Fallsview Casino Switched from LTR to Capacity Plus

[XBrandonEdwardX]

Hey Everyone,
This was something that was brought to my attention last week, but I can now confirm that the Fallsview Casino Resort has switched to DMR Capacity Plus from their previous LTR system. They have also implemented Restricted Access to System (RAS) and is using both basic and enhanced encryption depending on the talkgroups.

Previously they used a mixture of Motorola HT-1250 LS+ and XPR-7550 radios. I am assuming that they finally made the switch because LTR has reached its end-of-life a while ago, and that Motorola no longer makes the LTR option board for the XPR series radios. Who knows, maybe they have some of those new fancy R7s?

Furthermore, I also see that some of their DMR radios are broadcasting OTA-Aliases. However, they seem to just be the DMR ID number associated to that unit. I have yet to see any Automatic Registration (ARS) or any kind of GPS (GNSS) location data coming through. I also have yet to pick up the frequency LCNs... I plan on doing that today.

Anyways... that's what I've picked up so far. I will update accordingly.

 

[VA3ADP]

Hey Everyone,
This was something that was brought to my attention last week, but I can now confirm that the Fallsview Casino Resort has switched to DMR Capacity Plus from their previous LTR system. They have also implemented Restricted Access to System (RAS) and is using both basic and enhanced encryption depending on the talkgroups.

Previously they used a mixture of Motorola HT-1250 LS+ and XPR-7550 radios. I am assuming that they finally made the switch because LTR has reached its end-of-life a while ago, and that Motorola no longer makes the LTR option board for the XPR series radios. Who knows, maybe they have some of those new fancy R7s?

Furthermore, I also see that some of their DMR radios are broadcasting OTA-Aliases. However, they seem to just be the DMR ID number associated to that unit. I have yet to see any Automatic Registration (ARS) or any kind of GPS (GNSS) location data coming through. I also have yet to pick up the frequency LCNs... I plan on doing that today.

Anyways... that's what I've picked up so far. I will update accordingly.

Interesting find.

I think that if they are indeed using EP or BP they would be using one or the other. It is possible it could be a false decode?

 

[XBrandonEdwardX]

Interesting find.

I think that if they are indeed using EP or BP they would be using one or the other. It is possible it could be a false decode?

While anything is possible, I have observed BP appearing both from my residence and when parked on Robinson Street across from the casino recently. It has surfaced multiple times. Additionally, RAS intermittently appears — sometimes it is active, while other times it is not. This suggests that they may be utilizing the repeater in 'Migration Mode,' allowing transmissions to pass through regardless of whether RAS is programmed. However, I cannot confirm this with absolute certainty at this time and will need to conduct further monitoring of the system.

 

[XBrandonEdwardX]

So, while waiting for my vehicle to be finished at the dealership, I have been sitting here watching my SDR and DSD+ to see if any additional information pops up about this new Capacity Plus system. Still utilizing encryption on all talkgroups, I have yet to see a "clear" transmission. Furthermore, I have decoded LCN 1 & 2, which will give their system 4 data/voice paths.

• LCN #1&2: 422.5750
• LCN #2&3: 422.6750

Note: the frequencies above are coming up as S1, CC6. This may be important in the near future, as I recalled seeing some DMR traffic on the Casino Niagara system too. I believe they have both updated... I will look into that system a little later on.



Unfortunately, I only caught 1 screenshot that shows 422.5750 as 1&2. I plan on watching the other 7 frequencies to see if I can pick up anymore LCNs. I also noticed that the "Fallsview Casino" trunked system has disappeared from the database. I think now we should have enough details to restore/update the system.

 

[16b]

While I don’t have experience with the latest TRBO radios (R7, Ion,etc), all of the others only allow one encryption type to be active at a time. One of your screenshots shows both BP and EP on the same talkgroup (14); that’s almost certainly a false decode. My money is on EP being the real algorithm in use. I see a lot of false decodes indicating BP on DSD Plus. Most of the time it’s on an EP channel, but sometimes unencrypted as well.

 

[exkalibur]

You cannot mix EP and BP in the same radio. AES will show up as EP so it is possible you're seeing a mix of AES and BP (which IS possible in the same radio).

