22 May 2016

logs


06250.0 IABC: Italian Navy, I 1318 USB opchat with IDR, testing a faulty STANAG-4285 modem (17May16) (AAI)
06300.0 AVE: Unid Italian station 0920 J3E/USB op-chat with ROMA, QSY 5800.0  (20May16) (AAI)
06341.0 ---: Unid 1248 USB Thales Systeme3000 ALE (17May16) (AAI)
06417.0 XSL: Japanese Navy (aka Japanese Slot Machine) 2025 USB QPSK encrypted shore to ship (12May16) (AAI)
06790.0 4042: Sonatrach, ALG 0608  LSB MIL 188-141 2G-ALE sounding (21May16) (AAI)
06795.0 316013: Turkish Civil Defense, TUR 2202 USB MIL 188-141 2G-ALE global AllCall (16May16) (AAI)
06795.0 318018: Turkish Civil Defense, TUR 2153 USB MIL 188-141 2G-ALE global AllCall (16May16) (AAI)
06795.0 334018: Turkish Civil Defense, TUR 2201 USB MIL 188-141 2G-ALE global AllCall (16May16) (AAI)
06795.0 370018: Turkish Civil Defense, TUR 2156 USB MIL 188-141 2G-ALE global AllCall (16May16) (AAI)
06803.0 OC00: Austrian Mil, AUT 0754 USB MIL 188-141 2G-ALE handshake with OP00 then into MIL 188-110 App.B 39-tone (12May16) (AAI)
06815.0 JP20: Algerian Mil, ALG 0731  USB MIL 188-141 2G-ALE handshake with PY20 then into MIL 188-110 serial (12May16) (AAI)
06831.0 D20: National Protection and Rescue Directorate, HRV 0838 USB MIL 188-141 2G-ALE calling E5X (22May16) (AAI)
06831.0 E5X: National Protection and Rescue Directorate, HRV 0839 USB MIL 188-141 2G-ALE calling D20 [CMD AMD][RADIO TEST MESSAGE 22052016] (22May16) (AAI)
06831.0 R51: National Protection and Rescue Directorate, HRV 0839 USB MIL 188-141 2G-ALE sounding (20May16) (AAI)
06831.0 Z01: National Protection and Rescue Directorate, HRV 0825 USB MIL 188-141 2G-ALE sounding (22May16) (AAI)
06834.0 ---: Unid 1223 USB Thales Systeme3000 ALE (17May16) (AAI)
06867.0 (no call): Unid net 0736 USB MIL 188-141 2G-ALE calling ABK4 (12May16) (AAI)
06867.0 ABC7: Unid net 0729 USB MIL 188-141 2G-ALE calling ABD1 (12May16) (AAI)
06906.0 5001: Unid net 0607  USB MIL 188-141 2G-ALE sounding (21May16) (AAI)
06931.0 ---: Unid (prob. Croatian Mil/Gov) 0611 USB modified STANAG-4285 modem (21May16) (AAI)
06952.0 ---: Russian Intel, RUS 2044 (cf + 1600Hz USB) 5 x MFSK-16 10Bd 20Hz, BPSK 250Bd Hybrid modem (12May16) (AAI)
07739.0 4204: Sonatrach, ALG 0729 USB MIL 188-141 2G-ALE sounding (20May16) (AAI)
07814.3 C3: Royal Moroccan Army, MRC 0622 USB MIL 188-141 2G-ALE calling R3 (14May16) (AAI)
07890.0 CS001: Macedonian Mil, MKD 0635 USB MIL 188-110 ST sending FED-1052 App.B data to RS002 then terminate link (16May16) (AAI)
07950.0 FN01: Algerian Mil, ALG 0857 USB MIL 188-141 2G-ALE calling PY01 (20May16) (AAI)
08016.0 Z01: National Protection and Rescue Directorate, HRV 2001 USB MIL 188-141 2G-ALE sounding (12May16) (AAI)
08023.0 FQ55: Algerian Mil, ALG 0753 USB MIL 188-141 2G-ALE calling PY40, flwd by short (prob. Hagelin HC-256) scrambler and terminate link (20May16) (AAI)
08162.0 BX01: Algerian Mil, ALG 0737 USB MIL 188-141 2G-ALE calling BX02 (20May16) (AAI)
08162.0 MDN:  (prob. Algerian Ministry of Defence, ALG) 0745 USB MIL 188-141 2G-ALE sounding (20May16) (AAI)
08162.0 MV01: Algerian Mil, ALG 0738 USB MIL 188-141 2G-ALE calling PY01 (20May16) (AAI)
08162.0 PC02: Algerian Mil, ALG 0742 USB MIL 188-141 2G-ALE calling PY01 (20May16) (AAI)
13449.5 ---: Uk Mil/Gov, UK 1500 USB WINDRM modified waveform OFDM 51-tone (20May16) (AAI)
14710.0 RIA: Finnish Embassy Riyadh, ARS 1734 USB MIL 188-141 2G-ALE calling HKI2 Helsinki, flwd by SKY-OFDM 22-tone (12May16) (AAI)
17500.0 ---: Russian Intel/Diplo 0833 USB CIS-3000: PSK-8 serial tone, 2000Hz carrier, 3000Bd (17May16) (AAI)

21 May 2016

Unid FSK 300Bd/850


This FSK signal has been heard on 6699.0 KHz (cf), manipulation speed is 300 symbols/sec (quite unusual) and the shift between tones is ~850 Hz (pics. 1,2)

pic. 1
pic. 2
The transfer is continuous and data are encrypted but since I tuned it after its initial phase, I did not found any particular sequence in the demodulated bistream. However friends from radioscanner.ru that spotted a whole transmission say it contains KG-84 identifier in the initial part of the trasmission: this signal is reported here
The signal has a characteristic "batman-like" spectrum that exhibits 955Hz bandwidth (pic. 3)

pic. 3

16 May 2016

phase keyed signals, SA, and possible wrong demodulations

Playing with a STANAG-4285 signal and SA (Signals Analayzer) I met some problems in understanding correctly the synchronization sequence pattern of this waveform: the solution is very simple indeed and must be sought in the way the SA phase-plane module demodulator works. Below the story.
 
SA phase-plane demodulating a STANAG-4285 signal
 "The synchronization phase of the STANAG-4285 waveform consists of 80 symbols and is transmitted recurrently every 106.6 ms. This sequence uses 2-bit phase shift keying (2-PSK) modulation and the modulation rate is equal to 2400 bauds. The sequence is identical to a pseudorandom sequence of length 31, which is repeated periodically within the 80-symbol window, i.e., the synchronization sequence consists of 2 periods of length 31 plus the first 18 symbols of another period. A generator for the synchronization sequence is described in pic. 1. The generator polynomial is: x^5 + x^2 +1.
At the beginning of every frame the generator is initially set to the following value: 11010. The first symbol of the synchronization sequence is identical to the least significant bit of this initial value. The remaining 79 symbols are obtained by applying the clock 79 times.
The scrambling operation is carried out on reference and data symbols only, not on the synchronization sequence."
Fig. 1 - S-4285 sync sequence generator
Coding PSK-2 into 8-ary on air is achieved by mapping one-bit to one-symbol according to the following rule in Fig. 2: 
"000" tribit symbol for bit "0" (symbol 0) 
"100" tribit symbol for bit "1" (symbol 4)

Fig. 2 - 0-4 mapping
The S-4285 sync sequence generator can be synthesised running a simple Lua program: since the sync sequence is not subjected to the scrambling, the output file generated by the program is just the STANAG-4285 sync sequence that I need. The synthesised pattern of the sync sequence is visible using a bitstream analyzer (Fig. 3).
 
Fig. 3 - synthetized sync sequence pattern using the 0-4 mapping
Looking at a on-air STANAG-4285 demodulated by SA phase-plane, the 80 symbols sync sequence exhibits a different pattern than the one synthesised (Fig. 4)
 
Fig. 4 - synthesised 0-4 Vs on-air sync sequence patterns

The differences with the on-air signal are more evident looking at the sync sequence generated by a STANG-4285 modem (Fig. 5)
 
Fig. 5 - modem Vs on-air sync sequence patterns
while the synthesised and modem sync sequence patterns are the same, unless the polarity (Fig. 6) 

Fig. 6 - synthesised 0-4 Vs modem sync sequence patterns

Indeed, editing the mapBit() function of the Lua code adding a negative π/4 phase rotation, ie a 7-3 mapping, we get the same sync sequence pattern produced by the modem (Figs. 7,8)
  
local function mapBit(Ubit)
   if (Ubit == "0") then 
      8ary_symbol = {"1","1","1"} -- # symbol number 7
   else  
      8ary_symbol = {"0","1","1"} -- # symbol number 3
   end
    return 8ary_symbol
end

Fig. 7 - 7-3 mapping

Fig. 8 - syntesised 7-3 Vs modem sync sequences pattern
Editing the sync sequence generator, I found that a sequence that macthes the one of the on-air signal can be obtained by using the 4-0 mapping, ie by adding a π phase rotation as shown in Figures 9,10 (unless some uncertainties in the on-air signal):

local function mapBit(Ubit)
   if (Ubit == "0") then 
      8ary_symbol = {"1","0","0"} -- # symbol number 4
   else  
      8ary_symbol = {"0","0","0"} -- # symbol number 0
   end
    return 8ary_symbol
end

Fig. 9 - 4-0 mapping


Fig. 10 - synthesised 4-0 Vs on-air sync sequence patterns

I think that the differences between the sync sequences produced by the sythetiser and the modem and the sync sequence of the on-air signal are due to the phase-plane module of SA. SA is a signal analyzer and not a decoder, therefore its phase-plane demodulator does not sync  any particular protocol, as it happens for example in STANAG-4285 "suited" decoders. Working with phase keyed signals, the SA phane-plane demodulator produces right interpretations and views (number of phases, angles, modulation speed, carrier frequency,...) but it may return wrong demodulated streams due to the possible phase-offset errors.

13 May 2016

Link-11 SLEW: scrambler length and ACF value

TADIL-A/Link 11 is a secure half-duplex TADIL radio link used by US and NATO that receives or transmits --but not both simultaneously-- a sequential data exchange digital link.  It exchanges digital information among airborne, land-based, and ship-board tactical data systems. It is the primary means to exchange data such as radar tracking information beyond line of sight.
LINK-11 comes in two waveroms: the original Conventional  Link  Eleven  Waveform (CLEW) and Single (serial) tone Link Eleven Waveform (SLEW).


Single tone Link Eleven Waveform (SLEW) is one of the modes defined within the Link 11 NATO standard. For SLEW, a single analog waveform is generated for the upper side band, the PSK-8 modulation process is achieved by assigning the tri-bit numbers from the scrambler to 45-degree phase increments of a 1800 Hz carrier. Symbols rate is 2400 Bd while the user data rate is 1800 bps (pic. 1).

pic. 1
The SLEW waveform transmission format consists of an acquisition preamble followed by two or more fields. Each 45 symbols field is followed by a 19 symbols reinsertion probe. The first field  after the preamble is the header field and contains information that is used by the Combat Data System (CDS) and the encryption device. If there are data to transmit, successive data fields follow the reinsertion probe of the preceding fields (pic. 2,3).

pic. 2 SLEW waveform structure
pic. 3
Running the Cross Correlation or Auto Correlaton functions, a 64 symbols or 192 bits frame are expected, but in contrast the CCF output exhibits clear and strong 320 symbols spikes corresponding to a period of 960 bits. Note that five data and reinsertion-probe pairs are arranged inside the period window (pic. 4).

pic. 4 - SLEW waveform CCF result (133.33ms)
So, why the 133.33ms, or 320 symbols, period?
As in pic. 5, the 45 phase encoded pairs (values 0, 1, 2, 3) are mapped into tri-bit numbers (by multiplying by 2).  The tri-bit numbers (0, 2, 4, 6) are used for symbol generation and scrambled  to take on all 8 phase states. During the reinsertion probe, 19 tri-bits (set all to "000") are used for known symbol formation and scrambled.
 
pic. 5 - SLEW wavefrom formation (reinsertion probe and data field)
Since the scrambler could be an important factor in ACF generation,
let's give it a close look: it's worth to noting that the data sequence randomizing generator is the same 12-bit shift register used in MS188-110 serial tone!

"The tri-bit numbers supplied for the symbols (both data and probe) are modulo-8 added to a three-bit value supplied by the data sequence randomizing generator. At the start of the data phase, the shift register is loaded with the initial pattern 101110101101 (binary) or BAD (hex) and advanced 8 times. The resulting three bits are used to supply the scrambler with a number from 0 to 7 which is modulo-8 added to the data/probe symbol. The shift register is shifted eight times each time a new three-bit number is required (every transmit symbol period). After 160 transmit symbols, the shift register is reset to BAD (hex) prior to the eight shifts."

As seen in MS188-110 low data rates, this 12-bit randomizing generator is the cause of the Link-11 SLEW ACF.
In fact, since the scramble length of 160 symbols coincides with 2.5 frames, we get that each five frames - or just two scramble cycles(!) - the same probe value "000" is scrambled exactly after the same number of shifts and hence produce the same probe patterns (pic. 6). These same patterns repetion produces the 320 symbols (or 960 bit) spikes in CCF and ACF function.

pic. 6 (qualitative rapresentation, not in scale)

12 May 2016

SkyOFDM 22-tone, 64Bd QPSK, 2KHz bandwidth


this modem can be frequently spotted after the 2G-ALE handshake between Finnish MFA stations, being used to transfer data. Probably its development is by Sky Sweeper team, hence its name SkyOFDM. 
From Sky Sweeper manual
"SkyOFDM is a state of art high speed modem based on the OFDM and turbo coding technologies. It offers several baud rates (300-9600 bps) and two different interleaving options (short and long). Also there are two bandwidth options: 2.0 and 2.6 kHz.The receiver should be set to the USB reception mode.
The VHF/FM variant is not included in the SkySweeper Professional product.
"
 
This version use 22 tones with QPSK modulation at 64 Baud (pic. 2) and exhibits the same special char sent each 5 signal element periods, also visible after the ACF function (pic. 3)

pic. 2
pic. 3
This special symbol is also visible by highlighting a single tone and inspecting the bistream after the demodulation (pics. 4,5)

pic. 4 - analysis of the bottom tone
pic. 5
More info in the radioscanner site: 

 

logs

05892.0 ---: Unid (prob. Austrian Mil) 1505 USB MIL 188-110 App.B 39-tone QPSK (11May16) (AAI)
05892.0 OP00: Austrian Mil, AUT 1516 USB MIL 188-141 2G-ALE calling OC00 (11May16) (AAI)
05892.0 OY00: Austrian Mil, AUT 1513 USB MIL 188-141 2G-ALE calling OC00 (11May16) (AAI)
06329.0 OSY: Sailmail Brugge, BEL 2150 (cf +1500 USB) PacTOR-III, working PF6269  Dutch "Pleasure Ship" REBEL "PF6269 de OSY" (11May16) (AAI)
07617.0 302013: Turkish Civil Defense, TUR 2102 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 311013: Turkish Civil Defense Bilecik, TUR 2116 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 315018: Turkish Civil Defense Burdur, TUR 2054 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 324013: Turkish Civil Defense Erzincan, TUR 2053 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 327018: Turkish Civil Defense Gaziantep, TUR 2119 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 332013: Turkish Civil Defense Isparta, TUR 2118 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 349013: Turkish Civil Defense Mus, TUR 2058 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 357013: Turkish Civil Defense Sinop, TUR 2054 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 360018: Turkish Civil Defense Tokat, TUR 2101 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 364013: Turkish Civil Defense Usak, TUR 2100 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 371013: Turkish Civil Defense Kirikkale,TUR 2059 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 376013: Turkish Civil Defense Igdir, TUR 2121 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07617.0 8181: Turkish Civil Defense Cankiri, TUR 2121 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07739.0 3404: Sonatrach, ALG 2135 USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07739.0 4216: Sonatrach, ALG 2137 LSB USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07739.0 4216: Sonatrach, ALG 2137 USB USB MIL 188-141 2G-ALE sounding (11May16) (AAI)
07803.5 ---: Unid (prob. French AF) 2145 USB J3E male, loop recordered message “Execute TOABCD1910608K 2115z” (10May16) (AAI)
07898.0 049116: Deutsches Rotes Kreuz, D 2129 LSB MIL 188-141 2G-ALE sounding (11May16) (AAI)
08016.0 P34: NPRD Net Pozega, HRV 1534 USB MIL 188-141 2G-ALE sounding (25Apr16) (AAI)
08070.0 PY50: Algerian Mil, ALG 15:41 USB MIL 188-141 2G-ALE calling XS50 (25Apr16) (AAI)
08115.0 PY30: Algerian Mil, ALG 1537 USB MIL 188-141 2G-ALE calling RK31 (25Apr16) (AAI)
08182.0 XSS: UK DHFCS TASCOMM Forest Moor, G 1548 USB MIL 188-141 2G-ALE calling XBP (25Apr16) (AAI)
08190.0 RHN: Saudi AF Riyadh, ARS LSB MIL 188-141 2G-ALE calling AAN (11May16) (AAI)
10272.5 049119: German Red Cross, D 1521 LSB MIL 188-141 2G-ALE sounding (25Apr16) (AAI)
13233.0 ---: NATO French station 0836 USB (cf +2 Khz) NATO-FSK 75Bd/850 sending KG-84 encrypted traffic, opchat in French (30Apr16) (AAI)
17513.1 M42b: Russian Government & Intel, RUS 1504 (cf) FSK 50Bd/800 messages (10May16) (AAI)
18038.0 ---: Russian Mil, RUS 1034 USB CIS-45 OFDM HDR modem v1 33.33Bd BPSK (11May16) (AAI)
22499.7 ---: Unid 1356 BPSK 125Bd traffic, s/off 1400 (10May16) (AAI)

 

9 May 2016

unid PSK-8 & MFSK-8 with LFM pulses (prob. Iranian source)


this transmission is composed of messages that are sent using standard MS188-110 Serial Tone waveform (the ones indicated as 3, 4 , ...) and other messages (as 9, 11, ...) that are transmitted using a waveform that most likely is a proprietary variant of 188-110. The transmission ends with a short op-chat (providing some clues about the source) and one interesting MFSK-8 modulated segment the closes the link and characterized by the presence of an LFM pulse waveform preamble.
Below the analysis of the message #11 only since it's the better recording among the not-standard 188-110 signals.

For what concerns the carrier, modulation and symbols rate, the signal shares the same parameters of an MS188-110 modem: PSK-8 on a single 1800 Hz carrier frequency and a constant 2400 symbols/sec output waveform (Fig. 1)

pic. 1
 The structure of the signal is indeed different: after a ~211ms sync preamble phase, the data phase consists of 51.25ms frames of alternating data and known symbols (Fig. 2). After 57 data frames a symbol sequence (most likely a subset of the initial preamble) is reinserted possibly to facilitate late acquisition, doppler shift removal, and sync adjustment as requested by 188-110 standard (Fig. 3).

pic.2 - sync preamble and data phases
pic. 3 - preamble re-insertions
The most peculiar aspect of this waveform is its data frame that counts 123 symbols or 369 bit (51.25ms, as indicated by the ACF function in Fig. 4). The data frame consists of 91 data symbols and a mini-probe of  32 symbols of known data (Fig. 5).
The length of the mini-probe, 32 symbols, is quite common and is largely used in 188-110 waveforms, including the appendix D and C. The oddity is the 91 symbols length of the data block. 

We will need additional recordings to indagate it.

pic. 4 - 51.25ms ACF
pic. 5 - frame structure
 
About the short op-caht in the final part of the transmission, a friend of mine suggests that the language may belong to the  Iranian group (Dari, Pushto, Kurdish) and possibly the protocol itself is developed there. That recording is available for who wants to indagate, simply email me.

The MFSK-8 segment the closes the link is shown in the zoomed FFT of Fig. 6.
pic. 6 - the ending MFSK-8 segment
It consists of three messages, each consisting of a Linear Frequency Modulation (LFM) pulse preamble followed by the same wavefom as MS188-141 (8 tones, manipulation speed of 125 baud and 250Hz step between carriers) but with different libraries since it is undecodable (Figs. 7,8).
 
pic. 7
pic. 8 MFSK-8 grid
update: comment sent by ANgazu
I agree with your analysis. Just an error, probably a typo one: preamble reinsertion is in every 42 frames and lasts for about 2 frames, so the superframe should be 40 data frames + reinserted preamble ( 2.160 s) or preamble + 40 data frames.
The preamble is much longer than annex C (about 110  ms in this case) and probe is 32 symbols instead of 31, so I agree with you that this looks like a new variant.


That's correct ANgazu, thanks !

7 May 2016

CIS 3 x 100Bd/1440Hz VFT system


fig.1
In this signal we have three channels modulated at 100Bd and a pilot tone at ~3300 Hz (characteristic feature of Russian systems). Every channel has a 1440 Hz shift and 100 Baud speed, channels are separated by 480Hz steps (figs. 2,3) and interleaved as in fig.1
fig. 2 - 1440 Hz shift
fig. 3 - channel separation
The 100 symbols/sec modulation rate, is obtained by highlighting a single channel in the FFT and measuring its speed (fig. 4).

fig.4

CIS 6 x 100Bd/120Hz VFT system

fig. 1
in 6 x 100Bd VFT systems every channel has 120 Hz shift and 100 Baud speed, separation bewteen channels is 480 Hz (figs 2,3). Channels are arranged as in fig. 1.
 
fig. 2

fig. 3
This system can serve up to six outstations, in this sample only the lower channel is used (one-of-six mode) according to the needs at that time (number of the outstations to serve)  other modes are frequently observed:




2 May 2016

(CIS) OFDM 64-tone QAM-16, 40Bd


this is an interesting burst waveform composed of a two-parts preamble phase and a data phase; bursts have a duration of 2800ms and are 980ms spaced.

Preamble phase (pic. 1)
Part one
has a duration of 8 symbol element periods (~200ms) and consist of LFM pulse modulated data. Part two has a duration of 24 symbol element periods (~600ms) and consist of four unmodulated data tones with frequencies of 350, 1350, 2350 and 3350 Hz. During this part, the transmitted level of the 1350 Hz tone is 7 dB higher than the level of the 350 Hz and 2350 Hz tones and the transmitted level of the 3350 Hz tone is 7 dB lower than the level of the 350 Hz and 2350 Hz tones (pic. 2). Since the lack of the typical 3350 Hz tone, it's possible that the  1350 Hz tone could be used as Doppler correction.

pic. 1
pic. 2
Data phase (pic. 3)
The data phase has a duration of 2000 ms and consists of 64 QAM-16 data tones with constant modulation rate of 40 Baud. The 64 tones are 46.8 Hz shifted and spread about 2955 Hz bandwidth.

pic. 3
Detailed analysis in the OFDM module indicates that one special/service symbol is sent each five symbols (pic 4) and, as logically expected, it is confirmed by the 125ms value of the ACF (pic. 5).

pic. 4
pic. 5
Most likely this is a Russian signal: my friend KarapuZ sent me a recording with the evidence of a serdolik MFSK-32 ALE just before the OFDM 64-tone (pic. 6). That same ALE, characterized by the LFM period, was meet here (waveform s3):
http://i56578-swl.blogspot.it/2015/10/prob-new-serdolik-mfsk-burst-waveforms.html

pic. 6