(yet another) 100Bd/500 FSK-2

4 August 2020 update
some frequency, same timing, and same 511-bit sequence but the speed has switched to 50Bd (shift remains unchanged, 500Hz):

It's to notice that the 511-bit sequence is obtained using the seed  s=[0 0 0 0 0 0 0 0 1]  and transmitting the output in opposite polarity (i.e., inverting the polarity of the demodulated sequence we get the exact sequence generated with seed s=[0 0 0 0 0 0 0 0 1]):

up: LFSR sequence when seed = [0 0 0 0 0 0 0 0 1], down: received sequence after reversing the polarity

2 August 2020
Just to log interesting 100Bd/500 FSK-2 transmissions found on 9130 KHz (CF). Data sent consist of a repeated 511-bit pseudo-random sequence which is generated by the polynomial x^9+x^5+1 (Fig. 1); likely that sequence is used when no data to transmit is available or to mantain sync between transmitting and receive modem (see also ITU Recommendation O.153 [1]). Since the 100Bd/500Hz waveform is used in several systems, it's difficult to state the source; anyway, it's to notice that x^9+x^5+1 sequences (PRBS9) are also used in CIS-12 and more generally in T-230 family devices.

Fig. 1 - the 511-bit pseudo-random sequence

Looking at the two FSK tones, it seems that they preserve their phase after each switch-over (Fig. 2). By the way: F1 = 753.87 Hz (1:0.001326479), F2 = 1253.68 Hz (2:0.001595299), dF = 499.81 Hz.

Fig. 2

I followed the transmissions for some days, they usually take place on weekdays at 0943 and stop at 1100 (UTC times). I ran several TDoA attempts and results point to the Moscow area, unfortunately they do not exactly agree.

Fig. 3 - start stop period

Fig. 4 - some of the TDoA results

[1] https://www.itu.int/rec/T-REC-O.153/en

50Bd/500 FSK (likely CIS Gov/Mil)

update

My friend cryptomaster (thanks) confirmed the user (CIS networks) and he also pointed out that the 128-bit sequence is actually a 64-bit sequence that is transmitted in opposite polarity:

1111101111001110101100001011100011011010010001001100101010000001

0000010000110001010011110100011100100101101110110011010101111110

As well as the central part of the message which is the same 64-bit sequence (here 13-bit shifted) but with one bit in error:

0010101000000111110111100111010110000101110001101101001000100110

1101010111111000001000011000101001111010001110010010110111011000

11 June 2020

Unid (likely CIS) 50Bd/500 FSK message recorded on 12221 KHz (cf) at 1035z using the KiwiSDR "nsk" located near Novosibirsk, Russia. Notice the sequences generated by the polynomials x^7 + x^5 +x + 1 (128 bytes length) and x^5 + x^4 + x + 1 (Fig. 1).

Fig. 1 - the two LFSR sequences

Although the shift is an integer multiple of the speed, the two FSK tones do not preserve their phases (Fig. 2).

Fig. 2 - phases of the two FSK tones

https://yadi.sk/d/mZiO7oRcHtQ5-Q

K4MT/NT9P Net, Russian Intel/Diplo (M42b)

K4MT/NT9P network, also known as Enigma designator M42b, is a quite common Russian Intel/Diplo network which uses both CW-Morse and FSK 50Bd/500.

Fig. 1

In this recording, FSK follows a CW call "NT9P NT9P NT9P DE K4MT K4MT K" and in turn it's followed by a "CFM QRU K" request: most likely the CW is used for setup or operators chat. The FSK is a Baudot 5FG coded stream using a preamble and 7-bit period (fig. 2):

Fig. 2

note the markers at every group of 50 x 5FGs (Fig. 3):

Fig. 3

https://yadi.sk/d/GrRm0dpM3Mio6U

Baudot FSK 50Bd/500 (unid Rus Gov/Mil)

Some day ago, me and my friend KarapuZ were talking about some asynchronous 500 Hz shift FSK-2 signals and the way to get a meaningful decoding from the demodulator of SA. The first step is the removal of the START/STOP bits according to the size of the data field  (ie 5, 6, 7 or 8 bits) and then try different alphabet codes in turn, until you find one that produces an output that makes a sense. 

The analyzed signals have a shift of 500 Hz, a manipulation speed of 50 Baud and a 5-bit size data field. 

Once removed the START/STOP bits, we tried the 5-38 code (1 start bit, 1.5 stop bits, the good old Baudot), as KarapuZ advised, and we got groups of 5 LTs (or 5 FGs ?). The used procedure, and the results, are shown below.

Fig.1

Fig.2

Groups of 5 LTs is a "format" that is frequently used by several Military and Governative Agencies so in the absence of other evidence it's a bit difficult to identify the source, although there are good chances in favour of  CIS/Russian users.

https://yadi.sk/d/fcGKlSq_3GV8HT

Unid FSK 50/500

This signal was heard on 14568.0 (cf) around 1410z, 25 Jun. It's a sync FSK 2-carriers with shift = 500 Hz and baudrate = 50 Baud. ACF160ms with odd 2 bits stop and apparently no start bit.