Duke Energy P25 System

[MSS-Dave]

You're going to see the system light up for restoration efforts after the storm passes and it's safe for linemen to boom up in the truck. Not much happens on the radio especially in storm ramp ups. Lots of planning meetings going on for fixing broken stuff by regions.
There is a 0% possibility that encryption gets turned off on any talkgroup IMHO. Mutual aid efforts will probably be with a team leader working with contract utility company crews and that team leader is going to have a radio to talk to Duke.

The Motorola 900 SZ system is still up and active and a lot of talk groups are bridged to Harris. If you really want to monitor, I would suggest listening to that as it is unencrypted as it always has been. There was a report that traffic flowing from SZ to P25 was sent unencrypted over P25 but I can't confirm that. The vast number of subscribers in Florida have been converted to Harris by now anyway so very few SZ radios being used but probably is an option to re-deploy portables if needed during an event like this.

My comments are based on educated opinion and are not necessarily the Official views and policies of Duke Energy or any Duke Energy contractor or employee.

 

[INDaviation]

Central Indiana updates:
854.8125 is still the active CC at Plainfield (Site 68). Alternate CCs are 855.1875, 856.0375, 856.3375, 859.8375, 860.3125. All submitted to the database.

Site neighbors are 31, 32, 33, 45, 51, 54. All of these except for 31 and 33 are in the database. All on the 201 system.
Control channels for 31 and 33 are 854.8625 and 854.5125, respectively. Still trying to nail down the location of these sites. I'm guessing site 31 is Fillmore, IN in Putnam County based on FCC data but I'm not close enough to confirm.

I got one denied affiliation in Plainfield on TG 243, only talkgroup I've seen so far. Radio ID 1608. Two radio detaches from IDs 9960121 and 9960823.

 

[mtindor]

Central Indiana updates:
854.8125 is still the active CC at Plainfield (Site 68). Alternate CCs are 855.1875, 856.0375, 856.3375, 859.8375, 860.3125. All submitted to the database.

Site neighbors are 31, 32, 33, 45, 51, 54. All of these except for 31 and 33 are in the database. All on the 201 system.
Control channels for 31 and 33 are 854.8625 and 854.5125, respectively. Still trying to nail down the location of these sites. I'm guessing site 31 is Fillmore, IN in Putnam County based on FCC data but I'm not close enough to confirm.

I got one denied affiliation in Plainfield on TG 243, only talkgroup I've seen so far. Radio ID 1608. Two radio detaches from IDs 9960121 and 9960823.

Great job. Thank you for that. You're likely right about 31.31 being Filmore, and 33.33 will likely be Frankfort IN (Clinton Co) on the same WRJP309 license.

Google Map

Mike

 

[IStebleton]

It'll be interesting to see if any of these TGs start to get really busy (if they haven't already) while mobilizing for Hurricane Ian here in Florida. It'll also be interesting to see if any TGs turn their ENC off for mutual aid reasons when other out of state power crews come in to assist with any restoration efforts.

Are the TG's ENC, or just can't be monitored by a scanner because of the TDMA CC?

 

[mtindor]

Are the TG's ENC, or just can't be monitored by a scanner because of the TDMA CC?

Encrypted.

 

[jake_Braker]

Encrypted.

I don't believe any of the scanners avaiable are able to monitor TDMA CCs yet can they? I saw there was a FW update for the SDS series but I haven't downloaded it due to mine still being broken

 

[scannerboy02]

I don't believe any of the scanners avaiable are able to monitor TDMA CCs yet can they? I saw there was a FW update for the SDS series but I haven't downloaded it due to mine still being broken

Correct, no scanner is currently able to monitor a P25 TDMA CC. The BlueTail P25RX-II is capable of monitoring it and that is what I'm using and it's working rather well for me. It would be nice if other manufacturers added the capability to a firmware update but I do understand that it's likely not a priority for them given that these systems aren't being seen a lot yet. With that said, from my understanding it's not a difficult thing to add so I really wish they would just do it for those of us who need it.

 

[lwvmobile]

Been getting tons of hits today on 64864 here in North Florida on the Live Oak site. Appears to be a supergroup with a couple of groups patched into it. Smartzone for the same area has been dead silent. All ENC with AES-256.

