TL;DR: it is 2.4 GHz but it is not Wi-Fi, so no Wi-Fi card will ever decode it. Identify the radio chip first, then buy the matching ~€2 transceiver — the same chip both sniffs and transmits, which is exactly what you need for replay. Only fall back to an SDR if the chip turns out to be genuinely unknown. Do not buy an RTL-SDR for this.
Monitor mode captures raw 802.11 frames; promiscuous mode just hands every L2 frame to the OS. Both only understand the Wi-Fi MAC/PHY. A remote using GFSK/OOK with a proprietary packet format is not an 802.11 frame, so the card never produces anything decodable. Same band is not the same protocol.
Worth ruling out first: if it were infrared it would need line of sight, and an IR emitter shows up as a purple glow through a phone camera. The previous comment claiming "most likely infrared" is wrong for a remote that works through walls.
Also: the common RTL-SDR dongles (R820T2, and the R828D in the Blog V4) top out at about 1.766 GHz, below the 2.4 GHz band, so they are blind to it without a downconverter.
Open the remote, read the IC markings and crystal, photograph the board.
Look the device up by FCC ID on fcc.gov (equipment authorization filings include internal photos and block diagrams). Cheap imports usually still carry one.
Realistic 2.4 GHz remote radios: Nordic nRF24L01+ / nRF24LU1+, TI CC2500 / CC2531, Beken BK2421 / BK2425, Amiccom A7105, and the common clones Si24R1, XN297, and the LT8900 / LT8910 / LT8920 family. Most LED-strip remotes are one of these, and once you know the chip the packet format is usually in the datasheet.
An nRF24L01+ module costs about €1–3 and pairs with an ESP32, Arduino or Pico. Scan RSSI across channels to find the active one (the register default address is E7E7E7E7E7, and channel 76 / 2476 MHz is the common library default), then run a sniffer.
One honest caveat people repeat wrongly: the nRF24L01+ does not have true promiscuous reception. You must know the channel, and you only need the upper two bytes of the address, because sniffer firmware turns off the module's internal packet/CRC and retransmit handling. Useful starting points:
https://github.com/nRF24/RF24 — the RF24 driver (the old TMRh20/RF24 URL redirects here)
https://github.com/Yveaux/NRF24_Sniffer
https://github.com/michael-betz/nRF24L01-sniffer
Because the same chip receives and transmits, replay is a few lines once you have the bytes. That answers your second question directly: you do not need extra hardware to send.
If you want a purpose-built tool instead: Bastille's RFStorm nrf-research-firmware (https://github.com/BastilleResearch/nrf-research-firmware) flashed onto an nRF24LU1+ Logitech Unifying dongle (the nRF24LU1+ variants are model C-U0007) gives sniffing and injection, and Bitcraze's Crazyradio PA (also nRF24LU1+, 20 dBm with LNA) does nRF24 RX/TX straight from a PC over USB.
If the chip is not Nordic: CC2500 modules driven by an ESP32 work fine, A7105 and LT89xx have Arduino drivers, and BK2421/BK2425 registers are close enough to nRF24 that an nRF24-style driver can be ported.
Only if the chip is unknown or custom. You need something that can both receive and transmit at 2.4 GHz: HackRF One (1 MHz–6 GHz), LimeSDR Mini (10 MHz–3.5 GHz), or USRP B200 (70 MHz–6 GHz). Then record raw IQ and use Universal Radio Hacker (https://github.com/jopohl/urh) to auto-detect the modulation, demodulate, reconstruct the protocol and transmit it back — it has a record-and-send feature plus fuzzing. GNU Radio for anything custom.
This is the €150–300+ route, which is why it is step 4 and not step 1.
Press the same button several times and compare the captured packets (or the raw bytes if you only have the cheap sniffer):
Byte-identical, or differing only in a counter the receiver ignores → fixed code, replay is trivial.
Different every press → rolling code (KeeLoq-style). Naive replay will fail. You then need the algorithm and key from the chip documentation or an MCU firmware dump.
