DSDPlus Choppy Capacity Plus Rest Ch or Something New?

[inigo88]

Using DSD Plus v1.101 and SDR#, I came across what could best be described as a "choppy" Capacity Plus Rest Channel.

It has the same sound and timing as a Capacity Plus rest channel idle burst, but the burst itself is chopped up in the waterfall display. DSDPlus v1.101 recognizes it as DMR Cap+ with DCC 10, but then mistakes the bursts for MS DATA and voice frames and tries to decode it as encrypted voice. It also does not display the LSN of the current frequency and just gives a "? CC" symbol. The rest channel idle burst stays put on one frequency for a couple minutes, then broadcasts the FCC CW ID and rotates to the next frequency in the system, so other than the odd decode it behaves like a regular Capacity Plus system.

In a few of the attached screenshots the channel activity window shows it as Connect Plus, however that was an error on my part not resetting DSDPlus between monitoring a nearby Connect Plus control channel and this rest channel.

I have no experience with Capacity Plus with RAS, but I thought that DSDPlus v1.101 could recognize it. Could that be what I'm seeing causing the erroneous encrypted voice decode?

I also caught a CW ID of "WPMS97", which was a typo in CPS by some radio tech who was trying to type WPMS976.

FCC Callsign WPMS976 (Fisher Wireless Services, Inc.)

FCC Callsign WPMS976 (Fisher Wireless Services, Inc.)

www.radioreference.com

That license belongs to Fisher Wireless and the system appears to be located on Mt Otay near San Diego, CA (and sharing the same license as Fisher Wireless' Teamtalk Connect Plus site 119-1 also located there).

I've seen the "choppy" rest channel on the following frequencies, all DCC 10 and all are on the WPMS976 license:

451.2625
451.9125
452.2125
452.2375
452.3875
463.4375
463.9000

Anybody know what this is? Thanks for any help you guys can provide!

 

[TheButcher]

Very old version of DSD+. FL is very good software... That would be my suspicion.

FL = Fast-lane, by the way...

 

[Forts]

So are you saying those encrypted transmissions actually aren't? I monitor a Capacity Plus system here at work without issue (using the current FastLane release). I don't think I have any Cap+ systems around me that use RAS, only CapacityMax stuff.

 

[mikewazowski]

I’ve watched a Cap+ system with RAS and EP and haven’t seen what you’re seeing.

 

[a417]

Can you try it with w/o SDR# in the mix and with a more recent DSD version? I also am mapping a Cap + system and have not seen that with my setup.

 

[inigo88]

Thanks all for the replies. I don’t have Fast Lane yet, but planning on purchasing it soon. I dusted off Ian’s DMRDecode b74 for a second opinion, and the choppy idle bursts don’t decode at all. So I now suspect that this is a regular Capacity plus system which is experiencing some sort of technical issue that’s causing the idle bursts to transmit chopped up like that. I’ll follow up with a recording of idle bursts for reference.

So are you saying those encrypted transmissions actually aren't? I monitor a Capacity Plus system here at work without issue (using the current FastLane release). I don't think I have any Cap+ systems around me that use RAS, only CapacityMax stuff.

That’s correct. Listening to the sound, they are simply Capacity plus rest channel idle bursts intermixed with static. However DSD+ (pre-FL) was interpreting the idle bursts as encrypted voice frames. On the other hand, DMRDecode b74 (also quite old) doesn’t recognize the bursts as DMR at all. The repeater site is very nearby so I think that whatever was causing the static choppiness is on the repeater side. I wasn’t sure whether this was a technical error with regular Cap+, or some new variant entirely.

 

[slicerwizard]

DSD+ (pre-FL) was interpreting the idle bursts as encrypted voice frames.

Encrypted or full of errors?

Decoding polarity needs to be flipped...

 

[Ubbe]

It has the same sound and timing as a Capacity Plus rest channel idle burst, but the burst itself is chopped up in the waterfall display.

Could it be chopped up as if transmitting only in one timeslot and key off in the other timeslot as in a mobile transmission?

/Ubbe

 

[slicerwizard]

Hm, based on the screen shots, it's a portable or mobile radio transmitting where one would normally find base stations (repeaters); it likely has nothing to do with Capacity Plus. Use of voice encryption just adds to the "illegal transmission" aroma.

 

[inigo88]

Hm, based on the screen shots, it's a portable or mobile radio transmitting where one would normally find base stations (repeaters); it likely has nothing to do with Capacity Plus. Use of voice encryption just adds to the "illegal transmission" aroma.

That’s really odd. I’m embarrassed to admit I haven’t had the chance to monitor Mototrbo simplex or repeater inputs, but that makes a lot of sense that the audio would sound “choppy” since I’m only seeing one of the two time slots.

The reason I assumed a Capacity Plus was because the “idle bursts” were identical in frequency (about once every 2 seconds) and duration as a Capacity plus rest channel. The DSD+ activity window also shows “Cap+ DCC 10” in the bottom bar, though not always consistently. The idle bursts would continue on that frequency for a couple minutes, then stop and CW ID (“WPMS97”, which was a typo for WPMS976), then the idle bursts would move to the next frequency in sequence written in my original post. This behavior reminded me a lot of Capacity Plus rest channels rotating through the system’s available LSNs, but I have never heard a real Capacity Plus system CW ID every time a rest channel moves to a new frequency...

So if it’s a mobile radio doing all of the above on an encrypted talkgroup on a single time slot, I guess my next question is why?

