LTRTrunk and LTRDump programs Beta 3

[EricCottrell]

Hello,

I can not believe it has been almost 5 months since the last beta!

I wanted to get some basic passport support in LTRTrunk before releasing another beta. It is in there but took longer than expected.

I still have no clue on uploading to the downloads section. Sorry for posting files on the forums.

LTRDump Program 5-May-2004 Beta Version
LTRTrunk Version 3.84 beta ec3

These programs are proof-of-concept versions to test
various aspects of LTR decoding. Eventually it will
be part of the Trunker/Etrunk programs.

LTRDump.exe will decode and display LTR information. It also
logs the data to a log file named ltrdump.txt in the same
directory as the program.

LTRTrunk.exe will track regular LTR, LTR-Net, Multinet LTR,
and Passport systems. Most of the Trunker features
like talkgoup and id tagging may even work.

These programs run in DOS and have similar requirements
to eTrunk, the EDACS trunk program. LTRDump.exe is based on
the eedump.exe program version 3.8.3. LTRTrunk.exe is
based on the etrunk program version 3.8.3.

Changes since the last release (beta ec2)

More changes to improve the program. Tuned the timing values and
decoder.

LTRDump
Time stamp and version info are added similar to other trunker dump
programs.

Passport check is done. Some values are guessed at so DCC (Area)
values other than 0 and some id values may not decode.

LTRTrunk

System ID is calculated and used. For regular LTR it is 0000 for
Area 0 and 0001 for Area 1. For Multinet it is calculated from
the xor masks since they should be unique to the system. For
Passport it is the Site ID of the system in Hex added to
the DCC (Area) times 1000 hex so 100A is a DCC of 1 with a
site id of 10 (decimal). System ID is filtered and can change
under some conditions.

Fixed problems with calculated 800 MHz and 900 MHz Multinet
frequencies.

Added basic Passport decoding (Finally!!!!).

Fixed crashing when decoding LTR systems due to noise causing the
system type to change. After the system id is determined the mode
is locked. To track another system save and exit.

Known Problems - LTRDump

Decoding of information is very basic. It will decode Regular
LTR and Multinet. The automatic LTR type detection really only
works on transmissions and not on bursts.

Some check values of Passport are guessed at. Some packets and
DCC (Area) values other than zero may not be decoded.

LTR-Net detection only works on a idle system.

Multinet and Passport frequency display is done modulus 31 so it
is possible for frequency information to be displayed on top of
other frequency information.

Known Problems - LTRTrunk

Decoding of information is very basic. It will decode Regular LTR,
Multinet, and Passport. CW-ID and extended commands may show up as
a talkgroup.

The system id (site id) of a passport group id is not used. This may
cause a local group to be merged with one or more different groups
from another site. The mobile unit id is not used.

If multiple systems share a frequency or errors occur then the
system type can change and collected information can be lost.

Some check values of Passport are guessed at. Some packets and
DCC (Area) values other than zero may not be decoded.

Frequencies for Passport are not automatically calculated yet.
A workaround is to use plan 0 and create a map file for each site.

No filtering of Regular LTR and Passport packets to reduce noise
being decoded as valid data. This will be looked at more as basic
decoding progresses.

73 Eric

 

[SCPD]

Go Eric!

 

[cg]

Looks good so far, ran the Marcus system and the Bloomfield Public Safety, works well.

I am leaning toward a basic menu program to run different systems. I have used the "MYMENU" shareware for my dos computer and I am probably going add a "LTRTrunk" submenu with multiple copies of the program in multiple directories. That way when I hit "Bloomfield" it will go to it's own directory and the sys, grp, etc files will not get mixed up. Here is a link to MYMENU
http://www.botteronet.com/tamrof/archive/util.htm

Also, Windsor and East Windsor CT are going to go to Passport so there will be some additional targets. It is yet to be seen if they will network the whole thing.

chris

 

[mr_hankey]

eric,

i couldn't get LTRDump to work properly last time on my tapped 780, so i didn't get to play with the LTRTrunk beta 2 as much as i wanted to...

so let me understand something: if i'm locked on a Regular LTR frequency, LTRTrunk will populate the other known frequencies ala 800 Mhz Motorola Trunker? or are the freqs still revealed in hex and filled in by the user?

i have used VHF/UHF Trunker to track a 400Mhz Mot system in town with custom frequency mapping, and i thought this is how it had to be done with LTRTrunk...am i wrong?

seems like an improvement if Regular LTR and Multinet can automatically populate the frequencies in the system by just monitoring one KNOWN frequency...

