unid PSK8 2400Bd burst waveform

Unid PSK8 2400 Baud burst waveform spotted on 10557.0 KHz (CF) by using OZ1AEF KiwiSDR (Skanderborg, Denmark). ACF value is 293.4 ms, which makes a period length of 704 tribit symbols or 2112-bit length frames (figs 1,2). The resulting bitstream after demodulation does not have a well defined structure formed by known/unknown data blocks,  it could be a Walsh modulation but it is only a guess.

Fig. 1

Fig. 2

As a test I tried to analyze the bursts using a STANAG-4538 demodulator and surprisingly the decoder reacts but only to the first 700ms of each burst by identifying a 256 symbols initial segment (!) and a subsequent block of data (960 symbols only), even if not identifying any of the xDL traffic waveforms that it knows (BW1-BW7) and thus reporting the phase positions only:

6231017000770100000702070000001700000107010107000701070000000000
0000001001000070000010000000000107000000000000000010000000000000
0000000000000000000000000000000000000000000000000000000000070000
2357710003120162744325456425622470623725424155361132757073500120
 
0014030174251457266112142317764402235571057447051475133602436767
2703175471117746713161441063517300743117565244064305766450657067
3543135630554510775272301561043433561260120020160261523037545324
2056267511155732621360060321622731415212020343736426773247451624
1334736342650470251144547564221770112446074633674036402257132565
6167206436000663560205033075240623327644201057731763021170310231
2243202452744340766416127045073236601451345335341351405636207065
7530151204440026515461331365415522030410171723262531566213715260
5435401652143142551606034474235200464762472263162671465355421572
7246675441411506774573373574776501311646273035007266555622770517
4374175707126456760404241210370111043001250537550271063761077252
5455361471666153216322237212306173775100324261130557670052346734
3347363427504702511445475642217771124460746336740364022571325656
1672064360006635602050330752406233276442010577317630211703102312
2432024527443407664161270450732366014513453353423514056362070657

The period of the data bitstream is however in contrast to the value measured by the ACF (figure 3) but it could due to the short segment which is recognized and demodulated (700ms) and by now I still prefer to rely on SA.

Fig. 3

The shorter burts like those in figure 4 are instead recognized as BW0 waveform, Robust Link Setup RLSU protocol (1), although the latter has a slightly shorter duration, and then decoded:

11010000100010001010111011
11010100010010010000001110
11010000100010001010111011

Fig. 4

Regarding the initial segment of 256 symbols, mentioned above, it's important noting that the bursts of the BW0, BW1, BW4, and BW5 waveforms begin with 256 “throwaway” symbols that are sent while the transmitter level control and receiver AGC are settling (the so-called TLC/AGC guard sequence); this is probably the reason of the STANAG-4538 false-positives detections.

Despite this, I think that the similarity with the burst waveforms of STANAG-4538 should be taken into consideration in view for further insights and analysis of these signals.

https://disk.yandex.com/d/s8BveGOqLx_s2g
https://disk.yandex.com/d/X4z5LZJK59_QxA 

(1) robust burst waveform 0 (BW0) is used by the robust link setup (RLSU) protocol and carries a payload of 26 protocol bits

a note about CIS Navy FSK (T-600)

My friend Nicola, whom I thank for the collaboration, reported to me an inaccuracy in the post of April 16, 2021 "CIS Navy FSK 50Bd/250 (T-600)", more precisely regarding the 44-bit sequence which is sent after the reversals:

11100001010010111110000101001101011010101101  

The 44-bit sync sequence is in fact a 42-bit sequence (six 7-bit characters). The reason is that the transition from idle to traffic condition is signalled by a violation of the bit reversal structure so that a '1' is inserted instead of a '0' when the systems transits to traffic condition, ie the end is '...0101011' and not '01010' as given in my post (figure 1). That initial sync sequence of six 7-bit characters is also a violation of the 4:3 ratio. This ensures that sync is reliable. To use violation as signalling is quite common in many protocols, e.g. Ethernet LAN protocols.

