unid FSK/MFSK SELCAL

6907.0 KHz (cf): unid SELCAL waveform spotted on 6907.0 KHz (cf),. The waveform consists of 40Bd/240 FSK idling part  followed by MFSK-36 40Bd/40 (likely the Id of called station).

Fig. 1

 

Fig. 2

https://disk.yandex.com/d/XlHhceBC9fLlvQ

3G-HF "BW5 + 110A" combined waveform ...or just coincidence?

 

From 19 to 23 June I monitored interesting transmissions on 5091.5 KHz/USB that seem to use a kind of "combined" waveform which consists of FLSU BW5 waveform followed by 188-110A 300bps waveform. For what concerns the timing, the sendings occur each minute, they last about 31 seconds and are arranged in a way that resembles the circuit mode service of STANAG-4538. Starting from thursday 24, these broadcasts have not been repeated (at least until today).

Fig. 1 - ACFs 

 

As said, it seems that the data are sent using a transmission composed of two parts: a sequence of FLSU PDUs, which are transmitted using the BW5 burst waveform, and the payload data, transmitted using the 188-110A serial waveform. These two parts are transmitted contiguously with no dead time separating them (Figure 2).

Fig. 2 - framing

That kind of waveform (BW5 + 110A) is indeed very odd, unless I have been mistaken and it is an overlapping of two distinct transmissions... but it would still odd that the overlapping be so perfect and continuous for more than two days.  Anyway, if it's a real "combined" waveform then it's definitely a synthesized waveform (SDR).
For clarity - however - it must be said that:
a) BW5 waveform (and thus the FLSU protocol) has been detected by the examination of the signal's ACF and its payload;
b) the length (duration) of the initial BW5 sequence finds a clarification in this post;
c) BW5 waveform could also be used to transport other types of PDUs and not only the PDUs of the FSLU protocol.

data link protocol
The used data link protocol is also interesting: its initial structure consists of 32-bit (4 bytes) patterns which are common to all the payloads (Fig. 3):

192-bit idle sequences of reversals (alternating sequences of '0's and '1's)
10001011010001111000010010000111 (0xD1E221E1) sequence #1
01111011101101001011100010000111 (0xDE2D1DE1) sequence #2
11 bytes length data block
10001011010001111000010010000111
10001011010001111000010010000111
10001011010001111000010010000111 (5 x sequence #1)
10001011010001111000010010000111
10001011010001111000010010000111
(data block follows)

Fig. 3 - data link protocol after 188-110A removal

The two 4-byte sequences are not originated by polynomials and are likely used as sync patterns, although the five repetitions of the sequence #1 lead to think to an Initialization Vector; in my opinion, a such method could be risky in terms of security since the same IV sequence is used for all the forwarded messages (unless they are test transmissions and/or pseudo random traffic). Data blocks seem anyway encrypted.

Fig. 4 - details of the 32-bit structure of the data link protocol

The exact same structure and 32-bit sequences have already been detected in some recordings of 2018 (!): also in this case they were "plain" 188-110A transmissions forwarded in circuit mode service [4].

TDoA direction finding
The transmissions are fairly receivable only in the northern regions of Europe, more precisely I used KiwiSDRs in Norway and Denmark [1][2]: that's a sign that a low power transmitter is used or that they serve a local area. Just about the site of the transmitter,  all my direction findings point to a well-restricted area north from Oslo, Norway (Figure 5).

Fig. 5 - TDoA results

Norway has released an interactive map of all the military locations where it is forbidden to operate a drone [3]. All the markers indicate an area where it is illegal to take aerial photographs or video using a camera or any other type of sensors: in figure 6 I have cut out an area that more or less follows the area identified by the DF.

Fig. 6

remarks
Starting from June 22 the transmissions show a paradigm change, a bit more in line with the circuit service model of STANAG-4538: the structure of the used data-link protocol, anyway, remains unchanged. 

These transmissions raise several questions, the first being whether or not it is an experimental combined waveform (and therefore if they are test transmissions). It would also be interesting to identify the transmitter site with greater precision and - if anything - which data protocol is used.

https://disk.yandex.com/d/2I0bzM2nDShWGA
https://disk.yandex.com/d/kD-9y_TFkZoFqQ
https://disk.yandex.com/d/Bt2pIPxE-o6Udw

[1] LB3J SDR in Smøla, Norway http://77.223.174.203:8073/
[2] KiwiSDR by OZ1BFM in Vejby, DENMARK http://oz1bfm.proxy.kiwisdr.com:8073
[3] http://googlemapsmania.blogspot.com/2018/09/norways-secret-military-sites.html
[4]  https://i56578-swl.blogspot.com/2018/03/unid-32-bit-secondary-protocol.html

a STANAG-4481F temporary channel activation?

Heard 75Bd/850 FSK transmissions (broadcasts?) on 6372.0 KHz CF until sunday 13th June, no transmission in the following days (at least until today). Transmissions were KW-46 secured and sourced most likely from Barford St.John USAF transmitter. Think of a temporary activation on the occasion of the G7 summit just in UK... is that too imaginative?

Fig. 1

Fig. 2

https://disk.yandex.com/d/e1BfYmNeUhHa1A

Echotel 1810 and STANAG-4285, ie don't blindly trust decoders

It happened by chance to analyze a complete session of data exchange in MAHRS mode (ALE + traffic) while I had a STANAG-4285 decoder in active state on the desktop: to my surprise the decoder started printing out a bitstream though - as said - it was set for STANAG-4285 (Figure 1)

Fig. 1

Intrigued by that fact, I went to see the points that S4285 and MAHRS Echotel HF modem have in common enough to confuse the decoder, other than the obvious features such as speed (2400Bd) and modulation (PSK8).  

The first thing that stands out is the equality of the ACF values, Figure 2: 106.6 ms, or 256 symbols. Thus - in my opinion - it seems that the decoder in question (Sorcerer and therefore also K500) tries to identify a signal by analyzing its ACF: probably those kind of decoders have an internal table that allows this association.  

Fig. 2 - ACF values for STANAG-4285 and Echotel serial

The structure of the frames is anyway very different, unless the first 80-symbol preamble which is common to both the waveforms (Figure 3): S-4285 framing consists of an initial 80 symbol preamble followed by 4x32-symbols data segments and 3x16-symbol probes; Echotel framing consists of the initial 80 symbol preamble that is followed by a data block consisting of 176 data symbols. 

Fig. 3 - framing structure for STANAG-4285 and Echotel

As third common feature, both the 80-symbol preambles are modulated using BPSK: the pronounced BPSK states in the constellation plane of the Echotel 1810 signal are quite eloquent (Figure 4)

Fig. 4

STANAG-4285 is not an autobaud waveform so the decoding is based on the user settings, just for fun I played with some sub-modes even if - as obvious - the decoder can't find the expected known symbols (16-symbol probes). The best results, in terms of "confidence", were obtained by setting the bit rate to 2400 bps, obviously the corrections are equal to zero in the uncoded mode:

It must be said that this Echotel 1810 waveform is not the only S4285-like waveform, another example is the 2400Bd PSK-8 serial waveform from the THALES TRC-1752 modem (Thales Système 3000 family), although the latter is more properly defined as "variant".

Fig. 5 - THALES TRC-1752 STANAG-4285 variant

 

At the end, do not blindly trust decoders: they are not infallible and there is no magic wand; just open your wav files and analyze them.

Three new fleet broadcast channels

Three new fleet broadcast channels spotted in these days, all STANAG-4481F:  

4987.0 KHz (cf) 50Bd from NSS Davidsonville
7455,5 KHz (cf) 75Bd from NSY Niscemi
7457.0 KHz (cf) 50Bd from NAU Isabela

All the the broadcast are KW-46 secured(!), although 75Bd/850 usually run KIV-7/KG-84 devices.

These and other recent catches seem to confirm a change in some transmission frequencies, mostly of 2000 Hz or , even stranger, of 1300 Hz. "There is currently a Navy exercise in progress off the east coast, so the shift may perhaps be supporting that effort or maybe to avoid interference or harmonics on other services at the sites", my friend Mike mco say.

I have updated the page related to the BRASS STANAG-4481F page, it is even more evident that all the transmissions that use the waveform 50Bd / 850 are protected with KW-46.

https://disk.yandex.com/d/XJVGUnkI4D4etg