 

[Ubbe]

The idle bursts would continue on that frequency for a couple minutes, then stop and CW ID (“WPMS97”, which was a typo for WPMS976), then the idle bursts would move to the next frequency in sequence written in my original post.

It has to be a basestation when it sends CW and perhaps it only has a 6 character memory for that. As the idle move between channel it has to have interconnection between them, so absolutly a basestation system that only have one timeslot active during idle for some reason. Maybe it's a new ploj to promote a power saving eco mode that are enviroment friendly. They have to come up with all those things to have a feature to offer above their competitors and that also will reduce the pollution of earth. It probably doesn't matter to mobiles and portables if the voice slot are not transmitted.

/Ubbe

 

[a417]

when it sends CW and perhaps it only has a 6 character memory for that.

More likely a typo or someone fat-fingering the ID field.

7 character FCC IDs have been in use for decades, and it would be a pretty epic c0ck-up for a manufacturer modern enough to be building DMR hardware to make a mistake like having insufficient CW ID field spaces.

 

[inigo88]

Thanks all for your interest in this little mystery. Here is a short recording of the tail end of the idle bursts and the CW ID. It's an mp3 and might not decode due to compression, but if anyone really wants to try you can PM me your email and I could send it over that way.

 

[inigo88]

Hm, based on the screen shots, it's a portable or mobile radio transmitting where one would normally find base stations (repeaters); it likely has nothing to do with Capacity Plus. Use of voice encryption just adds to the "illegal transmission" aroma.

@slicerwizard , now that I’ve posted the audio sample are you still thinking this is a mobile transmitting on one time slot? The signal is coming in at a power level as if it were originating from a repeater.

If the license is correct then that site on Mt Otay is very near the Mexican border. I’m starting to wonder if they have a mobile hooked up to an amplifier and repeater Tx antenna programmed to key up once every 2 seconds on that encrypted talkgroup and imitate Capacity Plus? Perhaps we are seeing some “international frequency coordination” in action and they are essentially reserving those frequencies by annoying any would be frequency users on the Mexico side?

 

[GTR8000]

DMR TDMA subscribers transmit in 30ms bursts on/off, not 2 seconds apart. I doubt this is a legit subscriber transmitting if the bursts are that far apart.

 

[inigo88]

DMR TDMA subscribers transmit in 30ms bursts on/off, not 2 seconds apart. I doubt this is a legit subscriber transmitting if the bursts are that far apart.

Have you looked at the first two screenshots of the SDR# waterfall in post #1, and the audio sample in post #9? (I had to attach audio clip as a zip file.)

It sounds very similar to my ear like a Capacity Plus rest channel idle burst, both in duration of the “on” section and the delay between bursts. However instead of a continuous idle burst which looks like a block on the waterfall, it is discretized into one TDMA timeslot so it shows up as closely spaced horizontal lines and sounds “chopped up” in my original description (I hadn’t heard DMR simplex on one timeslot before). I would surmise the distance between these horizontal lines is the 30 ms you mentioned. However I may also be misunderstanding what you mean by legitimate DMR TDMA subscribers.

 

[GTR8000]

Sorry, I may've misread or misunderstood. I thought it was mentioned that the transmission bursts were spaced 2 seconds apart, but if you're seeing 30ms on/30ms off...then that would be indicative of DMR TDMA transmissions.

 

[slicerwizard]

Provide a good raw audio sample.

 

[inigo88]

Provide a good raw audio sample.

Done. Here's about a minute of uncompressed raw audio:

https://soundcloud.com/user-323576949%2Fchoppy-dmr-recording-2%2Fs-l9wiOvKtMR7

Under "... More" you should be able to download the original *.WAV file. (Edit: Or the down arrow on the top right in the preview in this thread.)

 

[inigo88]

Here's what DSDPlus Fastlane 2p256 has to say.

Sync: no sync
Sync:+DMR
+DMR    MS DATA       DCC=10  Voice Hdr  ERR13   ECC FAIL
+DMR    MS DATA       DCC=10  Voice Hdr Enc GC TG=111222 RID=11900101
+DMR    MS DATA       DCC=10  Voice Hdr Enc GC TG=111222 RID=11900101
+DMR    MS DATA       DCC=10  PI Header Alg=RC4 KID=1 MI=064EE344 Tgt=111222
+DMR    MS VOICE
+DMR    MS VC2
+DMR    MS VC3
+DMR    MS VC4
+DMR    MS VC5
+DMR    MS VC6
MS: Enc GC TG=111222 RID=11900101
+DMR    MS DATA       DCC=10  TLC Enc GC End TG=111222 RID=11900101
Sync: no sync
Sync:+DMR
+DMR    MS DATA       DCC=10  Voice Hdr  ERR14   ECC FAIL
+DMR    MS DATA       DCC=10  Voice Hdr Enc GC TG=111222 RID=11900101
+DMR    MS DATA       DCC=10  Voice Hdr Enc GC TG=111222 RID=11900101
+DMR    MS DATA       DCC=10  PI Header Alg=RC4 KID=1 MI=7EDDE0AE Tgt=111222
+DMR    MS VOICE
+DMR    MS VC2
+DMR    MS VC3
+DMR    MS VC4
+DMR    MS VC5
+DMR    MS VC6
MS: Enc GC TG=111222 RID=11900101
+DMR    MS DATA       DCC=10  TLC Enc GC End TG=111222 RID=11900101
Sync: no sync

I started this thread to see if I had discovered a new type of DMR trunking. It appears what I actually found is a mobile radio at a repeater site keying up every 2 seconds on an encrypted talkgroup... which is more strange.