Chinese Navy (PLA Ny) MFSK-8 125Bd & PSK2 2400Bd mixed mode

Complete and good quality data transfer session recorded on 10346.0 KHz/USB at 2153 UTC thanks to a KiwiSDR located in Oita, Japan [1].

Fig. 1 - Complete data transfer session

In the first part of the recording, the one related to the link setup, we can see standard MS 188-141 exchanges preceeded by bursts which use short MFSK-8 125Bd 250Hz segments (just the same tones of MS-141 but w/out the 6th tone). Perhaps they do not use this MFSK waveform as an ALE resource since they just use the standard 188-141. The involved ALE callsigns are AN1 & BN2, according to UDXF logs these IDs belong to the China's Navy (PLA Navy, People's Liberation Army Navy).

Fig. 2

The most interesting part is the one related to the data transfer. In my opinion, although constellation and state's transitions indicate a PSK4 modulation, the trajectories and the phase detector indicate that the main transmission mode is PSK2 (Figs. 3,4).

Fig. 3

Fig. 4

Probably, the four-state constellation is due to the inserts you may see below in Figure 5 (Figure 6).

Fig. 5

After PSK4 demdoulation, the resulting bitstream shows a well-defined 8-bit format.

Fig. 6

A Chinese PSK2 2400Bd serial waveform was already commented here: unfortunately, the bitstreams have different structure and patterns.

https://disk.yandex.com/d/IGweBYIwpB4dtg

[1] https://flydog.web-sdr.net/?f=10346.00usbz8

CIS FSK scanning SelCall (ACS/C)

This is an example of a CIS ACS/C (Automatic Channel Selection/Control) scanning SelCall [1], in this case a scan set of seven channels is used. The signal was recorded by my friend AngazU in two occasions and presents some interesting aspects. As shown in Figure 1, the call consists of five scanning cycles: the 3 centrals ones, each consisting of all the seven channels of the scan list (1-7), plus the first and the latter ones consisting respectively of the four upper channels (4-7) and the three lower ones (1-3): this way each channel of the scan list is "worked" four times. Since the scanning mode, the call (and probably the system) is asynchronous.

Fig. 1 - the five CIS ACS/C cycles

The main parameters are (Figure 2):

- used modulation in channels is FSK at 150 bps with a shift of 200 Hz;
- separation between channels is 4 Khz, for a total bandwidth of ~24 KHz *
- each FSK segment has a duration of 4000ms (see below) or 600 bits, which makes a 28s duration for a complete scanning cycle;
- the scanning call lasts 1m 50s;
- transition time between two consecutive channels is pratically zero. 

* the occupied bandwidth in Hz may be computed as ~[(N-1) × 4000 + 2×Br], in this sample N=7

Fig. 2 - main parameters

The FSK segments exhibit a 300 ms ACF and consist of a 45-bit repeated sequence (Figure 3), obviously all the segments transmit the same data.

Fig. 3 - a demodulated bitstream

It's worth noting that a 15-bit encoding would make sense.

As from Figure 1, the last FSK segment is shorter (~ 2240ms instead of 4000ms): the sequence before the trailing "1s" seems to be 1 bit off from the previous pattern, maybe it's a streaming failure (Figure 4).

Fig. 4 - last FSK segment

The second recording (Figure 5) shows the same scan set arrangement (4-7, 1-7, 1-7, 1-7, 1-3) except for a short FSK segment in the third scan cycle (Figure 6): it's not possible to know if it is intentional or is a malfunction or maybe - as assumed for the last segment - a streaming failure.

Fig. 5

Fig. 6

About the length of the FSK segments it's interesting to notice in Figure 7 that the very first segment, and only this, lasts 4040ms and consists of an initial preamble consisting of a 460ms "01"s sequence followed by a ~ 3580ms length data of the selcall: probably the preamble signals the start of the scanning cycles.

Fig. 7 - "01"s preamble in the first FSK segment

Even more interesting is that the preamble seems to be keyed at the speed of 160 bps and thus consisting of 73-bit length reversals: Figures 8, 9 clearly indicate the different speeds.