Fig. 1

Generally speaking, one should notice that 'primitive' block protocols as the ones used by the Russian Navy will have this general structure:
- Call and acknowledgement provided by morse coded session
- Bit sync provided by bit reversals with or without a final violation
- Character sync provided by an initial Unique Word (or sync sequence, the designation is a matter of semantics)
- Possibly, but not necessarily a header (address, length, type of message etc.)
- Data, including possible initialization vectors or session keys
- End-of-Message
- End-of-Transmission, which could be provided by yet another morse session

again about crypto devices with (5x) 128-bit Initialization Vectors

Recently in the list of the UDXF group a log of the UTE listener howardhawks (HH) appeared about transmissions of the Royal Navy of Oman (RNO) in 110A 1200bps/S mode on 8403.0 KHz/USB: nothing special except the use of encryption with 128-bit length initialization vectors, as indicated by KarapuZ in his comments to the message. This fact intrigued me and, since I have already met crypto systems that use initialization vectors of equal length and with the same format (ie five times repeated) [1], I decided to monitor those transmissions and collect some recordings to compare with other similar ones stored in my hard disks, ie:

- STANAG-4285 from Croatia (TDoA), recorded on January 2020 (*)
- 110A and STANAG-4539 attribute to the Swiss Emergency Network, recorded on October 2017 (*)

The bitstreams after demodulation of the above signals are shown all together in Figure 1:

Fig. 1 - COMSEC preambles using 5x128-bit length IVs

As you can see, the three COMSEC preambles - highlighted in figure 1 - have the same pattern, regardless of polarity:

• 000110000100000111000101111001011011101101001001011111010101 60-bit length frame sync
• 128-bit (16 bytes) sized Initialization Vector (5x)
• 0101010101010101010101010101010101010101010101010101010101010101 64-bit length phasing/idling sequence

I don't know if it's an external COMSEC devices (ie standalone equipment such as KG-84) or communications equipment with built-in COMSEC, the fact is that the preambles are the same and this leads me to think that the above  transmissions - coming from three different countries/organizations - are secured by the same COMSEC device. In this respect, it would be important to know which providers of communication equipments the above users have in common.

By the way, signals gathering has been possible thanks to the KiwiSDRs operated by Kuwait Amateur Radio Society [2]. Transmissions on 8403.0 KHz, at least those listened to, mainly consist of voice calls/radio-checks and short exchanges of  messages using as mentioned 188-110A in 1200bps/S mode. Unlike other HF networks, neither 188-141A or some other ALE system is used for link setup so it is assumed that the nodes are simultaneously listening on the same frequency and responding when called by the net control station (callsign F4). Stations mentioned in traffic on this net so far include H5R, O5H, R7N, W6J, W3M, O3P and G9I, as well as vessels RNOV Al Mubshir S11, RNOV Al Seeb Z20, Shabab Oman II (thanks to the logging by howardhawks).

http://9k2ra-2k.proxy.kiwisdr.com:8073

(*) 188-110A and STANAG-4285 modems show a slightly modified waveform due to the addition of 4 unmodulated initial tones

[1] https://i56578-swl.blogspot.com/p/initialization-vectors.html
[2] http://9k2ra-2k.proxy.kiwisdr.com:8073

CIS MPSK-16, a POSTNET 2-of-5 variant?

As for the 6-bit encoding used in CIS MPSK-16 streams, see this post for background, my friend Nicholas suggested that most likely it's a variant of the 2-out-of-5 code [1], a constant-weight code that provides ten possible combinations of two bits and is used for representing the decimal digits using five bits. A such coding works as follows: each bit position is assigned a numerical weight, i.e. a value, e.g. seen from the left '01236', so if bit 4 (the leftmost bit) is a '1' and bit 2 is also a '1' then the combination '10100' would yield 0+2 = 2.

