RIGHT-click here - Monitoring Times

More documents

Recommendations

Info

SCANNING REPORT THE WORLD ABOVE 30MHZ Dan Veeneman danveeneman@monitoringtimes.com www.signalharbor.com Decoding Digital Data Modern scanners have a feature that can add a new dimension to monitoring. This month we take a look at the details of the feature, discuss why it is useful, and finish up with a brief discussion of an encryption scheme in use in many public safety radio systems. Dear Dan, Hello from South Carolina! I have a couple of good questions that have been on my mind lately, so here goes. The first involves the use of proprietary monitoring software that can decode data about P-25 systems straight from your scanner. One freely available software title allows me to monitor the traffic flow in and out of the tower, including talkgroups that I can see actively pop up on my computer screen, almost like a 911 emergency center console. I can even save all of this data in a log for later reference. But, from a practical standpoint, I don’t see where it’s useful. I mean, what can I do with this information? Specifically I am referring to Pro96com and I’m using that in conjunction with my Radio Shack Pro-197 and Pro-106 handheld. I am using these to monitor two P-25 systems. One is the York County, South Carolina P-25 system and the Charlotte Mecklenburg (North Carolina) P-25 system. The latter is a new system intended to replace the existing Motorola system which, as I understand, was originally commissioned in 1985 or thereabouts. If you can recommend other decoding tools I’d like to know about them. I happened across Pro96com because I use PSREdit500 to program both of my scanners, and I found it on Mike Vander Veer’s website. The second question has to do with serialization of talkgroups. Specifically, in programming my scanner, I have noticed that talkgroup numbers skip every other number quite often. Do agencies publish ALL talkgroups on their systems or just the ones they want the public to see? Are there secret talkgroups we don’t know about? Should we be monitoring with more wildcards programmed into our scanners, or should we program the “in between” numbers in and listen that way? Any advice you could give would, as always, be greatly appreciated. Kevin in South Carolina Before we can answer Kevin’s questions we need to go over some background that is often taken for granted by experienced hobbyists but seems a mystery to newcomers. Trunked radio systems, at a fundamental level, involve computers talking to each other. A computer located at a repeater site transmits digital information to portable and mobile radios, where a computer inside the radio processes that information. When prompted, the computer inside the radio transmits a burst of digital information back to the repeater. Digital information in trunked radio systems is transmitted on control channels. The outbound control channel, carrying data from repeaters to radios, is typically continuous and is the usual target for scanner listeners since it is relatively strong and comes from towers or other sites with good coverage characteristics. The inbound control channel carries data from radios to repeaters and is shared by all active radios within range. Radios take turns using the inbound control channel as instructed by the repeater via commands sent on the outbound control channel. The digital data carried on control channels are made up of binary digits, called bits, where each bit is either a ‘0’ or a ‘1’. These bits are organized into meaningful chunks of information according to a well-defined protocol. Each protocol specifies a number of short instructions and responses that define various actions and states a radio might experience. Each manufacturer typically has their own proprietary protocol, although there are some exceptions – for instance, the protocols for APCO Project 25 are published and available for anyone to read and use. Bits are transmitted over the air one after another at a certain rate, measured as bits per second (abbreviated as bps). The table below lists the control channel protocol and data rate for several common trunking systems. Trunking System Protocol Rate Motorola Type I Motorola 3600 Motorola Type II Motorola 3600 EDACS Narrowband EDACS 4800 EDACS Wideband EDACS 9600 Logic Trunked Radio LTR 300 MPT-1327 MPT 1200 APCO Project 25 P-25 9600 Outbound control channels carry information related to activity on the system, including specific groups of conversing users (called talkgroups) and the radio frequencies on which those conversations are taking place. Modern scanners receive this stream of information and process it in order to track trunked conversations. The computer (actually a small microprocessor, but a computer nonetheless) inside the scanner is programmed with the