A widespread high pressure system settled down over Europe in the middle of October 2017. It brought a summer-like weather to Poland with temperatures as high as 26°C measured in Wrocław. Excellent weather conditions, so called a Polish golden autumn, continued for several days. When the atmospheric pressure started to decrease again, the wind had also weakened. This provided favorable circumstances for temperature inversions and tropospheric ducting on VHF, UHF and microwave radio bands. 

I’ve been observing propagation conditions on the WLAN frequencies for many years. The 5 GHz band is very crowded in Poland, as it is widely used by the ISPs (Internet Service Providers) with outdoor devices. The antennas are installed frequently on tall buildings like chimneys, blocks of flats or lattice masts. In autumn of 2015 I have detected some networks from Southern Poland and Czech Republic at distances over 300 km. I also fixed my personal reception record at 346.5 km, but it was just a single received packet I think. Since then I have started saving money for a taller mast, because the antenna (8 m AGL) was looking mostly at trees that greatly attenuate all microwave signals.

At the beginning of October I finally finished a new 18 meter mast with a 75 cm parabolic dish for the 5 GHz band. Ubiquiti RocketDish 5G31-AC is a dual polarization antenna for 5.1-5.8 GHz band with 31 dBi gain. It is connected to MikroTik Routerboard RB912UAG-5HPnD 2×2 MIMO radio behind the dish in a custom aluminium box. The mast is equipped with a rotator and everything can be remotely controlled. The view at this height is now unobstructed in almost all directions at low elevation angles (1-2°, locally 0.5° or better). My antenna is located near Płock in Central Poland.


The conditions in the first half of October were very unsuccessful for any tests of my new antenna and mast. Fortunately, that all changed after next two weeks, when the weather had improved. All forecasts were full of colorful shades over Poland, but the best conditions occurred one and two days after the predicted peak.

It started in the evening of October 17, 2017. The weather was really great that day. I came back home after a bike ride just at the twilight. The tropospheric propagation was already in a development at 17 UTC. It produced some signals out of the line of sight, like Kutno, Sochaczew (50 km), Łódź, Zgierz or Koluszki (80-90 km). The wind gusts were noticeable (3-4 m/s).

Around 18:30 UTC the first distance milestone was reached with a network TomNeT_dos-Lesna. I have already seen it together with Czech signals before (see this post), so I sticked to this direction. Other names indicated mostly Częstochowa (200 km) and neighborhoods, but some single networks also exceeded 250 km, like zbroslawice14_AC (identification via Wigle).

Shortly the first Czech network appeared, FCZ JBS with a radio name Janovice SXT SA. I found Janovice at a distance of around 340 km, exactly within my antenna’s azimuth. I also logged FCZ HaSe, but the location is unknown.

The signal levels of closer networks (100-200 km) were peaking at -70s dBm and the ducting area was slowly extending from an azimuth of 200° to 220° and 170°. I logged more distant signals like PTP-TEST01 (neighbourhood of Cieszyn, 320 km), a network with a hidden SSID and radio name W_TY_TYTY_L (Třinec, Czech Republic, 330 km), ANFA-LMDS-CZA2-U_N (Czantoria mountain, 330 km). My antenna was rotating automatically almost all the time between two defined azimuths, as the following video presents.

Around 19:30 UTC the wind completely stopped (0 m/s!), but just for a while. As it intensified again, I noticed another wave of the signals carried by a tropospherc duct. The path to Wieluń extended to Opole (250 km) and I noticed very strong signals within it, including -62 dBm from a network Chojny (Biała-Chojny 10) at approx. 160-170 km. The ducting area was expanding towards the east (Końskie, Przysucha, Radom), as the forecasts  predicted. I noticed other Czech networks, like chotnet9louky (radio name smer Louky). The distance to Louky village is 320 km

All signals from the southern directions disappeared at night, but another ducting path opened towards the west, up to 150 km. I left my rotator in a radar mode and I went to sleep.

