Quantcast
Channel: diario SWL I-56578 Antonio
Viewing all 622 articles
Browse latest View live
↧

wideband operations on 4950 KHz, new Harris wideband HF waveforms

January 23, 2019, 3:01 am
$
0
0

since few weeks me and my friend and colleague ANgazu are studying interesting wideband waveforms family spotted on 4950 KHz (central frequency), just in the middle of the 60 mt Broadcast band, these transmissions have been also reported here by our friend KarapuZ from radioscanner.  Monitoring was done thanks the KiwiSDR owned by WA2ZKD that can provide up to 20KHz IQ band http://rx.jimlill.com:8073/.

As shown in Fig. 1, they use Harris WB-ALE paradigm for call and link negotiation:
- STANAG-4538 FLSU initial call for link setup
- spectrum sensing to measure interference within the selected wideband channel
- new burst handshake exchanges spectrum sense measurements
- data exchange
- STANAG-4538 FLSU for link term

Fig. 1
The Harris wideband ALE approach and the 3G extensions for wideband have been previously discussed in this post.  

For what concerns tha data waveforms, we saw bandwiths from 3-24 Khz and modulations from PSK-8 to QAM-64 with a data rate from 75 to 120,000 bps.
Each transmission begins with a transmit level control (TLC) block to allow radio transmit gain control (TGC), transmitter automatic level control (ALC), and receiver automatic gain control (AGC) loops to settle before the actual preamble is sent/received. A variable length preamble for reliable synchronization and autobauding follows the TLC section and it's followed by ariable length frames of alternating data (unknown) and mini-probes (known) symbols: times vary depending on the combinations of speed and modulation.
Although the characteristics such as BWs, modulations and speeds are the same as those indicated in Appendix D of MIL-STD 188-110D (WBHF), these adaptive waveforms definitely do not belong to that standard. Indeed, as shown in the following figures (2-5), the waveforms exhibit a common structure consisting of a super frame which is formed of 8 frames probably related to the 8 different allowable bandwidths: a similar structure and the duration of the frames (i.e., the number of K and U symbols) are quite different from what is stated in the Appendix D.

Fig. 2 - 4800Bd/6KHz waveform
Fig. 3 - 7200Bd/9KHz waveform
Fig. 4 - 9600Bd/12KHz waveform
Fig. 5 - 16800Bd/18KHz waveform

The frames structures have been verified also by analyzing some streams after the demodulation of the signals: in figure 6 the result of the demodulation of a 9600Bd/12KHz chunk (in this case using PSK-8 modulation):

Fig. 6
When measuring  the symbole rate using the quadrature detector, an interesting pattern shows up: a repetitive 8 blocks group which are generated by miniprobes. Up to date, we know the "frequency" in these blocks is different for every speed, starting in lower freq and going upwards. In some modes a mirror image can be seen as in Fig. 7. This is an odd feature since it looks like miniprobes are not phase modulated as data are.

Fig. 7
The 8 different minprobes repeat in a particular series and are complicated to study, their structure point to a sequence (maybe using Walsh modulation?) that repeats 4 times: this pattern seems to be the same in all waveforms varying frequency/duration.
Fig. 8
We have other examples of such miniprobes but we prefer to postpone to a next post, if possible with more precise details. For this purpose, ANgazu and I would like to have some other better recordings (i.e., with IQ band > 20KHz) from friends in US so that we can gather more informations. Thanks!

https://yadi.sk/d/9Imj9tLkYZHGTQ
https://yadi.sk/d/cGzxKGCXHfUuFQ

↧
Search

8-ary constellation bursts at 12800bps data rate (3)

January 31, 2019, 12:57 am
$
0
0
This is a follow-up of the posts about the "clusters" of S4539 12800bps bursts, all posts including this one are grouped here.
Since a couple of days it's possible to hear both the peers, don't know if it's due to new test sites or increased powers but previously the "called" station was not heard (or maybe it did not even exist). As you see, the "called" listens on f2 while it simultaneously replies on f1 (the same for f2/f3 and in all the six clusters) as well as the "caller" station puts its call on f2 while it simultaneously listens on f1 (Fig. 1); the interval between the call and the reply is about 319 ms. Maybe they use staring and synched SDRs?

Fig. 1
This simultaneity is also noted between the lower frequency of a cluster and the higher frequency of the preceding one, as shown in Fig. 2. Particularly, Figure 3 shows the timings between the last and the first cluster (the different signal strengths in Fig. 3 depend on the different locations of the two used KiwiSDRs).


Fig. 2 - timings between two consecutive clusters
Fig. 3 - timings between the last and the first cluster
The raw demodulation exhibits strong 7680-bit period that make 1280 QAM64 symbols (Fig. 4).

Fig. 4


↧
↧

odd signals picked-up using the Arctic KiwiSDR

February 7, 2019, 2:10 am
$
0
0
7600 Hz wideband signals from (only!) Kiwi ArcticSDR and using single tone QAM-64 modulation at a symbol rate of 7200Bd. The signals seem to have specular positions of a "supposed" reference/pilot tone. Most likely, the signals "leak" out of wired high-voltage lines (PLC) running close the Bjarne's KiwiSDR.




https://yadi.sk/d/P_r6r69SqVf_3g

↧

unid signals from US KiwiSDRs by ANgazu & Rapidbit

February 18, 2019, 1:11 am
$
0
0
This signal was recorded tuning 5308 Khz and using some KiwiSDRs from the northeast of the US, mainly the one owened by K3FEF in Milford (PA). Since its various operating modes and its uncommon parameters, we decided to study it a little more thoroughly, leaving out the transmission purposes and the hypothetical users. The duty cycle of the signal is quite low so it took several hours of recording to collect signals suitable to be analyzed.

In the spectrogram of a recording we can see the bandwidth of the modes (Fig. 1). When several consecutive segments are transmitted, the separation between them is about 3m30s and the duration of the segments ranges between 94 and 106 seconds.

Fig. 1

mode 1
This mode has a spectral occupation of one 1000 Hz. The modulation is QPSK although with a notable majority of the symbols 0 and 2 and a speed of 600 Baud (Fig. 2). The ACF can be 840ms or 800ms and does not seem to transmit information, but seems  to be idling. After demodulation, bits aligned in frames of 1008 bits for ACF of 840 ms and 960 bits for ACF of 800 ms (Fig. 3).

Fig. 2
Fig. 3
 
mode 2
Its spectral occupation is about 1600 Hz. The modulation is QPSK with the same structure of mode 1, with a speed of 1200 Baud and an ACF of 420ms or 400ms. Also this mode exhbits a 1008 bits (960) frame with a very similar structure (Fig. 4).

