Unknown UHF - ENC 451.80000

spacellamaman

Member
Joined
Aug 22, 2014
Messages
1,288
Location
municipality of great state of insanity
i dunno what the landscape looks like now, but mostly around 2011-13 i found an insanely effective way to do something similar using a basic netbook, a program called netstumbler (many others out there but liked the way this one worked) and some usb extension cords and various usb wifi adapters.

it started out just driving around trying to find good wifi signals, cause i am cheap, and generally privacy oriented, and noticing the router names, some with interesting patterns. NC LE was just getting rolling hooking up in car networks. I first noticed it with NCSHP and, living in raleigh at the time, RPD soon had virtually everything that rolled set up. Small town PDs not so much, but last time i bothered sniffing at all was prob 5 years ago, but even then the local NCWRC boys had em. I can only imagine what its like now.

verizon/novatel mifi cards were quite popular, with a handful of others and you could set the program to audible alert on things like specific mfg, which quite luckily the ones i was interested in were not broadcasting a widely used mfg like huiwei or lyncsys etc. all networks were locked of course, which was fine with me, but my lord were they detectable. i might get 2% signal strength on the first hit, but it gave me all the specifics from that, and at 80mph and distances as high as a mile range, frankly i thought i was in heaven.

On long stretches of Hwy 64 outside of Raleigh where speed traps were well suited, you would have sections of gently rolling highway, that was dead straight, 4 lane and lightly used, begging to be driven at least 150% the speed limit. The troopers knew this, would be in the median at the bottom of one of these gentle rolls, setting up for an easy short range shot. Troopers tend to to be the most dangerous of hunters, keeping their radar guns quiet, waiting til they can see the whites of our eyes, and then manually triggering the radar gun. Being quite aware of LOS signal travel, if the trough was deep enough, there was little to worry about just leaving it on, wide open. They were aware that those suckers with radar detectors would hear narry a peep until we... um they would pop over the crest, catching a little air and a kiss-me-quick to be met by the thrill and horror of the deafening lightshow emanating from the dash of our own car, swiftly followed by a similar show viewed in the rearview mirror.

Multiple test runs showed a wifi adapter merely hooked on the rearview mirror with rubber bands via coax extention to a netbook in the passenger seat, gave me 5-10 seconds warning prior to my radar detector giving me notice. The crazy thing was, occasionally i got Over The Horizon reception at sometimes unbelievable ranges.

It became a rather intensive hobby for a while.

Anyhoo, something to think about :)
 

RaleighGuy

Member
Premium Subscriber
Joined
Jul 15, 2014
Messages
13,119
Location
Raleigh, NC
I am preparing for the day my local PD goes with encryption. I have studied wide band Aperiodic Receivers which were used in WWII to intercept clandestine transmissions. The design is very crude, a very simple receiver.

Yes, I know you are listening and what you are listening to because your radio is telling me.


 

RFI-EMI-GUY

Member
Joined
Dec 22, 2013
Messages
6,859
i dunno what the landscape looks like now, but mostly around 2011-13 i found an insanely effective way to do something similar using a basic netbook, a program called netstumbler (many others out there but liked the way this one worked) and some usb extension cords and various usb wifi adapters.

it started out just driving around trying to find good wifi signals, cause i am cheap, and generally privacy oriented, and noticing the router names, some with interesting patterns. NC LE was just getting rolling hooking up in car networks. I first noticed it with NCSHP and, living in raleigh at the time, RPD soon had virtually everything that rolled set up. Small town PDs not so much, but last time i bothered sniffing at all was prob 5 years ago, but even then the local NCWRC boys had em. I can only imagine what its like now.

verizon/novatel mifi cards were quite popular, with a handful of others and you could set the program to audible alert on things like specific mfg, which quite luckily the ones i was interested in were not broadcasting a widely used mfg like huiwei or lyncsys etc. all networks were locked of course, which was fine with me, but my lord were they detectable. i might get 2% signal strength on the first hit, but it gave me all the specifics from that, and at 80mph and distances as high as a mile range, frankly i thought i was in heaven.

On long stretches of Hwy 64 outside of Raleigh where speed traps were well suited, you would have sections of gently rolling highway, that was dead straight, 4 lane and lightly used, begging to be driven at least 150% the speed limit. The troopers knew this, would be in the median at the bottom of one of these gentle rolls, setting up for an easy short range shot. Troopers tend to to be the most dangerous of hunters, keeping their radar guns quiet, waiting til they can see the whites of our eyes, and then manually triggering the radar gun. Being quite aware of LOS signal travel, if the trough was deep enough, there was little to worry about just leaving it on, wide open. They were aware that those suckers with radar detectors would hear narry a peep until we... um they would pop over the crest, catching a little air and a kiss-me-quick to be met by the thrill and horror of the deafening lightshow emanating from the dash of our own car, swiftly followed by a similar show viewed in the rearview mirror.