October 17/18, 2017 – the farthest tropospheric ducting logs:

BSSID SSID Radio name Peak Approximate location [km]
4C:5E:0C:A8:1F:CA FCZ HaSe 4C5E0CA81FCA -87 Čeladná, Czechia 352
00:05:BF:CA:63:FA FCZ JBS Janovice SXT SA -89 Janovice, Czechia 343
4C:5E:0C:66:CC:4B   W_TY_TYTY_L -89 Třinec, Czechia 332
4C:5E:0C:D4:13:94 ANFA-LMDS-CZA2-U_N ANFA-LMDS-CZA2-U_ -84 Czantoria Wielka? 330
00:04:56:CE:8A:EC PTP-TEST01   -84 Cieszyn 324
44:D9:E7:D8:D3:A5 chotnet9louky smer Louky -87 Louky, Czechia? 320
E4:8D:8C:F7:C6:75 websoftsmermik1 Chlum-Kolnovice -87 Kolnovice? 300
E4:8D:8C:F2:D7:07 websoftsmermik Chlum smer Sirok -89
DC:9F:DB:84:97:7C SYSTEM-g01 NanoBridge M5 -91 Pawłowice/Warszewice 300
E4:8D:8C:D2:4D:17 minier APtower>havirska -87 Czechia?
E4:8D:8C:B5:68:C1 ANFA-LMDS-CHY3_V E48D8CB568C1 -85

In the morning another inversion layer developed, bringing networks from the north-western directions. Interestingly, the wind gusts were weak throughout all day and the tropo continued. My antenna was still rotating and *hundreds* of networks were logged, mostly at 100-200 km distances. I did not follow the logs in real time. It was also impossible to automatically check all the coming signals, as this would exceed the daily Wigle query limit very quickly. 


However, I was observing one of the strongest tropo openings on the VHF 87.5-108 MHz band from Germany that day. At around midday I also heard several signals from The Netherlands (91.8 & 94.8 Smilde and 89.1 & 97.5 Groningen). The broadcast stations were overriding my semi-local ones (like 98.1 NDR 2 Aurich at 825 km mixing with PR 2 Sierpc at 35 km on the same frequency). As the time was passing, the path shortened (Schiffdorf, Heide, Hamburg with surroundings, Bungsberg, Schwerin, Helpterberg and finally Szczecin at night). I logged lots of low power stations for the first time ever (Schleswig, Itzehoe, Rendsburg, Lübeck, Güstrow). I also checked the reception with a small portable radio with a telescopic antenna instead of hi-gain Yagi antennas. As a result I easily received Antenne MV 101.3 (Schwerin 565 km) in stereo and RDS next to my local station 101.2 TOK FM (<10 km).

In the evening, after a warm and sunny day, another inversion layer was in development just above the ground level. It brought some closer Wi-Fi networks (30-50+ km) from all directions with very strong signal levels, even up to -60 dBm. The network lists were flooded with almost 100 active entries. The wind gusts intensified later from 1 to 5 m/s. All (semi-)local signals faded away and I logged many networks from the western directions at distances over 200 km (Poznań, Grodzisk Wielkopolski). Anyway, as I have already mentioned, I was focusing mostly on the VHF band that day.

I was about to sleep at 23:30 UTC, but I decided to check some signals that survived the increased wind gusts (usually the farthest networks appear then). I noticed pogodna.net_zal-lub_mpt3 and IPECQRT networks at an azimuth of 290°. The first one is probably Załachowo or Lubostroń just at 130 km distance. I checked the Wigle database for the second one and as a result I got the coordinates to Police town, near Szczecin in northwestern Poland. I measured 365 km to this point. Well… the address 4C:5E:0C:81:10:38, name IPECQRT and azimuth – they all matched Wigle result. Moreover, this network was already seen for the first time at 18:40 UTC – five hours earlier…! 

This network was not encrypted, so I quickly tried to connect. Finally, after the fourth attempt… the connection was established. The signal level was not so bad at all, initially around -89 dBm per polarization or -86 dBm in total. Shortly I also logged link-chociwiel to which I measured around 310 km. Link with IPECQRT continued with some occasional breaks. I recorded a video with a full bandscan of the 87.5-108 MHz broadcast band in parallel to the 5 GHz link status window. The signal level on the other end was being reported in real time.