Fig.4

mode 3
The modulation speed is 1200 Baud with a spectral occupancy of about 1400Hz. It is a GFSK with a shift of about 800 Hz andACF of 840ms or 800ms. The binary frame has a 1008 or 960 bits length (Fig. 5).

Fig.5
mode 4
The modulation speed is 300 Baud with a spectral occupancy of about 600 Hz. The modulation is an FSK with a shift of 400 Hz and an ACF of 3.35  or 3.2 seconds. Once demodulated, the frame is still 1008 bits or 960 bits just like the previous ones (Fig. 6).

Fig. 6
 
 
↧

STANAG-5030/MIL-188-140 VLF/LF multichannel broadcast to submarines (2)

March 2, 2019, 3:09 am
$
0
0
(this is a follow-up of the post published here)

The narrow 200Hz bandwidth for VLF/LF submarine broadcast and the low efficiency of the aerials are limiting factors, but the use of MSK (a form of QPSK) can allow optimum use of that narrow bandwidth. Indeed, using MSK it is possible to transmit two 100 Baud channels X and Y, each on a pair of phase, and each channel can consists of 2x50 Baud multiplexed channels. Thus, MSK can provide a TDM multi-channel broadcast of  up to 4x50 Baud within the 200Hz assigned band. These transmissions are easy to hear, either locally or, better, using remote SDRs such as the ones provided by Kiwi and thanks to the MSK demodulator coded by my friend Christoph [1] it is possible to study the bitstreams and verify their characteristics. 
The vast majority of users transmit four VALLOR channels (X1, X2, Y1, Y2), i.e. four 50 Baud channels which use KW-46 encryption system. In each channel, data are arrangend in the format defined by STANAG-5065 in which frames are delimited by the pseudo-random sequence generated by the polynomial x^31+x^3+1 ("Fibonacci bits"). Error Correction And Detection (EDAC) is performed using Wagner coding.

One of the examples of four VALLOR broadcast is the DHO38 station (Fig. 1): a VLF transmitter on 24.3 KHz used by the German Navy to transmit orders to submarines and navies of Germany and other NATO countries. Figure 2 shows the four X1, X2, Y1, and Y2 14-bit streams: the marked columns are the Fibonacci bits.

Fig. 1 - DHO38 constellation
Fig. 1 - the four VALLOR streams from DHO38

The most interesting subComm station is FUE French-Ny on 65.8 KHz from Kerlouan.

Fig. 3 - FUE constellation
As shown in Fig. 4, X1 and X2 channels use the same format of the French-Ny FSK 50/850 broadcast [2]. That format exhibits a characteristic 21-bit frame and, in a way similar to STANAG-5065, two/three sub-frames which are delimited by the bits of two LFSR markers M1 and M2 and a logical "1" value bit (1-bit). The sequences for the two markers are generated by the polynomials x^6+x^5+1 and x^7+x^6+1.
The other two channels Y1 and Y2 are sent using the S5030 VALLOR format (14-bit frames, KW-46 and Wagner coding).

Fig. 4 - the four streams from FUE
Don't know if it is their normal way to operate or it's just a coincidence, perhaps they use two channels for the shore-to-sub VALLOR boadcasts (Y1 Y2) while the other twos (X1 X2) are connected to the shore-to-ship broadcast, who knows?

[1] https://github.com/hcab14/signal-analysis/blob/master/m/demod_msk.m 
[2] http://i56578-swl.blogspot.com/2015/06/french-navy-broadcast-fsk-50bd850.html 
↧
↧

use of uuencode for email attachments (Swiss-Mil)

March 13, 2019, 10:12 am
$
0
0
This post is an update, mostly a deepening, of the posts published here and here with regards to the way of sending email used by Swiss-Mil. The idea came from a hint from my friend Mike "mco", whom I thank here.

When files, especially email attachments, are transmitted over links that do not support other than simple ASCII data, non-printable characters (for example, control characters) might be interpreted as commands, telling the network to do something. In general, therefore, it is not safe to transmit a file if it contains such characters. UUEncode (Unix to Unix Encoding) is a symmetric encryption based on conversion of binary data (split into 6-bit blocks) into 65 ASCII printable characters (from 32 to 96) and is just used to transmit binary files. 
A message encrypted by uuencode is easily identifiable: it begins with the line 
begin <mode> <name> 
where <mode> is the value of the access rights to the Unix file and <name> is the name of the file that will be created at decoding; the message ends with a line containing only "end". 
An example of the use of uuencode can be seen by analyzing some Swiss-Mil transmissions.
Figure 1 shows the data from a transmission, recorded on 09187.0 KHz/usb, as they appear after the removal of 188-110A overhead (the HF waveform) and the FED-1052 App.B DLP encapsulation (the Data Link protocol).
 
Fig. 1 - email inline attachment sent using UUEncode

Some data of the email are in clear text, in this sample:
ZJ1 root@bfzj1f1.is.bf.intra2.admin.ch, ZJ1 sender
ZA1 statist@bf.intra2.admin.ch, ZA1 recipient
email ID: "stat-ZJ1-20181113135501" (2018.11.13, time: 135501)

The contents are encrypetd using the "IDEA" algorithm (1) [1]:
EncryptionMode=CFB64, Cipher feedback (CFB) mode using 64-bit blocks
IDEAKeyId=20110404
InitialVector=10A2B70A51AACF17, 128-bit initialization vector (Message Indicator, MI)

The email attachment consists of the (encrypted) block between the lines:
begin 666 /tmp/CFB640250215BEAD7EF13EFAE90.dat
end
that clearly indicate that uuencoding is being used. More precisely, at receive side will create a file named CFB640250215BEAD7EF13EFAE90.dat with access rights 666 in /tmp directory. 

Since in all my samples the uuencoded filenames start with the cipher feedback mode CFB64 (see here) I tend to think that those files are first encrypted using IDEA algorithm then encoded by uuencode, according to the layers shown in Fig. 2.

Fig. 2
As ending note, it's interesting to notice that this method of message formatting is suggested for any email client or gateway that does not  support MIME and that long before the MIME format  there was just UUEncode. Maybe do they use old not-MIME Unix systems? Do they need to be compatible in all their networks?


(1) IDEA algorithm is developed at ETH in Zurich, Switzerland, and its patents are heald by the Swiss company Ascom-Tech AG. In year 2008 Ascom Security Solutions has been commissioned by Armasuisse (Federal Office for Defence Procurement agency for armaments of Switzerland) to deliver telecommunications equipment as part of the 2007 Armaments Programme.