knowledge of particular trunking system protocols and thus can receive control channel bits and convert them into understandable instructions and responses, which it then uses to track conversations. ❖ Data Stream All trunking scanners use the received protocol messages internally to perform tracking. Some scanners also make those protocol messages available on an external connector that can be attached to a personal computer. This personal computer interface (PC/IF) connector is usually used for remote control of the scanner and for importing and exporting programming settings. Some models also support firmware upgrades through this same connector. Most recent GRE-built scanners have an optional “CCDump” (control channel dump) feature that streams received control channel data over the PC/IF connector. By connecting the scanner to a computer with the proper cable and running an appropriate software program, the hobbyist can see trunking messages in real-time as they appear on the system. As an example, the manual for the GRE PSR-500 handheld scanner includes an Appendix that details the CCDump data stream. It describes seven different types of stream messages. Two of them provide weather-related messages, specifically the Specific Area Message Encoding (SAME) and the warning alarm tone (1050 Hz). The remaining five are control channel data messages for Project 25 (“P25”), Motorola (“M36”), Logic Trunked Radio (“LTR”), EDACS Wideband (“EDW”) and EDACS Narrowband (“EDN”). Computer software can read these messages and display the meaning and associated parameters (frequency, talkgroup numbers, system identifiers, and so on) of each message. This traffic can also be stored in a file to be reviewed later or shared with other hobbyists. ❖ Trunking Message Decoders Kevin mentions a program called “Pro- 96Com.” The Radio Shack PRO-96 is a handheld scanner that was introduced in 2003. It came with a special mode that, when activated, sends Project 25 control channel data messages out via the PC/IF connector port without the need for any modifications or additional hardware. This 20 MONITORING TIMES August 2012
feature motivated Rick Parrish to write a computer program called “PRO96DMP” that interpreted the P25 messages and displayed them on the screen. Mike Vander Veer took the next step and wrote a more comprehensive program, Pro96Com, and has continued to refine it. You can read more about it at www.psredit.com/pro96com and download a free copy from there. As with most packages, there is also a Yahoo! interest group at www.groups.yahoo.com/group/Pro96Com. The current Pro96Com software works with a number of scanners, including these models: Make GRE GRE Radio Shack Radio Shack Radio Shack Radio Shack Uniden Uniden Model PSR-500 PSR-600 PRO-96 PRO-106 PRO-197 PRO-2096 BCD396XT BCD996XT In addition to Pro96Com, several other software programs are available that are capable of interpreting the CCDump data stream. UniTrunker is a Windows program, available at www.unitrunker.com, that provides control channel monitoring for Motorola, EDACS, and Project 25 from the PC/IF port on GRE PSR-500, GRE PSR-600, Radio Shack PRO-106 and Radio Shack PRO-197 scanners. It can also monitor Motorola and EDACS control channels using a Uniden BC346XT or Uniden BCT15X scanner, which are both analog trunk-tracking units. Eric Carlson has written LTRLogger, a Windows command line utility to display LTR messages from Uniden BCD396XT, BCD996XT and BCT15X scanners. You can find it at www. ericcarlson.net/ltrlogger If you’re more software development inclined, there is a set of Java libraries that support the GRE PSR-500 and PSR-600 (and the Radio Shack PRO-106 and PRO-197) PC/IF data port available at http://sourceforge.net/projects/ galena.pdf, although they have not been updated in quite some time. ❖ Why? To finally answer Kevin’s first question, these P-25 decoding tools allow someone to see “under the hood” of a trunked radio system and observe all of the underlying activity that makes the system actually work. For someone who really wants to understand the inner workings of a system, it is an invaluable tool. Such software is also very useful to capture and store all of this activity for later review, allowing the discovery of rarely used talkgroups and radios. It also helps to quickly build up a list of associations between talkgroup activity and individual radio identifiers to try and understand which departments use which talkgroups. It may also help in the discovery of other active frequencies on the system that might not have been known just normal or casual monitoring. With software like Pro96Com or UniTrunker, you can set up your scanner and computer to log trunked system activity 24 hours a day and thus capture talkgroup identifiers regardless of whether you are there to hear them