Because of the dynamic 802.11 ACK frame timeout configuration, the distance was wrongly reported by MikroTik RouterOS software. I have already seen such behavior on shorter links (for example – 135 km distance reported as just 20 km). I think that recurring retransmissions already take place, but the second side of the link acknowledges actually one of the first packets. The distance algorithm was definitely not designed for such long range links. Wrong ACK timing has also an imprint on the CCQ (quality indicator) and bitrate, which keeps dropping to the lowest modulation possible (BPSK – 6 Mbps). Unfortunately, I had no access to the second side of the link, so I could not change this parameter simultaneously on both ends.

The peak of the IPECQRT tropospheric ducting signal occurred on October 19th at 00:50 UTC (or 02:50 local time). The following video shows -78 dBm signal level during scanning at the very beginning and another peak of 79/-79 dBm after establishing the connection again. One can also watch the signal fluctuations over time. The maximum link rate reached 28.8 Mbps (802.11an MCS 9, 20 MHz, QPSK, FEC 1/2, short guard interval, two parallel streams), however the packet traffic was very low and, as I already mentioned, the ACK timeout was wrong on both sides.

Please note that the noise floor and signal to noise ratio is also wrongly reported by MikroTik RouterOS software. It is physically impossible to have a noise floor of -100 dBm or better on a 20 MHz channel (keep in mind the thermal noise equation and receiver noise figure).

IPECQRT was last seen at 1:18 UTC. As it was very late, I quickly went to sleep. Of course I left the antenna at a fixed azimuth for an overnight scanning, but the signal did not return. In the early morning pogodna.net_zal-lub_mpt3 was logged again, but just at 1/3 of that distance. The tropospheric ducting forecasts did not predict such good conditions on October 18/19 evening and night, there was just a small and marginal spot over Szczecin though (see the forecast maps at the end of the article).

October 18/19, 2017 – the farthest tropospheric ducting logs:

BSSID SSID Radio name Peak Approximate location [km]
4C:5E:0C:81:10:38 IPECQRT 4C5E0C811038 -78 Police 365
DC:9F:DB:44:73:FA Derczewo sitno-derczewo -86 Sitno/Derczewo 333
00:0E:8E:30:B5:B9 maszewo.net-skl falcon -87 Maszewo 330
00:0B:6B:80:91:86   2KO4NP:gg:610109 -87 Nowogródek Pomorski 321
E4:8D:8C:F6:B8:81 link-chociwel E48D8CF6B881 -89 Chociwel? 312

In total, I logged over 3000 WLAN networks between October 17 and 19 via tropospheric ducting propagation mode. It is certainly a merit of my new mast and antenna over nearby trees. I have already merged this log with my cumulative list of received networks: https://wifi.fmdx.pl/

I wrote a script that fetches a detailed info about each network from the Wigle database. Due to the daily query limit, it took a week to complete and 1278 out of 3396 networks were identified. I applied some constraints on the results though. Some dual-band WLAN radios were used in the past on the 2.4 GHz band instead, so I ignored these reports. I also limited all results to the networks that match reception azimuth within ±5°. Then I generated a map, which contains 1226 networks (36%). The longest path has been marked with a blue line, this is the IPECQRT network.

(click for an interactive map)

What about an exact location of the IPECQRT network?

Unfortunately, I don’t know the exact the location of this network. I have asked about it on the biggest ISP forum in Poland, but so far I have got no answers at all, so… I did some research on my own.

At the beginning I noticed I-PEC-QRT substrings in the name of this network, where PEC may stand for Przedsiębiorstwo Energetyki Cieplnej (eng. Heating Company or something like that). However, the PEC chimney in Police town is located more southwards than place indicated by Wigle. Anyway, I have seen many networks located on PEC chimneys before, so I decided to check that further. I took all signal samples from Wigle database and I generated the following map.

