• Effective immediately we will be deleting, without notice, any negative threads or posts that deal with the use of encryption and streaming of scanner audio.

    We've noticed a huge increase in rants and negative posts that revolve around agencies going to encryption due to the broadcasting of scanner audio on the internet. It's now worn out and continues to be the same recycled rants. These rants hijack the threads and derail the conversation. They no longer have a place anywhere on this forum other than in the designated threads in the Rants forum in the Tavern.

    If you violate these guidelines your post will be deleted without notice and an infraction will be issued. We are not against discussion of this issue. You just need to do it in the right place. For example:
    https://forums.radioreference.com/rants/224104-official-thread-live-audio-feeds-scanners-wait-encryption.html

VDL2 Ground Stations

DaveNF2G

Member
Premium Subscriber
Joined
Jan 23, 2001
Messages
9,084
Location
Rensselaer, NY
#1
Here are several GS identifiers that I have logged. There are a number of possible ground locations to which the messages could be directed (Montreal, Albany, Boston, JFK, Newark, Bradley, etc.) but I have found no correlations between traffic and likely ground station. Even aircraft locations correlate poorly to the possibilities.

10147A [] []
1014FA [] []
10258A [] []
102C0A [] []
102C1A [] []
10349A [] []
10405A [] []
10412A [] []
10456A [] []
1049AA [] []
104CBA [] []
10552A [] []
211197 [] []
213E77 [] []
22DE57 [] []
2441D7 [] []
251977 [] []
251979 [] []
261C37 [] []
261C38 [] []
282197 [] []

The brackets are placeholders for MultiPSK's VDL2_Ground_Stations.txt file.
 

DaveNF2G

Member
Premium Subscriber
Joined
Jan 23, 2001
Messages
9,084
Location
Rensselaer, NY
#2
I have plotted many VDL2 aircraft positions onto Google Earth and coded them according to the hex address of the ground station to which the message was directed.

The only spatial correlation I can see is that they are centered on my station, which is not surprising. I have about a 200-mile reception range for VDL2 reports and, naturally, my location should appear at the center of a collection of plots.

There seems to be no such correlation with respect to the ground station IDs. They appear to be nearly random, adjusting for the fact that the plots are generally along known arrival or departure routes for several major airports.

Physical location of the aircraft appears to be of no value in connecting hex IDs with ground station names.

There is a partial list of ground stations included with MultiPSK, mainly in Europe. I am curious to know how those stations were identified.

EDIT: In a few cases, there are multiple plots at certain locations directed at more than one GS. This might indicate that the hex codes involved are of multiple stations that are either in the same location or otherwise related to each other.
 
Joined
Aug 13, 2002
Messages
873
Location
Central Halton County, Ontario Canada
#3
Hi Dave and Merry Christmas!

Unlike legacy ACARS, VDL2 ground stations transmit a station identifier and an approximate LAT/LONG in the squitter message. All of the tabulated to date stations have been identified by people local to the location capturing the SQ messages, myself included in the case of Toronto CYYZ.

Example:

07/03/17 10:37:38 UTC
Broadcast address (hexa): FFFFFF (All aircraft)
Source address (hexa): 1030AA (Ground Station, delegated address [CYYZ Toronto 43°42'N 079°36'W] , On the ground , command frame)
XID (Exchange Identification) frame F=0
Data (hexa): 8280001C0109383838353A31393933020200010303208480050207D8060207D8F0001F000156040120C1044359595AC406000000000000C504FC020000C8031B5CE4
Public parameters:HDLC public parameter: 8885:1993
Classes of procedures (hexa): 0001
HDLC functions (hexa): 208480
I field length TX (hexa): 07D8
I field length RX (hexa): 07D8
Private parameter set identifier: V
AVLC specific options parameter (hexa): 20
Airports covered by the ground station: CYYZ TORONTO/PEARSON (ONTARIO)
ATN router nets:
* ADM identifier (hexa): 000000 User field (hexa): 000000
Station operator mask (address) (hexa): F00000
Ground station (+/- 3'): 43°42'N 079°36'W

07/03/17 10:43:37 UTC
Broadcast address (hexa): FFFFFF (All aircraft)
Source address (hexa): 2CE757 (Ground Station, delegated address [CYYZ Toronto 43°42'N 079°36'W] , On the ground , command frame)
XID (Exchange Identification) frame F=0
Data (hexa): 828000140109383838353A3139393302020001030320A488F0001F000156040120C1044359595AC406000000000000C50494000000C8031B5CE4
Public parameters:HDLC public parameter: 8885:1993
Classes of procedures (hexa): 0001
HDLC functions (hexa): 20A488
Private parameter set identifier: V
AVLC specific options parameter (hexa): 20
Airports covered by the ground station: CYYZ TORONTO/PEARSON (ONTARIO)
ATN router nets:
* ADM identifier (hexa): 000000 User field (hexa): 000000
Station operator mask (address) (hexa): 200000
Ground station (+/- 3'): 43°42'N 079°36'W


And just like legacy ACARS, the aircraft only needs to be in range of any ground station servicing the subscribed network (R/C-ARINC or SITA). Obviously a flight on the ground or operating at low level will likely connect to a closer station, but that's merely a factor of reception range. The stations are of course completely networked together (within each service provider's operation) so it's not at all important what station is servicing a particular exchange so long as the message sequence back and forth is successfully delivered. In Canada we have ground stations as some very remote airports and as the range of a particular station is anticipated as being 150NM at FL300 (going from memory of official documentation here so my number might be a bit out of whack) they don't have to be at major airports to service most traffic.

Cheers!

Bob
 
Last edited:

DaveNF2G

Member
Premium Subscriber
Joined
Jan 23, 2001
Messages
9,084
Location
Rensselaer, NY
#5
I guess I will have to sample VDL2 near my local airport to get its identifier(s).

Why are the same messages sent to multiple terminals?
 

DaveNF2G

Member
Premium Subscriber
Joined
Jan 23, 2001
Messages
9,084
Location
Rensselaer, NY
#9
I logged one case of an aircraft resending the same message every few seconds, alternating between two target addresses.

One of them was 211197 and I can't recall the other.
 
Joined
Aug 13, 2002
Messages
873
Location
Central Halton County, Ontario Canada
#10
Interesting. Of course seeing the network response from one or both would be the clue. Many years ago I logged a few occurrences on legacy ACARS where various aircraft would receive a response that (paraphrasing reasonably accurately here) "the account for XXXXXX has expired or is unpaid. Contact ARINC customer service at xxx-xxx-xxxx for assistance".

Bob
 

DaveNF2G

Member
Premium Subscriber
Joined
Jan 23, 2001
Messages
9,084
Location
Rensselaer, NY
#11
I sat at my local airport (KALB) for several hours on Monday and received no squitters on any ACARS frequency. There were no acknowledgments on VDL2 for data sent from aircraft on the ground, either. However, I did infer the VDL2 hex codes for KALB based on where the landed aircraft's messages were addressed.

Below is my current ground station list for MultiPSK. It is based on the one published by the software author, but sorted and edited for clarity.

