Hearing a mystery trunked system on federal UHF spectrum

[kj6psg]

Oddly enough, I'm only hearing this system on the input, with no sign of it on the output. I am in Ventura, CA. Another listener in San Diego could hear neither side of the system, so it's probably somewhere north of me. Input signals had a slow fade so I'm assuming an airborne transmitter; UHF propagation has also been unusually good lately. I didn't monitor 417-418 so I can't determine if there are voice channels present there. Smells like a Motorola system.

Assuming a +9 MHz offset I get the following:

• CC 406.7625
• VC 407.5625
• VC 410.1625

All have a NAC of $BA0, all Phase 1 from radio ID 4 on talkgroup 91 ($5B). All traffic AES-256 with key ID 0. I didn't catch any radio registration messages so I don't know the system ID beyond what the NAC implies.

Does anyone recognize this system info?

 

[kj6psg]

I also logged a hit as NAC $A40, TG 28, RID 6. Still encrypted and on the same channels.

 

[buddrousa]

My 1st thoughts was the United States Department of Defense (14C) System but checking I only see 380Mhz sites.

 

[ecps92]

Oddly enough, I'm only hearing this system on the input, with no sign of it on the output. I am in Ventura, CA. Another listener in San Diego could hear neither side of the system, so it's probably somewhere north of me. Input signals had a slow fade so I'm assuming an airborne transmitter; UHF propagation has also been unusually good lately. I didn't monitor 417-418 so I can't determine if there are voice channels present there. Smells like a Motorola system.

Assuming a +9 MHz offset I get the following:

• CC 406.7625
• VC 407.5625
• VC 410.1625

All have a NAC of $BA0, all Phase 1 from radio ID 4 on talkgroup 91 ($5B). All traffic AES-256 with key ID 0. I didn't catch any radio registration messages so I don't know the system ID beyond what the NAC implies.

Does anyone recognize this system info?

What SysID and WACN are you getting ? if any, since it is the input you say you are hearing.


My first thoughts, looking at a map and seeing your near the water is a possible Naval Vessel transiting the coast
two of the freq's you list I have regularly gotten on-board Motorola Trunks

checking my notes/logs
the only $BAO NAC I've ever gotten was VHF in Ontario Canada
the only $A40 NAC I've ever gotten was also VHF in Brownsville TX

 

[Wilrobnson]

Having never, in 30 years, heard of an airborne TRS, I'd lean towards BoP trunking at some facility, maybe MDC LA or one of the FCIs.

 

[RFI-EMI-GUY]

1) Are the freqs in NIFOG?
2) Are you hearing these sequentially like subscribers accessing a system?
3) On the CC are you picking up random bursts or a continuous stream of data?

 

[kj6psg]

What SysID and WACN are you getting ? if any, since it is the input you say you are hearing.

Since I only have the inbound channel to work with, I don't know the WACN. I did catch a registration last night with system ID $BA5. All loggings are obtained from the inbound side of the trunked system (or systems, since I cannot prove there is only one system involved; evidence suggests it due to frequency reuse).

The San Diego listener (on a better setup than I) has since provided loggings in greater quantity than I was able to obtain, and we could both hear transmissions on talkgroup 91. Signal strengths are generally not exceptional so most NACs did not decode. All talkgroups are encrypted, presumably with the same encryption as originally detailed. New loggings:

• Talkgroup 26 has radios 41 and 8008. 8008 uses NAC $A90.
• Talkgroup 28 has radios 52 and 54.
• Talkgroup 154 has radios 13 and 317. 317 uses NAC $950.

Having never, in 30 years, heard of an airborne TRS, I'd lean towards BoP trunking at some facility, maybe MDC LA or one of the FCIs.

The thought is that the subscribers are airborne, not the system itself. I'm able to catch little blips of the control channel through various scattering mechanisms, but I'd put control channel power at my receiver somewhere under -145 dBm under normal propagation, and never exceeding -130 dBm. Several hours of sitting on the control channel output hoping for an opportunistic frame decode yielded nothing. It does exist at 406.7625 MHz, though. Modulation on it is C4FM and I'd expect a $BA0 NAC against a $BA5 system ID.

My first thoughts, looking at a map and seeing your near the water is a possible Naval Vessel transiting the coast
two of the freq's you list I have regularly gotten on-board Motorola Trunks

Entirely possible now that San Diego has yielded loggings. There's still some funny propagation going on as I have numerous inbound messages yet can only catch the control channel by scattering. The power discrepancy between output at observed peaks and typical input is still around 30 dB favoring the input. I'd imagine this could be explained by the system using a leaky coax setup largely confined to the vessel, with some subscribers putting out a decent amount of power from a high point on the vessel.

I was under the impression that those all used 380-400 MHz but apparently that's not the case!

1) Are the freqs in NIFOG?
2) Are you hearing these sequentially like subscribers accessing a system?
3) On the CC are you picking up random bursts or a continuous stream of data?

1. No.
2. I see the grant demands occur at 415.7625 MHz, then a transmission at near-equal signal strength on a voice channel. System appears to use the ASTRO25 "PTT ID" conversation type as voice channels are reused on subsequent keyups on the same talkgroup.
3. There is a continuous stream of data on 406.7625 MHz that I cannot directly observe. The grant demands at 415.7625 MHz are short bursts, and the voice channels are regular P25 voice. I had actually assumed I had stumbled across conventional repeater outputs until I noticed talkgroups were involved (the only people really using conventional talkgroups are hams since multi-NAC is more interoperable) and NACs ended in a 0.

 

[RFI-EMI-GUY]

Here in Florida when we got Tropo openings at 800 MHz on the old analog Privacy Plus and Smartnet systems, it was not uncommon for foreign subscribers to grab / tailgate a channel from a very distant system. The early radios had 105.88 Hz (?) connect tones and no option to change them. This misbehavior of physics had Motorola rethinking that simplistic approach. I would be looking at surrounding federal installations that have subscribers, especially mobiles, at elevated terrain altitude.

 

[RFI-EMI-GUY]

system ID $BA5

 

[AEFI]

View attachment 205957 system ID $BA5

CDC Is on the SBCO TRS

San Bernardino County Trunking System - Talkgroup Category: County Sheriff-Coroner

San Bernardino County Trunking System talkgroups in the County Sheriff-Coroner category

www.radioreference.com

 

[AEFI]

Not seeing anything listed with the FCC. How strong is the signal? It may be an unlicensed MMDVM system. Is anything broadcasting a callsign?

 

[kj6psg]

Not seeing anything listed with the FCC. How strong is the signal? It may be an unlicensed MMDVM system. Is anything broadcasting a callsign?

It wouldn't be listed with the FCC because it's in NTIA spectrum (380-420 MHz for example), and things in that spectrum generally do not identify. It's too reliable to be DVMHost (grants are only being sent once) and MMDVM will do neither P25 trunking nor encryption. The coverage footprint involved (these receivers are about 200 miles apart and are hearing the same grant demands) also suggests it isn't someone playing around on a low-level system.

 

[RFI-EMI-GUY]

CDC Is on the SBCO TRS

San Bernardino County Trunking System - Talkgroup Category: County Sheriff-Coroner

San Bernardino County Trunking System talkgroups in the County Sheriff-Coroner category

www.radioreference.com

There is a Federal lock up and Marshals service at CDC. Possibly they have a UHF 400 MHz "site" plugged into SBCO TRS as a resource and patch to other agencies within.

 

[ecps92]

I was under the impression that those all used 380-400 MHz but apparently that's not the case!

Nope, there are still plenty on 406-420 and some using the 457/467 UHF Marine Pairs and some odd ducks using 458 Part 90 as the output

 

[batdude]

I have seen Navy ships in the Mayport, Florida area use "VOC" P25 systems - voice on control. One channel trunking system.

that said, I am leaning towards Hydra for what you are hearing. This is a shipboard system and could very well be offshore from you - and could very well not follow the "normal" offsets for a 406MHz trunking system.

https://www.l3harris.com/sites/default/files/2020-10/cs-pspc-hydra-system-shipboard-wireless-communications-brochure.pdf

 

[Wilrobnson]

There is a Federal lock up and Marshals service at CDC. Possibly they have a UHF 400 MHz "site" plugged into SBCO TRS as a resource and patch to other agencies within.

Nearly every jail in the nation takes Federal detainees/prisoners on a contract basis, or at least every one I've ever been in (as a LEO, not a guest ) does. Even the one I'm sitting next to right now is currently housing 56 ICE detainees and 1 DOJ detainee, though that number tends to rise dramatically midweek as transports come and go.

