What is the way to capture / sniff communication traffic from RC toy radio to receiver ?

[shafr]

Is it possible to capture 2.4G communication without expensive specialized hardware ?

I've tried everything that I had found lying around in my flat, but was not able to observe communication between purchased toy radio & drone:

• Arduino + nRF24L01 module (using different sketches)
• TP-LINK TL-WN722N ( I used to use it for promiscous capture of WIFI traffic, not sure if it would even with non- 802.11 packets)
• Texas Instruments CC2531 (with special sniff firmware installed, zigbee + raw capture)

Can I use some script (aside from Spectrum Analyzer built-in the multi-protocol Radio) that would help ?
Or buy some hardware that I can use moving ahead for the future?
Or at least can I somehow narrow down the search when trying to bind radio ?

[shafr]

This feature probably:
https://github.com/pascallanger/DIY-Multiprotocol-TX-Module/blob/master/docs/Advanced_Topics.md#xn297l-dump-feature

[pascallanger]

Which chip do you have on the TX/RX ?

You need to scan most likely 1Mb and 250Kb traffic on all channels. The nrf can scan on both bitrates, you need to disable the CRC check, set the address bytes number to 0, load either 0x5555555555 or 0xAAAAAAAAAA in the RX address. You'll receive a lot of garbage but if you find the right bitrate and frequency you'll start to see replicating patterns of at least 8 bytes.

[shafr]

Thanks Pacal.

Would it help if I would make it work:
http://yveaux.blogspot.com/2014/07/nrf24l01-sniffer-part-2.html

I'm not sure if it would help much if I would be able to capture traffic in Wireshark, and possibly blacklisting anything that is not related to the communication.

Related bulit-in radio, that's what is in Jumper T-Pro JP4IN1