29 October 2017

Maritime Interdiction Operations (MIOs) in Med'sea, a joint exercise?

The heard communications concern a Maritime Interdiction Operation (MIO) in Mediterranean sea and involve 2 vessels and one ashore station which acts as the net-control station by coordinating all the activities. It is not clear if  the heard activity is part of a routine patrol or rather a naval joint exercise. The ALE IDs used in communications (ie "CMOC", that could stands for Combined Maritime Operation Center), some terms in the messages (such as PUBEX, EVOLEX) and the "special" email domain name (here not reported for confidentiality) make me think to a MIO joint exercise. By the way, I did not find any related news in some specialized websites neither in press-agency sites.
The activity was heard on 7 and 8 MHz bands, expecially on 27 October. Communications  make use of 188-141 2G ALE for link setup while the messages are sent using a battle force email system based on STANAG-5066 HBFTP protocol. STANAG-4539/MS-110A are used as bearer HF waveforms, mostly QAM-64 9600bps and PSK-8 1200bps modulations (Figs 1,2). The STANAG-5066 addresses of the network nodes belong to the dummy block 10.000.000.zzz  which is not assigned to a country.
The language used for working out operational documents and for communications is English and French, this could be another hint in favour of a joint exercise.

Fig. 1 - STANAG-4539 transfer using QAM-64
Fig. 2 - STANAG-5066 stream
In addition to text or routine messages such as request to compress photos ("compresser la photo svp"), link informations ("liaison XXX to YYY par HF est nulle") or some ehortations ("veilles respecter le battle rythme et nous transmettre la situation RMP TN/DZ et vos position 12h00"), I saw some operational messages that are worth seeing. Although it could be a joint exercise, I avoid to go into details and some parts of these messages, as well as callsigns, are obscured or omitted for reasons of confidentiality of sensitive information. 

The firts two messages are related to the operation (tactical instructions?) and to the use of the MIO Board.

Fig. 3
Fig. 4
In Fig.5,  looks like they send informal ACP-like messages using email: note the from CMOC (Combined Maritime Operations Center?) to OTC (Operational Training Center?) header

Fig. 5
The operation was successull since the report on the interception of a boat of narcotrafficants (Fig. 6). Drug smugglers have thrown the material off at sea but it has been recovered by the navy sailors. Note how such reports are rigidly formatted in sections (termed "alfa", "bravo", "charlie") and sub-sections.

Fig. 6
Note also that in some messages, likely the more important ones, they make use of return receipts, as indicated by the MDN (Message Disposition Notification) tags in the email shown in Fig. 7 (turnaround time of 31 secs.). I saw MDNs in both English and French language.

Fig. 7
Many joint exercises (Phoenix Express, Morjane, Osis, MEDEX,...) take place every year in Souther Med'sea, so what I heard could be an ad-hoc scenario just established for this exercise.

update: 31 October 2017

...as expected:

23 October 2017

Japanese Navy "Slot Machine" w/ traffic forwards

Japanese Maritime Self-Defense Force ashore transmission from Ichihara, also known as "Japanese Slot Machine" (Enigma Designation XSL), with traffic segments  heard on 8590 KHz. Modulation used is QPSK 1500Bd (Fig. 1). The data frame structure consists of 140 symbols (28K+112U) with a 700-symbol super-frame (Figs. 2,3).
Streaming from remote SDR HL5NTR in South Korea, kindly sent me by ANgazu.
Fig. 1 - used modulation and ACF value

Fig. 2 - 140 symbols (28K+112U) frame structure

Fig. 3 - 700 symbols super-frame (5 frames length)


