5 December 2016

cars, chameleons, networks... (update 2)

[previous posts: Part I (OS BiH) , Part II (MORH HRV) , Update 1 (MORH HRV) ]                                                         
OPL-OPn net (5424.0 KHz)
I have already talked here about this QRG, where the heard ALE addresses were 5B, AB, 1PB, 1PC, 2PB, and 3PB (the so-called PB net), but in these days, at least from 1st December, in that same frequency I heard addresses as OPL, OP1, OP2, OP3, and OP4 (so the name OPL-OPn net). Transmissions start from about 0800 UTC and OPL seems to act as the net-control station. The used technology is the same than PB net, i.e. 188-110A and FED-1052 App.B for the messaging system, and 2G-ALE for the link setup, aside just three 188-110 App.B/FED-1052 App.A frames (see below).
 
Fig. 1
Same QRG and same nodes configuration mean the same source, OS BiH, and the same stations: just a "rotation" of the tactical on-air ALE addresses. I do not know if it's a monthly update or if the update was due to some other reason, further monitorings will help in this direction.
As expected, once removed 188-110A and FED-1052 headers, I got files with ARX and TNEF extensions but this time I had more luck: since the informal nature of the messages (in the reported example, a simple list of sent/received telegrams) these were sent in clear-text. The reading of the extracted files in Figs 2,3 confirms the source and the rotation of the on-air addresses while the e-mail addresses of the network nodes remain unchanged (see Fig.5 of the Part I for what concerns 5PBR), so the old 5B, AB, 1PB, 1PC, 2PB, 3PB,... and the current OPL, OP1, OP2, OP3, OP4,... refer to the same nodes of a single radio-network belonging to OS BiH and running on 5424.0 KHz/USB.

Fig. 2
Fig. 3
Thre is an oddity in one of the recordered transmissions: the presence of three 188-110 App.B/FED-1052 App.A frames just before the link termination (Fig. 4).

Fig. 4
This is the first time, on my side, I see such modality during the e-mail exchanges monitored in this frequnecy: it's hard to say if it just belongs to this transmission or it appeared randomly from some other (unid) source. Anyway, it's worth noting that its time-position in the transmission flow is correct as well as its obsolescence is justified by the use of FED-1052.


