29 October 2015

unid BPSK 100Bd & 200Bd


heard on 18255.0 (cf) monday, 26 October around 0830z the signal alternates BSPK segments with 100 and 1200 Baud. Out of these formats, the signal altenates long 11 carriers 150 Hz spaced preamble with a sort of modulated inserts. The signal is partially described in radioscanner.ru (missing the initial BPSK 100/1200 Baud part):
http://signals.radioscanner.ru/base/signal92/






28 October 2015

STANAG-4538, LDL BW3-BW4 samples

This is a recording of Low rate Data Link (LDL) protocol BW3, carrying Harris "Citadel" encrypted traffic, + BW4 LDL acknowledgments (ACK) waveforms: transmission was herad on 16716.0 KHz/USB. Both STANAG-4538 and MIL 188-141B/C App.C share these waveforms

pic.1
BW3 and BW4 waveforms, and the Data Link protocol (LDL), are identifiable by their duration as is specified in the STANAG-4538 official documentation "table 13-1":

pic.2 - BW4 lenght
For what concerns the BW3 waveform (pic.3), its ACF of 13.33ms (96 bits lenght, or 32 PSK-8 symbols) is a further test:

pic.3 - 13.33ms ACF of BW3 waveform
Bt the way, the LDL traffic consists of files which are encrypted using the Harris "Citadel" encryption system, as detecte by the analyzing the bistream once removed the Link Layer overhead (pic.4)

pic.4 - detecting Citadel encryption in the secondary protocol (LDL)

STANAG-4538 BW5 sample

waveform BW5

The usual 2G scenario (MIL 188-141 2G-ALE + MIL 188-110A/B 3KHz serial-tone) is replicated here but using 3G waveforms: the sample shows a data transfer, using one of the MIL 188-110C App.D serial-tone waveforms (precisely the waveform-id n.7 15KHz bandwidth, seen in another post), followed by STANAG 4538 FLSU 3G-ALE signal to supposedly close the link. 
To avoid confusions, MIL 188-141C Appendix C third-generation ALE is termed Link Set-Up (LSU) in STANAG 4538. Two non-interoperable protocols for link establishment are specified in STANAG 4538: Fast LSU (FLSU, smaller, lightly-loaded tactical networks) and Robust LSU (RLSU, large networks and heavy traffic).  The specifications previously contained in the Appendix C have been replaced with reference to the essentially identical NATO STANAG 4538: I refer to this document.

The ALE segments have been downsampled and decimated in order to get a better signal to analyze (pic. 2), so it was possible to identify the 3G-ALE as the Fast LSU burst-waveform n.5, or BW5 waveform as indicated in the table shown in picture 3, just from the standard STANG 4538. PSK-8 modulation is analyzed in pic. 4.

Pic. 2 - 3G-ALE signals after downsampling
lenght of the burst: 1013 ms
Pic. 3 - the heard signal mathces the characteristics of the BW5 waveform
Pic. 4

26 October 2015

MIL 188-110C App.D: BW18KHz, SR14400 Bd, PSK-8

 Waveform Number 7: PSK-8, 18 KHz bandwidth


This waveform (WID7-18Khz) occupies a bandwidth of 18 kHz, providing 28800 bps user data rate. Modulation used is PSK-8 at 14400 symbols/sec. Reading the MIL 188-110C App.D documentation, a frame for this waveform consists of 1536 unkown symbols (data) + 192 known symbols (mini probe), so 1728 symbols. Since the 14400 baudrate , the mini-probes should generate a 120 ms ACF: in this sample I used the CCF function but the obtained 240 ms result is the same as in WID7-15Khz.



MIL 188-110C App.D: BW15 KHz, SR12000 Bd, PSK-8

signals were heard at different days and times, around 1100-1200z, on 18270.KHz (f0) by KarapuZ.
   
Waveform Number 7: PSK-8, 15 KHz bandwidth 

 

The waveform (WID7-15Khz) occupies a bandwidth of 15 kHz, providing 24000 bps user data rate. Modulation used is PSK-8 at 12000 symbols/sec. Reading the MIL 188-110C App.D documentation, a frame for this waveform consists of 1280 unkown symbols (data) + 160 known symbols (mini probe), so 1440 symbols. Since the 12000 symbols/sec of this waveform, the frame should be 120 ms long but I get a 240 ms ACF: just the double of the expected lenght. More likely ACF value is generated by the cyclic rotation of the mini-probes, as specified in the standard, and the interleaving of this sample needs one rotation after 2 data blocks and so the 8640 bits period (240 ms).



25 October 2015

Robust PACKET Radio



Robust PACKET  is  a  data  transmission  mode using eight carrier, pulse shaped OFDM (Orthogonal Frequency Division Multiplex), 60 Hz spaced and spreading a 500Hz bandwidth. Dependent on the user data rate (200 or 600 bps before AX.25 protocol overhead) each carrier is DBPSK (as in this sample) or DQPSK modulated at a constant rate of 50 Baud. The modulation type is automatically adapted to the propagation conditions. Just like ordinary PACKET RADIO, the AX.25 protocol is utilized as the Layer 2 protocol.
This sample has been heard on 10147.3 KHz (cf) on the Robust Packet Network operated bu HAMs: below teh demodulation of the messages received.




23 October 2015

logs

16048.0 LASN Russian Mil, RUS 1357 CW "VVV TWWE E LASN K" (21Oct15)
16323.3 N55 Unid (possibly Chinese Mil) 1330 USB MIL 188.141A/B ALE calling A96 (21Oct15)
14550.0 O74 Moroccan Military, MRC 1241 USB MIL 188-141A/B ALE sounding (21Oct15)
16343.0 --- Russian (Domestic system ?) 0927 (cf) CIS FTM-4 MFSK-4, Br-150, Shift-4000 (21Oct15)
13528.4 "M" cluster beacon "M" Magadan, RUS 0710 CW "M" (21Oct15)
18203.0 --- Russian Intel/Diplo, RUS 0610 USB MFSK-32 bursts, prob. SERDOLIK new waveform (19Oct15)
14720.0 030NET2 Unid net 1135 USB MIL 188-141A/B ALE clg 006NET2 (20Oct15)
14600.0 SPT424 Polish Mil, POL 1130 USB MIL 188-141A/B ALE clg + handshake SNB813 (20Oct15)
14386.0 --- Unid (prob. French Mil) 0725 USB THALES Système 3000 ALE (20Oct15)
14557.0 --- Russian Mil, RUS 0830 USB CIS-60, OFDM 60-tones 30Bd π/4-DQPSK (20Oct15)
14429.5 --- Chinese Mil, CHN 0810 USB Chinese MFSK flwd by OFDM, poor signal (20Oct15)
16319.9 --- Unid 1505 (cf) F1B 125Bd/300 prob. TADIRAN HF-2000 modem (19Oct15)
16263.0 05024 Unid net 1426 USB MIL 188-141A/B ALE sounding (19Oct15)
16251.0 --- Russian Intel/Diplo, RUS USB 1425 MFSK-30 and MFSK-31 bursts prob. SERDOLIK new waveform (19Oct15)
15880.0 CM4 Algerian AF, ALG 1422 USB MIL 188-141A/B calling COF (19Oct15)
16256.5 --- Unid (prob. French Mil) 0857 USB THALES Système 3000 robust MFSK-8 flwd by TRC-177x modem serial-tone 2400Bd acf 106.6 ms (19Oct15)
16252.5 OEY61 ustrian Armi, A 0855 USB MIL 188/141A/B calling OEY20 (19Oct15)
16257.0 --- Russian Intel/Diplo, RUS USB 0834 MFSK-32 bursts prob. SERDOLIK new waveform (19Oct15)
16285.0 TU4 Tunisian MOI net, TUN 0706 USB MIL 188-141A/B ALE calling STAT154 (19Oct15)
14395.0 CENTR4 MFA Bucharest, ROM USB 0619 MIL 188-141A/B ALE clg SQA (19Oct15)
14788.5 --- MHFCS HF net, AUS 1345 (cf) GFSK 600Bd/340 (18Oct15)
16240.0 2205 Algerian Mil, ALG 0900 USB MIL 188-141A/B ALE sounding (17Oct15)
16160.8 20001 Unid Iranian net 0853 USB MIL 188-141A/B ALE sounding (17Oct15)
16074.0 RAA Russian Navy HQ Moscow, RUS 0816 CW "RJD93 DE RAA" (17Oct15)
14448.0 777 Unid net 0623 USB MIL 188-141A/B ALE calling 799 (17Oct15)
12800.0 --- Unid 1658 USB MIL 188-110 serial 2400bps/short (16Oct15)
12270.5 --- Unid 1608 (cf) R&S ALIS selcal 228.65Bd/170 Called address: 40 (16Oct15)


22 October 2015

(prob.) new SERDOLIK MFSK burst waveforms

s1: MFSK-28 burst waveform
s2: MFSK-30 burst waveform
s3: MFSK-32 burst waveform
s4: MFSK-32 burst waveform

heard on 19 October:
- 16251.0 KHz USB 1425z MFSK-28 and MFSK-30 burst waveforms(s1, s2)
- 16257.0 KHz USB 0834z MFSK-32 burst waveform (s3)
and 21 October:
- 18203.0 KHz USB 0610z MFSK-32 burst waveform (s4)

The waveforms have different MFSK parameters such as tones, baudrate and shift: probably they not involve all code combinations but the signals are certainly very similar and probably sent by the same equipment.

These signals seem to be experiment/tests with a new Serdolik set of MFSK waveforms, something like a combination of a call (or perhaps ALE Selcall) and data-sending. The s4 MFSK-32 waveform is reported as "new" also in radioscanner.ru, but in that post is used with OFDM-60 as a starting combination while here is used also as 'stand-alone' in burst mode. 
Interestingly the lack of the CIS-60 pilot-tone at the usual 3300 Hz: this could indicate the preamble purposes of the initial MFSK-32 tones. Also in this case, the burst mode is used.

MFSK-32 used as sort of CIS-60 preamble
An interesting difference - at least in these samples - between s1, s2 and s4 are the directions of the two initial sweeps (s3 has a different initial structure): in s1 and s2 the initial sweeps are upward while s4 has downward sweeps. In these recordings s2 carries the same data.
Other than the above post (by my friend KarapuZ) in radioscanner.ru forum, I could not find any other info/report about these waveforms: if they are on-air just from a few days we'll probably have the chance to read other logs and info in next days or weeks.

s1: MFSK-28 burst waveform
s2: MFSK-30 burst waveform
s2: MFSK-30 burst waveform dump
s3: MFSK-32 burst waveform
s4: MFSK-32 burst waveform
summary
s1: grid MFSK-28 (09/28 used), speed 76Bd, shift 95Hz
s2: grid MFSK-30 (21/30 used), speed 76Bd, shift 95Hz
s3: grid MFSK-32 (21/32 used), speed 40Bd, shift 46.8Hz
s4: grid MFSK-32 (32/32 used), speed 83Bd, shift 96.7Hz


21 October 2015

MFSK-4 150Bd 4000Hz (CIS FTM-4)

CIS FTM-4 unknown Russian "domestic" system: MFSK-4, speed 150Bd, Shift 4000Hz and CCF ~80 ms. Heard on 16343.0 and 16222.0 KHz cf (16335.0 and 16230.0 f0 USB). This signal is discussed here in radioscanner.ru: http://signals.radioscanner.ru/base/signal201/
At least in this sample, the start tone is the higher one while the ending tone is the lower.



the effective data rate
This signal (is logged as FSK 4-tone with baudrate 150Bd and shift 4000Hz, or else CIS FTM-4 (Pic. 1). Looking in depth, they use only 4 of 24 combinations of the four tones (Pic. 2), so the encoded characters which are transmitted are reduced to 4.  This mode is called Frequency-Time Matrix (FTM) or, in this case, FTM-4. The coding method is five-digit group of characters plus spaces. The four symbols are:
A) 1-2-3-4
B) 2-4-1-3
C) 4-3-2-1
D) 3-1-4-2
Looking at the segment in Pic. 2, we could find the occurences of each symbol, for example "A" occurs 4 times, "B" occurs 3 times, "C" occurs 3 times and "D" occurs 3 times.
Since the baudrate of the signal, i.e. 150Bd, the real data-rate is 150/4 = 37.5 Baud. 

Pic. 1
Pic. 2
The repetitions of 4 symbols is clearly visible analyzing the demodulated bistream, unless some few errors due to the demodulation:

Pic. 3
 as well as the structure of the message seen as 48 bits period: some parts are well distinct
although it is unclear what they mean (sinc?, address?, commands?, ...)

Pic. 4

20 October 2015

Chinese OFDM 30-tone


heard on 20 October around 0615z on 14429.5 KHz on USB: the waveform has a pilot tone at ~445Hz (the lower frequency in the spectrum), 30 carriers 75 Hz spaced with BPSK modulation at 60Bd speed. Preamble consists of four QPSK 60Bd modulated tones, 600 Hz spaced.


Unid FSK 125Bd/300 (Tadiran HF2000 modem?)


Recordered on 16319.9 KHz (cf) at 1505z on 20 October, just a few seconds transmission then nothing more for over one hour (playback duration). The signals is a clear FSK with manipulation speed of 125 Baud and 300 Hz shift: these parameters are the same of the Tadiran HF2000 125bd FSK Modem (radioreference.com) but I do not have other evidence to confirm this guess so comments are very welcome (by the way, the recording is available).

manipulation speed and shift values

19 October 2015

THALES: Système 3000 robust MFSK-8 and TRC-177x family serial modem

just heard this morning on 16256.5 USB at 0857z, probably source French Military.
The MFSK-8 waveform uses the same tone library as 188-141A/B 2G ALE but callsigns are limited to a maximum length of 2 figures only and can also be used as a robust-data mode. Aurally and visually it is easily mistaken for a normal ALE since the 250 Hz spaced eight tones and 125Bd speed. 
The serial-tone waveform more probably belongs to THALES TRC-1752 modem, has all the characteristics inherent STANAG-4285 (serial tone carrier 1800 Hz, speed 2400 baud and modulation PSK-8) except for the phase constellation of the preamble: a 'special' with 5-ary constellation maybe for receivers tuning purposes. ACF is 106.6 ms.TRC-1752 modem seems to be replaced by the HF Multi Mode modem TRC 177X family.  

the two combined THALES waveforms
serial tone ACF


18 October 2015

Unid 2400bd (mixed) PSK bursts

I started to follow these burst from ~0800z on USB 16257.0 (16259.0 cf) on 17 October,  they appeared pretty regularly in seconds 10, 25 and 40 (mm.10, mm.25, mm.40) for more than one hour then they stopped, or at least I did not hear them anymore.
The signal have 18 tones preamble followed by a sort of mixed PSK-4/PSK-8 modulation at 2400 symbols/sec, carrier is measured at ~1900Hz (but I could be mistuned). The SA phase-plane module vaguely reveals a PSK-8 constellation when its n-ary detector is set to 8, but that same constellation comes out also in case of 4-ary. ACF/CCF is 20ms lenght and is visible in the phase detector after the preamble.
It looks like the Chinese DQPSK, but I am not positive about this identification; the recording is available on simply request: comments are welcome!

Pic. 1 - the unid burst
Pic.2 - 4-ary and 8-ary constellations
Pic. 3 - phase detector output, note the 20ms pattern
Pic. 4 - CCF and signal frame