10105A [CYVR Vancouver International 49°12'N 123°13'W] [Vancouver, BC]
1025FA [CYVR Vancouver International 49°12'N 123°13'W] [Vancouver, BC]
2CDA57 [CYVR Vancouver International 49°12'N 123°13'W] [Vancouver, BC]
1024FA [CYYZ Lester B Pearson 43°42'N 079°36'W] [Toronto, ON]
1030AA [CYYZ Lester B Pearson 43°42'N 079°36'W] [Toronto, ON]
2CE757 [CYYZ Lester B Pearson 43°42'N 079°36'W] [Toronto, ON]
214AB7 [EBBR Zaventem 50°54'N 004°30'E] [Brussels]
234838 [EDDF Frankfurt Am Main International 50°00'N 008°36'E] [Frankfurt]
219DD7 [EDDK Koeln 50°54'N 007°06'E] [Bonn]
219DD8 [EDDK Koeln 50°54'N 007°06'E] [Bonn]
225661 [EDDL Duesseldorf 51°18'N 006°48'E] [Duesseldorf]
225677 [EDDL Duesseldorf 51°18'N 006°48'E] [Duesseldorf]
10910A [EDDS Echter 48°42'N 009°12'E] [Stuttgart]
241597 [EFHK Vantaa 60°18'N 025°00'E] [Helsinki]
24159F [EFHK Vantaa 60°18'N 025°00'E] [Helsinki]
212317 [EGBB Birmingham 52°30'N 001°48'W] [Birmingham]
260F37 [EGLC London City 51°30'N 000°00'E] [London]
10987A [EGSS Stansted 51°54'N 000°12'E] [London]
10900A [EHAM Schiphol 136.975 MHz 52°18'N 004°48'E] [Amsterdam]
11900A [EHAM Schiphol 136.875 MHz 52°18'N 004°48'E] [Amsterdam]
20B661 [EHAM Schiphol 136.875 MHz 52°18'N 004°48'E] [Amsterdam]
20B662 [EHAM Schiphol 136.875 MHz 52°18'N 004°48'E] [Amsterdam]
20B665 [EHAM Schiphol 136.775 MHz 52°18'N 004°48'E] [Amsterdam]
20B677 [EHAM Schiphol 136.975 MHz 52°18'N 004°48'E] [Amsterdam]
20B678 [EHAM Schiphol 136.975 MHz 52°18'N 004°48'E] [Amsterdam]
10920A [EPWA Chopin 52°12'N 021°00'E] [Warsaw]
2B86E1 [EPWA Chopin 136.875 MHz 52°12'N 020°54'E] [Warsaw]
2B86F7 [EPWA Chopin 52°12'N 020°54'E] [Warsaw]
10147A [KALB Albany International 42°44'N 073°49'W] [Albany, NY]
10349A [KALB Albany International 42°44'N 073°49'W] [Albany, NY]
10412A [KALB Albany International 42°44'N 073°49'W] [Albany, NY]
10495A [KATL Hartsfield-Jackson International 33°36'N 084°24'W] [Atlanta, GA]
10550A [KATL Hartsfield-Jackson International 33°36'N 084°24'W] [Atlanta, GA]
20D197 [KATL Hartsfield-Jackson International 33°36'N 084°24'W] [Atlanta, GA]
20D198 [KATL Hartsfield-Jackson International 33°36'N 084°24'W] [Atlanta, GA]
10204A [KBWI Baltimore Washington International 39°12'N 076°42'W] [Baltimore, MD]
1054BA [KBWI Baltimore Washington International 39°12'N 076°42'W] [Baltimore, MD]
10416A [KCMH John Glenn International 40°00'N 082°54'W] [Columbus, OH]
10545A [KDCA Reagan National 38°54'N 077°00'W] [Washington, DC]
220C37 [KDCA Reagan National 38°54'N 077°00'W] [Washington, DC]
10205A [KDEN Denver International 39°54'N 104°42'W] [Denver, CO]
10345A [KDEN Denver International 39°54'N 104°42'W] [Denver, CO]
1050AA [KDEN Denver International 39°54'N 104°42'W] [Denver, CO]
2215D7 [KDEN Denver International 39°54'N 104°42'W] [Denver, CO]
2215D8 [KDEN Denver International 39°54'N 104°42'W] [Denver, CO]
2215D9 [KDEN Denver International 39°54'N 104°42'W] [Denver, CO]
10142A [KIAD Washington Dulles International 38°54'N 077°30'W] [Dulles, VA]
10509A [KIAD Washington Dulles International 39°00'N 077°30'W] [Dulles, VA]
10209A [KIND Indianapolis International 39°42'N 086°18'W] [Indianapolis, IN]
10543A [KIND Indianapolis International 39°42'N 086°18'W] [Indianapolis, IN]
24B898 [KIND Indianapolis International 39°42'N 086°18'W] [Indianapolis, IN]
260677 [KLAS Mc Carran International 36°06'N 115°12'W] [Las Vegas, NV]
10146A [KLAX Los Angeles International 33°54'N 118°24'W] [Los Angeles, CA]
10346A [KLAX Los Angeles International 33°54'N 118°24'W] [Los Angeles, CA]
10540A [KLAX Los Angeles International 33°54'N 118°24'W] [Los Angeles, CA]
260717 [KLAX Los Angeles International 33°54'N 118°24'W] [Los Angeles, CA]
260718 [KLAX Los Angeles International 33°54'N 118°24'W] [Los Angeles, CA]
260719 [KLAX Los Angeles International 33°54'N 118°24'W] [Los Angeles, CA]
268D37 [KMCI Kansas City International 39°18'N 094°42'W] [Kansas City, MO]
268DF8 [KMCO Orlando International 28°24'N 081°18'W] [Orlando, FL]
26CE17 [KMSP Wold-Chamberlain International 44°54'N 093°12'W] [Minneapolis, MN]
10342A [KPIT Pittsburgh International 40°30'N 080°12'W] [Pittsburgh, PA]
282697 [KPIT Pittsburgh International 40°30'N 080°12'W] [Pittsburgh, PA]
10208A [KSAN San Diego International 32°42'N 117°12'W] [San Diego, CA]
10553A [KSAN San Diego International 32°42'N 117°12'W] [San Diego, CA]
2985D7 [KSAN San Diego International 32°42'N 117°12'W] [San Diego, CA]
2985D8 [KSAN San Diego International 32°42'N 117°12'W] [San Diego, CA]
29B078 [KSLC Salt Lake City International 40°48'N 112°00'W] [Salt Lake City, UT]
10406A [KSTL Lambert International 38°42'N 090°24'W] [St. Louis, MO]
10554A [KSTL Lambert International Airport 38°42'N 090°24'W] [St. Louis, MO]
29D197 [KSTL Lambert International 38°42'N 090°24'W] [St. Louis, MO]
2125F7 [LEBB Sondica 43°18'N 002°54'W] [Bilbao]
210DD7 [LEBL Barcelona-El Prat 41°18'N 002°06'E] [Barcelona]
210DD8 [LEBL Barcelona-El Prat 41°18'N 002°06'E] [Barcelona]
10909A [LFPO Orly International 48°42'N 002°24'E] [Paris]
27CB37 [LFPO Orly International 48°42'N 002°24'E] [Paris]
233D37 [LPFR Algarve 37°18'N 008°36'W][Faro]
102C8A [PHNL Daniel K Inouye International 21°18'N 157°54'W] [Honolulu, HI]
104D9A [PHNL Daniel K Inouye International 21°18'N 157°54'W] [Honolulu, HI]
F00643 [RJAA Narita International] [Tokyo]
F00644 [RJAA Narita International] [Tokyo]
F00645 [RJTT Haneda International] [Tokyo]
F00646 [RJTT Haneda International] [Tokyo]
10A48A [YSSY Kingsford Smith] [Sydney]
29E497 [YSSY Kingsford Smith] [Sydney]
29E498 [YSSY Kingsford Smith] [Sydney]
 