09/28/22 15:22:46.351256 add_patch: tgid(62773) is patched to sg(64864)
09/28/22 15:22:46.351266 add_patch: tgid(62774) is patched to sg(64864)

16:02:56        P25p2 VCH 0  MAC_SIGNAL
 Network Status Broadcast - Abbreviated
  LRA [1A] WACN [91F14] SYSID [2D7] NAC [01A] CHAN-T [82B8]
  Frequency [855.362500] MHz

16:02:56        P25p2 VCH 0  MAC_SIGNAL
 Group Voice Channel Grant Update - Implicit
  Channel 1 [82B9] Group 1 [64864][FD60]
  Frequency [855.362500] MHz
 
16:03:02        P25p2 VCH 0  MAC_ACTIVE
 VCH 0 - TG 64864 SRC 16428910 Group Voice
 
16:03:02        P25p2 VCH 0  2V
 VCH 0 - ALG ID 0x84 KEY ID 0x0001 MI 0xEB3086321D84BDEC ESSB

 

[INDaviation]

Correct, no scanner is currently able to monitor a P25 TDMA CC. The BlueTail P25RX-II is capable of monitoring it and that is what I'm using and it's working rather well for me. It would be nice if other manufacturers added the capability to a firmware update but I do understand that it's likely not a priority for them given that these systems aren't being seen a lot yet. With that said, from my understanding it's not a difficult thing to add so I really wish they would just do it for those of us who need it.

I've been doing all of my monitoring with DSD+ using my RTL-SDR. Works really well.

 

[lwvmobile]

Listened to Live Oak all morning, didn't get a single voice hit. But I did some digging on the PDUs and didn't even realize the control channel had been pumping out MFIDA4 Group Regroup Explicit Encryption Commands with alg id and key ids, this is what I was able to get on the Live Oak site.

11:56:44        P25p2 VCH 0  MAC_SIGNAL
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64805] KEY [01] ALG [84]
  WGID [F537][62775] WGID [F538][62776]
 P25 PDU Payload
  [1C][B0][A4][0D][65][FD][25][00][01][84][F5][37]
  [F5][38][08][05][88][88][88][01][AE][5D][20][00]
 
11:56:44        P25p2 VCH 0  MAC_SIGNAL
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64654] KEY [01] ALG [84]
  WGID [EAC6][60102] WGID [EAC7][60103] WGID [EAC8][60104]
 P25 PDU Payload
  [1C][B0][A4][0F][76][FC][8E][00][01][84][EA][C6]
  [EA][C7][EA][C8][08][03][88][01][A7][0A][B0][00]
 
11:56:44        P25p2 VCH 0  MAC_SIGNAL
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64855] KEY [01] ALG [84]
  WGID [F300][62208] WGID [F600][62976] WGID [F400][62464]
 P25 PDU Payload
  [1C][B0][A4][0F][77][FD][57][00][01][84][F3][00]
  [F6][00][F4][00][08][03][88][01][A4][6D][70][00]
 
11:56:44        P25p2 VCH 0  MAC_SIGNAL
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64856] KEY [01] ALG [84]
  WGID [F2DF][62175] WGID [F23E][62014] WGID [802][02050]
 P25 PDU Payload
  [1C][B0][A4][0F][78][FD][58][00][01][84][F2][DF]
  [F2][3E][08][02][08][03][88][01][A9][28][60][00]
 
11:56:44        P25p2 VCH 0  MAC_SIGNAL
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64868] KEY [00] ALG [80]
  WGID [1AB][00427] WGID [1BF][00447]
 P25 PDU Payload
  [1C][B0][A4][0D][64][FD][64][00][00][80][01][AB]
  [01][BF][08][05][88][88][88][01][A2][06][B0][00]
 
11:56:44        P25p2 VCH 0  MAC_SIGNAL
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64869] KEY [00] ALG [80]
  WGID [1DF][00479] WGID [1E9][00489]
 P25 PDU Payload
  [1C][B0][A4][0D][65][FD][65][00][00][80][01][DF]
  [01][E9][08][05][88][88][88][01][A7][D1][10][00]
 
11:57:04        P25p2 VCH 0  MAC_SIGNAL
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64871] KEY [00] ALG [80]
  WGID [1EB][00491] WGID [1EF][00495]
 P25 PDU Payload
  [1C][B0][A4][0D][67][FD][67][00][00][80][01][EB]
  [01][EF][08][05][88][88][88][01][AF][BC][60][00]
 
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64605] KEY [01] ALG [84]
  WGID [EAC4][60100] WGID [EAC5][60101]
 P25 PDU Payload
  [1C][B0][A4][0D][67][FC][5D][00][01][84][EA][C4]
  [EA][C5][08][05][88][88][88][01][AB][DE][80][00]
 
11:57:22        P25p2 VCH 0  MAC_SIGNAL
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64864] KEY [01] ALG [84]
  WGID [F535][62773] WGID [F536][62774]
 P25 PDU Payload
  [1C][B0][A4][0D][60][FD][60][00][01][84][F5][35]
  [F5][36][08][05][88][88][88][01][A8][31][50][00]
 
