12 November 2026

FSK signals with 24/32-bit frames and a constant last bit: a possible Russian origin

tags: ,
Cryptomaster kindly provided a recording of an FSK signal at 250/500 Bd with a mark/space shift of 1000 Hz. After reading the analysis of that signal published on the blog [1], he sent a second email: he had forgotten to send another recording, made on the same frequency a few hours earlier. This too turns out to be an FSK signal with a shift of 1000 Hz, at 150/300 Bd. Both signals are binary FSK with the same 32-bit frame structure. Moreover, in both signals the initial portion, consisting of a repeated "01" sequence, is modulated at half the rate of the data segment.
This second email prompted a search of the blog for those FSK signals characterized by a frame length of 24 or 32 bits with the peculiarity of having the last bit at 0 or, equivalently, the last column of the demodulated bitstream with all bits at 0; the purpose of this post is to provide an up-to-date overview of these types of signals. The results are reported in Table I (ordered by date) where, for ease of reading, the waveforms encountered are labeled as WFn; the first and the second recording received from Cryptomaster are WF6 and WF5, respectively. In this post the analysis of WF5, not yet published, is reported in full, while that of WF6, already published on the blog, is summarized here for completeness. The results for WF1-WF4, also published on the blog, are not repeated.

Note: the table does not claim to be exhaustive by any means, since the signals studied are those occasionally encountered or sent by friends and colleagues. A search for the coding has not yet been carried out for WF5 and WF6 (empty cells in the Code column).

Figure 1: Spectrograms of WF5 (top) and WF6 (bottom), recorded on the same frequency and in same date

WF6
The data segment and the trailing portion, presumably sync since it carries no information, are modulated at 500 Bd, while the initial "01" portion is modulated at 250 Bd. Both the keying rates and the function of each segment are confirmed by the demodulated signal. In particular, the data segment exhibits a periodicity of 64 ms, which at 500 Bd corresponds to a period of 32 bits. This periodicity is produced by a constant bit position, visible as a solid column of identical bits, while the trailing segment shows a fixed pattern repeating every 32 bits. The bitstream of WF6 was obtained with the generic FSK demodulator of SA (Signals Analyzer), so both the bit shift (i.e., "where does the frame start?") and the polarity ambiguity must be taken into account. Once the polarity is inverted and the bits are shifted accordingly, the data segment reveals a phasing bit, i.e., a bit with a fixed value at a fixed position in every frame, which appears as the last column of 0s. The bitstream, already published on the blog, is reproduced in Figure 2 for ease of reading.

Figure 2: Demodulated bitstream of WF6 displayed with a 32-bit period, one frame per row. The last column has a constant value of 0 (phasing bit).

Since the information lies in the transitions between consecutive bits rather than in absolute mark/space values, the question arises of whether differential decoding should be applied. Differential decoding removes the polarity ambiguity, and it could reveal a hidden structure if the transmitter uses differential (NRZI-like) encoding. It does not solve the bit shift, though.
A parity test over the full 32-bit frame of the differentially decoded bitstream of WF6 returns 100% success for even parity at a single start-bit offset, the one aligned with the phasing bit column. This is not an independent confirmation: XORing all the differential bits of a frame leaves only the XOR of the two bits at the frame boundary, which lie in the same column. If that column is constant, as the phasing bit is, the parity is necessarily even. The two readings are therefore equivalent: a raw bitstream with a constant bit position, or differentially encoded frames carrying an even parity bit (31 data bits plus 1 parity bit). Both produce the same raw bitstream, so the data alone cannot distinguish between them.
A rank test over the differentially decoded 32-bit frames of WF6 reveals a single parity relation, the even parity over the whole frame, and no other, so no further structure is evident in this capture. As discussed above, this relation is equivalent to the constant last bit. The number of captured frames is not sufficient to test longer or interleaved codeword structures, and therefore to formulate more consistent hypotheses on the coding.

WF5
This is also a dual-rate FSK signal (see Figure 3): the initial "01" sequence is sent at 150 Bd, followed by the payload transmitted at 300 Bd. The shift is constant across WF5 and WF6, namely 1000 Hz.

Figure 3: Spectrograms of the dual-rate FSK transmission WF5, with a 1000 Hz mark/space shift. Top: full capture. Middle: detail showing the keying-rate lines at 150.15 Hz and 299.93 Hz, corresponding to the 150 Bd "01" preamble and the 300 Bd payload. Bottom: keying-rate measurement (Br = 150.15 Bd) on the preamble segment, with a measured shift dF = 999.41 Hz.
 
Once WF5 is demodulated, the frame structure emerges clearly: a 32-bit period characterized by a last bit with a constant value of 0 (Figure 4). This is exactly the same framing as WF6. After differential decoding, the parity test on WF5 also returns 100% success for even parity at a single start-bit offset, the one aligned with the constant last-bit column (Figure 5), as for WF6.

