30 June 2015

Logs

30/06/15 14584.0 --- Unid (prob. French Mil ) 1455 USB Thales Systeme-3000 ALE
30/06/15 14442.0 --- Russian Intel/Diplo 1220 USB Serdolik: MFSK-34 40Bd then into OFDM 35-tones 40 Bd
30/06/15 14747.0 --- Unid 0647 MSK 1200Bd/600 bursts
30/06/15 13242.0 JNRNPR USAF-NIPRnet Salinas, PTR 0637 USB MIL 188-141A sndg
30/06/15 10702.8 --- Unid 0630 F1B 50Bd/850 ACF = 0
30/06/15 11114.6 --- Unid 0615 Arcotel MAHRS 2400, ALE mode
29/06/15 11068.0 --- Russian Mil 1355 USB AT-3004D/3104 (CIS-12)
28/06/15 14300.0 --- Unid (possibly Chinese Mil) 1713 USB OFDM 16-tone 75Bd bursts

26/06/15 16221.8 99910 MFA cairo, EGY 1927 USB Codan Chirp-mode/80bd clg 66601 (Embassy Washington)

FSK 500Bd/1000, CIS Navy Akula ("shark")


The segments are FSK 500Bd/1000 or the so-called "Shark" (or "Akula" in Russian language): http://signals.radioscanner.ru/base/signal197/



My friend KarapuZ noted that if the packets are demodulated, they have always the same ending sequence (EOM) "1771 /".


29 June 2015

Unid OFDM 16-tone 75 Bd, 110 Hz (MS 188-110A App.A modified?)


I had this signal via Twente SDR on USB 14301.8 (cf)  on 28/06/15 (1710z) just in the well-known 20 mt reserved band, an that's a bit odd.
The waveform is an OFDM 16-tone PSK, 75 Bd and 110 Hz shift, sent in burst mode. It is very similar to the obsoleted Standard NATO MIL 188-110A Appendix A without the doppler tone @ 605 Hz and in not-continuous mode.
 
OFDM parameters
There is a Chinese variant of the MIL 188-110A 16 channels: it could be this case, but I could not find info or logs about it. The burst mode could lead to something like a selcall waveform but the ~720mS spaced "pips" looks like a TDMA.
Hope to get more info and/or more records.

A short recording can be downloaded from here:

27 June 2015

Unid FSK-8 + PSK-2 1200 Bd (prob. AX-25)


Recordered this morning on 19304.0 USB (central frequency 19305.0) starting from 0937z until 1020z (s/off). The trasmission  heard consists of a series of short messages in PSK-2 1200 Bd (as well as some short bursts) along with 9-tones intervals. Sometimes a PSK-2 100 Bd preamble is sent. 

9-tones and PSK-2 1200 Bd insertions
PSK-2 1200 Bd, carrier ~1060 Hz
the 9 tones, top and bottom @ 7dB higher

PSK-2 100 Bd preamble
The transmission ended with a short CW/Morse message, decoded as "RFM U NIL SK 73" (more likely the '73' stands for greetings, as in HAM world).

 
The same waveform has been reported in radioscanner.ru:
http://www.radioscanner.ru/forum/index.php?action=search&loc=1&forum=21&topic=36750&page=1179863
and it is still un-identified.

Unid FSK 50/500



This signal was heard on 14568.0 (cf) around 1410z, 25 Jun. It's a sync FSK 2-carriers with shift = 500 Hz and baudrate = 50 Baud. ACF160ms with odd 2 bits stop and apparently no start bit.







26 June 2015

Logs

26/06/15 14631.0 CTA/CTP Portoguese Navy, POR 1323 LSB STANAG-4285 600/L CARBs (new CTP9xI)
26/06/15 17463.0 X06 Russian Diplo, RUS 1135 USB 6-MFSK/Mazielka 6 tone selcall "256134" s/off 1152
26/06/15 10137.2 IK3NWX beacon Rovigo, I 0715 CW
26/06/15 09050.0 --- Unid 0803 MIL 188-110A/2400bps short msgs
26/06/15 09288.0 X06 Russian Diplo, RUS 0650 USB 6-MFSK/Mazielka 6 tone selcall "356412" s/off 0702
26/06/15 14591.5 MOBE3F French AF Taverny, F 0646 USB MIL 188-141A clg 203E3F Awacs
26/06/15 15016.0 --- USAF Andrews, US 0640 J3E female EAM
25/06/15 16222.0 X06 Russian Diplo, RUS 1345 USB 6-MFSK/Mazielka 6 tone selcall "164532" s/off 1350


new CTP93I - CTP94I - CTP95I - CTP96I

25 June 2015

SERDOLIK sync marker (idling)

24/06/15 16047.0 --- Russian Gov 0918 Serdolik sync marker




The sync marker sequence is sent alone or after a Serdolik Selcall as shown below

Serdolik Selcall and Sync Marker (courtesy of KarapuZ)
Serdolik, as several time reported in this blog, is a complex system used by Russian Gov/Diplo and designed to connect embassies and diplomatic missions. The link below is a little story of this system:
http://www.sozvezdie.su/museum/sura__posolskaya_svyaz_dlya_sssr/ 
Thanks to KarapuZ for the link and the Sedolik Selcall waveform.

24 June 2015

Logs

24/06/15 16047.0 --- Russian Gov 0918 Serdolik sync marker idling
24/06/15 16108.2 --- Russian Mil 0800 USB MFSK 34+34 47 Bd
24/06/15 15643.0 --- Russian Mil 0725 USB CIS-45 OFDM 45-tone HDR modem v2 stream
23/06/15 15927.2 --- Unid NATO 1310 USB STANAG-4285 600bps/L short KG84 messages
23/06/15 16147.5 --- Unid NATO 1250 USB STANAG-4285 null traffic
23/06/15 14485.0 --- Russian Mil 0645 Moroz-2 FSK 50Bd/500
22/06/15 14460.2 --- Russian Mil 1210 USB CIS-3000 PSK-8 3000Bd, msgs at irregular intervals
22/06/15 14346.0 HB9MHB HF Network 1203 USB MIL 188-141A sndg
22/06/15 09904.5 --- Unid NATO 1140 Nato-75 75Bd/850 krypto
22/06/15 15785.0 --- Unid 0645 USB Pactor-III messages

21 June 2015

short log

19/06/15 12599.6 UAT Moscow radio, RUS 1202 CW id "DE UAT"
19/06/15 14786.0 --- unid 1135 USB MIL 188-110A/2400bps voice
19/06/15 14425.0 X06 Russian Diplo, RUS 0655 USB 6-MFSK/Mazielka 6 tone selcall "213546" s/off 0700
18/06/15 14350.0 --- North Korean Diplo, PRK 1235 LSB FSK ARQ 1200Bd/1200 (DPR-ARQ)
18/06/15 10146.0 HB9AK Winlink Mail Server 0700 Winmor-500
17/06/15 04249.0 HEB24 Global Link Bern, SUI 2150 USB Pactor-III traffic
17/06/15 14900.0 SPT424 Polish Military, POL 1405 USB MIL 188-141A SNB813 handshake

20 June 2015

WINMOR-500

18/06/15 10146.0 HB9AK Winlink Mail Server 0700  Winmor-500

The WINMOR (WINlink Message Over Radio) protocol is intended to be used for sending messages and binary data error free over a HF radio link. It is a Selective Repeat Automatic Retry reQuest (SRARQ) protocol where the Information Receiving Station (IRS) acknowledges receipt of the data to the Information Sending Station (ISS). Normally during a connection session the IRS and ISS exchange roles multiple times. The protocol is designed to handle the type conditions normally encountered in amateur radio transmission. WINMOR is not optimized for keyboarding or chat mode applications though this may be possible.

The WINMOR protocol uses basic OFDM (Orthogonal Frequency Division Multiplexing) modulation and a number of modulation modes and error correction schemes to adapt to changing channel conditions.
There is currently 2 operating bandwidths of 500 and 1600 Hz (@ 26 db below peak power output:
  • 500 Hz BW 2 carriers 46.875 Baud 4FSK or 93.75 baud PSK
  • 1600 Hz BW 8 carriers 46.875 Baud 4FSK or 93.75 baud PSK
Pic. 1a - WINMOR-500 data frames
Pic. 1b - 4FSK grid

I recently heard (18 June, Pic. 1) the WINMOR 500 Hz bandwidth mode around 0700z on 10146.0 KHz (center frequency). As said, the 500 Hz bandwidth mode use 3 modes PSK:
- 4PSK TCM, 8PSK TCM, 16PSK TCM  - 2 Carriers at 1406.25 Hz and 1593.75 Hz
and one 4FSK mode:
- 2 groups of 1 of 4 Carriers. (2 carriers active simultaneously)
  Group 1: 1312.5, 1358.375, 1406.25 and 1453.125 Hz
  Group 2: 1546.875, 1593.75, 1640.625 and 1687.5 Hz

 
A WINMOR frame is composed of a Pilot ("leader" of the frame) and Data. The Pilot is used to enable rapid identification of a transmission, to DSP tune the receiving station accurately, to establish symbol and frame sync and to indicate the frame type:
Data frames:
- Two carrier 8PSK (Pic. 2)
- Two carrier 4FSK (Pic. 3)  
Control frames:
- Connect ReQuest frame: 2 Car 4FSK
- Coded Control Frame: 2 Car 4FSK (Pic. 3,4,5)
- Ack: 2 Car 4FSK FEC (Pic. 4)

- ID frame: 2 Car 4FSK (Pic. 5)

Pic.2 - 16QAM data frame
 
Pic.3 - 4FSK data frame and control frames

Pic. 4 - control frame and ACK frame
Pic. 5 - control frame and ID frame

17 June 2015

Harris RF-5800 'Selective Call', MSK 2000Bd/1000

('Systeme3000-ALE' equivocation)
 
(AngazU,I56578)

We recently had the opportunity to get and study the Harris Selective Call waveform (we name it as Harris-ALE but it's not its official name!): it's an MSK modulation at 2000 Baud speed, followed by short MFSK-8 125 Baud in non-standard MS-188-141A (ALE), acf is 50 ms (100 bit). We focused on the initial 3 seconds segment in order to define modulation mode and other features in order to help to clarify the above misunderstanding (see later).

At first glance it looks like a serial-tone signal: carrier frequency 1600 Hz and OQPSK modulation at 2000 Bd speed (pic. 1). As reported in this article by Sergey Makarov (SergUA6) http://signals.radioscanner.ru/info/item281/ "it is not easy to tell apart between QPSK and MSK since they are tightly connected".

Pic. 1- Harris Selective Call and its phase-plane
By measuring the main parameters of the signal we had (pic.2):


baudrate (Br) = 2000 Bd

bandwidth (Bw) ~ 3000 Hz

shift (Sh) = 1000 Hz

Pic. 2
That said, and according to what reported here http://signals.radioscanner.ru/info/item68/ we are pretty sure that the Harris Selective Call is not an OQPSK but rather an MSK 2000/1000 waveform, 2000Baud speed and 1000Hz shifted. As it is clearly visible in pic.2, are verified those relationships that are specific to MKS signals, i.e.: Bw = 1.5 Br and Sh = Br/2 as shown in the cited article (pic.3):

Pic. 3 - MSK relationships (from radioscanner.ru)

  
Moreover, into the Harris signal, there is another clue that points to MSK. As you can see in the picture 4, there is a long state staying in one frequency, if should it be PSK, the frequency should come back to carrier and stay there till a new phase change. 
 
Pic. 4


 The shape of the eye diagram (pic. 5) also points in this direction (MSK with BT = 0.3):

Pic. 5
The Harris signal has an ACF value of 50 mSec (100 bit) and it is characterized by the presence of what looks like a signature, something like a 'business card':

  
As said, this is a safe-origin signal since it was recordered some years ago during Harris RF-5800 acceptance tests: at that time it was supposed to be standard in Falcon-II series radios. Harris equipment is wide spread in NATO countries, but this mode, although available, seems to be not much used.

With these points in mind, we asked ourselves the question that we indicated at the beginning: the so-called Thales “Systeme3000-ALE” (reported also in a post on this blog) has a waveform that is very similar to the Harris-ALE' one, also aurally they just sound in the same way. Browsing the web, there are logs by listeners reporting both the signals: altought the Thales waveform be almost 99.99% OQPSK, may be the case that these two signals could be confused each other ?

16 June 2015

Logs

16/06/15 15680.0 --- unid Russian Mil 1140 USB CIS-45 v1 HDR modem 33.33 Baud, burst-mode
15/06/15 14720.0 001 unid 1310 USB MIL 188-141 ALE clg 002
15/06/15 14720.0 001NET2 unid 1308 USB MIL 188-141 ALE clg 002NET2
15/06/15 14720.0 001 unid 1305 USB MIL 188-141 ALE clg 002


(unid ALE IDs from two parrallel different decoders).

15 June 2015

French Navy Broadcast, FSK 50Bd/850


Signal caught on 12700.0 KHz (cf) on USB at 0905 UTC (14Jun15).
French Navy Bcast - the name is owned by the French Navy, a fairly standard set of parameters, except for the word length of 21 bits (can be clearly seen in pic 2 and 3) that can be used for identification. Standard ACF does not give conclusive results, I recommend to use a bitflow editor or VMW module of SA.

pic. 1
pic. 2
pic. 3

14 June 2015

Logs

13/06/15 18034.7 --- Unid Egyptian Diplo, EGY 0540 (USB 18033.0) SITOR-A clg unid Embassy TVXY
12/06/15 08950.0 342018 Turkish Civil Defense, TUR 2001 MIL 188-141A sndg
12/06/15 08950.0 123456 Turkish Civil Defense, TUR 1959 MIL 188-141A sndg
12/06/15 08950.0 334113 Turkish Civil Defense, TUR 1957 MIL 188-141A clg any-station
12/06/15 08950.0 370013 Turkish Civil Defense, TUR 1954 MIL 188-141A clg any-station
12/06/15 15818.0 CNC Algerian Air Force, ALG 0602 USB MIL 188-141A sndg
12/06/15 14430.0 CM6 Algerian Air Force Biskra, ALG 0550 USB MIL 188-141A clg HE3
11/06/15 12226.0 --- Unid NATO 0712 USB MIL 188-110A 2400bps/Voice LPC10/MELP vocoder

11 June 2015

Rohde & Schwarz GM2100 HF modem, "Signal Format"

(ANgazu, I56578)
Besides the well-known standards PSK-8 signals with carrier at 1800 Hz and 2400 Baud, there are variants and proprietary systems developed by several manufacturers either to meet specific needs or to maintain the prestige of the brand proprietary systems.
One of these proprietary signals is the R&S Signal Format developed by Rohde & Schwarz and included in several of its modems. The documentation available is limited, so this short study could fit into some not correct parameters.


Signal was heard using Twente-SDR on 8132 USB, this frequency allows to get the correct ALE 2G center frequency (1625 Hz). The user is the German Police, as clearly visible by decoding the ALE (MIL 188-141A) segment. More likely, the GM2100 "signal format" waveform is also used by the Italian GdF (Guardia di Finanza).

initial ALE segment, link between BPLEZS and BP2

 
The signal parameters are:

PSK-8 modulation at 2400 Bd
carrier frequency 1500 Hz In this recording)
ACF: 133.33 mS (superframe)

Frame: 26.66 mS (64 symbols, 48 data + 16 sync)
Superframe: 133.33 mS (5 frames)


As shown in the manufacturer's documentation, the preamble consists of three frames of 64 symbols, followed by the data blocks (48 + 16 symbols) and ending in another frame of 64 symbols:
 
ACF measurement

structure of the superframe
The superframe (due to the legth of the interleaver or scrambler) consists of five frames and originates the 133.33 msec ACF. As said, each frame is composed of 48 unknown + 16 known symbols (48/16). The initial preamble symbols (192) and the end of message symbols (64) are formed by specific sequences.
Feature of the R&S GM2100 HF modem can be seen here:

Logs

10/06/15 08446.5 HEB28 Global Link Berne, SUI 2110 PACTOR-III traffic
10/06/15 16342.0 --- Unid Russian Mil 1400 USB CIS-112 OFDM modem bursts (1 minute transmission)
10/06/15 11086.5 --- Unid 0606 USB HARRIS (?)/THALES(?) proprietary ALE 2000Bd [1]
10/06/15 15288.0 Unid Russian Mil 0555 USB AT3004D 12-tone HF modem 120Bd BPSK
10/06/15 13500.0 --- Unid Russian Mil 0540 USB CIS 3x100 VFT
10/06/15 09101.0 --- Unid NATO MIL Station 0530 DSB 2 x Link-11 CLEW

09/06/15 09181.0 PY50 Algerian Mil, ALG 2137 USB MIL 188-141A clg XS55
09/06/15 14738.0 --- Russian Intel 2100 XPA2 MFSK "09883 00001 00000 10140"
09/06/15 15945.0 --- Unid 0717 USB serial modem PSK-8 2400Bd msgs 


[1] will be discussed later

9 June 2015

Chinese mixed mode QPSK 2400Bd + MFSK-8 125Bd

As reported in the log of 5 June
05/06/15 16148.5 --- Chinese Mil 2105 USB mix mode: MFSK-8 (125/250) + QPSK 2400Bd
05/06/15 16148.5 D54 Chinese Mil 2103 USB MIL 188-141A clg N50
on 16148.5 USB I heard the callsign D54 calling N50 using the MIL 188-141A protocol, both the callsigns belong to a Chinese Mil network. After a few seconds the M188-141A was followed by an odd bursty waveform sounding like the previous ALE but un-decodable (signal 1 in pic.1).

Pic. 1
Talking with KarapuZ about this signal he told me that is a mixed mode QPSK 2400Bd + MFSK-8 125Bd used by Chinese Military (signal 2 in pic.1) and he provided me a recording of this waveform.
As said above, the MFSK segments are manipulated at 125 Baud and consist of eight tones, 250 Hz spaced, just like the standard MIL 188-141A (pic. 2); trying to decode it you do not get anything although the tones are in the expected position: k500 recognizes it as [AQC mode], but it's clearly wrong, while other deciders prints non-sense ASCII strings.

Pic.2 MFSK-8
Perhaps they do not use this MFSK waveform as an ALE resource since they just use the standard MIL 188-141A, as reported by many listeners and in my logs too.
About the PSK segments it was pretty easy to get its boudrate and carrier (2400Bd and 1800 Hz), unfortunatelly not the same thing for the phase-plane (pic. 3): a better signal could help.

Pic.3
Both the two recordings are downloadable from here:
https://www.dropbox.com/s/bvhodhs85wfekpy/mix%20mode%20chinese.wav?dl=0
https://www.dropbox.com/s/gg5mlbob31i00y9/05-Jun-2015-211122%2016.148500%20MHz.wav?dl=0 

8 June 2015

Logs

05/06/15 16148.5 --- Chinese Mil 2105 USB mix mode: MFSK-8 (125/250) + QPSK 2400Bd
05/06/15 16148.5 D54 Chinese Mil 2103 USB MIL 188-141A clg N50
05/06/15 16167.0 --- Russian Intel 2100 XPA2 MFSK "03720 00001 00000 10140"
05/06/15 12600.0 SVO Olympia Radio Athens, GRC 1315 USB Sitor-B 100/170 news bulletin in Greek // 8424.0

05/06/15 22471.0 NKW Diego Garcia US Navy 1220 F1B 50Bd/850 messages 
04/06/15 12226.0 --- Unid NATO 1300 USB MIL 188-110A 2400bps/Voice LPC10/MELP vocoder
04/06/15 10467.5 --- Unid NATO 1255 USB STANAG-4285 null traffic

04/06/15 14670.0 CHU Time Station Ottawa/ON CAN 0705 AM 1Khz offset time signal
04/06/15 12105.0 --- Unid 0645 (cf) 100 msec pips
04/06/15 17470.0 --- DOSC Moscow, RUS 0638 USB SERDOLIK, MFSK-34 mode
04/06/15 16333.0 --- Unid Egyptian Diplo, EGY 0630 USB Sitor-A clg unid TVQX "TVQX TVDS 66661"
03/06/15 16129.0 --- Unid 1255 USB Arcotel MAHRS-2400 EADS/RACOMS, ALE mode

02/06/15 19875.0 X06 Russian Diplo, RUS 0825 cf 6-MFSK/Mazielka 
6 tone selcall "125643" group 317, s/off 0840
02/06/15 16190.0 --- Russian Mil 0810 USB MFSK 34+34 s/off 0820
02/06/15 15062.0 --- Unid 0745 USB serial modem PSK-8 2400Bd msgs
02/06/15 12666.0 FUG12 French Navy, F 0720 USB STANAG-4285 600/L "FAAA DE FUG12"

testing "VOYEZ VOUS LE BRICK GEANT QUE J EXAMINE PRES DU GRAND WHARF"
02/06/15 11927.4 --- Unid 0715 USB STANAG-4285 600/L crypto
02/06/15 10165.0 --- Unid 0700 USB MIL 188 -110A 2400 bps short messages
01/06/15 15870.1 --- Russian Mil, RUS 0650 FSK 53.7Bd/500 reversals
01/06/15 14451.0 --- Russian Mil, RUS 0630 USB AT-3104 (CIS-12) PSK-2 120Bd traffic


Unid 0745 USB serial modem PSK-8 2400Bd
It's not so unusual to meet CIS-12 running with full carrier (at least here on 16603.0 USB)

the unid 100 mSec "pips" station