29 October 2015

unid BPSK 100Bd & 200Bd


heard on 18255.0 (cf) monday, 26 October around 0830z the signal alternates BSPK segments with 100 and 1200 Baud. Out of these formats, the signal altenates long 11 carriers 150 Hz spaced preamble with a sort of modulated inserts. The signal is partially described in radioscanner.ru (missing the initial BPSK 100/1200 Baud part):
http://signals.radioscanner.ru/base/signal92/






28 October 2015

STANAG-4538, LDL BW3-BW4 samples

This is a recording of Low rate Data Link (LDL) protocol BW3, carrying Harris "Citadel" encrypted traffic, + BW4 LDL acknowledgments (ACK) waveforms: transmission was herad on 16716.0 KHz/USB. Both STANAG-4538 and MIL 188-141B/C App.C share these waveforms

pic.1
BW3 and BW4 waveforms, and the Data Link protocol (LDL), are identifiable by their duration as is specified in the STANAG-4538 official documentation "table 13-1":

pic.2 - BW4 lenght
For what concerns the BW3 waveform (pic.3), its ACF of 13.33ms (96 bits lenght, or 32 PSK-8 symbols) is a further test:

pic.3 - 13.33ms ACF of BW3 waveform
Bt the way, the LDL traffic consists of files which are encrypted using the Harris "Citadel" encryption system, as detecte by the analyzing the bistream once removed the Link Layer overhead (pic.4)

pic.4 - detecting Citadel encryption in the secondary protocol (LDL)

STANAG-4538 BW5 sample

waveform BW5

The usual 2G scenario (MIL 188-141 2G-ALE + MIL 188-110A/B 3KHz serial-tone) is replicated here but using 3G waveforms: the sample shows a data transfer, using one of the MIL 188-110C App.D serial-tone waveforms (precisely the waveform-id n.7 15KHz bandwidth, seen in another post), followed by STANAG 4538 FLSU 3G-ALE signal to supposedly close the link. 
To avoid confusions, MIL 188-141C Appendix C third-generation ALE is termed Link Set-Up (LSU) in STANAG 4538. Two non-interoperable protocols for link establishment are specified in STANAG 4538: Fast LSU (FLSU, smaller, lightly-loaded tactical networks) and Robust LSU (RLSU, large networks and heavy traffic).  The specifications previously contained in the Appendix C have been replaced with reference to the essentially identical NATO STANAG 4538: I refer to this document.

The ALE segments have been downsampled and decimated in order to get a better signal to analyze (pic. 2), so it was possible to identify the 3G-ALE as the Fast LSU burst-waveform n.5, or BW5 waveform as indicated in the table shown in picture 3, just from the standard STANG 4538. PSK-8 modulation is analyzed in pic. 4.

Pic. 2 - 3G-ALE signals after downsampling
lenght of the burst: 1013 ms
Pic. 3 - the heard signal mathces the characteristics of the BW5 waveform
Pic. 4

26 October 2015

MIL 188-110C App.D: BW18KHz, SR14400 Bd, PSK-8

 Waveform Number 7: PSK-8, 18 KHz bandwidth


This waveform (WID7-18Khz) occupies a bandwidth of 18 kHz, providing 28800 bps user data rate. Modulation used is PSK-8 at 14400 symbols/sec. Reading the MIL 188-110C App.D documentation, a frame for this waveform consists of 1536 unkown symbols (data) + 192 known symbols (mini probe), so 1728 symbols. Since the 14400 baudrate , the mini-probes should generate a 120 ms ACF: in this sample I used the CCF function but the obtained 240 ms result is the same as in WID7-15Khz.



MIL 188-110C App.D: BW15 KHz, SR12000 Bd, PSK-8

signals were heard at different days and times, around 1100-1200z, on 18270.KHz (f0) by KarapuZ.
   
Waveform Number 7: PSK-8, 15 KHz bandwidth 

 

The waveform (WID7-15Khz) occupies a bandwidth of 15 kHz, providing 24000 bps user data rate. Modulation used is PSK-8 at 12000 symbols/sec. Reading the MIL 188-110C App.D documentation, a frame for this waveform consists of 1280 unkown symbols (data) + 160 known symbols (mini probe), so 1440 symbols. Since the 12000 symbols/sec of this waveform, the frame should be 120 ms long but I get a 240 ms ACF: just the double of the expected lenght. More likely ACF value is generated by the cyclic rotation of the mini-probes, as specified in the standard, and the interleaving of this sample needs one rotation after 2 data blocks and so the 8640 bits period (240 ms).



25 October 2015

Robust PACKET Radio



Robust PACKET  is  a  data  transmission  mode using eight carrier, pulse shaped OFDM (Orthogonal Frequency Division Multiplex), 60 Hz spaced and spreading a 500Hz bandwidth. Dependent on the user data rate (200 or 600 bps before AX.25 protocol overhead) each carrier is DBPSK (as in this sample) or DQPSK modulated at a constant rate of 50 Baud. The modulation type is automatically adapted to the propagation conditions. Just like ordinary PACKET RADIO, the AX.25 protocol is utilized as the Layer 2 protocol.
This sample has been heard on 10147.3 KHz (cf) on the Robust Packet Network operated bu HAMs: below teh demodulation of the messages received.




22 October 2015

(prob.) new SERDOLIK MFSK burst waveforms

s1: MFSK-28 burst waveform
s2: MFSK-30 burst waveform
s3: MFSK-32 burst waveform
s4: MFSK-32 burst waveform

heard on 19 October:
- 16251.0 KHz USB 1425z MFSK-28 and MFSK-30 burst waveforms(s1, s2)
- 16257.0 KHz USB 0834z MFSK-32 burst waveform (s3)
and 21 October:
- 18203.0 KHz USB 0610z MFSK-32 burst waveform (s4)

The waveforms have different MFSK parameters such as tones, baudrate and shift: probably they not involve all code combinations but the signals are certainly very similar and probably sent by the same equipment.

These signals seem to be experiment/tests with a new Serdolik set of MFSK waveforms, something like a combination of a call (or perhaps ALE Selcall) and data-sending. The s4 MFSK-32 waveform is reported as "new" also in radioscanner.ru, but in that post is used with OFDM-60 as a starting combination while here is used also as 'stand-alone' in burst mode. 
Interestingly the lack of the CIS-60 pilot-tone at the usual 3300 Hz: this could indicate the preamble purposes of the initial MFSK-32 tones. Also in this case, the burst mode is used.

MFSK-32 used as sort of CIS-60 preamble
An interesting difference - at least in these samples - between s1, s2 and s4 are the directions of the two initial sweeps (s3 has a different initial structure): in s1 and s2 the initial sweeps are upward while s4 has downward sweeps. In these recordings s2 carries the same data.
Other than the above post (by my friend KarapuZ) in radioscanner.ru forum, I could not find any other info/report about these waveforms: if they are on-air just from a few days we'll probably have the chance to read other logs and info in next days or weeks.

s1: MFSK-28 burst waveform
s2: MFSK-30 burst waveform
s2: MFSK-30 burst waveform dump
s3: MFSK-32 burst waveform
s4: MFSK-32 burst waveform
summary
s1: grid MFSK-28 (09/28 used), speed 76Bd, shift 95Hz
s2: grid MFSK-30 (21/30 used), speed 76Bd, shift 95Hz
s3: grid MFSK-32 (21/32 used), speed 40Bd, shift 46.8Hz
s4: grid MFSK-32 (32/32 used), speed 83Bd, shift 96.7Hz


21 October 2015

MFSK-4 150Bd 4000Hz (CIS FTM-4)

CIS FTM-4 unknown Russian "domestic" system: MFSK-4, speed 150Bd, Shift 4000Hz and CCF ~80 ms. Heard on 16343.0 and 16222.0 KHz cf (16335.0 and 16230.0 f0 USB). This signal is discussed here in radioscanner.ru: http://signals.radioscanner.ru/base/signal201/
At least in this sample, the start tone is the higher one while the ending tone is the lower.




20 October 2015

Chinese OFDM 30-tone


heard on 20 October around 0615z on 14429.5 KHz on USB: the waveform has a pilot tone at ~445Hz (the lower frequency in the spectrum), 30 carriers 75 Hz spaced with BPSK modulation at 60Bd speed. Preamble consists of four QPSK 60Bd modulated tones, 600 Hz spaced.


19 October 2015

THALES: Système 3000 robust MFSK-8 and TRC-177x family serial modem

just heard this morning on 16256.5 USB at 0857z, probably source French Military.
The MFSK-8 waveform uses the same tone library as 188-141A/B 2G ALE but callsigns are limited to a maximum length of 2 figures only and can also be used as a robust-data mode. Aurally and visually it is easily mistaken for a normal ALE since the 250 Hz spaced eight tones and 125Bd speed. 
The serial-tone waveform more probably belongs to THALES TRC-1752 modem, has all the characteristics inherent STANAG-4285 (serial tone carrier 1800 Hz, speed 2400 baud and modulation PSK-8) except for the phase constellation of the preamble: a 'special' with 5-ary constellation maybe for receivers tuning purposes. ACF is 106.6 ms.TRC-1752 modem seems to be replaced by the HF Multi Mode modem TRC 177X family.  

the two combined THALES waveforms
serial tone ACF


18 October 2015

Unid 2400bd (mixed) PSK bursts

I started to follow these burst from ~0800z on USB 16257.0 (16259.0 cf) on 17 October,  they appeared pretty regularly in seconds 10, 25 and 40 (mm.10, mm.25, mm.40) for more than one hour then they stopped, or at least I did not hear them anymore.
The signal have 18 tones preamble followed by a sort of mixed PSK-4/PSK-8 modulation at 2400 symbols/sec, carrier is measured at ~1900Hz (but I could be mistuned). The SA phase-plane module vaguely reveals a PSK-8 constellation when its n-ary detector is set to 8, but that same constellation comes out also in case of 4-ary. ACF/CCF is 20ms lenght and is visible in the phase detector after the preamble.
It looks like the Chinese DQPSK, but I am not positive about this identification; the recording is available on simply request: comments are welcome!

Pic. 1 - the unid burst
Pic.2 - 4-ary and 8-ary constellations
Pic. 3 - phase detector output, note the 20ms pattern
Pic. 4 - CCF and signal frame

15 October 2015

how fading or AGC may confuse the things...

looking inside a 3 KHz serial tone, I was puzzled by its 2 x PSK-8 rings unusual constellation: baudrate (3000 symbols/sec) and ACF (640 msec) made me think to the CIS-3000 waveform... but that PSK shape was not the expected one, so I asked my friends Karapuz and Angazu to hear their opinion and they gave me an hint: "hey, look at the amplitude of the signal!".
That's right: highlighting a single chunk of signal and selecting the SA wave form-module, is visible an amplitude variation, possibly due to fading, that in turn causes a sort of inter-symbol distortion in the phase plane and then the optical effetct of the two concentric PSK-8 rings. My wrong because, just in case, before I had to ran the wave-form module. Same conclusions if I had increased the printing delay in the phase plane as an instant-replay.
Well, good to know... especially if tinkering with AGC.
 
the sonogram
the two PSK-8 rings...
...and its clarification