11:57:22        P25p2 VCH 0  MAC_SIGNAL
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64654] KEY [01] ALG [84]
  WGID [EAC6][60102] WGID [EAC7][60103] WGID [EAC8][60104]
 P25 PDU Payload
  [1C][B0][A4][0F][76][FC][8E][00][01][84][EA][C6]
  [EA][C7][EA][C8][08][03][88][01][A7][0A][B0][00]
 
11:57:23        P25p2 VCH 0  MAC_SIGNAL
 MFIDA4 Group Regroup Explicit Encryption Command
  SG [64870] KEY [00] ALG [80]
  WGID [1D1][00465] WGID [1DB][00475] WGID [1D7][00471]
 P25 PDU Payload
  [1C][B0][A4][0F][66][FD][66][00][00][80][01][D1]
  [01][DB][01][D7][08][03][88][01][A6][F6][30][00]

All the supergroups with ALG 80 are in the clear, and those with alg 84 are using AES-256 encryption.

 

[scannerboy02]

I noticed while in my office this morning I was hearing unencrypted transmissions on my P25RX-II. I'll need to pull the data later today to see what/who it was. They were talking about making sure something was disconnected, so it appears not EVERYTHING is going to be encrypted, or encryption is selectable at some level.

 

[INDaviation]

Got a few hits on 64855 on the Plainfield site today, all in the clear. Too brief to make out what they were talking about.

 

[RaleighGuy]

Multiple new and modified license issued this past week for sites in North Carolina. All new applications have a note that a 5 year implementation period was granted, with yearly certifications.

Of the thirteen Raleigh area freqs listed none are active, licenses are WRUV446 (Raleigh), WRUV432 (RDU Morrisville), WRUV408 (Garner).

 

[mtindor]

I'll be updating the Duke Energy google map that I had made, this weekend. I've got to add updates from the past four months, including new/modified locations in various states.

Duke Energy Google Map

The blue balloons in various states are sites that are licensed but not known to be online yet. There are green and purple balloons that are strictly VHF and UHF DMR (not P25). The DMR is on a separate layer so it can be turned on and off.

The other icons denote sites that are either confirmed to be online, or should be online (and we know the site iDs).

At any rate, I've been derelict on this, and the post from @RaleighGuy made me realize this.

M

 

[engine183]

I’m trying to monitor the Duke Energy P25 system in my area. I have a strong signal and it appears that DSD+ Fastlane has found the local (Mt. Orab-Hillcrest) site okay. It locks in and show me the associated neighbor sites, however I do not see any TG’s or any system activity. What is it I’m not doing correctly?

 

[scannerboy02]

I’m trying to monitor the Duke Energy P25 system in my area. I have a strong signal and it appears that DSD+ Fastlane has found the local (Mt. Orab-Hillcrest) site okay. It locks in and show me the associated neighbor sites, however I do not see any TG’s or any system activity. What is it I’m not doing correctly?
View attachment 129189

You're not doing anything incorrectly. It's just likely that site doesn't have any radios affiliated with it, or no one is talking on a talk group that does have a radio affiliated.

I have found that most of the traffic I am picking up is coming off the Brecon and Valleyview Office sites, and a few others from time to time.

 

[scannerboy02]

Just an update on the talk group IDs seen so far in the Cincinnati, Ohio area.

Being that everything is mostly encrypted and the chances of actually identifying the use is nil, would it be possible to add the active TGID's to the database as "unknown" or "Duke Operations xxxxx" or something like that? I have seen this done with other trunking systems on RR, an example from my area Southwest Ohio Regional Transit Authority (SORTA) Trunking System, Cincinnati, Multi-State "SORTA Bus Operations xx" isn't the actual talk group names for those channels but they were added to the database that way.

SYS_ID (HEX)	TGRP	Alpha Tag	Description	WACN (HEX)
0x201	62001	62001_unknown	unknown	0x91f14
0x201	62016	62016_unknown	unknown	0x91f14
0x201	62503	62503_unknown	unknown	0x91f14
0x201	62595	62595_unknown	unknown	0x91f14
0x201	62601	62601_unknown	unknown	0x91f14
0x201	62613	62613_unknown	unknown	0x91f14
0x201	62633	62633_unknown	unknown	0x91f14
0x201	62659	62659_unknown	unknown	0x91f14
0x201	62662	62662_unknown	unknown	0x91f14
0x201	62664	62664_unknown	unknown	0x91f14
0x201	62666	62666_unknown	unknown	0x91f14
0x201	62678	62678_unknown	unknown	0x91f14
0x201	62680	62680_unknown	unknown	0x91f14
0x201	62709	62709_unknown	unknown	0x91f14
0x201	62720	62720_unknown	unknown	0x91f14
0x201	62722	62722_unknown	unknown	0x91f14
0x201	62786	62786_unknown	unknown	0x91f14
0x201	62788	62788_unknown	unknown	0x91f14
0x201	62790	62790_unknown	unknown	0x91f14
0x201	62801	62801_unknown	unknown	0x91f14
0x201	64206	64206_unknown	unknown	0x91f14
0x201	64835	64835_unknown	unknown	0x91f14
0x201	64855	64855_unknown	unknown	0x91f14
0x201	64856	64856_unknown	unknown	0x91f14

