cars, chameleons, networks, and other stories (update)

6231 net (6231.0 KHz)
I recently spotted the frequency 6231.0 KHz on USB where stations connect following the same procedure as of AB-net and use STANAG-5066 HMTP protocol which is transported by a STANAG-4285 modem configured for 1200 bps and short interleaver (Figs. 1,2).  As in the 5054-net, the message transfer is not preceded by ALE or selcall phase and this supports the idea of scheduled tansmissions. 
The post related to AB-net and 5054-net (HRV MORH-u) can be read here.

Fig.1 - the HF waveform (Stanag-4285)

Fig.2 - 1776 bit period (Stanag-5066)

While the transmissions in the AB-net are scheduled on tuesday and thursady from 0830 UTC (0730, daylight savings time), transmissions on this frequency start  at 0800 UTC on monday and wednesday (most likely 0700, daylight savings time)[1]. These are the heard callsigns,  listed in the call-order: 
GHU3 (net-control station)
ONI6
ZIO4
OLI7
NIK2
ULI6
VEL8
CIK5
ZIL7
Stations are contacted a first time by GHU3 for a radio-check then, in case of messages, the stations shall be contacted a second time and in the same order. Unless the initial 188-141 2G-ALE phase, the message transfer follows the schema seen here, used in the AB-net.

The HMTP headers in Fig. 4 prove that this net belongs to the HRV MORH-u network as the previous AB-net and 5054-net: same OS (Linux Open-SUSE), same STANAG-5066 application ("CroS 5066", developed by CROZ) and same attachment filename.

Fig. 4

The examination of the headers of the Data PDUs (D_PDU) gives the chance to get the STANAG-5066 addresses of the nodes in the play. The D_PDU headers can be highlighted by synchronizing the bitstream on the 16-bit Maury-Styles sequence 0xEB90 since all D_PDUs, regardless of type, begin with that same sync (it's just this sequence that causes the 1776-bit ACF of Figure 2).

Fig.5 - D_PDU headers

The S-5066 addresses obtained from the recordings belong to the 006.008.003.zzz subnet, then 5054.0 and 6321.0 KHz  are just two channels of the same subnet.
Below the updated S-5066 Addresses Table and the Network Map. 

AB-net 5838.0 KHz (...)
ALE  S-5066 Add.       E-mail Add. 
ABC7 006.008.001.039   user1@asdf.123 (ncs)
ABD1 006.008.004.166   user1@sdfg.123
ABG6 006.008.004.165   user1@dfgh.123
ABF2 006.008.006.226   user1@fghj.123
ABS5 006.008.008.215   user1@ghjk.123
ABK4 006.008.002.144   user1@jklp.123
ABH3 006.008.002.055          ?

5054/6231-net 5054.0 KHz, 6231.0 KHz
CALL S-5066 Add.       E-mail Add.

GHU3 006.008.004.165   user1@aysxd.111 (ncs)
ZIO4 006.008.003.032   user1@oli93.111
     006.008.003.033   user1@lost62.111
NIK2 006.008.003.036   user1@dres32.111
ULI6 006.008.003.037   user1@fejk8.111
CIK5 006.008.003.039   user1@huba9.111
ONI6
OLI7
VEL8
ZIL7

Anyway, these are tactical callsigns and rotate likely on a monthly base: e.g. in January 16 2017  the station user1@huba9.111 has been heard with callsign CHP3 (was CIK5) and obviously with same S-50966 Address (006.008.003.039).

[1] further recordings are needed