https://yadi.sk/d/W19eZn8W32AwPg 

30 November 2016

Logs



04062.0 CM1: Unid net 2205 USB 188-141 2G-ALE calling CO1 flwd by voice call in French "Charlie Hotel respondrè"(23Nov16) (AAI)
05280.5 ALA2: Unid net 0828 USB 188-141 2G-ALE calling ALEJA2 (24Nov16) (AAI)
05280.5 ALA2: Unid net 0830 USB 188-141 2G-ALE calling EZERO2 (24Nov16) (AAI)
05302.0 ---: Unid 0815 USB Chinese mixed mode QPSK 2400Bd + MFSK-8 125Bd (24Nov16) (AAI)
05405.0 BI0: Algerian Military, ALG 0809 USB 188-141 2G-ALE calling PY0 (24Nov16) (AAI)
05405.0 JU01: Algerian Military, ALG 0811 USB 188-141 2G-ALE calling PY01 (24Nov16) (AAI)
06208.4 XLB: Unid net 0623 USB MIL 188-141 2G-ALE calling XLA (18Nov16) (AAI)
06230.0 LIS: Unid net 0723 USB MIL 188-141 2G-ALE calling WTF (17Nov16) (AAI)
06231.0 GHU3: Croatian Military, HRV 0907 USB Stanag-4285 1200bps/S transporting STANAG-5066 HMTP msg to VEL8. Other outstations callsigns: OLI7,NIK2,ULI6,CIK5,ZIL7 (14Nov16) (AAI)
06231.0 GHU3: Croatian Military, HRV 0907 USB STANAG-5066 HMTP over Stanag-4285 1200bps/S msg to IK5 (28Nov16) (AAI)
06320.0 Z1V: Slovakian AF, SVK 0752 USB MIL 188-141 2G-ALE handshake K1U Kuchyna then 188-110A transp. STANAG-5066 HBFTP msg (18Nov16) (AAI)
06324.0 ---: Unid 0831 USB Thales Systeme-3000 analog voice scrambler, also heard on 6400.0 KHz at 0938 (17Nov16) (AAI)
06342.0 ---: Russian Navy, RUS 0645 (cf) T600 FSK 50Bd/200 msg Sync 0x1414bebe952 (18Nov16) (AAI)
06450.0 CAGLIARI: Guardia di Finanza, I 0753 USB MIL 188-141 2G-ALE handshake OLTRAMONTI then R&S GM2100 HF-modem transp. proprietary ARQ-protocol RSX.25 (16Nov16) (AAI)
06522.6 ---: Unid 1047 Thales Robust Mode MFSK-8 125Bd (29Nov16) (AAI)
06562.0 S32: Moroccan Military, MRC 0800 USB MIL 188-141 2G-ALE sounding (26Nov16) (AAI)
06733.0 IDR: Italian Navy S.Rosa Roma, I 1318 J3E/USB wkg maritime patrol aircraft DAGA-03 Breguet Atlantic Br.1150 (14Nov16) (AAI)
06739.0 ---: USAF 0743 J3E/USB SKYKING message "DIABLO time ?? authentication UT" (18Nov16) (AAI)
06790.0 4200: Algerian Sonatrach, ALG 0827 USB MIL 188-141 2G-ALE sounding (18Nov16) (AAI)
06801.0 RIHQ02: Croatian NPRD, HRV 0848 USB MIL 188-141 2G-ALE sounding (25Nov16) (AAI)
06802.0 PC01: Algerian Military, ALG 1346 USB MIL 188-141 2G-ALE calling PY01 (14Nov16) (AAI)
06831.0 E5X: Global HF-net/NPRD-net, HRV 1444 USB MIL 188-141 2G-ALE sounding flwd by 188-110A 72-bit period msg (13Nov16) (AAI)
06840.0 RAPTOR: Unid net 0659 USB MIL 188-141 2G-ALE sounding (18Nov16) (AAI)
06906.0 3114: Algerian Sonatrach, ALG 0647 USB MIL 188-141 2G-ALE sounding (18Nov16) (AAI)
06915.0 PA01: Algerian Military, ALG 0908 USB MIL 188-141 2G-ALE handshake PY01 (25Nov16) (AAI)
06928.5 LC0: Italian Military, I 0950 J3E/USB asking BDA reports to TI4, TA5; relaying EE7 msg to TI4 (22Nov16) (AAI)
06938.0 HBLZDRD1: Roumanian Military, ROU 0823 USB MIL 188-141 2G-ALE handshake HFJCDRD1 flwd by MIL 188-110A Serial (28Nov16) (AAI)
06944.0 JCN: Saudi Air Force, ARS 1738 USB MIL 188-141 2G-ALE calling RFN (26Nov16) (AAI)
06944.0 JCP: Saudi Air Force, ARS 1753 USB MIL 188-141 2G-ALE sounding (26Nov16) (AAI)
06944.0 JCU: Saudi Air Force, ARS 1750 USB MIL 188-141 2G-ALE calling RFU (26Nov16) (AAI)
08090.0 2151: Unid net 0933 USB MIL 188-141 2G-ALE calling 2169 (29Nov16) (AAI)
08092.0 123456: Turkish civil defence test call, TUR 1330 USB MIL 188-141 2G-ALE sounding (27Nov16) (AAI)
08093.5 A02: Netherlands Army, HOL 1328 USB MIL 188-141 2G-ALE calling A05 (27Nov16) (AAI)
08093.5 A06: Netherlands Army, HOL 0902 USB MIL 188-141 2G-ALE calling ANET (29Nov16) (AAI)
08093.5 A06: Netherlands Army, HOL 1323 USB MIL 188-141 2G-ALE calling A18 (27Nov16) (AAI)
08133.0 ---: Russian Intel/Diplo, RUS 1240 USB CIS MFSK-16 133.33Bd 175Hz (29Nov16) (AAI)
08150.6 ---: Algerian Military, ALG 1452 (cf) Bell-103 compatible modem FSK 300Bd/200 (27Nov16) (AAI)
08317.5 ---: Unid 1110 USB BPSK bursts, 4800Bd 6KHz bandwidth (28Nov16) (AAI)
08551.0 ---: Japanese Military, J 0710 USB Japanese MFSK-8, 2 redundant FSK-2 100Bd/300Hz (25Nov16) (AAI)
08580.0 ---: South African Navy, AFS 1705 USB Saab Grintek MHF-50 modem (27Nov16) (AAI)
08600.0 5112: Nigerian Police, NIG 1700 USB MIL 188-141 2G-ALE sounding (27Nov16) (AAI)
08750.0 SHARK21: Unid net 1407 USB MIL 188-141 2G-ALE calling HQ1 (24Nov16) (AAI)
08750.0 SHARK25: Unid net 1403 USB MIL 188-141 2G-ALE calling HQ1 (24Nov16) (AAI)
08847.0 AA8: Israeli Air Force, ISR 1424 USB MIL 188-141 2G-ALE sounding (27Nov16) (AAI)
08847.0 BB3: Israeli Air Force, ISR 1424 USB MIL 188-141 2G-ALE sounding (27Nov16) (AAI)
08847.0 DD3: Israeli Air Force, ISR 1422 USB MIL 188-141 2G-ALE sounding (27Nov16) (AAI)
08850.0 RAPTOR: KFOR NATO-MNBG-E 1154 USB MIL 188-141 2G-ALE sounding (27Nov16) (AAI)
08975.0 ---: (no call) 1415 USB MIL 188-141 2G-ALE calling Unid OVC (27Nov16) (AAI)
08975.0 UAN: Unid net 1415 USB MIL 188-141 2G-ALE calling CON (27Nov16) (AAI)
08984.5 SZ01: Unid net (Tunisian/Algerian ?) 0907 USB MIL 188-141 2G-ALE calling AC01 (29Nov16) (AAI)
09038.0 RAPTOR: NATO-MNBG-E 0813 USB MIL 188-141 2G-ALE sounding (25Nov16) (AAI)
09150.0 GANOB10: Unid net 1445 USB MIL 188-141 2G-ALE calling HQ1 (24Nov16) (AAI)
10185.0 J62: Moroccan Military, MRC 0911 USB MIL 188-141 2G-ALE sounding (26Nov16) (AAI)
10220.0 2167: Unid net 1509 USB MIL 188-141 2G-ALE calling 2157 (17Nov16) (AAI)
10245.5 A03: Netherlands Army, HOL 0828 USB MIL 188-141 2G-ALE calling A18 (26Nov16) (AAI)
10245.5 A06: Netherlands Army, HOL 0841 USB MIL 188-141 2G-ALE calling A18 (26Nov16) (AAI)
10330.0 920007: Unid net 0922 USB MIL 188-141 2G-ALE calling 920001 (26Nov16) (AAI)
10425.0 SRS: Unid net 1356 USB 188-141 2G-ALE calling XW0 (22Nov16) (AAI)
10425.0 XW0: Unid net 1354 USB 188-141 2G-ALE calling UYS (22Nov16) (AAI)
10425.0 XW0: Unid net 1357 USB 188-141 2G-ALE calling TCN (22Nov16) (AAI)
10425.0 XW0: Unid net 1359 USB 188-141 2G-ALE calling GY9 (22Nov16) (AAI)
10425.0 XW0: Unid net 1402 USB 188-141 2G-ALE calling BPF (22Nov16) (AAI)
10638.0 EK9: Greek Military, GRC 1416  USB MIL 188-141 2G-ALE handshake GEF (17Nov16) (AAI)
11162.0 ---: Russian Military, RUS 0900 USB CIS-45 OFDM HDR modem v1 BPSK 33.3Bd 62.5Hz (18Nov16) (AAI)
12115.0 RHI: Saudi Military, ARS 1414 ISB 188-141 2G-ALE calling AAI (19Nov16) (AAI)
12164.0 ---: Russian Military, RUS 1020 USB CIS-45 OFDM HDR modem v2 QPSK 40Bd 62.5Hz (18Nov16) (AAI)
12497.0 5601: Unid Iranian net, IRN 1340 USB MIL 188-141 2G-ALE sounding (19Nov16) (AAI)
13495.8 ---: Russian Mil/Diplo 0950 (cf) MFSK-16 65.6Bd 174.7Hz separation (19Nov16) (AAI)
13499.0 24191: Moroccan Civil Protection, MRC 1452 USB MIL 188-141 2G-ALE sounding (19Nov16) (AAI)
14643.0 ---: Russian Military, RUS 0838 USB CIS-112 OFDM modem 22.22Bd BPSK (18Nov16) (AAI)
16241.0 ---: Russian Intel/Diplo, RUS 1000 USB CIS MFSK-16 16.44Bd 175Hz (29Nov16) (AAI)

