▼

CIS Ny T-600 Fleet Broadcast

Last update: 21 September 2026

This page does not claim to define the characteristics of the T-600 system, nor to be exhaustive. It reports only the author's own observations, in the hope that they may help or complement those of other SIGINT hobbyists. Corrections and additional observations are welcome.

1. What the published sources say
T-600 is one of several code names for a proprietary FSK broadcast system used by the Russian Navy [3]. Signal Identification Wiki describes a mode called CIS-36-50, also known as BEE-36, an FSK modem used by the Russian Navy [1]. That page does not use the name T-600, and the Priyom page [3] does not use the name CIS-36-50. The equivalence of the names is stated in a forum post [2], which refers back to [1], and in the labels of this blog. It should therefore be read as a convention of the monitoring community, not as a documented designation. 

Priyom states that the system has no fixed symbol rate or frequency shift. The typical HF configurations are 50 Bd with 200 Hz shift, 50 Bd with 250 Hz and 100 Bd with 500 Hz; on VLF the only configuration is 50 Bd with 75 Hz [3]. Signal Identification Wiki reports symbol rates of 36, 50, 75, 100 and 150 Bd, shifts of 85, 125, 250 and 500 Hz, and a variable rate of 50-3500 Bd; its samples include 50 Bd with 250 Hz and 100 Bd with 100 Hz [1]. These figures describe what has been observed, not a specification.

Priyom also describes the frame [3]. Transmissions begin with brief reversals (0101...), followed by a 44-bit start-of-message sequence, of which three variants are listed (ship-to-shore, RDL and unknown) (1). A 70-bit session key follows, sent twice, and then the message. The system casts 5-bit characters into 7-bit sequences that always contain four marks and three spaces, and the end of message is made of five 7-bit words 0001000. Among its examples is a ship-to-shore 50 Bd / 200 Hz variant that sends reversals, delivers two messages, then sends reversals again.

Some transmissions pair the data with FSK Morse. On the RDL broadcast the Morse carries "RDL RDL RDL" followed either by two 5-digit groups repeated three times or by a radiogram, and messages of the "Monolith" type, marked by an "XXX XXX" prefix, are also sent [3][4]. Priyom gives a shift of 250 Hz for the RDL broadcast on HF [4], while the caption of an RDL sample on the T-600 page gives 200 Hz [3].

Everything documented publicly concerns the modem and framing layers. No public source consulted documents the encryption layer, so it is not known whether encryption is integrated in the same equipment or performed by a separate device feeding the modem. A forum post [2] notes that the mode can be partly read, but that no one is sure what is being said.

2. How the label is used on this page
The label "T-600" is used here as a working name for a group of 50 Bd FSK transmissions attributed to the Russian/CIS Navy fleet broadcast. The name follows its use in the listener community [2][3], but the grouping criteria are the author's own: transmissions are assigned to the group by the structure of their bitstream, not by their modulation parameters. A transmission belongs to the group if its bitstream shows a start-of-message sequence of 42 bits, a 70-bit Initialization Vector sent twice, a payload of 5-bit characters carried in 7-bit words with a fixed 4:3 ratio of ones to zeros, and an End of Message made of five 7-bit words. The sequence used on this page is the one of the ship-to-shore variant in [3]; the comparison of each sample with the other two variants listed there is not part of this page.

The scope is narrower than in the published usage [3], which also includes 100 Bd transmissions with a 500 Hz shift. The variant with 136-bit framing is treated separately and is not part of this group. Shift values of 40, 700 and 1000 Hz do not appear in the lists reported by [1] and [3].

Grouping by frame layout is consistent with a common origin or system. It does not show that all these transmissions come from the same equipment or the same operator, and it does not exclude that other systems use the same layout. The payload is enciphered and has not been decoded (2).

3. Observations
3.1 Recorded shifts
Six shift values are documented on this blog, all with traffic at 50 Bd:

- 40 Hz: HF, 12592.5 kHz, also received on 14581.0 kHz by a collaborator; post of 22 July 2016 [5]
- 75 Hz: VLF, 18.1 kHz, RDL broadcast [6]
- 200 Hz: HF, described in the post of October 2016 [7]
- 250 Hz: HF, described in the post of April 2021 [8]
- 700 Hz: HF, 16199.75 kHz (cf), recorded on 22 July 2026; first time this shift was observed [9]
- 1000 Hz: HF, 12376.0 kHz (cf), recorded on 11 December 2016 [10]

3.2 Frame layout
The 'standard' format of the 50 Bd FSK messages grouped here as T-600 consists of (Figure 1):

- a 42-bit start-of-message sequence / Unique Word, usually 100001010010111110000101001101011010101101;
- a 70-bit Initialization Vector (called session key in [3]), sent twice;
- a ciphered payload of 7-bit words arranged in a 4:3 ratio, with parity check;
- five 7-bit words 0001000 as End of Message (EOM).

The 0/1 values of the sequences above depend on the reception polarity. The layout matches the description in [3]; the difference in the length of the start sequence is explained in (1).

Fig. 1: Frame layout: reversals, 42-bit sync, two 70-bit IV, payload with 4:3 ratio and parity check, five EOM words, reversals.

42-bit sync sequence
The transition from idle to traffic is signalled by a break in the bit reversal structure: a '1' is inserted instead of a '0', so that the reversals end in 01011 rather than 01010 (Figure 2). Using intentional protocol deviations for signaling is a common practice across many standards, such as Ethernet LAN protocols (3). The initial 42-bit sync sequence also represents a "violation" of the 4:3 ratio (see below), ensuring reliable synchronization.

Fig. 2: The 42-bit sequence searched with zero errors allowed in the two messages (msg1, msg2); the arrows mark the matches.

70-bit Initialization Vector
Figure 3 displays the identical pair of messages aligned in 70-bit blocks, emphasizing the probable Initialization Vector (IV) sequences, repeated twice, prior to the encrypted payload.

Fig. 3: The two messages aligned in 70-bit blocks.

4:3 ratio with parity check
The payload consists of 5-bit characters encoded into a 7-bit sequence with a fixed 4:3 ratio of '1's to '0's (or vice versa, depending on reception polarity) (4). The constant presence of four '1's per word also provides parity-based error detection. Figure 4 shows a scan of the start bit offset: at the correct offset 98.8% of the words satisfy the 4:3 ratio and 99.4% satisfy even parity, while at the other offsets the success rate falls to roughly 35-55%, which confirms the alignment of the payload on 7-bit words.

Fig. 4: Word alignment test on the payload: 4:3 ratio (98.8%) and even parity (99.4%) as a function of the start bit offset.
End of Message (EOM)
The End-of-Message (EOM) sequence (Figure 5) consists of five identical 7-bit words, 0001000, again violating the constant bit ratio of the payload section. The figure also shows that the two messages are identical. In the 1000 Hz sample at least four repeated end words were counted [10].


Fig. 5: End of Message in the two messages.

3.3 Idle, preamble and message priority
Traffic is preceded by reversals. In the 200 Hz sample an initial reversal sequence at 36 Bd was followed by traffic at 50 Bd, and the 36 Bd reversals were omitted when more than one message was sent [7]. In the 700 Hz sample the signal consisted of almost continuous reversals, with the change to traffic marked as described in 3.2 [9]. This break is documented for the 700 Hz sample only.

The 700 Hz sample was also preceded by a Morse-FSK preamble, UUUUU XXX XXX, which is consistent with high-priority traffic. This interpretation is not confirmed by official sources [9]. Morse-FSK flash messages were previously documented in the 200 Hz sample [7] and on VLF at 18.1 kHz [6]. The two messages in the 700 Hz sample are identical, which is consistent with repetition for reliability.
TDoA measurements with KiwiSDR receivers for the 700 Hz sample point to an area southwest of Moscow, but multi-hop propagation makes the result uncertain [9].

3.4 Interpretation and limits
The recurrence of the same layout under six different shifts, on VLF and on HF, is consistent with the shift being a link-level parameter, while the framing belongs to a layer that stays the same across links. For the 40 Hz sample the post documents the start and end markers and the 4:3 code [5].

Three points limit this evidence. The layout itself is already described in [3], so the contribution of this page is its recurrence across shifts, not the layout. The 1000 Hz sample is a single recording, probably an occasional test, with a 100 Hz keying at the transition edges that may come from a filtering fault; its shift is also unusual for this family [10]. And the existence of a variant with 136-bit framing [11] shows that this layout is not common to all 50 Bd transmissions of this kind.


Notes
1.The ship-to-shore sequence in [3] has 44 bits and is identical to the 42-bit sequence used on this page preceded by the two bits "11". This is consistent with those two bits being the break in the reversal pattern described in 3.2 (a '1' instead of a '0' at the end of the reversals), which is counted separately here.
2. Only the frame structure is described on this page; nothing is claimed about the content of the messages.
3. In 10BASE-T Ethernet the frame starts with a preamble of alternating 1s and 0s, which ends with two consecutive 1 bits to signal the start of the frame (IEEE 802.3, Clause 3).
4. A 7-bit word with four ones has 35 possible values, of which 32 are needed to carry a 5-bit character.

References

No comments:

Post a Comment