[1] https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm

↧

Harris WB operations and UK MoD XMPP over HF: interesting confirmations

March 15, 2019, 8:18 am
$
0
0
Reading the Harris and Isode-Babcock presentations at the recent HFIA Meeting in San Diego, CA (February 14, 2019) I had an interesting feedbacks which could confirm the guess I did about:
1) new wideband HF waveforms tested by Harris (the analysis is posted here)
2) XMPP chat over HF by UK MoD (the analysis is posted here).



1) In the Harris presentation "Summary of Harris on-air testing of WBHF systems 2010-2018" you can read that since 2015 Harris began development of a WBHF Hybrid Automatic Repeat Request (ARQ) waveform for use on HF (WHARQ). It supports 3, 6, 9, 12, 15, 18, 21, 24 kHz. WHARQ is bundled in a new radio mode called 3G Wideband IP (3GWBIP) which has been tested extensively on the bench and over the air. On-air 3GWBIP testing took place on november-december 2018 using NVIS link and 150 Watt power.


As posted here, me and some friend of mine saw 3-24 Khz bandwith waveforms with modulations from PSK-8 to QAM-64 and data rates from 75 to 120,000 bps. Although the characteristics such as BWs, modulations and speeds are the same as those indicated in Appendix D of MIL-STD 188-110D (WBHF), these adaptive waveforms definitely do not belong to that standard. 
Maybe we just hear those WHARQ/3GWBIP waveforms?


2) in the Isode-Babcock presentation "UK Mod XMPP over HF Pilot" you find that UK MoD Funded Babcock to run an XMPP over HF trial using Isode XMPP Software. “Group Chat” provided by XMPP Multi-User Chat (MUC) is the core service Highly desirable to use Real Time Chat for Naval and Airborne communication when HF is the only available bearer. In the paper they presentred the trials run to evaluate viability of providing this service over STANAG 5066 ARQ.




 Well, I'm happy to see that this paper matches the results posted here.
↧

Aus ADF/ MHFCS FSK 600Bd/850 with KW-46 encryption

March 23, 2019, 8:51 am
$
0
0

Quite good FSK 600Bd/850 signal centered on 10405 KHz from Australian Defence Force (ADF/MHFCS), heard some days ago around 1630z using iw2nke KiwiSDR (center Italy). As reported in UDXF logs by Eddy Waters [1] [2], Australian Defence Force has changed the previous dual channel system (ISB) to two single channel with 4 KHz spacings: the lower of the 2 frequencies has a speed of 600 baud, while the higher is 50 baud. The shift in both cases is 850 Hz. As in the waterfall above, I did not hear the 50bd FSK signal 4 KHz above (i.e. on 10409 KHz): maybe it's missing? Eddy also logged 10405 KHz frequency reporting ADF MHFCS Humpty Doo as location of the Tx.

Fig. 1 - main parameters
After arranged the demodulated stream into a 7-bit format, it's possible to detect the presence of the sequence called "Fibonacci bits" originated by the polynomial x^31+x^3+1 and which reveals the use of KW-46 crypto device (Fig. 2) as per STANAG-5065 Annex-A:
"Encryption and decryption sall be provided by KW-46 interoperable cryptographic equipment operating in the 6.0 Stepped Digital mode. Encryption by the KW-46 equipment sall be coded in the 7-0 unit SART-TOP ITA2 alphabet. Encryption by the KW-46 equipment will result in bits 1 through 6 being encrypted and bit 7 (STOP) being replaced with an unencrypted and deterministic Fibonacci bit", where "Fibonacci bits = Deterministic unencrypted bits used by the KW-46 interoperable cryptographic equipment to provide synchronization defined by the polynomial x^31+x^3+1."
 
Fig. 2 - 7-bit frame delimited by KW-46 sync bit
As reported here, the lower signal in ISB mode was called "Rockwell CPU100", don't know if such nickname is still valid.

Humpty  Doo  Transmitting  Station  is  situated  on  an  almost  800 hectare parcel of land near Middle Point and is located approximately 50 kilometres east/ south east of Darwin. Run and point google Earth to 12°36'39"S   131°17'28"E.

Fig. 3 - Humpty  Doo  Transmitting  Station

↧
Search

CCIR-493 CODAN selcall FSK 100Bd/170 (4-digit IDs, 1000ms preamble)

April 1, 2019, 6:58 am
$
0
0

Several 3 KHz spaced channels which use the CCIR-493 CODAN Selcall FSK 100Bd/170 (4-digit IDs), spotted on 8MHz using Hong Kong KiwiSDR http://kb7gkh6.proxy.kiwisdr.com:8073.
The system is a synchronous system developed by the Australian CODAN PTY based on ITU Recommendation M.493 [1] [2], Digital selective-calling system for use in the maritime mobile service, and is very similar to GMDSS/DSC (Fig. 1).

Fig. 1- ITU M.493 FSK parameters
Each data byte consists of 7 data bits and 3 parity bits (10-bit error detecting code), thus the duration of each character is 100 ms. The first seven bits (1-7) of the code are information bits; bits 8, 9 and 10 indicate, in the form of a binary number, the number of B elements that occur in the seven information bits, a Y element being a binary number 1 and a B element a binary number 0. For example, a BYY sequence for bits 8, 9 and 10 indicates 3 B elements in the associated seven information bit sequence; and a YYB sequence indicates 6 B elements in the associated seven information bit sequence.

The bitstreams after demodulation, as the one reported in Figure 2, can be easily parsed according the Table A1-1 "Ten-bit error-detecting code" from ITU M.493-15: the table is published at the end of the post for your convenience. The seven information bits of the primary code express a symbol number from 00 to 127, as shown in Table A1-1, where:
– the symbols from 00 to 99 are used to code two decimal figures;
– the symbols from 100 to 127 are used to code service commands.


Fig. 2 - bitstream after demodulation of a CODAN Selcall
A preamble of dot reversals, to provide appropriate conditions for earlier bit synchronization and to allow for scanning methods, precedes the data block.
As I verified, in all these selcall messages the preamble consists of 50 changes between "0" and "1" i.e. 100 bits(!) and therefore it has duration of 1 second (as also shown in Fig.3). Note that the 100 bits length is not provided in ITU M.493-15 or in other similar documents; quoting a comment from my friend hf_linkz: "it all depends on how many freqs are in the scanning list of each radio of a net. It has to be long enough so radios can detect the preamble while scanning so then stopping on the channel for a decode. On my Codan 9360’s the value is 6 seconds and you can’t change it while on my Barrett 950 & Codan NGT-SR you can set manually the preamble length in seconds. I’m not sure but i guess the radios of this net are not scanning freqs at all, so 1 sec is prob the best value to optimize transfers/min ratio don't know the nature of this variation".