Multiple test runs showed a wifi adapter merely hooked on the rearview mirror with rubber bands via coax extention to a netbook in the passenger seat, gave me 5-10 seconds warning prior to my radar detector giving me notice. The crazy thing was, occasionally i got Over The Horizon reception at sometimes unbelievable ranges.

It became a rather intensive hobby for a while.

Anyhoo, something to think about :)

I am blown away. You could be the next Michael Valentine (Cincinatti Microwave radar detectors)!
 

spacellamaman

Member
Joined
Aug 22, 2014
Messages
1,288
Location
municipality of great state of insanity
I am blown away. You could be the next Michael Valentine (Cincinatti Microwave radar detectors)!


well very nice of you to say but it certainly doesn't function the same, false alerts will be constant as LE presence doesn't equate to a speed trap, but there are plenty more reasons one might want to alter their behavior. not to mention, use of this technique is certainly not limited to mobile applications.

i set up things at my house in such a manner, that i could detect vehicles on the street in front of my house and the parallel street running one house behind me, both lightly traveled residential side streets. by adjusting the positioning of the wifi adapters at each corner of the house for optimum attenuation, i could prevent signal reception from the heavily trafficked main-drags that each side street intersected with. otherwise it was a constant stream of alerts as everyone went about their daily business.

the adapters were all connected into a central computer with coax extensions, and the audio alerts run through to stereo speakers that were already distributed through the house. it limited things quite nicely and allowed for peace of mind if, say for instance, i wasn't expecting visitors, yet had a knock at the door.

purely serendipity that i came across this though, and at the time internet searches found little to no public discussion of this interesting fact. i can presume various actors were aware but preferred not sharing it, though by now, it must be more widely known, at least in some circles.

as time went on, other services/departments adopted the same type hardware and a simple alert based on MFG became less reliable as a "LE-only" detection technique, as FDs, ambulances, solid waste services, public transit vehicles, dog-catcher etc were outfitted.

so at the cost of simplicity things had to be more refined. the program, netstumbler, allowed one to add notes for a particular MAC address. with a MAC address being pretty close to a unique ID, rolling up behind someone who might have a particular wireless card on-board, and seeing 100% signal strength reading, allowed a theoretical database to be compiled of physical identifying features of a subject vehicle/driver. so when an audible alert was heard, it was necessary to glance at the screen and see who exactly it was that had just been detected. thankfully, i never once noted an instance where a particular wireless card was transferred from one vehicle to another, tho upgraded models were occasionally installed, but so rarely as to not be of a concern.

eventually one finds oneself in a "collect-them-all" mindset which can create an overwhelming urge to violate rules of discretion while trying to get a complete collection for a particular group. or so i would imagine.
 

BigLebowski

Member
Premium Subscriber
Joined
May 5, 2004
Messages
893
Location
Piedmont NC
Had to go town toward Rockingham today. Passing by the Uwharries I heard 43.04 digital and 154.5275 $167 were active. I also got a single hit on 158.400 $167. The majority of the activity was on 43.04 but it was faint from 220.
 

RFI-EMI-GUY

Member
Joined
Dec 22, 2013
Messages
6,859
There was some research to study the EM and RF emissions from vehicles and the study concluded that you could determine make and model from the emissions. Adding the electronic installed by upfitters and the drivers themselves, you could identify an individual vehicle. Sensors would have to be placed close by.
 
Last edited:

Flyham

Member
Joined
Sep 18, 2006
Messages
363
Location
Purplexed
Had to go town toward Rockingham today. Passing by the Uwharries I heard 43.04 digital and 154.5275 $167 were active. I also got a single hit on 158.400 $167. The majority of the activity was on 43.04 but it was faint from 220.

I think it's Robin Sage time down in the Uhwarries, Southern Piedmont and Sandhills regions of NC.
In the same time frame as BigLebowski's observations. I was hearing some voice traffic in the 35 & 43 mhz range as well. I don't have a log close by but I think ROPER, OKIE, and OMAHA may have been used.

I also concur that 451.800mhz has went cold. That one was good while it lasted.
 

spacellamaman

Member
Joined
Aug 22, 2014
Messages
1,288
Location
municipality of great state of insanity
Had to go town toward Rockingham today. Passing by the Uwharries I heard 43.04 digital and 154.5275 $167 were active. I also got a single hit on 158.400 $167. The majority of the activity was on 43.04 but it was faint from 220.

awww man that is excellent. so that leads one to believe the origins may be more to the eastern edge of the Uwharries then, perhaps NE, which might explain why i havent rx squat yet. you rx'd the 150's at the same time? Passing the Uwharries on 220? Weak signal as well?

not to mention 158.4 is on the WQZU830 list for phoenix. maybe this has been sage related the whole time. the geographical areas and time frames generally overlap. not to mention phoenix address in fayetteville.