 

[EricCottrell]

eric,

so let me understand something: if i'm locked on a Regular LTR frequency, LTRTrunk will populate the other known frequencies ala 800 Mhz Motorola Trunker? or are the freqs still revealed in hex and filled in by the user?

It depends on the LTR system.

Regular LTR will default to plan 0 and use the hex value of the repeater number. You have to fill in the frequency.

Multi-Net LTR will default to plan 8 and use the internal map to convert the "lcn" to a real 800 MHz frequency. You have to change to 9 for 900 MHz, S for 800 splinter, and 0 for everything else. You need to enter frequencies if plan 0.

Passport will default to plan 0 (although it may default to plan 8 due to a bug) and use the hex value of the "lcn" number. You have to fill in the frequency. If it does default to 8 then you need to change the plan to 0.

It appears the Passport system may transmit a band code (The most common one is 5 (450 MHz to 470 MHz). If I get some good dumps on systems not in the 450 to 470 band then I can determine more. It also appears Passport has 800 and 900 MHz mappings like Multi-Net.

If you know the mappings of the system then you can create a map file.
If there is a area zero system then a 0000map.txt file may look like this:
451.3875,0.0,1
453.2500,0.0,5
452.5000,0.0,9
461.3000,0.0,d
461.6000,0.0,11
The result is when the program is run the frequencies will be entered for
channels 1, 5, 9, 13, and 17. This trick also works in my VHF/UHF betas of trunker and etrunk. Handy if you know what frequencies the lcns refer to.

All that LTRTrunk does for Passport LTR is decode group calls and create a sysid from the site id and dcc of the "neighbor" message. I noticed other message types being transmitted but I have only figured out the group call, mobile ID, Neighbor, and group unkey. I need to figure out some logic to display the mobile id.

LTRDump will display some more Passport LTR information. Each group appears to have a Site ID that is the home site of the group. The passport information that I have talks about home and roaming group ids. I think that if the Site Id of the group is not the same as the site it is transmitted on then it is a "roaming" ID. I do not know how to handle this yet and LTRTrunk will not display the Site ID of the group. It seems possible that a system could have the same group id assigned to multiple different groups (one on each site) and to allow for this would mean the group file would have to handle over 8 million group ids! It would also mean changes to the internal structures to allow ids of 24 bits or more.

73 Eric

 

[EricCottrell]

Hello,

I realize that I have not given any guidance as to using the log
files from LTRDump. I find users tend not to have a good idea
of what a good decode looks like and it is my fault.

Occasionally noise can be decoded as a valid frame so a single
frame does not really mean anything. Some versions like beta
ec2 had bugs that caused frames of all zeros being logged.
You need to look for patterns.

I can not stress the need for a clean signal too much. Any
noise increases the chance of it causing errors or being
mistaken for valid data. You need to use a slicer with a
low pass filter to filter out the voice. The program should
decode while there is voice on the channel.

I found the lack of a time stamp to be a problem with logging.
Are those two frames adjacent or hours apart? It also allows
judging the signal quality as you can judge the number of
frames per second.

Regular LTR

The rate of Regular LTR is slightly over 7 frames per second.
If the program is decoding 100 percent there will be 7 frames
each second of log time with a occasional 8 frames a second
of log time. If you were listening to 471.8875 in Boston on
the date and time indicated you might have logged:

========================
Thu May 6 20:26:16 2004 Dumper Version 5-May-2004
========================
229240bd Area:0 Ch 1 Free Ch 17 Active -> User: 0-9-36
1290760d Area:0 Ch 12 Free Ch 9 Active -> User: 0-9-7
1a903190 Area:0 Ch 3 Free Ch 13 Active -> User: 0-9-3
229240bd Area:0 Ch 1 Free Ch 17 Active -> User: 0-9-36
12907400 Area:0 Ch 8 Free Ch 9 Active -> User: 0-9-7
1a903190 Area:0 Ch 3 Free Ch 13 Active -> User: 0-9-3
2292466a Area:0 Ch 12 Free Ch 17 Active -> User: 0-9-36
========================
Thu May 6 20:26:17 2004 Dumper Version 5-May-2004
========================
12907400 Area:0 Ch 8 Free Ch 9 Active -> User: 0-9-7
1a903097 Area:0 Ch 1 Free Ch 13 Active -> User: 0-9-3
1290760d Area:0 Ch 12 Free Ch 9 Active -> User: 0-9-7
1a903190 Area:0 Ch 3 Free Ch 13 Active -> User: 0-9-3
129078eb Area:0 Ch 17 Free Ch 9 Active -> User: 0-9-7
129071dd Area:0 Ch 3 Free Ch 9 Active -> User: 0-9-7
129076ce Area:0 Ch 13 Free Ch 9 Active -> User: 0-9-7
129070da Area:0 Ch 1 Free Ch 9 Active -> User: 0-9-7
========================
Thu May 6 20:26:18 2004 Dumper Version 5-May-2004
========================
1290760d Area:0 Ch 12 Free Ch 9 Active -> User: 0-9-7
3e9074ba Area:0 (Extended) Ch 9 Unkey -> User: 0-9-7
129071dd Area:0 Ch 3 Free Ch 9 Active -> User: 0-9-7
1290760d Area:0 Ch 12 Free Ch 9 Active -> User: 0-9-7
========================
Thu May 6 20:26:19 2004 Dumper Version 5-May-2004
========================
129070da Area:0 Ch 1 Free Ch 9 Active -> User: 0-9-7

The segment starts out with 3 talkgroups active with group
0-9-7 on repeater 9, 0-9-3 on repeater 13, and 0-9-36 on
repeater 17. In short order the users unkey. At 20:26:18
the last user unkeys and another user in the group quickly
keys up.

You can see this system has an unusual repeater number
configuration with 1, 3, 8, 9, 12, 13, and 17.

Multi-Net LTR

The rate of Multi-Net LTR is between 4 and 5 frames per second.
If the program is decoding 100 percent there will be 4 frames
each second of log time alternating with 5 frames a second
of log time. This is an example of a idle Multi-Net LTR
status channel.

========================
Thu May 6 21:14:34 2004 Dumper Version 5-May-2004
========================
155c8b377b0b36a Multinet -> 61a87fc38fffc25 LCN 56 Free LCN 53 Idle (Ch 1)
155c8b377b0b36a Multinet -> 61a87fc38fffc25 LCN 56 Free LCN 53 Idle (Ch 1)
155c8b377b0b36a Multinet -> 61a87fc38fffc25 LCN 56 Free LCN 53 Idle (Ch 1)
155c8b378b0b324 Multinet -> 61a87fc37fffc6b LCN 55 Free LCN 53 Idle (Ch 1)
========================
Thu May 6 21:14:35 2004 Dumper Version 5-May-2004
========================
155c8b378b0b324 Multinet -> 61a87fc37fffc6b LCN 55 Free LCN 53 Idle (Ch 1)
155c8b378b0b324 Multinet -> 61a87fc37fffc6b LCN 55 Free LCN 53 Idle (Ch 1)
155c8b376b0b375 Multinet -> 61a87fc39fffc3a LCN 57 Free LCN 53 Idle (Ch 1)
155c8b379b0b33b Multinet -> 61a87fc36fffc74 LCN 54 Free LCN 53 Idle (Ch 1)
155c8b377b0b36a Multinet -> 61a87fc38fffc25 LCN 56 Free LCN 53 Idle (Ch 1)
========================
Thu May 6 21:14:36 2004 Dumper Version 5-May-2004
========================
155c8b378b0b324 Multinet -> 61a87fc37fffc6b LCN 55 Free LCN 53 Idle (Ch 1)
155c8b379b0b33b Multinet -> 61a87fc36fffc74 LCN 54 Free LCN 53 Idle (Ch 1)
155c8b376b0b375 Multinet -> 61a87fc39fffc3a LCN 57 Free LCN 53 Idle (Ch 1)
155c8b379b0b33b Multinet -> 61a87fc36fffc74 LCN 54 Free LCN 53 Idle (Ch 1)
========================
Thu May 6 21:14:37 2004 Dumper Version 5-May-2004
========================
155c8b378b0b324 Multinet -> 61a87fc37fffc6b LCN 55 Free LCN 53 Idle (Ch 1)

Multi-Net LTR uses xor masks for system security. The log gives the original and
the translated data. They should be different. Multinet uses direct goto LCNs
but the repeater numbers are still specified. Repeater one is LCN 53 which is
935.6625 and the system alao uses 935.675, 935.6875, 935.7000, and 935.7125.

Here is a radio 2123 keying up on group 2-232.

155c8b376b0b375 Multinet -> 61a87fc39fffc3a LCN 57 Free LCN 53 Idle (Ch 1)
155c4ef770d13db Multinet -> 61a8ba038425c94 LCN 56 Free LCN 53 Active -> Group: 2-232 User 2123
========================
Thu May 6 21:28:58 2004 Dumper Version 5-May-2004
========================
155c4ef760d13c4 Multinet -> 61a8ba039425c8b LCN 57 Free LCN 53 Active -> Group: 2-232 User 2123
155c4ef760d13c4 Multinet -> 61a8ba039425c8b LCN 57 Free LCN 53 Active -> Group: 2-232 User 2123
155c4ef770d13db Multinet -> 61a8ba038425c94 LCN 56 Free LCN 53 Active -> Group: 2-232 User 2123
155c4ef790d138a Multinet -> 61a8ba036425cc5 LCN 54 Free LCN 53 Active -> Group: 2-232 User 2123
========================

Passport

The rate of Passport LTR is between 4 and 5 frames per second.
If the program is decoding 100 percent there will be 4 frames
each second of log time alternating with 5 frames a second
of log time. The idle bursts of a passport system are what
I call "Neighbor" frames and usually occurs every two seconds.

========================
Thu May 6 21:37:41 2004 Dumper Version 5-May-2004
========================
1c0630a8a8c57b2 Passport Neighbor -> DCC: 0 LCN 1111 c:1793 g:70-5397
========================
Thu May 6 21:37:43 2004 Dumper Version 5-May-2004
========================
1c0630a8a8c4693 Passport Neighbor -> DCC: 0 LCN 1094 c:1793 g:70-5397
========================
Thu May 6 21:37:45 2004 Dumper Version 5-May-2004
========================
52ffffff *revcrc Area:1 (Unknown) C: 9 H:15 G:255 F:31
1c0630a8a88e040 Passport Neighbor -> DCC: 0 LCN 224 c:1793 g:70-5397
19264905b4f2360 Multinet -> 19264905b4f2360 LCN 91 Free LCN 804 Active -> Group: 25-36 User 2532
========================
Thu May 6 21:37:49 2004 Dumper Version 5-May-2004
========================
0e0318545447020 Multinet -> 0e0318545447020 LCN 325 Free LCN 448 Active -> Group: 12-97 User 2190
========================
Thu May 6 21:37:51 2004 Dumper Version 5-May-2004
========================
1c0630a8a8c57b2 Passport Neighbor -> DCC: 0 LCN 1111 c:1793 g:70-5397
========================
The DCC (Area) of this system is zero. The 70 is the site id and 5397
is a system configuration word. The LCN are goto frequencies for
neighboring sites. This is a 450 to 470 MHz system so 91 is 451.1375,
224 is 452.8000, 1094 is 463.675, and 1111 is 463.8875.

You can also see some noise affecting the decoding at 21:37:45 and 21:37:49
with the burst at 21:37:47 missing. The Regular LTR and Multinet packets
are not valid.

Here is Mobile ID 2251 of site 40 talking on group 62047.

========================
Tue Mar 9 21:33:44 2004 Dumper Version 06-Mar-2004
========================
014d4792f839fa1 Passport LCN 927 Free LCN 83 Active -> Group: 40-62047
014d40465b06154 Passport LCN 97 Free LCN 83 Active -> MID: 40-2251
000ad4792f80e969 Multinet *badpar (0001)
014d4792f839fa1 Passport LCN 927 Free LCN 83 Active -> Group: 40-62047
014d4792f80617b Passport LCN 97 Free LCN 83 Active -> Group: 40-62047
========================
Tue Mar 9 21:33:45 2004 Dumper Version 06-Mar-2004
========================
014d4792f80e969 Passport LCN 233 Free LCN 83 Active -> Group: 40-62047
014d4792f839fa1 Passport LCN 927 Free LCN 83 Active -> Group: 40-62047
014d4792f80617b Passport LCN 97 Free LCN 83 Active -> Group: 40-62047
014d4792f80e969 Passport LCN 233 Free LCN 83 Active -> Group: 40-62047
========================
Tue Mar 9 21:33:46 2004 Dumper Version 06-Mar-2004
========================
014d4792f839fa1 Passport LCN 927 Free LCN 83 Active -> Group: 40-62047
014d40465b06154 Passport LCN 97 Free LCN 83 Active -> MID: 40-2251
1c0190a8a8c4893 Passport Neighbor -> LCN 1096 c:1792 g:50-5397
014d4792f80e969 Passport LCN 233 Free LCN 83 Active -> Group: 40-62047
========================
Tue Mar 9 21:33:47 2004 Dumper Version 06-Mar-2004
========================
014d4792f839fa1 Passport LCN 927 Free LCN 83 Active -> Group: 40-62047
014d4792f80617b Passport LCN 97 Free LCN 83 Active -> Group: 40-62047
014d4792f80e969 Passport LCN 233 Free LCN 83 Active -> Group: 40-62047
1ffd4792f885302 Passport LCN 83 Free Unkey -> Group: 40-62047
1c0590a8a8c5b03 Passport Neighbor -> LCN 1115 c:1793 g:50-5397
========================

The Multinet frame is not valid and likely a bad Passport LTR frame.
Ocassionally the Mobile ID and neighbor information is sent.
The mobile is talking on 451.0375 at site 50 (Wolcott, CT). Site 50
also has 451.2125 (97), 452.9125 (233), and 461.5875 (927).