Fig. 8 - different modulation speeds detected with the "zero-crossing" method

Fig. 9 - 160 and 150 bps FSK demodulations

The scanning system makes probably use of the CIS Selcall waveform [2] "Vishnya" (from the name of the R-016V "Вишня" radio  equipment): indeed modulation, bps, shift and ACF match. It must be said, however, that although I referred to the transmission as a "call" it could also be an LQA or other type of message/signaling. Apparently - at least in this portion of band - there is nor reply from the called station.

By the way, also this (quite rare and old) signal was heard using a remote SDR located in Ukraine... unfortunately, many interesting signals are on-air in that unfortunate area.

https://disk.yandex.com/d/MuMLNeTCkb4npg

[1] http://signals.radioscanner.ru/base/signal251/
[2] http://signals.radioscanner.ru/base/signal106/

yet another unidentified "embroidery"

updated

Unid signal noted on 7005 KHz/USB, "patterns" are sent each 1328 ms and have a duration of 672 ms (2000 ms cycle). Transmissions occur during the afternoon, not all the days, and last 2 hours. As per Kiwis and some observations, this new waveform could be from Russia.

Fig. 1

Could be a kind of "image" formed by the array of multiple frequencies, just like the HAM calls sent in SSTV broadcasts, but it's only a my guess and further recordings could clarify source and users. Comments are welcome.

https://disk.yandex.com/d/Kvog7RX83oppFA 

19th August update
I want to thank my dear friend cryptomaster who suggested that this signal could be an "evolution" or a modified version of the Turkish waveform shown here:
http://i56578-swl.blogspot.com/2023/05/a-strange-as-unid-signal-appeared-last.html

If he's right, as I think, this would be a good step forward.
 

ECCM Frequency Hopping Spread-Spectrum (FHSS) example

Looking at the spectrum of the receivable signals around 7 MHz in the UKR skyes, as well as numerous and very frequent STANAG-4538 and L3Harris WHARQ waveforms, it may happen that we observe transmissions in frequency hopping mode (FHSS, or Frequency Hopping Spread-Spectrum) as shown in Figure 1.
Frequency hopping (also known as ECCM, Electronic counter-countermeasures) is the most commonly used Transmission Security (TRANSEC) technique. The frequency hopping capability provides advanced anti jam protection for communications. In HOP radio mode, the transmitter frequency changes so rapidly that it is difficult to intercept or jam the signal. For additional security, hopping data and digital voice data can be encrypted. 

Fig.1 - FHSS transmission

Me and my friend ANgazu from radiofrecuencias.es had the chance the analyze these signals and share the results. We observed transmissions which use 26 or 27 channels and occupy a bandwidth of 81 KHz, since each channel is 3 KHz wide (2700 + 300 Hz separation). Hopping rate is 8.88 sps with an hop time of ~112.5 ms (say 102 ms ON, 10.5 ms OFF).

Fig. 2 - FHSS single channel frequency occupation

Fig. 3 - FHSS timing

Like a single-channel serial tone waveform, the modulation used is 2400 Bd PSK8 for both voice and data (Fig. 4).

Fig. 4 - FHSS modulation

This waveform is fielded in AN/PRC-150(C) radios by L3Harris. Wideband hopping covers a frequency band that is bounded by a lower and upper frequency specified in multiples of 100 Hz, frequency exclusion bands may also be programmed. AN/PRC-150 narrow band hopping uses frequencies within a defined bandwidth of the center frequency (Fc) as in the Table below: notice the reported 81 KHz bandwidth  in case of  3.5 MHz <= Fc < 9.995 MHz.

Table 3.16 - L3Harris AN/PRC-150 operation manual

An important aspect of hopping is synchronization, ie all radios in a net shall use the same frequency at the same time intervall: that alignment may be accomplished with the use of GPS, but is some in cases (very very rare) it uses the manual  3x4 sync sequences as shown in Figure 5.

