed into a loop, surrounded by a shielded coaxial conductor that has a deliberate gap at the top of the loop). The shielding suppresses pickup of E-field components and concentrates the response on H-field (magnetic field) only. This makes the H-field probe more selective: it picks up currents flowing in traces, not voltages on nodes. Closer to a microscopic version of a current clamp. Useful for tracing where a noise current actually flows on a PCB.

The bench-standard kit is the Beehive Electronics 100-series: 100A (broadband E-field whip), 100B (shielded H-field loop, ~5 mm), 100C (shielded H-field loop, ~25 mm). The full kit runs about $200-300 for all three, covers 30 MHz - 6 GHz with rated sensitivity, and includes SMA terminations that connect directly to an SA or SDR. For higher-frequency work (up to 18 GHz or so), Beehive also makes the 101 series in K-connector mount.

The DIY version is straightforward enough that most experimenters build their own and treat the Beehive set as a calibrated reference. For an H-field loop probe:

  1. Cut a 10-15 cm length of semi-rigid coax (UT-141 or UT-085; UT-085 is more flexible at the cost of being less rugged). Strip the outer jacket cleanly.
  2. Bend the coax into a circular loop at one end with diameter 5-25 mm depending on the application — smaller loops are more selective, larger loops more sensitive but pick up wider area.
  3. Solder the cut end of the outer braid to itself across the loop join (or to a small ground tab).
  4. At the top of the loop (180° around from where the coax enters), use a Dremel or fine file to cut through the braid (but not the inner conductor or the dielectric). This is the critical “gap” that makes the probe an H-field pickup — without the gap, the shielded loop becomes a single-turn antenna picking up both E and H.
  5. Terminate the other end of the coax with an SMA connector.

Use cases for near-field probing:

  • Finding which trace is radiating: PCB lid removed, probe in hand, SA tuned to the spurious frequency. Walk the probe across the board, watch the SA level. The trace under the probe when the level peaks is the source.
  • Verifying shield effectiveness: probe along enclosure seams, ventilation slots, panel-mount connectors, and any other potential leak path. A peak indicates a leak.
  • Debugging crosstalk in dense PCBs: probe one trace while driving a known signal on an adjacent one; if the probe sees the driven signal, you have measurable coupling.
  • Identifying the radiator in a multi-board system: probe each board in turn (the offending board produces a much stronger probe signal than the others).

For a budget setup: pair a homebrew H-field loop with a HackRF One or RTL-SDR running a waterfall display (SDR# or GQRX). You get a poor-man’s near-field scanner — slow tuning, no absolute calibration, but excellent at spotting “there’s something at this frequency, peaking at this physical location.” The HackRF One running at high gain plus a homebrew loop is an EMI-hunting kit that costs $30 of parts and finds real problems.

The cross-link to §13 (Pre-selectors) is important: when probing in a high-EMI environment, the SA can get overloaded by broadband signals other than the one you’re trying to isolate. A bandpass filter in line with the probe (covering only the band of interest) cleans up the display dramatically.

13. Pre-selectors and front-end filters

A spectrum analyzer’s input is fundamentally a mixer. The mixer is nonlinear: it multiplies the input signal by the local oscillator (LO), producing sum and difference frequencies. Mixers have a limited input range — too much total input power across all frequencies and the mixer begins to compress (gain reduces, then signals start producing intermodulation products), eventually saturating into pure distortion.

The trap: the input attenuator is the only thing protecting the mixer, and at full sensitivity (RF gain on, attenuator at 0 dB) a spectrum analyzer is wide open. If you’re in a high-RF environment — say, sweeping antennas near a powerful AM/FM broadcast tower, or doing harmonic measurements in a lab next to a 100 W TX — the total input power across the entire SA frequency range can easily exceed the mixer’s safe linear range, even if you’re tuned to 1 GHz and the nearest big signal is 100 MHz. The mixer goes nonlinear; intermod products appear at your tuned frequency that look like real signals but are entirely artifacts of the SA mixer being overdriven.

