Airframes.io: Intelligence Source Guide

Airframes.io aggregates decoded aircraft datalink messages – ACARS, VDL Mode 2, HFDL and satellite AERO – from a volunteer receiver network into one searchable stream. It is the cheapest route to the content of aircraft communications, not just their positions.

At a glance

Source	Airframes.io
Category	Aviation & Space › ADS-B & Flight Tracking
Homepage	https://airframes.io
Machine interface	`https://api.airframes.io/v1/`
Format	`REST`
Access	Open — no account required
Disciplines	Radio Frequency Intelligence, Signals Intelligence
Mission domains	RF & Signals Intel, Aviation Security

Aggregator of ACARS, VDL, HFDL and SATCOM aircraft messages with decode, station coverage and message search API. — as catalogued in the platform’s own source registry.

Airframes.io is a community aggregation layer sitting on top of a distributed network of volunteer radio receivers. Individual operators run open-source decoders – acarsdec and vdlm2dec for VHF ACARS and VDL Mode 2, dumpvdl2, dumphfdl for High Frequency Data Link, JAERO and Iridium toolchains for satellite AERO – and forward the decoded frames to a central ingest. The site presents a live message feed, per-station statistics, coverage maps and search, with a programmatic interface for retrieving messages. What arrives is not a position report in the ADS-B sense. It is the payload of an operational datalink: crew free-text, OOOI events (out of gate, off ground, on ground, in gate), weather requests, position reports carried inside ADS-C contracts, CPDLC clearances, maintenance downlinks, load sheets, and a long tail of airline-proprietary formats that the decoder passes through as text. Each record is tagged with the receiving station, the frequency or channel, the link type, the aircraft address where present, and a receiver-side timestamp.

Every other aviation source in this catalogue tells you where an aircraft was. This one tells you what was said. That is a categorically different analytical product. A diverted aircraft shows up in ADS-B as a track that bends; in ACARS it shows up as a crew message asking for a gate at the new destination, a maintenance code, or a fuel figure. An aircraft with its transponder off may still be transmitting on VDL Mode 2 or HFDL because those links serve the airline's operational control function, not air traffic surveillance, and they are administered separately. For RFINT work, the source doubles as a map of which datalink infrastructure is actually in use in a region – which ground stations, which frequencies, which satellite beams – because the message metadata records the path. For AVINT work on state and VIP aircraft, the free-text and OOOI streams frequently carry the ground handling detail that positional data cannot: the handling agent, the requested services, the crew's own naming of the mission. Treat it as the collateral channel that runs alongside surveillance, and expect it to be noisier, sparser and more revealing.

Who publishes it, and why that matters

The project is community-run and open-source-centred, coordinated through public repositories and a chat community rather than a corporate support structure. Feeders contribute bandwidth and hardware for no payment; the aggregation infrastructure is maintained by a small group. That has three consequences you should plan around. First, coverage is a function of who happens to be enthusiastic in a given country, and it changes without notice – a station going offline can remove an entire region from your collection for weeks. Second, there is no service-level commitment, no support contract and no guarantee that the current API shape survives a refactor; the repositories are the authoritative statement of what exists, not anything you cached. Third, the incentive structure is hobbyist and research-oriented, which makes the project unusually transparent about its own gaps but also unusually vulnerable to a single maintainer's availability. If an investigation depends on this feed, mirror what you collect locally and do not assume you can go back and re-query historical windows later.

Provenance is the first question to ask of any dataset and the one most often skipped. Who collects it, what their incentive is, whether they publish a methodology, and whether they correct the record when they get something wrong all bear directly on how much weight a finding drawn from it can carry.

What a record actually contains

The fields you will be working with, what each one means, and whether it is something you can pivot on. Read the meanings carefully — more analysis is wrecked by misreading a field than by failing to find one, and a field that looks like an observation is often an inference.

