QPSK & "SPIDER HF" MFSK8 waveforms (ROK Military)

I monitored the 8235.0 KHz/USB frequency (maritime band) since some days using some remote KiwiSDRs in Oita, Okayama (both Japan) and Daegu (South Korea) [1] recording several and very interesting QPSK and MFSK8 signals that I had never met before.

1) I noticed that QPSK transmissions usually start from 0730 UTC while MFSK8 transmissions start from around 0900 UTC; probably they have different contents and purposes. In this regard, it should be noted that I monitored only during the morning and early afternoon UTC and that Korean Standard Time (KST) is UTC+9. A second interestig aspect is that both types of transmission are not preceded by selcalls or ALE, perhaps 8235.0 KHz is a "stand-by" frequency of that net? 
As shown in Figure 1, other than QPSK & MFSK8 data transfers, transmissions consist of voice comms that have been very useful since the analysis of the audio files (speech & accent), and in part of the waveforms too, allowed me to trace it back to a South Korean user; also note in Figure 1 the slight mistuned frequency between the operators.

Fig. 1 - QPSK and MFSK8 signals

2) QPSK transmissions consist of a series of "segments" that are sent consecutively, the longest I have seen is about 32 seconds; voice comms occur before and after a series has been transmitted. 

 

Each segment has a modulation rate of 750 Baud (1500 bps) and a 1600 Hz bandwidth. Each segment is preceded by two unmodulated tones lasting approximately 5 seconds and end with a short tone transmitted at the sub-carrier frequency (Figs 2,3); the distance between the two initial tones is 750 Hz.

 

Fig. 2 - QPSK signal parameters

Fig. 3 - QPSK modulation

 

As confirmed by my friend ANgazu, the two initial tones make a BPSK signal whose modulation speed has the same value as their shift, ie 750 Bd; the carrier is the center of both. They transmit reversals and are very useful to adjust the AGC, fine-tuning the signal and synchronizing the demodulator's PLL. In this case, if using a QPSK demodulator, the initial preambe is "0202020202" and it achieves the same functions (Figure 4).

 

Fig. 4 - QPSK demodulation of the two initial tones

I couldn't find a characteristic period of the demodulated QPSK bitstreams (Figure 5): instead, since they are raw PSK demodulations and NOT the result of a decoding, we should see something similar to a "framing" of the used HF waveform, as we usually see in these cases, even if bits are encoded and interleaved.

 

fig. 5 - a bitstream after QPSK demodulation (BPSK preamble is omitted)

 

Statistical analysis of one of these bitstreams (Figure 6) shows a compressed or encrypted stream: probably the encryption device is built into the modem or the encrypted streams are sent directly to a "simple" QPSK modulator.

 

Fig. 6 - statiscal analysis of a demodulated QPSK bitstream

3) MFSK8 transmissions, unlike QPSK, consist in a "single" transfer, voice comms occur before and after each individual transmission. 

Transmissions are preceded by two unmodulated tones with a separation of 500 Hz and a duration of about 5 seconds (as in the QPSK waveform). The unmodulated ending tone, lasting about 1 second, coincides with the lowest data tone (the initial two tones do not match any data tone). The eight data tones are modulated at the speed of 250 Baud (750 bps) and the space between the tones is 250 Hz giving an occupied bandwidth of 2250 Hz (Figs 7,8). Each tone (symbol) represents three bits of data as follows (least significant bit (LSB) to the right):

 

   tone       Gray   bin
• 1000 Hz  000    000
• 1250 Hz  001    001
• 1500 Hz  011    010
• 1750 Hz  010    011
• 2000 Hz  110    100
• 2250 Hz  111    101
• 2500 Hz  101    110
• 2750 Hz  100    111

 

(the frequency of the tones was established based on the correct tuning of the operators' voice)
Note that aurally it cannot be confused with the Thales Robust MFSK8 or MS-141A waveforms as they have a 250 Hz lower tones allocation and a lower Baud rate (125 Bd). By the way, the SPIDER MFSK8 its usage is probably similar to the Thales one, i.e. data transmission.

 

Fig. 7

Fig. 8

The analysis of ACF and bitmap rasters reveals the presence of structured blocks at the beginning and at the end of each transmission (Figure 9): these blocks have a duration of 1364 ms that makes 341 symbols (at modulation speed of 250 Bd).