22 October 2017


04488.0: ---: Unid 0543 USB TADIRAN HF modem MFSK-4 125Bd/300Hz autocall (19Oct17) (AAI)
05270.0: IDR: Italian Navy S.Rosa Rome, I 0715 J3E/USB radio check with Filone, Bussola, Orale, I0951 (07Oct17) (AAI)
05298.0: ---: Unid 1627 USB Thales Systeme-3000 ALE / Thales analog voice scrambler (10Oct17) (AAI)
05298.0: RIHQ001: Unid (HRV NPRD Net ?) 0703 USB 188-141A sounding (07Oct17) (AAI)
05365.0: PO00: Austrian Military, AUT 0532 USB 188-141A call OY00 (05Oct17) (AAI)
05371.5: 9A4OS: Global ALE HF Network, HRV 0709 USB 188-141A sounding (07Oct17) (AAI)
05371.5: 9A5EX1P: Global ALE HF Network, HRV 0719 USB 188-141A sounding (07Oct17) (AAI)
05400.0: ---: Unid 1905 (cf) unid 2380Bd GFSK/PSK2, QPSK/PSK-2, MFSK-4/PSK-2 burst waveform (prob. Chinese made) (10Oct17) (AAI)
05402.0: FC6FEM: FEMA Region 6 HQ Denton TX, US 0526 USB 188-141A sounding (11Oct17) (AAI)
05413.0: ---:Russian Mil/Intel, RUS 1928 voice comms / CIS-60 OFDM 60-tones unmodulated (no data sending) (13Oct17) (AAI)
05788.0: PO00: Austrian Military, AUT 0542 USB 188-141A call OG00 (05Oct17) (AAI)
05798.5: B22: Unid (Dutch Military?) 0728 USB 188-141A handshake B21 / 188-110A Serial (07Oct17) (AAI)
05885.0: ---: Unid 0755 USB TADIRAN HF modem MFSK-4 125Bd/300Hz + scrambled speech (17Oct17) (AAI)
06213.0: ---: Unid 0635 USB 3G-HF 2-way FLSU handshake / Circuit Mode service using 188-110A serial (19Oct17) (AAI) (AAI)
06228.7: ---: Unid (KNL trials?) 0630 ISB ARQ system: user-data adaptive PSK-2 and QPSK 2400Bd burst waveform on USB, link/traffic management 1500Bd PSK2/QPSK burst waveform (12Oct17) (AAI)
06231.0: VBE3: Croatian Mil, HRV 0705 J3E/USB asking radio-check to ASQ8, OIL6, UTI7 (11Oct17) (AAI)
06233.0: ---: Unid 0756 USB 3G-HF FLSU asynchronous call, no reply (12Oct17) (AAI)
06239.0: ---: Unid 0630 USB unid PSK-2 4800Bd 6KHz modem (09Oct17) (AAI)
06239.0: CG47: Unid 0657 J3E/USB French lang male asking radio-check to DA34 (11Oct17) (AAI)
06246.5: ---: Unid (prob. Turkish Military) 0750 USB Marconi-25 OFDM 12+12 tones 48Bd QPSK (12Oct17) (AAI)
06251.0: XGK: DHFCS (reported as "mobile station"), UK 0746 USB 188-141A call XSS (19Oct17) (AAI)
06259.8: HWK01: Swedish Armed Forces, S 0736 USB 3G-HF 1-way FLSU / MIL 188-110A Serial, Circuit Mode tfc to HWK01, S5066 unid UDOP client (09Oct17) (AAI)
06320.0: Z1V: Slovakian Air Force Zvolen, SVK 0658 USB USB 188-141A handshake S1S multicast address / 188-110A Serial + STANAG-5066, sending HBFTP gzipped file (09Oct17) (AAI)
06329.0: OSY: SailMail Brugge, BEL 0617 USB (cf +1500Hz) Pactor-III, wkg FGD2123 "Welcome to SailMail Europe, station R-12, FGD2123 de OSY, QTC 1 msg 13384 char, AirMail-3.4.055-B2FHIM$" (09Oct17) (AAI)
06330.0: AA5: Israeli AF, ISR 0533 USB 188-141A sounding (17Oct17) (AAI)
06380.0: HBLZDRD1: Roumenian Military, ROU  0709 USB 188-141A handshake HFJCDRD1 / op-caht + FED1052, sending Harris Citadel encrypted file (09Oct17) (AAI)
06450.0: FUSCO: Guardia di Finanza Patrol Boat Fusco G125, I 2002 USB 188-141A call PALERMO (19Oct17) (AAI)
06510.0: M1I: Slovakian Air Force Mierovo, SVK 0753 USB USB 188-141A handshake Z1V Zvolen / 188-110A Serial + STANAG-5066, sending HBFTP gzipped file (09Oct17) (AAI)
