The low quality of my recordings does not allow its demodulation and then further investigations to check the presence of KG-84 encryption, anyway generally used in this kind of signals (FSK, both 600 and 1200 Baud speed). KarapuZ provided me a better quality recording so it was pretty easy to verify the KG-84 "flag"
17 March 2016
Turkish Mil, FSK 600Bd/400Hz & 1200Bd/800Hz KG-84C
tags:
FSK 600Bd/400,
KG-84,
Saville,
Turkish Mil
The low quality of my recordings does not allow its demodulation and then further investigations to check the presence of KG-84 encryption, anyway generally used in this kind of signals (FSK, both 600 and 1200 Baud speed). KarapuZ provided me a better quality recording so it was pretty easy to verify the KG-84 "flag"
13 March 2016
Sending files using MS188-110A and FED-STD 1052 App.B (H520) Data Link Protocol
tags:
FED-1052
FED-STD-1052 Appendix B (FS-1052B) specifies a first generation Data Link Protocol (DLP) layer with priority messaging and multiple pre-emptive resume queuing ARQ (it is basically the equivalent of MS188-110A Serial Tone as to the modems). The FS-1052B HF DLP as designed will work with other data modems and not just the FS-1052 and MS110A ST modems, as in this sample. However FS-1052 it is optimized for use with a data modem having those same data rates from 75-2400bps and also supporting auto-baud.
FS-1052B provides three modes of operation:
ARQ mode The primary mode of operation is the automatic repeat request (ARQ) mode, which provides for error-free point-to-point data transfer and employ a control frame acknowledgment scheme.
Broadcast mode A secondary mode of operation is the Broadcast (non-ARQ) mode. The Broadcast mode allows unidirectional data transfer using fixed-length frames to multiple (as well as to single) receivers. No transmissions from the receiving terminal are desired or required.
Circuit mode The other secondary mode, the Circuit mode, allows a link to be established and maintained in the absence of traffic. The ARQ variable-length frame protocol is used along with a technique to maintain the data link connection in the absence of user data.
In the samples below, signals come from the real-world, for example the above picture is related to a link between the callsigns BS008CB and CS003A: after the link setup, performed by MS188-141 2-G, they go into MS 188-110 for data transfer.
FS-1052B provides three modes of operation:
ARQ mode The primary mode of operation is the automatic repeat request (ARQ) mode, which provides for error-free point-to-point data transfer and employ a control frame acknowledgment scheme.
Broadcast mode A secondary mode of operation is the Broadcast (non-ARQ) mode. The Broadcast mode allows unidirectional data transfer using fixed-length frames to multiple (as well as to single) receivers. No transmissions from the receiving terminal are desired or required.
Circuit mode The other secondary mode, the Circuit mode, allows a link to be established and maintained in the absence of traffic. The ARQ variable-length frame protocol is used along with a technique to maintain the data link connection in the absence of user data.
In the samples below, signals come from the real-world, for example the above picture is related to a link between the callsigns BS008CB and CS003A: after the link setup, performed by MS188-141 2-G, they go into MS 188-110 for data transfer.
After
removed MS188-110A headers and other stuff (scramber, interleave and
FEC coding) the resulting bistream exhibits a clear 520 bits period that
is characteristic of FED-1052 App.B or H520 protocol (pic 2)
![]() |
| pic. 1 - over-the-air bitstream, as demodulated by SA |
In the case shown in pic.2, the transmission is performed through an exchange of protocol frames so here we face the primary ARQ mode.
![]() |
| pic.2 - FS-1052B in ARQ mode |
If the data are corrupted (strong fading, interferences, too weak signal,...) the analyzer will print out the "CRC Error" message, moreover the sessions
should be taken from the beginning to the end since any lack of bits affects the
integrity of the data.
![]() |
| pic. 3 - FS-1052B in Broadcast mode |
Each new transmission begins with a three byte (24 bits) frame synchronization pattern to identify the following traffic as DLP processed traffic. The frame synchronization sequence in hexadecimal format is "5C5C5C". The sync pattern is transmitted such that the first eight bits in order of transmission are "00111010". Note: As shown here in transmission sequence, the left-most bits are the LSBs (pic. 4). If a transmission contains more than one frame, a two-byte sync sequence shall be inserted between each pair of adjacent frames, this pattern (hexadecimal) is "5C5C".
![]() |
| pic.4 - frame synchronization pattern |
The Frame Header fields (consisting of the Sync Mismatch Bit and the Frame Type bit) and then Control Frame Header fields (pic. 5) follow the 3-byte sync pattern: their possible values and meanings are illustrated in paragraph 50.1.2 of "FS-1052: Letter of Promulgation" (see the link at the end).
In Broadcast mode (the receiver does not send acknowledgments) the transmit peer sends 520 bits (or 65 bytes) fixed-length frames structured as (pic. 6):
![]() |
| pic.5 - Frame Header and Control Frame Header fields |
a) 40-bits header
8-bits synchronization, depends on the communication line (observed patterns: "10010000", "10110000" 10001000");
8-bits descending counter indicating the frame number inside the block (pic. 7);
24-bits offset (in bytes) from the beginning of the message;
+
b) 448-bits information field;
b) 448-bits information field;
+
c) 32-bits CRC field (computed over the preeceding 448-bits data).
c) 32-bits CRC field (computed over the preeceding 448-bits data).
![]() |
| pic.6 - 40 bits header |
![]() |
| pic. 7 - the 8-bits descending counter |
The information field can be obscured using cryptographic encoders such as KG-84A, KG-84C, KY-99, KY-57, KIV-7, KY-58 and KY-68.
With this protocol, E-mail, files in MS-TNEF format, text messages, graphics extensions (TIF, GIF, JPG, BMP), Microsoft Word and Excel documents, Power Point presentations, PDF documents, HTML and other types of file can be transmitted: unfortunately, my analyzer does not have all handlers so, once removed FS-1052B protocol (pic. 8) the resulting stream/file may contain other protocols that will require further processing.
![]() |
| pic. 8 - after FS-1052B removal |
FS-1052B is limited to a 2400bps maximum data rate by design, whereas the newer STANAG-5066 (second generation Data Link Protocol) has no such limitation.
An interesting E-mail Performance comparison with 2nd and 3rd Generation Data Links protocols can be seen here (.pdf file).
About the user equipment, the popular Harris family of tactical HF radios includes models that implement a draft Proposed FS-1052B DLP (pFS-1052) they adopted and fielded years prior (!) to the published 1996 FS-1052 standard. So, more likely, the heard trasmissions just come from Harris tactical radios.
Links
An interesting E-mail Performance comparison with 2nd and 3rd Generation Data Links protocols can be seen here (.pdf file).
About the user equipment, the popular Harris family of tactical HF radios includes models that implement a draft Proposed FS-1052B DLP (pFS-1052) they adopted and fielded years prior (!) to the published 1996 FS-1052 standard. So, more likely, the heard trasmissions just come from Harris tactical radios.
Links
8 March 2016
About CIS-3000, possibly a counterpart of NATO ALE ?
The so-called CIS-3000 is a single 8-ary PSK-modulated 2000 Hz carrier (pic. 1) and it's nick name is just due to its constant 3000 symbols/sec waveform. This single-tone signal provides a teoric limit of max 9000 bit/sec and neeeds about 3300 Hz bandwidth.
![]() |
| pic.1 - main characteristics of CIS-3000 |
CIS-3000 is allegedly almost 100% of Russian origin and possibly used by Intel/Diplo agencies. It can be seen either as a continuous stream and as bursts, and very often used before MFSK-68 and OFDM-128 "Corvette" modem transmissions (pic. 2).
The burst waveform has been analyzed by radioscanner.ru friends and in this blog too; it is worth noting that in the analysis the radioscanner guys, mostly SergUA6, often use the terms "in this example only!" perhaps to draw attention to the existence of different CIS-3000 modes as, for example, the stream mode I heard and that is illustrated below in picture 3.
The first thing that strikes the eye is a sort of well-defined structure consisting of a preamble and data (say a superblock) that is repeated each ~3456 ms and indicated as "A" in pic. 3; in that same picture is also visible the repetition of the same structure "B" along the superblocks.
A more refined measurement of the length of the superblock "A" is obtained by the demodulation of the signal and analyzing the resulting bistream: the length is 31104 bits or 10368 PSK-8 symbols (exactly 3456 ms, as a confirm of the precision of SA), as shown below in pic.4 where the number of the lines just match the number of the superblocks (unless the initial sync and the final trailer).
Processing the CIS-3000 bistream returns a characteristic period of 5760 bits length, or 1920 PSK-8 symbols. Besides the period, another interesting characteristic are the sequences of repeated data: as shown in pics. 5-6, the same sequences are repeated either along "B" blocks and "A" superblocks. This means that the system transmits contiguous redundant informations (source and destination adresses?, commands?, controls?, ...), most likely to combat and reduce the effects of fading, interference, and noise.
Back to the burst mode, it's interesting to observe that this mode too has both the same 5760 bits length structure and redundancy feature (pic. 7), although the repetitions in this sample seem to be limited to 3 times and then less "aggressive". So, the 5760 bits period length and the redundancy are certain characterstics of CIS-3000, regardless the stream or the burst mode.
By the way, since the lengths of a single burst and a superblock are pretty the same (pic. 8), the stream waveform could be thinked as a sequel of burst sent side by side (preambles included), but it's only a my speculation.
The substantial redundant format adopted by the system, like MS188-141 or CODAN PSK-8 selcall, and its use before MFSK-68 and OFDM-128 modems, leads to think that the CIS-3000 could be used as a selcall or a sort of CIS counterpart of the NATO ALE.
![]() |
| pic. 2 |
The first thing that strikes the eye is a sort of well-defined structure consisting of a preamble and data (say a superblock) that is repeated each ~3456 ms and indicated as "A" in pic. 3; in that same picture is also visible the repetition of the same structure "B" along the superblocks.
![]() |
| pic.3 - super-blocks and blocks repetitions |
![]() |
| pic.4 - the same signal seen by the bitstream analyzer |
![]() |
| pic.5 |
![]() |
| pic.6 |
![]() |
| pic.7 - structure and redundancy of a CIS-3000 burst |
![]() |
| pic.8 |
7 March 2016
Chinese-64: MFSK-64, 37.5/18.7 Bd 37.5Hz
tags:
Chinese Waveforms,
MFSK waveforms
Since the weak signal I asked my friend KarapuZ to send me one of his recordings of the Chinese MFSK-64 modem: it's easy to verify that both the records show the same start sequence of symbols (pic. 1).
![]() |
| pic.1 |
The signal, copied on 16990.2 KHz (cf) around 0910 UTC, consists of 64 tones, 37.5 Hz spaced, modulated alternatively at 37.5 and 18.7 symbols/sec speed (pic. 2 for 37.5 Bd speed).
![]() |
| pic.2 |
It's worth nothing the characteristic "dual-speed" modulation, seen in both the two recordings: in some segments the speed switches from 37.5 to 18.7 Baud and conversely (pics 3,4)
![]() |
| pic. 3 |
![]() |
| pic. 4 |
![]() |
| pic. 5 |
https://yadi.sk/d/ZRGpFEoi3A9jkM
3 March 2016
QPSK 1500Bd-19200Bd (Maritime Band)
tags:
KNL,
unid Maritime-WBHF
Thanks to my friend KarapuZ, I recently had the opportunity to play with some signals heard in HF maritime segments, fixed and mobile services, mainly recordered on 8400 and 12300 KHz/USB.
The most of these signals have wide-band high-speed performances (although they do not belong to 188-110C App. D) as the following 19200Bd DQPSK whauch occupies a band of ~24KHz bandwidth (pic. 1).
![]() |
| pic. 1 |
As in almost all these signals, a 1500Bd starting block seems used to announce or precede the session. As shown in pic. 2, this block has 1500Bd BPSK modulation in the preamble and trailer segments and 1500Bd QPSK modulation in the data block; the follwing three segments have 19200Bd QPSK modulation (pic. 3).
![]() |
| pic. 2 - 1500Bd starting segment |
![]() |
| pic. 3 - 19200Bd segments |
By selecting and analyzing the second 19200Bd segment, the longer one, we can get some clues about its frame structure. Looking at pic. 4 we can see frames of alternating data and miniprobe symbols. Each data frame consists of a data block followed by a BPSK mini-probe consisting of symbols of known data. After 4 data blocks, the initial BPSK preamble (or an its symbol subset) is reinserted most likely to facilitate late acquisition of an ongoing transmission.
![]() |
| pic. 4 - frame structure |
Frame structure and times are confirmed by running both CCF and ACF functions (pic. 5): note that 120ms frame makes 2304 QPSK symbols, ie 4608 bits, at 19200 Baud speed.
In order to find the data block and known data (miniprobe) lengths we need to investigate the 120ms frame by using a bitstream analyzer as shown in pic. 6.
As expected, the period legth is 4608 bits that matches the 120ms or 2304 QPSK symbols. Since the mini-probes consist of well known data, their pattern is easily recognizable into the bitstream and we can get a pretty acurate measurement of the length: 512 bits, ie 256 QPSK symbols (pic. 7)
![]() |
| pic. 7 - known data lenght |
Unless my mistakes, each 2304 symbols frame consists of a data block consisting of 2048 data symbols followed by a mini-probe consisting of 256 symbols of known data. After 8192 data symbols, ie each four data blocks, a 584 known symbols set (preamble?) is reinserted (pic. 8) [1]
![]() |
| pic. 8 - frame structure |
Little or nothing can be said about the secondary protocol: we can work on just the over-the-air symbols, unless to find the scrambler ploynomial, interelaver lenght and CRC algorithm... but that's another story.
My friend Alipio pointed me to an interesting question: the superframe length and the way to measure it.
We know that the superframe consists of 9544 symbols:
4 data-blocks: 8192 symbols
3 mini-probes: 768 symbols
reinserted-preamble: 584
while Alipio says that the reinserted-preamble is made up by the fourth miniprobe + the preamble itself (as in MS188-110 style):
4 data blocks: 8192 symbols
4 miniprobes: 1024 symbols
1 preamble: 328 symbols
Perhaps it's only a question of interpretation of the fourth mini-probe.
[1] MIL-STD 188-110C W/ CHANGE NOTICE-1 (03-JAN-2012) removed the Paragraph D.5.4 sentence "The reinserted preamble facilitates acquisition (or re-acquisition) of an ongoing broadcast transmission." since it refers to a feature that is obsolete.
Subscribe to:
Posts (Atom)



