Field	Type	What it means	Pivot value
`timestamp`	timestamp	When the receiving station observed the frame, in the station's clock. It is not the time the crew composed the message and not the time the airline's host system processed it.	Align against ADS-B track time to place the message on a flight path; expect small offsets.
`station_id`	string	The volunteer receiver that heard the transmission. Doubles as a coarse geolocation constraint on the transmitter for VHF links.	Receiver location, coverage map, and by inference an approximate transmitter footprint.
`link_type`	enum	Which datalink carried the message: VHF ACARS (POA), VDL Mode 2, HFDL, or satellite AERO via Inmarsat or Iridium. Determines propagation physics and therefore what absence means.	Frequency plan, ground station or satellite beam, expected range.
`frequency`	string	The channel in MHz. For VDL2 the common signalling channel dominates; for HFDL the frequency identifies the ground station and the time of day it is usable.	Ground station identity, propagation window, regional datalink infrastructure mapping.
`tail`	string	Aircraft registration as carried in the ACARS header. Airline-entered and therefore subject to typos, padding characters and stale values after a re-registration.	Registration lookup in adsbdb or hexdb.io, national registry, ownership and operator.
`icao`	string	The 24-bit ICAO aircraft address in hex, present on VDL2 and HFDL frames and absent from plain VHF ACARS. This is the reliable identity anchor.	ADS-B correlation, aircraft type and operator resolution, country allocation block.
`flight`	string	Flight identifier as the airline expresses it – often IATA-style in ACARS rather than the ICAO callsign that appears in ADS-B. The two do not match character for character.	Schedule data, route resolution, but only after normalising the identifier format.
`label`	string	ARINC 620 message label, a two-character code indicating the message class. Standard labels have defined meanings; many are overloaded by individual airlines with private semantics.	Message class filtering; do not treat non-standard labels as decodable without airline-specific knowledge.
`text`	string	The message body. Ranges from human-readable crew and dispatch traffic to binary-in-ASCII airline formats that the decoder emits verbatim.	Named entities, airport codes, times, fuel and load figures – all requiring manual interpretation.
`ack`	string	Acknowledgement field. Distinguishes an original transmission from an acknowledgement of one, which matters when you are counting activity.	Message pairing; de-duplicating traffic volume estimates.
`block_id`	string	Block sequencing identifier used to reassemble multi-block messages. A message split across blocks will look like several fragments unless you reassemble.	Message reconstruction; detecting truncated collection.
`level`	int	Received signal level at the station, where the decoder reports it. Useful for judging whether a marginal decode should be trusted.	Decode confidence; receiver performance assessment.
`error`	int	Error or CRC indicator from the decoder. A non-zero value means characters in the body may be wrong even though the frame parsed.	Quality gating; exclude from any analysis where a single character changes the meaning.
`position`	array	Latitude and longitude where the message carried one – typically an ADS-C position report or a free-text position in an operational message. Not present on most records.	Geospatial correlation with ADS-B, waypoint and FIR analysis, oceanic track identification.

Coverage — and what is not in it

Coverage is receiver-shaped, not geography-shaped. VHF ACARS and VDL Mode 2 are line-of-sight links, so a message is only in the dataset if a volunteer with an antenna was within radio horizon of the aircraft when it transmitted – in practice a few hundred kilometres for an aircraft at cruise altitude, far less on the ground. That produces dense collection over Western Europe, North America, parts of Australia, Japan and a scattering of well-served cities elsewhere, and near-nothing over most of Africa, Central Asia, the interior of South America and the polar regions. HFDL changes the picture: high frequency propagates over the horizon and a handful of receivers can hear traffic from ground stations serving whole ocean basins, which is why HFDL is the only part of this source with genuinely global reach. Satellite AERO coverage depends on whether a feeder is pointed at the relevant Inmarsat beam or receiving Iridium, and is correspondingly patchy but occasionally deep. Update rhythm is continuous – messages appear within seconds of reception. Historical depth is the weak axis: the live stream is the product, and you should not assume that arbitrary past windows remain retrievable.

Known blind spots

Absence of evidence here is not evidence of absence. These are the conditions under which Airframes.io will not show you something that is nevertheless real:

No receiver, no record. Absence of messages from an aircraft is overwhelmingly likely to mean nobody was listening in the right place, not that the aircraft was silent, and this failure mode is strongest exactly where analytical interest is highest.
Plain VHF ACARS frames often carry no ICAO 24-bit address, only a registration string typed by the airline's system, so an aircraft using a false or stale tail in its ACARS configuration is not detectable from this source alone.
Military aircraft on operational missions generally do not use civil ACARS; the ones you will see are transports, tankers, VIP and state aircraft operating in the civil system, which biases the dataset towards logistics and away from combat aviation.
HFDL reception is governed by ionospheric propagation, so the same aircraft on the same route will be audible at some hours and inaudible at others, and the diurnal pattern in your data is a property of physics rather than of the target.
Airline-proprietary message formats are passed through unparsed; a large fraction of the text field is not human-readable and cannot be interpreted without carrier-specific documentation you will not have.
Multi-block messages arrive as fragments and a naive query returns partial text that reads as complete, which silently truncates the meaning of exactly the operational messages most worth reading.
There is no guarantee of historical retention or of a stable retrospective query surface, so an investigation that needs a defensible archive must capture and store its own copy at collection time.
Satellite links carrying an increasing share of operational traffic are moving to protocols and beams that the volunteer toolchain does not decode, so the dataset's share of total datalink traffic declines over time in ways that are invisible from inside it.
Ground station and airline migration to newer datalink services means a route can drop out of the dataset entirely because the technology changed, not because the flying stopped.

