Found this strange signal on UHF

Status
Not open for further replies.

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
It sounds like some kind of digital mode. Any idea what it might be? The RF frequency I found it on, the demodulation type of the RF carrier that my radio was set on (not the modulation type of the subcarrier for the digital mode, and not necesarilly the actual modulation type transmitted by the source), and the date and time I recorded it on, are all in the filename of the WAV file I saved (and the ZIP file I used to compress the WAV file to make it small enough to fit on here and make sure that it was of the right file type for an attachment which doesn't allow WAV files). Note that the Radio Shack scanner I was using is manufactured to be permanently using FM demodulation (except when set to the aircraft band, which automatically switches the scanner to using AM demodulation) so there's no guaranty that that's the actual modulation type used by the transmitter of this signal. I also have an ICom PCR-1000 (which allows manual selection of demodulator), but it's not hooked up at the moment. But listening to it should give you a general idea of what it is if you are familiar with UHF professional digital modes. So I hope somebody on these forums can tell me what it is.
 

Attachments

  • Unusual Signal (936.387MHz, FM, 8-17PM PST, 1-21-2015).zip
    164.4 KB · Views: 140
Last edited:

Spitfire8520

I might be completely clueless! =)
Joined
Jun 29, 2009
Messages
1,970
Location
Colorado
I agree with the thought that it's a control channel for a trunked radio system of some kind. I had to reference Digital*Modes*Samples and W2SJW - Radio Sounds for some audio samples because I haven't personally encountered this one before. It sounds closest to a 4800 baud EDACS Narrowband control channel (Sample 1 and Sample 2) which appear to be primarily used on 900 MHz.
 

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
Found another one just a few hundred kHz higher. This one makes a series of clicks. Can somebody here let me know what it is? I haven't been able to find any online sample that sounds like this one where I normally check for sample radio sounds (Digital*Modes*Samples)

Attached to this post is a ZIP file containing the WAV file I recorded of this sound. I hope somebody can tell me what it is.
 

Attachments

  • Unusual Signal (936.787MHz, FM, 6-19PM PST, 1-23-2015).zip
    179.5 KB · Views: 74

Spitfire8520

I might be completely clueless! =)
Joined
Jun 29, 2009
Messages
1,970
Location
Colorado
Found another one just a few hundred kHz higher. This one makes a series of clicks. Can somebody here let me know what it is? I haven't been able to find any online sample that sounds like this one where I normally check for sample radio sounds (Digital*Modes*Samples)

Attached to this post is a ZIP file containing the WAV file I recorded of this sound. I hope somebody can tell me what it is.

Playing the audio matching game, it's possibly Mobitex given the two samples I have found (http://www.kb9ukd.com/digital/mobitex.wav and MOBITEX - Signal Identification Wiki). I don't know anything of this format personally so I can't tell you if it actually is Mobitex.
 

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
And here's another strange one. It's just a series of repeating buzzing alarm like sounds. It doesn't sound like any data is being transmitted, as its sound doesn't vary in any way (as a low baudrate data signal would sound like) nor does it sound like bursts of "static noise" (as a high baudrate data signal would sound like). I'm guessing it's an idling tone for some always-on-the air data system, such that it idles whenever there's no data being transmitted (instead of just shutting off the transmitter), but I have yet to hear any data being transmitted on this frequency. Anybody here know what it might be?

Note, sorry about the background hiss noise that seems to come and go throughout the recording. I couldn't get a really good clear signal on this one.
 

Attachments

  • Unusual Signal (454.350MHz, FM, 4-47PM PST, 1-24-2015).zip
    128.9 KB · Views: 70

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
Thanks to all who have replied for the info you've provided.
By the way, does anybody know what SCADA system is being used, regarding the 3rd sound sample? I live in Seattle, if that helps. Is that particular transmission coming from a well known service/utility source (electric power company, railroad, port/shipping industry, airport, etc), that's well known to other scanner listeners in Seattle?
 

nd5y

Member
Joined
Dec 19, 2002
Messages
11,297
Location
Wichita Falls, TX
454.35 is a part 22 paging channel. There is no telling who the end user might be.

Some of the 900 MHz frequencies were auctioned off. You will have to do a geosearch on the FCC ULS license search page to see who owns the frequencies in your county or market area.

The search instructions in the Part 22 wiki article above are also good for finding other types of auctioned wireless and Maritime Public Coast licenses.
 

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
454.35 is a part 22 paging channel. There is no telling who the end user might be.

Some of the 900 MHz frequencies were auctioned off. You will have to do a geosearch on the FCC ULS license search page to see who owns the frequencies in your county or market area.

The search instructions in the Part 22 wiki article above are also good for finding other types of auctioned wireless and Maritime Public Coast licenses.

By paging, do you mean like a person's "pager" that they carry with them (to notify them when somebody tries to call them)? If so, what protocol is it? I don't think it is, as the the protocols for telephone pagers are called Flex, ReFlex, and Pocsag. And I've heard WAV files of these modes before, and this doesn't sound like any of them.
 

nd5y

Member
Joined
Dec 19, 2002
Messages
11,297
Location
Wichita Falls, TX
Yes, personal pagers. There are many different paging formats. The audio in your recording is not paging. The present day part 22 channels used to be only for use by commercial paging, mobile phone service (pre-cellular IMTS and others) and rural radio. Many of those networks no longer exist. The frequencies were auctioned and now you can hear conventional simplex, repeaters, LTR, DMR and P25 trunking and probably other stuff on those frequencies. In many cases you won't be able to tell who the end user is because the frequencies are usually licensed to the auction winner or leased to a service provider.
Read all the links in the wiki article.
 

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
Yes, personal pagers. There are many different paging formats. The audio in your recording is not paging. The present day part 22 channels used to be only for use by commercial paging, mobile phone service (pre-cellular IMTS and others) and rural radio. Many of those networks no longer exist. The frequencies were auctioned and now you can hear conventional simplex, repeaters, LTR, DMR and P25 trunking and probably other stuff on those frequencies. In many cases you won't be able to tell who the end user is because the frequencies are usually licensed to the auction winner or leased to a service provider.
Read all the links in the wiki article.

Then can it be said that it is some paging format that is not related to telephone pagers, but rather some kind of professional radio paging system, to let somebody know that that somebody else on their 2-way is trying to contact them (like maybe construction workers, ship workers, railroad workers, etc)?

By listening to the sound in question, can you tell what digital mode is being used at least (even if the company name can't be determined)? Is it a common one to hear on UHF? Or is it likely a proprietary mode, used only by a specific company?

Using the link you pointed me to, I can tell that it's a base station frequency, and that its designated block is "GN". How can I look up who the user is? Is there some FCC database I can search?
 
Last edited:

nd5y

Member
Joined
Dec 19, 2002
Messages
11,297
Location
Wichita Falls, TX
It is NOT a paging signal.
The wiki article tells you how so use the FCC database but I guess you didn't read that part.
There are two licensees for 454.35 in King Co. WA.
ULS License - Part 22 VHF/UHF Paging (excluding 931MHz) License - WPXN967 - MOTOROLA SOLUTIONS, INC.
and
ULS License - Part 22 VHF/UHF Paging (excluding 931MHz) License - WQKM204 - Pierce County Public Transportation Benefit Area Corp.
Which is a public transportation agency. The data stream is probably AVL for busses.
According to this application attachment they acquired frequencies from Motorola Solutions.
https://wireless2.fcc.gov/UlsEntry/...tachmentKey=18399517&attachmentInd=applAttach
 

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
Ok, I finally figured out how to do the search. I did a search for all licensees for the frequency range 454 to 455 MHz, in a geographical area centered on Lat=47° 36' 36" N, Lon=122° 19' 48" W, which is the center of the city of Seattle, and a search radius of 25 miles. It found one licensee for the frequency in question (454.35MHz) within this geographical region.

Licensee = MOTOROLA SOLUTIONS, INC.

It found 5 physical locations that this licensee has licensed for this frequency.

Location 1 = 47° 18' 13.8" N, 122° 23' 47.8" W
Location 2 = 47° 30' 12.0" N, 122° 20' 14.0" W
Location 3 = 47° 21' 28.4" N, 122° 14' 37.5" W
Location 4 = 47° 23' 27.0" N, 122° 36' 29.0" W
Location 5 = 47° 23' 58.8" N, 122° 35' 17.0" W

Here is a screenshot of Google Earth displaying markers for these locations. It also shows one for Alki Beach (this is the beach I live on, but note that for privacy reasons, it doesn't point to the actual building I live in). As you can see from this, Location 2 is closest to where I live, but there is no line-of-sight from the beach to this location, as there is a hill between where I live and this location. UHF usually requires line-of-sight to the transmitter, in order to receive the signal. Locations 4 and 5 MIGHT be considered line-of-sight (there's no geographic barrier, just buildings between me and this location), but it's much farther away. Overall, Locations 2, 4, and 5 are the most likely candidates I believe, but I'm not sure.

http://i.imgur.com/dG4vonX.jpg

But I still don't know what digital mode is being used. By listening to the signal, can anybody tell me what digital mode is being used? This sound #3 is still a mystery to me, as to what digital mode is being use.
 

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
It is NOT a paging signal.
The wiki article tells you how so use the FCC database but I guess you didn't read that part.
There are two licensees for 454.35 in King Co. WA.
ULS License - Part 22 VHF/UHF Paging (excluding 931MHz) License - WPXN967 - MOTOROLA SOLUTIONS, INC.
and
ULS License - Part 22 VHF/UHF Paging (excluding 931MHz) License - WQKM204 - Pierce County Public Transportation Benefit Area Corp.
Which is a public transportation agency. The data stream is probably AVL for busses.
According to this application attachment they acquired frequencies from Motorola Solutions.
https://wireless2.fcc.gov/UlsEntry/...tachmentKey=18399517&attachmentInd=applAttach



I already found that. I found it, and started typing my reply to explain that (with quite a bit of information) before you posted. It appears I finished typing, and posted it, after you already replied (the page refresh after my posting showed you already replied).
 

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
Still no answer to my big question (kinda got an idea as to may be who is sending it but that's an answer to a relatively minor question). On unknown signal #3 that I posted here, the big question still remains. What digital mode is it? Is it a common one used on UHF? Or is it proprietary?
 

nd5y

Member
Joined
Dec 19, 2002
Messages
11,297
Location
Wichita Falls, TX
It sounds like 2400 baud data sent with standard 1200/2400 Hz tones.
That is a common data radio modem format.

If it is the public transit agency then it is probably AVL or fleet management data.
There are several manufacturers of systems that send the bus GPS location and some can send alerts for engine temperature, oil pressure, tire pressure, text messaging, etc.

There is no telling what the actual data is or what protocol or format it is. Decoding modem tones is easy but all you would get a meaningless stream of 0s and 1s. It could be some industry standard SCADA format or something with error correction, proprietary or encrypted that you could never decode unelss you had the same equipment and software that they have.
 

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
It sounds like 2400 baud data sent with standard 1200/2400 Hz tones.
That is a common data radio modem format.

If it is the public transit agency then it is probably AVL or fleet management data.
There are several manufacturers of systems that send the bus GPS location and some can send alerts for engine temperature, oil pressure, tire pressure, text messaging, etc.

There is no telling what the actual data is or what protocol or format it is. Decoding modem tones is easy but all you would get a meaningless stream of 0s and 1s. It could be some industry standard SCADA format or something with error correction, proprietary or encrypted that you could never decode unelss you had the same equipment and software that they have.

In other words, this 3rd signal I've uploaded isn't an obviously recognizable signal type (like the Mobitex was that somebody mentioned that my second signal upload was). So it really IS a mystery signal then.
 

KE7IZL

Member
Joined
Aug 2, 2011
Messages
151
Location
Seattle, WA
Here's another interesting signal. Don't know if it's a well known signal type, and I've heard it a lot before on my scanner (FM demodulation only) but never really looked at its actual raw signal before. I got out my Icom PCR1000 today, and using my own custom made software set it to upper-sideband mode and 50kHz IF filter width (a combination not allowed using Icom's own software). This basically allowed me to downconvert a signal to the audio part of the spectrum, without FM demodulation. I then tuned to an interesting signal. This allowed me to record the actual raw signal's RF content (just downconverted to the AF baseband) on my computer, using the audio software GoldWave. Unfortunately, even with such a wide bandwidth and the samplerate set to 48kHz, the audio signal path (all analog AF electronics in the radio and in the sound card) is not completely flat across the entire AF spectrum, and tends to weaken signals at higher frequency. So then I used GoldWave's spectrum filter to do 2 things, filter out everything outside the bandwidth of the desired signal (approximately 16.5kHz wide signal), and also to boost the higher frequencies (frequencies near the upper part of the desired signal were about 17dB weaker than frequencies near the lower part of the desired signal). The last thing I did was to use GoldWave to FM demodulate the signal. This produces a much better FM demodulated signal than using the radio's FM mode (even when using a wide IF filter), as the radio's audio output is highpass filtered to block frequencies below common speech frequencies, which can block important low frequencies on some types of signals. This FM demodulated signal produces a sound that is very similar to what you would hear if you were listening to it with most scanners, and is what you should use to compare to other recordings of radio signals on the internet for the purposes of identifying the signal (the other two I included just so that someone could more thoroughly analyze the mode itself and maybe make a MultiPSK style soundcard-based decoder software for the mode). This FM demodulated copy has the advantage that only the DC component has been removed (calculate the average value for the entire recorded signal, and then subtract it from each sample in the signal), which makes sure that all low frequency audio remains (including frequencies that are well below the lowest hearable frequency). By doing FM demodulation in software, and not in the radio hardware, it makes sure that the entire content of the demodulated signal exists, so that it can be decoded into something meaningful using additional software (which I don't have now, as I don't know what digital mode it is that I am working with here). Also by using wideband USB mode, and demodulating it later in software I don't need direct access to the radio's discriminator (which usually is what's used for this purpose).

As these files are much too large to attach to this post (over 60MB), I have instead put the 3 WAV files in a ZIP file and uploaded that ZIP file to Mediafire. Below you will see a download link for that ZIP file on Mediafire.

Download link: https://www.mediafire.com/?6kshok2156nmnbl

File Descriptions:
Unknown Signal (866.027MHz, USB, IF-Width 50kHz, 6-23PM PST, 2-3-2015).wav
This is the raw signal as recorded on my computer. The sample rate is 48kHz.

Unknown Signal (866.027MHz, USB, IF-Width 50kHz, AF-Width 16.5kHz, Spectrum Equalized, 6-23PM PST, 2-3-2015).wav
This is the same as the above file, but with the spectrum equalized, and filtered to remove all frequencies above 16.5kHz. The sample rate is 48kHz.

Unknown Signal (866.027MHz, USB, IF-Width 50kHz, FM Demod, 6-23PM PST, 2-3-2015).wav
This file has the output of the final step I performed, FM demodulation. It sounds like what you would hear on most scanners when listening to the signal. The sample rate is 8kHz (samplerate is lower because demodulated signal only occupies 1.6kHz, so 4kHz nyquist limit is more than enough to hold this).



My own analysis of the signal:
It appears to consist of a multiple separate packets of data, with a fixed duration between packets. The duration appears to be about 18 seconds long (+/- 150ms).
The carrier is not maintained between transmissions, but rather is switched off.
The data packets are usually about 8 seconds long, though the exact duration will vary slightly based on content (the longest one I have seen is actually twice this long, indicating possibly that it's a special packet of some kind).
Each data packet starts with unmodulated carrier for a a period of exactly 870ms.
After this, each data packet is is modulated by square-wave, which switching the carrier between the highest frequency and lowest frequency. This part of the packet lasts for a duration of exactly 20ms. The square-wave appears to have a frequency of 800Hz.
After this comes data.
After this comes a final segment of unmodulated carrier. This last segment of the packet lasts 20ms.

Then there's also a rare packet type that I'm not sure what it is, but it's not a normal data packet, as it is much shorter than data packets. It only comes after a long string of data packets. It's possibly an "end of file" indicator, assuming that what's being transferred is a file. The duration of off-time between a data packet and this special packet is 5.86 seconds on the one that I recorded (rather than the normal 8 seconds, as between any 2 data packets), but this might vary (I don't have any others to compare it to that I recorded).
The duration of unmodulated carrier at the beginning of this special packet is 494ms.
Then there is a segment of squarewave modulated carrier, switching the carrier between lowest and highest frequencies, for a duration of 480ms. The frequency of the square wave is again 600Hz.
Then there is a very brief data segment, the vast majority of it appears to be repeating a specific pattern.
At the end of this packet there is a segment of unmodulated carrier lasting for a duration of 19ms.

Now in the data packets' data segments, there are a number of different types sub-modes in use. The data always is sent at 1600baud in this recording. However, I've seen on very rare occasions when 3200baud is used instead, but I don't have an example of this recorded, and usually it switches to 3200baud mid-packet and then back again, so 1600baud appears to be default. My description provide here is for the 1600baud signal. There's a standard 2-tone FSK, and also a 4-tone FSK (probably more properly called MFSK, as it uses more than two tones). There are also two different shifts in 2-tone FSK, a wider shift and a narrower shift. The two tones in wide 2-tone FSK are at center frequency +/- 5kHz. In 4-tone FSK it uses the same two tones as in 2-tone FSK, and also a tone that is 1/3 the distance between the lower and upper tone, and also a tone that is 2/3 between the lower and upper tone. From tone with lowest frequency to highest frequency, I will call them tone-1, tone-2, tone-3, and tone-4. Wide shift 2-tone FSK uses tone-1 and tone-4. Narrow shift 2-tone FSK uses tone-2 and tone-4 (though on some occasions think I've seen it use tone-1 and tone-3, but I don't have an example of this recorded). When in 4-tone FSK submode, it uses all 4 tones. It seems that at some times in the data portion of a packet there are square-wave alternations between tone-1 and tone-4. This may be how it represents long strings of binary 0s in the data it's sending or as some kind of field separator if the data is formatted into fields. I'm not sure about this.

Further analysis of this signal by somebody who's experienced in signal analysis is needed, if it is not already a well known signal type that is completely documented somewhere.
 
Status
Not open for further replies.
Top