25 November 2016

FLSU/FTM protocol + 188-110A Serial: example of 3G/2G switching


This sample is a real-world example of 3G-HF Link SetUp protocol used in conjunction with a 2G MS 188-110 Serial waveform, it was copied and recordered on 9003.0 KHz/USB by my friend Mike Chace-Ortiz (mco) who kindly sent me the file
As visible in the "NATO HF House" in Fig. 1, STANAG-4538 is located at the two lowest layers of the OSI model. The Data Link protocols at Layer two are closely connected with the burst waveforms defined in the standard and located at Layer 1 and cannot be run with other waveforms. On the other hand, link-oriented protocols, which are also located at layer two, can be run "in conjunction" with other data link protocols, for example STANAG 5066, and with waveforms at Layer 1 of the HF House such as STANAG-4285, STANAG-4539 and MIL 188-110: in this case, STANAG 4538 establishes a sort of line-switched connection which STANAG-5066 or the waveforms make use of. For example, Former Selex Communications, now Leonardo, has implemented FLSU from STANAG-4538 together with STANAG-5066 for the Swedish Armed Forces. 
Fig.1 - NATO HF House
The sample consists of n-transmissions, each composed of a MIL 188-110A transfer running at 300bps, preceeded and terminated by BW5 bursts which control the link (Figs. 2,3):

Fig.2
Fig.3
More precisely, 188-110A frames transport Harris proprietary Citadel encrypted data, Fig. 4, so it's difficult to say what sits behind: S-5066 or FED-1052 (most likely the former).

Fig.4
Since the  1.033 msec length and the 50-bit payload, type "A" bursts correspond to the burst waveform 5 (BW5), as defined in STANAG-4538 (MIL 188-141C does NOT provide such waveform):
 
Fig.5

BW5 is an extended version of the BW0, it uses the same TLC, FEC, Walsh coding, and PN spreading but a longer preamble and the 50-bit payload (with increased interleaver span) make BW5 more robust than BW0. Note that the BW5 bursts that terminate each transmission, the type "C" bursts in Fig. 2, are a bit longer than the expected 1.03 msec: this is not a problem since only the first part, i.e.just 1.03msec length, contains modulated data (Fig. 6).

Fig.6
BW5 bursts are used to carry the PDUs of FLSU (Fast Link SetUp) and its closely associated FTM (Fast Traffic Management) protocol. PDUs for the two protocols are distinguished by the protocol field in the first three bits: 001 for an FLSU PDU versus 100 for an FTM PDU. 
Unfortunately, the decode attempt of the BW5 frames, either type "A" or type "C", does not show the expected values of the first 3 bits, unless in some cases (Fig. 7). Anyway, the presence of repeated patterns could indicate a certain consistency of the data. I do not know if it's due to decoder errors or perhaps a proprietary implementation of FLSU/FTM PDU to accomplish this 3G/2G switching: for sure, since the use of the proprietary Citadel encryption, they use Harris equipment and Harris had, and still has, a preminent role in the development of 3G-HF technology (Harris was the first who implemented STANAG-4538).

Fig.7



https://yadi.sk/d/GCq28TAjzSYzU

19 November 2016

R&S proprietary ARQ-protocol RSX.25 over GM-2100 HF modem


transmission received on 06450.0 KHz on USB at 0753 UTC. The ending part in MIL 188-141A, which terminates the link, reveals that the user is the Italian "Guardia di Finanza - GdF", ALE addresses are CAGLIARI (Coastal Naval Station in Cagliari, the sender) and the patrol boat OLTRAMONTI (the receive peer). 
Data are sent using the HF waveform "Signal Format", a so-called Rohde & Schwarz proprietary waveform originated by the HF modem GM2100, in combination with the proprietary ARQ-protocol RSX.25. LAN/WAN interconnections are most likely managed by the "Message Handling System PostMan", this also from R&S.
RSX.25 literally stands for R&S adaptation of wired X.25 protocol to the HF radio channel, it derives from the packet protocol X.25 and cannot be used togheter with STANAG and MIL-STD HF waveforms such as S-4039, S-4285 and 199-110A; for these waveforms, radio protocols such as STANAG 5066 are available (quoting from R&S data sheets [1]).

