Recently I ran across on several transmissions in the 5 MHz band (also available on a secondary basis for amateur use) consisting of STANAG-4538 point-to-point circuit mode service with 188-110A (300, 1200, and 2400 bps) used as traffic waveform. The transmissions are receivable in Northern Europe with a good SNR, especially using the KiwiSDR receiver at OZ1AEF (Skanderborg, Denmark): they are very frequent, of short duration, and occur on at least a half dozen different channels between 5300 and 5400 KHz USB. Given their unpredictability (time/channel) and their duration, a Direction Finding is very difficult, at least with the means at my disposal.
 |
| Fig. 1 - 188-110A running at 2400bps |
The excellent SNR allows demodulations without many errors and therefore the possibility of examining and comparing the obtained bitstreams: to be honest, I expected to find a known data-link protocol or at least sequences attributable to some encryption technique (known or not )... but that's not what exactly happened.
Although the ACF doesn't produce results, comparing various demodulations it turns out that all the bitstreams exhibit the same initial 20 (16) bit sequence 11110000100111010111 (0000100111010111). By syncing the bitstreams on the two sequences, interesting results are obtained: in particular, with the 20-bit sequence we get patterns that have a fairly well-defined structure in the first 196 bit and more clear than the one obtained with the 16-bit sequence (Figure 2).
 |
| Fig. 2 - bitstreams synched on 11110000100111010111 sequence(first 196 bit) |
One could argue that the 16-bit sequence (LSB)0000100111010111(MSB) is the binary equivalent for 0xEB, ie the sync sequence of STANAG-5066 frames: unfortunately, the following bytes do not match the Data Transfer Sublayer headers, ie the (supposed) fields do not contain data that make sense (EOT, size of address,...).