Fig. 9 - MFSK8 ACF and bitmaps

I also tried a "plain" 8-tone demodulation using the SA demodulator and according to the tone order shown in Figure 10; for completeness I used both binary and Gray (MS-141 style) conversion. Again, Bit streams show two initial and final blocks that have equal length of 1023 bits, ie 341 symbols (each tone represents a 3-bit symbol).

 

Fig. 10 - binary and Gray coded MFSK8 bitstreams

 

4) Why am I thinking of South Korean users?
My friend cryptomaster told me a great lead by reporting that the MFSK8 250Bd/250Hz is a "proprietary" waveform of the "SPIDER Tactical Communication System" by Huneed Technologies (Figure 11), a South Korea-based company engaged in the provision of tactical communication equipment to South Korea Army [2]; the system was deployed in the early 2000s. According to some Google searches, the transceiver used could be the SPIDER (CNR) HF PRC/VRC-950K, suited for either army and navy [3][4]. It's not known if, in addition to MFSK8, the QPSK waveform too is provided by that same device.  
Since the speech & accent, the voice comms language is definitely Korean, as Max (KJ4WNA) from UDXF emailed me "a tell tale sign is the endings -nida". As for the North/South Korea ambiguity due to the use of the same language, AFAIK the North Korean military (Korean People's Army, KPA) uses communication equipments by Glocom Corp. and not South Korean ones. Unfortunately, further "geographic" confirmation was not possible because radio direction finding results were not reliable due to the brevity and near unpredictability of the transmissions as well as the lack of receivers west of the Korean peninsula.

 

Fig. 11 - SPIDER (Combat Net Radio) HF transceiver by Huneed

As far as possible, I transcribed the Korean-language audio files into texts using some online tools [5], then I translated the txt files into English using Google/Yandex/DeepL translators obtaining rather interesting conversation' snippets (Figure 12). Although transcriptions and translations may results a bit "odd" and discordant, actually there are clues that point to South Korea.

 

Fig. 11 - example of a machine transcription & translation

Speeches seem refer to a maritime scenario, as from the exchanged informations related to weather conditions, sailing, heading etc.: it must be said that the use of the SPIDER HF waveform would indicate an usage in a military environment such as the Navy and not in fishing boats. In addition to usual coordination and voice checks relating to the sending/receiving of data,  operators cite names of some South Korean places such as "I'm going to go to Namhae by the South Sea"(1),"There's nothing else in Busan "(2), or "Mapo is 7 Km away" (3).
As I said, the transmissions are not preceded by selcal/ALE and I did not hear - or perhaps I did not figure out - any callsigns pronounced by the operators. Only in a few transmissions I came across sentences such as "I've communicated with all the surrounding turns... I've communicated with both SP3 and SP4" but I haven't heard anything else or additional context that actually confirms that these are callsigns. Only once I heard a link termination:  "This is Yanglak-Dong 146 / This is Maunoi" (or perhaps "This is Yangrak-Dong 146 / This is Maunnoi").
Amogng other txt files, a September 23 0923 UTC (1623 KST) voice recording requesting the location of a boat carrying (North Korean) defectors must be noted (Figure 12). North Korean "defectors" are Koreans who have fled North Korea seeking asylum in South Korea or other nations. For the sake of completeness, I must say that the day after I looked at the Yonhap news agency website [6] but I did not find any reference to alleged defectors. Perhaps the news was not so relevant or there was no intervention by South Korean assets ...but here we enter the realm of suppositions.

 

Fig. 12

5) Given the the use of a "informal language", the machine transcriptions/translations might sometimes generate military jargon terms and names that seem a bit odd and out-of-context, as the the classic term "Christmas trees" used in board U.S. submarines and reffered to nuclear missiles. For example, I have often noticed the use of the term "seagull" which, judging by the speeches context, may not refer to the well-known bird. Also, it must be said that the operators speak Korean(!) and not more "easy" languages ​​such as English, Spanish or even French, so I could not correct the errors as I should desire and confirm that the transcriptions were accurate, but I simply copied and pasted the automatically transcripted texts.

6) At present I do not have sufficient evidence to confirm whether this is the South Korean Navy (ROKN, Republic of Korea Navy) or possibly other assets such as the Coast Guard (KCG, Korea Coast Guard), although the latter is not under the Ministry of Defense (the Coast Guard is an independent and external branch of the Ministry of Maritime Affairs and Fisheries). Therefore I can't not exclude that users may be other South Korean military/civilian organization: further recordings & analysis and blog readers too will help.

(to be continued)

 

https://disk.yandex.com/d/_Ab_KPufsyPGPw (waveforms and a relevant op-chat)

(1) Namhae is the site of the South Regional HQ of Korean Coast Guard and also a Mine Sweeper Hunter of Korean Navy

(2) The Busan Naval Base is a group of ports and land facilities of Korean Navy (ROKN), located at Nam-Gu, Busan. The United States Naval Forces Korea headquarters sit within this base

(3) "Mapo" could be a mistranscription of the word "Mopko" which is the Third Fleet Command HQ of ROKN and also the West Sea Regional HQ of KCG. This way, the sentence "Mopko is 7 Km away" would make sense

[1] http://kiwi.web-sdr.net:80/ (list) http://22052.proxy.kiwisdr.com:8073/ http://hl5ntr-sdr.ddns.net:8073/
[2] https://huneed.gobizkorea.com/mini/site/miniSiteMain.do?domn_id=huneed
[3] https://en.wikipedia.org/wiki/...
[4] https://blog.naver.com/PostView.nhn?blogId=altecsound&logNo=6017573017
[5] https://app.transkriptor.com   https://turboscribe.ai   https://www.notta.ai

[6] https://en.yna.co.kr/
 

CIS MFSK-33 (here:15+∅+17), likely a "Serdolik" multimode waveform

Fig. 1 - "Serdolik" multimode waveform

The MFSK segments have the usual 40Bd and 40Hz (channels separation) values which are typical of the Serdolik waveforms family: a long-range radio system used by the Russian and CIS countries Diplomatic Service, possibly Serdolik V2. It's worth noting in Figure 2 - at least in this sample - that although the system provides a 33 channels grid, only 32 are the effective (used) ones: specifically, the first 15 lower channels plus the 17 higher ones (the 16th channel is not used).

Fig. 2 - MFSK segments

The FSK inserts too have usual Serdolik values, ie 40Bd/680Hz in this sample, and consist of short "01"s sequences (Figure 3).

Fig. 3 - FSK segments

This sample has been recorded on 20.8155 MHz/USB using a remote AirSpy server located in UK.

CIS MFSK-33 waveform is not the only one that does not always use all the available channels of the frequency grid: CIS MFSK-34 (aka Crowd-36) is another example in this regard (Figure 4).

Fig. 4 - frequency grid of some CIS MFSK-34 samples

https://disk.yandex.com/d/wgskeCZfRcz6Ow

unid MFSK-17 125Bd

Unid (probably Russian) MFSK-17/125 125Bd burst transmission heard on 21292 kHz USB (15mt HAM band) USB at 0830 UTC. 

Fig. 1

Fig. 2

The same waveform was already noted six years ago(!) and reported in this blog:
http://i56578-swl.blogspot.com/2017/07/russian-mfsk-17-125bd125hz-burst-system.html 

 https://disk.yandex.com/d/7LLoZu03nFRhaA

unid FSK/MFSK SELCAL

6907.0 KHz (cf): unid SELCAL waveform spotted on 6907.0 KHz (cf),. The waveform consists of 40Bd/240 FSK idling part  followed by MFSK-36 40Bd/40 (likely the Id of called station).

Fig. 1

 

Fig. 2

https://disk.yandex.com/d/XlHhceBC9fLlvQ

unid 200Bd/400 MFSK-4

Yet another interesting signal sent me by my friend Eddy from Australia. The transmission has been recorded on 16320.0 KHz/USB at 0520Z and consists of 200Bd/400 FSK-4 segments (the signal in between does not carry information). Figure 1 shows the measurement of the relevant FSK parameters. 

Fig. 1

The first two segments A,B (the shorter ones) could probably act as selcall. Indeed, after the removal of the polynomial x^5+x^4+x+1, the stream exhibits an interesting 8-bit structure where repeated initial patterns can be seen.

Fig. 2

The longest segment has an interesting structure. In my opinion, the initial part is formed of a 118-bit initial sequence followed by a block consisting of a 192-bit (24 bytes) sequence which is four times repeated; probably it's the synch + initialization vector section of the message.

Fig. 3

After the removal of the initial part, the stream shows a 504-bit period but with several alternate sequences (Fig. 4). The same 8-bit structure is visible after the removal of the polynomial x^5+x^4+x+1 (Fig. 5 ). Most likely it's a Chinese waveform, although there are not more informations about it. Recently these transmissions have also been listened on the Twente websdr (and just on the same frequency).

