CIS-Navy FSK 50Bd/700 Flash Messages

This post presents a technical analysis of an HF radio intercept recorded on July 22. The analysis focuses on the structure of a 50 Baud FSK signal transmitted by the CIS Navy, highlighting both standard transmission characteristics and distinctive operational features, such as the use of a specific frequency shift (700 Hz) and the inclusion of a Morse-FSK preamble indicative of high-priority message traffic.

A very interesting FSK 50 Bd / 700 Hz signal was intercepted on 16199.75 kHz (cf) on July 22. The signal transmits almost continuous "01" reversals, occasionally interrupted by a Morse-FSK preamble prior to an encrypted payload. The preamble likely serves as a signaling sequence indicating the priority/precedence level of the upcoming transmission. As shown in Figure 1, the payload of the recorded transmission consists of two concatenated messages framed by short reversal segments before returning to continuous reversals. In ordinary or low-priority traffic, the payload directly follows the reversals (without a preamble), consists of multiple concatenated messages and can last for some minutes.

Fig. 1: the intercepted signal

As confirmed by fellow monitor cryptomaster, the intercepted signal belongs to the family of 50 Bd FSK waveforms used by the CIS Navy with various shift values such as 75, 200, 250, 500, and even 1000 Hz [1] likely generated by the T-600 system, while maintaining the same message format. This is the first time I have observed a CIS Navy 50 Bd FSK modulation with a 700 Hz shift, which is another remarkable aspect of this sample.

Fig. 2: FSK parameters

Transmitting a Morse coded preamble typically indicates an incoming message of high priority. In Russian military radio doctrine, top-priority traffic (equivalent to FLASH or MONOLITH) is preceded by repeated letter sequences to alert operators and trigger automated equipment (1). In this instance, the preamble consists of the string 'UUUUU XXX XXX'. This sequence likely functions as a two-stage marker: 'UUUUU' for initial synchronization/attention, followed by 'XXX XXX' to signal an incoming long or high-precedence message prior to switching to FSK data modulation. Notably, while these markers are unconfirmed by official Russian Navy sources, they are well-established through decades of independent SIGINT monitoring. A similar preamble was previously documented in CIS Navy 50 Bd/75 transmissions on 18.1 kHz (submarine communications) [2].

Fig. 3: the Morse-FSK preamble

The two messages in this sample are identical, likely to improve system reliability through message redundancy.
Below is the bitstream analysis of the intercepted sample (700 Hz shift), demonstrating the above—namely, that both the message's format and the symbol rate of 50 Bd are shared across CIS Navy FSK waveforms, even when using different shift values.

The 'standard' format of CIS Navy 50 Bd FSK messages usually consists of:

 ⦁ 42-bit initial sequence / Unique Word (usually 100001010010111110000101001101011010101101)
 ⦁ 70-bit Initialization Vector, repeated twice)
 ⦁ 7-bit word ciphered payload arranged in a 4:3 ratio with parity check
 ⦁ five 7-bit "0001000" words as End of Message (EOM)

(the 0/1 values of the sequences above depend on the reception polarity)

42-bit sync sequence
It is worth noting that the transition from idle to traffic condition is signaled by a break in the bit reversal structure, where a '1' is inserted instead of a '0' when the system transitions to traffic i.e., ending in '01011' rather than '01010', as shown in Figure 4. Using intentional protocol deviations for signaling is a common practice across many standards, such as Ethernet LAN protocols (2).
The initial 42-bit sync sequence also represents a "violation" of the 4:3 ratio (see below), ensuring reliable synchronization.

Fig. 4: 42-bit initial sequence sent after reversals

70-bit Initialization Vector
Figure 5 displays the identical pair of messages aligned in 70-bit blocks, emphasizing the probable Initialization Vector (IV) sequences, repeated twice, prior to the encrypted payload.

Fig. 5: 70-bit sequence, repeated twice

4:3 ratio with parity check
The payload data consists of 5-bit characters encoded into a 7-bit sequence with a fixed 4:3 ratio of '1's to '0's (or vice versa, depending on reception polarity). Naturally, the constant presence of four '1's per character also provides parity-based error detection. 

Fig. 6: 4:3 ratio and parity check

End of Message (EOM)

The End-of-Message (EOM) sequence in Figure 7 consists of five identical 7-bit words "0001000", again violating the constant bit ratio of the payload section. This figure also clearly demonstrates that the two messages are identical. 

Fig. 7: the EOM sequence

It appears that the format of the CIS-Navy 50Bd transmissions revolves around the number "7": an initial 42-bit synchronization sequence (6x7), 70-bit Initialization Vectors (10x7), and a payload structured into 7-bit words. In fact, it can be argued that the entire message (sync sequence, IVs, payload, EOM)  is fundamentally structured into 7-bit words.

Attempts to geolocate the transmitter site proved challenging, likely due to the nature of the signal and potential multi-hop propagation. Nonetheless, as shown in Figure 8, the KiwiSDR receivers used for Time Difference of Arrival (TDoA) measurements point to an area southwest of Moscow (likely the RDL site?), though this cannot be established with a high degree of certainty (3).

Fig. 8: direction finding attempts (TDoA)

Recordings via linkz's KiwiSDR [3].

 https://disk.yandex.com/d/4uBK5oJYGYtMVg

(1) In NATO military communications (as ACP-126 standard), FLASH precedence is represented by the letter indicator Z (Prosign). To alert operators and trigger automated terminal alarms, the precedence sequence is repeated at the start of the transmission (e.g., ZCZC ZZZZ), followed by a Z time-stamp designator and the text header FLASH FLASH FLASH. In strategic/command contexts, it functions similarly to Russian high-priority or MONOLITH-type alerts.

(2) In traditional 10 Mbps Ethernet networks (10BASE-T), data is transmitted using Manchester encoding. Transmission begins with a 7-byte preamble consisting of alternating 1s and 0s (10101010...), used to synchronize the receiver's clock. Immediately following this is the SFD (Start Frame Delimiter) value, where the alternating sequence breaks with two consecutive 1 bits (10101011). This break in the alternating rhythm signals the network chip: "Attention: the preamble has ended; the very next bit marks the actual start of the Ethernet packet" (IEEE 802.3 Standard, Clause 3).

