How RF Direction Finding Works: From Angle-of-Arrival to Networked TDOA Positioning

If you set up a drone detection system that listens but never transmits, you are using radio frequency direction finding. The concept is simple in principle and subtle in practice. A drone talks to its remote controller. That conversation uses radio waves. A passive sensor tuned to the right frequency bands picks up the conversation, measures where it is coming from, and, when multiple sensors work together, triangulates the source location. The system emits nothing. It reveals nothing about itself. It just listens.

This article explains the two core techniques behind passive drone detection—angle-of-arrival and time-difference-of-arrival—and walks through the LZ TECH products that use them. No signal transmission, no jamming, no navigation interference. Just receiving.

Angle-of-arrival: which direction is the drone in?

Angle-of-arrival, or AOA, is the most straightforward way to find a radio source. An AOA sensor uses an antenna array. When a drone’s signal hits the array, each antenna element receives it at a slightly different phase. The phase differences across the array tell the sensor which direction the signal came from. Modern AOA systems can resolve direction to within a few degrees.

A single AOA sensor gives you a bearing line. That is a line drawn from the sensor in the direction of the signal. It tells you the drone is somewhere along that line. It does not tell you how far away it is. For a security operator, this is enough information to start scanning the sky in the right direction, but not enough to send a response team to a specific location.

Two AOA sensors change the picture. When two sensors at known positions each produce a bearing line toward the same signal source, those lines intersect. The intersection is the drone’s position. Three sensors are better. Four eliminate ambiguity entirely in rough terrain. This is how AOA-based passive detection networks work. Each sensor is a passive RF receiver that listens and measures angle. The command platform collects the bearing lines from all nodes and computes the intersection. No sensor transmits anything at any point in the process.

LZ TECH’s DF Series fixed-site sensors are built for AOA networking. The DF chassis covers 30 MHz to 6 GHz, with a detection range of up to 8 kilometers and 360-degree coverage. Its direction-finding accuracy is 3 degrees for a hovering drone and 10 degrees for a moving target. Multiple DF nodes can be deployed around a protected site and networked together through the CCS command platform. Each node adds another bearing line to the intersection calculation, improving the position estimate with every additional sensor.

Two higher-specification variants extend the AOA concept. The DF5 Max keeps the same 30 MHz to 6 GHz range and 8-kilometer detection envelope but adds dedicated direction-finding bands at 2.4 GHz and 5.8 GHz, the frequencies where most consumer drones operate. The DF10 Max stretches the frequency ceiling to 8 GHz, widens its direction-finding band from 100 MHz to 6 GHz, and tightens accuracy to 5 degrees RMS out to 5 kilometers. Both feed into the same CCS networking logic as the base DF Series.

TDOA: when timing replaces triangulation

Angle-of-arrival works well when the sensors have clear line of sight and the drone is not moving too fast. It gets harder in dense urban environments where signals bounce off buildings and arrive at the sensor from multiple directions at once. That multipath reflection shifts the apparent phase at the antenna array and degrades the bearing measurement. In these environments, a different technique called time-difference-of-arrival, or TDOA, often produces better results.

TDOA works on a different principle. Instead of measuring the angle of arrival, it measures the time a signal takes to reach each sensor in the network. Radio waves travel at the speed of light. A signal from a drone reaches a sensor that is 300 meters away about one microsecond before it reaches a sensor that is 600 meters away. A TDOA network detects these microscopic timing differences between sensor pairs.

Each pair of sensors that receives the same signal produces a hyperbola—a curve of possible source locations where the time difference matches the measurement. When multiple sensor pairs produce overlapping hyperbolas, the curves converge on a single point. That point is the drone’s position, computed purely from timing data. TDOA systems do not need directional antennas. They do not need phase-sensitive arrays. They need tightly synchronized clocks across the sensor network and a computing platform that solves the hyperbolic intersection in real time.

