29 July 2022

Notes on Russian-Ukrainian Datalink (by Nicola)

I received from my friend Nicola, and gladly publish it, his work on Russian-Ukrainian Datalink.

When reading these notes, one should be aware that they have been pieced together from numerous sources and then consolidated. Carefully controlled machine translation from Russian and Ukrainian has been used. It should also be taken into consideration that the workings of the protocols and the nature of the application data they transport as well as the composition of the automated, military systems they serve may not have been fully understood. Markings in yellow indicate that translation is not available or that the given translation is tentative or poorly understood. Russian and Ukrainian designations have mostly been transliterated into Latin characters.Summing up: this is a work in progress. 

1. Introduction and history

Russian-UkrainianDatalink (RUSUKRDL) is a fictive designationwhich for the sake of simplicity is used in these notes to designate a collection of data link and application layer protocols used in air defense, fire controland automated battle field data networks of the armed forces of the Russian Federation,Ukraine and probably also of other former Soviet republics.

The description below will concentrate on the Akkord family of protocols. Akkord seems to be a fairly old family of data transmission protocols.In 1953, the Scientific Research Institute of Electrical Devices (NII ETU) separated from the Krasnaya Zarya plant, the main activity of which was the creation of technical means of data transmission and photo-telegraph equipment. The customers were the Air Defense Forces, the Navy, and the Space Forces. The data transmission protocols and equipment created by the Research Institute of ETU, "Araks", "Aragva", "Pogoda", "Akkord-SS-PD", "Akkord-SS-PS" and a number of others are still in operation in the ministry of defense of the Russian Federation.

The operation of early Akkordprotocols are described in detail in a textbook from 1975. Akkord-50 was one of the first protocols and used ITA-2 with blocks of 12x5 data bits + 2 repetition flag bits + 13 checksum bits in fixed data block mode transmitting at 50 or 100 Baud.

  

   

Exchange of traffic works like this: Sending station (PD) sends signal “start of data” (SSSS) and the receiving station acknowledges with ‘I’. Then the sending station sends ‘I’ and data block 1 with the two flag bits set to ‘00’. If the sending station does not receive a receipt (‘I’) within 1.5 s after having transmitted a data block, it retransmits the unacknowledged block, now with the flag bits sets to ‘01’.

Akkord-1200 is a protocol designed to be used for data transmission at 600 or 1200 Baud. 

 

In the figure above, the upper diagram shows the structure of a block at 600 Baud, while the lower diagram shows the structure of a 1200 Baud block. The former has 4 block number bits + 112 data bits + 16 check bits (= 132 bits), while the latter utilizes 4 + 240 + 16 bits (= 260 bits). The generator polynomial is x16+x12+x5+1, CCITT-16, the same as used in laterAkkordprotocols described below. It should be obvious from the above illustration, that the structure of Akkord-1200 is very similar to Akkord-SS-PD.

A special phasing block initiates the transmission of data: 


The block consists of 4 flag bits + 60 bits with an optimal number of bit transitions + 16 bits of a special phasing sequence, totaling 80 bits.

 

As is obvious from the illustration above, Akkord-1200 transmits a data block adding an ‘A’ to the first block, which is acknowledged by the receiving station. Block B(2) arrives in error, and a request for retransmission is issued. Block C (3) is transmitted. When the sending station receives the request, it retransmits blocks B and C.[1]

2. Protocol stack

The protocols discussed in this document are datalink layer protocols and the data they transport. The physical level network, transport and application layers is consequently not part of this discussion, but most of the intercepted radio links have been characterized by a telegraph speed of 1200 bps FSK with a shift of 800 Hz in the frequency range 5-7 MHz, which suggests short to medium range distances. Sources also mention the use of PSK, both absolute and differential.

 

DATA

APPLICATION

TRANSPORT

NETWORK

DATA LINK

PHYSICAL

2.1 Datalink layer protocols

 

Protocol name

Block length [(n, k] bits]

Speed

Used with

Remarks

Akkord-SS-PD (“Akkord-165”)

(165, 144), (117, 96), (69, 48)

1200, 2400, 4800, 9600 bps

AI-010, 55Ts6, R-050

 

Akkord-SS-PS

(69, 48)

2400 bps

AI-011

 

Irtysh

(117, 96), (69, 48)[1]

 

T-235-1L

 

Aragva

(126, 110)

1200 bps

5Ts55

 

Araks

?

?

?

Details unknown

Pogoda

?

?

?

Details unknown

Almaz

?

50 Baud

KSA 5D72, 88E8

 

?

(20, 15)

 

5Ts49

ITA-2 (MTK-2)

Pautina-1M

(32, 28)

60

?

2 channels

STA-2M

15 … 26 characters

 

STA-2M

ITA-2 without check bits

RB

?

?

?

Details unknown

ASPD-U

(40, 36)

234, 468

 

 

 2.1.2 Akkord-SS-PD

This protocol appears to be the main protocol used. The packet structure of this protocol is as follows:

 

The 4 m-bits are so called service bits which are used to signal various modes of operation at link level. The C-bit – also a service bit - indicates the address mode used, and the CRC is the cyclic redundancy check protecting the preceding bits. The protocol is transparent and may transport various types of information.