Fig. 3 - preamble duration
The preamble pattern is followed by a synchronization sequence called the "phasing sequence" in which the characters 125,109,125,108,125,107,125,106,125,105,125,104 are transmitted. The phasing sequence provides information to the receiver to permit correct bit phasing and unambiguous determination of the positions of the characters within a call sequence (remember that Y = 1 and B =0):

YBYYYYYBBY 125
YBYYBYYBYB 109
YBYYYYYBBY 125
BBYYBYYBYY 108
YBYYYYYBBY 125
YYBYBYYBYB 107
YBYYYYYBBY 125
BYBYBYYBYY 106
YBYYYYYBBY 125
YBBYBYYBYY 105
YBYYYYYBBY 125
BBBYBYYYBB 104

The phasing sequence is followed by the "call content" with addresses and command/control characters. The Specifier symbol establishes the general nature fo the call; these basic options are: allcall and selective call. The Address consists of a special symbol in the case of alcalls and the identification symbols for the required station for selective calls:

YYBYYYYBBY 123
YYBYYYYBBY 123
BYBYBBYYBB  74 called station: 7474
YYBYYYYBBY 123
BYBYBBYYBB  74
YYBYYYYBBY 123
BBYBBYYYBB 100
BYBYBBYYBB  74
YBYBYYBBYY  53 calling station: 5348
BYBYBBYYBB  74
BBBBYYBYBY  48

123 = Format: selective call to a particular individual station using the semi-automatic/automatic service
100 = Category: routine

Messages and "end of sequence” (EOS) follow.

downloads:
↧
↧

8-ary constellation bursts at 12800bps data rate (4)

April 5, 2019, 2:08 am
$
0
0
Just another followup about the 8-ary constellation bursts. By the way, I also want to point out the interesting work that Christoph is pursuing in his blog.

Recently, Martin G8JNJ pointed out two new series of bursts on 2501.2 KHz and 2668.2 KHz USB. Bursts are STANAG-4539 12800bps compliant and use 8 points of the outer ring of the QAM-64 constellation, just like those covered here. The timing of the bursts is a further analogy and appears "connected" to the two previous and following clusters (Fig. 1): this way - if my guess is confirmed- we have now a total of seven clusters, or sets, of channels.

Fig. 1
It's worth noting in the tables below that the sequence 2082.2->7822.2 KHz now lasts about 40 seconds (A-G) while the same sequence had previously (i.e. before the two new bursts appear) a duration of 36 seconds (A-F). Therefore, since the introduction of the 2501.2 & 2668.2 KHz bursts have affected the duration of the 2082.2->7822.2 KHz sequence, I'm quite positive that all the bursts belong to the same sequence. But it's just a my guess.


 
Fig. 2 - the whole sequence A->G

downloads:
https://yadi.sk/d/RlxGYd3sYkWH-A
https://yadi.sk/d/ozXrjS54njfLGw
↧

Harris wideband operations, WHARQ and WBALE waveforms (2)

April 16, 2019, 2:13 am
$
0
0

Recently we had the chance to monitor and record the wideband transmissions on 7.9 MHz thanks to the use of four fairly close together KiwiSDRs [1] (we think transmitters use low power and NVIS) and this allowed us to have a better understanding of the whole scenario.
The data waveforms occupy a bandwidth from 3 to 24 KHz (grouped together under the title, courtesy of radiofrecuencias.es) and use an adaptive ARQ pattern with modulations from PSK-8 up to QAM-64. As said, most probably they are part of the Harris WHARQ development: a proprietary wideband HF waveforms family, already discussed here and largely discussed by my friends ANgazu, Malak and Rapidbit inradiofrecuencias forum [2]. The burst waveforms are the WBALE PDUs, i.e. the Harris design choices for the implementation of 188-141D extensions for 3GWB mode [3]. 
 
Fig. 1 - spectrogram of a WHARQ waveform (credits to ANgazu)
WHARQ waveforms have a preamble/header followed by slots of miniprobe and data, 8 slots make a frame (or 8 frames grouped into a super-frame). Header modulation is always PSK-8 and it's followed by a "double" miniprobe. The duration of the header relies on the speed of the waveform (baud rate) and not depends on the used modulation. Frame is made up by 8 slots (data + miniprobe) consisting of 8 different miniprobes for each frame. ACF varies depending on modulation and baudrate. For further details on WHARQ I suggest to read the relevant posts and analysis in radiofrecuencias forum, here I focused on the WBALE bursts.

A quite clear WBALE/WHARQ scenario is visible in the IQ recording below in Figure 2:

Fig.2
The upper bursts are 3G STANAG-4538 BW5 and BW6: BW5 is used for Fast Link Setup (FLSU) and BW6 used as acknowledgemts PDUs. Lokking at these samples, in my guess it seems that BW6 ACK is used with 3 KHz WHARQ waveforms and a proper WHARQ ACK burst is used with wider waveforms. 
Harris approach for 3GWB is based on a simple enhancement to the Fast Link Setup protocol defined in STANAG 4538. The primary modification is the use of an additional 3 kHz bandwidth burst handshake (WBALE HS in Fig. 3) which exchanges profiles of the two linking radios' locally measured interference environments and negotiates a waveform bandwidth, offset from the specified channel frequency, and modulation and coding selection suitable for reliable high-performance communications.

Fig. 3 - Harris WBALE (not in scale!)

The WBALE handshakes are clearly visible in Fig. 4, it's worth noting the change of the traffic waveform after bandwidth negotiation:

Fig. 4 - WBALE handshakes

WBALE PDUs are very similar to BW5 FLSU PDUs so I analyzed them using a 3G demodulator: the following are therefore my hypothesis that need further confirmations.
 
Fig. 5 - WBALE waveform
The PDUs have a duration of 525ms and consist of 1216 PSK8 (2400Bd on-air) symbols: 256 PSK8 symbols (768 bits) for the preamble which is followed by 960 PSK8 symbols (2880 bits) for the ALE payload. I don't know, though it's likely, if the preamble is preceded by one or more short TLC blocks (they might be ignored by demodulator).Since Harris WBALE it's 3G based, i.e. network participiants are synched, I do not think to "variable" length PDUs to best fit the scanning lists: there is no need since the peers are already linked by the previous BW5 FLSU handshakes (this means that WBALE bursts are not "caller" PDUs!).