Figure 4: Demodulated bitstream of WF5 displayed with a 32-bit period, one frame per row. The last column has a constant value of 0 (phasing bit), as in WF6.

Figure 5: Parity test on the differentially decoded bitstream of WF5, computed over the full 32-bit frame. Left: decoded bitstream, one frame per row. Right: parity success rate versus start-bit offset, peaking at 100% for even parity at a single offset, the one aligned with the constant last-bit column.

Discussion
All six FSK waveforms have a frame length of 24 or 32 bits and a constant last bit (0); in all of them a parity relation is found after differential decoding: the parity over the whole frame is even. As discussed above for WF6, this relation is equivalent to the constant last bit and is not an independent confirmation of a parity bit. A common coding is established only for the four 24-bit signals (WF1-WF4), which share the H(24,16) code (1); for the 32-bit signals (WF5 and WF6) only the framing is shared.
The keying rate, the shift and the frame length do not appear to be tied to one another. The same keying rates (150/300 Bd) occur with different shifts and frame lengths (WF2, WF3, WF5), and the same shift (1000 Hz) occurs with different frame lengths (WF3, WF5).
Moreover, each of the following pairs differs in a single parameter among keying rate, shift and frame length:

- WF2 and WF3: shift only (500 Hz versus 1000 Hz)
- WF3 and WF5: frame length only (24 versus 32 bits)
- WF5 and WF6: keying rates only (150/300 Bd versus 250/500 Bd, a factor of 5/3)

The single keying rates reported for WF1 (500 Bd) and WF4 (300 Bd) coincide with the higher rate of WF6 and of WF2, WF3 and WF5, respectively.

The 32-bit frames of WF5 and WF6 are the only ones observed with this length, and these are also the most recent signals. It might be tempting to interpret the 32-bit frame as an evolution of the 24-bit one, but this would be premature. WF5 and WF6 were recorded on the same frequency on the same day, so they represent a single observation rather than two independent ones. WF4, a 24-bit signal, was recorded only a few months earlier, so the two frame lengths are not clearly separated in time. Moreover, Table I contains no FSK captures with 24/32-bit frames between WF3 and WF4 (an interval of nearly four years), so it is not possible to exclude that 32-bit frames were already in use during that period. Further captures would be needed to test this possibility.

The two frame lengths differ by exactly one byte (24 bits = 3 bytes, 32 bits = 4 bytes). This may simply reflect a byte-oriented framing, but it could also be related to the coding used, for instance an additional data or check byte. In WF1-WF4 the 24-bit frame carries an H(24,16) code, i.e. 16 information bits and 8 check bits. A code search has not yet been carried out for WF5 and WF6 (Table I), so whether the additional byte carries information or check bits remains an open question.

In the dual-rate signals (WF2, WF3, WF5 and WF6) the ratio between the two rates is 2:1 and the "01" preamble is sent at half the payload rate. This is consistent with a synchronization purpose: longer symbols make carrier and bit-clock acquisition easier on a noisy HF channel, and the alternating pattern maximizes transitions for timing recovery. This is an interpretation, not something the data demonstrates.
 
These observations are consistent with a family of configurations of a single transmission system in which keying rate, shift and frame length (and, possibly, the code) can be selected independently. They are also consistent with different systems sharing the same framing convention, and Table I does not allow distinguishing between the two cases. WF5 and WF6 were recorded on the same frequency and differ only in keying rate, which is what one would expect from experimentation, i.e. trials of different configurations of the same system. This remains a hypothesis: two recordings cannot rule out alternatives such as speed selection by the operator or adaptation to propagation conditions, which would produce the same observations. The other signals were observed on different frequencies, so the configurations are not tied to a single channel. 

As for the origin, two of the signals provide direct evidence. WF2 was located in the Kaliningrad Oblast by TDoA. WF4 was preceded by a voice op-chat in Russian, on a different frequency, in which two operators agree on the frequency to be used for the following FSK message; the message was then received on the agreed frequency (Table I), as a 300 Bd signal with a 500 Hz shift and the 24-bit frame. The language of the operators indicates Russian-speaking users, but by itself it does not locate the transmitter. No direct evidence of origin is available for WF1, WF3, WF5 and WF6. For WF1 and WF3, the H(24,16) code shared with WF2 and WF4 makes a Russian origin more plausible. For WF5 and WF6 only the framing and the relationships among the parameters can be invoked, so a Russian origin remains a hypothesis. A naval user cannot be excluded, but no element in the available data supports it.

Conclusion
The six signals of Table I share a 24- or 32-bit frame with a constant last bit and even parity after differential decoding (a consequence of the constant last bit), and the four 24-bit signals (WF1-WF4) also share the H(24,16) code. The signals differ in keying rate, shift and frame length. WF5 and WF6 share frequency, shift and framing, and differ only in keying rate. The most likely interpretation is a family of configurations of one transmission system, but different systems with a common framing convention cannot be excluded. Direct evidence of a Russian origin is available only for WF2 (TDoA) and WF4 (Russian-language op-chat). Further captures, ideally with direction finding, and a larger number of frames per signal are needed to confirm the hypothesis of a single transmission system and to identify the coding of the 32-bit frames.

To be continued...

Notes
1. The check matrix for the H(24,16) code is generated with the polynomial x^7+x^3+x^2+x+1 
 
1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0   1 0 0 0 0 0 0 0
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0   0 1 0 0 0 0 0 0
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0   0 0 1 0 0 0 0 0
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1   0 0 0 1 0 0 0 0
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1   0 0 0 0 1 0 0 0
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1   0 0 0 0 0 1 0 0
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1   0 0 0 0 0 0 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0   0 0 0 0 0 0 0 1

No comments:

4 November 2026

Unid 250-500Bd/1000 FSK, a relative of Unid 150-300Bd/500 FSK

tags:

Dual-rate FSK transmission at 250 and 500 bps (for binary FSK, bps and baud coincide) with a mark/space shift of 1000 Hz, as shown in Figure 1. The data segment and the trailing portion, presumably sync since it carries no information, are modulated at 500 bps, while the initial portion, consisting of a repeated "01" sequence, is modulated at 250 bps. The recording was kindly sent me by my friend Cryptomaster. 

Figure 1: Spectrograms of the dual-rate FSK transmission with a 1000 Hz mark/space shift. Top: full capture. Middle: detail showing the keying-rate lines at 249.76 Hz and 499.88 Hz, corresponding to the 250 bps preamble and the 500 bps data and tail segments. Bottom: keying-rate measurement (Br = 249.94 bps) on the preamble segment.

The bitmaps in Figure 2 confirm both the keying rates and the function of each segment. In particular, the data segment, shown in the center of the figure, exhibits a periodicity of 64 ms, which at 500 bps corresponds to a period of 32 bits. The same bitmap shows that this periodicity is produced by a constant bit position, visible as a solid column of identical bits.
 
Figure 2: Bitmaps of the three segments. Top: "01" preamble at 250 bps. Middle: data segment at 500 bps, showing a 64 ms (32-bit) periodicity. Bottom: trailing segment at 500 bps.

The bitstream obtained by demodulating the two 500 bps segments is shown in Figure 3 and matches what was already observed in the bitmaps of Figure 2. Both the bit shift (i.e., "where does the frame start?") and the polarity ambiguity must be taken into account, since the bitstream was obtained with the generic FSK demodulator of SA (Signals Analyzer).
 
Figure 3: Demodulated 500 bps bitstream displayed with a 32-bit period. Top: data segment. Bottom: trailing segment, showing a fixed pattern repeating every 32 bits. Bit shift and polarity are arbitrary.

Once the polarity is inverted and the bits are shifted accordingly, the data segment reveals a phasing bit, i.e., a bit with a fixed value at a fixed position in every frame, which appears here as the last column of 0s (Figure 4).

Figure 4: Data segment of the demodulated 500 bps bitstream after polarity inversion and bit shifting, displayed with a 32-bit period. The phasing bit appears as the last column of 0s.

A similar signal with different parameters was previously reported [1], featuring a 500 Hz shift and a 24-bit period; its bitstream is shown in Figure 5 for ease of comparison. The relationship between the FSK parameters of the signal observed in August 2022 and those of the signal analyzed in this post is noteworthy: 150/300 bps with a 500 Hz shift versus 250/500 bps with a 1000 Hz shift, respectively. The keying rates scale by a factor of 5/3, while the shift doubles.

Figure 5: Demodulated bitstream of the similar signal observed in August 2022 [1], displayed with a 24-bit period.

Once again, the question arises of whether differential decoding should be applied. Since the information then lies in the transitions between consecutive bits rather than in absolute mark/space values, differential decoding removes the polarity ambiguity, and it could reveal a hidden structure if the transmitter uses differential (NRZI-like) encoding. It does not solve the bit shift, though.
As shown in Figure 6, a parity test over the full 32-bit frame of the differentially decoded bitstream of Figure 4 returns 100% success for even parity at a single start-bit offset, the one aligned with the phasing bit column. This is not an independent confirmation: XORing all the differential bits of a frame leaves only the XOR of the two bits at the frame boundary, which lie in the same column. If that column is constant, as the phasing bit is, the parity is necessarily even. The two readings are therefore equivalent: a raw bitstream with a constant bit position, or differentially encoded frames carrying an even parity bit (31 data bits plus 1 parity bit). Both produce the same raw bitstream, so the data alone cannot distinguish between them.

Figure 6: Parity test on the differentially decoded bitstream of Figure 4, computed over the full 32-bit frame. Left: decoded bitstream, one frame per row. Right: parity success rate versus start-bit offset, peaking at 100% for even parity at a single offset.

The 2022 signal [1] was located in the Kaliningrad Oblast by TDOA. It shares with the signal analyzed here a constant last bit (0) in every frame and, after differential decoding, a parity test returning 100% for even parity; moreover, the FSK parameters of the two signals are related (keying rates scaling by a factor of 5/3, shift doubling). These similarities suggest a Russian origin for this signal as well, although this remains a hypothesis.
Unlike the 2022 signal [1], in which an H(24,16) code was found, a rank test over the 32-bit frames of Figure 4 shows no parity relation other than the constant bit, so no such structure is evident in this capture. The number of captured frames is not sufficient to test longer or interleaved codeword structures, and therefore to formulate more consistent hypotheses on the coding.


Downloads

References

No comments:

27 October 2026

40 Fixed Bits in a 128-bit IV: A Shared COMSEC Preamble on Three HF Modems

This post compares the COMSEC preamble of a STANAG-4285 link on 4147.4 kHz with other HF recordings that show the same structure.

The first transmission, intercepted on 4147.4 kHz/USB, was kindly sent to me by my friend Kosmod. It consists of bursts modulated with STANAG-4285 in 600 bps mode with short interleaver. The duration and sequence of the bursts in Figure 1 point to an ARQ system (Automatic Repeat reQuest): the longer bursts carry messages, each followed by short bursts that act as ACKs (acknowledgements).
As shown in Figure 1, each burst begins with four unmodulated tones lasting ~90 ms, separated by asymmetric frequency spacings of 700 Hz, 500 Hz and 900 Hz. This variant is not specified in the STANAG-4285 standard. The four tones form an all-in-one synchronization preamble: the spacing pattern appears to identify the network, while the tones also work as a channel probe and a CW sync probe.

Figure 1: Spectrogram of the 4147.4 kHz/USB recording (WebSDR, 25 Sep 2023). The upper panel shows the sequence of long message bursts and short ACK bursts; the lower panel is a zoom on the start of a burst, showing the four initial unmodulated tones.

The message bursts do not all have the same duration. After demodulation, each one carries one or more encrypted messages. The structure is the one typical of protected HF links: a COMSEC preamble (the block of data that prepares the receiver to decrypt the message) followed by the encrypted message itself. In greater detail:

- Frame Sync: 64 bits (8 bytes), a fixed pattern that marks the start of the COMSEC preamble: 0001100001000001110001011110010110111011010010010111110101011001
- Initialization Vector (IV): 128 bits (16 bytes), repeated 5 times (640 bits in total). An IV is a value sent along with an encrypted message so that the receiver can decrypt it; it is normally expected to change from one transmission to the next.
- Reversals: 64 bits of alternating sequence (0101...).
- Encrypted payload: ciphertext message, probably followed by an encrypted EOM/postamble.
 
The Frame Sync, in hexadecimal, is 0x1841C5E5BB497D59. It contains exactly 32 ones and 32 zeros. This is only an observation: a perfectly balanced sequence is not rare among random 64-bit values, so it does not by itself prove that the sequence was chosen for good correlation properties. 

Figures 2, 3 and 4 clearly illustrate the structure of the COMSEC preamble.

Figure 2: Demodulated bitstream displayed with a 128-bit period. The 64-bit Frame Sync is located with the Find function (zero bit errors), marking the start of the COMSEC preamble.

Figure 3: The same bitstream with a 128-bit period: the Initialization Vector (128 bits) is repeated five times (640 bits in total), appearing as identical vertically aligned rows.

Figure 4: The Reversals field, 64 bits of alternating 0101... sequence, located with Find, immediately before the encrypted payload.

The most striking and interesting feature is the structure of the Initialization Vectors visible in Figure 3. As can be seen, the two IVs, taken from two different bursts, have 40 bits (5 bytes) in common, in exactly the same positions. This is quite unusual for IVs, which are normally expected to differ from one transmission to the next.
To verify this unusual structure, I synchronized the entire bitstream of the transmission on the Frame Sync value and limited the output to 192 bits, i.e. 64 sync bits plus the first instance of each IV. The result is shown in Figure 5 and clearly reveals the structure used for the IVs:

bit 0-63: 64 variable bits
bit 64-103: 40 fixed bits 0000000001000000000000010000100000001001 = 0x0040010809
bit 104-127: 24 variable bits

The fixed block is contiguous and begins and ends on byte boundaries, so the layout is 8 bytes + 5 bytes + 3 bytes.

Figure 5: Bitstream synchronized on the Frame Sync and limited to 192 bits (64 sync bits plus the first instance of each IV), showing the 40 fixed bits within the IV structure.

An IV with 40 fixed bits and 88 variable bits is not a purely random IV, but could be a structured field. The fixed block starts and ends on byte boundaries, which makes a field-based structure plausible. Moreover, only 5 of its 40 bits are ones (0x00 0x40 0x01 0x08 0x09), which looks more like a set of flags or control fields than random data. If the 40 bits were just padding, one would not necessarily expect them to be transmitted; if they are transmitted, they may carry information. An alternative explanation cannot be ruled out, for example an 88-bit nonce completed by a fixed part.

I remembered that I had already come across a similar COMSEC preamble structure with a 128-bit IV. Browsing my blog, I found a transmission from the Tunisian MFA intercepted on 29 July 2026 and analyzed in a later post on 3 August 2026 [1]. The similarities are remarkable:

- In that case the HF modem was MS-110A, but with a non-standard start: four unmodulated tones with the same asymmetric spacing (700/500/900 Hz) as the initial tones of the STANAG-4285 transmission analyzed here.
- Identical bit-by-bit structure of the COMSEC preamble, i.e. the same 64-bit Frame Sync, 128-bit IVs, and a 64-bit run of 01 reversals.

I repeated the same analysis procedure as before, but this time on the entire bitstream of the Tunisian MFA transmission, i.e. synchronizing on the Frame Sync plus the first instance of each IV (192 bits in total). Comparing the two analyses (see Figure 6), the fields that make up the IVs are perfectly matching.

Figure 6: Comparison of the IV structure in the STANAG-4285 transmission (top) and the Tunisian MFA MS-110A transmission (bottom), both synchronized on the Frame Sync and limited to 192 bits.

I applied the same procedure (synchronizing the bitstreams on the Frame Sync sequence) to other recordings that also carry 128-bit IVs repeated five times [2]. The results show five transmissions in total (three of them shown in Figure 7) on different HF modems (MS-110A, STANAG-4539 and STANAG-4285) that share the same COMSEC preamble layout and the same IV structure, with a block of 40 fixed bits inside a 128-bit IV. The only exception is the STANAG-4539 recording, in which 2 of the 40 bits differ (Figure 7). Note that STANAG-4539 is the NATO equivalent of MIL-STD-188-110B Appendix C, which is why the corresponding recording file is named "188-110B_APP-C".

Figure 7: IV structure in recordings made on different HF modems, synchronized on the Frame Sync and limited to 192 bits: MS-110A (6.670 MHz, 2 Oct 2017), STANAG-4539 (equivalent to MIL-STD-188-110B Appendix C; 7.9985 MHz, 9 Mar 2018) and STANAG-4285 (4.015 MHz, 10 Jan 2020). The 40 fixed bits are the same in all three, except for 2 bits in the STANAG-4539 recording.

This points to a common origin, such as the same encryption equipment or the same protocol family. It does not by itself show that the links belong to the same user or network.
Open questions: what the 40 fixed bits encode, whether the variable parts of the IV follow a pattern (for example a counter), and which cipher is used. A 128-bit IV is consistent with a 128-bit block cipher such as AES, but this remains a hypothesis.

Downloads

References

1 comment:

16 October 2026

US Navy MS-110A 600 bps/L: burst transmissions with a fixed 32-bit sync word (0x0A6E14DC)

Recently, reception reports of several US Navy stations (Barford, Niscemi, Lualualei, Diego Garcia, among others) appeared on the UDXF mailing list. These stations seem to use the MS-110A waveform for fleet broadcast, rather than the usual STANAG-4481F or STANAG-4285. Some of the stations and frequencies reported had already been under observation by me and my friend Kosmod because of a few peculiarities, discussed below. 

Non-continuous transmissions
The transmissions we monitored (and are still monitoring) are not a continuous stream, as in STANAG- 4481F and STANAG-4285 broadcasts, but consist of bursts of irregular duration separated by short pauses. Figure 1 shows one of the receptions of the Niscemi station on 5118.5 kHz USB, recorded on 23 September 2026 at 07:53:58 UTC: the five bursts last between about 20 and 43 seconds. Across all our captures, bursts range from a few seconds to a little over a minute.
Curiously, the MS-110A waveform is used in the same 600 bps/L mode (600 bps, long interleaver) that is employed in STANAG-4285 broadcasts.

A possible reason for the bursts lies in how the two waveforms handle synchronization. With STANAG 4285, the continuous probes sent by the modem keep the receiving side always in sync, and this applies not only to the HF modem but also to the upper-layer protocol. With MS-110A, a receiver that joins late cannot demodulate until it receives the preamble, so a continuous MS-110A transmission would be lost to any receiver that misses its beginning. Short bursts avoid the problem: each burst opens with its own preamble, so a receiver that joins late can acquire synchronization at the start of the next burst instead of waiting indefinitely. The upper layer follows the same logic: in the bitstreams we examined, each burst starts with its own alternating run of bits (the "01" run, 1010... in the captured streams) followed by a sync word, so synchronization is restarted at every burst at both levels.
At present it is hard to tell whether these are tests or a lasting change in how the broadcast is run.

Figure 1: Spectrogram of a reception of Niscemi on 5118.5 kHz USB, 23 September 2026, 07:53:58 UTC. The dark vertical lines are pauses between bursts; the black band on the right is the end of the file. The burst durations shown (28, 24, 33, 20 and 43 s) are measured values, but only approximate.

A fixed 32-bit word after the "01" run

The captures come from five US Navy transmitting stations (Barford, Davidsonville, Diego Garcia, Lualualei and Niscemi) and were recorded between 30 August and 30 September 2026. Every capture is a standard MS-110A 600 bps/L transmission. In every demodulated bitstream, the same 32-bit word follows the "01" run:

00001010011011100001010011011100 (0x0A6E14DC)

The word is identical in all captures and appears only after the "01" run. An alternating run followed by a fixed word is a common bit-sync/phasing plus sync-word structure in synchronous data links. As far as we can tell, the word is not part of the MS-110A framing, so it is probably part of the payload and likely belongs to a link-level protocol or device, such as a data encryptor. Figures 2 and 3 show the demodulated bitstreams from the five stations (yellow = 1, blue = 0, 32 bits per row), showing the alternating run, the row with the sync word and the random-looking data that follows. 

Figure 2

Figure 3

Structure of the word 0x0A6E14DC

The 32 bits above are not arbitrary. They consist of a single 15-bit pattern, repeated twice, plus the first 2 bits of a third repetition:

000010100110111
000010100110111
00

Read as two 16-bit halves, the second looks like the first one shifted by one bit. This is a side effect of the period: the real period is 15, not 16.

The polynomial generator
A pattern like this is produced by a tiny shift register with only 4 stages. Each new bit is the XOR of the previous bit and the bit from four steps earlier, which we denote by the polynomial x^4 + x + 1; with the reciprocal convention the same register is written x^4 + x^3 + 1. This polynomial is of the "maximal-length" kind: the register passes through every possible non-zero state before repeating, giving the longest cycle possible for 4 stages, 15 bits.
Starting from the register state 1111 (all ones, a very common choice), the generator produces 111101011001000. The pattern observed on the air is exactly this sequence with every bit flipped. Inversion does not change the underlying generator, only how the sequence looks.

Figure 4: Left, the 15-bit sequence produced by the generator from the initial state 1111 (the inverse of the one observed on the air). Right, schematic of the 4-stage shift register.

As a further check, I ranked candidate generator polynomials of the form x^n + x^k + 1 by how well each reproduces the observed sequence (Figure 5, right). x^4 + x + 1 comes first by a wide margin. The next three (x^9 + x^7 + 1, x^10 + x^5 + 1 and x^12 + x^11 + 1) are not competing hypotheses: each is a multiple of x^4 + x + 1, so each also reproduces the sequence. The remaining candidates score near the noise floor.

Figure 5: Left and center, the 15-bit sequence as observed on the air, repeated line by line; in a 15-column view it appears as vertical stripes. Right, ranking of candidate generator polynomials x^n + x^k + 1 (pairs n,k) by score, with x^4 + x + 1 on top.

Common structure of the streams
- Every stream starts with an alternating run of exactly 256 bits (128 pairs).
- The 32-bit word appears at position 256 in all five streams, bit-for-bit identical.
- The word appears only once per stream: there is no resynchronization in the middle of a transmission.
- There are no inverted or bit-reversed versions, so the demodulation polarity is the same in all captures.

What follows the word
I compared five bursts, one from each station, in pairs (10 pairs), aligned on the end of the word. Over the first 256 bits the percentage of differing bits ranges from 46.9% to 56.2%, and over the whole common part from 49.8% to 52.0%. Independent streams are expected to give 50%, with a spread of about 3 points over 256 bits, so all values are within normal variation. There is no common field right after the word, such as a shared message indicator, and shifting one burst against another by up to 64 bits reveals no shifted copies.
Within each burst, the 0/1 balance is within 1.6 standard deviations of 50%, and neither the runs test nor the autocorrelation shows any periodicity. The lengths of the data after the word are all multiples of 8 bits, and at 600 bit/s the five bursts last from about 5 seconds (Barford) to about 75 seconds (Lualualei). Figure 6 shows a set of checks on one burst; the other four give the same picture.

Figure 6: Statistical checks on the data following the sync word of one burst (1736 bytes): bit balance, byte histogram, autocorrelation, bit raster and running proportion of 1s. The other bursts give the same picture.
A possible interpretation
Statistically, what follows the sync word is indistinguishable from random data, at least by the tests applied. This is what encrypted traffic looks like, and also what a data encryptor sends when it has no message: fill scrambled by the keystream. The tests cannot tell the two apart.
A possible reading is the following. The alternating run and the sync word open every burst and let the receiving equipment align itself on the incoming stream: the alternating run for bit timing, the sync word for the start of the stream. A transmitter does not always have a real message to send, so part of what is transmitted may be random-looking fill rather than traffic. This is seen, for example, in STANAG-4481F and STANAG-4285 transmissions, where a continuous stream of random data is interrupted by the KG-84 sync sequence when there is a real message to send. Here the picture is only partly similar: continuous fill would not explain the pauses between bursts, which are better accounted for by the synchronization argument above. The data cannot show whether a given burst carries a real encrypted message or only fill.

Downloads

4 comments:

18 September 2026

11592.0 kHz - Unid FSK 41.6 Bd/200 Hz shift (CIS/Rus FSK family?)

tags:

An unidentified FSK 41.6 Bd/200 Hz signal on 11592.0 kHz (CF), reminiscent of — but not quite matching — the Russian Navy's well-known T-600/CIS-36-50 family. Still an open case after days of monitoring and a first TDoA attempt.

1. Signal Parameters
Among the FSK utility signals monitored on HF, a transmission on 11592.0 kHz (cf) stands out for its distinctive parameters: approximately 41.6–41.67 Bd with a 200 Hz shift between mark and space tones (Figure 1). The 200 Hz shift value is reminiscent of T-600, a proprietary FSK broadcast system used by the Russian Navy (also known as BEE-36 or CIS 36-50), which is documented to use a 200 Hz shift at more than one baud rate [1]. Neither of these documented rates matches the ~41.6–41.67 Bd observed here, nor does any other published T-600 configuration. At most, then, the shift value can be treated as a family resemblance to the T-600 system rather than a positive identification.

Figure 1: Top: waterfall/spectrogram of the two-tone FSK carrier. Bottom: period/pattern analysis confirming a symbol rate of 41.66 Bd (Br) and a measured shift dF = 201.42 Hz

A further characteristic emerges when examining the phase relationship across successive shifts: the phase of each tone is not preserved from one occurrence to the next, and this holds independently for both the space tone (Figure 2) and the mark tone (Figure 3). This is consistent with the two tones being generated by two independent, free-running oscillators rather than a single voltage-controlled oscillator (VCO) switching frequency while preserving phase continuity — a scheme under which no phase discontinuity would be expected at the shifts.

Figure 2: Persistence display of the space tone across successive shifts. The Δθ arrows mark the phase offset between successive shifts, showing that phase is not preserved.

Figure 3: Persistence display of the mark tone across successive shifts, showing the same lack of phase continuity.
 
A straightforward computation from the persistence displays confirms these tone frequencies. Measuring the elapsed time across two cycles gives 0.002220733 s for the space tone and 0.001815733 s for the mark tone, corresponding to (respectively):
2 / 0.002220733 ≈ 900.60 Hz
2 / 0.001822133 ≈ 1097.61 Hz
The resulting shift (≈197 Hz) is consistent with the previously measured dF = 201.42 Hz (Figure 1), and the tone pair's midpoint (≈1001.0 Hz) matches the expected ~1000 Hz baseband position given the 1 kHz USB dial offset used for the recording.
 
2. Transmission Pattern
The frequency neighborhood around 11592.0 kHz offers additional context for the transmission pattern described below: a recent capture (Figure 4) shows the station idling while two confirmed Russian BEE/50 circuits nearby actively carry crypto traffic — at 11598 kHz (200 Hz shift) and 11603 kHz (250 Hz shift), the same shift variability already noted for the T-600/CIS 36-50 family in Section 1. Unlike its neighbours at the time of capture, 11592.0 kHz was idling, consistent with the traffic pattern discussed in this section.

Figure 4 – Frequency neighborhood snapshot: 11592.0 kHz idling alongside two confirmed Russian BEE/50 circuits actively carrying crypto traffic, at 11598 kHz (200 Hz shift) and 11603 kHz (250 Hz shift).

The bulk of the observed traffic consists of idling — the regular "01"s sequences also known as eversals. Transmissions begin around 0800 UTC, with no preceding call-up or announcement (Figure 5, top), and continue for roughly ten hours, until approximately 1800 UTC, ending as abruptly as they begin, with no sign-off (Figure 6). The on- and off-times are not perfectly fixed: variations of more than a minute have been observed on repeated occasions, which is consistent with — though does not confirm — manual start/stop of the transmission rather than a strictly clock-driven schedule. The idling phase is occasionally interrupted by brief N0N(1) transmissions on the space-tone frequency, before resuming the normal alternating pattern (Figure 5, bottom).

Figure 5: Top: onset of transmission with no preamble. Bottom: idling briefly interrupted by an N0N transmission on the "space" requency.


Figure 6: End of transmission: the reversals pattern cuts off abruptly into noise, with no sign-off (recording started 17 September 2026, 17:35:34 UTC; the .wav file was later trimmed to isolate the transmission's closing segment).

Very short N0N interruptions were also recorded during some monitoring sessions (Figure 7).

Figure 7: Reversals sequence briefly interrupted by N0N transmissions on the space frequency.

Nighttime monitoring (beyond the 1800–0800 UTC window) has so far only been carried out on a few occasions but without receptions of the signal of interest. Given that this null result is consistent with the daytime-only schedule already established above, it does not by itself indicate a separate nighttime frequency. One plausible explanation, common to HF fixed/military links, is that 11592.0 kHz (cf) could serve as the daytime channel with a distinct, as-yet-unidentified frequency used at night(2). No candidate night frequency carrying the same modem signature has been found so far, so this remains an open hypothesis for future monitoring rather than an established fact.

3. Attribution Assessment
Geolocation. Four independent TDoA runs were carried out using a European KiwiSDR receiver network (nodes in/near Germany, Poland, the Slovakia/Hungary border, Croatia, Italy, and Greece), with no receiver coverage east of the target. Given this geometry, all baselines approach the emitter from broadly the same direction, producing hyperbolic lines of position that intersect at shallow angles — which limits precision along that bearing.
Results. The four fixes (44.40N/32.60E, 44.80N/30.80E, 43.60N/30.40E, 45.00N/32.20E) cluster within roughly 150–230 km of each other (Figure 8), in the northwestern Black Sea / southern Ukraine coast / Crimea-approaches area that overlaps the operating theatre of Russia's Black Sea Fleet (home-ported at Sevastopol, Crimea), which is consistent with — though does not confirm — the CIS-36-50/Russian Navy family hypothesis raised above, possibly as a shore-to-ship link. Resolving the emitter's location further would require at least one receiver east of the target to break the current fan geometry; until then, this result stands as a corroborating but non-conclusive data point.

Figure 8 – Four independent TDoA fixes for the 11592.0 kHz signal, clustering in the northwestern Black Sea / Crimea-approaches area.

Hardware attribution. Beyond geolocation, no hardware or cryptographic device designation can currently be attributed to this signal — and indeed, no meaningful statement about its encryption can be made at all, since no actual data traffic has yet been captured: everything observed so far consists of idling and N0N segments, neither of which carries any cryptographic content to analyze. Some sources associate similarly-parametered Russian military/government FSK modes with specific T-series cipher devices or R-series radio terminals, but none of these attributions match the 41.6–41.67 Bd / 200 Hz combination observed here, and no corroborating source has been found for a name or nickname specific to this signal. Pending further monitoring and input from other analysts, the transmission is best treated as unidentified, tentatively consistent with a CIS/Russian military or government FSK family.

4. Preliminary Conclusions
Why the idling? Continuous idling of this kind can be attributed to several different operational, technical, or strategic rationales. It may serve to keep the frequency occupied, preventing other stations or commercial broadcasters from using the same channel. It also allows automatic receivers — presumably off-shore ones  —  to stay synchronized with the carrier's clock, ready to lock onto the traffic the instant real transmission begins. In the author's experience, however, this frequency has often been monitored for extended periods without any traffic being heard beyond the idling tone, though this alone is not sufficient to characterize the purpose of the station.
Alternative explanations. Other explanations for the extended idling remain equally speculative. One possibility, consistent with the TDoA-supported shore-to-ship hypothesis (Section 3), is that this behaves as a fleet broadcast, where actual data traffic is typically brief and occurs only when there is a genuine dispatch to send. It could also serve as a continuous propagation test on this specific frequency, or represent a reserve channel — loosely termed here a "ghost net" — kept active by a secondary control station while the main operational network routes traffic elsewhere, for example over primary frequencies offering better propagation at a given time.
The frequency neighborhood. The frequency picture in Figure 4 also raises questions that remain speculative, grounded only in the signals' own characteristics rather than in any further evidence: why would FSK broadcasts sitting so close together in frequency use different shift configurations, and could this reflect different intended recipients tuned to different channels, possibly with some form of channel prioritization? In the author's experience, a loose parallel exists with NATO FSK broadcasts [2], which commonly use 50/75 Bd with an 850 Hz shift — though under different encryption (KW-46 or KG-84), making the comparison structural at best rather than substantive.

Only future — and hopefully more fortunate — captures that include an actual dispatch transmission are likely to provide more definitive answers. Friends who may have recordings of this signal, particularly from nighttime hours or capturing an actual burst of traffic, are warmly invited to get in touch at tony.anselmi@gmail.com.

Downloads

Notes
1.In shortwave radio monitoring and ITU emission classification, N0N is an emission designator that stands for a continuous, unmodulated carrier carrying no information.
2. For example, the HFGCS network uses 11175 kHz as its main daytime frequency and 4724 kHz at night.

References

No comments:
Subscribe to: Posts (Atom)