The D5-B is LZ TECH‘s dedicated TDOA sensor node. It is a fixed-site, network-enabled detection and positioning unit that uses passive RF sensing with TDOA computation. Multiple D5-B nodes deployed around a perimeter form a TDOA grid. Each node timestamps every signal it receives. The central platform correlates the timestamps across nodes, computes the hyperbolic intersections, and outputs a coordinate fix. The D5-B does not emit. It is undetectable by the drone it is tracking.

AOA plus TDOA: why both are better than either alone

The most capable detection networks use both AOA and TDOA in combination. AOA provides a fast initial bearing estimate from a single sensor. That bearing tells the operator where to look and gives the electro-optical systems a direction to slew toward. TDOA provides a precise coordinate fix from the network, independent of multipath conditions that might degrade AOA accuracy.

The two techniques complement each other’s weaknesses. AOA is strong in open terrain with a small number of sensors. TDOA is strong in cluttered environments where bearing measurements are unreliable, but it requires more sensor nodes and careful clock synchronization. A network that runs both simultaneously gets the best of both: rapid bearing from AOA across a few well-placed nodes, and high-precision positioning from TDOA across a denser grid. The data streams merge in the command platform, which fuses the AOA bearings and TDOA hyperbolas into a single position estimate on a GIS display.

Airborne direction finding: removing the terrain blind spot

No matter how good the AOA or TDOA algorithm is, a ground-based sensor cannot detect a signal it does not receive. Buildings, hills, and terrain contours block radio line of sight. A drone flying at 80 meters behind a warehouse is invisible to a sensor on the other side of the building. Passive direction finding works with the signals it sees. It cannot invent signals it misses.

One way to solve this is to put a sensor in the air. The D5-Air is an RF detection payload that mounts on a standard commercial UAV platform, such as the DJI M400 or M350. From an airborne position, its detection band of 400 MHz to 6 GHz covers drone control and video frequencies, and its range extends up to 5 kilometers. The D5-Air does not attempt stand-alone direction finding. It feeds received signal data back to the ground station, which incorporates it into the same AOA and TDOA processing pipeline as the fixed ground nodes. An airborne node changes nothing about the underlying physics of direction finding. It just gives the network a vantage point that is not blocked by whatever is between the ground sensor and the target.

What this means for procurement decisions

Passive RF detection gives site operators a set of choices that active systems do not. Because passive sensors emit nothing, they can be deployed at airports, hospitals, and broadcast facilities where radio emissions are tightly regulated. They can operate continuously without affecting the electromagnetic environment. They do not announce their presence to the drone or its operator. The drone flies into monitored airspace without knowing it has been detected, and the security team gets a position fix before the drone gets close to anything critical.

The procurement decision breaks down into three questions: how many sensors, what type of positioning, and is airborne coverage needed.

For a small, open site with good sightlines—say a water treatment plant or a solar farm—two to three DF Series nodes running AOA networking provide adequate coverage. The terrain is flat, multipath is minimal, and AOA bearings are reliable.

For a large site or one with irregular terrain—an airport perimeter, a port facility, a border crossing—a combination of DF Series AOA nodes and D5-B TDOA nodes delivers both fast bearing and precise positioning. The AOA nodes cover the open areas quickly. The TDOA nodes handle the cluttered sections where bearings get unreliable. The CCS platform fuses them.

For a site where terrain or structures create known blind spots that ground sensors cannot resolve, adding a D5-Air airborne node extends the coverage into those shadows. The airborne node does not replace the ground grid. It supplements it, filling gaps that geometry alone prevents ground sensors from reaching.

Passive direction finding has been a core technology in signals intelligence for decades. The drone detection industry has adapted it for a new threat at lower cost and with faster deployment than the military systems it descends from. The core principle is unchanged. Listen carefully, measure precisely, emit nothing. The DF Series, the D5-B, and the D5-Air represent three different ways to do that, and for most sites, the right answer is some combination of all three.