or not. This continuous monitoring of the control channel also avoids a drawback of ordinary monitoring, where the listener hears the conversation from a single talkgroup but may miss other active talkgroups. Since all active talkgroup numbers are sent on the control channel, a monitoring program can capture all of the identifiers even if they appear simultaneously. ❖ Talkgroup Publication Most agencies do not actually publish their talkgroup numbers. A few agencies might be paranoid that the release of such information could somehow be harmful, but the majority of trunked system operators simply don’t need to make the list public. They have an internal staff of radio technicians, or subcontract maintenance to an outside service company, who assigns talkgroup numbers and programs them into radios. Talkgroup lists that you find on the Internet or (more rarely these days) published in books are largely by hobbyists who monitor the system and put together reports of what they’ve heard with what talkgroups their scanner or software reports. While gathering this kind of information, the hobbyist will operate their scanner in “open” mode, which will cause it to stop on every transmission and thus capture each active talkgroup. It is similar in concept to the “wildcard” character used in many computer searches. ❖ Charlotte-Mecklenburg, North Carolina The new Charlotte-Mecklenburg system that Kevin mentions covers three counties in south-central North Carolina, specifically Gaston, Mecklenburg, and Union. About two dozen repeater sites in various locations cover the 1,500 square miles of service area. The Federal Communications Commission (FCC) license database at http://wireless2.fcc. gov/UlsApp/UlsSearch/searchLicense.jsp lists the following frequencies under several call signs: County Licensed Frequencies (MHz) Gaston 851.3375, 851.4750, 851.7375, 852.4625, 852.6500, 852.8375, 852.8750, 853.4625, 853.5875 Mecklenburg 851.1500, 851.2375, 851.2625, 851.3125, 851.3375, 851.4750, 851.7000, 851.7375, 851.7625, 851.8125, 851.8750, 852.0875, 852.2375, 852.3125, 852.3750, 852.4625, 852.5875, 852.6500, 852.8125, 852.8375, 852.8750, 852.9125, 853.0625, 853.1000, 853.1500, 853.2625, 853.3125, 853.3500, 853.4625, 853.5875, 853.6500, 853.8125, 853.8500, 853.8750, 853.9000, 853.9250, 853.9375 Union 851.2625, 851.3125, 851.7625, 851.8750, 852.3125, 853.1500, 853.3125, 853.6500, 853.9000, 853.9375 Because this is a “pure” Project 25 system – meaning all voice activity is digital and the trunking control channel follows the P25 standard – you will need a newer digital-capable scanner to monitor it. The good news is that it also means you can track it by programming just the control channel frequencies. The scanner will use the information August 2012 MONITORING TIMES 21
Page 1 and 2: www.monitoringtimes.com Scanning -
Page 4: C O N T E N T S Vol. 31 No. 8 Augus
Page 7 and 8: ISBN 978-0-945053-50-7 Study with t
Page 9 and 10: SATELLITES Spy-Sat Crumbs fall to N
Page 11 and 12: the frequency; I’m coming back wi
Page 13 and 14: every week and they had teams back
Page 15 and 16: The Arabs Zanzibar was one of the m
Page 17 and 18: department. While this can be harml
Page 19 and 20: The Road to New LPFM It seemed an i
Page 21: equires significant planning and or
Page 25 and 26: ASK BOB GENERAL QUESTIONS RELATED T
Page 27 and 28: 12788.0, and 17144.5 kHz USB. The s
Page 29 and 30: DIGEST DIGITAL MODES ON HF Rivet an
Page 31 and 32: compensate for “other issues” i
Page 33 and 34: Wolverine Radio has a theme to thei
Page 35 and 36: clear channel Toronto radio station
Page 37 and 38: English Language How to Use the Sho
Page 39 and 40: 0200 0300 Sat/Sun USA, WBCQ Montice
Page 41 and 42: 0700 0800 Canada, CKZN St Johns NF
Page 43 and 44: 1200 1300 Bahrain, R Bahrain 6010me
Page 45 and 46: 1600 1630 Vietnam, VO Vietnam/Overs
Page 47 and 48: 1945 2000 DRM Vatican City State, V
Page 49 and 50: MTXTRA Shortwave Broadcast Guide AR
Page 51 and 52: 0230 0300 China, Qing Hai PBS 4750d
Page 53 and 54: 1100 1200 Guam, KTWR/TWR Asia 9910a
Page 55 and 56: 5xx NAS Fallon NV 381.0125 381.1750
Page 57 and 58: ❖ QSL Woes Bob Combs wrote from N
Page 59 and 60: other aircraft are - as well as the
Page 61 and 62: Video streaming, and free “borrow
Page 63 and 64: Station sign and beacon ZWG/287 kHz
Page 65 and 66: An uninformed person might have att
Page 67 and 68: A somewhat modest system of ground
Page 69 and 70: A number of novel technologies are
Page 71 and 72: ❖ Snaking your antenna around obs
Page 73 and 74:
Circuit Architecture And Technical
Page 75 and 76:
Software Library for Hams. This lib
Page 77 and 78:
new ones on sale right now. Thanks
Page 79:
Join ARRL and Discover the Exciteme
show all

RIGHT-click here - Monitoring Times

Create successful ePaper yourself

Delete template?

Save as template?