Fig. 5 - 3x4 sync sequences

If our guess is correct, we can assume a large employ of L3Harris equipmente in that (war) theatre.

https://disk.yandex.com/d/YFFDFIUrTFQ2oA

FSK 150Bd/500, prob. RusAF "Chayka" (telecode "Seagull")

Interesting catch of some short FSK signals on 6885.5 KHz (cf) with modulation speed of 150 bps and shift of 500 Hz. The FSK parameters and the receiver used, an AirSpy server in Ukraine, are good indications in favor of the Russian Air Force system called "Chayka" ("Чайка", Seagull): a command/signaling message system, encrypted, used for military aircraft-ground communications.

Fig. 1

The used equipment could be Р-095 or Р-099 (R-095 and R-099, if translated), that is "aviation on-board telecode communication equipment" [1][2]: increasing the gain of the spectrum to 65 dB (Figure 2) is also possible to detect the message sent by the corresponding station so that we can see both the air & ground versions (...admitted that I have really heard a Chayka signal).

Fig. 2

A "Chayka codegram" may consist of separated segments and/or insertions, as clearly visible in Figure 3 where the signal has been resampled to 3788 KHz.

Fig. 3

By the way, specialists of the Kaluga Research Institute developed the high-speed communication P-097M, that is the successor of P-099 Chaika: one of the key differences between the new system and its predecessors is the high automation [3].

source: (http://wiki.airforce.ru/ - List of airborne radio communications: Data communication equipment)

As a final note, Figure 4 shows that the phases of the two frequencies are not constant and change after every switch:  a single oscillator, maybe a VCO, is used (if two distinct generators were used we would see no phase changes). Given that Figure 5 shows the durations of two periods, it's possible to come back to the two tones frequency:

2: 0.001286 = 1555.20 Hz
2: 0.001896 = 1054.85 HZ

ie just 500 Hz shift.

Fig. 4

https://disk.yandex.com/d/toc0K7MpLq94ZQ

[1] http://wiki.airforce.ru/
[2] http://www.rwd-mb3.de/ntechnik/pages/ng_r.htm
[3] https://www.aviaport.ru/digest/2020/07/06/644509.html

unid 100Bd PSK2

 Unid 100Bd PSK2 signal recorded on 4844.0 KHz and 6819.5 KHz USB (Figure 1)

Fig. 1

The demodulated bistreams, after differential decoding, show two different 133-bit length periods: supposedly, the first one (4844.0 KHz, Figure 2) is a combination of the source and destination address while the second one (6819.5 KHz, Figure 3) seems to refer to sending a message - several times repeated - to the correspondent. It's worth noting in the demodulated bitstream of Figure 2 what seem to be five "sections" following the header (that's the same in the two bitstreams).

Fig. 1

Fig. 2

More material is needed to fully understand the nature of such communications, comments are welcome.

https://disk.yandex.com/d/cDnTYrXiGDA1fA

PolAF, UUCP over RSX.25 to exchange HF email messages

I have already encountered the Rohde & Schwarz RSX.25 protocol in some transmissions of the German BPOL and Italian GdF, this time (just a few days ago) I spotted such transmissions from the Polish AirForce (Siły Powietrzne - Ministerstwo Obrony Narodowej, MON) on 6884 KHz/USB where they use R&S GM2100 proprietary waveforms as HF bearer and UUCP over RSX.25 to send PostMan II email messages (Figure 1). Transmission were recorded using a Polish KiwiSDR [1].

Fig. 1

Particularly, one of the transmissions being analyzed refers to the nodes with ALE address WARSZAWA2 and BYDGOSZCZ:

TO WARSZAWA2 TIS BYDGOSZCZ
TO BYDGOSZCZ TIS WARSZAWA2
TO WARSZAWA2 TIS BYDGOSZCZ User Unique Function 00 07 (CMD USER UNIQUE WORD)

The used 2G-ALE protocol is the well-known standard 188-141A: the first thing that catches the eye is the use of a User Unique Function (UUF) [2] with the value 00 07 (14-bit ASCII [nul][bel]) in the third frame of the ALE handshake. User Unique Functions enable the transmission of a manufacturer-specific Unique Index which may be used for controlling the subsequent data transmission protocol; in this case, the value 0007 is most likely the particular "index" that R&S uses to signal UUCP/RSX.25 protocol to the receive node.

Data are sent using the HF waveform "Signal Format", a so-called R&S proprietary advanced waveform provided by their GM2100/GM2200 HF modem. The used waveform is the quite common 2400Bd PSK8 occupying a 3 KHz bandwidth (Figure 2). With 8PSK the net data rate of the serial modem is 5400 bit/s, errors are at first corrected by FEC, which reduces net data rate to 2700 bit/s. 

Fig. 2

The framing consists of a 192-symbol sequence preamble followed by one ore more data blocks each consisting of 64-symbols: 48 unknown symbols (coded data) + 16 known symbols ("test sequences"). The postamble terminates the data blocks and consists of a 64-symbol End Of Message sequence. Except for the presence of an initial TLC section(s), the total length is then a multiple of 64 symbols.

Fig. 3

Figure 4 shows the ACF/period of the GM2100 waveform: since the 2400 Baud, the ACF value of 133.33ms corresponds to a 320-symbol period, ie to five 64-symbol data blocks.

Fig. 4

The length of 320 symbols is due to the fact that the 16-symbol test sequences are actually "segments" of a longer 80-symbol sequence and so they are five times repeated, as visible in Figure 4 (unless demodulation errors), hence the length of (48+16)×5=320 symbols, or 960 bit since each PSK8 symbol is mapped to a tri-bit sequence (000...111). 

Fig. 5

After the removal of the HF waveform overhead, the well-known 8-bit patterns of RSX.25 emerge (Figure 6). RSX.25 literally stands for R&S adaptation of wired X.25 protocol to the HF radio channel,ie a modified AX.25 packet radio protocol.
Quoting R&S papers: "RSX.25 organizes the data to be transmitted in packets, which are successively transferred to the data modem. The packets contain a variable number  of  frames, the number per packet depending on radio-link quality and being adapted at regular intervals. The data transmitted in a packet are distributed among the frames. The length of the frame data is variable and also depends on radio-link quality: in channels of very good quality, a frame contains up to 250 data  bytes, in strongly disturbed channels 4 bytes. Errors escaping FEC are eliminated by the ARQ procedure of the RSX.25 protocol." [3]

Fig. 6

The transmitted data are obtained after the removal of RSX.25 encapsulation and packets' reassembly, the file (Hex codes and ASCII text) is edited using the XVI32 hex editor [4] and shown in figure 7. Some known "reserved words" and syntax say that's an email transport performed by the use of UUCP: all messages in the initial handshake begin with a `^P' (a byte with the octal value \020, hex  0x10) and end with a null byte (octal \000, hex 0x00).

 

Fig. 7

UUCP (Unix-to-Unix copy) suite is a set of computer programs and protocols that allow for the remote execution of commands and the transfer of email and files between computers, in this scenario it is used over RSX.25. The human-readable version of  the UUCP "conversation" (just the initial part)  is shown in Figure 8.

 

Fig. 8

The messages can be parsed according to the UUCP protocol internals [5] so to get some other informations about users, SW/HW equipment... and so on.

 

login...Connected...OK 

login section

S Bydgoszcz_HF -pz -vgrade=z -R -N07 ROKN07 Pyie Uy

UUCP handshake 
S  caller hostname = Bydgoszcz_HF
-pz -vgrade=z  requests the called system to only transfer files of the specified grade or higher = z (grades in UUCP links means 'priorities')
-R  caller UUCP understands how to restart failed file transmissions. Supported only by System V Release 4 UUCP, so this is a System V release.
-N07 - caller UUCP understands the Taylor UUCP size negotiation extension (only for UUPlus, so this is UUPlus)
ROKN07 – called station acknowledgement of ‘R’ options. The caller UUCP is acceptable, it specified `-N', and the called UUCP also understands the Taylor UUCP size limiting extensions
Pyie  the called station supports the following UUCP protocols y, i, e
Uy  the calling station selects which protocol to use out of the protocols offered by the called station, in this case the UUCP protocol 'y'