Fig. 4

 

Fig. 5

 

https://yadi.sk/d/nECimsqDQuy1hw

demodulating sync F7B mode transmissions using F7B.exe software

F7B signal, apparently a "classic" MFSK-4

My friend cryptomaster coded a program (F7B.exe) for demodulating synchronous F7B, it can be freely used and distributed for the analysis of such signals. Unfortunately, SA program parses these transmissions as classic MFSK-4 but that is not what actually is on-air: indeed,  F7B transmission mode deals with signals consisting of two independent but synchronous channels CH1 CH2 each carrying teletype signals (FSK2 on 2 independent channels).

F7B.exe can be downloaded from here:

http://www.radioscanner.ru/files/download/file21446/f7b_new.rar
https://yadi.sk/d/ZcsslwVpIwTpmg 

Warning: F7B.exe is coded to run under win/32-bit systems so you may encounter a comdlg32.ocx error (component not correctly registered) when try to run it under x64 systems, here is how to resolve comdlg32.ocx missing error:

https://www.swisssalary.ch/.../register-comdlg32.ocx-on-x64-win7

F7B.exe needs as input file the  raw MFSK-4 stream produced by the demodulator of SA and output two ASCII-Bit files CH1.txt and CH2.txt in the same directory of the input file:

Moreover, the Octave script T207_detect.m  has been used for the check of T207/CIS-14 mode [1]: it can be freely downloaded from here (you will need GNU Octave package [2] to run the script):
https://github.com/hcab14/.../T207_detect.m
the Octave script T207_detect_e.m also extracts the two world and bit interleaved channels:

https://yadi.sk/d/zsCD73C9DZpHPQ

I tested the demodulator on the two  F7B modes 100Bd/1000 and 96Bd/500, both actively used by Ukrainian Nets; by the way, two preliminary observations:

1) usually, the two F7B channels CH1 CH2 are T-207 secured according to the CIS-14 mode [1]. Since CIS-14 consists of two independent 5-bit MTK-2 channels (transmitted in 14-bit frames), it turns out that those F7B transmissions may carry up to four independent 5-bit channels (CH1a, CH1b, CH2a, CH2b);

2) both those F7B waveforms have their FSK2 counterparts.

I also tested F7B.exe on the Rockwell TE-204, a "special" time-frequency diversity FSK4 mode most commonly used by Allied Air Forces as an air-to-ground messaging system as well as in ground and naval applications.

100Bd/1000 F7B

Fig. 1 - 100Bd/1000 F7B

100Bd/1000 F7B transmissions occupies about 3000Hz bandwidth with the four tones at -1500, -500, +500, +1500 Hz respect to the center frequency. As said above, 100Bd/1000 F7B transmissions may carry up to four independent 5-bit channels. In this regard, it's worth noting in figure 2 that - at least in this sample - the two F7B channels adopt different CIS-14 checksums: mode 20 (0312) in channel CH1 and mode 3 (3120) in channel CH2: who knows, maybe the two F7B channels carry the same data but with different checksums just to increase the redundancy of the system. Note that CIS-14 100Bd/1000  (the FSK2 counterpart) uses the checksum mode 20.

Fig. 2 - two 100Bd/1000 F7B channels, each transporting two CIS-14 channels (CH1a, CH1b, CH2a, CH2b)

96Bd/500 F7B

Fig. 3 - 96Bd/500 F7B

96Bd/500 F7B transmissions occupies about 1500Hz bandwidth with the four tones at -750, -250, +250, + 750 Hz respect to the center frequency. The same earlier conclusion applies: that is since CIS-14 consists of two independent channels,  96Bd/500 F7B transmissions too may carry up to four independent 5-bit channels.

I don't know if it's a mere coincidence, anyway it's interesting to note in figures 4,5 that only one channel transports data, as well as the CIS-14 96Bd/500 (the FSK2 counterpart) does: i.e., either 96Bd/500 F7B either 96Bd/500 FSK2 use only one of their two "available" channels.  Both the waveforms use the CIS-14 checksum mode 20.

Fig. 4 - two 96Bd/500 F7B channels, only one of the two available CIS-14 channels is used

Fig. 5 - CIS-14 96Bd/500 FSK2 channels, only one of the two available 5-bit channels is used

In this transmission the two channels use different EOT signaling sequences (figure 6)

Fig. 5

Rockwell TE-204 FSK4
Although TE-204 does not definitely use the F7B mode, I decided to check it since regards two FSK2 channels. Indeed, TE-204 transmits the "mark" on 935 Hz for 6.67 msec period followed by a replicated 6.67 msec "mark" at 1815 Hz. Similarly, the "space" is transmitted at 1375 Hz for 6.67 msec followed by a replicated 6.67 msec "space" at 2255 Hz (figure 6). This "mode" provides an in-band frequency  and time diversity function  (thus the speed is the half of the measured one). As for above, from the perspective of the  data-transfer, the modem works as a 75Bd/880Hz FSK2 modem.