Joined
Apr 25, 2012
Messages
7
#12
I found 136.650 in very light use (136.975 is very busy). I'm in Reno, NV. The traffic so far lists 1131EA as the destination address but one flight I picked up was headed back east out of San Francisco and the other was headed to Seattle from southern California. I noticed 136.650 had VDL2-like "blips" and sure enough, there are planes there. I don't see this frequency on any documentation. I will let this run several days at least, so far only three decodable (some of these are visible but quite weak)

Reno ground station address is 2939F7

Vince
 

AirScan

Member
Premium Subscriber
Joined
Feb 13, 2007
Messages
323
#13
Just got up and running with an SDRPlay-RSPduo using dumpvdl2 software (Linux) to decode.

Can add 10307A = CYOW to the list.

[2018-09-13 16:34:55 EDT] [136.975] [-39.1/-51.0 dBFS] [11.9 dB] [-2.3 ppm]
10307A (Ground station, On ground) -> FFFFFF (Aircraft): Command
AVLC: type: U (XID) P/F: 0
XID: Ground Station Information Frame
Public params:
Parameter set ID: 8885:1993
Procedure classes: 00 01
HDLC options: 20 84 80
N1-downlink: 07 d8
N1-uplink: 07 d8
VDL params:
Parameter set ID: V
AVLC specific options: 20
Airport coverage: CYOW
ATN router NETs: 00 00 00 00 00 00 "......"
System mask: fc 02 00 00
Ground station location: 45.3N 75.7W

Anyone in the northeast have any more ? Montreal ? Syracuse ? Quebec City ? Burlington ? Rochester ? Is the list being updated somewhere ?

AS
 

EricCottrell

Member
Database Admin
Joined
Nov 8, 2002
Messages
2,263
Location
Boston, Ma
#16
Hello,

I live about eight miles from Logan Airport in Boston and decided to try decoding VDL2. I am using dumpvdl2 using the SDRPlay. There was a segmentation fault and I had to add a parameter to a callback function in the code to use the latest Linux drivers.

I was able to receive aircraft on the ground at Logan. Here are the ground stations I could receive:

10503A (Ground station, On ground) -> FFFFFF (Aircraft): Command
AVLC: type: U (XID) P/F: 0
XID: Ground Station Information Frame
Public params:
Parameter set ID: 8885:1993
Procedure classes: 00 01
HDLC options: 20 84 80
N1-downlink: 07 d8
N1-uplink: 07 d8
VDL params:
Parameter set ID: V
AVLC specific options: 20
Airport coverage: KBOS
ATN router NETs: 00 00 00 00 00 00 "......"
System mask: fc 02 00 00
Ground station location: 42.4N 71.0W

1034DA (Ground station, On ground) -> FFFFFF (Aircraft): Command
AVLC: type: U (XID) P/F: 0
XID: Ground Station Information Frame
Public params:
Parameter set ID: 8885:1993
Procedure classes: 00 01
HDLC options: 20 84 80
N1-downlink: 07 d8
N1-uplink: 07 d8
VDL params:
Parameter set ID: V
AVLC specific options: 20
Airport coverage: KBOS
ATN router NETs: 00 00 00 00 00 00 "......"
System mask: fc 02 00 00
Ground station location: 42.4N 71.0W

213E77 (Ground station, On ground) -> FFFFFF (Aircraft): Command
AVLC: type: U (XID) P/F: 0
XID: Ground Station Information Frame
Public params:
Parameter set ID: 8885:1993
Procedure classes: 00 01
HDLC options: 20 a4 88
VDL params:
Parameter set ID: V
AVLC specific options: 20
Timer T4: 00 02
Airport coverage: KBOS
ATN router NETs: 00 00 00 00 00 00 "......"
System mask: 94 00 00 00
Ground station location: 42.4N 71.0W

I think there is one more at Logan. I came across a document from the late 2000s that indicated a whole bunch of VDL2 stations in the US.

73 Eric
 

krokus

Member
Premium Subscriber
Joined
Jun 9, 2006
Messages
3,638
Location
Southeastern Michigan
#19
It looks like this mode is better to monitor, if near an airport. How likely is it to intercept stuff from the aircraft near a major city?

Sent using Tapatalk
 

kma371

Global DB Admin
Database Admin
Joined
Feb 20, 2001
Messages
6,190
#20
New to the VDL2 game. Heres some ground stations I've monitored and notes on where I was able to hear them.

California

278578 valley/bay area
10103a valley
10315a valley/bay area
10409a valley/bay area
10507a valley/bay area
10519a bay area
1031ea bay area
29a877 bay area
2999f8 bay area
29b4d8 bay area
10440a bay area
29b4d8 bay area
1015ca bay area
1031ea bay area
 
Top