Blocking the receiver while capturing, so you can replay later, is effectively jamming and is illegal in the EU. Do not.
2.4 GHz is licence-exempt ISM, but transmitting is expected to stay low-power and adaptive under ETSI EN 300 328. Replaying to your own light strip is fine; never jam or interfere with links you do not own.
TL;DR: it is 2.4 GHz but it is not Wi-Fi, so no Wi-Fi card will ever decode it. Identify the radio chip first, then buy the matching ~€2 transceiver — the same chip both sniffs and transmits, which is exactly what you need for replay. Only fall back to an SDR if the chip turns out to be genuinely unknown. Do not buy an RTL-SDR for this.
Why monitor/promiscuous mode cannot see it
Monitor mode captures raw 802.11 frames; promiscuous mode just hands every L2 frame to the OS. Both only understand the Wi-Fi MAC/PHY. A remote using GFSK/OOK with a proprietary packet format is not an 802.11 frame, so the card never produces anything decodable. Same band is not the same protocol.
Worth ruling out first: if it were infrared it would need line of sight, and an IR emitter shows up as a purple glow through a phone camera. The previous comment claiming "most likely infrared" is wrong for a remote that works through walls.
Also: the common RTL-SDR dongles (R820T2, and the R828D in the Blog V4) top out at about 1.766 GHz, below the 2.4 GHz band, so they are blind to it without a downconverter.
Step 1 — identify the chip before spending anything
The cheap path (this is what I would do)
An nRF24L01+ module costs about €1–3 and pairs with an ESP32, Arduino or Pico. Scan RSSI across channels to find the active one (the register default address is
E7E7E7E7E7, and channel 76 / 2476 MHz is the common library default), then run a sniffer.One honest caveat people repeat wrongly: the nRF24L01+ does not have true promiscuous reception. You must know the channel, and you only need the upper two bytes of the address, because sniffer firmware turns off the module's internal packet/CRC and retransmit handling. Useful starting points:
TMRh20/RF24URL redirects here)Because the same chip receives and transmits, replay is a few lines once you have the bytes. That answers your second question directly: you do not need extra hardware to send.
If you want a purpose-built tool instead: Bastille's RFStorm
nrf-research-firmware(https://github.com/BastilleResearch/nrf-research-firmware) flashed onto an nRF24LU1+ Logitech Unifying dongle (the nRF24LU1+ variants are model C-U0007) gives sniffing and injection, and Bitcraze's Crazyradio PA (also nRF24LU1+, 20 dBm with LNA) does nRF24 RX/TX straight from a PC over USB.If the chip is not Nordic: CC2500 modules driven by an ESP32 work fine, A7105 and LT89xx have Arduino drivers, and BK2421/BK2425 registers are close enough to nRF24 that an nRF24-style driver can be ported.
The general path — a 2.4 GHz-capable SDR
Only if the chip is unknown or custom. You need something that can both receive and transmit at 2.4 GHz: HackRF One (1 MHz–6 GHz), LimeSDR Mini (10 MHz–3.5 GHz), or USRP B200 (70 MHz–6 GHz). Then record raw IQ and use Universal Radio Hacker (https://github.com/jopohl/urh) to auto-detect the modulation, demodulate, reconstruct the protocol and transmit it back — it has a record-and-send feature plus fuzzing. GNU Radio for anything custom.
This is the €150–300+ route, which is why it is step 4 and not step 1.
Replay: fixed vs rolling code
Press the same button several times and compare the captured packets (or the raw bytes if you only have the cheap sniffer):
Cheapest-first plan
Do not buy: an RTL-SDR (no 2.4 GHz coverage), a "monitor mode" Wi-Fi card, or a HackRF as a first move.
Legal, briefly
2.4 GHz is licence-exempt ISM, but transmitting is expected to stay low-power and adaptive under ETSI EN 300 328. Replaying to your own light strip is fine; never jam or interfere with links you do not own.