06510.0: N1R: Slovakian Air Force Nitra, SVK 0722 USB USB 188-141A handshake Z1V Zvolen / 188-110A Serial + STANAG-5066, sending HBFTP gzipped file (09Oct17) (AAI)
06510.0: V1E: Slovakian Air Force (unid stn), SVK 0733 USB USB 188-141A handshake Z1V Zvolen / 188-110A Serial + STANAG-5066, sending HBFTP gzipped file (09Oct17) (AAI)
06510.0: Z1V: Slovakian Air Force Zvolen, SVK 0715 USB USB 188-141A handshake K1U Kuchyna / 188-110A Serial + STANAG-5066, sending HBFTP gzipped file (09Oct17) (AAI)
06670.0: CAMP: Unid 0732 USB USB 188-141A handshake OUTPOST / proprietary HF modem using modified 188-110A Serial & STANAG-4539 waveforms, 128-bit secondary protocol, prob 88-bit key encoded (09Oct17) (AAI)
06673.0: 6005: Unid 0530 USB 188-141A sounding (12Oct17) (AAI)
06728.0: 810002: Unid USB 188-141A sounding (12Oct17) (AAI)
06733.0: IDR: Italian Navy S.Rosa Rome, I 0755 USB wkg vessel P72, voice comms, data sending using FSK 75Bd/850 with KG84 encryption (06Oct17) (AAI)
06753.0: ND01: Unid (Tunisian net?)0911 USB 188-141A call SZ01 (05Oct17) (AAI)
06773.0: LUU: Austrian Military, AUT 0625 USB 188-141A 2-way handshake with OY00, no follow-up (05Oct17) (AAI)
06812.0: UDM: Unid 1825 CW repeating "UDM" (13Oct17) (AAI)
06840.0: R24504: US Army Helo, Sikorsky UH-60A Black Hawk 0823 USB 188-141A sounding (06Oct17) (AAI)
06851.8: ---: Unid 0811 USB STANAG-4197 ANDVT (09Oct17) (AAI)
06852.0: 002: Unid 0646 USB 188-141A call 001 (19Oct17) (AAI)
06867.0: ABC7: Croatian Military, HRV 0818 USB 188-141A call ABK4 (19Oct17) (AAI)
06884.0: POL3: Polish MSWiA, POL 0751 USB 188-141A call POL1 (17Oct17) (AAI)
06884.0: WARSZAWA2: Polish MSWiA Net, POL 0636 USB 188-141A call BYDGOSZCZ (05Oct17) (AAI)
06906.0: 3044: Unid 0709 USB 188-141A sounding (05Oct17) (AAI)
08257.0: 120715: Unid 1550 USB 188-141A sounding (09Oct17) (AAI)
10333.0: RCN: Saudi Air Force, ARS 1445 LSB 188-141A call NAN (08Oct17) (AAI)
10390.0: 24091: Moroccan Civil Protection, MRC 1135 USB 188-141A sounding (07Oct17) (AAI)
10713.0: SPT24: Polish Military, POL 1145 USB 188-141A handshake SNB813 AMD "QRA5584" / voice comms (07Oct17) (AAI)
13370.0: A98: Chinese Diplo, CHN 1335 USB 188-141A call D78 (05Oct17) (AAI)
13379.0: A98: Chinese Diplo, CHN 1331 USB 188-141A call D78 (05Oct17) (AAI)
13503.6  KWT93: US Dept of State Stn 1329 USB 188-141A call KWT96 (05Oct17) (AAI)
14953.0: ---: Russian Mil/Intel, RUS 0953 USB MFSK-16 66.66Bd 175Hz (18Oct17) (AAI)
15807.0: CM6: Commandant de la 6e region militaire Tamanrasset, ALG 0835 USB 188-141A handshake COF / 188-110A Serial, sending Harris Citadel encrypted file (19Oct17) (AAI)
16246.0: ---: Russian Mil/Intel, RUS 0950 USB CIS-45, OFDM 45-tones HDR modem v.2, BPSK 40Bd (19Oct17) (AAI)
16520.0: SUV: Unid 0854 USB 188-141A call OD0, copyied also 3G-HF soundings (19Oct17) (AAI)
16625.0: ---: Unid 1427 USB wideband BPSK burst modem 4800Bd/6KHz 9600Bd/12KHz 19200Bd/24KHz (18Oct17) (AAI) [1]
16657.0: ---: Unid 1000 USB wideband BPSK burst modem 4800Bd/6KHz (19Oct17) (AAI) [1]
16759.0: A98: Chinese Net, CHN 0903 USB 188-141A call D66 + proprietary MFSK-8 125Bd waveform (19Oct17) (AAI)
18493.0: ---: Russian Mil/Intel, RUS 0744 USB MFSK-16 33.33Bd 175Hz (18Oct17) (AAI)
20890.0: ---: Russian Mil/Intel, RUS 0831 USB CIS-3000 PSK-8 3000Bd burst modem / MFSK 32+32, CIS-3000 most likely used for link management (18Oct17) (AAI) 