This is the classic gotcha that catches even experienced operators. You’re trying to measure a -90 dBm spur on your transmitter at 432 MHz. The tower across the street is broadcasting +40 dBm on 100 MHz. Your SA has no pre-selector. The 100 MHz signal hits the mixer, but you’re tuned to 432 MHz so it doesn’t appear directly — instead, mixer IMD products like (3·100) = 300 MHz, (4·100) = 400 MHz, (5·100) = 500 MHz, and their harmonics with the LO frequency, populate your display with phantom “spurs” at frequencies you care about. The measurement is garbage.

The fix is a pre-selector: a bandpass filter in front of the SA’s input that limits the total power reaching the mixer to just the band of interest. With a bandpass filter centered at 432 MHz with 50 MHz of bandwidth, the 100 MHz broadcast signal hits 50+ dB of attenuation before reaching the mixer, restoring linearity.

Common pre-selector options:

Mini-Circuits SXBP series — fixed-band cavity filters, typically 30-80 dB out-of-band rejection, 0.5-2 dB insertion loss in passband. ~$30-80 per filter. Pick the band: SXBP-15+ (10-20 MHz), SXBP-30+ (25-40 MHz), SXBP-60+ (50-80 MHz), SXBP-100+ (90-110 MHz, the FM broadcast notch), and so on through GHz bands. For amateur work, a SXBP-145 or SXBP-432 covers the 2m and 70cm bands.

Crystek CBP series — high-Q ceramic bandpass filters, very steep skirts, narrower bandwidth. Useful for surgical band-edge measurement. ~$50-100.

Tunable preselectors — built into high-end SAs (Signal Hound SM200B’s preselector, R&S FSH8’s, HP 8593E’s YIG-tuned filter). External tunable preselectors exist (Wenzel, RF Solutions) for $1,000+. Less common in amateur work.

Step attenuator — the classic HP 8494A/8494B 0-110 dB step attenuator in 10 dB steps, used $200-400. Not a filter but a controlled-attenuation panel that lets you knock the input down by 10/20/30/40 dB while you tune. For full-band SWR sweeps in high-RF environments, dial in 30 dB of attenuation and accept the noise-floor penalty in exchange for clean linear measurement.

The rule of thumb for the SA’s own input attenuator: never run with 0 dB attenuation unless you’re chasing a weak signal in a known-clean environment. The default attenuator setting on most SAs is 10 dB; this gives the mixer 10 dB of headroom before it starts compressing on the strongest signal in band. For harmonic measurement of a transmitter (where strong fundamental + relatively weak harmonics) the attenuator should be set to whatever value keeps the fundamental at least 10 dB below the mixer’s compression point, typically 20-30 dB of attenuation. Trade: more attenuation = higher noise floor = less sensitivity to weak harmonics. The art is finding the value that lets you see the weakest harmonic of interest with linearity intact.

Cross-link to Vol 26 (RF power, SWR & field-strength) for the broader power-handling discussion (dummy loads, attenuator chains, calorimetric power measurement at high levels).

14. Commercial buys

Pricing as of mid-2026, organized by tier. All prices USD.

Budget tier (~$80-200). For amateur experimenters who want a real measurement instrument without dedicating a benchtop budget. The TinySA Ultra at $130-180 is the clear winner here — built-in tracking gen, 100 kHz - 5.3 GHz coverage, usable display, USB-C for capture. The TinySA (original) at $60-80 is the entry point if you only need 350 MHz coverage; useful as a portable companion to a benchtop instrument. RTL-SDR + rtl_power scripts is a no-purchase option for the existing RTL-SDR owner — gives you a rough spectrum-display proxy in the rtl-sdr’s tuning range (24 MHz - 1.7 GHz), without calibration but free.

Mid tier (~$300-3,000). The used-benchtop sweet spot. HP 8590B/E with Option 010 tracking generator $800-1,500 used from a reputable dealer is the recommended buy in this tier — bench-grade calibration, GPIB-controllable, real durability. Tektronix RSA306B used $1,500-2,500 buys you real-time spectrum analysis and Windows software integration; the right pick if you do a lot of intermittent-EMI hunting and have a Windows host already. Owon XSA1015-TG and XSA1036-TG ($1,500-2,500 new) are modern Chinese benchtops that compete well in basic SA capabilities; not at the build quality of HP/Agilent but new with warranty. Siglent SSA3032X-Plus ($2,500-3,500 new) is the well-respected Chinese mid-tier benchtop with built-in tracking gen and CISPR-capable RBW filters.