The codeword format is XXXXXS, where X = '0' or '1' and S is the stop bit, always '1', so in order to decode it you will have to invert the polarity of the bitstream 1 to obtain a 1:0 ratio of 2:3, indeed, I found a ratio 1:0 = 3:2 in reverse polarity.

Fig. 1

Using the table shown in the cited post, after  invert the polarity and remove the stop bits, I tried to apply the  POSTNET 74210 code [2] to the source message (assuming 11111/00000 is the codeword used for the separator character):

Fig. 2 - 2-out-of-5 code

 

00111 = A     11000 = 0 (---)
01011 = B     10100 = 9 (7+2)
01101 = C     10010 = 8 (7+1)
01110 = D     10001 = 7 (7+0)
10011 = E     01100 = 6 (4+2)
10101 = F     01010 = 5 (4+1)
10110 = G     01001 = 4 (4+0)
11001 = H     00110 = 3 (2+1)
11010 = I     00101 = 2 (2+0)
11100 = L     00011 = 1 (1+0)

 

As you see, applying the POSTNET 74210 coding to the source message, from the fourth group of the first line (and form the first group of the last line) yields the 5-digit group 99932  where 32 is just the total number of the groups within the message:

79128 79128 79128 99932
73814 04737 77008 73818
73717 65621 93714 65728
71837 65621 72185 46677
73815 72716 63472 21056
98742 10365 72716 62714
75321 63451 45660 87242
65721 72716 16078 75025
45666 12343 23445 00352
99932 79128 79128 79128

However, it remains to be seen whether '999' is actually '000' or "---" (as said, the coding could be a variant of 74210) and the meaning of the other 3 groups (79128) of the first and last line: probably something related to the message itself, perhaps the number of the message?

[1] https://encyclopedia.thefreedictionary.com/two-out-of-five+code
[2] https://en.wikipedia.org/wiki/POSTNET

THALES XL modem, channels time lag

 

Thales HF XL SALAMANDRE (1) test transmissions spotted by my friend Geoff (who kindly sent me his recordings) on the upper limit of the 6 MHz band. In these tests the modems are able to use 16 contiguous 3 kHz channels with 2 KHz spacing and occupies a bandwidth of about 80 KHz. As a rule, two stations are used. 

Each transmitted burst consists of an initial XL synchronization preamble (2), followed by 9 frames of alternating data and known symbols. Each data frame consists of a data block consisting of 256 data symbols, followed by a mini-probe consisting of 31 symbols of known data, as per STANAG-4539 (188-110C Ap.C).  All the sixteen channels use PSK8 modulation at the symbol rate of 2400 Bd, user data rate is measured as 3200 bps with Very Short interleaver. Figure 1 shows the analysis of the upper channel and the Thales 124-symbol length extended preamble.

 

Fig. 1

 

A necessary foreword to understand how XL modem works. From what is possible to know from public documents available on the web, the XL multi narrow band (MNB) waveform is implemented by a multithread software running in a Linux PC (figure 2): "[...]The input stream is coded, interleaved and sent to different individual modulators having different data rates, each attached to a single channel. The modems outputs are combined in a frequency division multiplex and then the composite signal modulates the HF radio" (3).

 

Fig. 2 - multi-narrow band “XL” modem approach (Thales - HFIA meeting, San Diego Jan. 31th, 2013)

I realized that, modifying the FFT values, it turns out that the 16 channels do not come out at the same time but rather sequentially; more precisely, by filtering the intermediate channels, it is possible to measure a time lag of 3200 μs between the first and the 16th channel (figure 3). Likely, the parallel to serial buffer at the receive modem shall cancel that delay.