The HF waveform GM2100 "Signal Format" exhibits the usual 1800Hz carrier with PSK-8 modulation at 2400 symbols/sec (Fig. 1)

Fig.1
Figs. 2a, 2b shows the structure of a frame with R&S Signal Format and transmitted by the HF modem GM2100. The preamble consisting of a fixed 192 symbol sequence enables the receive station to synchronize with correct timing and phase. The following data block consists of 64-symbols frames each composed of 48 unknown (data) symbols + 16 known symbols (probe). The postamble, terminating the data block, has a structure which is basically the same as that of the data frames but it contains a stop-code sequence instead of information data.
Fig.2a
Fig. 2b (from a different recording)

Most likely the length of the interleaver or the scrambler generates the 133.33msec ACF spikes, i.e. five data blocks which make 960 bit or 320 symbols period (Fig.3).
 
Fig.3
The RSX.25 protocol permits all types of digital data to be transmitted, eg for a printer, digital camera, camcorder or fax unit. RSX.25 organizes the data to be transmitted in packets, which are successively transferred to the data modem. The packets contain a variable number of frames, the number per packet depending on radio-link quality and being adapted at regular intervals.
The data transmitted in a packet are distributed among the frames. The length of the frame data is variable and also depends on radio-link quality. In channels of very good quality, a frame contains 250 data bytes, in strongly disturbed channels 4 bytes. The length of the transmitted data is continually adapted to link quality

RSX.25 has a typical period of 8-bit period with recognizable patterns and is visible once removed the overhead due the Signal Format waveform (Fig. 4).

Fig.4

RSX.25 use the BZIP arvhivier so the received data can be extracted to ASCII files. Although the "data protection" feature is used, some portions as the e-mail addresses or other headers are in clear-text and thus easily identified (Fig. 5): as it was easy to predict, ALE and e-mail addresses match.

Fig.5

Some useful links:
https://www.rohde-schwarz.com/fi/file/n160_email.pdf
https://www.rohde-schwarz.com/file/n155_shortwave.pdf


https://yadi.sk/d/L8ccg2Nnyq5Su

17 November 2016

cars, chameleons, networks, and other stories (update)

6231 net (6231.0 KHz)
I recently spotted the frequency 6231.0 KHz on USB where stations connect following the same procedure as of AB-net and use STANAG-5066 HMTP protocol which is transported by a STANAG-4285 modem configured for 1200 bps and short interleaver (Figs. 1,2).  As in the 5054-net, the message transfer is not preceded by ALE or selcall phase and this supports the idea of scheduled tansmissions. 
The post related to AB-net and 5054-net (HRV MORH-u) can be read here.

Fig.1 - the HF waveform (Stanag-4285)
Fig.2 - 1776 bit period (Stanag-5066)

While the transmissions in the AB-net are scheduled on tuesday and thursady from 0830 UTC (0730, daylight savings time), transmissions on this frequency start  at 0800 UTC on monday and wednesday (most likely 0700, daylight savings time)[1]. These are the heard callsigns,  listed in the call-order: 
GHU3 (net-control station)
ONI6
ZIO4
OLI7
NIK2
ULI6
VEL8
CIK5
ZIL7
Stations are contacted a first time by GHU3 for a radio-check then, in case of messages, the stations shall be contacted a second time and in the same order. Unless the initial 188-141 2G-ALE phase, the message transfer follows the schema seen here, used in the AB-net.

The HMTP headers in Fig. 4 prove that this net belongs to the HRV MORH-u network as the previous AB-net and 5054-net: same OS (Linux Open-SUSE), same STANAG-5066 application ("CroS 5066", developed by CROZ) and same attachment filename.

Fig. 4

The examination of the headers of the Data PDUs (D_PDU) gives the chance to get the STANAG-5066 addresses of the nodes in the play. The D_PDU headers can be highlighted by synchronizing the bitstream on the 16-bit Maury-Styles sequence 0xEB90 since all D_PDUs, regardless of type, begin with that same sync (it's just this sequence that causes the 1776-bit ACF of Figure 2).

Fig.5 - D_PDU headers
The S-5066 addresses obtained from the recordings belong to the 006.008.003.zzz subnet, then 5054.0 and 6321.0 KHz  are just two channels of the same subnet.
Below the updated S-5066 Addresses Table and the Network Map. 

AB-net 5838.0 KHz (...)
ALE  S-5066 Add.       E-mail Add. 
ABC7 006.008.001.039   user1@asdf.123 (ncs)
ABD1 006.008.004.166   user1@sdfg.123
ABG6 006.008.004.165   user1@dfgh.123
ABF2 006.008.006.226   user1@fghj.123
ABS5 006.008.008.215   user1@ghjk.123
ABK4 006.008.002.144   user1@jklp.123
ABH3 006.008.002.055          ?