2.1.2.1 m-bits

These bits indicate the various operation modes of the protocol.

 

Service bits

Service bit values

Type of packet

 

m

C

1st Bit

2nd Bit

3rd Bit

4th Bit

X

X

X

X

1

Addressed

1

0

X

X

0

Broadcast[1]

1

1

X

X

0

Idle[2]

Note - "X" is the arbitrary value of this bit (0 or 1)


[1] In Russian „Circular“

[2] In Russian ”Silence”

m1 = Flag for erasure mode operation (in Russian DRS, see below)

m2= Flag for feedback (ARQ) operation (in Russian DRO, see below)

Only for duplex operation:

m3 = Receipt for received data block

m4 = Communication channel status indicator

 

m-bits

Remarks

1000

Observed with (165, 144)and (117, 96) payload packets

1010

Observed with (69, 48) payload packets

1100

Observed with (117, 96) scrambled idle (‘silence’) packets, and (69, 48)scrambled packets[1]

1101

Bit sync packets


Other sources indicate this for Akkord-165:

 

Digitvalues

Codagram types

m

C

0101

1

Phasing combination (F1 or F2)[1]

010х

0

Idle combination (х – arbitrary value)

zzz0

0

Information block, where the value of zzz determine the retransmission delay code


m - service digits  
C - decisive feedback flag
 

2.1.2.2 Data bits

Data transmission is carried out in blocks of 48, 96 or 144 data bits structured in a number of – 2, 4, or 6 - 24-bit data words. The data field contains the data payload.

 2.1.2.2 C-bit

The C-bit indicates whether the data block isunaddressed (‘0’) or addressed (‘1’) to a single recipient or is a broadcast. The address range is 1 to 15.

 2.1.2.3 Checksum

The m-bits, the data bits and the c-bit are protected by a 16-bit cyclic redundancy check with a generator polynomial G(x) = x16+x12+x5+1, which is the standard CCITT CRC-16. This will detect six errors and correct three.

 2.1.2.3 Protocol operation

The protocol is able to operate in three connection modes: Simplex, full duplex and half duplex. In duplex two sub-modes are available: Data erasure mode, where packets received in error are dropped, and feedback mode, where packets received in error are requested to be retransmitted by the opposite party by transmitting block repetition requests(RQ). If ‘erasure mode’ is disabled, packets in error are forwarded to the recipient (DTE) accompanied with an error indication to warn the end consumer. In simplex and half-duplex modes only erasure operation is available.

 SIMPLEX (SPX)

Format: Full Akkord format

Initial sync: 2 x block length reversals + sync seq (normal)

Cyclic sync: Each 21th block is sync seq (normal)

No traffic: Idle sequence

FULL DUPLEX (FDX)

OK ODK-1

Format: Full Akkord format

Initial sync: 2 x block length reversals + sync seq (normal)

Cyclic sync: Each 96th block is sync seq (normal)

No traffic: Idle sequence

OK ODK-2

Format: All bits except the 16-bit CRC are used for data.

Initial sync: 2x block length reversals + sync seq (normal) + sync seq (inverted)

Cyclic sync: Each 96th and 97th block is sync seq (normal) + sync seq (inverted)

No traffic: Idle sequence

OK ODK-2-1

Like ODK 2, but connection is closed down, when no traffic is received from the DTE.

HALF DUPLEX (HDX) (Alternate Duplex mode)

PDK-1

Format: Full Akkord format

Initial sync: 2 x block length reversals + sync seq (normal)

Cyclic sync: Each 21th block is sync seq (normal)

No traffic: Connection closed down

Other sources use the terms Simplex-1, Duplex-1, Duplex-2 and Duplex-3:

 SIMPLEX-1, DUPLEX-1

Sync seq every 95th block.

 DUPLEX-2

Resync is only initiated if a certain number of Block Repeat Requests[1] is received. Resync is attempted until sync is achieved, i.e. when the exchange of sync seqs with F1 and F2 flags takes place. This happens when the opposite party responds with F2 when sync seqs with F1 are received[2].

DUPLEX-3

Sync every 20th block. After initial sync synchronization is only resumed if a Phase Request[1] signal is received from the opposite party. If sync is not achieved after 96 blocks, then sync seqs are sent every 20th block.


2.1.2.3.1 Synchronization

A special 69-bit synchronization sequence is generated by the polynomial F(x) = x8+x6+x5+x4+1. The start byte of the sequence is 01010000 (0x50) and the final byte is 00000011 (0x03).This 69-bit sync sequence is extended for other block formats so as to cover an entire block, i.e. for (117, 69) 48 bits are added,… 0010 0100 1101 1100 1000 0010 1011 0110 1011 1101 1100 0011, and for (165, 144) another 48 bits are added, … 1110 1101 1110 1011 1010 0010 0001 1011 1111 0011 1001 1000.

Initial synchronization is achieved by transmitting a string of bit reversals. A polarity violation signals that the following string of reversal is the last before an initial sync sequence is transmitted. After this sequence has ended and synchronization achieved, data transmission starts. Depending on the transmission mode, sync sequences are inserted in the data stream at regular intervals (see preceding paragraph).

When the initial phasing codeword 0x50 has been found, the phasing analyzer module of the DCE proceeds to search for the ending codeword 0x03. It the proceeds the sync process, and being synchronized is defined as at least 21matches have been found within 29 bits in any interval of the phasing sequence. At least 21 matches of the corresponding bits must have been detected[1].

2.1.2.3.2 Idle

The idle packet for the (69, 48) and (165, 144) formats is structured like this:

m = 1101 (4 bits)

data = ‘01’ (reversals) (48 | 144 bits)

c-bit (1 bit)

crc (16 bits)

In the idle state the (117, 96) format seems to transmit packets with their contents set to the bits of a pseudo-random bit stream.

2.1.2.3.2. Request for repetition

In duplex mode and with feedback mode selected, the transmitting party stores the already transmitted data blocks and waits for acknowledgement from the opposite party. If an acknowledgement is not received within the time of four data blocks, then the stored data block is retransmitted. This procedure continues until acknowledgement is received.

 3. Application protocols

In this document, the term application protocol is used to describe the data transported by the underlying protocol(s).

 It seems that the family of Akkord protocols are used for a number of purposes including transmission of defense radio monitoring data and maybe most importantly in automated air defense systems deploying radar stations and altimeters, computation centers, fire control for surface to air missiles (SAM) and control and command for interceptors.


3.1. (69,48)

3.1.2. Irtysh (T-235-1L)

The transfer of information from a radar station via the AI-011 DCE is made automatically using three types of messages with the following priorities:

1. Coordinates of the radar station and information about its operating modes.

2. Target coordinates and bearings for AShP setters.

3. Target coordinates and signs and a flagfor the radar image acquisition channel (automatic or PAS).

 

Messages of the first priority are sent three times passing the DNA radar direction relative to North.

Messages of the second priority about bearings for AShP setters issued only through the automatic pickup channel.

Messages of the third priority are target information packages sent as they are created.

 

POP - attention flag (1) 

?? (2)

PAS - semi-automatic pickup flag (1)

PG - group target flag (1)

PP - target belonging flag (2)

PT - current review flag (1)

TL - location time (8)

H - target height (for auto-detect and PAS) (8)

ZХ (ZY) - coordinate Х(Y) sign flag (1)

X(Y) - coordinate X(Y) (11)

 

3.2. Akkord-SS-PS or Akkord-SS-PD?

The messages for the (69, 48) format depicted below – called codograms(KDG) in Russian and Ukrainian – are transmitted between the various components and units of the automated systems. In the sources these messages have been described:

 

Direction of information transfer

Information content

Form of information submission

DCE

VKP-9S52

Computer calculated alerts (20 targets)

KDG 5, 6, 7, 8

AI-011

Commands to RZ

KDG 15

Purposed commands (to 2 TsV and 5 ZD)

KDG 10

General purpose commands

KDG 12

9S52-VKP

Information on accompanying targets (up to 24 (96) traces)

KDG 5, 6, 8, 20

AI-011

Reports onKU, KZ, KRZ

KDG 11, 12, 15

Reports on the combat capability of individual zrdi

KDG 5, 6, 8

PORI P1 – 9S52

Computer calculated alerts (up to 50 targets)

KDG 5, 6, 8

AI-011

Bearings

KDG 9

Reports onKU, KZ

KDG 11, 12

Coordinates for RLI TS (radar station)

KDG 12

9S52 – PORI P1

Management commands

KDG 10

AI-011

General purpose commands

KDG 12

Batch of target numbers

KDG 7

Coordinates of UT zrbr

KDG 16, 17

9S470 – 9S52

Information on 6 targets accompanying SOU

KDG 4, 6, 8, 20

S23-1

9S52 – 9S470

Reports on KTs

KDG 11

S23-1

Checkpoint coordinates

KDG 13

Select computer calculated alerts (up to 15 targets)

KDG 4, 6, 7, 8

Commands on targets (up to 4 TsV and 5 ZD)

KDG 10

In the following, field explanations will not be repeated after their first occurrence. 

 

Message no. 4 –Target coordinates (DCE S-23-1, for DCE AI-011 this message is no. 5)

ООП – Attention flag (1): 0 = ?,1 = transfer of X, Y coordinates

ПO – Process flag (1): 0 = automatic, 1 = manual

X - Not used (2)

ОЦГ - Group target flag (1): 0 = single, 1 = group

OH – (ЧЖ,СВ, …)- State affiliation (2): 00 = unrecognized,01 = ЧЖ(chuzhiy)- alien, 10 = CB (sviy) - own, 11 = suffer his own misfortune

Озн. наявн. Н.(1) –Flag for height reliability

X -Not used (1)

NСЛ – Trace number (7)

H– Height x200 m (8)

X – X coordinate x100 m(first bit probably sign) (12)

Y – Y coordinate x100 m (first bit probably sign) (12)

 

Message no.6 – Target characteristics (DCE AI-011)

ООП

ТП– ? (6)

X - Not used (2)

NСЛ(NЦ)- Trace (target) number (7)

ТЦ – ? (3)

ПД – ? (2)

ПМ- ? (2)

X - Not used (1)

КС – ? (5)

ТСС - ? (3)

VXHorizontal velocity along the X-axis(first bit probably sign) (8)

VYHorizontal velocity along the Y-axis (first bit probably sign) (8)

 

Message no. 8 – End of data transmission (DCE AI-011, S23-1)

ПOП – ? (1)

ТП

X - Not used (2)

NСЛ(NЦ)

X - Not used (6)

КПТ (траси)–End of data command (2)

X - Not used (24)

Message no. 10 – Target command (DCE S23-1)

ПOП

ТП

X - Not used (2)

NСЛ(NЦ)

КЦ - ? (4)

КЦ - ? (4)

X - Not used (24)

Message no. 12 – Various commands (DCE AI-011, S23-1)

ПOП

ТП

X- Notused (9)

Командазагальноготипу (КЗ)– Generalpurposecommand (4)

Командазагальноготипу (КЗ)– General purpose command (4)

X – X coordinate (12)

Y – Y coordinate (12)

3.3. Akkord-SS-PD

3.3.1.Akkord (69, 48)

 


The picture above illustrates idle packets mainly containing bit reversals, payload packets (target coordinates (KDG 4 (or 5)), and end of data for given targets (KDG 6)) as well as a sync sequence (marked ‘phasing’) for the (69, 48) format.

 

This picture show a (69, 48) transmission with scramble or encrypted data blocks and two phasing sequences

3.3.2 Akkord (117, 96)

This format has only been observed used for the transmission of 48 bit data blocks or scrambled idle blocks. The remaining 48 bits are filled up with padding characters (0x0Eh). The blocks of data is initialized with a data block with unknown purpose: 0x7E + 0x45 (or 0x3A)+ bit reversals + 6 x 0xE0.

A transmission in (117, 96) format showing scrambled or encrypted data blocks (probably idles), 48-bit blocks (KDG 4 (5)) with 48bits of padding characters (0x0Eh). Also, notice the initial bit sync string followed by a bit violation in bit 1 in row 3 followed by an initial phasing sequence starting with the codeword 0x50h and ending with 0x03h

Again scrambled (117, 96) data blocks (idles) exhibiting a Pseudo Random pattern (the four ‘belts’ starting in the lower left corner and running diagonally towards the upper right corner.

3.3.2. Akkord (165, 144) (”Akkord-165”)

 
(165, 144) data block traffic with a phasing sequence inserted in the middle of the picture. The data payload does not seem to match the information on codogram formats available at the time of writing
  

3.3.2.1. Automated battlefield systems

The messages for the (165, 48) format depicted below are transmitted between the various components and units of the automated systems. In the sources these messages have been described:

Direction of information transfer

Information content

Form of information submission

73N6 (5N37) <-> 5N60/61K6/46L6

I Computer calculated coordinates

1 x 10 s

II Characteristics of computercalculated coordinates

Immediately after I, then 1 x 2 min

III Bearings

1 x 10 s

IV About VP from SAZV

When updated

V Interaction with target

As needed

VI Load of OK and BG DRLI

1 x 20 s

Notification about ET (training)

 

KP 1, 2 (about the serviceability of the data channel) or KP 3, 4

1 x 10 s

73N6 <->

5N55 (5N55M-O)

Computer calculated coordinates

1 x 10 s

Telephone conversation regarding computer calculated coordinates

One time

Bearings

1 x 10 s

Order regarding computer calculated coordinates, 73N6

One time

KP 1, 2 (about the serviceability of the data channel) or KP 3, 4

1 x 10 s

73N6 <-> 5K38

Interaction commands

 

Guidance information

 

Information about the reversal of the VP

 

Computer calculated coordinates

 

Orders on PN

 

KP 1, 2 (about the serviceability of the data channel) or KP 3, 4

1 x 10 s

73N6 <-> 70R6

Order to the database (BD)

 

Orders regadingRLV sectors

 

Reference route

 

Report on computer calculated coordinates

 

Report on database (BD) system

 

Report on the ZRK (SAM) database

 

Control report

 

 
 

Exchange formatfor the link between 73N6 and 5N60, 61K6, 46L6


Word no.

1Message header? (24);

2 No. trasi – Trace number (8); +/- - Sign of X (1); X(tsmr – 100 m) –X coordinate (res. 100 m) (14);RP (1)

3 ?(1); ? (7); +/- - Sign of Y (1); Y(tsmr – 100 m)– Y coordinate (res. 100 m) (14); Not used (1);

4 +/- - Sign of VH (1); VH(tsmr- 10 m/s)– Vertical velocity (res. 10 m/s) (7); HH– Fag for height information reliability (0 – H is reliable) ? (1); H(tsmr -100 m)– Height (res. 100 m) (10); Td – Time offset? (5);

5 VZ (2); POM (2); OGP (2); OGP(1); VH (1); +/- - Sign of horizontal velocity along the X-axis (1); Vx(tsmr - 10 m/s)Horizontal velocity along the X-axis (res. 10 m/s)(8); M (2); Not used (2); KS(Ts) – Something regarding the target (3);

6 TLA (4); IVO (4);+/- - Sign of horizontal velocity along the Y-axis (1); VY(tsmr res. 10 m/s) – Horizontal velocity along the Y-axis (res. 10 m/s) (8); TII (4); SOPR(3);

RP – Flag for electronic warfare purposes; HH – flag for reliability of height (0 - H reliable);

VZ - Interaction with target: (00 - none; 01 - VA; 10 - ZRV; 11 – VA and ZRV);

POM– Interference from target: (00 - none; 01 - AZ; 10 - PZ; 11 - both);

OGP– State affiliation: (00 - unrecognized; 01 - alien; 10 - own; 11 - suffer his own misfortune);

OGP - Flag for renewal of state affiliation?;

M–Flag for maneuver (00 - none; 01 - on course, 10 - on height; 11 - on height and course);

TLA- ?: (SB, IB, KR, PRS, …);

IVO - Air object index code;

TII - Type of radar data: (000 - SAZO; 001 - SNR, RPTs, RPN; 010 – radar station (RLS) in meter range; …);

SOPR –Support information:(001 - new target; 011 - coordinates extrapolated; 100 - correction of coordinates X, Y; … 111 - reset route).

 
Exchange format for the link between 73N6 and KZA 5N55M
 
Word no.

1Message header? (24)

2No.trasi (8); +/- (1); X(0 – 1638,3) (14); Not used (1)

3No.RTB(strashirozryadi) (8); +/- (1); Y(0 – 1638,3) (14); SN (1)

4No.RTB(molodshirozryadi) (8); Not used (1); H(0 -102,3) (10); Td (5)

5? (2); No. zayavki (22)

6TLA (4); IVO (4); ¿ (9); VNPR (4); ¿ (1); PA (1); ¿ (1)

 SN – Flag for connection numbering: (0 –Number is in the number system of the transmitting KP; 1 –Number is not in the number system of the transmitting KP);

№ zayavki- Number of the application aircraft (consists of two digits (letters) and the code of the VP);

VNRP - Type of flight violation: (0000 - none; 0001 - violation of the KS; 0100 - deviation for H; 1000 - by route, …); 

PA - Flag for landing at the aerodrome, which will be carried out)

3.3.3.2. Radio monitoring data

Akkord(4 x 24 bits) used for the transmission of radio monitoring data

 
 

Word no.

1 Шифр (8);Частота(24): x10 МГц (4), x1 МГц (4), x100 кГц(4), x10 кГц(4),
2x1 кГц(4), x100 Гц(4); Пеленги (12): x100 Град (4), x10 Град (4), x1 Град (4); ТЛФ (2); Приoр (2)
3 чатота нажатияFн(12): x1 кГц (4), x100 Гц (4), x10 Гц (4);чатота отжатияFo(12): x1 кГц (4), x100 Гц (4), x10 Гц (4)
4 полоса (4); скоростьТЛГ (боды) (4); Сост. Цели (4); Уровни (4); X (12)
Шифр - Number?
Частота- Frequency: x10 МHz, x1 МHz, x100 kHz, x10 kHz, x1 kHz, x100 Hz
Пеленги- Bearing: x100 degrees, x10 degrees, x1 degrees
ТЛФ- ?
Приoр- Priority
чатотанажатия–?: x1 kHz,x100 Hz, x10 Hz
чатота отжатия- ?: x1 kHz, x100 Hz, x10 Hz
полоса- Band
скорость ТЛГ (боды)Telegraphspeed (Baud)
Сост. Цели– Target composition?
Уровни– Levels
Not used?

3.3.3.3. Time and time offset data

Akkord-SS-PD (2 x 24 bits) used to transmit network time and time offset. The message is meant to be transmitted immediately following a phasing block

 

Word no.
1 AM-PM(1); Часы (4); Минуты (4); секунды (4); миллисекунды (7)
2 день (5); месяц (4); Год (7);смещение (8) 
AM-PM – Before or afternoon: 0 = AM, 1 = PM(1)
Часы- Hour: 0 – 12
МинутыMinut: 0 – 60
секундыSecond: 0 – 60
миллисекундыMilliseconds: 0 – 100
деньDay: 1 – 31;месяцMonth: 1- 12; Год– 0 - 99;смещениеOffset (0 – 4,25 min)

 

4. Samples

This sample consists of two (69, 48) Akkord-SS-PD or PS messages KDG no. 4 and no. 6 transmitted from a S23-1 DCE, where the data link layer has been removed. These messages seem always to be sent together:

KDG 4: 11000101 00100010 00100000 110111011010 000111111100

KDG 6: 00001010 00100010 01010000 000001000010011100010101

KDG № 4 Coordinates of the target (DCE S23-1, [KDG] No. 5 via DCE AI-011)

11000101 0010001000100000110111011010000111111100

1 = OON (attention flag = transferring X, Y coordinates)

 1 = PO (process flag = manual)

  00 = X (not used)

0 = OTsG(group target flag = single)

      10 = ON(indication of state affiliation = own)

       1 = Ozn. Nayavi. H (height information reliability flag = Height unreliable)

         0 = X (not used)

0100010 = NTs = 34 (trace/target no.)

00100000 = H (x200 m) = 32 = 6400 m

110111011010 = X (x100 m) = 1 10111011010 = +149800 m     

000111111100 = Y (x100 m)= 0 00111111100 = -50800 m

KDG № 6 Characteristics of the target (DCE AI-011)

00001010 00100010 01010000 00000 100 0010011100010101

0 = OON (attention flag = no transfer of coordinates)

 000101 = TP = 5

       0 0 = X (not used)

          0100010 = NTs= 34

                 010 = TTs = 2

                     10 = PTs = 2

                       00 = PM = 0

                         0 = X = 0 (not used)

                           00000 = KS

                                 100 = TSS = 4

00100111 = Vx = 0 39 = 390 m/s

00010101 = Vy = 0 = 21 = 210 m/s

KDG № 8 End of data transmission (DCE AI-011, S23-1)

00010010 00100010 00000011 000000000000000000000000

0 = POP

 001001 = 9 = TP

       0 0 = X (not used)

          0100010 = NTs = 34

                  000000 = X (not used)

                        11 = 3 = KPT (trasi) = end of tracking command

                           0…0 = X (not used)

 
 

26 July 2022

STANAG-5066 over MIL 188-110A: Polish CD/TDF messaging

I spent some days monitoring the transmissions of a Polish net on 5094.0 KHz/USB, traffic occurs mainly in the morning from Monday to Friday and consists of ALE link setup followed by voice radio-checks (sometimes) and data exchanges which may last several seconds, up to some minutes (figure 1). Link setup, as usual, is performed by using 2G-ALE 188-141. Results of the analysis of the traffic waveform show the use of 188-110 ST with an high adaptive rate and a good SNR ratio due to the proximity of the receiver [1]; the sub carriers have a slight slip, just a few Hz, from the nominal value of 1800 Hz.

Fig. 1 - a complete transfer

The demodulated bitstreams, such as the one in figure 2, have period lengths that reveals the use of the STANAG-5066 suite at the datalink layer, presence which is also confirmed by the numerous detection of the 16-bit synchronisation sequences 0x90EB, tipycal of that Standard.

Fig. 2 - a demodulated bitstream

The bitstreams have been analyzed using my "STANAG-5066 Dissector" tool [2]; below the traffic-flow output that clearly shows the use of the ARQ (DATA-ACK, ACK-ONLY, DATA-ONLY (simplex)) and non-ARQ (EXP NON-ARQ DATA) transfer modes: 

looking at the waterfalls shown in figure 1, the ARQ segments are recognizable by the different fading patterns.
Further "technical" information can be extracted by examining the data transfer frames as the one shown below:


The most interesting one is the use of a CFTP-based application to send data. The Compressed File Transfer Protocol (CFTP) sends compressed e-mail over an HF link using a file transfer protocol, rather than a mail transfer protocol. Messages produced by an mail application are processed by a MTA (Mail Transfer Agent), compressed in CFTP, segmented in the STANAG 5066 Basic File Transfer Protocol (BFTP), and passed to the subnet interface by the STANAG 5066 Reliable Connection Oriented Protocol (RCOP). At the receiving node, this process is reversed, and the uncompressed e-mail message is delivered to the receiving MTA for delivery or forwarding. CFTP provides the most bandwidth-efficient exchange of data just using BFTP to send compressed file, both the protocols are defined by STANAG-5066 Annex F.10.2.2. By the way, it's interesting to note the use use of HBFTP, see figure 3, that likely stands for the Harris implementation of BFTP protocol (that's a first clue in favour of the use of Harris hardware/software solutions).

Fig. 3

As mentioned, a complete data transfer session (from the link setup to its closure) can last up to some minutes, with large silence intervals during which messages are retrieved and processed for forwarding. Almost all the link requests are sourced by the callsign WA1 (that is likely the net-control station). All messages are delivered to recipients using informal mails which emerge after unpacking the HBFTP--.gz files. 

Usually each session begins with a voice radio-check followed by a "bilateral" QRA request/response (figure 4): perhaps the QRA strings have something to do with message routing, anyway a certain QRA is always sent by a same station (see below).

Fig. 4 - QRA exchanges bewteen WA1,ST3

Quite a bit of information can be gleaned from examining the headers of the mails.
The "From:" "To:" fields allow you to understand who the user of the messaging system is, in this case the top level domain .pl (pl = Poland) suggests a Polish mil/gov newtork; the mail domain is .ga8.pl and the nodes involved in this exchange are WA1 and ST3 (the same callsigns used in the ALE exchanges). The prefix "WMT" used in the mail addresses (such as wmtwa1@wa1.ga8.pl) clearly indicates the use of Harris RF-6760W Wireless Message Terminal (WMT) application, and quite surely they also use the RF-6750W Wireless Gateway (WG) application. The hostnames "cwt.radio" (station WA1) and "radio7de49420a" (station ST3) are also exposed. By comparing the mail addresses and the relative STANAG-5066 frames is then possible to go back to the respective S-5066 addresses WA1 011.000.000.001 and ST3 011.000.000.003 (see below).
A (quite old) Microsoft Outlook version is the used mail application, therefore the HF network nodes use Windows Microsoft-based PCs. The X-HSMTP-Hop (Harris SMTP) header shows that the recipient node is at 1-hop distance (DP and NP values).
[Received: from] "Stanowisko25" (Polish "stanowisko" stands for station, office) is the name the sending or relaying computer, probably the remote mail server used to forward mail from external mail server to WG, or to forward outbound mail from WG. Stanowisko25 should also provide user mail box from wich mail is "pulled from" to the client.
Most of the times, a message mail (QTC) follows the QRA exchange: such mails adopt a same schema:

the first four numbers stand for
message number (21)
group number (30)
day of the month (19)
time (08.30)


time indication seems to have a granularity of 30 minutes (hh.00, hh.30)


Five Z-coded strings follow:
= ZKV = ZAD ZDI ZHN ZQL =

Apparently, the texts resulting from the Z-code translation make little sense, it must be said that each Country can have its own coding that differs from the standard one.

The actual messages always consist of twenty-seven 5-FIGS/LTRS groups:

63118 72301 92285 23977 56651 38765 93511 62687 40203 90410
88997 12303 96027 23809 18777 24397 88893 98093 69555 27998  
76296 75891 88515 47584 32907 35614 45654

GHUYD  GHIKU  XDIFV  BHYTR  KJHGF  OIASG  DLJJG  TEIIA  SIIYT OEIYS
LIPJO  IUIIH  EJDFC  GHJUE  OINHG  POPPY  HGJPP  UIPPI  BYUDE  OPUUY
IIPEL  IIIJM  FDJRE  HDBCF  KJFDV  YTRUD  KOIUP

Fig. 5

Sometimes the 27 groups are sent in two different mails, sometimes in the same mail or grouped (notice that the message numbers are in descending order):

 
messages recepit is then confirmed in a single message:


It may happens that a mail has a MIME type "MS-TNEF" (1) attachment which is encoded using Base64 (2). MS-TNEF (Transport Neutral Encapsulation Format) is a proprietary format used by Microsoft Exchange and Outlook when sending messages formatted as Rich Text Format (RTF), the TNEF part appears as a long sequence of hexadecimal digits, either in the message itself or as an attached file usually named WINMAIL.DAT Unfortunately, most non-Microsoft e-mail clients cannot decipher TNEF blocks, consequently WINMAIL.DAT files serve no useful purpose since the un-formatted message is always sent. Indeed, you may decode the WINMAIL.DAT block from Base64 (figure 6) and then read its contents using a specific tool such as Winmail Opener [4]:  as you see, contents are the same! Notice the path of the mail message within the sending computer at ST3 (C:\Harris\WMTwmt.pst).

Fig. 6 - decoding from base64

You may also decode from Base64 using the command-line tool "base64.exe" [5]:
 
Fig. 7

TNEF encoded mails are about four times larger than their respective Plain Text ones, consequently - if both are sent with the same speed/interleaver - sending RTF-formatted mail needs more air-time, decreasing the overall throughput of the system. Since the purpose of such mails, in my opinion they should turn off TNEF in all their Microsoft mail clients:

-rwxr--r--  1 antonio antonio  663 lug 15 12:31 000_HBFTP--38  (QRA mail - plainTetxt)
-rwxr--r--  1 antonio antonio 2891 lug 15 12:33 000_HBFTP--40  (QRA mail - RFT)
-rwxr--r--  1 antonio antonio  889 lug 13 09:23 023_HBFTP--13  (QTC mail - plainTetxt)
-rwxr--r--  1 antonio antonio 3713 lug 13 11:07 015_HBFTP--48  (QTC mail - RTF)

Back to the user identification, the "star net" calls (3) issued by WA1 (TIS [WA1] TO [GA8]) helped to identify the name of the network and the callsigns of the nodes that compose it. Moreover, given the long monitoring, I also had the opportunity to record some voice radio checks which were then translated from Polish with the help of some UDXF friends; in this way it was possible to trace the names of the stations and match them to their respective callsigns (see below). The voice op-chats highlight a large share of women in service.
Then I did some further investigation about the hostname "stanowisko25" and found that stanowisko.pl is a Linux-based virtual private server (VPS), IPv4 address 85.128.128.104, hosted by the Polish company nazwa.pl [3]. Likewise, the hostname kabina2 indicates the kabina.pl VPS (it shares with stanowisko the same IPv4 address 85.128.128.104 and the same physical host). The server seems to filter out incoming telnet connections to TCP port 25 from unallowed IPv4 addresses, packets are simply dropped with no response. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software (figure 8).
 
Fig. 8

The gathered information allow to draw a (tentative) structure of the 5094.0 KHz HF network at present day (figure 9):

station: Barbin(g) 12 Net-Control Station,
ALE address: WA1 (likely Warzawa 1)
STANAG-5066 address: 011.000.000.001
mail address: wmtwa1@wa1.ga8.pl
hostname: cwt.radio
associated QRA: 0370,3369,4295,6063,6138,9287,9339,9542,...

station: Alik 64
ALE address: AL6
STANAG-5066 address: 011.000.000.005
mail address: wmtal6@al6.ga8.pl
hostname: radiozbamqxsqq
associated QRA: 7213,4382,6385,8352,8463,...

station: Depozytor 32
ALE address: DE3
STANAG-5066 address: 011.000.000.006
mail address: wmtde3@de3.ga8.pl
hostname: SOHARRIS1
associated QRA: 2849,3668,...

station: Fenix 69
ALE address: FE6
STANAG-5066 address: 011.000.000.004
mail address: wmtfe6@fe6.ga8.pl
hostname: kabina2
associated QRA: 5362,9462,...

station: Kraków 20
ALE address: KR2
STANAG-5066 address:
mail address:
hostname:
associated QRA:
(several ALE exchanges logged but no data transfers)

station: Stawka 38
ALE address: ST3
STANAG-5066 address: 011.000.000.003
mail address: wmtst3@st3.ga8.pl
hostname: radio7de49420a
associated QRA: 2564,3497,6253,6380,...

Fig. 9 - presumed structure of the Polish HF network GA8 (at July 2022)

The lack of cryptography and the  op-chats style (maybe volunteers?) make me think of Polish Civil Defence (CD) or Territorial Defence Force (TDF) as the most likely user.

Same type of traffic was heard on August 2016:
https://i56578-swl.blogspot.com/2016/08/yet-another-email-exchange-via-stanag.html 

 

Last minute update:
It's much more probable that both "stanowisko" and "kabina" are just random domains registered with nazwa.pl, the IP address they point to is one of the servers hosting the default page / landing page of all nazwa domains" as my friend ZZZ (whom I thank) emailed me.
 

 https://disk.yandex.com/d/XFlEbfFyRrPWow

(1) MIME type "MS-TNEF" (Transport Neutral Encapsulation Format) is a proprietary format used by the Microsoft Exchange and Outlook e-mail clients when sending messages formatted as Rich Text Format (RTF). When Microsoft Exchange thinks that it is sending a message to another Microsoft e-mail client, it extracts all the formatting information and encodes it in a special TNEF block. On the receiving side, a Microsoft e-mail client processes the TNEF block and re-formats the message. When you receive a TNEF-encoded message with a non-Microsoft e-mail client, the TNEF part appears as a long sequence of hexadecimal digits, either in the message itself or as an attached file usually named WINMAIL.DAT.

(2) The MIME (Multipurpose Internet Mail Extensions) specification (RFC 1341 and successors) defines a mechanism for encoding arbitrary binary information for transmission by electronic mail. Triplets of 8-bit octets are encoded as groups of four characters, each representing 6 bits of the source 24 bits. Only characters present in all variants of ASCII and EBCDIC are used, avoiding incompatibilities in other forms of encoding such as uuencode/uudecode.

(3) As per MIL 188-141 Appendix A, a star net call is identical to a one-to-one call, except that the called station address is a netaddress. The purpose of a net call is to rapidly and efficiently establish contact with multiple prearranged (net) stations (simultaneously if possible) by the use of  a single net address, which is an additional address assigned to all net members in common.

[1] http://websdr.printf.cc:8901/
[2] https://i56578-swl.blogspot.com/2021/02/a-stanag-5066-off-line-dissector.html
[3] https://www.nazwa.pl/vps/
[4] https://www.eolsoft.com/freeware/winmail_opener/
[5] https://disk.yandex.com/d/df8P6EkaaXrDLw


5 July 2022

Thales HDR Single Tone modem? (TRC-3600/3700 family)

 

I rcently spent a bit of time monitoring the data transfer sessions which frequently happen on 6478.0 KHz/usb in ARQ mode. As usual, transfers start with the link setup stage: the particular and distinguishable shape of the ALE burts makes it possible to identify the Thales Systeme-3000 Skymaster ALE. The initial part of the ALE burts is SDPSK (Symmerical Differential PSK) modulated at 2000 Baud speed with a carrier frequency of 1600 Hz; as you see, transitions do not traverse the origin and the information is stored in the transitions and not in the states (figure 1). The initial part is followed by short MFSK-8  125 Baud segment that is not compatible with MS 188-141 2G-ALE although the scope be the same (they use different tones library).

Fig. 1 - Systeme-3000 Skymaster ALE

The SDPSK part exhibits a 50ms ACF that corresponds to a 100-bit frame (figure 2)

Fig. 2

Data bursts are PSK-8 modulated at a symbol rate of 2400 Bd and exhibt a 106.6 msec ACF (corresponding to 256 symbols) but adopt diferent frame structures: likely it's due the the adaptive feature of the modem which therefore adopts different data rates and waveforms (figs 3,4).

Fig. 3

Fig. 4

The presence of the Systeme-3000 ALE bursts - and thus a Thales proprietary waveform - suggest that the 2440Bd/PSK8 waveforms (used for data) are sourced by the High Data Rate modem incorporated into the TRC-3600/3700 family of combat radios. Quoting TRC-3600 datasheet: "It integrates a high data rate, multiwaveform, single tone modem (from 75 to 5400 bps) and a vocoder (800 - 2400 bps) associated to a high security digital COMSEC chip. The performances of the modem, the use of powerful error correction codes and the use of real time adaptive procedures enable to offer reliable HF links even on a severely degraded ionospheric path. The links are automatically optimized in real time according to the possibilities of the HF channel".

...and yes, yet another 106.6 ms ACF waveform.

 https://disk.yandex.com/d/GAB7inxTA7-QWw