30 January 2016

KG-84 evidences

I tried out to look at some signals that use KG-84 encryption (based on Saville algorithm) in order to identify its footprint inside them and differences (if any), specifically: the two NATO widely used waveforms STANAG-4285 and STANAG-4481-FSK, one of the STANAG-4285 variants (this one possibly a Croatian version) and the FSK 600Bd/400Hz by Turkish Military. Since only four waveforms, this does not claim to be a complete view, rather it will be updated as soon as I'll get other such encrypted signals.
Given a signal, as previously seen, the existence of  KG-84 encryption can be detected by its well-known 64-bit sync pattern that is inserted at the beginning of each session/message and followed by the encryption initialization:
In order to highlight the sync pattern we need to work with bitstream files, also known as ASCII-bits file, containing only the binary symbols 0 and 1 and provided by decoders such as k500 or Sorcerer (in the picture belows). This because - for example - the PSK-8 demodulated output from signals analyzers such SA, provide on-the-air symbols that still contains extra-symbols due to FEC and they should de-scrambled, de-interleaved and converted from HEX values to binary. 
The bitstream analysis is performed using a bit flow processor and editor.

STANAG-4481P (STANAG-4285 300bps/L)

pic. 1 - NATO STANAG-4481P
in this case the sync is followed by a 512 bits group consisting of two 64 bits sequences repeated 4 times: the two 64 bits sequences form the 128 bits key, k500 call them as "inizialization vectors" and are clearly indicated in its output as two strings each of 32 HEX characters. As far as I can see, both the sync and the key are inserted at the beginning of the session and are not re-inserted or repeated so that the message can not be deciphered in case of late entry.

STANAG-4481F (FSK 75Bd/850)
pic. 2 - NATO STANAG-4481-FSK
since the same operating environment (NATO), STANAG-4481-FSK adopts the same structure as in 4285. It is worth noting in pic. 3 that the 64-bit sync patterns produce ~850ms ACF spikes visible in the initial part of the signal.

pic. 3 - 850ms ACF spikes due to key insertion

STANAG-4285 variant

pic. 4 a STANAG-4285 variant
although it's compatible with NATO S-4285, this waveform (the user is suggested to be Croatian) does not provide KG-84 encryption (coud not find the sync pattersn) but rather a sort of linear encryption taht is not detected by the standard S-4285 decoders such as k500 and Sorcerer.

Turkish FSK 600Bd/400Hz

pic. 5 - the Turkish FSK/600/400
for what concerns KG-84 encryption, this waveform exhibits an interesting peculiarity: the sync pattern is not followed by the 512-bits key block as seen in NATO 4285 and 4481 implementations. I do not know if the  128 bits immediately following the syncr are indeed the key or else the key is obscured to standard decoders. 
As expected, since this trasmission consists of 7 blocks, the sync is repeated  7 times each 3954 bits exactly: since the apparently lack of the key I don't know if the transmission carries seven distinct messages or if the repetion is an help in case of late entry (so the messages are the same?).

pic. 6 - the seven resolvers

It's quite useless and waste of space and bandwidth to list here concepts and images that are easily found on the web about KG-84, below just few links:
Thanks to my friend KarapuZ for pointing me this argument and his stimolous to deepen.

29 January 2016

BELL 103 compatible FSK modem 300Bd/200 (Algerian AF)

heard on 11446.2 KHz (cf) at 0756 UTC. FSK bursts preceeded by three unmodulated tones 150 Hz spaced, manipulation speed is 300 symbols/s and shift is 200 Hz. A short 250ms preamble is embedded in the 3 pre-tones (pic.3) , data are encrypted. Since the baudrate (300Bd) is higher than the shift (200Hz), modulation could be a so-called semi-mode such as MSK or GMSK.
The waveform is compatible with AT&T Bell 103 modem and suggested to be used by Algerian Air Force. A short recording is available here
pic. 1 baudrate 300Bd
pic. 2 shift 200 Hz
pic. 3 FSK preamble

26 January 2016

Iranian-QPSK 468.75, 937.5 Baud

Heard on 10724.0 KHz and 17382.2 (cF) on USB at 2120z, this signal is known as "Iranian-QPSK" since its QPSK modulation QPSK. For what is known, the Iranian-QPSK occurs in some variants that differ in speed such as: 1875, 937.5, 468.75 and 207 Baud. It seems that there is also a variant with a speed of 234 baud. The 207 Baud waveform is reported in radioscanner.ru while qrg.globaltuners.com   identifies the signal as belonging to the Iranian Navy: I did not find such match looking at UDXF logs.


21 January 2016

Turkish Mil, FSK 600Bd/400Hz KG-84C

Although the signal is weak, you could easily find its basic parameters as in pictures 1 and 2. The signal has been heard on 07932.5 KHz (cf) around 0744z and also analyzed here by radioscanner.ru friends.
pic. 2
This signal use cipher NATO KG-84, it can be identified by the 64-bit sequence in each session (the KG-84 frame sync)
highlighted in pic. 3

The KG-84A and KG-84C are encryption devices developed by the U.S. National Security Agency (NSA) to ensure secure transmission of digital data. The KG-84C is a Dedicated Loop Encryption Device (DLED), and both devices are General-Purpose Telegraph Encryption Equipment (GPTEE). The KG-84A is primarily used for point-to-point encrypted communications via landline, microwave, and satellite systems. The KG-84C is an outgrowth of the U.S. Navy high frequency (HF) communications program and supports these needs. The KG-84A and KG-84C are devices that operate in simplex, half-duplex, or full-duplex modes. The KG-84C contains all of the KG-84 and KG-84A modes, plus a variable update counter, improved HF performance, synchronous out-of-sync detection, asynchronous cipher text, plain text, bypass, and European TELEX protocol. 
Compared to the KG-84A, the KG-84C had some interesting extras. It has a variable update counter,
improved HF performance, out-of-sync detection (when in synchronous mode), asynchronous ciphertext, plaintext bypass, and the European Telex protocol. When used with a suitable digital telephone unit, the KG-84 could also be used for secure voice transmissions. Data could be handled by the KG-84 in asynchronous mode at rates between 50 and 9600 baud. In synchronous mode, it could even go up to 32,000 baud (or even 64,000 baud when used in combination with an external clock). 


06450.0 BOVIENZO: Italian GdF patrol boat G106, I 0745 USB MIL 188-141 ALE clg CAGLIARI (15Jan16) (AAI)
06510.0 K1U: prob. Slovak Mil Kuchyňa, SVK 0751 USB MIL 188-141 ALE clg Z1V (15Jan16) (AAI)
06510.0 --- (no call) prob. Slovak Mil, SVK 0809 USB MIL 188-141 ALE clg N1R (15Jan16) (AAI)
06510.0 Z1V: prob. Slovak Mil Zvolen, SVK 0749 USB MIL 188-141 ALE clg P1O (15Jan16) (AAI)
07421.5 CHFEDR: Greek AF, GRC 0734 USB MIL 188-141 ALE clg SFFF2 (20Jan16) (AAI)
07535.0 BX0: Algerian Mil, ALG 0649 USB MIL 188-141 ALE clg BX02 (21Jan16) (AAI)
07890.0 BS008CA: 0740 USB MIL 188-141 ALE clg CS001A (15Jan16) (AAI)
07996.0 SI4: Polish Mil, POL 0803 USB MIL 188-141 ALE clg RA1 QRA1029 (20Jan16) (AAI)
08058.6 KWA37: US Dept of State station 0741 USB MIL 188-141 ALE clg KWT93 (21Jan16) (AAI)
08162.0 IU01: Algerian Mil, ALG 0731 USB MIL 188-141 ALE clg PY01, handshake (21Jan16) (AAI)
08174.0 AC01: Unid (prob Algerian Net) 0920 USB MIL 188-141 ALE clg XV01 (20Jan16) (AAI)
08190.0 NAPOLI: Italian GdF patrol boat, I 0706 USB MIL 188-141 ALE clg BOVIENZO (21Jan16) (AAI)
08193.0 IN6: Polish Mil, POL 0726 USB MIL 188-141 ALE clg TU4 (20Jan16) (AAI)
09181.0 XS50: Algerian Mil, ALG 0829 USB MIL 188-141 ALE clg XS52 (19Jan16) (AAI)
09971.0 LAMBDA0ALE: Polish Mil, POL 1125 USB MIL 188-141 ALE clg STRYJOWALE (19Jan16) (AAI) [*]
09971.0 LAMBDA0ALE: Polish Mil, POL 1136 USB MIL 188-141 ALE clg HERODOT63 (19Jan16) (AAI) [*]
09971.0 LAMBDA: Polish Mil, POL 1107 USB MIL 188-141 ALE clg STRYJOW20 (19Jan16) (AAI) [*]
09971.0 STRYJOWALE: Polish Mil, POL 1125 USB MIL 188-141 ALE clg LAMBDA0ALE (19Jan16) (AAI) [*]
09971.0 STRYJOWALE: Polish Mil, POL 1139 USB MIL 188-141 ALE clg HE3 flwd by MIL 188-110A serial (19Jan16) (AAI) [*]
09980.0 YDM: Unid 0735 USB MIL 188-141 ALE to UR LQA REQUEST RESPONSE (19Jan16) (AAI)
10175.0 325: Unid (prob. Chinese Air Defence, CHN) 1424 USB MIL 188-141 ALE clg 375 (20Jan16) (AAI)
15870.0 BLD: Algerian AF, ALG 1408 USB MIL 188-141 ALE clg BAL (20Jan16) (AAI)
[*] thanks to Kristian: looks like regular exercise every 3rd tuesday of month, as 20.Oct.2015 was also a tuesday

05292.8 "S": Unid beacon 0658 rough CW Morse (21Jan16) (AAI)
07516.0 ---: Russian Intel, RUS 0721 USB (cf) CIS FTM-4, MFSK-4 150Bd 4000Hz (tones at: -6, -2, +2, +6 KHz) lasting 8s (19Jan16) (AAI)
07683.0 ---: Swiss Diplo, SUI 1050 USB (cf +1500 on USB) PacTOR-II (17Jan16) (AAI)
07687.5 ---: Unid 1445 USB Thales Systeme 3000 robust MFSK-8 (20Jan16) (AAI)
07932.5 ---: Turkish Mil, TUR 0744 (cf) FSK 400Hz/600 KG-84 crypto (20Jan16) (AAI)
08701.0 CTA: NATO Lissabon Monsanto, POR 1604 LSB STANAG-4285 600/L "1604Z//CTA02I/CTA08I/CTA12I//" (20Jan16) (AAI)
09050.0 ---: Unid (prob. Bulgarian Diplo Net) 1212 USB RFSM 300bps Robust Mode LP, lasting 4 mins (19Jan16) (AAI)
09151.0 ---: Unid prob.Swiss Diplo, SUI 1207 USB (cf +1500 on USB) PacTOR-II (19Jan16) (AAI)

below the demodulation of one of the PSK-8 segments of the MS188-110C/App.D signal: the 32 symbols mini-probe (96 bits length) are highlighted

17 January 2016


from http://www.marsregionone.org/Temp/rfsm-8000.pdf
"The RFSM-8000 (Radio Frequency Software Modem) is a software by RFSM-IDE Group, it operates under standards MIL 188-110A / MIL 188-110B App. C, (also under a modified version) providing a maximum speed of 8000bps (standard mode), or 6670bps (non-standard "narrow" mode). Signal bandwidth: 0.3-3.3 kHz (standard mode) and 0.3-2.7 kHz (non-standard mode).
Some technical descriptions: 
- real-time signal spectroscope/waterfall view, and IQ-diagram;
- operates under standards MIL-STD 188-110A / MIL-STD 188-110B App. C, (also under a modified version);
- maximum speed: 8000 bps (standard mode), or 6670 bps (non-standard "narrow" mode);
- signal bandwidth: 0.3-3.3 kHz (standard mode) and 0.3-2.7 kHz (non-standard mode).
- uses adaptive correction;
- file transfers are accomplished utilizing ARQ;
- uses SSE2 optimization (if available on CPU);
- transmitter control over COM-port (DTR or RTS line, or CI-V interface);
- allow correction of sound card discretization error;
- allow simple remote control and file-based IPC (for automatic connecting and file transfer)"

I did some tests to check the MS188-110 compatibility and their differences, below are shown the results
- RFSM-8000 modem settings: no DataMasking, standard mode, synchronous
- text sent: "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua."
- decoder used: k500 in both MS188-110A and MS188-110B/App.C synchronous mode

75, 300 bps
2400Bd PSK-8 preamble, headers MS188-110 not compatible
- 75bps: special very robust mode (32-Walsh-based), works under very poor conditions ( -8 dB ), data PSK-8, ACF ~13.6ms (32 symbols)
-300bps: special robust mode - 300bps (16-Walsh-based), works under poor conditions ( -3 dB ), data PSK-8, ACF 13.6ms
About the robust modes the spectrogram shows a sort of inserts with irregular repetition interval, probably due to Walsh modulation, which makes the corrispondent ACF spikes. The 32 tribit symbols, i.e. 96 bits, are clearly visible in the "period" highlighted by BEE (pic. 2b). Standard MS188-110 doesn't exhibit such ACF for the 75bps waveform (pic. 2). 
75bps and 300bps are a sort of proprietary waveforms and need more investigations.

RFSM-modem -> k500
75 long  -> 4800 uncoded (not recognized)
300 long -> 2400 voice
(not recognized)

pic. 1
pic. 2
pic. 2b - 96 bits ACF in RFSM-8000 75bps as seen by BEE
600, 1200, 2400 bps
2400Bd PSK-8 preamble
- 600bps: data PSK-8,  ACF = MS188-110A (pic. 3)
- 1200bps: data PSK-8,  ACF = MS188-110A
- 2400bps: data PSK-8,  ACF = MS188-110A
source text is not clearly returned (7 bit shift ?) 

RFSM-modem -> k500 
600 long -> 600 long
1200 long -> 1200 long
2400 long -> 2400 long 
pic. 3 - RFSM-8000 2400bps ACF
3200 bps
2400Bd PSK-8 preamble, headers not MS188-110A compatible
data PSK-8,  ACF = MS188-110A

RFSM-modem -> k500
3200 long -> 75 long
(not recognized)

4800, 6400, 8000 bps (MS188-110B/App.C High-Speed WF)
(4800bps only uncoded in MS188-110A, coded in MS188-110B/App.C )
2400Bd PSK-8 preamble

- 4800bps: data PSK-8,  ACF ~119.5ms or 287 symbols frame (pic. 4)
- 6400bps: data QAM-16, ACF ~119.5ms (pic. 5)
- 8000bps: data QAM-32, ACF ~119.5ms (pic. 5)

RFSM-modem -> k500
4800 long -> 4800 long
6400 long -> 6400 long
8000 long -> 8000 long

pic. 4 - RFSM-8000 4800bps frame
pic. 5 - RFSM-8000 6400bps, 8000bps

As pointed and tested by AngazU, more likely RFSM chops the info into 59 byte groups and adds its own 6 bytes to build 65 chars chunks for a total of 520 bits frame. The example in pic. 6 is a null file sent by RFSM-8000 at 1200bps: he kindly gave me this file so I could replicate his investigation and get the same results:

pic. 6 - RFSM-8000 data framing (do not mix up with protocol framing)
As you can see in pic. 7, plain MS188-110A doesn't exhibit such beavior since each "period" is just 8 bit length.
pic. 7 -  8 bits period of MA188-110A

14 January 2016


08789.4 RJ01: Unid prob. Tunisian Net 1240 USB MIL 188-141 ALE, LQA REQUEST RESPONSE to BF01 (07Jan16) (AAI)
09000.0 523497: Unid (prob. USAF asset) 0906 USB MIL 188-141 ALE sounding (06Jan16) (AAI)
09377.0 VNL: (prob. Slovenian Net,"Triglav-11") 0854 USB MIL 188-141 ALE calling POC (prob. "Pomorski Operativni Center, Ankaran) (04Jan16) (AAI)
11246.0 M72: Israeli Air Force, ISR  Boeing 707 (KC707) Aircraft #272/4X-JYV0735 USB MIL 188-141 ALE sounding (14Jan16) (AAI)
15043.0 233120: Unid (prob USAF asset) 0925 USB MIL 188-141 ALE sounding (12Jan16) (AAI)
15043.0 AKR: Unid (prob RAF Akrotiri CYP) 0748 USB MIL 188-141 ALE calling 280336 (prob USAF asset) (12Jan16) (AAI)
15043.0 AKR: Unid (prob RAF Akrotiri CYP) 0800 USB MIL 188-141 ALE calling 201087 (prob USAF asset) (12Jan16) (AAI)
15740.7 A90: Unid (prob. US CBP net) 0902 USB MIL 188-141 ALE calling F14 (USCG HU-25 ?) same call on 15912.5 at 0905 (12Jan16) (AAI)
16125.0 TU4: Tunisian MOI, TUN 0834 USB MIL 188-141 ALE LQA response to STAT154 (13Jan16) (AAI)

09040.0 ---: Unid (prob. Bulgarian Diplo net) 0744 USB RFSM 75bps/long Link Protect (04Jan16) (AAI)
09050.0 ---: Unid (prob. Bulgarian Diplo net) 0830,0900,0930 USB Mon-Fri, RFSM Link Protect QRX 9055.0 (06Jan16) (AAI)
09065.1 ---: Unid 0750 cf FSK-2 100Bd/500 (11Jan16) (AAI)
09070.0 ---: Russian Mil, RUS 0900 USB CIS-45 OFDM 45-tone 40Bd DQPSK (11Jan16) (AAI)
09281.0 ---: Unid 1005 USB Hagelin HC-256 scrambler (03Jan16) (AAI)
10113.0 STAT154 Tunisian MOI Net, TUN 0750 (cf +1700) USB PacTOR-II "DEFAULT@#HFARQ#STAT154" (08Jan16) (AAI)
10187.8 ---: Unid 1340 cf FSK-2 1200Bd/850 (07Jan16) (AAI)
10237.9 JO62SK: Pirate Beacon 0845 CW "JO62SK 5W DIPOLE JO62SK COMMON AND PRECIOUS" (03Jan16) (AAI)
10543.0 RCV: Russian Navy Sevastopol, UKR 0853 wkg RBE86 "...NAWAREA 3745 KARTE 3233 TUNIS..." (03Jan16) (AAI)
10801.0 ---: Unid (prob Chinese Intel/Diplo net) 1120 (cf) DQPSK 62.5Bd/100 (06Jan16) (AAI)
10853.0 ---: Russian Intel, RUS 0930 (cf +2 KHz on USB) MFSK-68(34+34) (11Jan16) (AAI)
11544.0 ---: Russian Intel, RUS 0805 (cf +2 KHz on USB) MFSK-68(34+34) (14Jan16) (AAI)
12577.5 UAT: Moscow Radio, RUS 0725 (cf +1500 on USB) Sitor-FEC, NAVIP Bulletin, ID in Morse at end "DE UAT" (12Jan16) (AAI)
12875.3 ---: Unid 1250 cf FSK-2 1200Bd/850 (07Jan16) (AAI)
13856.0 ---: Russian Intel, RUS 0840 USB (cf) CIS FTM-4, MFSK-4 150Bd 4000Hz (tones at: -6, -2, +2, +6 KHz) (11Jan16) (AAI)
13932.4 ---: Russian Mil/Gov?, RUS 0725 cf VFT 3x100 100Bd/1440, single channel (14Jan16) (AAI)
14978.0 XPA2: 0822 USB "01968 00001 00000 10140" (11Jan16) (AAI)
15062.0 ---: Unid 0915 USB serial PSK-8 2400Bd modem, carrier 1800Hz ACF 7296 bit (12Jan16) (AAI)
15614.0 ---: Russian Intel, RUS 0820 (cf +2 KHz on USB) MFSK-68(34+34) (12Jan16) (AAI)
15626.0 ---: Russian Intel, RUS 0822 USB (cf) CIS FTM-4, MFSK-4 150Bd 4000Hz (tones at: -6, -2, +2, +6 KHz) lasting 8 seconds. New at 0830 (12Jan16) (AAI)
16194.5 ---: Unid (prob. German Mil) 0819 USB Arcotel MAHRS-2400 ALE bursts flwd by MAHRS-2400 serial (13Jan16) (AAI) 
16230.0 ---: Russian Intel, RUS 0846 USB CIS-3000 PSK-8 3000Bd serial flwd by MFSK-68(34+34) (13Jan16) (AAI)
16332.1 A: Cluster beacon "A" Astrakhan, RUS 0802 CW "A" (13Jan16) (AAI)

12 January 2016

an RFSM network on 9050.0 KHz (almost surely Bulgarian Diplo)

I followed these signals on 9050.0 KHz USB mainly in the morning and during the last days, from 0700 to 1100 UTC. Looking at UDXF logs and talking with some friends of mine, the network using 9050.0 Khz is probably Bulgarian or  Romanian Diplo (since some ALE calls such as RETEA, FARAONRETEA, SC1DSRETEA), the QRX is visible on 9055 kHz but sometimes only one frequency may be used. Is not sure if also a similar signal heard on 9040.0 KHz belongs to the same net. My friend Kristian from Germany suggested to be Bulgarian Diplo net and kindly pointed a Monitoring Times issue (May 2011) talking about this mode and Bulgarian Diplo activity:

Transmissions on 9050.0 seem to be scheduled at 0830, 0900 and 0930 UTC Mon-Fri, almost all the sessions start with a ~ 15sec tone at 9051.8 KHz (sent about two minutes before) and they last the time necessary for interchanging/sending the messages, usually few minutes.
From previous recordings they used plain MIL-STD 188-110A and now they switched to RFSM (Radio Frequency Software Modem) with Data Masking (link protect) feature, an MS188-110 ST based software-modem by "RFSM-IDE Group". 
Carrier frequency (1800Hz), symbol speed (2400Bd) and modulation (PSK-8)  are the same as that standard (pic. 1) and may be misunderstood and wrongly identified as MS188-110 4800bps/uncoded (the RFSM 75bps/L) and 2400bps/voice (the RFSM 300bps/L), as it happens with both k500 and sorcerer; the 13ms ACF is a clue in favor of RFSM (pic. 2). The structure of the signal is quite complicated, the PSK-8 preamble is followed by the data transfer in PSK-8, QAM-32 or QAM-16 according to needed data-rate. Just as aside note, a sort of 2-ISB signal + carrier has been seen on 9050.0 as central frequency: signal is very week and is difficult to say it's nature.
The RFSM-2400/8000 is a software by "RFSM-IDE Group", it operates under standards MIL 188-110A / MIL 188-110B App. C, (also under a modified version) providing a maximum speed of 8000bps (standard mode), or 6670bps (non-standard "narrow" mode). Signal bandwidth: 0.3-3.3 kHz (standard mode) and 0.3-2.7 kHz (non-standard mode).

8 January 2016

Unid FSK 1200Bd 850Hz

10186.0 --- Unid 1340z (cf +1800Hz on USB) strong FSK-2 1200Bd/850, ~1500 Hz bandwidth, heard on 07Jan16: probably GMSK or CPFSK.

7 January 2016


06262.5 BCHB1: Italian Navy (ship?), I 0752 J3E/USB checking msgs sent by IDR, roger your 308,309,310 (22Dec15) (AAI)
06262.5 IDR: Italian Navy Rome, I 0750 USB sending msgs to BCHB1, STANAG-4285 600/L (22Dec15) (AAI)
07421.5 CHFEDR: Greek Air Force, GRC 0733 MIL 188-141 2G-ALE handshake with SFFF2 (21Dec15) (AAI)
08115.0 RK35 ALgerian Mil, ALG 1331 USB MIL 188-141 2G-ALE handshake with PY30 (20Dec15) (AAI)
08171.0 ---: Russian Intel, RUS 1310 CIS FTM-4, MFSK-4 150Bd 4000Hz (tones at: -6, -2, +2, +6 KHz) (17Dec15) (AAI)
09119.0 NPRD001: NPRD net, HRV 1300 USB MIL 188-141 2G-ALE sounding (22Dec15) (AAI)
10307.5 IGNH: Italian Coast Guard, I 1225 J3E/USB requesting radio check to ICI Coast Guard HQ Rome, do you read me? (21Dec15) (AAI)
10838.5 ---: Unid 1311 cf +1500Hz on USB R&S ALIS 228.65Bd/170 called address 69 (21Dec15) (AAI)
11115.0 ---: MFA Cairo, EGY 0645 cf +1700 USB Sitor-A 100Bd/170 selcal TVVF Beirut (29Dec15) (AAI)
11130.0 A2: Moroccan Army, MRC 0855 USB MIL 188-141 2G-ALE calling C3 (28Dec15) (AAI)
11169.0 ---: no call Roumanian Mil, ROU 0812 USB MIL 188-141 2G-ALE calling HFJCDR (28Dec15) (AAI)
11424.0 ---: Russian Navy, RUS 0809 USB AT-3004D modem MPSK-12 120Bd BPSK + CW "QJC 2 K" (29Dec15) (AAI)
11430.0 ---: Russian Mil, RUS 1520 USB long session of 4x3480ms CIS-3000 serial 3000Bd PSK-8 bursts sent each 40 seconds (24Dec15) (AAI)
11525.0 ---: Russian Intel, RUS 0905 USB MFSK-68(34+34) + QPSK 2400Bd 10KHz inserts each 1 sec (28Dec15) (AAI)
11598.0 ---: (11.597,98 KHz) Unid Russian Navy, RUS 0740 F1B 50Bd/78Hz (??) (21Dec15) (AAI)
12165.0 ---: Unid NATO stn 1404 USB LINK-11 Clew (21Dec15) (AAI)
12187.0 761: Unid network 0853 USB MIL 188-141 2G-ALE calling 772 (23Dec15) (AAI)
12226.0 ---: Unid 0902 USB MIL 188-110 serial PSK-8 2400bps/voice QSX 12221.0 (23Dec15) (AAI)
12282.5 ---: Unid (prob.German AF) 0839 USB Telefunken Racoms MAHRS-2400 serial 2400Bd PSK-8 (23Dec15) (AAI)
12394.0 ---: Unid (prob.German AF) 0859 USB Telefunken Racoms MAHRS-2400 serial 2400Bd PSK-8 (23Dec15) (AAI)
12579.0 FH8071: ship 0827 USB PacTOR III wkg OSY "de FH8071 QTC: 4 1666 1296" (23Dec15) (AAI)
12579.0 ---: Unid 1353 cf +1500Hz on USB PACTOR-IV ARQ "Dragon" modem (21Dec15) (AAI)
13890.0 ---: Russian Intel, RUS 0815 USB MFSK-68(34+34) + QPSK 2400Bd 10KHz inserts each 1 sec (22Dec15) (AAI)
15043.0 HAW: USAF Wideawake Ascension Is., ASC 0735 USB MIL 188-141 2G-ALE sounding (28Dec15) (AAI)
16203.0 ---: Russian Mil, RUS 0930 USB CIS-45 HDR modem v1 33.3Bd 62.5Hz BPSK (24Dec15) (AAI)
16255.0 ---: Russian Intel, RUS 0845 USB MFSK-68(34+34) + QPSK 2400Bd 10KHz inserts each 1 sec (22Dec15) (AAI)
16285.0 ---: Russian Mil, RUS 0920 USB CIS-112 OFDM 22.22Bd 25.6Hz BPSK (18Dec15) (AAI)
16288.0 ---: Russian Intel/Diplo, RUS 0859 USB CIS-3000 serial 3000Bd PSK-8 (18Dec15) (AAI)
16683.0 ---: Unid 0945 cf +1500Hz on USB PACTOR-IV ARQ "Dragon" modem (24Dec15) (AAI)
17382.0 ---: Unid Iranian net (prob. navy?) 1503 (cf) Iranian-QPSK 468.75 Baud (23Dec15) (AAI)
17387.0 E22: 0959 AM 1Khz tone, at 1000z female "this is TK8... TK8...TK8", ID rptd 1005z, 1011z carrier off (23Dec15) (AAI)
17387.0 E22: 1059 AM 1Khz tone, at 1100z female "this is EV2... EV2...EV2", 1111z carrier off (23Dec15) (AAI)
17434.0 ---: Russian Intel, RUS 0847 cf CIS FTM-4, MFSK-4 150Bd 4000Hz (tones at: -6, -2, +2, +6 KHz) (22Dec15) (AAI)
17438.5 VA: Unid (prob. Italian Mil) 0855 J3E/USB male in Italian "ZAZ de VA, I'm in QRU" (22Dec15) (AAI)
17469.0 ---: Russian Intel, RUS 1134 USB 4x3480ms CIS-3000 serial 3000Bd PSK-8 bursts flwd by MFSK-68(34+34) + QPSK 2400Bd 10KHz inserts each 1 sec, 60secs lasting (23Dec15) (AAI)
17540.0 ---: Russian Mil, 1405 USB CIS-112 OFDM 22.22Bd 25.6Hz BPSK, burst and stream mode (23Dec15) (AAI)
18667.0 ---: Russian Diplo, RUS 0740 (cf) Serdolik MFSK-34 40Bd 40Hz (CROWD-36) (24Dec15) (AAI)
19126.0 ---: Russian Intel, RUS 0730 USB MFSK-68(34+34) + QPSK 2400Bd 10KHz inserts each 1 sec (23Dec15) (AAI)
19305.0 ---: Russian Mil, RUS 1320 USB CIS-45 v1 OFDM BPSK 33.3Bd 62-5Hz (22Dec15) (AAI)
19670.0 LEB: Unid network 0909 USB MIL 188-141 2G-ALE calling KUL (31Dec15) (AAI)

2 January 2016

HFDL Ground Stations (traffic to and from)

HFDL (High Frequency Data Link) is a HF data link protocol, defined in ARINC spec 635-3.It may be described as some sort of HF ACARS.  It's used to exchange data such as Aeronautical Operational Control (AOC) messages, Controller Pilot Data Link Communications (CPDLC) messages and Automatic Dependent Surveillance (ADS) messages between aircraft end-systems and corresponding ground-based HFDL ground stations.
Transmissions on HF are in USB on a sub carrier of 1440 Hz with a symbol speed of 1800 baud. Modulation is 2-PSK, 4-PSK or 8-PSK with effective bit rates of 300, 600, 1200 or 1800 bits/sec.
The HFDL service is operated by ARINC as GLOBALink service through a worldwide network of HF stations. 

Ground Station ID 1
Longitude 121 45 34  W  Latitude 38 22 48  N 

Ground Station ID 2
Longitude 157 10 46  W  Latitude 21 10 47  N 

Ground Station ID 3
Longitude 21 50 59  W  Latitude 64 4 47  N 

Ground Station ID 4
Longitude 72 38 22  W  Latitude 40 52 47  N 

Ground Station ID 5
Longitude 174 48 35  E  Latitude 37 1 10  S

Ground Station ID 6
Longitude 100 23 24  E  Latitude 6 56 23  N 

Ground Station ID 7
Longitude 8 55 46  W  Latitude 52 43 48  N

Ground Station ID 8
Longitude 28 12 35  E  Latitude 26 7 46  S

Ground Station ID 9
Longitude 156 46 46  W  Latitude 71 18 0  N 

Ground Station ID 11
Longitude 79 32 59  W  Latitude 8 58 12  N

Ground Station ID 14
Longitude 92 18 0  E  Latitude 56 6 0  N 

Ground Station ID 13
Longitude 63 7 46  W  Latitude 17 40 11  S 

Ground Station ID 16
Longitude 144 48 0  E  Latitude 13 28 11  N  

Ground Station ID 15
Longitude 50 39 0  E  Latitude 26 16 12  N 

Ground Station ID 17
Longitude 15 23 23  W  Latitude 27 56 59  N