5054/6231-net 5054.0 KHz, 6231.0 KHz
CALL S-5066 Add.       E-mail Add.
GHU3 006.008.004.165   user1@aysxd.111 (ncs)
ZIO4 006.008.003.032   user1@oli93.111
     006.008.003.033   user1@lost62.111

NIK2 006.008.003.036   user1@dres32.111
ULI6 006.008.003.037   user1@fejk8.111

CIK5 006.008.003.039   user1@huba9.111
ONI6
OLI7
VEL8
ZIL7



[1] further recordings are needed

13 November 2016

Logs

08002.0 KHz/USB 1518 UTC STANAG-4538 HDL+ data transfer
04926.0 KR4: Polish Military, POL 1827 USB MIL 188-141 2G-ALE calling ST8 (08Nov16) (AAI)
04926.0 KR4: Polish Military, POL 1837 USB MIL 188-141 2G-ALE calling FU7 (08Nov16) (AAI)
05316.0 9A3WD1: Croatia HF-ALE net, HRV 0932 USB MIL 188-141 2G-ALE calling 9A3DZL, prob. supporting NPRD? (03Nov16)
05316.0 K51: Croatia NPRD, HRV 0927 USB MIL 188-141 2G-ALE calling STHQ01 (03Nov16) (AAI)
05400.0 ---: Unid 1450 USB USB MIL 188-141 2G-ALE Link Protect (10Nov16) (AAI)
05424.0 FIT3: Bosnia Herzegovina Defense, BIH 0817 USB MIL 188-141 2G-ALE handshake with FI3 flwd by 188-110A transporting STANAG-5066 HBFTP msgs (03Nov16) (AAI)
05472.0 ---: Unid 0801 USB TADIRAN AutoCall MFSK-4 (10Nov16) (AAI)
05740.0 ---: Unid 0750 USB Unid PSK-8 2400Bd ARQ system, ACF = 112.5ms/810 bit, 135 symbols length frame with QPSK preamble (03Nov16) (AAI)
05785.0 PRATICA01: GdF, I 0735 USB MIL 188-141A 2G-ALE calling SAGITTARIO (28Oct16) (AAI)
05838.0 ABC7: Croatian Mil, HRV 0921 USB MIL 188-141 2G-ALE calling ABS5 (03Nov16) (AAI)
06220.0 DSM2: Unid 1818 CW "3VD6 3VD6 DE DSM2 DSM2 R 469? K", same msg for TGYH,Q2LR,8FLO,H5HF (06Nov16) (AAI)
06224.0 AA5: Israeli AF, ISR 1714 USB MIL 188-141 2G-ALE sounding (06Nov16) (AAI)
06228.0 ---: Unid 1706 USB Hagelin HC-256 voice scrambler (06Nov16) (AAI)
06310.0 BS008C1: CS/RS net 0909 USB MIL 188-141 2G-ALE calling CS004A (08Nov16) (AAI)
06316.0 ---: Unid 1750 USB RACAL/THALES Panter-H modem Frequency Hopper QPSK 2400Bd (06Nov16) (AAI)
06324.5 XSS: DHFCS Forest Moor, G 1736 USB MIL 188-141 2G-ALE sounding (06Nov16) (AAI)
06358.5 PBB: Dutch Navy Den Helder via Goeree TX, HOL 1732 (cf) FSK 75bd/850 CARBs "02A 04B 06A 08B 12A 16X 22X PBB" (06Nov16) (AAI)
06394.0 ---: Russian Military, RUS 0824 USB AT3004-D modem BPSK 120Bd (06Nov16)
06424.5 IDR: Italian Navy S.Rosa Rome, I 0855 J3E/USB daylight component, radio check with Bussola, Orale, Filone (06Nov16) (AAI)
06450.0 GENOVA: GDF, I 0915 USB MIL 188-141 2G-ALE calling GAETA (08Nov16) (AAI)
06654.0 DB5: Iraqi Border Police Region 5 Najaf, IRQ 1745 USB MIL 188-141 2G-ALE calling SHA (08Nov16) (AAI)
06715.0 CROSPR: USAF Croughton SIPR-net, G  1746 USB MIL 188-141 2G-ALE sounding (06Nov16) (AAI)
06765.0 CNP: Roumenian Police, ROU 0932 USB MIL 188-141 2G-ALE calling VAS (10Nov16) (AAI)
06767.0 ABC7: Croatian Military, HRV 0904 USB MIL 188-141 2G-ALE calling ABF2, rptd on 6909.0, 06990.0 (08Nov16) (AAI)
06772.0 LIS: Unid net 1826 USB MIL 188-141 2G-ALE sounding (11Nov16) (AAI)
06772.0 LIS: Unid net 1837 USB MIL 188-141 2G-ALE calling XGY (11Nov16) (AAI)
06783.0 ALA2: Unid net 0842 USB MIL 188-141 2G-ALE calling SLIKA2 (08Nov16) (AAI)
06795.0 381013: Turkish civil defense, TUR 1716 USB MIL 188-141 2G-ALE calling 367013 (06Nov16) (AAI)
06801.0 D20: NPRD net, HRV 0916 USB MIL 188-141 2G-ALE sounding (08Nov16) (AAI)
06805.0 2600: Unid net 0827 USB MIL 188-141 2G-ALE calling 1600 (10Nov16) (AAI)
06841.0 RCV: Russian Navy Sevastopol, UKR 1725 (cf) T600 FSK 50Bd/250 msg Sync 0x1eb41eb2952 (06Nov16) (AAI)
06870.0 PY10: Algerian Mil, ALG 0731 USB MIL 188-141 2G-ALE calling KB16 (03Nov16) (AAI)
