DMR packet

[sq3tgv]

I'm trying to understand these packets.

First column analysis:
1.) D2 - 210
2.) 52 -> hex: 82 - packet number
3.) 5F5F0D1C2204A1B2C3D4341F971D6 - date, where last two digits are day
4.) 6705 - seconds (?)
8.) 1499 - in 90% same value, but there are few packets with value like BC53 or 9489
9.) 0CDE00650470 - lat/lon/other telemetry?
10.) 6C040A568E - lat/lon/other telemetry?
11.) 000000000000000000 - null
12.) 44C7DA29 - unknown

Date for first packet: 2021.12.14 23:25:55

 

[DSheirer]

Looks like it's carrying a LRRP GPS Triggered location report. Your column splits are fragmenting some of the tokens and values
```
0x0D = Triggered GPS location report
0x1C = Packet length (28 bytes)
0x22 = Identity token - variable length (3 or 4 bytes)
0x34 = Timestamp token + 5 bytes of data
0x51 = Location Token + 10 bytes of data.
0x6C = Speed token + 2 bytes of data
0x56 = Heading token + 1 byte data
```

 

[slicerwizard]

Motorola LRRP Protocol

Hello guys, I'm new with Motorola Tetra radios. My Tetra infrastructure, is able to decode all Tetra communications of the Tetra Motorola radios but not GPS Positions. The radios are configured to send the GPS position in the LRRP format. My infrastructure decodes the GPS position sent by the...

forums.radioreference.com

 

[sq3tgv]

Thanks!

hex: 499E8633 (b 1001001 10011110 10000110 00110011) dec: 1235125811 = N51.7635 etc.

DSheirer your github repo XCMP/XNL/LRRP/ARP is very helpful.

I'm testing other devices with my friend - Hytera.

First packet comes from Motorola - is clear to understand, but others? Is there some mask, XOR, shift implemented?



I tried transcibe first 8 packets - LAT column. Start position: 40 as in Motorola. Radio has GPS enabled and there is voice between Motorola/Hytera.

 

[DSheirer]

It looks like you may have a variety of packet types in your samples, and they're not all LRRP/GPS packets. You might try first decoding the Packet Header to see what the packet payload type is, and to determine if the Data messages are carrying confirmed or unconfirmed data, so that you can reassemble the packets. There can also be a vendor packet header that follows the primary packet header. Packets are going to be variable length and use a variety of formats and protocols. Often, these packet sequences are carrying a fragmented IPV4 packet and by decoding the IP header and then the sub-protocol header, you can better identify the content of the packet ... UDP, TCP, or other, and more importantly, determine if the packet is encrypted.

On some MotoTRBO networks, they can use MNIS as a way to compress/reduce the IP packet overhead. MOTOTRBO: What does MNIS do?

 

[slicerwizard]

Hytera isn't going to send LRRP data.

Raw audio would be easier to analyze. Your extracts are missing too much data.

 

[sq3tgv]

Sorry for missing the whole packet.



First two packets 0239 - PDP unconfirmed. Rest: 02990 - sap proprietary data (9)- pad octet: 9.

Raw values:

029900FAFA00BCEF8500DECFACC3D5E071878301DA79F10C3B9D97B4422E11057768E1B0984B46F0C76FEFC4316CCE00000000000000000073C5A5F8
029900FAFA00BCEF8500DECFD517D9DF3A2876C3EF4D9D48551C2969078801EAB670FD571B838FEF2AA6B0655BAF1C0000000000000000009C6DE7AA
029900FAFA00BCEF8500DECF94D50174CFD17A4128B6E4597157904FA811FE0B38888634216478646C87BE833041D2000000000000000000EFDCCF5C
029900FAFA00BCEF8500DECF6C06F7307524FE083D31BFFF440F61ADA12712FA72B381B3269A44110F3B9563BB85F1000000000000000000E00D0926
029900FAFA00BCEF8500DECF72126668713F988D2D1CC9BB65667A6DC69D2163EF3CFE64CA545C1EF388DDC515DE2A0000000000000000005E6507D5
029900FAFA00BCEF8500DECFA89B6039634BA587A2A387400C4A17E8231B5215982DA19146188B0218A7E62EA45B30000000000000000000F1F668F2
029900FAFA00BCEF8500DECF6F96C58D4E504D0EF59B8AFD4F40ED32E245BA60126F0ABCB81F31CCB7811D8150B07F0000000000000000008EC633AB
029900FAFA00BCEF8500DECFF12BF8F3922005414E9CDB2CD5E2F5D16C56DFEDC47C86660F2303D55C28BA129C71F6000000000000000000CA8BFF4A
029900FAFA00BCEF8500DECF8C769BF817D0E575405CA4ABBA044AD2901EB58246CB89FF27A37245393E2C5C86DE9F000000000000000000057B679F

Packets are sent every minute - same as Motorola LRRP, but I can't understand payload. Bitwise operation/TEA is possible? Maybe I'm thinking too much...

 

[slicerwizard]

The randomness of the data suggests that encryption may be in use.