21 October 2017

strong 4+4 π/4 DQPSK 75Bd Chinese modem

Strong copy of the 4+4 DQPSK 75Bd Chinese modem on 17149.7 KHz/USB at 0915, 1128 and 1129 UTC.

Fig. 1
Fig. 2
Fig. 3
Note the different periods in preamble, 36-bit length, and data segments, 12-bit length: most likely a 6-bit structure signal with 1 stop bit (Fig. 6)

Fig. 4 - 36-bit period in the preamble segments
Fig. 5 - 12-bit period in the data segments
Fig. 6 - 6-bit signal

The same signal was also heard few hours later (around 1130z) at -91dB and no QSB: too good conditions for a signal coming from China:

By the way, the Algerian Navy recently acquired three C28A Corvettes built in China [1] by Hudong-Zhonghua Shipbuilding Group, a subsidiary of China State Shipbuilding Corporation, this could explain the strength of the signal.


20 October 2017

BPSK 4800,9600,19200Bd 6,12,24 KHz (Marine Band)

Other WideBand burst waveforms spotted in HF Marine band: speed 4800, 9600 and 19200 Baud, bandwidth  6, 12 and 24 KHz.

Fig. 1 - 16625.0 KHz/USB
Fig. 2 - 16657.0 KHz/USB
Still uncertain whether these transmissions concern the over-the-air tests of KNL Networks CNHF (Cognitive Networked HF) system, as they illustrated in their presentation slide of this system (Fig. 3), or perhaps a real-world testbed/implementation.

 Some info about CNHF system can be read in their website.

19 October 2017

Radio Teleswitch, an example of AM Signalling System (AMSS)
(by ANgazu)

BBC Radio-4 (LF 198 Khz) is a radio station that broadcasts a great variety of programs. At first glance, it looks like any other AM commercial emitter, but there is a feature that makes it different: its carrier is PSK modulated, transmiting  data to switch electric meters and consumer appliances to take advantage of best electric tariffs [1].
This sample was recorded using TWENTE sdr in USB mode so to preserve the carrier, its spectrogram is as any standard AM broadcast (Fig. 1) and it's occupation is about 12 Khz as most AM comercial stations.

Fig. 1
When zooming on carrier (Fig. 2), there is a  signal using about 50 Hz BW on each side of the carrier and once filtered, the modulation speed is 50 symbols/sec (Fig.3).

Fig. 2
Fig. 3
In this case, carrier is the AM carrier so we  can go to  the signal constelation that shows that the carrier phase is shifted  ±  22.5º (Fig. 4). This small shift is suitable  for retrieving data and is small enough to avoid interferences with the intended AM signal.