06902.6 KXV44: US DoS station 0941 USB MIL 188-141 2G-ALE calling KXV44 (08Nov16) (AAI)
06906.0 3110: Unid net 0731 USB MIL 188-141 2G-ALE sounding (03Nov16) (AAI)
06971.0 ---: Russian Intel, RUS 1700 USB CIS FTM-4, MFSK-4 150Bd (effective 37.5Bd) 4000Hz modem (tones at: -6, -2, +2, +6 KHz) (06Nov16) (AAI)
07315.0 KF01: Algerian Military, ALG 0904 USB MIL 188-141 2G-ALE handshake ND01 flwd by MIL 188-110 App.B OFDM 39-tone modem (11Nov16)(AAI)
07575.0 WG11: Algerian Military, ALG 0750 USB MIL 188-141 2G-ALE sounding (11Nov16) (AAI)
07578.0 WG21: Algerian Military, ALG 0752 USB MIL 188-141 2G-ALE calling AT20 (11Nov16) (AAI)
07611.0 PY40: Algerian Mil, ALG 0903 USB MIL 188-141A 2G-ALE calling FQ65 (28Oct16) (AAI)
07879.5 DB1: Iraqi Border Police, IRQ 1702 USB MIL 188-141 2G-ALE calling DUH (11Nov16) (AAI)
07879.5 DB1: Iraqi Border Police, IRQ 1716 USB MIL 188-141 2G-ALE calling SUL (11Nov16) (AAI)
07950.0 BX01: Algerian Military, ALG 0756 USB MIL 188-141 2G-ALE calling PY01 (11Nov16)(AAI)
07950.0 FN01: Algerian Military, ALG 0800 USB MIL 188-141 2G-ALE calling PY01 (11Nov16)(AAI)
07950.0 WG01: Algerian Military, ALG 0755 USB MIL 188-141 2G-ALE calling AT01 (11Nov16) (AAI)
07950.0 WL01: Algerian Military, ALG 0757 USB MIL 188-141 2G-ALE calling PY01 (11Nov16)(AAI)
08000.5 HBLZDRD1: Roumanian Military, ROU 0806 USB MIL 188-141 2G-ALE calling HFJCDRD1 (11Nov16)(AAI)
08002.0 ---. Unid 1518 USB STANAG-4538 HDL+ data transfer (10Nov16) (AAI)
08015.5 ---: Russian Diplo, RUS 1519 (cf) CIS-3000 PSK-8 3000Bd serial flwd by MFSK-68 (34+34) + QPSK 2400Bd 10KHz wide-band inserts (10Nov16) (AAI)
08016.0 RIHQ02: Unid net 0749 USB MIL 188-141 2G-ALE sounding (11Nov16) (AAI)
08023.0 FQ40: Algerian Military, ALG 0817 USB MIL 188-141 2G-ALE calling AT40 (11Nov16)(AAI)
08141.0 KW01: Unid net 1300 USB MIL 188-141 2G-ALE calling IX01 (11Nov16) (AAI)
08162.0 VG02: Algerian Military, ALG 0837 USB MIL 188-141 2G-ALE calling PY01 (11Nov16)(AAI)
08500.0 ---: Russian Nvay, RUS 0615 (cf) CIS Navy "Akula" FSK 500Bd/1000 (05Nov16) (AAI)
10158.0 RIHQ02: Croatian NPRD, HRV 1024 USB MIL 188-141 2G-ALE sounding (11Nov16) (AAI)
10158.0 STHQ01: Croatian NPRD, HRV 1021 USB MIL 188-141 2G-ALE sounding (11Nov16) (AAI)
10165.0 ---: Unid 0800 USB RFSM serial modem with Data Masking, QRX 10170.0 (04Nov16) (AAI)
10190.0 BSK: Algerian AF, ALG 1300 USB MIL 188-141 2G-ALE calling CM4 (03Nov16) (AAI)
10212.0 ---: Russian Mil, RUS 0730 USB AT3004-D modem BPSK 120Bd (04Nov16)
10220.0 2151: Unid net 10:06 USB MIL 188-141 2G-ALE calling 2172 (11Nov16) (AAI)
10220.0 2151: Unid net 1401 USB MIL 188-141 2G-ALE sounding (10Nov16) (AAI)
10250.0 GHARB3: (GMRA net, LYB ?) 0926 USB MIL 188-141 2G-ALE calling HQ2 with AMD "IFBUIFSHSBIBN", flwd by CLOVER-2000 62.5Bd PSK-16 data transfer (12Nov16) (AAI)
10272.5 049112:  German Red Cross, D 0922 USB MIL 188-141 2G-ALE sounding (12Nov16) (AAI)
10275.0 3127: Sonatrach, ALG 0747 LSB MIL 188-141 2G-ALE sounding (04Nov16) (AAI)
10275.0 4042: Sonatrach, ALG 1405 LSB MIL 188-141 2G-ALE sounding (10Nov16) (AAI)
10275.0 4050: Sonatrach, ALG 1255 LSB MIL 188-141 2G-ALE sounding (03Nov16) (AAI)
10280.0 4536: Unid net 0702 USB MIL 188-141 2G-ALE calling 8536 (04Nov16)
10390.0 2405: Moroccan Civil Protection, MRC 0643 USB MIL 188-141 2G-ALE sounding (04Nov16) (AAI)
10429.0 2151: Unid net 1301 USB MIL 188-141 2G-ALE sounding (09Nov16) (AAI)
10429.0 2159: Unid net 1010 USB MIL 188-141 2G-ALE handshake with 2167 flwd by voice comms (03Nov16) (AAI)
10548.0 ---: Russian Mil, RUS 0824 USB AT3004-D modem BPSK 120Bd (04Nov16)