Write the blind spot into the product. A statement that something “was not observed in Airframes.io” is defensible; a statement that it “did not happen” is not, and the difference is what survives cross-examination.

Access, licensing and what you may do with it

Access model: Open — no account required

The web interface is open and requires no account for browsing the live feed, station list and coverage view. Programmatic access is offered at an API host, and the practical advice is to read the project's public repositories for the current endpoint shape rather than relying on any endpoint list from memory or from a blog post – the surface has evolved with the project. If you intend to pull at volume, the community norm is to introduce yourself in the project's chat, describe what you are doing and agree an approach; this is a volunteer-funded system where an aggressive scraper is a real cost to real people. The more durable form of access is to become a feeder yourself: a receiver plus an SDR dongle plus a decoder gives you a first-party stream for your own area of interest, removes your dependence on someone else's uptime, and contributes coverage back. For any serious programme, run both – feed your own station and consume the aggregate.

Licence

Licensing here is layered and none of the layers is simple. The decoder software is open-source under its own terms. The aggregated message corpus is community-contributed and the project's terms of use are the authoritative statement of what redistribution is permitted; confirm them directly before republishing bulk data or building a commercial product on top. Separately, and more importantly, the legality of receiving and acting on these transmissions is not uniform. In some jurisdictions reception of any radio transmission not intended for the general public, and in particular disclosure of its content, is a criminal offence regardless of whether the signal was encrypted – the United Kingdom's wireless telegraphy regime is the commonly cited example. In others, reception of unencrypted transmissions is lawful but use or disclosure is regulated. Do not assume that because the data is on a public website, your organisation may lawfully collect, store or act on it in your jurisdiction. Get this cleared before you build a workflow on it, not after.

Rate limits and fair use

No published quota should be assumed. Treat the service as a shared community resource: cache aggressively, poll rather than hammer, request only the time windows and filters you need, and set a descriptive user agent that identifies your organisation and gives a contact. If your requirement is a continuous stream rather than periodic queries, ask the maintainers about the streaming route rather than approximating it with a tight polling loop. A sustained high-rate scrape against a volunteer aggregator will be noticed, will be blocked, and deserves to be.

Licensing changes, and it changes without warning. A dataset that was free for research this year may not be free for commercial or evidential use next year. Confirm the current terms before you build a dependency on it, and record the terms you relied on alongside the data — the licence in force at the time of collection is part of the provenance.

Collecting it

How Airframes.io is actually pulled, in the order you would set it up. Prefer the bulk or export interface over per-item lookups wherever one exists: it is kinder to the publisher, faster for you, and gives a reproducible snapshot rather than a series of point-in-time answers you cannot reconstruct later.

Method	Format	Cadence	Notes
Live web feed	HTML	continuous	Best for orientation and for confirming that the link types you care about are currently being received at all. Not a collection method for anything you need to keep.
REST API queries	JSON	continuous; poll on a schedule matched to your target's flight rhythm	The workhorse. Filter by aircraft address, registration or link type rather than pulling everything and filtering locally.
Own receiver feed	JSON	real time	Run acarsdec, dumpvdl2 or dumphfdl locally and take the decoder output directly. Gives you provenance you control and a defensible chain of custody.
Station and coverage metadata	JSON	occasional; re-pull weekly	Essential context. Knowing which stations were live during your window is what turns an absence of messages into a defensible negative finding.
Targeted archive capture	JSONL	continuous during an active case	Write every record you retrieve to your own append-only store at retrieval time, with the retrieval timestamp alongside the station timestamp.

Ingesting it into the platform

Every step below is idempotent and cursor-based: interrupt one and it resumes from where it stopped rather than duplicating rows or losing progress. Collection is recorded per source, so a feed that quietly stops publishing shows up as a stale timestamp instead of silently thinning your coverage.

Register the source — Add Airframes.io in sources.php with its link types and the receiver-dependency caveat recorded as a collection note, so that later analysts see the coverage limitation attached to the data rather than in a separate document.
Schedule collection — Configure collect.php to run the pull on a cadence matched to your targets, and let cron.php own the schedule so that gaps in collection are visible as job failures rather than silent absences.
Normalise identity — During ingest.php, split the record's identity fields: ICAO 24-bit address is the primary key, registration and flight identifier are attributes. Do not merge records on registration alone.
Reassemble multi-block messages — Group by aircraft, label and block sequence before storing the text body, and mark reassembled records so an analyst can tell a complete message from a fragment.
Resolve the aircraft — Run resolve-everything.php to attach type, operator and registration detail from the aircraft database sources, keeping the resolved attributes separate from what the message itself claimed.
Correlate with positional data — Use correlate.php to match the message timeline against ADS-B tracks for the same address, producing a combined record where a message can be placed at a point on a flight path.
Build the case timeline — Push matched records into timeline.php so the message stream and the track render on one axis, then attach the result to a case in cases.php with the collecting station recorded.
Flag and alert — Configure alert rules so that a watched aircraft address producing traffic on an unexpected link type, region or hour raises a notification rather than waiting for a manual review.