Fig. 6

Well, decoding separately the two FSK2 channels (935-1375, 1815-2255) we get obviously two time-shifted similar streams (figure 7)

Fig. 7 - the two TE-204 demodulated FSK2 streams

Demodulating it as if it were an F7B signal we get "01" sequences in channel CH1 and  (expected) duplicated data in channel CH2 (figure 8)

Fig. 8

https://yadi.sk/d/f0U80pRg3F58iA  (F7B signals)

[1] https://i56578-swl.blogspot.com/.../redefining-t-207-checksums.html
[2] https://www.gnu.org/software/octave/

MFSK-4with mixed offsets mode (likely Ukr nets)

Some days ago my friend Mike (mco) sent me an interesting record about a seeming MFSK-4 signal (fig. 1) originating north of Rivne, Ukraine; such (duplex) transmissions are frequently heard on 13873.55, 15833.55, 15863.55, 16354.55, 17412.55, 17442.55 & 17469.55 KHz (Rivne TX).

Fig. 1

This sample I think it's a  combined mode in which the used offsets and speeds are: -1200 -400 +400 +1200 400Bd, -750 -250 +250 +750 250Bd, and -600 -200 +200 +600 200Bd; anyway, it's to be noticed a change of the center frequency between the first and the second mode (Figs 2,3).

Fig. 2

Fig. 3

"They use a wide range of frequencies and I've not noted all of them. This list seems ok but it certainly include Main stn freqs and also side B stations ones and some are missing. They are working full duplex with abroad stations according to multiple TDoAs. So far I've seen them using MFSK-4 with 50/100 80/160 100/200 125/250 160/320 200/400 250/500 400/800 500/1000 settings" my friend Linkz say.

Fig. 4 - TDoA Tx site (thanks to Mike)

https://yadi.sk/d/WQrHjOlxMkH48A
[1] http://resources.rohde-schwarz-usa.com/c/manual-of-transmissi-2

some recent (unid) catches in the 8 MHz band

STANAG-4285 async operations

Transmission heard on 8167.0 KHz/usb consisting of S4285 600bps/L transfer. After demodulation, the bitstream reveals ITA2 5N1.5 async operation with encrypted data and looks like the format seen here which is possibly used by Turkish-Mil.

https://yadi.sk/d/PPd1Rl9FZHtTbQ

MIL 188-110A bursts

Since several days I've been listening to 188-110A Serial Tone bursts on 8058.0 KHz/usb, 600bps short interleaving is the used mode. Burst last 1200ms and have a spacing of 500ms.  The long (hours) sessions continuously send the same 240-bit pattern. 

Fig. 1 - 240 bit pattern (reshaped to bytes)

TDoA runs point to Spain. 

Fig. 2

 https://yadi.sk/d/tYRSkswo6gwYiA

MFSK-4 100Bd/400

short transmission heard on 8180.0 KHz/usb, unfortunatelly I went very late on it and I have not had the chance to listen to it anymore. My friend KarapuZ suggests Russian source.

https://yadi.sk/d/JnZGPnoAsoXarQ

two interesting MFSK catches

1) MFSK-66 (33+33) 40Bd/40 (presumed)

Transmission heard on 9122.0 KHz/usb on 20 November, 0832z. It looks like they use 2-tones x symbol and a manipulation speed of 40 Bd (Fig. 1). Dividing the spectrum into two equal parts gives a grid of 33 tones, 40Hz spaced, with the expected symbol rate of 40Bd (Fig. 2): this is why I defined the signal as MFSK 33+33 40Bd/40Hz, but I could be wrong. Likely Russian users.

https://yadi.sk/d/rZYN067am2suCQ 

Fig. 1

Fig. 2

Fig. 3

2) 19KHz wide MFSK-17 33.3Bd/1200Hz

Transmission heard on 13386.0 KHz/usb (centered on ~ 13397 KHz) on 20 November, 1156z. Never meet a such wide band MFSK waveform.

https://yadi.sk/d/tqw4R9phxzJCCQ

Fig. 4

Fig. 5