10590.0 CM1: Algerian Air Force Blida ALG 0825 USB MIL 188-141 2G-ALE calling 761 (07Nov16) (AAI)
10596.0 ---: Russian Air Force, RUS 1350 FSK 50Bd/500 no traffic (10Nov16) (AAI)
10627.0 ---: Unid 1258 USB 3G-HF, HDL BW2-BW1 burst waveforms (02Nov16) (AAI)
10648.0 120001: Turkish Emergency Net, TUR 0638 USB MIL 188-141 2G-ALE sounding (04Nov16) (AAI)
10675.0 ---: Russian Military, RUS 0830 USB AT3004-D modem BPSK 120Bd (07Nov16)
10805.5 002: Unid net 1426 USB MIL 188-141 2G-ALE calling 001 (USCG HC-130J #2001 Hercules aircraft?) (07Nov16) (AAI)
10830.0 NDT: US-navy Totsuka J 0642 FSK 50Bd/850 encrypted transmission (04Nov16) (AAI)
10888.0 ---: Russian Military, RUS 0830 USB AT3004-D modem BPSK 120Bd (07Nov16)
10922.0 ---: Russian Mil, RUS 0737 USB AT3004-D modem BPSK 120Bd (04Nov16)
10935.0 ---: Unid 0910 (cf) FSK 100Bd/1000 (07Nov16) (AAI)
10963.2 ---: Unid 1440 USB STANAG-4285 KG-84 encrypted message (10Nov16) (AAI)
10996.0 ---: Unid 1407 (cf) R&S ALIS 228.65Bd/200 calling address 366, followon type Morse (07Nov16) (AAI)
11020.0 BSK: Algerian Air Force Biskra ALG 0755 USB MIL 188-141 2G-ALE calling CM4 (07Nov16) (AAI)
11020.0 CM4: Algerian AF, ALG 0846 USB MIL 188-141A 2G-ALE calling ILZ (31Oct16) (AAI)
11020.0 ILZ: Algerian Air Force Illizi, ALG 0754 USB MIL 188-141 2G-ALE calling CM4 (07Nov16) (AAI)
11030.0 CM1: Algerian Air Force Blida, ALG 0743 USB MIL 188-141 2G-ALE handshake COF flwd by 188-110A transporting Citadel encrypted data (07Nov16) (AAI)
11097.0 EQB: Swedish Military, S 1527 USB MIL 188-141 2G-ALE calling EQ2 (rptd on 10974.0, 10602.0) (07Nov16) (AAI)
11097.0 EQB: Swedish Military, S 1537 USB MIL 188-141 2G-ALE calling EQ1 (rptd on 10974.0, 10602.0) (07Nov16) (AAI)
11097.0 EQB: Swedish Military, S 1545 USB MIL 188-141 2G-ALE calling MON (rptd on 10974.0, 10602.0) (07Nov16) (AAI)
11100.0 DJT: Algerian Air Force Djanet ALG 0815 USB MIL 188-141 2G-ALE calling CM4 (07Nov16) (AAI)
11111.0 STAT22: Tunisian MoI, TUN 0837 USB (cf +1700Hz) PacTOR-II 100Bd/200 DQPSK, sending email to STAT152 (07Nov16) (AAI)
11111.0 STAT23: Tunisian MoI, TUN 0816 USB (cf +1700Hz) PacTOR-II 100Bd/200 DQPSK, sending email to TUD (04Nov16) (AAI)
11130.0 C3:  Moroccan Military, MRC 0818 USB MIL 188-141 2G-ALE calling R3 (07Nov16) (AAI)
11135.0 HQ3: poss. GMRA net, LYB 0851 USB MIL 188-141A 2G-ALE calling GANOB8 (31Oct16) (AAI)
11160.0 BAL: Unid (Algerian AF or decoder error ?) 0857 USB MIL 188-141 2G-ALE sounding (07Nov16) (AAI)
11168.7 HBLZDRD1: Roumanian Military, ROU 0801 USB MIL 188-141 2G-ALE calling HFJCDRD1 (07Nov16) (AAI)
11168.7 HBLZDRzZM: Roumanian Military, ROU 0800 USB MIL 188-141 2G-ALE calling HFJCDRzZM (07Nov16) (AAI)
11181.0 5B: Bosnia Herzegovina Defense 5th Infantry Brigade Tuzla, BIH 0823 USB MIL 188-141A 2G-ALE calling AB (31Oct16) (AAI)
11198.0 ---: Unid NATO 1410 DSB Link-11 CLEW (07Nov16) (AAI)
11226.0 201067: USAF unid asset 0958 USB MIL 188-141 2G-ALE sounding (03Nov16) (AAI)
11226.0 280336: USAF unid asset 0958 USB MIL 188-141 2G-ALE sounding (03Nov16) (AAI)
11430.0 ---: Unid 1043 USB 3G-HF, (prob. MDL-NACK protocol) BW3 bursts transporting Citadel encrypted data (31Oct16) (AAI)
12379.0 ---: Unid 0930 (cf) 6KHz channel ISB ARQ system, BPSK 2400 Bd (05Nov16) (AAI)
12550.0 North Korean diplo, DPRK 1015 LSB (cf + 1500Hz) DPRK-AQ 1200Bd/1200 (09Nov16) (AAI)
13270.0 8351: Turkish Civil Defence/Emergence net, TUR 0855 USB MIL 188-141 2G-ALE sounding (09Nov16) (AAI)
13471.0 ---: Unid (maybe Chinese V22?) 1415 (cf) BPSK 62.5Bd 16-bit period (06Nov16) (AAI)
13499.0 2001: Unid net 1406 USB MIL 188-141 2G-ALE sounding (04Nov16) (AAI)