Premium tier (~$3,000-30,000). Lab-grade for serious work. Signal Hound BB60D ($5,000 new) is the recommended USB-controlled SA at this tier — phase noise low enough for receiver characterization, dynamic range and IIP3 to compete with $30k benchtops on most metrics, runs from USB with Spike software. Signal Hound SM200B ($10,000 new) extends coverage to 20 GHz with a tunable preselector — the right pick for serious EMC work or microwave amateur experimentation. R&S FSH4 ($7-15k new, $2.5-6k used) is the field-portable benchtop — battery-powered, ruggedized, CISPR-compliant filters; pick this over a USB analyzer if you need to do field work or tower-top characterization. Keysight FieldFox N991xA series ($8-25k depending on options) is the direct R&S FSH competitor with integrated SA + VNA + power meter in one box. Tektronix RSA607A ($3,000-4,000 new) extends RSA306 to 7.2 GHz with built-in tracking gen. Agilent ESA E4407/E4408 used ($1,500-4,000 used) is the next-tier-up used benchtop with color LCD and LAN.

Above $30k: the lab-instrument tier (Keysight UXA, R&S FSU, R&S FSW, R&S FSV30). These are real lab spectrum analyzers with phase noise -130 dBc/Hz and below, true CISPR EMI receivers, and capability for protocol decode at 5G/6G frequencies. Out of scope for the Hack Tools lineup; rentable from instrument-rental shops at $200-500/day if a specific measurement requires this tier.

The decision framework:

  • “I have $200 and want a real SA” → TinySA Ultra. The right answer for ~80% of amateur experimentation.
  • “I have $1,000 and want bench-grade calibration” → HP 8591E with Option 010, used from ValueTronics.
  • “I have $5,000 and need genuinely lab-grade specs in a small box” → Signal Hound BB60D.
  • “I’m hunting intermittent EMI and have a Windows machine” → Tektronix RSA306B used.
  • “I need to take measurements out of the lab” → R&S FSH4 used (or FieldFox if you prefer Keysight).
  • “I need 20+ GHz coverage” → Signal Hound SM200B (new), or Agilent E4408B (used).

15. Common gotchas and myths

“A spectrum analyzer measures SWR.” It does not, directly. A spectrum analyzer measures power at its input — that’s it. To measure SWR you need additional gear: a tracking generator (built-in or external) plus a directional coupler in front of the antenna under test (see §9). With that kit you measure return loss vs frequency, then convert to SWR. Without it, the SA just shows you input power, which has no fixed relationship to SWR. The myth comes from people who own an SA + TG combination and forget to mention the coupler.

“The TinySA Ultra is as good as a benchtop SA for compliance work.” For hobby work, EMI hunting, rough harmonic checks, and band-survey use, the TinySA Ultra is genuinely excellent value. For compliance-grade measurements that require traceable calibration, CISPR-compliant peak/quasi-peak/average detectors, certified RBW filters, and dynamic range to capture -90 dBc spurs accurately, the TinySA Ultra falls well short. The Tektronix RSA, Signal Hound BB60D/SM200B, R&S FSH, and Keysight FieldFox are the instruments qualified for compliance work. Don’t submit a TinySA Ultra screenshot to an EMC certification lab; they won’t accept it.

“An SDR + FFT is the same as a spectrum analyzer.” For relative-level work (comparing two signals, seeing which is bigger, tracking a peak in time), an SDR + FFT in software (gqrx, SDR#, GNU Radio) gives you a perfectly usable spectrum display. For absolute-level work (measuring power in dBm, comparing against a regulatory limit, characterizing receiver sensitivity in MDS dBm terms), the SDR must be calibrated against a known signal generator at each frequency of interest. The SDR’s front-end gain is frequency-dependent, AGC varies, and the ADC scale is in counts not in dBm. Building a frequency-by-frequency cal table is doable (and worth it for serious SDR-as-instrument work), but it’s a project, not a quick check. A real SA gives you absolute power without per-frequency cal effort.

