17 November 2016

cars, chameleons, networks, and other stories (update)

6231 net (6231.0 KHz)
I recently spotted the frequency 6231.0 KHz on USB where stations connect following the same procedure as of AB-net and use STANAG-5066 HMTP protocol which is transported by a STANAG-4285 modem configured for 1200 bps and short interleaver (Figs. 1,2).  As in the 5054-net, the message transfer is not preceded by ALE or selcall phase and this supports the idea of scheduled tansmissions. 
The post related to AB-net and 5054-net (HRV MORH-u) can be read here.

Fig.1 - the HF waveform (Stanag-4285)
Fig.2 - 1776 bit period (Stanag-5066)

While the transmissions in the AB-net are scheduled on tuesday and thursady from 0830 UTC (0730, daylight savings time), transmissions on this frequency start  at 0800 UTC on monday and wednesday (most likely 0700, daylight savings time)[1]. These are the heard callsigns,  listed in the call-order: 
GHU3 (net-control station)
Stations are contacted a first time by GHU3 for a radio-check then, in case of messages, the stations shall be contacted a second time and in the same order. Unless the initial 188-141 2G-ALE phase, the message transfer follows the schema seen here, used in the AB-net.

The HMTP headers in Fig. 4 prove that this net belongs to the HRV MORH-u network as the previous AB-net and 5054-net: same OS (Linux Open-SUSE), same STANAG-5066 application ("CroS 5066", developed by CROZ) and same attachment filename.

Fig. 4

The examination of the headers of the Data PDUs (D_PDU) gives the chance to get the STANAG-5066 addresses of the nodes in the play. The D_PDU headers can be highlighted by synchronizing the bitstream on the 16-bit Maury-Styles sequence 0xEB90 since all D_PDUs, regardless of type, begin with that same sync (it's just this sequence that causes the 1776-bit ACF of Figure 2).

Fig.5 - D_PDU headers
The S-5066 addresses obtained from the recordings belong to the 006.008.003.zzz subnet, then 5054.0 and 6321.0 KHz  are just two channels of the same subnet.
Below the updated S-5066 Addresses Table and the Network Map. 

AB-net 5838.0 KHz (...)
ALE  S-5066 Add.       E-mail Add. 
ABC7   user1@asdf.123 (ncs)
ABD1   user1@sdfg.123
ABG6   user1@dfgh.123
ABF2   user1@fghj.123
ABS5   user1@ghjk.123
ABK4   user1@jklp.123
ABH3          ?

5054/6231-net 5054.0 KHz, 6231.0 KHz
CALL S-5066 Add.       E-mail Add.
GHU3   user1@aysxd.111 (ncs)
ZIO4   user1@oli93.111   user1@lost62.111

NIK2   user1@dres32.111
ULI6   user1@fejk8.111

CIK5   user1@huba9.111

Anyway, these are tactical callsigns and rotate likely on a monthly base: e.g. in January 16 2017  the station user1@huba9.111 has been heard with callsign CHP3 (was CIK5) and obviously with same S-50966 Address (

[1] further recordings are needed

No comments:

Post a Comment