1216 symbols @ 2400Bd are well suited to the duration of 525 ms
After a raw PSK-8 demodulation the payloads show a 3-bit structure (Fig. 6) and are possibly modulated using a Walsh function: it's difficult to establish the actual length of the payload since FEC coding and Walsh format info missing (by the way, payloads could be descrambled using the polynomial x^4+x^3+x+1 to obtain a 12-bit stream... but it's just a speculation!).  

Fig. 6 - payload 3-bit structure after raw psk8 demodulation

WBALE/WHARQ transmissions was spotted on 4 and 7 MHz bands, the former on 4950 KHz i.e. in the 60mt broadcast band: the choice of these HF portions is probably linked to the concept of "primary and secondary users" [4]. This concept has been borrowed from the cognitive radio paradigm which divides users into primary users (licensed) and secondary users (unlicensed). Primary users “own” the bandwidth allocation while secondary users are only allowed to use this spectrum in a non-interfering basis. 
a) For WBALE primary user mode, stations that link for the purpose of transferring data will use a bandwidth and offset in each direction that is chosen to maximize the signal-to-noise ratio (SNR) with which transmissions in each direction are received. Stations will avoid
interference with other stations within the same network, but will make no effort to prevent interference with other stations outside the network, except as a byproduct of optimizing communications within the network.  This can have at least two significant implications:
1. the bandwidth and offset used in each direction of the link may be different;
2. the stations may cause harmful interference to communications in other networks while themselves not experiencing harmful interference. 
b) In secondary user mode, stations will not (as far as is practical) cause interference to other stations outside the network that are operating within the same channel allocations used by the network. In particular, whenever a link is established for a wideband data transfer, the bandwidth and offset used for the link will be chosen so as to avoid interference with any transmission detected by either side. Due to hidden-node considerations, this is likely to require that the same bandwidth and offset be used in both link directions.  
As a side note, remember that WBALE (or 3GWB) is not WALE (or 4G-ALE): they use different waveforms.
(to be continued)
 
spectrum sensing performed by a Rockwell Collins modem (2013)

[1] thanks to the owners of the KiwiSDRs
http://eemedia.mynetgear.com:8073/
http://n4ttn.ham-radio-op.net:8073/
http://rx.jimlill.com:8073/
http://38.86.67.206:8078/

[2] http://radiofrecuencias.es/viewtopic.php?f=11&t=1204&hilit=wharq 
[3] http://i56578-swl.blogspot.com/2018/04/3gwb-3g-ale-extensions-for-wideband.html 
[4] William N. Furman, John W. Nieto, Eric N. Koski: The 10th Nordic Conference on HF Communications, At Fårö, Sweden (2013)
↧

9MR Royal Malaysian Navy, simultaneously on two FSK channels

April 27, 2019, 1:42 am
$
0
0
"RY/SG" test tape continuously transmitted by 9MR Royal Malaysian Navy (RMN) [1], spotted thanks to the KiwiSDR owned by SWLOI33 in Jakarta, Indonesia. The interesting aspect is that the test is transmitted simultaneously on two FSK channels, 2 KHz away: 50Bd/900 on 6483 KHz and 50Bd/1800 on 6485 KHz (Figs. 1,2).

Fig. 1
Fig. 2
The text is tramsitted in blocks of 718 bits using 5-bit ITA2 (Baudot) alphabet, most likely with a 5N1.5 framing which results in alternation of stops with a length of 2 and 1 bit when parsed by the editor (Fig.3).
"JULL JULL 9MR 5/9/10 RMMJ MRB MRB RYRYRYRYRY 9MR 5/9/10 RMMJ MRB MRB SGSGSGSGSG AR" 
 
Fig. 3
The different strength of the received signals leads to think that the two channels are transmitted from two different locations; this is even more evident in Fig. 4, relating to a recording made some hours later at 2109Z.
 
Fig. 4

↧

OFDM-30 (+1 pilot, +2) MSK 50Bd possibly Chinese modem?

May 1, 2019, 3:24 am
$
0
0

The signal was recorded at 8403.5 KHz (CF) thanks to the use of some KiwiSDRs [1], it occupies a bandwidth of 2500 Hz  and seemigly consists of 35 tones (Fig. 1a). The lower tone (in case of USB) most likely is the "pilot" one, used for Doppler correction, and its level is 7 dB higher than the normal level of any one of the the remaining 34 tones (Fig. 1b). The pilot seems followed by four tones: actually two PSK2 channels modulated at 25 and 50 Bd.
The remainig 30 tones are used for data transfer, they are ~71 Hz spaced and are formed using the OFDM technology. Curiously, the transition from idle/data phases does not happen simultaneously for all the channels, the delay is approximately 3500ms starting from the lowest channel (Fig. 1c). 
A similar multi-channel signal was already meet here (thanks pir3 for his comment in twitter).

Fig. 1a
Fig. 1b
Fig. 1c

The two lower 25Bd and 50Bd PSK2 channels after the pilot tone send a continuous sequence of zeros and ones which is most likely used for sync purposes.

Fig. 2a
Fig. 2b

The analysis of the 30 data tones shows a 4-ary constellation in absolute mode and a 2-ary constellation in relative mode (Fig. 3), therefore in my opinion these tones are keyed using MSK modulation with symbol-rate of 50 Baud and 25Hz shift; the analysis of a single tone confirms my guess (Fig. 4). No particular patterns were detected during the data phase.

Fig.3
Fig.4

For what is worth, the demodulation of each single channel results in a 100-bit period stream (Fig. 5).


Fig.5
Signal localization is rather difficult, indeed several TDoA runs result in the middle of nowhere in Pacific Ocean (Fig. 6).

Fig.5

↧
↧

why use of scrambling

May 15, 2019, 5:24 am
$
0
0
Some days ago a friend of mine drop me an email asking about a signal recorded at 428 MHz. It's clearly an FSK modulation (probably GFSK) at the rate of 318124 bps as shown in Fig. 1, but the most interesting aspect was pointed out to me by my friend KarapuZ: he suggested me to investigate the signal in order to detect the presence of a scrambler. Indeed, after demodulation of the signal I found that a scrambler described by the polynomial x^9+x^4+1 was used.
 
Fig. 1
In normal usage, scrambling is used for two reasons:

1) it is used to remove the possibility of a long sequence of 1's and 0's in the bit sequence. The long sequence of 1's and 0's make timing synchronisation and clock synchronisation tougher at the receiver as regular transitions help in working of adaptive circuits like AGC and phase locked loop;
2) it eliminates the dependence of signal's power spectrum on  the transmitted information sequence thereby keeping it below the maximum power spectral density requirement. If scrambling is not done, power might be concentrated in a narrow frequency band thereby causing intermodulation and crossmodulation distortion to adjacent channels.

As a proof, KarapuZ kindly sent me two synthesized FSK signals: with and w/out the use of a scrambler. The used source bitstream and modulation are just the same of the real 428MHz signal. As you can easily see, the bitstream structure, if not scrambled, introduces an imbalance in the formation of the spectrum by a modulator (Fig. 2a) and the pseudo-random sequence originated by the scrambler "aligns" the spectrum (Fig. 2b): that's useful to us in order to understand the formation of signals. 
For the sake of completeness, the spectrum of the 428MHz signal is shown in Fig 2c: note also that in the synthesized signals the Gauss filter was not used.

Fig. 2a - unscrambled signal, unbalanced spectrum in its low part
Fig. 2b - same signal when scrambling is used
Fig. 2c - 428MHz signal
The same motivations seen above also apply to more complex signals which use PSK-n modulation.

Just to complete the analysis of the 428MHz signal, the source bitstream got after descrambling shows a 3420/6840 bits period that can be reduced to 18/39 bits patterns (Figs. 3,4).

Fig. 3
Fig. 4
 
↧

KW-46 secured traffic over 188-110A, prob. US/Australian NCS HEH

May 18, 2019, 6:08 am
$
0
0

These signals were recorded and monitored on 14462.0 KHz/USB thanks the KiwiSDRs at OI33 and OI33SA in Jakarta, Indonesia:

behavior and waveform Transmissions take place mainly during the morning time UTC, probably scheduled from Thursday to Saturday, and consist of very long traffic sessions (although not continuous, as S4285 broadcasts are) alternated with equally long idling sequences. Several times I went late on the signal and given the lack of preamble re-insertions in the 110A waveform, the acquisition of sync, and the consequent decoding, were impossible. After days of long monitoring I had the chance to record the start of a transmission and then identify the mode, i.e.: 600bps/Long.
Since the absence of any "ALE phase" in the time interval immediately preceding the start of the transmission (Fig. 1), it's difficult say if we're dealing with PtP or broadcast transmissions to staring receivers in standby.

Fig. 1
The analysis of the frame structure (Fig. 2) confirms 110A operations at low datarates: each frame is composed of 40 tribit symbols, or 120 bits, (20 symbols for miniprobe + 20 symbols for data). In low datarate modes, from 150 to 1200 bps, the 480-bit length of the 110A scrambler exactly matches four frames (i.e.: 4 x 120 bits) and so it produces the strong 66.67ms spikes which are visible in the auto-correlation function.

Fig. 2
bitstream analysis The most certainly interesting aspect is the use of KW-46 encryption to secure data transfers (Fig. 3). Usually, the KW-46 crypto device is used in USN/NATO fleet broadcast paired with FSK 50Bd/850 or S4285 modems: it's the first time I see KW-46 secured traffic carried on air by 188-110A.

Fig. 3 - Fibonacci's bits in the demodulated bitstream
source and user As for the signal source, although the TDoA algorithm may be inaccurate due to the few KiwiSDRs in that region, considering the use of KW-46 crypto devices a plausible hypothesis can be the Royal Australian Navy (RAN) Naval Communication Station "Harold E. Holt" at Exmouth (NCS HEH) [1]. Royal Australian Navy is the naval branch of the Australian Defence Force (ADF).

Fig. 4 TDoA result and HEH site

NCS HEH is a joint US/Australian radio relay station comprising three separate main areas: Area A (Register no. 103552), located at Cape Murat, the VLF facility comprises the Very Low Frequency Transmitter, a deep-water pier, the primary Power Plant and a POL Tank Farm; Area B (Register no. 102767) includes Administration and HF Transmission; and Area C (Register no.103554) HF Reception. Areas "B" and "C" facilities are dedicated to point to point communication circuits. These circuits are established with shore facilities and navy surface ships operating within the station's area of communications responsibility. 


https://yadi.sk/d/xOD5_rlCK2I5NA
↧
Search

THALES HFXL, "wide band link" phase? (tentative) AngazU, i56578

May 22, 2019, 3:33 am
$
0
0

In our recent THALES HFXL monitorings we noted an initial "leader" burst which is exchanged in each frequency of the channel between the peers, the exchanges occurs after the 2G-ALE phase and just before the traffic starts: in our guess it appears to be the "wide band link", i.e. the third step of the HFXL link establishment procedure.
The used waveform is the same of HFXL-S4539: you may note the presence of the Thales "extented" preamble in Fig. 1

Fig. 1 . the presence of the THALES extened preamble following the S4539 normal preamble
It's interesting to note that after removing the mini-probes, the data blocks symbols show a regular structure of 768 bits (!), i.e. the 256 tribit data symbols of the S4539 framing appear as composed of repeated sequences/data; indeed, such a perfect 768-bit period does not occur in cases where user data such as chat, HTML, FTP, emails,... are sent. The presence of such repetitions is also clearly visible at a glance in the bistream (Fig. 2).

Fig. 2
Another clue in favor of repeated sequences in the data blocks is the ease with which the autocorrelation of 27648 bits is detected (Fig. 3): that's the length of the inteleaver block and just thanks to repeated data that it's possible to mark it. Also, the strong result of the autocorrelation leads to think of the use of Walsh Orthogonal Modulation, although it's not provided in S4539. Indeed, the detection of the interleaver length is facilitated because the last di-bit in any interleaver block is identified by the use of alternate set of Walsh sequences.

Fig. 3 - result from the autocorrelation
AngazU edited a header to eliminate the miniprobes (roughly)  and the resulting ACF is 26.6 ms considering both polarities and 13.3 ms considering only one. This indicates that it could be a walsh code of 32 symbols that is repeated inverted (Fig.4): 64 (32+32) symbols lasting ~26.6ms makes a data rate of 2400 Baud.
But be careful, it's just a speculation! We'll need a good quality recording to demodulate it and to verify it at  bit level.

Fig. 4

From the above, we think that the initial bursts use Walsh modulation and are used as a negotiation phase before the traffic starts: possibly we are facing with the "wide band link" (Fig. 4) that makes use of the "Cognitive Engine" software during the link establishment procedure, taking into account information on MUF, requested SNR, noise level, propagation modes, antenna performances.
As said, the above are only our hypotheses, we do not yet have any confirmation of them. Comments are welcome.

Fig. 4 - HFXL link establishment procedure

↧

KG-84, KW-46, ...

May 24, 2019, 1:40 am
$
0
0
In this blog I often use terms like "KG-84", "KW-46", "BID",..., as well as the names of other cryptographic devices, but this does not necessarily mean that those devices are physically used ashore or on aboard of ships! Rather than to the equipments, those names must be understood as referring to the used "algorithms", since - unless few exceptions - many of those devices are now obsolete and no longer used. Actually, the algorithms are emulated by interoperable and more compact devices such as - for example - the KIV-7M Programmable Multi-Channel Encryptor that can be used for communicating with a KIV-7 family device or the older KG-84/BID family of devices.
In general:
KG means Key Generator which could be used with any digital input device;
KI is for data transmission;
KW is the prefix for a Teletype encryption device;
KY stands for a voice encryption device. 
Also note that these products are only used by the US Government, their contractors, and federally sponsored non-US Government activities, in accordance with the International Traffic in Arms Regulations (ITAR), as well as by NATO and by the administrations of some NATO countries.

↧
↧

KW-46/KIV-7M secured fleet broadcast using the GA-205 multiplex (Australian RAN)

May 28, 2019, 9:56 am
$
0
0

This is a very interesting STANAG-4285 signal spotted on May 24 on 6378.0 KHz USB thanks to the KiwiSDR owned by VK6QS in Collie, Western Australia. About the 6378 KHz, some old WUN logs report the callsign VZD800, at that time attribuited to the Royal Australian Navy (RAN). On my side, on that same frequency I spotted the Australian MHFCS net operating in ISB/FSK: so, as also confirmed by the direction finding, the source is definitely in Australia. 
In my opinion, I believe this is a KW-46 (or KIV-7M) secured multichannel fleet broadcast originated by the GA-205 TDM [1]: a 12-channel time division multiplexer that was just deployed at RAN by DRS Technologies (Fig. 1).

Fig. 1

Now, the way I came up to this conclusion.
The HF waveform is STANAG-4285, here used in the usual "600bps/Long" sub-mode (Fig. 1): waveform that is easily recognizable and then demodulable by almost all software decoders. Given the evidence of regular patterns, I reshaped the demodulated stream to a 12-bit format, just as the number of the input ports of the GA-205 TDM. After reshaping, you can clearly see that the 12 input channels transport exactly the same data (Fig. 2).

Fig.2
Then I exctracted a single payload (i.e. a column of the stream), reshaped it to a 7-bit frames format and tested it for LFSR delimitation: as expected, the KW-46 "sign" was detected (Fig. 3). Indeed, as from STANAG-5065, the "Fibonacci bits" originated by the polynomial x^31+x^3+1 are used by KW-46 cryptographic equipment to provide  synchronization.  

Fig.3
In synchronous mode the TDM works by the muliplexer giving exactly the same time slot to each device connected to it even if one or more devices have nothing to transmit. The data rates of different input devices control the number of the slots: a device may have one slot, other may have two or three according to their data rate. In this case, all the input channels have the same data rate of 600:12=50 Baud, therefore share the same number of slots.  Managing a TDM requires that some control bits (sync, device tagging, ...) be appended to the beginning of each slot, but I did not find such bits in the streams I demodulated: a recording of the initial part of a similar transmission could help.

From what above, in my opinion the heard S4285 transmission is a fleet broadcast consisting of 12 "flat multiplexed"[2] channels that transport the same KW-46/KIV-7M secured payload (real traffic or pseudo-random chars).

Monitoring the 6378.0 KHz frequency, on May 25 I saw that they switched to the ISB mode (Fig. 4), more precisely: LSB for a single channel fleet broadcast and USB for a multi channel (GA-205 TDM) fleet broadcast; both the broadcasts are KW-46 secured and use the same STANAG-4285 600bps/L waveform. Don't know if they carry the same payloads. 
The same STANAG-4285 configuration and broadcast paradigm were also spotted on 7462.0, 8460.2, and 10847.2 KHz (logged on May, 28): surely there are other operating frequencies that I do not currently know.


For what concerns the source of the signal, TDoA direction findings indicate the "Naval Communication Station Harold E. Holt" (NCS HEH) which is located 6km north of Exmouth (Fig. 5). COMMSTA HEH is jointly manned by Royal Australian Navy and US Navy Personnel. The High Frequency Transmitter (HFT) site building houses a number of transmitters, many of which are dedicated to point to point communication circuits. These circuits are established with shore facilities and navy surface ships operating within the station's area of communications responsibility.
My friend Eddy Waters (member of Utility DXers Forum) from Australia emailed me: "there seem to be transmitter site changes happen at different times of the day. Sometimes these signals come from Exmouth Western Australia, sometimes from Lyndoch, New South Wales, sometimes from Humpty Doo, Northern Territory. There are more and more frequencies changing over to the ISB STANAG setup that you describe".
 
Fig. 5

As far as I know, RAN fleet broadcasts come in using the GA-205 in a 6-channels configuration, it's not clear to me the use of 12-channels that - moreover- transport the same payload. I tried to reshape the stream to a 6-bit frames format (and 6-bit multiples)... but the KW-46 synch missed. By the way,  it's interesting to mention the KW-46 secured transmissions (probably also them from RAN) reported here: https://i56578-swl.blogspot.com/.../kw-46-secured-traffic-over-188-110a.html
 
[1]  https://www.yumpu.com/.../ga-205-time-division-multiplexer
[2] I used the term "flat multiplexed" to mean the fact that no classified multiplexing algorithm seems to be used.

↧

STANAG-4285 1200bps/L in async mode

June 3, 2019, 3:39 am
$
0
0

Interesting recording of STANAG-4285 1200bps/L blocks which transport 8N1 framed streams (async ops).

Fig. 1
After demodulation (I preferred to use my Harris RF-5710A modem), each block consists of 476 bytes of data and share the same header (Fig. 2):
00 52 00 00 A4 3A 29 21 5C F0 01 4C 00 00 00 00 00 00 00 F2 40 19 77 E6 ...
don't know what the "signature" could be (encryption, compression, protocol encapsulation...), anyway the messages are not sent in clear-text.

Fig. 1
Recording picked up on 7559.0 KHz/USB using http://swloi33.proxy.kiwisdr.com:8073/ 

https://yadi.sk/d/ceWfDANNQF9yIw
 
↧

XMPP over HF radio using STANAG-5066

December 12, 2018, 5:00 am
$
0
0
(updated)

Interesting transmissions spotted on 4381.0 KHz and 4833.5 KHz (all usb) consisting of MIL 188-110A Serial HF waveform (fixed 600bps/S) and 6-bit code clear text (6x28) & STANAG-5066 as bearer for XMPP Multi-User Chat (MUC)  messages.
XMPP, the Internet Standard eXtensible Messaging and Presence Protocol, is the open standard for Instant Messaging (IM), Group Chat and Presence services. XMPP is widely used for military deployments, where operation over constrained and degraded networks is often essential, particularly for tactical operation. 
Multi-User Chat (MUC) is a central service for military communication. If data is being provided, it makes sense to share it so that all interested parties can see it. For example, it will enable external strategists or lawyers to observe communication in real time, and provide input as appropriate. It often makes sense to share information in the field, for example a group of ships jointly working out who will target what and how. MUC is an important operational capability. 
In XMPP a client connects locally to its server, and then there are direct server to server connections (S2S) to support communication with clients on other servers. The mapping of XEP-0361 (Zero Handshake Server to Server Protocol) onto STANAG-5066 is standardized in "XEP-0365: Server to Server communication over STANAG-5066 ARQ”. XEP-0365 is mapped onto the S5066 SIS and transferred using RCOP protocol.
The 6-bit text and S5066 bitstream (Fig. 1) is obtained after demodulating the 188-110A Serial waveform:
 
Fig. 1
S5066 peers have the addresses 010.050.066.001 and 010.050.066.003 (odd) in 4381.0 KHz channel; the addresses 010.050.066.002 and 010.050.066.004 (even) are used in the 4833.5 KHz channel. These are probably "exercise" addresses since the block 10.50 is allocated to Uganda. 
These transmissions have been monitored for about one day so I could collect hundreds of messages, only some of them are shown below as examples: you can see groupchat messages, Instant Messaging (private messages) and Presence/IQ messages. My friend and colleague Guido @decodesignals logged same transmissions (and same addresses) on 4613.0 Hz, in his catches the S4539 4800bps is used as the HF waveform.

<message
    from='latency.ground@ground.net/2aad61419fb06287'
    to='latency.p8-one@p8-one.net'>
    <body>
    (a3d5bb51-70c3-4152-9a29-ab7cddbb47a3; 20181207T224101.034169)
    Test Message H - Private Message From GROUND Latency Acct
    </body>
    <securitylabel xmlns="urn:xmpp:sec-label:0">
    <displaymarking bgcolor="green">UNCLASSIFIED</displaymarking>
    <label/></securitylabel>
</message>

<message
    from='mission-one@chat.ground.net/LATENCY_GROUND'
    to='mission-one@chat.p8-one.net'
    type='groupchat' id='fmucinte54838a0b2804718'>
    <fmuc xmlns='http://isode.com/protocol/fmuc'
    from='latency.ground@ground.net/8f9f7ba5ca23d374'
    sync_stamp='2018-12-07T22:44:52Z'/>
    <body>
    (29f06ec4-a4a9-4849-bd46-42c54efa42ea; 20181207T224452.309137)
    Test Message T - MUC From GROUND Latency Acct
    </body>
    <securitylabel xmlns="urn:xmpp:sec-label:0">
    <displaymarking bgcolor="green">UNCLASSIFIED</displaymarking>
    <label/>
    </securitylabel>
</message>

<iq
    from='mission-one@chat.ground.net/LATENCY_GROUND'
    to='mission-one@chat.p8-one.net/Supervisor Air'
    type='get' id='d98686c2-d66f-4bdc-9b4e-ceb9911c834e'>
    <query node='http://swift.im#3ScHZH4hKmksks0e7RG8B4cjaT8='
    xmlns='http://jabber.org/protocol/disco#info'/>
</iq>

<presence
    from='mission-one@chat.ground.net/LATENCY_GROUND'
    to='mission-one@chat.p8-one.net/LATENCY_GROUND'
    id='fmucint0e52f98befac3522'>
    <fmuc xmlns='http://isode.com/protocol/fmuc'
    from='latency.ground@ground.net/8f9f7ba5ca23d374'/>
    <x xmlns='http://jabber.org/protocol/muc'/>
</presence>

<presence
    from='mission-one@chat.p8-one.net/LATENCY_AIR'
    to='mission-one@chat.ground.net/LATENCY_AIR'
    id='fmucint0572337e8aafbad5'>
    <fmuc xmlns='http://isode.com/protocol/fmuc'
    from='latency.p8-one@p8-one.net/f5ac7b83c2cc6951'/>
    <x xmlns='http://jabber.org/protocol/muc'/>
</presence>

A bit of intelligence gathering can be done by the reading of the messages and from TDoA.
Direction finding  is not easy since the transmissions originate from two different sites, however the results obtained indicate UK as the area of operations (Fig. 2): maybe UK MoD?
Fig. 2 - TDoA result
The namespace attribute fmuc xmlns='http://isode.com/protocol/fmuc can be a clue of the use of the M-Link software developed by Isode for XMPP [1]. By the way, reading some Isode documentation available in the web you can see odd 10.x.y.w S5066 addresses like the ones used in the heard transmissions (Fig. 3)

Fig. 3 - from XMPP5066EVAL.pdf by Isode
Servers names and nodes names as: mission-one@chat.ground.net/LATENCY_GROUND and mission-one@chat.ground.net/LATENCY_AIR, as well as the Test Message format suggest a test phase aimed to measure the latency of air and ground links. Note also that the tests are performed using different HF waveforms: MIL 188-110A Serial 600bps and STANAG-4539 4800bps.

That being said, probaby these are UK MoD test transmissions concerning (Isode) XMPP over HF radio but it's only my guess. Ropey @Topol_MSS27 suggests that "maybe P8 (chat.p8-one.net) is a clue and references new ops for upcoming P-8A's due to join RAF from Nov next year" [2].

12 December update
My friend Martin G8JNJ, owner of the http://southwest.ddns.net:8073/ KiwiSDR, reports he heard synch'ed transmissions on 4381.0 KHz and 5505.0 KHz too, all usb. His TDoA runs point to Inskip (Former RNAS Inskip), a transmitting site of UK DHFCS located in Lancashire, North England: it confirms my TDoA and is a further clue in favor of RAF operations.

(a lot of documentation is publicy available in the web about ISODE XMPP, google is your friend) 
[2] https://www.raf.mod.uk/aircraft/p-8a/ 

↧
Viewing all 622 articles
Browse latest View live
Search
<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>