“Real-time bandwidth means I see everything.” Only within the RT-BW window. The Tek RSA306B has 40 MHz of RT-BW — meaning anywhere in any 40 MHz window centered on the current tuned frequency, you see every signal in real time, including microsecond-duration bursts. Outside that 40 MHz window, you’re back to swept-tuned behavior, and short bursts can be missed. To survey a wide band for intermittent activity, you have to step through 40 MHz windows (or buy a wider-RT-BW instrument like the SM200B at 110 MHz, or eventually a Keysight UXA at 1 GHz of RT-BW).

“RBW = resolution, narrower is always better.” RBW filters do define the bandwidth of the SA’s effective receiver — narrower filters give finer frequency resolution. But the displayed amplitude in narrow RBW is also lower-noise-floor-limited. The relationship is: noise floor (dBm) = noise floor (dBm/Hz) + 10·log(RBW in Hz). A narrow 100 Hz RBW gives a noise floor 30 dB lower than a 100 kHz RBW. But the narrow RBW also sweeps slower (square law: 10× narrower RBW = 100× slower sweep) and shows wider signals (FM voice, digital modulation) as distributed energy across many bins rather than as a clean peak. The art is matching RBW to the signal you’re trying to characterize — 1 kHz for narrow CW, 10 kHz for SSB voice, 100 kHz for FM/DMR, 200+ kHz for spread-spectrum and CW pulses.

“Setting sweep speed faster gives sharper signals.” False, and worse than false: setting sweep speed too fast for the RBW filter actively produces incorrect amplitude readings. The rule of thumb: sweep time (s) ≥ k · span (Hz) / RBW² (Hz²), where k is typically 1-3 depending on filter Q. Equivalently: at any given RBW, there’s a minimum dwell time per resolution-bin that lets the filter settle to full response. Sweep faster than that and the filter doesn’t fully build up — displayed amplitude is reported low, and the signal might appear at a slightly shifted frequency. The SA’s “auto sweep” function on modern instruments handles this calculation for you (and may grey out the sweep-time field with “minimum 200 ms for these settings”). On older instruments, manually slow the sweep until amplitudes stop changing. If the signal “grows” when you slow the sweep, the original was sweep-rate-limited.

“I can connect a transmitter directly to the spectrum analyzer.” Don’t. Even +20 dBm (100 mW) is enough to damage the mixer in some SAs; +30 dBm (1 W) damages most; +40 dBm (10 W) destroys the input cleanly. Always use a directional coupler or a high-power attenuator chain to drop the level to safe range. The SA’s absolute-maximum input rating is the destruction threshold, not the working level — keep actual input at least 10-20 dB below absolute max.

“The cal certificate is good for 5 years.” No. Spectrum analyzer calibration drifts with use and with temperature cycling; the typical compliance-grade cal interval is 1 year for traceable measurements. Older HP 8590-series can hold cal for several years if treated well, but the noise floor and amplitude flatness specs creep slowly. For benchtop hobby work, a unit that hasn’t been calibrated in 3-5 years is still usable — just don’t trust absolute dBm readings to better than ±2 dB without checking against a known reference signal.

16. Resources

TinySA ecosystem:

Authoritative spectrum-analyzer fundamentals references:

  • Keysight (Agilent) Application Note 150, “Spectrum Analysis Basics” — the canonical introduction, freely available from Keysight: https://www.keysight.com/us/en/assets/7018-06714/application-notes/5952-0292.pdf
  • Keysight Application Note 1304, “8 Hints for Better Spectrum Analyzer Measurements”
  • R&S Educational Note 1MA201, “Spectrum Analyzer Fundamentals — Theory and Operation of Modern Spectrum Analyzers”
  • Tektronix Primer “Real-Time Spectrum Analysis Fundamentals” (free PDF from Tek)
  • ARRL Antenna Book, 25th+ edition, Ch. 27 (Test Equipment) — covers SA basics in the amateur context

Used-equipment dealers:

Vendor product pages:

EMC and pre-compliance:

  • ARRL “RFI Book” — amateur-radio-focused EMI/RFI hunting (current edition as of mid-2026)
  • EFF EMI guide for amateurs (informal community reference; see ARRL forums for current pointers)
  • CISPR 16 specification (formal standard for EMI receiver requirements; cited by every commercial EMC bench)

Cross-links inside this deep dive: