a (possible) 3G-HF multicast transfer with MDLN protocol

This burst-trasmision has been heard on 13505.0 KHz/USB at 1120 UTC (27 Oct). All of the burst waveforms use an 8-ary PSK serial tone modulation of an 1800 Hz carrier at 2400 symbols per second (fig. 1)

fig. 1

The analysis of the bursts say that they belong to the HF burst waveforms described in STANAG-4538 3G-HF, specifically: after the initial BW5 FLSU burst, there are four BW3 tansmissions which transport 4 x 512 bytes of data and two zero-filled BW3 transmissions which transpot 2 x 51 bytes of data. The transfer ends with a single BW4 burst. BW3 and BW4 waveforms are used by LDL protocol, as defined in STANAG-4538.

fig. 2 - BW3 burst

fig. 3 - BW4 burst

In a normal  LDL data transfer, the sending station and the receiving station alternate transmissions in the manner of figure 4: the sending station transmits LDL_DATA PDUs containing payload data  packets,  and  the  receiving  station  transmits  LDL_ACK  PDUs  each  containing  an acknowledgement  of  whether  or  not  the  data  packet  in  the  preceding  LDL_DATA  PDU  was received without error. The LDL_EOM PDU is transmitted using  the  BW4  waveform indicating that the entire user  datagram  has  been  delivered  to  the  receiving  station  without  errors ( LDL_EOM  PDUs  are  distinguished  from  LDL_ACK PDUs by context: any PDU sent using BW4 in the forward direction is an LDL_EOM PDU, while any PDU sent using BW4 in the reverse direction is an LDL_ACK PDU).

fig. 4 - 3G-HF LDL protocol transfer session

Conversely, in this recording there are no BW4 ACK bursts returned by the receiver station but only a final BW4 burst... unless the BW4 ACKs were transmitted and I did not receive them (Fig. 5):

fig. 5 - the heard 3G-HF session

The supposed lack of ACKs in figure 5 leads to think to a non-ARQ multicast transmission or a trasmission for recipients which are in EMCON (Emission Control): anyway STANAG-4538 does not provide the non-ARQ modality and the HDL/LDL protocols are for point-to-point applications only.

A possible scenario could be the use of the MDL-NACK protocol, Multicast Data Link with NAKs or MDLN. MDLN is a 3G multicast protocol with embedded retransmissions, it's added alongside the point-to-point 3G data link protocols HDL, HDL+ and LDL and shares many of the characteristics of the other 3G data link protocols (fig. 6).

fig. 6 - extended 3G-HF

In MDLN each forward transmission is followed by a pause during which receivers that were not able to decode that transmission emit a very robust pseudonoise (PN) PSK symbol sequence to request retransmission (fig. 7). All receivers share the NAK slot. (Detection of the PN NAK sequence is sufficiently robust to allow any number of NAKs to overlap during the slot.) When the sender detects a NAK, it sends additional redundancy bits. Thus MDLN, like the point-to-point ARQ protocols, sends only enough redundancy to convey the message error-free. 

In our case, the data transfer is performed using MDL-512, a robust mode that uses a stream of 512-byte BW3 bursts. All recipients have decoded the entire transmission so we do not see NACKs.

fig. 7 - MDL-NACK opeation

MDL-MDLN protocol has been introduced in "Third Generation and Wideband HF Radio Communications" and in "Military Communications Conference, 2005" by E. Koski - Harris Corporation. The presence of the Citadel pattern (fig. 8) in the decoded bistream is a strong clue and would just confirm the use of Harris equipment. The transfer contains only one encrypted datagram. Obviously, the encryption is off-line.

fig. 8 - Citadel encryption

https://yadi.sk/d/7sMqo4-OxnJEm