 

[mtindor]

Just an update on the talk group IDs seen so far in the Cincinnati, Ohio area.

Being that everything is mostly encrypted and the chances of actually identifying the use is nil, would it be possible to add the active TGID's to the database as "unknown" or "Duke Operations xxxxx" or something like that? I have seen this done with other trunking systems on RR, an example from my area Southwest Ohio Regional Transit Authority (SORTA) Trunking System, Cincinnati, Multi-State "SORTA Bus Operations xx" isn't the actual talk group names for those channels but they were added to the database that way.

SYS_ID (HEX)	TGRP	Alpha Tag	Description	WACN (HEX)
0x201	62001	62001_unknown	unknown	0x91f14
0x201	62016	62016_unknown	unknown	0x91f14
0x201	62503	62503_unknown	unknown	0x91f14
0x201	62595	62595_unknown	unknown	0x91f14
0x201	62601	62601_unknown	unknown	0x91f14
0x201	62613	62613_unknown	unknown	0x91f14
0x201	62633	62633_unknown	unknown	0x91f14
0x201	62659	62659_unknown	unknown	0x91f14
0x201	62662	62662_unknown	unknown	0x91f14
0x201	62664	62664_unknown	unknown	0x91f14
0x201	62666	62666_unknown	unknown	0x91f14
0x201	62678	62678_unknown	unknown	0x91f14
0x201	62680	62680_unknown	unknown	0x91f14
0x201	62709	62709_unknown	unknown	0x91f14
0x201	62720	62720_unknown	unknown	0x91f14
0x201	62722	62722_unknown	unknown	0x91f14
0x201	62786	62786_unknown	unknown	0x91f14
0x201	62788	62788_unknown	unknown	0x91f14
0x201	62790	62790_unknown	unknown	0x91f14
0x201	62801	62801_unknown	unknown	0x91f14
0x201	64206	64206_unknown	unknown	0x91f14
0x201	64835	64835_unknown	unknown	0x91f14
0x201	64855	64855_unknown	unknown	0x91f14
0x201	64856	64856_unknown	unknown	0x91f14

I can tell you that I personally would not add them. I guess you might find some admin that would. The Duke system is a large system, covering many states. Imagine if everyone submitted unknown ENC talkgroups for their areas. We would end up accumulating hundreds (if not more) unidentified talkgroups that will never be useful to anyone. That information is totally useless from the standpoint of anybody scanning the system.

As far as SORTA goes, there is a difference there since those talkgroups aren't encrypted. Somebody could program them into their scanner and potentially identify more precise usage, submit those updates, and make things more accurate.

I'd recommend making a wiki article off of the Duke system if you want to document unknown talkgroups.

 

[RaleighGuy]

I can tell you that I personally would not add them. ... That information is totally useless from the standpoint of anybody scanning the system.

Totally agree with you @mtindor however I don't think that was the intent of posting them here, I would hope no admin would add them to the database even if it was on a state by state basis.

That said, it is nice to see the TGs in use as we are awaiting for the system here to go live and it gives me an idea what to look for.

 

[sonm10]

Hello, I lurk on this thread just for the heck of it.
Here is an excerpt from the DB admin handbook:

Encrypted Talkgroups
In general, encrypted talkgroups will not be entered in the database, unless either of two specific conditions are met.

• If the agency which "owns" an encrypted talkgroup can be confirmed to a reasonable degree of certainty, it may be entered in the talkgroup category for that agency. Ways to confirm ownership include monitoring unencrypted talkgroups for references to an encrypted talkgroup which then becomes active (ie "Switch to Tac 2" and the same units appear on the encrypted talkgroup), or regular use of the talkgroup by an overwhelming preponderance of radio IDs which have been confirmed as a specific agency.
• Provided there are no clear (unencrypted) talkgroups on the system, encrypted talkgroups may be entered to indicate that there is activity on the system.

Take a look at the second bullet point