 

Fig. 3

 

Assuming that the XL modem  approach of figure 2 is still used today, I wonder if that time lag - unless it's a something like a required feature - is due to the context switching between the threads, ie between the software-defined  modems. I think that the initial de-multiplexing is irrelevant, since it will start to feed the n modems after the sync preambles have been formed, ie the symbols that are transmitted first are those of the n TLC/AGC sequences.  

Since the process spawns as many threads as the channels to be used,  the time delay is expected to decrease as the number of channels decreases: and indeed that's what happens in case of use of 12 and 9 channels (figure 4).

Fig. 4

I want to say that it's just a my guess and it relies either on the accuracy of SA measurements and the modem approach of figure 2: obviously more samples are needed to support my guess; unfortunately, both for the very nature of these transmissions (trials) and for the difficulty in having broadband recordings, it is a bit difficult to recover/find similar files to be analyzed. It would be great if someone from Thales would came across this post and would shed a light on this behavior.

 

As a final note, since 16 is the maximum number of channels the XL modem can allocate (figure 5), the one shown above is definitely the best performance possible in terms of used bandwidth: that is, 16 contiguous channels in only 80 KHz; but - at the same time - it is also the worst case when considering the total time delay between the limit channels. 

Fig. 5

https://disk.yandex.com/d/WyHqZXAy3yzu1w 
https://disk.yandex.com/d/RsIhraUOmlHaWA

(1)  Système Avancé pour Liaisons HF Adaptatives Multi-bANDes Rapides et Efficientes (adaptable, bandwidth-efficient, multi-band high-speed and high-frequency communication system)

(2) The synchronization preamble consists of three parts:
- a Transmitter Level Control / Automatic Gain Control (TLC/AGC) sequence, including an optional sequence to provide offset between channels;
- the main synchronization preamble, compatible with STANAG 4539 preamble;
- an extended synchronization preamble, specific to HF XL.
This last part, not included when operating according to 4539 or ISB modes, is combined with the main preamble to carry all information necessary to the HF XL waveform, in particular information on modulation choice for each channel. 

(3) HF XL: ADAPTIVE WIDEBAND HF TRANSMISSIONS - NordicHF 2013

CIS MPSK-16, PSK2 500Bd

Interesting CIS transmission spotted by my friend KarapuZ, whom I thank for sharing. The signal is a wideband MPSK-16 waveform, with 2500 Hz channel spacing, and use a PSK2 modulation at the symbol rate of 500 Bd in each channel. The 16 channels transport the same data.

Fig. 1 - PSK parameters of a single channel

A better view of the decoded bitstream of a single channel is obtained by using a 36-bit length period (figure 2):

Fig. 2 - 36-bit period

The messages consist of 5-FGs groups and a separator character (111110). In my opinion each group is coded into a 5-bit Figures, (after the removal of the common trailing "0") and has a constant ratio "1s"/"0s" = 3/2, except the separator which consists of all ones bit (11111). Nothing changes if the reverse polarity is taken into consideration. By using the association:

11111 = space/separator
00111 = A
01011 = B
01101 = C
01110 = D
10011 = E
10101 = F
10110 = G
11001 = H
11010 = I
11100 = L

we get :

DBLIC DBLIC DBLIC BBBHI
DHCLG AGDHD DDAAC DHCLC
DHDLD EFEIL BHDLG EFDIC
DLCHD EFEIL DILCF GEEDD
DHCLF DIDLE EHGDI ILAFE
BCDGI LAHEF DIDLE EIDLG
DFHIL EHGFL GFEEA CDIGI
EFDIL DIDLE LEADC DFAIF
GFEEE LIHGH IHGGF AAHFI
BBBHI DBLIC DBLIC DBLIC

Notice the particular "format" that is used for the initial and last four groups of the message: some conjectures can be made about its purpose such as for example the signaling of SOM/EOM or the date/number of the message... anyway only hypotesis. The messages are probably off-line encrypted and maybe using the so-called OTP (one-time pad) technique: anyway, one could test the possible associations as for example the following A=0 - L=9 (or the reverse order) and see what it turns out:.