7 November 2016

STANAG-4538 3G-HF, HDL complete session


3G-HF HDL transfer heard on 10627.0 KHz/USB at 1258 UTC
The High-throughput Data Link protocol (HDL), defined in STANAG-4538, is a selective repeat ARQ protocol which can only be run in a point-to-point data packet connection. HDL is most efficient when large volumes of data are to be transmitted and the channel conditions are moderately good, while LDL is best suited for small data volumes and in poor quality channel
"Data transfer by HDL begins after the stations have already established the data link connection in the traffic setup phase (using FLSU BW5 waveform). In an HDL data transfer, the sending station and the receiving station alternate transmissions in the manner depicted in figure 1; the sending station transmitting HDL_DATA PDUs containing payload data packets, and the receiving station transmitting HDL_ACK PDUs containing acknowledgments of the data packets received without errors in the preceding HDL_DATA PDU. The end of a data transfer is reached when the sending station has transmitted HDL_DATA PDUs containing all of the payload data in the delivered datagram, and the receiving station has received these data without errors and has acknowledged their successful delivery. When the sending station receives an HDL_ACK PDU indicating that the entire contents of the datagram have been delivered successfully, it sends an HDL_EOM PDU repeated as many times as possible within the duration of an HDL_DATA PDU, starting at the time at which it would have otherwise transmitted the next HDL_DATA PDU." [1]

fig. 1
As in STANAG-4538 Table 13-1, HDL protocol use the burst waveforms BW2 for data forward and BW1 for ACK and EOM/Term signal, all the burst waveforms use the basic PSK-8 modulation at 2400 baud centered at 1800hz also used in the MIL-STD 188-110A serial tone modem waveform (fig. 2) and can be identified by measuring their duration (fig. 3)

fig. 2
fig. 3
BW2 consists of 100 msec TLC section and a short (26,67 msec) preamble followed by a number of fixed-size data packets (3, 6, 12, or 24): the number of packets is negotiated before the HDL protocol starts and remains unchanged until the end of the data transfer. Each packet consists of 20 frames, each of which contains 32 unknown symbols (data) followed by 16 known symbols acting as probe (fig. 5). 
HDL protocol is packet-oriented, in contrast with LDL protocol which is byte-oriented, and it can be designated by a number as HDL<n> where n - as said above - is the negotiated  number of packets which are transmitted in one forward frame: for example, in the recorderd transfer we see HDL3-type frames.

fig. 5
Burst waveform 1 (BW1) is a general-purpose waveform used to carry short messages for many of the 3G protocols: traffic management, link maintenance, and data acknowledgments for the HDL protocol. It consists of 576 PSK-8 symbols preamble followed by 2304 PSK-8 symbols of data which are coded using 16-ary Walsh seqences (fig. 6).

fig. 6
It's worth noting that all the six burst waveforms specified by STANAG-4538 begin with a TLC/AGC guard sequence, why? Existing HF radios were generally not designed with burst waveforms in mind. For example, MIL-STD-188-141 military radios are allowed 25 ms to reach full transmit power after keying. While the transmitter radio frequency stages are ramping up, the input audio signal level is adjusted by a transmit level control (TLC) loop so that it fully modulates the transmit power. At the receiver, an automatic gain control (AGC) loop must also adjust to a new receive signal. To accommodate these characteristics of existing radios, the 3G burst waveforms just begin with a TLC section of “throwaway” 8-ary PSK symbols that are passed through the system while the transmitter’s and receiver’s level control loops stabilize.

[1] from: "Third-Generation and Wideband HF Radio Communications" 
 

6 November 2016

unid 3KHz/6KHz channel waveforms in Maritime Band


These are unidentified signals heard by me and my friend KarapuZ in the Maritime Band segments, mainly 8 and 12 MHz, during daylight. Transmissions are a mix of 3 KHz and 6 KHz wide channels (BW) and use PSK modulation, symbols rate is dependent on the bandwidth:
3 KHz BW: 2400 symbols/sec, BPSK modulation (fig. 1)
6 KHz BW: 4800 symbols/sec, BPSK and QPSK modulation (figs. 2, 3)

fig. 1
fig. 2
fig. 3
The most interesting transmission is what seems an Independent Side Band ARQ system in which the sender use the upper band to convey messages and receiver use the lower band for ACKs, both use BPSK modulation and 2400Bd symbols rate (figs. 4,5)

fig. 4
fig. 5
In order to get better quality signals, at the same time I tuned the 12 MHz band using the remote SDR at Twente University: curiously such signals were not received at the remote site. I know that this test make a poor sense but it could be a little clue about the origin of these transmissions. 




https://yadi.sk/d/DSfW8C_oyAEBd

4 November 2016

Unid PSK-8 2400Bd (ARQ) system


unid, possibly ARQ, system heard and tuned using the remote Twente-SDR on 5740.0 KHz/USB for a long standing time. The waveform used by S1 S2 stations is a 1800 Hz carrier which is modulated at constant rate of 2400 symbols per second (fig. 1): QPSK is probably used for the initial preamble and PSK-8 for the data blocks (fig. 2). Each transmission, both from S1 and S2, lasts about 1660 msec.

fig. 1
fig. 2
The use of QPSK modulation is confirmed by the four accentuaded positions in the constellation diagram (fig. 3), moreover the preamble seems to be sent at higher level than the data blocks (fig. 4).

fig. 3
fig. 4
The signal has an ACF of 112.5 msec which corresponds to a period length of 810 bit or 270 PSK-8 symbols @ 2400 Baud. However, the frame length is the half of the period i.e. 135 symbols: the ACF value may be due to the lenght of the scrambler or the length of the interleaver, i.e. 810 bit. Most likely the frame consists of 32 known symbols and 103 unknown data symbols (fig. 5). 

fig. 5

https://yadi.sk/d/8sNOkDw6y4fap





An interesting comment from my friend ANgazu:
UNID PSK in last entry looks very interesting. Seems to be an hibrid modem.
Header is likely to use MSK. 32 symbols sync sequences use QPSK and are very similar to MIL-STD reinserts.



I agree, the strong PSK-4 positions in the constellation are just due to the repeated known symbols sequences.