 

[XBrandonEdwardX]

@16b and @exkalibur, you are both correct on the way that encryption works. You cannot run Enhanced Privacy and Basic Privacy at the same time. However, you can run Enhanced Privacy and AES together. There's no indication of them using AES, though.

I didn't pay attention to the radios that were keying up with Enhanced Privacy vs the ones that were keying up with Basic. There is a possibility they were different units talking on different talkgroups. My main goal was to confirm what kind of system it was, and what the LCN's are.

At this time, I have only picked up Site-1 as the Fallsview Casino Resort, with 2 LCN's. No other frequencies are containing the Capacity Plus beacon that the radios require. I will also be looking into the Casino Niagara frequencies too, as I think they were on "Site-2."
As time goes on, and I have some more time to dedicate to this, I will be able to provide more details.

As of right now, I spent maybe about an hour watching the system tops.

 

[XBrandonEdwardX]

Update:
I am no longer picking up analog LTR trunking data on any of the Casino Niagara (old casino) frequencies. However, I am picking up DMR Capacity Plus beacons on two of them. I have yet to decode any talkgroups or radio IDs, but I am pretty close to getting the frequencies and LCNs for that system. So far, I have decoded:

LCN #1&2: 422.56250
LCN #3&4: 422.76250

These frequencies are showing up as "Site 2" with "Color Code 7." I was able to finally hear some encryption noises coming from talkgroups 14 and 104. According to my DSD+, they are both using Basic Privacy (BP) encryption, however... there is a possibility these could be false decodes as per my last conversation with @16b...
I will have to try and scan this system a little closer to the building.

Checking back on my first set of screenshots that I posted, I can also see that it captured talkgroup 14 on "Site 1" using BP. I wonder if that's a linked talkgroup between the two properties?
I know for a fact that the two locations share security and maintenance personnel. I believe they share cleaners too, but they are a third-party contract.

Maybe we can change the database listing to "OLG Casinos," and change the type to a multi-site capacity plus system? Maybe "Site 1" can be renamed to "Fallsview Casino" and "Site 2" can be named "Casino Niagara?"

CONFIRMED THIS IS A LINKED CAPACITY PLUS (LCP) SYSTEM!
(See the attached screenshot)

​

 

[XBrandonEdwardX]

Update:
Over the past 30 minutes, this is the information that my SDR has picked up. I am going to leave it scanning throughout the night to see what happens.

Talkgroup ID	Radio ID Range	Active Users
14	6xx & 7xx	3
22	8xx	6
29	4xx	2

Judging from previous experience listening to their LTR system, I feel confident in saying that "22" is probably the machine technicians. I haven't been able to determine talkgroup "14" or "29" yet. Though, I have a strong feeling that "14" is a linked talkgroup between the two properties... I just haven't done enough scanning yet to confirm that.

The other talkgroups mentioned earlier in this post have been silent.

 

[Forts]

Just for reference, many of the big casinos in Vegas are Cap+/Con+ and run BP w/RAS. Pretty effective when you think about it. RAS blocks you from using a radio to guess the BP code, and BP blocks non-Moto radios that don't care about RAS. Now that being said, I assume the custom Uniden FW for the SDS etc that lets you enter privacy keys would be able to get around this.

 

[XBrandonEdwardX]

Just for reference, many of the big casinos in Vegas are Cap+/Con+ and run BP w/RAS. Pretty effective when you think about it. RAS blocks you from using a radio to guess the BP code, and BP blocks non-Moto radios that don't care about RAS. Now that being said, I assume the custom Uniden FW for the SDS etc that lets you enter privacy keys would be able to get around this.

That would make sense if they were using Restricted Access to System (RAS) in "Migration" mode which allows radios that are/aren't capable to be able to use the same system. There are other pros to that too, such as not having someone nearby using the repeater's input frequency to listen to radio comms as that would bypass RAS all together. Also, with it being a dynamic trunked system, with the talkgroups moving around to new rest channels, it would make it harder to listen too.

Also, an important to note... that "bypass" won't work if you're trying to do it from a Motorola radio. If they are using RAS, their radios transmit the packets needed for that feature. Motorola radios don't know how to decode or ignore those packets... hence why you have to put the key into the software... that way the radio is pretty much like "hey, I know that key, let's listen!"