31982 31982 31982 11178
37296 06373 33002 37292
37393 45489 17396 45382
39273 45489 38925 64433
37295 38394 47638 89054
12368 90745 38394 48396
35789 47659 65440 23868
45389 38394 94032 35085
65444 98767 87665 00758
11178 31982 31982 31982

My friend Cryptomaster came to the same conclusions in his reply in radioscanner taking a different approach: ie 6-bit words consisting of 5-bit code + 1 parity bit. Probably the MPSK waveform is an evolution of the CIS PSK-2 serial tone waveform (same period, same bitstream pattern) [1]: given that the 16 channels transport the same data, they provide a better immunity to noise and interferences.

https://disk.yandex.com/d/uBpZwnz0dv47Rw

[1] http://signals.radioscanner.ru/base/signal172/ 

analyzing the HF network traffic on 5120 KHz (OS BiH)

 

First of all I want to thank IZ6BYY Alain from Martinsicuro (Italy) who allowed me to use his KiwiSDR receiver without time limits: I very appreciated. 
I monitored this Bosnian HF network (I logged them first time on 2016) for more than two weeks: transmissions occur almost exclusively in the morning, not on weekends, and start around at 0730 UTC, likely following a certain schedule. The traffic consists of standards-based email exchange:

– 141A 2G ALE for link establishment
– Up to 2400 bps modem (Serial 110A, 39-tone 110A App.B)
– STANAG 5066 & CFTP client used for reliable over-the-air data delivery
– Standard SMTP email protocols into the wired network

All stations are members of the same ALE network and use the 3-way handshake for link management. In a few cases, a link closure similar to that used in STANAG-4538 is adopted, i.e. the link is terminated by the called station and not by the calling one.
The analysis of the 5066 PDUs after the removal of 110A overhead, figure 1, show the use of HBFTP compressed files (Harris Basic File Transfer Protocol) which, as for 5066 Annex F, is used along with CFTP for transfers from one SMTP server to another. 

Fig. 1 - STANAG-5066 PDUs showing the use of CFTP and HBFTP protocols

After HBFTPn.gz files have been extracted and unzipped, the email headers finally emerge and allow a bit of "intelligence" (figure 2):

Fig. 2 - email headers

 

wmtuser@OMEGA.ok, wmtuser@CIKLON.ok
The email addresses reveal that the messaging system software, and most likely the connected radios, are provided by Harris Corporation: indeed "wmtuser" is the email address default name that is prompted by Harris RF-67x0W Wireless Gateway. The ".ok" e-mail domain name stands for Operativna Komanda or Operational Command,
 

received: from osbihbutmir, received from kstbrvspvo
The server name "osbihbutmir" must be split as OS BiH Butmir where OS BiH (Oružane Snage Bosne i Hercegovine) stands for Armed Forces of Bosnia and Herzegovina, and Butmir is a neighborhood in Ilidža municipality site of the AF Operational Command HQ. Similarly, the name "kstbrvspvo" could be formed by the acronyms KSTBR and VSPVO, where KSTBR may stand for Communications Systems and Technologies Brigade (Komunikacioni Systems i Tehnologije BRigada).
I also noted the server name "jovana" which may have been chosen to honour the memory of Jovana Divjak, a Bosnian army general who died on April 8th, 2021: but that's just a my guess.

X-Mailer
The underlaying PCs run a Microsoft OS, likely Windows 2000 Professional or Windows XP Professional; Outlook 11 is used to draft and send the emails by OMEGA while other nodes seem to use Outlook Express.

X-HSMTP
(likely Harris SMTP, Simple Mail Transfer Protocol) The routing rows show that the recipient node is at 1-hop distance (DP and NP values).

By processing the bitstreams is then possible to derive the the 5066 addresses of the nodes and associate them to the related stations names and 141A ALE addresses  (in brackets):

 

000.000.000.001 OMEGA (OMA)
000.000.000.006 ASTRA (ASA)
000.000.000.007 CIKLON (CIN)
000.000.000.011 GRANIT (GRT)
000.000.000.016 LI(?)A (LIA)
000.000.000.017 LI(?)1 (LI1)
000.000.000.029 ORKAN (ORN)

 

It must be noted that:

1) the 5066 address range 0.0.0.0 — 0.255.255.255 does not have a Regional Assignee, rather the actual block allocation for Bosnia-Herzegovina is 6.6.y.z ( STANAG-5066 Annex N);

2) during the monitoring period I have not heard any other station or ALE address other than those listed. 

 

We also might compare the current station names with the old ones in use in year 2016, assuming that the 5066 addresses of the stations have not changed; notice that at that time the 141A ALE addresses were assigned  by using some popular automotive brands (HFMREZA is the Bosnian translation for HF Nerwork):

000.000.000.001 GAMAHFMREZA (GAMA)
000.000.000.003 FIATHFMREZA (FIAT)
000.000.000.005 FORDHFMREZA (FORD)
000.000.000.007 OPELHFMREZA (OPEL)        
000.000.000.009 SKODAHFMREZA (SKODA)   
000.000.000.011 VOLVOHFMREZA (VOLVO)        

Searching in the UDXF logs, this network appears for the first time in 2014: even in that case the ALE addresses were formed by the union of the first two and the last letter of the station names (TAO = TAngO), the latters consisting of the letters of the Greek alphabet: ALA (=ALFA), BRO (=BRAVO), DEA (=DELTA), GOF (=GOLF), EKO (=ECHO), OMA (=OMEGA), OSR (=OSCAR),TAO (=TANGO), ZUU (=ZULU).

The particular 5066 address (.001), the site (the AF Operational Command HQ), the traffic (OMEGA almost always initiates the ALE sessions) and the software too (Outlook 11 rather than Outlook express), led to think of OMEGA (OMA) as the net-control station as it was for the station GAMA. In addition to the change of station names and addresses, the most relevant change compared to 2016 is the paradigm used for emails: PEM - Privacy Enhanced Mail is now used for secure that traffic (figure 3).

Fig. 3

 

In some cases the contents of the emails are in clear-text, as for example the list of telegrams received/sent by the DK brigade (DK brTP) along with the greetings (*** Greetings from the team DK brTP OS BiH **** ) and the name of the operator of the "Workstation DK 6.pbr"; due to privacy, I have masked his surname:

 

Fig. 4

As said above, in some links the messages are also exchanged using the 39-Tone (110A App.B/FED-1052B) as HF waveform: this evidence proves the use of (at least) two radio networks where all or a subset of the nodes are members of both nets; at this regard, it's to be noted that Harris RF-6750 WG does not allow the use of multiple waveforms/protocols in a same radio-network. Likely, the HF email domain ".OK" coincides with only one radio network.
(yep I know, it's not good and it's definitely not discreet! anyway - to better illustrate my hypothesis - I had recourse to a old copy of the 6750 WG to simulate the software setup that I imagine and which in my opinion comes closest to the configuration which they use)

Fig. 5 - two distinct radio-networks with different waveforms/protocols

Another interesting point is that some bitstreams carried by the 39-tone and 188-110 modems have initial 41-bit length similar patterns (figure 6) that - in my opinion - reveal the use of encryption, therefore in those cases 5066 PDUs are not readable. I tried some analysis of the patterns and maybe they could be "partial" strings of the sequence generated by the polynomial x^42+x^41+x+1. 

Fig. 6 - 41-bit patterns in Serial 110A and 39-tone bitstreams

As far as the encryption device is concerned, my guess is that some links use Datotek encryption which is used in Harris RF-5022 and RF-5800 based radio stations. In that regard, I did some research in the web and found that as early as 2009 they were just using Harris RF-5022 transceivers during their participation as a PfP country in the "NATO Combined Endeavor" 2009 exercise (1). If my guess is correct, the 41-bit sequences could be a kind of "distinctive sign" of the Datotek encryption.