Registered sources and their last-collected state are listed in sources.php, and the scheduled chain that keeps them current is in automation.php.

How it is wrong, and how to tell

Every dataset is wrong in characteristic ways. Knowing which ways is the difference between using a source and being used by one, and it is the part of source evaluation most often skipped because it is the part that takes work.

Judge this source on decode integrity first and completeness second, and never confuse the two. Decode integrity is generally good: the open-source decoders are mature, widely used and conservative, and frames that fail CRC are usually marked rather than silently passed. Where they do pass marginal frames, single-character corruption in the body is the typical failure, which matters enormously if you are reading a registration, a fuel figure or a waypoint out of free text. Completeness is where the source is weak and honest about it – you are seeing what volunteers happened to hear. The right posture is to treat every positive record as strong evidence that a transmission occurred and every absence as no evidence at all. Corroboration should be structural rather than incidental: for any finding that matters, confirm the aircraft identity independently through ADS-B or a registry, confirm the timing against an independent clock, and confirm that the receiving station was actually live and performing normally during the window. The aggregate has no editorial layer, no analyst review and no confidence scoring; the quality judgement is entirely yours to make and to document.

Characteristic false positives

The registration in an ACARS header is a string the airline's system inserted, not something the radio proved. A carrier that mis-configures a unit, or has not updated it after a re-registration, produces messages that confidently name the wrong aircraft.
The same transmission heard by several stations produces several records, and counting messages without de-duplicating on aircraft, time and content inflates apparent activity in exactly the regions with the densest receiver coverage.
A message frequently concerns an aircraft other than the transmitter – dispatch traffic, connection information, fleet messages – so extracting a tail number from the body and attributing it to the sender is a common and serious error.
Timestamps are receiver clocks. Poorly synchronised stations introduce offsets of seconds to minutes, which is enough to break a correlation with a positional track or to invert the apparent order of two events.
Free-text position and time references are frequently planned rather than actual – an estimate for a waypoint, a scheduled gate time – and reading them as observations produces a track that never happened.
Corrupted decodes can produce syntactically valid but false identifiers: a registration, hex address or airport code that is one character off and resolves cleanly to a real but wrong entity.
Flight identifiers in ACARS use the operator's own convention and collide across carriers and across days; a bare flight number is not an identity and matching on it alone will merge unrelated flights.
Non-standard ARINC labels carry airline-private meanings, and interpreting them by analogy with the published label list produces confident, wrong classifications of message purpose.

None of these make the source unusable. They make it a source that requires corroboration before an assertion built on it goes into a product, which is true of every source and admitted by few.

Ageing

The message itself never goes stale – it is a dated observation and remains true as an observation. What ages is everything you attached to it. The aircraft's registration, operator and even its ICAO 24-bit address can change: registrations transfer between operators and countries, and the hex address is allocated by the state of registry, so a re-registered airframe carries a different address afterwards. An analysis built on a resolved operator name six months ago may be describing a different company today. Station metadata ages fastest of all – the receiver that gave you coverage last quarter may be gone, which quietly changes the meaning of every subsequent absence. A stale record looks like a message correctly attributed to a hex address whose resolved aircraft details no longer match reality, and it is detected by re-resolving identity at analysis time rather than trusting the enrichment captured at ingest.

What this source feeds

A source is only worth what it lets you conclude. These are the disciplines that collect through it, the mission domains it serves and the data points it yields — every one is a tag, so you can follow any thread from here into the rest of the library.

Collected by these intelligence disciplines

Serves these mission domains

Yields these data points

How each sector uses Airframes.io

The same dataset is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The records are shared — the constraints, thresholds and outputs are not.

🎖 Military and defence

For force protection and movement analysis, the value is in logistics rather than combat aviation. Charter, contractor and leased transport aircraft supporting operations use civil datalink and generate OOOI events, load messages and handling requests that reveal tempo, turnaround location and ground support arrangements. Combined with the link-type metadata, the source also functions as an RF environment survey: which datalink infrastructure is live in a theatre, on what frequencies, and what a normal traffic baseline looks like, so that a change in that baseline is legible. Use it to characterise the civil aviation datalink picture around an area of interest, and never expect it to see aircraft operating under military communications discipline.

🕵 National intelligence

The analytical strength is content plus persistence. A state or VIP aircraft that files a routine flight plan still generates dispatch and handling traffic that names ground agents, requested services and crew-entered detail. Repeated over time this yields patterns of life at a level positional data cannot reach – which handler, which stand, which fuel arrangement. For collection management, the source is also a live map of where the community's coverage is and is not, which is a prerequisite for writing an honest confidence statement. The discipline point is that this is RFINT and SIGINT-adjacent material: the legal basis for collection, retention and dissemination in your jurisdiction is a live question, not a formality, and should be settled before the collection is stood up.

👮 Law enforcement

Investigatively useful in trafficking, smuggling and sanctions-evasion work where an aircraft's operational communications reveal the handling chain around a flight. OOOI events establish times of arrival and departure with a precision that supports an operational timeline. Free-text and dispatch traffic can name a handling agent or a service request that identifies a ground-side counterparty. Two cautions dominate: the evidential status of intercepted radio traffic varies sharply by jurisdiction and may render otherwise probative material inadmissible or unlawful to hold, and the source is not a chain-of-custody instrument unless you collect it yourself with documented provenance. Treat it as a lead generator and confirm through process – registry records, airport operator records, carrier records obtained lawfully.

🔍 Private investigation and corporate security

For asset location and corporate work, this is the source that tells you an aircraft's ground handling story rather than its route. Where a subject's aircraft is serviced, by whom, and how often is often the more useful fact. It is also the practical way to detect activity by an aircraft whose positional broadcast is suppressed under a privacy programme but whose operational datalink continues. The professional constraint is that a great deal of what looks accessible is legally awkward to collect or disclose in some jurisdictions, and a client brief does not change that. Establish the lawful basis, document it, and prefer findings you can corroborate from registry and public record so the datalink material stays as corroboration rather than as the load-bearing evidence.

📰 Journalism and OSINT media

For investigative reporting on flights – deportation charters, sanctions-relevant movements, corporate jet use – this source supplies the detail that turns a track into a story: the handling arrangements, the times on and off blocks, the operational context. It also supplies a genuine verification problem you should be honest about in print, because the registration in a message is a claim by an airline system rather than an established fact. Sound practice is to use datalink material to direct reporting rather than to publish it raw, to corroborate every identity through a registry, and to describe the collection method transparently. Do not publish free-text crew messages that identify individual crew members without a clear public interest justification; the people in these messages are workers, not subjects.

🌍 NGO, humanitarian and human rights

Human rights and humanitarian monitoring uses this to document flights that would otherwise be undocumented – rendition and deportation charters, arms-related logistics, aircraft operating into embargoed destinations. The message content frequently establishes ground arrangements at an airport in a way that supports a documentation standard rather than an inference. The dominant limitation is coverage: the destinations that matter most for this work are the ones with the fewest volunteer receivers, so a negative result carries no weight and should never be presented as evidence that a flight did not occur. Pair it with HFDL, which reaches where VHF cannot, and with vessel and open-source reporting, and record the coverage caveat in the documentation itself.

🎓 University and research

Air transport researchers, communications security researchers and geographers all use this corpus, and it supports several distinct research programmes: measurement of datalink protocol use and its migration; the security posture of unauthenticated aviation communications; airline operational behaviour observable from OOOI and dispatch traffic; and the sociotechnical study of volunteer sensor networks themselves. The corpus is a convenience sample with strong spatial bias, so any quantitative claim needs an explicit coverage model, and research ethics review is warranted because the traffic includes identifiable communications by named crew. Contributing a receiver is both good practice and a way to obtain a documented, reproducible slice of the data for a specific region.

Playbook: working Airframes.io end to end

A repeatable sequence from first pull to finished product. Each phase states what you are trying to establish, not merely what to click — the objective is a defensible chain of reasoning, not a completed checklist.

Phase 1 — Decide whether this is the right sensor at all

Ask what question you are answering. If it is where an aircraft went, positional sources answer it better and more defensibly. Come here when the question is what was communicated, when an aircraft's transponder behaviour is itself the subject, or when you need to characterise the datalink environment in a region. Starting here for a routing question wastes days.

Phase 2 — Establish the collection geometry before you collect

Pull the station list and coverage view first and write down which receivers cover your area of interest and what link types they carry. This single step determines whether any negative finding you later make has meaning. Record the station set with dates, because it will change during your investigation and you need to know when it did.

Phase 3 — Anchor identity on the 24-bit address

Resolve your target to its ICAO hex address using a registry or aircraft database before you query messages, and treat registration strings and flight numbers as attributes to be matched loosely. Half the analytical errors with this source come from an analyst who searched a tail number, got results, and never checked whether the results were the same airframe.

Phase 4 — Baseline the normal message profile

Collect two to four weeks of ordinary traffic for the target or the fleet before drawing conclusions about any specific day. You are learning which labels appear, at what rate, on which links, and at what hours. Without that baseline you cannot distinguish an operationally significant message from the same message the aircraft sends on every sector.

Phase 5 — Separate observation from assertion in every record

For each message, split what the radio proved from what the text claims. The radio proved that a transmission on a frequency was received by a station at a time, and on VDL2 and HFDL that it carried a specific 24-bit address. Everything else – tail, flight number, position, times in the body – is an assertion by a system you do not control. Store the two categories differently.

Phase 6 — Reassemble and read the bodies properly

Group fragments into whole messages before reading. Then triage the text: human-readable operational traffic, structured airline formats you can partially interpret, and opaque binary-in-ASCII you should leave alone. Resist the temptation to interpret the opaque category by pattern-matching; confident misreadings of proprietary formats are a recurring failure in published work using this source.

Phase 7 — Correlate against the positional picture

Join the message stream to ADS-B tracks for the same address and the same window. Agreement raises confidence in both. Disagreement is a finding in itself and usually means one of three things: a clock offset, a message about a different aircraft, or an aircraft whose positional broadcast is suppressed while its datalink continues.

Phase 8 — Test the negative deliberately

When your conclusion depends on an aircraft not having done something, prove that you would have seen it if it had. Show that a covering station was live and healthy, that it was receiving other traffic in the same window, and that the link type in question was being decoded. If you cannot show all three, downgrade the finding to unknown and say so.

Phase 9 — Exploit the link-type metadata as its own intelligence

Which links an aircraft or a route uses, and when that changes, tells you about infrastructure and operator behaviour rather than about a single flight. A fleet shifting from HFDL to satellite, or a region's VDL2 ground infrastructure appearing in the data for the first time, is a structural observation with a longer shelf life than any individual message.

Phase 10 — Corroborate off-source before you commit

Take every load-bearing identity to an independent authority – a national registry, an operator's own published fleet, an aircraft database, sanctions and ownership records. Take every load-bearing time to an independent clock. The point is not distrust of the decoder; it is that a case built on a single unauthenticated broadcast channel has one point of failure.

Phase 11 — Assess what your own collection reveals

Decide whether querying, feeding or publishing exposes your interest. Your query pattern is visible to the aggregator; a receiver you operate is visible in the public station list along with its approximate location. If either matters, plan for it – use a neutral network path, avoid distinctive query patterns, and think carefully before contributing a station from a sensitive location.

Phase 12 — Package with the caveats attached

Write the finished product so the coverage model travels with the conclusion. State which stations were listening, which links were decoded, what the retention situation is, and what the legal basis for collection was. A datalink finding without that context will be misread by the next analyst as a complete picture, and the error will be yours.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

What to pair it with

No single source carries a finding. These are the datasets that corroborate, extend or contradict this one — and a source that contradicts is worth more than one that agrees, because it is the only thing that will tell you when you are wrong.

Source	Relationship	What it adds
OpenSky Network	corroborates	Independent positional observation of the same 24-bit address, from a different sensor network with a different coverage footprint. The primary cross-check for any datalink finding.
adsbdb	extends	Resolves the hex address or registration in a message to aircraft type, operator and registered owner, and callsigns to a probable route.
hexdb.io	extends	Second, independently maintained resolution path for hex to registration and type, useful precisely because it disagrees with adsbdb often enough to be informative.
National aircraft registries	prerequisite	The authoritative record of registration, type and owner. Datalink material should never be the last word on identity when a registry is available.
NOAA Aviation Weather Center	corroborates	Weather-related ACARS traffic and diversion messages make sense only against the actual conditions; METAR and SIGMET data explain a large share of anomalous operational messages.
OpenSanctions	extends	Screens resolved operators, owners and handling counterparties against sanctions and PEP data, which is where an aviation logistics finding becomes a compliance or enforcement finding.
Open-source decoder projects	prerequisite	The decoders that produce this data – the VDL2, HFDL and ACARS toolchains – are also how you build your own first-party collection with provenance you control.

Legal, ethical and operational constraints

Two separate legal questions apply and they have different answers. The first is whether you may receive and record these transmissions. Aviation datalink is unencrypted, but unencrypted does not mean unprotected: several jurisdictions criminalise the reception, and more commonly the disclosure or use, of radio transmissions not intended for general reception, and aviation operational traffic is not a general reception service. In the United Kingdom the wireless telegraphy regime is the standard citation; other European states have analogous provisions; the position in the United States and elsewhere differs again. The second question is whether the content, once held, is personal data. Crew free-text names individuals, and in most data-protection regimes that makes a stored corpus of such messages personal data requiring a lawful basis, a retention limit and a purpose test. Add to both a proportionality assessment: this is communications content, and the fact that it is technically accessible does not make its collection proportionate to a routine inquiry. Get a written legal position before standing up collection, revisit it if you cross borders, and never disclose message content identifying crew members without a specific justification you would defend in public.

Operational security

Consuming this source is a network transaction against a small community service, and your queries are visible in its logs: source address, timing, and the specific aircraft addresses or registrations you asked about. A pattern of queries against one airframe is a legible statement of interest to anyone with access to those logs. If your interest in a target is itself sensitive, route requests through infrastructure not attributable to your organisation, avoid distinctive query cadences, and consider pulling broader slices and filtering locally rather than querying narrowly. Feeding is a stronger exposure: a contributed station appears in the public station list with an approximate location, so a receiver stood up near a sensitive site announces both the capability and the interest. Running your own unlisted receiver purely for local decode avoids both problems and gives better provenance, at the cost of the aggregate coverage you would otherwise consume.

Two rules that hold regardless of jurisdiction. Collection that is lawful is not automatically proportionate, and a dataset assembled for one purpose does not carry consent for another. Where the records concern identifiable people, the question is not only whether you may hold the data but whether holding it serves the purpose you are accountable for.

Is it earning its place?

Sources accumulate. Feeds get added during an incident and are never reviewed again, and a decade later the pipeline is carrying dead weight that nobody dares remove. These are the measures that show whether Airframes.io is contributing anything, and they are worth baselining now so the answer is available later.

Messages retrieved per target aircraft per week, tracked over time – a decline usually means a station went offline rather than that the aircraft stopped flying, and distinguishing the two is the point of the metric.
Proportion of retrieved records carrying a 24-bit ICAO address, which measures how much of your collection can be identity-anchored rather than merely tail-labelled.
Correlation rate between datalink records and independent positional tracks for the same address and window, as a direct measure of whether the two sensor networks agree.
Count of live covering stations for each area of interest, sampled weekly, so that changes in your own collection capability are recorded rather than discovered later.
Share of retrieved messages that are opaque proprietary formats versus interpretable traffic, which tells you honestly how much of the volume is actually usable.
Number of findings where a datalink record supplied a fact that no other source in the case supplied – the only metric that answers whether this source is earning its place.
Rate at which identity resolution from a message body was later contradicted by a registry check, tracked as an analytical error rate rather than a source error rate.

Beware of volume. Indicator counts rise easily and say almost nothing. Unique contribution — findings this source produced that no other source in your stack would have — is the measure that matters, and it is usually far lower than anyone expects.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Read the link type before you read the message. VHF ACARS, VDL Mode 2, HFDL and satellite AERO have different identity fields, different ranges and different failure modes, and an analyst who treats them as one stream will make range and coverage assumptions that are wrong by an order of magnitude.
The 24-bit address is the identity; the tail string is a label. Registration is entered by the operator's system and changes when the airframe is re-registered, and the hex address changes then too. Reconcile both and record which one your conclusion rests on.
A message about an aircraft is not a message from an aircraft. Dispatch and fleet traffic routinely names other airframes, and mining bodies for registrations without checking the transmitter is one of the most common ways published analyses go wrong.
Treat times in message bodies as planned unless proven otherwise. Estimated times over waypoints and scheduled block times look exactly like observations and are not.
Absence of traffic is a statement about receivers, not aircraft. Never let a negative finding leave your desk without an accompanying demonstration that a covering station was live and healthy in the window.
De-duplicate before you count anything. Multi-station reception makes activity look highest where receiver density is highest, which is a map of hobbyists rather than a map of aviation.
Non-standard labels are private semantics. If a label is not in the published set, say you do not know what it means rather than inferring from an adjacent code; the inference will be plausible and unverifiable.
Store the raw frame alongside your interpretation. Decoders change, your understanding changes, and a case that retained only the parsed fields cannot be re-examined when either does.
Decide the legal position before the technical one. This is the source in the aviation catalogue most likely to be lawful to browse and unlawful for your organisation to collect at scale, and discovering that after building the pipeline is expensive.

Questions analysts actually ask

Can I see military aircraft here?

Some, and not the ones you probably want. Aircraft operating in the civil system – transports, tankers, VIP and government fleets, contracted charters – use civil datalink and appear. Aircraft operating under military communications discipline use military systems and do not. Treat this as a source on aviation logistics rather than on air operations.

Is ACARS encrypted?

Overwhelmingly no. The links carry operational traffic in the clear, which is a long-standing and well-documented security problem in civil aviation rather than a discovery. A minority of operators apply their own message-level protection, and some proprietary formats are opaque without being cryptographically protected – opacity is not encryption and should not be described as such.