 

pm2mrs -CR D.0097 0666 dso22odn@bydgoszcz.airforce.pl 0x3d26

most likely R&S PostMan II messenger

D.0097 file to send
0666 mode of file, if UUPlus always = 0666 for outgoing files
dso22odn@bydgoszcz.airforce.pl file name
0x3d26 file size (15654 bytes) 

rsmail -v2 -f dso22odn@bydgoszcz.airforce.pl dsocop@warszawa2.airforce.pl

Since PostMan offers  e-mail, fax and file transfer, my guess is that the additional command rsmail (most likely R&S mail)  following the pm2mrs invocation just specifies the email service

dso22odn@bydgoszcz.airforce.pl the caller station (ALE address: BYDGOSZCZ) is the "22 Ośrodek Dowodzenia i Naprowadzania" (22 Command and Guidance Center) [6] located st Bydgoszcz Airport: it's a civilian airport but shared with the Polish Air Force
dsocop@warszawa2.airforce.pl it's the called station (ALE address: WARSZAWA2) , "dso cop" is probably the Armed Forces Operational Command in Warzawa (it's a my guess)

It's interesting to note that in some other recordings the email address are user@warszawa2.airforce.pl and user@bydgoszcz.airforce.pl ("user@" is the common default username as in other message handling systems), although the ALE address remain the same, ie WARSZAWA2 and BYDGOSZCZ.

 

BZh9
Bzip2 4 bytes header, here starts the file to be sent (Bzip compressed)
BZ  Signature (0x425A magic number)
h Bzip2 (h is for Huffman coding)
9  increments of 100 kB block-size uncompressed

It's really obvious that the two stations belong to the Polish Air Force (indeed "airforce.pl" is the email domain name) as well as the use of R&S hardware/software equipment (STANAG/MIL-STD waveforms cannot be used along with the RSX.25 protocol [7]). 

A bit of OSINT demonstrates the R&S support to the Polish Armed Forces:

https://www.epicos.com/article/475115/rohde-schwarz-supports-polish-armed-forces

as well as the use of R&S XK2500L and XK2900L radios (along with Harris RF-5800) at the "Radio Center, Region 4 Air Force ICT Support":

http://www.szpzl-zegrze.waw.pl/pdf/k/29/5.pdf 

https://archiwum-4rwt.wp.mil.pl/pl/31.html 

 

Must be noted that PostMan II (now superseeded by PostMan III) is a combined R&S hardware & software product running on a Unix-like communication server: hence the use of such OS, at least in the mail server of the local nets.

Further catches could offer the chance to gather some more intelligence.

 

https://disk.yandex.com/d/ZapUYqs-xgddiQ 

 

[1] http://plonsk3.proxy.kiwisdr.com:8073/
[2] http://hflink.com/standards/MIL_STD_188-141C.pdf  (A.5.6.9 User unique functions)
[3] https://cdn.rohde-schwarz.com/pws/dl_downloads/.../n155.pdf

[4] http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm
[5] http://www.math.utah.edu/docs/info/uucp_5.html

[6] https://22odn.wp.mil.pl/pl/
[7] https://scdn.rohde-schwarz.com/.../Postman_en_.pdf

 

unid 2000Bd PSK8 burst transmission (720 symbols frames)

Unid burst transmission recorded on 5330.50 KHz/USB (60 mt HAM band) using a remote KiwiSDR locate at Oita, Japan [1]. The bursts have a duration of about 2606 ms with an interval of 3390 ms, the occupied bandwidth is 2200 Hz (Figure 1).

Fig. 1

 

The measured symbol rate is 2000 Bd on a 1274 Hz carrier: most likely 1200 Hz is the right value. The transitions diagram and the harmonic spectrum in Figure 2 show the use of PSK2 and PSK8 modulations, in particular PSK2 seems to be used for the initial preamble and for the inserts (miniprobes?) preceding the data blocks, the latter being modulated using PSK8. Obviously, PSK2 dibits are scrambled to appear on air as PSK8 tribit symbols.