(3) Rather than a single fixed mast, HF transmissions under the call sign RDL are routed through naval communications hubs primarily tied to naval headquarters/command nodes in Central Russia such as the Moscow military region hub. Just for example, Naro-Fominsk area hosts major command posts and communications infrastructure for the Russian Armed Forces, including high-power HF transmitter facilities and receiver centers used for strategic naval command broadcasts and central military district communications.

[1] http://i56578-swl.blogspot.com/2016/12/unid-fsk-50bd1000-prob-cis-navy.html
[2] http://i56578-swl.blogspot.com/2020/08/cis-navy-vlf-50bd75-fsk-t600-75hz.html
[3] http://linkz.ddns.net:8075/?f=16198.00usbz9

Voice Coordination & FSK 300Bd/500 Tactical Bursts (Russian Navy)

This is not the first time I have had the opportunity to study the 300Bd/500Hz FSK waveform (of Russian/CIS origin), which I have encountered in different configurations — for instance, with 255/366-bit framing, or with reversal preambles transmitted at 150 baud [1]. This time, the opportunity was provided by my friend Mario, who kindly sent me some recordings of his intercepts, captured via KiwiSDRs located in Japan (Nagano and Hokkaido). The intercepts were recorded on June 23rd, between 0848 and 0944 UTC. These are almost certainly Russian Navy voice and data transmissions, likely between the Russian Pacific Fleet HQ in Vladivostok or the Sovetskaya Gavan Naval Station (a submarine base) and a vessel. The traffic consists of voice coordination followed by tactical data bursts using FSK 300Bd/500Hz modulation on a negotiated frequency (Figure 1).

Fig. 1: Voice link setup on 8439 kHz (top) followed by FSK 300Bd/500Hz data bursts on 9100 kHz (bottom)

The voice comm intercept occurred on 8439 kHz, which is probably a primary calling/hailing frequency. In a naval net, a major shore station or flagship (the NCS, Net Control Station) monitors this frequency continuously, acting as a guard station for the net. Subordinate mobile units check in briefly on this primary frequency just long enough to establish initial contact. Because the primary frequency must remain clear for other assets to report in, the calling unit requests a shift to a discrete tactical channel to send the follow-on data traffic.
Below, the text transcript and corresponding translation of the voice communication. 

Russian (original)	English (translation)
Волнобой, я Грейдер. Волнобой, я Грейдер. Волнобой, я Грейдер. Как слышно? Прием.	Volnoboy, this is Greyder. Volnoboy, this is Greyder. Volnoboy, this is Greyder. How do you read? Over.
Волнобой, я Грейдер. Волнобой, я Грейдер. Следи. Вызови меня на червячке девять-один-ноль-ноль, девять-один-ноль-ноль. Как понял?	Volnoboy, this is Greyder. Volnoboy, this is Greyder. Keep listening. QSY to vernier* nine-one-zero-zero, nine-one-zero-zero. How copy?
Я Грейдер. Прием.	This is Greyder. Over.

*"Vernier" (червячок, lit. "little worm") — Russian radio slang for the fine-tuning dial, here indicating the secondary frequency.

Callsign: Volnoboy (Волнобой - "Breakwater") — Called Station, likely Net Control Station (NCS).The callsign evokes a fixed, protective structure, consistent with a shore-based command facility or a flagship unit acting as the control node.
Callsign: Greyder (Грейдер - "Grader") — Calling Station / Initiator. The callsign references mobile equipment, suggesting a an auxiliary/support vessel or a subordinate combatant establishing a tactical link.

In Soviet/Russian doctrine, callsigns are not fully arbitrary but follow category-based semantic conventions, "heavy/permanent/protective" nouns for fixed command stations or flagship units, and "mobile/task-oriented" nouns for subordinate tactical units. This reinforces the assessment of Volnoboy as NCS and Greyder as the mobile calling unit.

If my guess is correct (!), i.e. Volnoboy is the ashore NCS, there is an ideological and technological divergence between NATO and the Russian Navies:
1. The NATO Paradigm: Continuous Broadcasts (FAB). NATO utilizes the BRASS (Broadcast, Ship-Shore and Maritime Rear Link System) architecture. Shore-based Net Control Stations broadcast continuously and use FAB (Frequency Availability Broadcast) to tell the fleet exactly which frequencies are currently free for ship-shore comms. The Philosophy: Maximum protection for the ship. By listening passively to the broadcast, ships maintain total EMCON (Emission Control). The ship only transmits a brief burst to establish the link on the best available frequency. The fixed shore station takes 100% of the RF exposure.
2. The Russian Paradigm: Tactical Shadowing ("The Worm"). The intercept between Greyder and Volnoboy shows the exact opposite workflow. The Russian Navy relies heavily on "skedy" (rigidly scheduled radio appointments) and paper matrixes. Stations meet on a known primary calling frequency simply to confirm mutual contact and readability. The mobile unit (Greyder) immediately directs the shore station (Volnoboy) to transition to a secondary tactical channel ("the little worm 9100").

Shortly after the voice link setup on 8439 kHz, tactical data bursts utilizing FSK 300Bd/500Hz modulation were intercepted on the negotiated secondary frequency of 9100 kHz. Because no voice response from Volnoboy was detected (1), this data traffic is assessed with high confidence as originating from Greyder. This fits the classic profile of a mobile naval asset transitioning from a public voice channel to an FSK burst transmission on a tactical shadow frequency to pass encrypted operational traffic.

Figures 2, 3 show the main parameters and the 80 ms period of the FSK bursts.

 

Fig. 2 : main FSK parameters (300 Bd/500Hz)

Fig. 3: 80 ms period

The demodulated bitstream shows a 24-bit period (corresponding to the 80 ms duration visible in the bitmap in Figure 3), the last of which is the phasing bit (the final column of "0s"). The data are preceded by a 240-bit sequence generated by the polynomial x^12+x^10+x^9+x^3+1.

Fig. 4: demodulated bitstream

After removing the preamble/sync sequence and inverting the 9th column of the stream, a clear H(24,16) coding was found, ie 16-bit data followed by a 8-bit CRC. Coding is performed using the following Hamming parity check (8,24) matrix:

1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0   1 0 0 0 0 0 0 0
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0   0 1 0 0 0 0 0 0
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0   0 0 1 0 0 0 0 0
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1   0 0 0 1 0 0 0 0
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1   0 0 0 0 1 0 0 0
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1   0 0 0 0 0 1 0 0
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1   0 0 0 0 0 0 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0   0 0 0 0 0 0 0 1

As demonstrated in Figure 5, the received CRC (left) matches the computed CRC (right). The latter is obtained by applying the (8,16) check sub-matrix shown above to the 16-bit data portion of the demodulated bitstream.

Fig. 5: received CRC (left) vs computed CRC (right)

Coding verification is carried out by comparing each line of encoded data with every row of the check sub-matrix: for each row #n, the number of vertical matches between the "ones" in the encoded line and the "ones" in that row is counted. If the count is even, CRC bit #n will be "0"; if the count is odd, CRC bit #n will be "1".

Example: CRC computation for the first row of the encoded data:

DATA                               CRC
1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1    1 0 1 1 0 0 1 0
1 1 1 0 0 0 0 0 1 0 1 0 1 1 0 1    1 0 1 1 0 1 1 0
0 0 1 0 0 0 1 1 0 0 0 1 0 0 0 0    1 0 0 0 1 1 1 0
0 1 1 1 1 1 0 1 0 0 1 0 1 1 0 0    0 1 0 0 1 1 1 0
1 1 0 0 1 0 1 1 1 1 0 1 1 1 0 1    0 1 1 0 1 1 0 0
1 0 1 1 1 0 1 0 1 0 0 0 1 0 0 1    0 1 0 0 1 1 1 0
0 0 1 0 0 0 0 1 0 1 1 1 0 1 0 0    0 1 0 1 1 0 1 0
1 0 1 0 1 1 1 1 1 1 0 0 0 0 0 0    1 1 0 1 1 1 1 0
1 1 0 1 1 0 1 1 1 1 0 1 1 0 1 1    1 1 1 1 0 0 0 0
0 0 1 0 1 0 0 0 1 0 1 0 0 0 0 1    1 0 0 1 0 1 0 0
1 1 0 0 1 1 1 0 0 0 0 1 0 0 0 0    1 1 1 1 0 1 1 0
0 0 0 1 1 1 0 0 0 1 0 1 1 0 0 0    0 1 0 1 0 1 1 0

CHECK SUB-MATRIX
1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 check sub-matrix row #1
7 matches (odd), CRC bit #1 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 check sub-matrix row #2
6 matches (even), CRC bit #2 value: 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 check sub-matrix row #3
7 matches (odd), CRC bit #3 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 check sub-matrix row #4
7 matches (odd), CRC bit #4 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1 check sub-matrix row #5
6 matches (even), CRC bit #5 value: 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1 check sub-matrix row #6
8 matches (even), CRC bit #6 value: 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1 check sub-matrix row #7
7 matches (odd), CRC bit #7 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 check sub-matrix row #8
no matches (zero is even), CRC bit #8 value: 0

By the way, I used a short Octave script to compute the CRC string.

This intercept illustrates a type of Russian Fleet HF procedure: a brief voice hail on 8439 kHz to establish contact and negotiate a shift frequency, followed by short FSK 300Bd/500Hz data bursts on 9100 kHz carrying the operational traffic. The callsign roles and QSY direction are consistent with a doctrine that differs structurally from the NATO FAB/BRASS model, with the mobile unit dictating the shift and the shore station absorbing the RF exposure.
Thanks to Mario for sharing the KiwiSDR recordings that made this analysis possible.

https://disk.yandex.com/d/mgLcnpLJOLGS9Q

(1) Greyder asked the question and Volnoboy answered it. Greyder heard the response and moved to 9100 kHz to transmit its data traffic, but most likely the HF skip zone completely hid Volnoboy's voice from the KiwiSDR in Japan. The Japanese receiver was likely sitting in a dead zone where Volnoboy's signal skipped over the antenna, while Greyder's signal — transmitted from a different position — had a more favorable propagation path.

[2]  http://i56578-swl.blogspot.com/search/label/FSK%20300Bd%2F500

CIS 20Bd/7000 Wide FSK

In the world of HF, spectral efficiency is usually the gold standard. Modern digital modes strive to pack as much data as possible into narrow bandwidths. However, when monitoring tactical networks originating from the CIS (Commonwealth of Independent States) region, we may encounter a signal that flips this paradigm entirely: the 20Bd/7000 Wide FSK waveform. Operating at a "glacial" 20 Baud but utilizing a massive 7000 Hz frequency shift, this waveform intentionally sacrifices spectral real estate.
On a standard SDR waterfall display, the CIS 20Bd/7000 is highly distinctive yet easily misidentified by automated classification algorithms. Instead of a single coherent data stream, it appears as two completely detached Continuous Wave (CW) carriers separated by a 7 kHz void (Figure 1).
I recently heard this waveform on 25th June at about 2235 UTC on 6945.0 kHz (CF) using the remote AirSpy SDR receiver managed by EA1FAQ in Spain, whom I wish to thank. 

Fig. 1: CIS 20Bd/7000 Wide FSK

Technical Specifications & RF Fingerprint (Figure 2):
Modulation: Frequency Shift Keying (FSK / F1B), Lower tone: 6941.5 kHz, Upper tone: 6948.5 kHz, Center freq: 6945.0 kHz
Symbol Rate: 20 Baud (Symbol duration: 50 ms)
Shift (Δf): 7000 Hz (±3500 Hz from center)
Modulation Index β = fm/​Δf ​= 20/7000 ​= 350
Primary Users: Russian / CIS Military and Diplomatic Networks

Fig. 2: main FSK technical parameters (shift & speed)

Apart from the center frequency noted here (6945.0 kHz), this same transmission can be observed on various other frequencies around 7 MHz, acting as an intruder and causing interference within the corresponding amateur radio band, as regularly documented by the IARU Monitoring System (IARUMS). Specifically, I observed a "twin" transmission at 9966.5 kHz. While it is difficult to establish whether both originate from the same transmitter site, their signal strengths on the waterfall display are nearly identical, suggesting they might be emitted from antennas with different take-off angles.

An intriguing aspect captured in Figure 3 is the simultaneous ±1500 Hz offset from the center frequency of both transmissions, with the signals returning to their baseline values within a few minutes.

Fig. 3 : simultaneous ±1500 Hz offset from the center frequencies

Such a deterministic and simultaneous shift points to two likely scenarios. The first is that this offset is pre-programmed by design, requiring the receiving modem to have prior knowledge of the transition to maintain carrier lock and ensure uninterrupted demodulation. Alternatively, if no prior agreement exists, the receiving system must employ an aggressive Automatic Frequency Control (AFC) or a wide DSP tracking loop capable of instantly detecting the energy shift and re-synchronizing within milliseconds.

By appropriately filtering the signal, it can be easily demodulated using the Signals Analyzer (SA) FSK demodulator. The resulting bitstream—at least in this sample—features a continuously repeating 255-bit pattern (typical of an 8-bit LFSR, 2^8 −1), as shown in Figure 4. However, the pattern does not appear to be generated by a polynomial.

Fig. 4: 255-bit period demodulated bitstream

To confirm this finding, I retrieved two additional recordings of this signal from separate YouTube channels. In both samples, the demodulated bitstreams exhibited the exact same characteristic (a 255-bit pattern length). However, analyzing further recordings could help to better characterize the payload.

Fig. 5: comparison of 3 demodulated bitstreams

Why Spend 7 kHz on 20 Baud?
This signal is engineered for high-availability survivability in contested environments. Using a massive 7000 Hz shift in HF FSK modulation deliberately trades away channel space to achieve near-indestructible reliability. Here is the breakdown of why it is used:

- Beating Ionospheric Fading. The ionosphere often creates narrow "dead zones" in the spectrum. By separating the two signaling tones by 7 kHz, it is statistically impossible for a single ionospheric drop-out to wipe out both frequencies at the same time. If one tone dies, the other gets through.

- Crushing Electronic Jamming. Spreading a slow data rate across such a massive frequency gap creates a huge modulation index. To block the signal, an adversary has to dilute their jamming power across a wide 7 kHz swath, making the jamming highly ineffective.

- Immunity to Doppler Drift. In unstable conditions (like polar regions or solar storms), frequencies can drift by tens of Hertz. For narrow shifts, this blends the tones together; for a 7,000 Hz shift, a 50 Hz drift is completely negligible.

- Signal Obfuscation (Stealth). Because it spans a bandwidth wider than a normal 3 kHz HF intercept receiver's window, an operator or automated classifier looking at a standard waterfall display will simply see isolated, alternating CW (Continuous Wave) pulses separated by a massive gap. It effectively hides its identity as a unified, synchronized FSK data stream, making it harder to automatically classify, intercept, or parse unless the intercepting party knows exactly what to look for.

The CIS 20Bd/7000 is a textbook example of Soviet-legacy military engineering surviving into the modern era. It prioritizes absolute link reliability and Electronic Counter-Countermeasures (ECCM) over spectral efficiency, providing a robust, jam-resistant command link that remains a frequent sight on the HF bands for modern SIGINT monitors.

https://disk.yandex.com/d/iwfwZCwjPiNq9Q

DTE-DCE Handshaking and Transmission Management

Following my previous post, a colleague reached out asking for clarification on the real-world, non-simulated operations of Data Terminal Equipment (DTE, typically a host PC) and Data Circuit-terminating Equipment (DCE, the HF modem). This inspired this post, which consolidates and structures the technical information scattered across the web. To ground these concepts in a practical scenario, this analysis focuses on an SDTE — more formally specified in NATO documentation as the SIS-DTE (Subnetwork Interface Service Data Terminal Equipment) — executing the STANAG 5066 stack. For clarity and consistency, this component will be referred to simply as the DTE throughout the remainder of this post.

Operating high-speed data networks over the High Frequency (HF) ionospheric channel presents an exceptional engineering challenge. The channel is inherently non-stationary, susceptible to severe multipath fading, atmospheric noise, and Doppler shifts. To maintain physical-layer synchronization under these hostile conditions, tactical waveforms such as MIL-STD-188-110A and NATO STANAG 4285 decouple the physical modulation speed from the actual user throughput.
Regardless of the data rate selected by upper-layer protocols, the physical over-the-air modulation speed remains strictly locked at 2400 baud (symbols per second). Scaling the data rate down from 2400 bps to a ruggedized 75 bps is achieved not by slowing down the radio's RF emission engine, but by dynamically increasing the density of Forward Error Correction (FEC) codes, interleaver settings, and bit-repetition factors. Managing this asymmetry requires an explicit structural division between session logic and physical timing. This post outlines the interface architecture, the real-world transactional flow, the critical impact of interleaver latency, and the modern IP-based evolution of systems operating between a STANAG 5066 DTE server and a DCE tactical radio modem.

1. Deconstructing the Interface: Baud, Bits, and Protocol Overhead
A frequent point of confusion in tactical data link design is the relationship between the over-the-air symbol rate (baud) and the baseband clock frequency driven across the physical DTE/DCE interface.

1.1. The 8-PSK Modulation Reality
In a standard MIL-STD-188-110A single-tone waveform, the modem operates at 2400 baud using 8-Phase Shift Keying (8-PSK). Because each symbol represents one of eight distinct phase states, it encodes exactly 3 bits of raw information (23=8). This establishes a constant over-the-air aggregate physical line rate of: 2400 baud × 3 bits/symbol = 7200 bps

1.2. Waveform Geometry vs. Coding Overhead
By subtracting the useful user payload from this 7200 bps aggregate line rate, we can isolate the exact volume of protocol overhead. However, this overhead is not strictly composed of Forward Error Correction (FEC). In military standard waveforms, a significant portion of this bandwidth is consumed by waveform geometry—specifically, channel-probing blocks.
The waveform structure alternates strictly between blocks of unknown data symbols and blocks of known pseudo-random training patterns (e.g., 20 data symbols followed by 16 probe symbols). The receiving Digital Signal Processor (DSP) uses these known probes to continuously map and counteract ionospheric fading and multipath distortion.

- At the maximum user rate (2400 bps):
7200 bps (Total Rate)−2400 bps (User Payload)=4800 bps (Overhead)
In this high-clearance scenario, the modem dedicates exactly 66.67% of its total over-the-air bandwidth to the combination of FEC data packing and synchronization probes to stabilize the link.
- At a highly ruggedized sub-rate (150 bps):
7200 bps (Total Rate)−150 bps (User Payload)=7050 bps (Overhead)
When channel conditions deteriorate, the protocol overhead consumes 97.92% of the total bandwidth. This mathematically demonstrates how aggressively the physical layer wraps each individual user bit in an extensive repetition and convolutional coding matrix to survive extreme signal degradation.

1.3. The Shift in Timing Leadership
To prevent buffer underrun or overflow during these speed adjustments, the system splits leadership between two distinct control domains:
- The DTE (STANAG 5066 Server) rules Session Configuration: It evaluates link performance via Automated Repeat Request (ARQ) frame error rates and dictates what data rate and interleaver depth must be utilized via its Dynamic Rate Adaptation (DRA) algorithms.
- The DCE (Modem) rules Physical Timing: Once a rate is selected, the modem operates as the master metronome. 

In a legacy synchronous interface—such as RS-530 or MIL-STD-188-114—the modem physically scales its baseband clock output (TX_CLK) to match the active user bit rate. If STANAG 5066 commands a 150 bps rate, the modem's internal oscillators drop the physical hardware line clock on the data cable to exactly 150 Hz. The DTE functions as a slave to this clock, forcing its internal serial shift registers to march precisely to the physical rhythm driven by the DCE.

2. Legacy Chassis Topology: Separating the Data and Control Planes
Using a legacy, rack-mounted standalone tactical modem—such as the Harris RF-5710A—as an architectural reference, the physical implementation mandates two completely independent cabling pathways to separate synchronous data delivery from runtime reconfiguration.

2.1.The J3 Remote Control Port (The Control Plane)
The J3 interface is an asynchronous serial port (typically configured as standard RS-232). It handles no user payload data. Instead, the STANAG 5066 subnetwork layer uses this link exclusively to transmit out-of-band management commands directly to the modem's central processor. These commands are formatted using either proprietary command architectures or standardized STANAG 5066 Annex E modem control strings.

2.2. The J2 Data Port (The Data Plane)
The J2 interface is a high-speed synchronous serial interface configured for RS-530 or MIL-STD-188-114 balanced signaling. It contains the physical baseband data lines (TX_DATA, RX_DATA), the master hardware clocks driven by the modem (TX_CLK, RX_CLK), and the discrete hardware flow control lines: Request to Send (RTS) and Clear to Send (CTS).

3. The Real-World End-to-End Transaction Flow
When an application connected to a STANAG 5066 server attempts to transmit a data block across an adaptive HF link, the interaction across the J3 control plane and the J2 data plane executes a precise sequence.

 

Step 1: Link Adaptation Assessment
The STANAG 5066 subnetwork layer processes incoming link-quality statistics from the distant receiving station. Noting a drop in the Signal-to-Noise Ratio (SNR), the DTE's Dynamic Rate Adaptation algorithm calculates that the link must drop from 2400 bps to 150 bps with a Long Interleaver setting to penetrate local atmospheric noise.

Step 2: Out-of-Band Reconfiguration (J3 Interface)
Before asserting any data lines, the STANAG 5066 server constructs a management frame enclosing Annex E configuration strings, e.g.:
[DTE -> J3 Async Input]: Command -> Set Waveform: 110A_SINGLE_TONE; Rate: 150; Interleaver: LONG;

 

The internal controller of the Harris RF-5710A parses the asynchronous packet, reconfigures its internal DSP algorithms, and prepares the physical layer to alter its baseband clock distribution.

Step 3: Interface Clock Realignment (J2 Interface)
The modem immediately scales its physical hardware clock synthesizer engine down. The physical TX_CLK line output on the J2 serial connector drops from a 2400 Hz square wave down to a steady 150 Hz pulse train. The hardware interface is now locked into the correct physical sub-rate window.

Step 4: The Physical Transmission Handshake
With the interface speed stabilized at 150 bps, the synchronous data transfer proceeds:
- DTE Asserts RTS: The STANAG 5066 server drives the physical RTS line on the J2 connector LOW (Active State). This serves as a direct hardware interrupt instructing the modem to key the attached HF radio transmitter.
- The Transmitter Keying and Preamble Phase: The modem keys the radio transmitter. It keeps the physical TX_CLK signal silent and the CTS line de-asserted. During this turnaround window, the modem generates and broadcasts a physical-layer over-the-air synchronization preamble. This known tone pattern allows the distant station’s receiver to achieve phase lock and evaluate interleaver synchronization.
- Modem Asserts CTS: Once the over-the-air preamble transmission concludes, the DCE drops the physical CTS line on the J2 connector LOW. Simultaneously, it activates the 150 Hz synchronous TX_CLK line.
- Synchronous Bit Burst: The STANAG 5066 DTE detects the active CTS boundary. On every rising edge of the incoming 150 Hz clock pulse provided by the modem, the DTE shifts one bit of data onto the TX_DATA wire. The modem samples this data precisely on the subsequent falling edge, funneling it directly into the DSP's FEC packing matrix.

4. The Interleaver Latency Penalty: The Hidden Operational Constraint
A critical operational factor that engineers must account for when deploying STANAG 5066 protocols over sub-rates is interleaver latency.
To protect data from long, continuous bursts of noise (fade duration), the modem utilizes a block or convolutional interleaver matrix. The transmitter rearranges the chronological order of bits over a specific time window before sending them over the air. The worse the channel conditions, the larger the interleaver matrix required.
When dropping to a sub-rate like 150 bps with a Long Interleaver, this matrix introduces severe physical delivery delays:
- The Buffering Constraint: The transmitter's DSP must wait until enough bits have accumulated to completely fill the structural interleaver matrix before it can shuffle them and begin actual over-the-air transmission.
- The Latency Cost: At 150 bps, filling a Long Interleaver matrix introduces a processing latency of 4.8 seconds or more at the transmitter, and another 4.8 seconds for de-interleaving at the receiver.
Consequently, the first bit of the user payload does not emerge from the receiving station's modem until nearly 10 seconds after the DTE begins shifting data. This structural delay dictates that the STANAG 5066 layer must scale its internal Automated Repeat Request (ARQ) frame timers aggressively. If the software's acknowledgment timeout timers are set too short, the DTE will prematurely assume a packet was dropped and retransmit it, clogging the narrow 150 Hz pipeline with duplicate traffic.

5. The Modern Evolution: Transitioning to IP-Based Software Defined Radios
The legacy Harris RF-5710A represents a 'High-Data-Rate, IP-Ready, and Annex-E Compliant' evolution capable of driving the HF channel up to 9600/12800 bps via adaptive QAM, enabling the efficient utilization of modern STANAG 5066 servers featuring Dynamic Rate Adaptation (DRA). It serves as the ultimate historical bridge between old-world balanced cabled engineering and modern consolidated networking architectures.
In contemporary Software Defined Radios (SDRs)—such as the Harris Falcon III series—the separate physical modem and transceiver chassis collapse into a single integrated unit. Physical J2 and J3 serial connectors are completely replaced by a single Ethernet interface running standard IP stacks. This shifts the implementation from hardware-level pinning to software-defined protocol boundaries:
- The Control Plane is virtualized. Instead of serial strings sent over a dedicated RS-232 line, the STANAG 5066 node establishes a TCP/IP or UDP socket connection to a designated management port on the radio, sending configuration packets using modernized subnetwork control protocols (such as the HF Radio Control Protocol / HRCP).
- The Data Plane eliminates physical clock lines (TX_CLK). The Data Plane eliminates physical clock lines (TX_CLK). Baseband streaming bits are packaged into standardized encapsulation networks, such as STANAG 4538 or virtual synchronous serial profiles over IP. The radio's internal software clocks handle the synchronization between incoming IP packets and the underlying DSP modulator frame boundaries.

Despite this transition to IP-routed pipelines, the core architectural logic remains completely unchanged. The STANAG 5066 software node remains the logical king of data rate selection based on link performance, while the radio's internal DSP remains the absolute metronome of physical over-the-air ionospheric synchronization.

Simulating ADF ISB Transmissions: 12-Bit Repetition Coding on the USB Channel

The idea for this post stems from an interesting RAN (Royal Australian Navy) fleet broadcast originating from the MHFCS (Modernised High Frequency Communications System) utilized by the ADF (Australian Defence Force). The captured transmission employs STANAG-4285 at 600 bps/L in ISB (Independent SideBand) mode on 14874.0 kHz (Figure 1), and was successfully recorded thanks to the remote KiwiSDR VK6QS2 located in Augusta, Western Australia.

Data redundancy is a mission-critical asset in military HF communications. To ensure reliable delivery over thousands of miles, this transmission architecture departs from standard handling, utilizing the ISB spectrum to securely distribute the payload. 

Fig. 1: ADF MHFCS in ISB mode

As mentioned, the transmission relies on an asymmetric Independent Sideband (ISB) framework: the Upper Sideband (USB) delivers a redundant 600 bps stream wherein each individual bit is replicated 12 times, while the Lower Sideband (LSB) simultaneously transmits a "standard" signal at an identical 600 bps clock rate. This dual-path configuration mitigates severe ionospheric fading, allowing the receiver to cross-correlate the sidebands and reconstruct the payload without data loss. 

Technical analysis confirms that the LSB stream represents a broadcast encrypted by a KW-46 (or compatible) crypto-device, identified by the m-sequence of the generator polynomial x^31+x^3+1. This sequence is natively employed by the KW-46T transmitter for remote receiver synchronization (KW-46R). In contrast, the USB data structure exhibits 12-bit blocks of uniform logical states, most likely originated by a GA-205 12-channel Time-Division Multiplexer. This sideband similarly secures its payload using KW-46 protocols: as illustrated in Figure 2, by isolating a single multiplexed channel, stripping the remaining 11, and reshaping the data into a 7-bit architecture, the presence of the identical x^31+x^3+1 m-sequence was conclusively verified.

Fig. 2 : LSB and USB demodulated bitstreams

In this sample, both STANAG-4285 modems have the exact same clock speed and line rate of 600 bps on the physical serial line (the DTE/DCE interface) (1).  However, the amount of unique, useful information (the actual payload) is highly asymmetric: the USB channel carries a 50 bps information rate (Strategic Command & Control ?) protected by the 12x repetition code, while the LSB channel carries a native 600 bps information rate (Routine Data Traffic & Logistics ?).

The ultimate operational of ISB in this scenario is spectrum optimization.  Instead of requesting two distinct HF frequency allocations from military spectrum management, which would tie up vital radio assets and increase the station's electronic footprint, the user allocates a single suppressed carrier frequency. By utilizing ISB, the transmitter concurrently radiates two separate, parallel operational environments on a single RF assignment. 

A similar ISB paradigm is utilized, for example, by specific Portuguese Navy transmissions operating in STANAG-4285 600 bps/L mode, notably on the 12704.5 kHz Center Frequency (CF), using the HF callsign CTA12 (Figure 3). The bandwidth allocation is split as follows:

LSB Channel: Transmits the plain text Channel Availability and Receipt Broadcast (CARB), also frequently designated as the FAB (Frequency Availability Broadcast)

USB Channel: Carries a secure, encrypted fleet broadcast utilizing a legacy KW-46 cryptographic device.

Fig. 3: Portuguese Navy CT12 working in ISB mode

Concerning the source of the transmission, TDoA geolocation points to the 'Naval Communication Station Harold E. Holt' (NCS HEH), situated 6 km north of Exmouth (Figure 4). COMMSTA HEH is jointly operated by Royal Australian Navy and US Navy personnel. The High Frequency Transmitter (HFT) site houses an array of hardware, much of which is dedicated to point-to-point communication circuits linked to shore facilities and surface vessels operating within the station's operational footprint.

Fig. 4: Direction Finding (TDoA) results

The remainder of this post aims to simulate the generation of the baseband data stream for the USB (Upper Sideband) channel, alongside DTE-DCE timing management, using hardwired digital logic managed by Arduino microcontrollers. Naturally, this is a standalone proof of concept and does not reflect the actual hardware infrastructure utilized by the MHFCS.
To evaluate the generation of the cloned 12-bit redundant stream, the simulation leverages a CD4067 multiplexer (MUX) to closely mirror the hardware-level TDM implementation of the GA-205 12-channel multiplexer used by the Australian Defence Force. I followed the logical block diagram illustrated in Figure 5, implemented using breadboards, TTL and CMOS chips, and two Arduino microcontrollers. Figure 6 shows the components prior to wiring.

Fig. 5: USB channel formation

Fig. 6

A: extender buffer 

Implementing a 1-to-12 output bit extender (also known in electronics as a fan-out replicator or distribution buffer) using TTL logic is a classic and very straightforward project. The crucial factor is the current: a single output pin of a standard chip does not have the electrical strength to drive the 12 inputs of the following multiplexer (MUX) simultaneously while maintaining the correct voltage levels. For this reason, buffers are required. I used the 74LS04 chip, which contains 6 inverters (NOT gates). By routing the signal through two inverters in cascade, the bit is inverted twice, returning to its original state but with all the necessary driving power. Using the common 74LS04 chips we need to employ a 'cascade' logic: one gate acts as a pilot (inverting the signal the first time), and the other gates act as splitters (inverting it a second time, thus restoring the original signal). Given that each chip contains 6 gates, using 3 chips gives us a total of 18 gates: one will serve as the pilot, and 12 will provide the desired outputs.

B: multiplexer

The CD4067B module, a CMOS single-ended 16-channel pre-monted board, is utilized as a synchronous time-division multiplexer (TDM), serving as the critical link that generates the redundant serial stream. Driven by the binary addressing logic of Arduino #1, the CD4067B sequentially samples each input channel. By allocating an identical, deterministic time slot to every channel, the chip enforces the strict synchronous timing required to mimic real-world TDM hardware like the GA-205. The multiplexer acts as the true functional centerpiece of the system that replicates the structural signature observed in the original MHFCS transmission.

C: Arduino #1

The first microcontroller serves as the data source and hardware controller, driven by Arduino 2 clock. It is responsible for generating or forwarding the low-speed baseband bitstream (e.g., 50 bps) and generating the necessary addressing logic to drive the multiplexer. It ensures that the correct channel is actively routed into the system pipeline with precise timing.

D: Arduino #2 

The second microcontroller functions strictly as a downstream monitoring and simulation of the digital front-end of a STANAG-4285 modulator: it processes the incoming bitstream exactly as the STANAG-4285 hardware would see it, capturing the raw, synchronous 12-bit sequences directly from the multiplexer's output. The line tapped by the Arduino RX carries the exact, fully formed digital data that is ready to be applied to the physical input of the modem. This allows for comprehensive loopback testing, signal verification, and diagnostic analysis of the transmission line without needing to connect a physical modem unit.

This architecture functions as a redundant 12-bit serializer achieving high noise immunity and fault tolerance. On top of this hardware-level redundancy, the STANAG-4285 modem will introduce an extra layer of protection against fading and burst noise, thanks to its robust FEC (Forward Error Correction) and configurable interleaver mechanisms.

The fully wired circuit is depicted in Figure 7.

Fig. 7

Figure 8 displays the serial monitors of the two Arduino microcontrollers: the data source (top) and the receiver (bottom). Two "COM4" ports are displayed because the Arduino boards are driven by two separate PCs. Note that a very low clock rate was chosen in the firmware implementation allow easy reading of the serial monitors.

Fig. 8:serial monitors output of the two microcontrollers

A note about Bitrate Expansion vs. Datarate Preservation

The integration of the buffer-extender and the hardware multiplexer within this data pipeline serves a dual purpose: expanding the transmission bitrate while strictly preserving the baseline datarate (the actual information payload). 

Bitrate Expansion (50 bps→600 bps): The system ingests a baseline digital signal at 50 bps and up-rates the transmission frequency by a factor of 12, delivering a 600 bps synchronous stream at the final output. This high-speed clocking is structurally required to match the ingestion constraints of the STANAG-4285 modem. 

Datarate Preservation: While the physical signaling speed increases, the net information throughput remains exactly identical to the 50 bps input. The system does not inject new data or alter the original message content. Instead of increasing information capacity, the remaining bandwidth created by the 12x clock multiplier is entirely dedicated to data redundancy. Each original bit is algorithmically mapped across the 12-bit output frame.

https://disk.yandex.com/d/-9xhLnBZ-7RPKw  Royal Australian Navy, 14874.0 kHz CF

https://disk.yandex.com/d/MyzyM20VOnYTvg Portuguese Navy, 12704.5 kHz CF

(1) In professional HF communications (such as STANAG 4285 or MIL-STD-188-110A), the DCE (Data Circuit-terminating Equipment / Modem) acts as the master of the communications link, while the DTE (Data Terminal Equipment / Data Source) acts as a slave regarding timing and throughput.

UNID Narrowband 2400 Bd High-Order Constellation Waveform

These signals were captured on 14430.0 kHz (USB) by my colleague ANgazu, who kindly shared them with me. Special thanks go to EA1FAQ for providing access to his SDR via the AirSpy Server Network.
The intercepted transmission consists of short time-synchronized bursts, occurring either as discrete pulses or in clusters of five. Occasionally, longer-duration bursts occur with no apparent correlation to the primary pulse train. These signals exhibit a bandwidth of approximately 3 kHz and a symbol rate of 2400 Baud. Spectral analysis indicates a high SNR. Figure 1 illustrates an example of this behavior (abridged-timeline view).

Fig. 1

Analysis of the Autocorrelation Function (ACF) exhibits strong peaks every 62.5 ms. At a 2400 Baud rate, this confirms a frame length of exactly 150 symbols (2400×0.0625=150). The structure likely consists of 122 unknown data symbols followed by 28 known probe symbols. This indicates that the signal is not a standard MIL-STD/STANAG waveform; based on available non-restricted documentation, none of the established standards utilize a 150-symbol framing structure.

Fig. 2: autocorrelation analysis

Figure 3 shows a rhomboidal (rotated) signaling constellation, as observed during the analysis of the longer bursts. This pattern strongly resembles High-Order QAM modulation. Notably, the symbols cluster toward the edges of the grid rather than forming a uniform "checkerboard" layout. This effect is likely attributable to Non-linear Distortion or Gain Compression (often termed AM-AM distortion). Such effects typically occur when a signal is recorded with excessive gain (clipping) or processed through an amplifier operating near its saturation point. Similarly, in a high-power transmitter, this occurs when the power amplifier is driven close to its physical limits to maximize efficiency, causing the outer constellation points to compress.

Fig. 3: rhomboidal (rotated) signalling constellation

In QAM, outer constellation points possess higher amplitudes; under saturation, these points are "compressed" inward or flattened against the boundaries, while inner points remain relatively unaffected. Furthermore, in the case of 64- or 256-QAM, the high symbol density means that without precise Symbol Timing Recovery, the constellation points converge into a blurred mass near the decision boundaries.
I analyzed one of the long bursts using an Octave script from my repository [1], and the result of Figure 4 closely approximates the constellation analysis shown in Figure 3.

 

Fig. 4

Then I used a different Octave script [2] to mitigate the effects of clipping and saturation and employing various decimation factors across several bursts. As demonstrated in Figure 5, this approach recovered the (suspected) QAM constellations, resulting in stable amplitudes, minimal IQ imbalance, and accurate frequency offset estimations.

 

Fig. 5

Subsequently, I specifically tested the signal from Figure 3 using a dedicated 256-QAM analysis script; the results are presented in Figure 6.

 

Fig. 6

According to these findings, the signal employs high-order QAM/APSK modulation.
The interpretation of 64/256-QAM is consistent with MS-110D Waveform IDs 10-12 and STANAG-4539, which support:

- 2400 baud in a 3 kHz bandwidth
- High-order QAM (64-QAM, 256-QAM)
- high spectral efficiency, with raw data rates of approximately 14.4 kbps (64-QAM) and 19.2 kbps (256-QAM), calculated at a symbol rate of 2400 baud with 6 and 8 bits/symbol respectively.

Although the constellation alone aligns with both MS-110D and STANAG 4539 standards, the observed 150-symbol periodic structure is inconsistent with the framing specified by either protocol (MS-110D 64/256-QAM modulations utilize 288- and 384-symbol frames, while STANAG 4539 employs a 287-symbol frame).
In HF environments, the Channel Coherence Time — the window during which the ionosphere remains quasi-stationary — typically ranges between 50 and 100 ms. The observed 62.5 ms probe interval offers significantly enhanced robustness compared to the MS-110D and STANAG 4539 standards (which feature durations of 120 ms, 160 ms, and 119.5 ms, respectively). By inserting a training sequence (probe) every 62.5 ms, the system enables the receiver to update its equalizer coefficients more frequently, allowing for more effective tracking of rapid channel variations and Doppler spreads that would otherwise degrade high-order QAM performance.

The analysis tends to confirm the detection of a highly optimized narrowband (3 kHz) waveform rather than a standard MS-110D or STANAG-4539 implementation. While it utilizes a single-carrier 2400 baud rate with high-order modulation, its unique 150-symbol periodic structure distinguishes it from established military protocols. This emission may represent experimental testing or a next-generation waveform currently restricted to non-public documentation or classified reference libraries. At the time of writing, I have no reports of further interceptions, at least not on 14430 kHz.

 

https://disk.yandex.com/d/X0hzag4Z5WUgrQ 

 

[1] https://disk.yandex.com/d/6ZqFXE9ULW59SQ
[2] https://disk.yandex.com/d/g0OwfkL3KBlyvQ

CIS 2400 Bd serial bursts + WideBand OFDM-241

[Update April 3, 2026]: Further analysis of the OFDM-241 waveform has revealed additional parameters.
I would like to thank my friend and colleague ANgazu, who shared a high-fidelity signal recording. He also analyzed the OFDM-241 waveform in radiofrecuencias.es forum, identifying 16-QAM modulation on the sub-carriers. Tones 1 and 241 are pilots. There are intermediate pilots and symbols used as such in what are known as "scattered pilots" .On my end, I replicated the OFDM analysis on the signal provided by my colleague and can fully confirm his findings. 

---

The original post follows below:

Interesting composite signal featuring a format consisting of a burst pair with a 3 kHz bandwidth (~750 ms duratione), followed by a longer burst (~5700 ms duration) occupying a 6 kHz bandwidth. The transmission was recorded at a center frequency of 20859.0 kHz a few weeks ago (Figure 1).

Fig. 1

3 KHz bandwidth bursts
The 3 kHz bandwidth bursts consist of a preamble followed by 33 frames. The modulation employed is PSK at a symbol rate of 2400 Bd. Signal autocorrelation (ACF) exhibits peaks at 20 ms intervals, corresponding to a framing of 48 symbols: likely 16 symbols used for probes (known symbols) and 32 symbols for data (unknown symbols).

Fig. 2: 3 KHz bandwidth, 2400 Bd bursts 

Constellation diagrams and state transitions provide little assistance in identifying the modulation scheme (Figure 3); however, the preambles and reinserted probes most likely employ BPSK. In accordance with previous analysis, the waveform employed is identical to the one discussed in posts [1] and [2].

Fig. 3: 3 KHz bandiwdth, 2400 Bd constellations

6 KHz bandwidth bursts
The 6 kHz bandwidth bursts employ an OFDM waveform, consisting of a 241-channel multiplex with 25 Hz spacing and a symbol rate of approximately 21.33 Bd per carrier. This results in an aggregate raw symbol rate exceeding 5000 Bd.

Fig. 4: OFDM-241 6 KHz bandwidth burst

Determining the modulation scheme employed for each channel remains challenging; while QAM is a likely candidate, this remains an unconfirmed hypothesis. Similarly, it can be hypothesized that these are test or experimental transmissions conducted by CIS diplomatic or military entities, as observed in previous cases.

https://disk.yandex.com/d/67gLhhUILzry0Q

[1] https://i56578-swl.blogspot.com/search?q=ofdm+121
[2] https://i56578-swl.blogspot.com/2021/12/cis-2400bd-serial-bursts.html