I checked these points on Google Street View. There is no line of sight to PEC chimney, so it can be safely rejected as a possible network location. I found other chimneys there, actually lots of them. The SSID should be probably considered as IP-EC-QRT then, where EC indicates elektrociepłownia (eng. thermal power plant) and IP is very likely a short for IPartner, the local ISP. In Wigle maps I also noticed another network with the same prefix in the neighborhood, IPEC-N5M.

The distance to each chimney varies between 365 and 366 km. The antenna installation height is unknown, but seems to be pretty high. The distance from Płock to Police town near Szczecin along the roads is almost 900 km back and forth, so I will not be able to check that on my own, at least in the near future.

What about an antenna and WLAN radio of the IPECQRT network?

This was definitely a MikroTik 2×2 MIMO radio with RouterOS version 6.38.3. The exact equipment is unknown, however the name IPECQRT suggests Mikrotik Routerboard QRT 5 panel antenna rated at 24 dBi with an integrated radio module.

I own a pair of these antennas and I found an insignificant clue. QRT has a vertical polarization connected to the first chain (Ch0 – V) and a horizontal to the second one (Ch1 – H). My RocketDish has them connected in an opposite manner (Ch0 – H, Ch1 – V). As one can see on the videos above, the TX/RX signals were inconsistent on each chain, but consistent across them.

Measurements and forecasts

This is a direction to IPECQRT network, as seen from my antenna’s installation height (114 m ASL + 18 m AGL). The line of sight ends at a distance of 800 meters, where the trees start.


Temperature and wind gusts in Płock, Poland (monitor.pogodynka.pl).


Atmospheric sounding from Greifswald, Germany near town Police, Poland performed during reception of the IPECQRT network. Both ground level and elevated ducts are well visible (weather.uwyo.edu).


William Hepburn’s Tropospheric Ducting Forecast (dxinfocentre.com) and mean sea level pressure (weatheronline.co.uk).

  1. Roman K. 05-11-2017 17:25


    FCZ JBS and FCZ HaSe is from my work. I am network specialist in this company. AP is realy in Czech Republic. City Janovice (JBS) and city Čeladná (HaSe).

    When you have interest, align antenna on signal level min. -60 and i sell my connectivity from 50 Zl :-)

    Have nice day


  2. Darek SQ7HJE 09-11-2017 08:30

    Hello WiFi hunter !
    You have very intresting hobby – I don’t know anybody who ma the same interestings (I mean 5 GHz hunting). Can you tell more about your radio shack (hardware / software) ?
    Regards from Darek SQ7HJE

  3. felixmateer 08-12-2017 10:52


  4. Very interesting post. I hear first time about establishing wifi connection over tropo duct :) Congratulations :) You mentioned that impossible is to get -100 noise floor on 20MHz channel width. I’m using Cisco access point in home, which reporting least noise floor on -99dBm on 20MHz channel width, and -96dBm on 40MHz channel width. But I don’t use it with external antenna.

    • Thanks, Jan. I think I should clarify that a bit more. The total noise figure depends on the RF input path. In a typical WLAN module it consists of a RX/TX switch, band pass filter (both with some insertion loss) and a low noise amplifier rated at some noise figure.

      The thermal noise at a room temperature (20 °C) for a 20 MHz channel can be calculated as follows: -174 dBm/Hz + 10*log10(20 000 000 Hz) = -101 dBm @ 20 MHz

      However, the OFDM channel is actually a bit narrower in order to reduce the overlap between adjacent channels: -174 dBm/Hz + 10*log10(16 250 000 Hz) = -101.9 dBm @ 16.25 MHz

      As you can see, anything below -101…-102 dBm is an incorrect value. Taking into account the receiver noise figure, the noise floor better than -100 dBm should be generally considered as incorrect.

      With noise floor reported at -99 dBm, the RF module should be rated at 2-3 dB of total noise figure and this is of course possible using good RF ICs. However, it might be not valid for a cheap consumer-grade equipment, especially on the 5 GHz band.

      One more important thing – I don’t know anything about signal calibration of the WLAN modules.

Add a comment / Dodaj komentarz:

Post Navigation