 

Fig. 2 - PSK analysis

 

Bitstream analysis of a single burst, after the removal of the preamble, reveals the use of six frames (as indeed visible in the previous Figure 2) each characterized by a length of 2160 bits or 720 symbols. More precisely, each frame consists of a first sequence of 72 known symbols, followed by 72 unknown symbols (use of 720/72 symbols is curious) and finally by another 576 unknown symbols (216+216+1728 bit). Figure 3 clearly shows this frame structure. By the way, the initial 72 symbols sequence can be descrambled by the polynomial x^9+x^6+x^3+1 (1).

 

Fig. 3 - bitstream analysis

Symbols-oriented analysis of Figure 4 helps to better define the composition of the frames and particularly the used modulations. Indeed, looking at the 144 symbols diagram, the first 72 symbols are PSK8 modulated while the following 72 symbols are clearly modulated using PSK2.  Thus, each 720 symbols frame consists of an initial 72 known symbols sequence with PSK8 modulation, 72 unknown symbols with PSK2 modulation and 576 unknown symbols with PSK8 modulation.

 

Fig. 4 - symbols analysis

As from Figure 2, each burst has a duration of 2606 ms that - at the symbol rate of 2000 Bd - makes a total of 5212 symbols. Since each burst consists of six 720 symbols length frames, ie 4320 symbols, it follows that the initial preamble is composed of (5212 - 4320) = 892 symbols. Figure 5 shows the preamble and its symbols analysis, from which it can be seen that PSK2 modulation is used (except for some initial "uncertainties" due the SA generic PSK demodulator I used). Preamble can be descrambled using the polynomial x^6+x^3+1 (1).

 

Fig. 5 - preamble analysis

Evidence of Direction Finding (TDoA algorithm) indicate an area of the transmission site that could be compatible with Guam Island (Figure 6). However, in evaluating the goodness of such results it must be taken into account that the survey area is not densely populated with KiwiSDR receivers, especially in the East direction, and that the transmission was not continuous but - in fact - a train of bursts (although quite close together).

Fig. 6 - some Direction Finding (TDoA algo) results

https://disk.yandex.com/d/zu3AE6Ossjl_gQ 

(1) SA is a signal analyzer and not a decoder, therefore its phase-plane demodulator does not sync any particular sequence, as it happens for "suited" decoders, and phase-offset errors are possible. 

[1]  http://flydog.web-sdr.net/

unid 15.66Bd/120 FSK system

This is a new FSK signal for me that can be heard starting mid-morning, at least on that frequency, with a good SNR using a KiwiSDR located in the UK [1]. Coming to the signal' main parameters, the FSK central frequency is 6938.55 KHz, 120 Hz shift and an apparently(!) keying speed of 31 Baud (or bps, since the FSK mode): Figure 1 show these values.

Fig. 1

I wrote "apparent modulation speed" because by demodulating the signal at a speed of 31 Baud, duplicate bit values are obtained, as can be seen in Figure 2: a sign that the real speed is half that detected with a superficial analysis.

Fig. 2

Indeed, the duration of a bit of information is about 64 ms, while the "raster" of 8 bits measures 511.4 ms (Figure 3): some very simple calculations indicate a modulation speed of 15.6 Baud. As expected, in this case the obtained bitstream correctly shows the reversals "01"s sequence (Figure 4).

Fig. 3

Fig. 4

Direction Finding attempts (TDoA algorithm) seem to point to an area in South West England as a possible transmitter site (Figure 5). Difficult to say something about the users and the purposes.

Fig. 5

As a final note, Figure 6 shows that the phases of the two frequencies are not constant and change after every switch: sign that a single oscillator, maybe a VCO, is used (if two distinct generators were used we would see no phase changes).

By the way, since Figure 6 shows the durations of two periods, it's possible to come back to the two tones frequency:

2: 0.003427 = 583.6 Hz
2: 0.004315 = 463.5 HZ

ie just 120 Hz shift.

Fig. 6

 https://disk.yandex.com/d/lAp4MSgpbVRZ7g

[1] http://websdr.uk:8060/