I think it's Robin Sage time down in the Uhwarries, Southern Piedmont and Sandhills regions of NC.
In the same time frame as BigLebowski's observations. I was hearing some voice traffic in the 35 & 43 mhz range as well. I don't have a log close by but I think ROPER, OKIE, and OMAHA may have been used.

Quite right you are, i believe this is Day+8. I can confirm that every single instance of digital/encrypted 43.04mhz being recieved and reported here in the forums was during a Robin Sage iteration or the immediate prior run-up days, the very first time being Day -2 IIRC, which is to say 2 days before INFIL.

now this doesn't mean much but for the first time in a couple of weeks i have been recieving some low band skip today, but none of it military related though. a year or two ago, a few days of skip from a heavy mil-training area, right in the middle of an iteration caused me headaches cause all of the tx's were in the clear and made no sense contextually, though i forget why. i eventually heard a mention of "rtb to Kxxx" and didn't recognize the airport. looked it up and it was some huge training area, either alabama or texas. so i had to trash all my notes up until that point.
 

RFI-EMI-GUY

Member
Joined
Dec 22, 2013
Messages
6,859
What kind of encryption is being used on 43.04 MHz? The use of that frequency suggests commercial Part 90 radios because unlike many Military radios that resolve only 25 KHz or 12.5 KHz channels, Part 90 radios in low band can resolve to 5.0 KHz channel steps. If the encryption is P25 that would be quite unusual. If it were CVSD that implies some rather old SyntorX type equipment like sold by Mechem Electronics. If it is some audible analog bucket brigade form, that would be more likley.

-----

These frequencies are licensed for itinerant use in the US and may have activity from time to time. Anyone eligible for a Part 90 license could license these frequencies. Interestingly, NIFOG has a section for itinerant frequencies, including these, so they expect federal interoperability in an emergency.

27.49 Base or Mobile 10.
35.04 Base or Mobile 10.
43.04 Base or mobile 17.

(10) This frequency will be assigned only to stations used in itinerant operations, except within 56 km (35 miles) of Detroit, Mich., where it may be assigned for either itinerant or permanent area operations (i.e., general use).

(17) This frequency will be assigned only to stations used in itinerant operations.
 

BigLebowski

Member
Premium Subscriber
Joined
May 5, 2004
Messages
893
Location
Piedmont NC
Its definately not P25, and not the white noise type you hear with DES.

FYI.. modern military gear will tune any frequency. It will take 43.999 if you punch it in.
 

RFI-EMI-GUY

Member
Joined
Dec 22, 2013
Messages
6,859
Big Lebowski
I must be 40 years behind on "green radios".

Regarding the encryption, there are encryption devices that scramble the audio in time domain and sound like martian talk. Others like data modem in the voice range. You simply attach them is series with the hand set.
 

BigLebowski

Member
Premium Subscriber
Joined
May 5, 2004
Messages
893
Location
Piedmont NC
Well since they are running AES-256 on VHF and UHF I expect its something similar on low band, not some low grade rolling code stuff.
 

RFI-EMI-GUY

Member
Joined
Dec 22, 2013
Messages
6,859
Marconi and Seimens have a number of products that use proprietary encryption that interface with analog radios. There are some other lesser known companies as well such as the Technical Communication Corp DSP 9000 .

some sounds here:


 

Flyham

Member
Joined
Sep 18, 2006
Messages
363
Location
Purplexed
Well since they are running AES-256 on VHF and UHF I expect its something similar on low band, not some low grade rolling code stuff.

I wonder if NSA Type-1 encryption is a possibility, especially given the potential to be Robin Sage related? Reading these 2 links makes me wonder, even though equipment in the first link is more for HF.