Fig. 4
To  demodulate this signal, you have to filter out the carrier and proceed as in any BPSK signal. ACF is about 2 seconds, this means that there are 30 frames within each second and everyone carries 100 bits. Signal is "manchester" coded so we will have 50 bits of information per frame (Fig. 5). The signal is idling most of the time (01010101…) 

Fig. 5


14 October 2017

BPSK & QPSK 2400Bd, QPSK 1500Bd, ARQ system (Maritime Band)

Robust ISB SDR ARQ system heard on 6231.5 KHz/USB (Maritime Mobile band) 2800Hz offset from carrier, around 0630z on 12 October and in which the two channels are used as follows:

- on USB upper channel: user data transfer using adaptive 2400 Baud PSK-2 and QPSK burst waveform, according to the channel conditions and the feasible data-rate. Initial bursts use PSK-2 modulation at 2400 Baud;  
- on LSB lower channel: link and traffic management (ACKs and mode used for data transfer) using 1500 Baud PSK-2/QPSK waveform; 

is not clear if the change of the mode used for data transfer is signaled in the management channel by the caller or it is requested by the called station.

Fig. 1 - user data transfer waveform (upper channel)
Fig. 2 - link and traffic management waveform (lower channel)

At least in this sample, data bursts last 2088 msec for PSK-2 and 3144 msec for QPSK, the initial bursts have a duration of 520msec; link and traffic management bursts last 310 msec. PSK-2 and QPSK data bursts exhibit strong ACF spikes every 523 msec which suggest a 1256 symbols frame structure (Fig. 3); initial data bursts have ACF = 0, probably Walsh modulation is used (Fig. 4).

Fig. 3
Fig. 4
Together with IK1YDE we studied the bitstreams after PSK-2 and QPSK demodulations and found a frame structure similar to those provided by the recent MS-110 Appendix C for the waveforms ID 5 and 6 (Fig.5). Indeed both PSK-2 and QPsK frames consist of 288 symbols (Fig. 6): 32 knwon symbols (mini probes) followed by 256 unknown (data user) symbols. It must be noted anyway that the data rate of the analyzed waveform (in its USB channel) is 2400 Baud and doesn't match the one provided by the waveforms 5 and 6 of MS-110 App.C.
Most likely the 1256-bit ACF is due to the length of the interleaver or the scrambler sequences.

Fig. 5
Fig. 6 - data bits and symbol numbers

A similar system was heard on 5 November 2016: in that case ACK burst were sent after each BPSK data burst (Figs. 7,8)

Talking with KarapuZ about this system, he suggested a SDR equipment rather than a ISB mode (I edited the text of the post accordingly) and proposed to have a look at the KNL Networks website since they are testing a proprietary 3G HF hybrid system (termed CNHF) to support the ship traffic in Artic regions [1]. In that high latitudes satcomm links can't be easily used since geostationary satellites do not cover these areas, moreover due to the long dark periods the low portion of HF shall be used (lack of F layers). Perhaps may catches are related to their tests... but it's only my guess (I emailed them to ask a confirm and maybe shed some ligth on this system).

TADIRAN HF modem running in scrambler mode

TADIRAN HF modem, probably the HF-6000 model, running in COMSEC mode using FSK 125Bd/300Hz and scrambled voice-comms. Transmission heard on 5885.0 KHz/USB at 0755z with a very poor SNR. The sample marked as "A" is the "autocall" waveform: it precedes the MFSK/scrambler sessions, marked as "B", and terminates the link (Figure 1).
Fig. 1
The FSK segmentes sent during the scrambled voice-comms have a speed of 125Bd and 300Hz shift (same parameters of the MFSK-4 waveform):

Fig. 2

A distinctive feature of the FSK waveform is the TADIRAN "business card" that consists of a 84-bit period shown in Figure 3.

Fig. 3

12 October 2017

OFDM modem 12+12 tones 48Bd (Marconi 25-tones)

Probably a simplex transmission heard on 6246.5 KHz/USB. Although the SNR is poor, it's possible to see a central un-modulated tone a + 1500Hz  that splits the signal in two identical parts which I analyzed separately. The results show an OFDM modulation of 12 + 12 tones at a rate of 48 symbols/sec; the on-air constellation seems to be QPSK on each channel.

Fig. 1
Fig. 2
Fig. 3
 The initial part exhibits an upper un-modulated tone and a short FSK

Fig. 4

 Modem name and users are unknown to me.

thanks to hf_linkz who pointed me to the correct identification of this modem: it's the "Marconi 25-tones" as depicted here: