22 April 2018

Logs, 20 Mar - 22 Apr

04593.0: RDP: Saudi Air Force, ARS 2108 USB 188-141A, calling DAI (23Mar18)
05553.2: ---: Unid 2120 USB STANAG-4285 1200bps/L modem, unid 1536-bit secondary protocol (prob. TDM system) (23Mar18)
06234.0: ---: Unid 2100 STANAG-4285 600bps/L modem, async operation (encrypted ITA2, framing 5N1.5) (31Mar18)
06407.0: WL01: Algerian Military, ALG 1529 USB MIL 188-141A, calling NX01 (10Apr18)
06600.5: HBLZDRD1: Roumenian Military, ROU 0915 USB 188-141A, calling HFJCDRD1 (23Mar18)
06840.0: BOSOX: Unid 1452 USB 188-141A, sounding (29Mar18) (AA)
06840.0: R26452: US Military 92-26452 Sikorsky UH-60L Black Hawk 1445 USB 188-141A, handshake w/ BOSOX, short op-chat (29Mar18) (AA)
06849.5: ---: Unid, prob. Russian Air Force 0650 (cf) FSK 100Bd/2000, idling (10Apr18)
07690.0: 9002: Unid 1709 USB mil 188-141A, calling 9001 (04Apr18)
07703.0: WI2XER: possibly Skycast ERS 2129 USB 30 unmodulated tones, 100Hz spaced, lasting 20.7 secs and followed by Morse ID “WI2XER” (16Mar18)
07732.0: A98: presumed Chinese-Diplo net, CHN 1710 USB MIL 188-141A, calling E56 (04Apr18)
07823.0: GR2ORX: Sonatrach GR2 Pipeline, ALG 1718 USB MIL 188-141A, sounding (10Apr18)
08089.0: HL: Unid 1638 USB Arab voice comms with callsigns AZ, JU, FT / STANAG-4197 ANDVT modem (10Apr18)
08092.0: 362013: Turkish Civil Defence, Erzincan District, TUR 1711 USB MIL 188-141A, calling 304013 Agri District (04Apr18)
08104.75: ---: Unid, prob. Russian Mil/Gov 0805 (cf) FSK 50Bd/1000, idling (27Mar18)
08151.0: TYMT2: Guardia Civil Toledo, E 1711 USB MIL 188-141A, sounding (04Apr18)
08171.0: Russian Intel/Mil, RUS 0910 USB CIS FTM-4, MFSK-4 150Bd (effective 37.5:Bd) 4000Hz modem (tones at: -6, -2, +2, +6 KHz) (28Mar18)
08182.0: XFZ: UK-DHFCS 1331 USB 188-141A calling XNM (22Apr18)
08190.0: INZUCC: Guardia di Finanza Patrol Boat Inzucchi G118, I 1003 188-141A, calling PALERMO (18Apr18)
08707.7: HWK01: Swedish Armed Forces, S 0807 USB 3G-HF 1-way FLSU / MIL 188-110A Serial, Circuit Mode tfc, S5066 unid UDOP client protocol delivering 2 blocks of ciphered text (12Apr18) 
09079.0: ---: Unid 1709 USB 3G-HF 2-way FLSU handshake / HDL24 transfer (28Mar18)
09206.0: ---: Unid USB WBHF MIL 188-110D App.D, 4800Bd 6KHz bursts, scrambled BPSK (WId 2). Linking with 3G ALE extensions for wideband (3GWB) (12Apr18)
09210.0: ---: Unid USB WBHF MIL 188-110D App.D, 7200Bd 9KHz bursts, Walsh modulation (WId 0). Linking with 3G ALE extensions for wideband (3GWB) (12Apr18)
09295.0: TXFA8: Spanish Police, E 1009 USB 188-141A, calling TZCP1 (16Apr18)
09540.0: ---: Russian Gov/Mil (?), RUS 0947 USB "Tandeme" system tests, MFSK-56/23 25/62Bd 2500 msec bursts on 9540, 9584, 9636 KHz. Also noted before CIS-79 OFDM (20Mar18)
09909.0: HA2: Polish Military, POL 1002 USB 188-141A, calling KR4 (28Mar18)
09909.0: HA2: Polish Military, POL 1006 USB 188-141A, handshake w/ TE5, no follow-on (28Mar18)
09909.0: HA2: Polish Military, POL 1010 USB 188-141A, calling TA6 (28Mar18)
09909.0: HA2: Polish Military, POL 1017 USB 188-141A, calling ST8 (28Mar18)
09909.0: TA6: Polish Military, POL 1000 USB 188-141A, calling JU9 (28Mar18)
09909.0: TA6: Polish Military, POL 1002 USB 188-141A, calling JA4 (28Mar18)
10185.0: X44: Moroccan Military, MRC 0820 USB 188-141A, sounding (18Apr18)
10222.0: Unid 1100 USB MFSK-6 (3-out-of-6) 100Bd/400Hz modem, lasting 11 mins (28Mar18)  [1]
10284.9: GR2ORX: 1638 LSB 188-141A, sounding (28Mar18)
10480.0: CENTR2: Rou-MAECT Centrala2 Bucharest, ROU 0825 USB 188-141A handshake KOW (Copenhagen embassy) / 188-110A bearing S5066 HBFTP email (18Apr18)
10576.0: 739: Unid 1547 USB 188-141A calling 195 (22Apr18)
12215.0: ---: Russian Mil/Gov, RUS 0934 USB CIS-45 HDR modem v1, OFDM 45-tone 33.33Bd PSK-2 (23Mar18)
13005.0: ---: Unid 1333 USB 3G-HF 2-way FLSU handshake / HDL+ transfer (05Apr18)
13032.0: ---: Rus Mil, RUS 1240 (cf) FSK/Morse flash message "XXX XXX WEGI WEGI 23327 36051 STOKOBOJ 4724 4957 K" (08Apr18)
13215.0: 538883: Unid  1047 USB MIL 188-141A, sounding (05Apr18)
13371.5: HO32: Russian Mil/AF, RUS 0809 (cf) weird Morse/FSK/1000Hz (100Bd idling) "FD68 DE HO32 QSA? K" (27Mar18)
13446.0: FC1: FEMA NRS (FNARS) Net Region 1, US 1300 USB MIL 188-141A, calling ME1FEM (05Apr18)
13905.5: WI2XER: possibly Skycast ERS 1504 USB 30 unmodulated tones, 100Hz spaced, lasting 20.7 secs and followed by Morse ID “WI2XER” on 13907.2 (05Apr18)
13960.0: ---: Ukrainian Net 1227 (cf) F7B mode system 100Bd/2000, tones at -1500, -500, +500, +1500 (16Apr18)
14445.0: OEB: Algerian Air Force Oum El Bouagh, ALG 0933 USB MIL 188-141A, sounding (09Apr18)
17422.0: ---: Rus Gov/Mil, RUS 1006 USB CIS-112, OFDM 112-tone 22.22Bd BPSK modedm (05Apr18)

21 April 2018

FSK-2 300Bd/200, 17-bit ACF 6-bit code

FSK-2 300Bd/200 transfer occupying ~500Hz bandwidth, each cycle lasts 6000ms (4640ms data block, 1360ms idling) and shows 17-bit length ACF. Each data block consists of 738 bits (data + framing), data seem to be sent using a 6-bit code. Very strong in JN52.

Fig. 1
Fig. 2
In Fig. 3, although contents are different, it's possible to see repeated sequences in the packets, expecially the last 12 bits of each packet. Same packets also exhibit a same sequence in their initial part. Figure 4 shows the result of the comparison between the first packet on the left in Fig. 3 and the following 10 packets.

Fig. 3
Fig. 4 - comparison between the first packet on the left in Fig. 3 and the following 10 packets
The transmission lasted for a long time, I followed it about two hours on Thursday evening  (Apr, 19) from 2030z - when I tuned it - and I still found it there the following morning until 0900z when it stopped. A friend from Northern Portugal reported this signal in UDXF list (18 Apr): "It has been on all morning on 3575.65kHz (USB dial freq)".
The same signal is reported in a post of 2012 (27 Jun) in radioscanner, user and purposes of that transmission/protocol are not yet known or verified.

Nice work indeed by 'cryptomaster': use Diff-FSK, remove extra columns, remove odd parity-bit column and then get the 6 bit code. Great!

Fig. 5

19 April 2018

FSK two channels in F7B mode, likely an UKR-Net

On 13960.0 KHz I tuned  an apparently MFSK-4 100Bd/1000 transmission spreading about 3000Hz bandwidth: tones at -1500, -500, +500, +1500. After emails exchange with friends, "cryptomaster" from radioscanner suggested that the signal is a F7B mode actively used by Ukrainian Nets. Usually, the two channels transfer T-207 ciphered data. He also warned me that SA program parses these transmissions as classic MFSK-4 therefore the received result doesn't correspond to the truth. Another F7B signal, this one from Ukrainian Mil, was reported here some times ago.

Fig. 1
Fig. 2
F7B is a FSK modulation technique with four modulation frequencies, the two transmission channels, termed V1 and V2, are obtained through six possible combinations of the four frequencies and this leads to 6 different modes F7B1 to F7B6:

The equipment BUK-2D, for example, is one of the equipments used to filter and separate the two channels (thanks to 'cryptomaster').

Fig. 3 - BUK-2D equipment


14 April 2018

WBHF comms in the 9 MHz band (188-110C/D Appendix D)

Just a couple of good quality recordings of the wideband activity that can be monitored in 9 MHz band. Both the waveforms belong to WBHF 188-110C/D App.D.

The 6 KHz burst is modulated at a symbol rate of 4800Bd and has a 192 symbols frame consisting of 96 data symbols (user data) followed by 96 known symbols (mini-probes): according to TABLE D-XI and TABLE D-XII, this the Waveform ID 1 or ID 2, (scrambled) BPSK modulation, depending on the used data rate (300 or 600 bps, as in TABLE D-II). Note that the BPSK constellations are scrambled to appear, on-air, as a PSK-8 constellation.
Fig. 1 - 6 KHz bandwidth bursts
Fig. 2
The 9 Khz burst has symbol-rate of 7200Bd and a period length of 2048 symbols. The period length helps to identify the waveform as the Waveform ID 0. Quoting D.5.1.4 "For the case of Waveform ID 0, an 8-PSK data scrambling sequence is utilized [...] this implementation is used to generate 256*8 or 2048 values. For the Walsh Orthogonal Modes the sequences are continuously wrapped around the 2048 symbol boundary". Since the 9 KHz bandwidth, the data rate is 300bps (TABLE D-II).

Fig. 3
Linking is performed using 3GWB extensions (3G ALE FLSU + WBALE). WBHF modes could also deliver video for awareness, such bandwidth allows information rather than data.

Fig. 4

13 April 2018

3GWB, 3G ALE extensions for wideband operations (Harris WB ALE)

I was investigating some wideband HF (WBHF) scenarios and spotted unexpected 3G-HF FLSU bursts in some recordings: it's a unexpected presence because for circuit mode connections WBHF is not comprised in the types of traffic that will be delivered on the link (the available types of traffic are listed in STANAG-4538 Table 4.6.1-2). Such transmissions can be observed by monitoring the band around 9.2 MHz.
Reading the Appendix-G to MIL 188-141D, I found an answer to my perplexities: most likely those intercepts are related to 3GWB: a set of "extensions" to 3G-HF linking for wideband. Indeed, quoting MIL 188-1414D §G.5.5.7, "It is possible to set up a narrowband link using 3G-HF FLSU and then to negotiate a wideband channel for traffic via a second handshake that uses 3GWB extensions to the FLSU protocol, the link shall be terminated with FLSU_term. The extensions for this 3GWB mode are not standardized here". Figure 1 provides a timing diagram of all the signalling required. 
Harris developed a similar system for wideband ALE termed "WB ALE" [1] [2]. 
Fig. 1 - 3G wideband point-to-point link setup example (timing not to scale)
That said, I am inclined to say that part of the heard WBHF transmissions are just examples of WB ALE/3GWB system tests. Figure 2 reports a such transmission recorded on 5365.0 KHz/USB. The link setup of standard 3G-HF is unaffected: link request and confirm control FLSU bursts remain unchanged. Harris say that the only modification to 3G linking is the addition of a new traffic type to support wideband data (as I supposed). After the link has been established, both radios simultaneously perform a spectrum sensing operation to determine the currently interference-free bandwidth at each end. Once spectrum sensing has determined the available bandwidth and offset, a second two-way handshake (WB handshake) is used to exchange the required information for the wideband transfer. Once the data transfer is complete, FLSU terminate bursts will tear down the link as is done in 3G-HF.

Fig. 2 - on-air 3G wideband point-to-point link
Fig. 3
By the way, the traffic waveform (Fig. 4) has a symbol rate of 14400Bd and uses the 18 KHz bandwidth.

Fig. 4

I do not have informations about the format of the FLSU PDUs (Protocol data Units) employed in the WB ALE handshake (are they still addressed?) and the modded BW5 waveforms. Unfortunately, the quality of recordings doesn't allow accurate investigations as the ACF and the period framing: I can only state that WB ALE FLSU request and confirm bursts last about 530ms and are modulated at 2400 symbols/sec using PSK-8 modulation. Quoting Harris [3]:
"The two-way WB handshake has been designed using burst waveforms very similar to BW5 of STANAG-4538 and allows the exchange of the following information:
- SNR values measured at each end
- Quantized representation of local interference environment
- Coordinated decision on available bandwidth (i.e. 3, 6, 9, 12, 15, 18, 21, 24 kHz)
- Coordinated decision on offset (i.e. frequency offset of available bandwidth in the up to 24 kHz allocation; offset value is quantized and is in the range of +/- 10500 Hz)
- Coordinated decision on initial data rates.
Bandwidth and offset decisions will be based on either a primary or secondary usage of channel. In primary user mode, bandwidth and offset decisions can be made independently for each direction of transmission. In secondary user mode, bandwidth and offset will be the same in both directions."

Given the latest "D" release of MIL 188-110 (December 2017), it would be interesting to know if Harris has upgraded  WB ALE to support up to 48 KHz bandwidth waveforms introduced by the Appendix D. 

Thanks to KarapuZ who sent me some of his rercordings.

The multiplicity of abbreviations and acronyms sometimes doesn't help, below what I used:

WBHF, Wideband HF waveforms (MIL 188-110C/D App.D)
3G-HF, third generation HF protocol suite for 3G ALE and data-link (STANAG-4538)
FLSU, 3G-HF Fast Link Setup protocol
3GWB, third generation ALE with wideband extensions
WB ALE, Harris implementation of 3GWB, also termed WBALE

WALE, wideband ALE (MIL 188-141D App.G) also termed 4G ALE (fourth generation ALE)

note that WB ALE is not synonymous with WALE since the latter has its own PDUs and waveforms.

12 April 2018

188-110A 2400S (prob. Egypt-Ny)

slightly modified 188-110A bursts with some voice comms in Arabic, prob. from Egyptian Ny, spotted on 15950.0 KHz/USB 1320z.
It's interesting to note the well visible three 200ms synchronization pattern segmentes (MIL 188-110 § Sync preamble sequence), confirmed by the 200ms spikes in the preamble ACF. Data blocks ACF exhibits 20ms spikes that makes 48 tribit symbols at the speed of 2400Bd: each data block consisting of 32 symbols of unknown data (user data) and 16 symbols of known data (probes).

Fig. 1
Fig. 2 - ACF values for preamble and data blocks
Fig. 3 - frame structure
The short synch preamble (3x200ms) and the used framing (48 symbols, 32+16) point out the 2400bps/S mode, as confirmed by the 5710A modem. 

Fig. 4

4 April 2018

Asynchronous STANAG-4285 15/128 bit period (possibly Turkish T-15)

6234 Khz/USB STANAG-4285 600bpsL, very long idling periods (hours!) with sporadic asynchronous data transfers consisting of 15 bit and apparently nx32 bit (32,64,...,128) ACF blocks (Fig. 1). The 15-bit Block-A is clearly an async ITA2 5N1.5 stream (Fig. 2). By decoding the whole stream whit the HARRIS RF-5710A modem, also the Block-B seems to use ITA2 and 5N1.5 framing: indeed, the modem does not print bad framing errors. By the way, I do not think a framing change "on the fly" be possible. Looking at Block-B  (Fig. 3), it seems arranged as 4 groups of 4 chars (the fourth as separator), but it's only a my guess.
In both blocks the 5-bit text appears as (off-line?) encrypted.
For a better understanding of the figures keep in mind that bit editors work with an integer number of bits therefore they cannot represent an half bit.

Fig. 1 - data transfer consists of two blocks
Fig. 2 - 15-bit period Block-A
Fig. 3 - 32/128-bit period Block-B
The above images come from a 4285 demodulator output which returns the bits in air, the demodulated stream from 5710A modem (framing 5N1.5) is shown in Figure 4.

Fig. 4

For what concerns the user/source, I had the best SNR using a remote SDR in Greece (http://sdr.telcosol.gr:8073/), probably the transmitter is located in the eastern Mediterranean area: Greece, Cyprus Is. or Turkey. Some friends from radioscanner say it's the Turkish T-15 protocol.

Fig. 5 - monitoring the signal using remote SDRs in Greece and Spain (at same time)

29 March 2018

FSK 500Bd/1000, CIS Navy Akula ("shark")

CIS Akula ("Shark") is a FSK 500Bd/1000 burst waveform used by Russian/CIS Navy in  ship-shore links, most likely by submarines. Akula is one of the most interesting signals you may meet in air: fast, unpredictable and unfrequent; see below for a little story of this signal.
Back to the signal, the waveform consists of FSK bursts modulated at speed of 500Bd and 1000Hz shift (Figure 1). A distinctive sign are the last bits of the demodulated bitstream: a sort of EOM mark "1771/" (Figure 2).

Fig. 1
Fig. 2
I worked several good quality recordings and found that they can be successfully descrambled using the polinomyal x^5+x^3+x+1, after the removal of the scrambler the resulting bitstream exhibits an interesting 6-bit period (Figure 3).

Fig. 3
The same 6-bit period (Figure 4) can be obtained by descrambling the bitstream after differential decoding: in this case the scramble polynomial is x^4+x^3+1 (thanks to KarapuZ).

Fig. 4

Legacy Akula (Shark), or the so-called 49th channel, was originally a ship-shore superfast telegraph system used to transmit reports from submarines, the received transmissions were immediately relayed to HQ Navy on all available communication channels.
Transmissions did consist of ten groups of 5 digits and 0.72 secs in air. The main equipment of Akula is the sensor P-758 and the receiver P-759 (Figs 5,6), with their ancillaries, and appeared in the fleet in the late 50's. In total, more than 4,500 sets were produced. [1]

Fig. 5 - P-758
Fig. 6 - P-759
"In parallel with the development of land-based communication systems of the Navy the technical means with high-speed, security and automation were designed for surface ships and submarines. The experts of the Naval Research Institute of Communication designed special HF very-high-speed (VHS) secured communication link later named Akula (Shark). Then existing systems could not detect and not even saying of taking a bearing of VHS transmissions. In addition thanks to the usage of increased capacity (up to 15 kW) radio transmitting equipment at submarines and a set of geographically distributed land-based receiving radio centers the high-fidelity reception was possible even at range of 8-10 thousand kilometers. Navy commissioning of VHS communication means marked the new qualitative stage in the development of naval communication systems."

There is an interesting story about the so-called "Project Boresight" and “lost” Soviet submarines that confirms the Akula's undetectable feature (thanks to Dave for the link):

Akula, with minor variations ("Dolphin", to be precise), is still used for long-range operational and near operational-tactical communications of the Russian Navy, perhaps the P-758IS equipment is used (Figure 7).

Fig. 7 - P-758IS

Frequencies (all CFs):

3399 4414 4882 5338 5555 5784 6772 6836 6852 6864 6908 6920 7316 7620 
7690 7734 7674 7748 8300 8500 9155 9202 9264 9372 9955 9628 10116 10192
10208 10314 10478 10659 10664 10816 10860 10888 10928 11024 11155 12312
12368 12693 13146 14266 13404 13406 14206 14208 14266 14840 14860 16104
16248 16264
Thanks to Dave who collected the logs.


28 March 2018

unid 3-of-6 multitone system (tentative)

28 Mar update
The MFSK-6 modem seems to be entered in production mode: spotted today on 10222.0 KHz/USB with no repetitions of the same pattern, as noted in the precedent intercepts.  Note as the system uses 3-tone symbols and a symbol rate of 100symbols/sec.

Will wait for further recordings to confirm my guess.


8 Feb / 7 Mar updates
The same system as the 16 Aug 17 intercept (see below) has been spotted on 10222.0 KHz/USB on February 8 (Fig. 1) and on 7674.0 KHz/USB on March 7 (Fig. 2): data blocks last respectively 250 msec and 200 msec

Fig. 5 - 250 msec blocks
Fig. 6 - 200 msec blocks
In my opinion, looking at the three intercepts, it seems that these are still test transmissions in which different data-formats are used:

16 Aug post

Recently I copied an interesting multitone signal on 14642.0 KHz and 16114.0 KHz on USB. The signal uses 6 tones, 400Hz spaced, starting from 650Hz, and it sounds just like a frog. Tranmissions do not have a preamble, last for a few minutes (the longer I heard last up to 16 minutes) and consists of 820ms blocks: 500ms data block followed by 320ms interval (Fig. 1)

Fig. 1
Transmissions end with the sending of the 6 carriers in a special sequence (Fig. 2)

Fig. 2
Three of the six tones are used to form the code symbols, ie they are sent simultaneously (Fig. 3): since given six tones there are twenty combinations of three that can be drawn without repetitions, this system use a 20 symbols alphabet set. It's important to note in Fig. 3 that each data block always consists of the ordered sequence of all the possible symbols (!) that makes a speed of 40 symbols/sec that is - in some way - coherent with the used shift (40Bd/400hz).

Fig. 3

Many "exotic" coding could be derived from this set (as 123=A,124=B,... or 123=0,124=1,...) and a 6-bit representation could be one of these: e.g. using the lower tone as the LSB we get the sequences:

000111 001011 010011 100011 001101 010101 100101 011001 101001 110001 
001110 010110 100110 011010 101010 110010 011100 101100 110100 111000

(you may play around it inverting the order, changinB g polarity, differential decoding,...)

I don't know who they are and where the signals come from, anyway the fact of sending all the alphabet symbols leads to think that it could be a test of a new system, maybe aimed to Intel/Diplo services... but it's only a my supposition and - if that is the case - we should wait for further transmissions from the "production" frog-modem.