Installing Rayhunter on Orbic RC400L: A Windows User's Journey

What is Rayhunter?

Rayhunter is an open-source project by the Electronic Frontier Foundation (EFF) that transforms inexpensive mobile hotspots into IMSI catcher detectors. IMSI catchers (also known as "Stingrays" or cell-site simulators) are surveillance devices that mimic cell towers to intercept mobile device communications. With Rayhunter, everyday citizens can detect and document the use of these invasive surveillance technologies in their communities.

The Device: Orbic Speed RC400L

The Orbic RC400L is a budget-friendly LTE mobile hotspot (around $20-30) that serves as the perfect platform for Rayhunter. Once installed, the device:

• Continuously monitors for potential IMSI catchers
• Stores detection logs locally
• Functions as a normal mobile hotspot
• Operates completely standalone

My Installation Journey: The Windows Struggle

Like many users, I started with the recommended network installer on Windows. Spoiler alert: it didn't go smoothly.

Initial Setup

I downloaded Rayhunter v0.9.0 for Windows x86_64 and found my Orbic's admin password (the 8-character WiFi password visible on the device screen). The documentation said it should be straightforward:

./installer orbic --admin-password '530d9e54'

The Error Wall

Instead of success, I hit this error repeatedly:

Logging in and starting telnet...
Failed to install rayhunter on the Orbic RC400L

Caused by:
    0: failed to start telnet
    1: error sending request
    2: client error (SendRequest)
    3: connection closed before message completed

Troubleshooting Attempts

I tried everything the documentation suggested:

1. Enabling Telnet in the Web UI

• Navigated to http://192.168.1.1
• Went to Features → Port Filter → TELNET
• Enabled telnet access
• Result: Still no connection

2. Disabling the Firewall

• Features → Firewall → Disabled
• Result: Port 23 still refused connections

3. Testing Connectivity

Test-NetConnection -ComputerName 192.168.1.1 -Port 23
# Result: TcpTestSucceeded : False

telnet 192.168.1.1
# Result: Could not open connection to the host, on port 23: Connect failed

The device was pingable, but all TCP ports (22, 23, 24, 25) were closed. The network installer simply couldn't establish the telnet connection needed to install Rayhunter.

The USB Installer Warning

I briefly considered the USB installer (./installer orbic-usb), but the warning message was terrifying:

WARNING: The orbic USB installer is not recommended for most usecases.

WINDOWS IS NOT FULLY SUPPORTED
THIS MAY BRICK YOUR DEVICE
PLEASE INSTALL FROM MACOS OR LINUX INSTEAD IF POSSIBLE

That was a hard pass.

The Solution: Linux VM to the Rescue

The breakthrough came when I remembered I had a Linux VirtualBox VM. Here's what worked:

Step 1: Network Configuration

The key was configuring VirtualBox to use Bridged Adapter networking instead of NAT:

1. Opened VirtualBox settings for my Linux VM
2. Went to Network → Adapter 1
3. Changed "Attached to:" from NAT to Bridged Adapter
4. Selected my WiFi adapter from the dropdown
5. Started the VM

Step 2: Connect to Orbic WiFi

On my Windows host machine:

1. Connected to the Orbic's WiFi network (SSID visible on device screen)
2. Entered the 8-character WiFi password

The Linux VM automatically inherited this connection through the bridged adapter.

Step 3: Verify Connectivity

In the Linux VM:

ping 192.168.1.1
# Success! 0% packet loss

curl http://192.168.1.1
# Success! Got the Orbic admin page HTML

Step 4: Run the Installer

Downloaded the Linux version of Rayhunter and ran:

cd ~/Downloads/rayhunter-v0.9.0-linux-x86_64
./installer orbic --admin-password '530d9e54'

Total installation time: About 3-5 minutes.

Verification

After installation, I could access the Rayhunter web interface at http://192.168.1.1:8080/

The interface showed:

• ✅ Rayhunter version 0.9.0 running
• ✅ Active recording in progress
• ✅ 0 warnings (green status)
• ✅ System information (battery, storage, memory)
• ✅ Configuration options

The Orbic's screen displayed a green line at the top, indicating Rayhunter was actively monitoring for IMSI catchers.

How to Use Rayhunter

Daily Operation

Rayhunter operates completely standalone:

• Powers on automatically when the Orbic is turned on
• Monitors continuously without any phone/computer connected
• Stores recordings locally on the device
• The display shows status (green = normal, red = detection)

Checking for Detections

Connect your phone or computer to the Orbic's WiFi and visit http://192.168.1.1:8080/ to:

• View current recording status
• Check for warnings (informational, low, medium, high)
• Download recordings (pcap, qmdl, or zip format)
• Configure analyzer settings

Warning Levels

• Informational (blue): No action needed
• Low (yellow): Probably nothing suspicious
• Medium (orange): Possible suspicious activity
• High (red): Strong indicator of IMSI catcher

Testing Your Installation

Enable the "Test Heuristic" in Configuration settings to verify Rayhunter is working. This will trigger an alert for every cell tower you see (very noisy, so turn it off after testing).

Reporting Detections

If you detect a potential IMSI catcher, the EFF encourages you to report it:

1. Download the recording as a zip file
2. Send it via Signal to: ElectronicFrontierFoundation.90
3. Include: date, location, device model, Rayhunter version

Lessons Learned

Why Windows Failed

The Windows network installer has known reliability issues:

• Difficulty establishing telnet connections to the Orbic
• Connection errors even with firewall disabled
• Multiple GitHub issues document these problems (#716, #693, #764)

The EFF documentation acknowledges "Windows support in Rayhunter's installer is a work-in-progress."

Why Linux VM Worked

Using a Linux VM with bridged networking bypassed all Windows-specific issues:

• The Linux installer is more mature and reliable
• Bridged networking allows the VM to communicate directly with the Orbic
• No USB passthrough complexity needed (which is finicky in VirtualBox)

Alternative Solutions

If you don't have a Linux VM, other options include:

• Windows Subsystem for Linux (WSL) with USBIPD-WIN
• Linux live USB boot (no permanent installation needed)
• Borrow a Mac or Linux machine for the 5-minute installation
• USB installer (orbic-usb) as absolute last resort (high brick risk on Windows)

Conclusion

Rayhunter is an important tool for privacy-conscious individuals and community activists who want to detect surveillance technologies in their neighborhoods. While the Windows installation process has rough edges, the Linux VM workaround makes it accessible to Windows users without requiring a full operating system change.

Once installed, Rayhunter operates seamlessly as a standalone device. It's like having a dashcam for cellular surveillance—continuously monitoring, recording when needed, and providing peace of mind.