Why do I see an aircraft here that is not on any tracking site?

Usually because the two channels are administered separately. Positional broadcast can be suppressed under a privacy programme, or the aircraft may be outside ADS-B receiver coverage while an HFDL ground station still hears it. Occasionally it is the reverse of the interesting case: a stale registration in the airline's system naming an aircraft that is not the one transmitting.

How far back can I query?

Do not plan around retrospective access. The service is built around a live stream, retention is a maintenance decision rather than a commitment, and any historical query surface may change. If your work needs an archive, build one from the moment collection starts and store the retrieval time next to the station time.

Is it legal for me to use this?

It depends on your jurisdiction and it is genuinely not a formality. Some countries criminalise the reception or disclosure of radio traffic not intended for the public, irrespective of encryption. Separately, message content naming crew is personal data in most data-protection regimes. Get a written position covering both before you build anything on it.

How accurate are the positions in these messages?

Position reports carried in ADS-C contracts are aircraft-derived and generally good. Positions appearing in free text are frequently estimates for a future waypoint. The two look similar in a text field and mean entirely different things, so classify the message type before you plot anything.

Should I run my own receiver instead of using the API?

For anything with evidential or operational weight, yes, and use the aggregate as well. A local receiver gives you provenance, timing you control and independence from someone else's uptime. The aggregate gives you coverage you cannot replicate. The two together are the professional configuration; either alone has a structural weakness.

Can I identify a specific person from this data?

Sometimes, and that is precisely why the ethical and legal handling matters. Crew free-text can name individuals and reveal their working patterns. Unless your investigation is specifically about those individuals and you have a lawful basis, treat personal content as incidental collection: minimise it, do not disseminate it, and do not publish it.

Why does the same flight appear with two different flight numbers?

Because ACARS carries the operator's own identifier while ADS-B carries the ICAO callsign, and codeshares add a third. Normalise the formats explicitly rather than assuming a mismatch means two flights, and never join datasets on a bare flight number.

Standards, formats and interoperability

What this source speaks natively, and what it has to be translated into before a partner can consume it. Work that arrives in a recognised format is easier to defend, easier to hand over and easier to automate against:

ARINC 618 and ARINC 620 define the air-ground ACARS protocol and the message label set, which is why the label field is interpretable at all and why airline extensions to it are not.
ICAO Annex 10 covers aeronautical telecommunications, including the datalink services and the allocation of 24-bit aircraft addresses by state of registry.
VDL Mode 2 carries ACARS over a digital VHF link using AVLC framing; understanding this is what tells you that a VDL2 record has a hex address and a plain ACARS record may not.
HFDL is a single-provider global service with a small number of ground stations, so the frequency in a record maps to a ground station and therefore to a region.
ADS-C is a contract-based position reporting service carried over datalink rather than broadcast, which is why its positions are ATC-grade while free-text positions are not.
CPDLC carries controller-pilot clearances over the same links, and its presence in a record indicates air traffic control interaction rather than airline operational traffic.
The platform exports derived indicators and entities in STIX 2.1, MISP, CSV, JSON and JSONL, so datalink-derived aircraft entities travel into the same case structures as any other observable.

References

Primary documentation and authoritative references for this source. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Airframes.io — Airframes.io community. The service itself: live feed, station list and coverage view. Start here to see whether the links and regions you need are currently being received.
Airframes.io source repositories — Airframes.io community. The authoritative statement of what the ingest and API actually do. Read this rather than trusting any secondhand endpoint documentation.
dumpvdl2 — szpajder. The VDL Mode 2 decoder most feeders run. Its documentation is the clearest available explanation of what fields a VDL2 record can and cannot contain.
dumphfdl — szpajder. HFDL decoder. Useful for understanding ground station structure and why HFDL coverage behaves so differently from VHF links.
acarsdec — TLeconte. The VHF ACARS decoder. Reading its output format is the fastest way to learn which fields are radio-derived and which are airline-asserted.
JAERO — Jonti Olds. Decoder for Inmarsat Classic Aero satellite datalink, the route by which oceanic and remote traffic enters the corpus.
International Civil Aviation Organization — ICAO. The standards authority for aeronautical telecommunications and aircraft addressing. The reference point for what these links are supposed to do.
OpenSky Network — OpenSky Network Association. The positional counterpart used for correlation, and a useful contrast in how a research-governed sensor network differs from a hobbyist one.
RTL-SDR — RTL-SDR.com. Practical reference for the receiver hardware and antenna work involved in standing up your own first-party collection.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this source: it registers the datalink stream as a first-class source, anchors every message to a 24-bit aircraft address, correlates it against independent positional tracks, and carries the coverage caveat through to the finished report.. Browse the full source catalogue, or follow any tag above into the rest of the library.