 

[kj6psg]

Having now monitored for another night, I caught a registration with system ID $950 against NAC $950, so I am seeing overlapping systems. Since I've seen one other NAC on the frequency, it's reasonable to assume there is at least one other system on the frequency in addition to the two I've seen. Due to a silly typographical error I didn't get any local decodes last night, but both 415.7625 and 416.5625 MHz frequencies were active and receivable locally. System $950 description might include logs from the NAC $A90 system since I made those logs assuming there was one or two systems on this frequency.

Somebody has been running radar in this band so peak-hold graphs to identify potential voice channels got obliterated.

Current loggings as follows, including previous logs:

• System $BA5, NAC $BA0:
  • Talkgroup 91: radio 4
• System $950, NAC $950:
  • May have a talkgroup 26 with radios 37 and 317 but I didn't get a good decode here. 317 belongs to system $950.
  • Talkgroup 28: radios 13, 30, 52, 54
  • Talkgroup 90: radio 8002
  • Talkgroup 154: radio 317
• Unknown system with NAC $A90, only heard once:
  • Talkgroup 26: radio 8008.

All three of these systems have in common the fact that they aren't in the DSDPlus System List, and every talkgroup is 100% encrypted -- I have never logged a clear call.

I have seen Navy ships in the Mayport, Florida area use "VOC" P25 systems - voice on control. One channel trunking system.

No voice activity has ever been heard on the control channel input frequency; they've always jumped to some other VC as detailed above.

that said, I am leaning towards Hydra for what you are hearing. This is a shipboard system and could very well be offshore from you - and could very well not follow the "normal" offsets for a 406MHz trunking system.

I thought this too, which is why I checked the normal offset and found a control channel (albeit not much of one). I simply lack the gain to decode it from scattering, and I might not ever find the gain since my noise floor is already near thermal and I'm still around 10 dB short. Since it now appears to be three overlapping trunked systems, I can't be sure what's what now -- next goal will probably be to chase these voice channels around and start disentangling the systems, since they may have different voice channels.

System $950 (whose existence is reasonably well attested now via decodes that happened while writing this post) resembles the NAC $A90 system, which to me suggests they are used similarly. Shipboard systems would make sense in that case.

 

[kj6psg]

Excellent results from overnight monitoring. The NAC $A90 system was coming in unusually well on its input around 8AM. As is tradition, everything is fully encrypted. This has long faded out so I have no record of what the voice channels may have been, and the only frequencies logged with excess peak power are 415.1625 and 416.5625 MHz.

WACN $BEE00, System ID $A9D

• Talkgroup 26: radios 7, 37, 43
• Talkgroup 27: radio 7
• Talkgroup 28: radio 9, 33, 8006
• Talkgroup 76: radios 38, 45
• Registration only: 8008

San Diego listener didn't hear any of this. They've only been getting traffic from TG 91, RID 4 on the $BA5 system. The one exception was a registration to the $950 system confirming a WACN of $BEE00, which I did not hear locally.

$BA5 talkgroup 91 radio 4 was coming in for a brief period around 2:30 AM. I logged six calls, all of which were heard by the San Diego listener. The San Diego listener logged about 60 calls last night, so it's doing a better job hearing $BA5 while I'm doing a better job hearing $A9D.

 

[kj6psg]

System $A9D uses the same encryption settings as the other systems: AES-256 with key ID $0000. I've only seen voice channel input 416.5625 MHz so far on it (as in most grant demands I see are followed by a voice call on this frequency). No sign of a control channel anywhere between 406-430 MHz while these transmissions were ongoing.

Radio 4 on system $BA5 was coming in above -100 dBm on both my radio and the San Diego listener's simultaneously; there's no way this thing isn't in the air. I have also confirmed there is a voice channel output at 407.5625 corresponding with the 416.5625 MHz input for system $BA5, but it took quite a bit of work to find it.

Radio 39 on talkgroup 28 on system $950 is unencrypted. It sounds English, but the quality of voice is not very good (very hot microphones, high BER, and DSDPlus's poor vocoder) and I can only make out numbers. The other end of that conversation was encrypted. I did not catch very many transmissions.

 

[mmckenna]

Tell me about signal strength on the subscriber units you are hearing? Preferably around the same time to remove atmospheric anomalies.

Are all the subscriber units you hear the same signal level around the same time, or does each individual one vary quite a bit?