Fig. 7 - Datotek encryption may be used in RF-5022 based radio stations

https://disk.yandex.com/d/B0wHSW1Tfhz2Eg

(1) Bosnia and Herzegovina joined the Partnership for Peace (PfP) programme in 2006.At the beginning of 2021, Bosnia and Herzegovina established the Commission for Cooperation with NATO in order to facilitate the development of their Reform Programme for 2021-2022 and other matters on their path to accession.  
http://mod.gov.ba/Zdruzeni_napor/?id=21449 

 

a strange (if not wrong) use of STANAG-5066

29 Septembere 2021, update

I was WRONG!
Starting from RF-6710W Wireless Messaging Terminal (WMT) v5.0, Harris added new adaptive data rate support for existing HF modem waveforms so that customers can leverage their hardware investments with their new radio purchases. These waveforms include the widely used Parallel tone (39-tone) and STANAG 4285 Coded waveforms. Looking at the 39-tone demodulated stream, it could be that a crypto device is in the path, ie between a pc running STANAG-5066  and the modem

thus the STANAG-5066 PDUs are not in clear text and then no more visible.

24 Septembere 2021
These days I am monitoring some signals on 5120 KHz (from Serbian-Mil) that will be the subject of a next post, and I noticed a strangeness in the use of STANAG-5066 in relation to the "way" the data are sent. The waveforms are shown in the waterfall of figure 1.

Fig. 1 - the waveforms into play

As known from the "operation" of STANAG-5066, before the Data Transfer Sublayer (DTS) forwards the data, the Channel Access Sublayer (CAS) provides the functions necessary to access the physical channel (figure 2), ie the radio spectrum, assuming that the selection of the frequency (physical link setup) is handled by an external process such as ALE, in this case 188-141A. Then, a soft-link session (1) will be started immediately when there is data available for transmission to a remote STANAG-5066 node (2).

Fig. 2 - Physical Link Request PDUs related to the S5066 of figure 1

The strangeness is that, in that sample, data are not sent by STANAG-5066 DTS & 188-110 but rather using M-39 (188-110 App.B), ie outside STANAG-5066 (remember that STANAG-5066 is a data-link protocol, NOT a waveform).

 (1) To explain the difference between a physical channel and a session: when a client wishes to send an email to a remote client a physical link is established by the CAS; then a soft-link session is set up over this physical link. The soft-link session is between the local and remote client while the physical link is between the local and remote node. 

 
(2) A correct sequence of operations is shown in figures 3,4 (physical link request/accept, data forward, ACKs, physical link break): all managed by the STANAG-5066 sublayers that is carried by the same underlaying HF wavefrom. Notice the switch of the node address.

 

Fig. 3

 

Fig. 4

Frames captured thanks my STANAG-5066 off-line dissector.

19.5Bd/100 FSK: Rus R-397 “IRTYSH” (“ИРТЫШ”)

About one years ago (may 2020) I came across a short 19.5Bd/100 FSK [1] which, at that time, I chalked up to a some Russian-Mil network. Well, an anonymous reader of the blog, whom I thank, left a link about it [2], without further comments or suggestions: the link refers to an interesting topic posted on the airbase.ru forum about the HF R-397LK receiver - "Lapis" (Р- 397ЛК "Ляпис") used by the Navy Special Forces and - likely - not only by the Navy or by Russian forces. 
The translation from Russian is shown below. 

The R-397 LK radio receiver is intended for tuningless and search-free communication with discrete frequency setting in the short-wave range and provides reception and registration of call commands with visual and sound indication in the memory device, as well as auditory reception of messages by Morse code in the RT and AT modes. The radio receiver provides the following modes:
- Auditory reception of telegraph signals with amplitude modulation (AT)
- Auditory reception of telegraph signals with frequency modulation (FM)
- Continuous reception of commands by signals of RF at a rate of 19.53 baud (CALL CONTINUOUS.)
- Reception of commands by signals of RF at a rate of 19.53 baud with periodic switching on and off of the radio receiver power (CALL CYCLE) 

Fig. 1 - 19.5Bd/100 FSK (R-397 OK)

The “IRTYSH” (“ИРТЫШ”) equipment is designed to provide h24, noise-resistant short-wave special radio communication for the purpose of transmitting short messages with up to 50 digital groups and calls and providing auditory telegraph communication.

RADIO LINE COMPOSITION [3]
R-397 OK - special radio transmitter "OKOLYSH"
R-397 LK - special radio receiver "LYAPIS"
R-397 KC - a set of center equipment "KEDON" as part of the R-160P radio receiver, R-397 OTs demodulator and BPA
R-397 OTs - special demodulator "DEER" included in the set of center equipment "KEDON"
Р-397 LC - the generator of calling commands "LUMEN"
BPA - start-stop telegraph apparatus operating with the MTK-2 code

Conventionally, the radio line "IRTYSH" can be divided into two functionally independent directions:
radio link "OKOLYSH" - "KEDON"
radio link "LYUMEN" - "LYAPIS"
Radio direction "OKOLYSH" - "KEDON" works only for the transmission of information with a special broadband low-energy signal from the correspondent to the Center. The radio direction "LYUMEN" - "LYAPIS" provides an urgent call for communication with a source of intelligence or special intelligence at any time and the transfer of information by auditory telegraph from the Center. Thus, it seems I heard just a short transmission in the Lyumen-Lyapis mode, maybe the R-397 OK2 was the used device.

[1] https://yadi.sk/d/z-4ImVGLytR0rQ
[2] http://forums.airbase.ru/2008/10/t62176_10--spetsnaz-vmf.html
[3] https://sdamzavas.net/4-35296.html 
https://studfile.net/preview/7104174/page:25 
http://www.vrazvedka.ru/main/learning/last-confl/afgan-03_07.shtml

unid 1200Bd/850 (G)FSK bursts recorded in Japan

This is an update of the January 9, 2019 post (see below)

Nicely, on the same day two friends of mine linkz (from France) and Eddy (from South Australia) signaled me about the presence of these 1200Bd FSK bursts on 19102.0 KHz (cf). Linkz also DF'ed the signal with good success, identifying the probable Tx site location in the city area of Busan, South Korea "still transmitting the same data over & over":

https://twitter.com/hf_linkz/status/1439165124141592578

So, at present, these (still unid) transmissions have been heard on (KHz): 4584,4626,4756,7531, and 19102 (all cf).

9 January 2019

 

This 1200Bd/850 FSK signal was recorded at different periods using some the KiwiSDRs located in Japan (http://103.2.34.7:8073 http://222.7.151.84:8073 http://kiwisdr-jp7fso.ddns.net:8073), it was observed, at least, in three frequencies: 4765, 4626 and 4584 KHz. During night-time good results are also obtained with the KiwiSDR at Irkutsk (Russia), so the origin of the signal seems to be Japan or surroundings. 

My Spanish friends ANgazu and Rapidbit (from radiofrecuencias group) did a brief analysis measuring the speed (1200Bd) and the shift between tones (825-890 KHz) and suggesting the GFSK mode. On my behalf, I veried their measurements and verified that the bursts are 26 secs spaced and carry the same (encrypted?) text sent in async 8N1 mode (Fig. 21), although there are some difference among old recordings and new ones. The stream obtained after removal the start/stop bits does not offer useful information (encryption? not-standard 8-bit alphabet?), same results after descrambled the stream using the polynomial x^3+x^2+x+1. 

Fig.1

 

https://yadi.sk/d/fUFrXKOTgnEGaw