*
Marine Corps picks HF radio systems from L3Harris that offer NSA Type-1 encryption for information security
*
Harris wins contract to provide Special Operations forces with new manpack radio
 

spacellamaman

Member
Joined
Aug 22, 2014
Messages
1,288
Location
municipality of great state of insanity
yeah this issue with the 43.04 and the other low-band encrypted has been a bit of an enigma. its not P25 as far as i can tell. i bought a 436HP 2 years ago specifically to double check that my pro668 wasn't missing something. i had been hearing the stuff for 2 years previous to that but was convinced it was some sort of data or blue-force tracking signal. it took me forever to be certain it wasn't simply random static/noise because....it basically sounds like standard low band static/noise. the key for me at least, was noticing the sharp on/off in signal strength when a transmitter was nearby. with the squelch down, occasionally a transmission would could be heard initiate with a sharp high-pitched chirp as well, so brief that it was over before the scanner would kick in the audio. AM mode gives some measure to notice discrete differences, if you think its unlikely that anything in the clear might come over.

when chris parris first reported the Low-Band P25 reports, roughly the time period that the first 43.04 report came in i really went nuts. i had never noted any occasion where a "static" frequency had carried in the clear comms back to back. for that matter the "static frequencies" (of which there are maybe ten i have noted over the years, with mainly 3-4 of them making up 95% of the noted total airtime) i have only heard in the clear comms on maybe 2 of them ever, not to say that means anything tho. so i got concerned that, hmmmm i have no way to test if perhaps the pro668 isn't even set up to recieve P25, certainly it should, but if making it do so required extra engineering or expense, well why should it? so i bought a 436hp. not P25, not that it sounded like it, or much of anything for that matter.

i wouldn't make much of the xx.04 bit, like biglebowski said they'll take bout anything. i know that some of the FLIPPER CH-47s from the bragg area use 41.88FM which suprised me at the time. it was a Close Call hit and since they were chit chatting i had time to manually punch it in to other scanners and nothing was recieved on 41.875 or 41.9 while i was hearing them on 41.88. subsequntley reading through a manual for a common use radio on the Ch47s it stated something like "blah blah blah channels in 25khz steps" with a side note that you could adjust 5 or 10 khz up or down from each 25khz channel manually.
 

richardbritt

Member
Database Admin
Joined
Sep 17, 2006
Messages
388
Location
Northeastern NC
By any chance did any of the 451.8 comms seem as it could have been the group of pick up trucks and suvs mixing up the protesters to go from peaceful to more violent? It is possible that the security company was involved. Most of them had Arizona license plates from what I heard from listening to the police radio traffic in Charlotte and Raleigh.

Just curious because of the timing and the encryption of the signals.

Also using out of state license plates is very common with CIA and other federal agencies working clandestine ops.

Just a thought

Regards Richard
 

JSTARS03

Monitor
Premium Subscriber
Joined
Jun 10, 2003
Messages
159
Location
Sunny Florida
eventually one finds oneself in a "collect-them-all" mindset which can create an overwhelming urge to violate rules of discretion while trying to get a complete collection for a particular group. or so i would imagine.

Glad I am not the only one who monitors WIFI for Law Enforcement vehicles.
JSTARS03
 

BigLebowski

Member
Premium Subscriber
Joined
May 5, 2004
Messages
893
Location
Piedmont NC
451.800 was 99.9% encrypted with AES-256 other than the one time when an air unit called ground. 469.550, 154.5275, and 43.04 were 100% encrypted.

By any chance did any of the 451.8 comms seem as it could have been the group of pick up trucks and suvs mixing up the protesters to go from peaceful to more violent? It is possible that the security company was involved. Most of them had Arizona license plates from what I heard from listening to the police radio traffic in Charlotte and Raleigh.

Just curious because of the timing and the encryption of the signals.

Also using out of state license plates is very common with CIA and other federal agencies working clandestine ops.

Just a thought

Regards Richard
 

Flyham

Member
Joined
Sep 18, 2006
Messages
363
Location
Purplexed
As I've read the forum I've started making a more concentrated effort to scan the itinerants allowed on VHF Lo, VHF HI, and UHF.
Thinking things might have settled down. I opted for early evening drive down I-85 in a circuit from Greensboro to Thomasville and back thru High Point. While no VHF Lo or High traffic was noted. I did faintly hear 451.800 (again in its seemingly normal P25 / ENC self) as I was southbound out of Greensboro. However I did get a few hits on a "new to me anyways" freq of 451.8125 FM with PL TONES being both CSQ and 151.4 as I got closer to Thomasville. I think I heard mentions of large chair and statues. I was driving down I-85 amongts the people who think the Interstate designation is the posted speed limit. So obviously paying full attention to the receiver was not a priority!
 

BigLebowski

Member
Premium Subscriber
Joined
May 5, 2004
Messages
893
Location
Piedmont NC
451.800 $167 popped up again at about 0200 this morning in Greensboro which just happened to coincide with a large scale disorder/shooting/homicide that happened on Spring Garden Street. All enc of course. It has remained active this afternoon and as I drove around Randolph County this afternoon 154.5275 $167 was active as well with marginal signals, simplex I think and all 100% enc.
 
Last edited:
Top