73 Eric

 

[mr_hankey]

i'm playing around with this tonight - it would appear one of our news choppers is on a Passport LTR system and i'm trying hard to figure out the frequency mapping for the system.

unfortunately, my passthrough tap isn't working with LTRTrunk, so i'm having to default to my serial pin workup (i think it's slicer A tap, can't remember).

dumper is working great though!

i am getting some 800 Mhz frequencies in place of hex values on the Passport sys.txt file, so i'm still trying to figure out what's going on...

either way, LTRTrunk is offering more insight to my local LTR systems than i would have garnered on my own!

great job!

 

[EricCottrell]

Hello,

Thank you. A passport system on 800 MHz is a great find since most are on UHF.

I noticed in looking around the net that there is a big passport system run by Teletouch in East Texas.

I use the Slicer A tap on my BC780 with excellent results. I have a bank set up for LTR trunking and scan it in trunk mode to "setup" the scanner. It will stay in LTR mode until powerdown or you start scanning a EDACS or Motorola bank. I have search banks setup for UHF, 800, and 900 to search for new systems.

If you post the hex values so far with the frequencies they represent then maybe I could see a pattern. I suspect it will be similar to other systems where 1 represents 851.0125 and there are 25 KHz steps until 866.0125 then 12.5 KHz steps. Motorola and Multi-Net have gaps in their 800 MHz schemes for some reason. If you make a map file (nnnnMap.TXT where nnnn is the sysid) with the following two lines in it
851.0125,0.025,1
866.0125,0.0125,259
then put the program and config files in a new directory with the map file. See if the frequencies come out correctly.

73 Eric

 

[mr_hankey]

ah, it looks like my LND8 tap on the BC780 isn't working right, which is leading to the bad signal, which sucks because it's my only pass-through tap!

i am now using the pin-6 tap on the BC780's serial port and decoding just fine.

the system i was tracking last night was:

LTR Passport 
Sysid 1034

  v0x0ee
  v0x376
c v463.6625
  v0x457
  v0x465
  v0x466
  v0x467

this system appears to be used by News 12 Helicopter for live feeds and reporting.

 

[EricCottrell]

Hello,

Oh, I misunderstood and throught it was a 800 MHz system.

463.6625 should have a hex value of 0x445.

0ee = 452.9750
376 = 461.0750
457 = 463.8875
465 = 464.0625 May not be valid
466 = 464.0750 May not be valid
467 = 464.0875 May not be valid

This is a system on the 450 to 470 band. If you create a text file called 1034map.txt and put the following line in
450.0125,0.0125,1
then any new frequency will be calculated.

This looks great because a sysid of 1034 indicates a DCC of 1. I guessed at that check code and it looks like I was correct. I would be interested in ltrdump.txt files of a few active frequencies.

Doing an FCC search on the frequencies shows the last 3 may not be valid frequencies. Very likely noise or decoding errors.

It appears that this is a big Passport LTR system around the San Antonio area and you may be able to hear the News Copter on other sites. There may be one closer to your location. You are likely picking up the 101 Bowie St site. If you search on Poole, Duane A for Texas licenses then you will see several pages of them.

Some of the licenses are
Poole, Duane Aoole, Hattie C DBA Industrial Communications
San Antonio
WPMC789 101 Bowie St 452.9750 461.0750 461.7000
WPMW369 101 Bowie St 452.3375, 461.5375, 463.6625, 463.8875, 464.6875
WPPG459 1535 Military Hwy 451.4500 451.7250 451.8500 451.9500 452.3500 452.6500 453.0000 461.0750 461.1750 461.2750
WPYQ779 One SBC Center 451.3500 451.9125 462.0250 461.0750
plus a whole bunch of other licenses...

New Braunfels, Tx
WPMZ796 Texas FM 306 451.9625 463.6625 464.6125 464.8125
plus others

I noticed that a number of frequencies are licensed to multiple sites which may explain why there is a DCC (or Area) code of 1 used. The radio will ignore a DCC that is different than the DCC of the site they are using.

73 Eric

 

[mr_hankey]

max 6 LCN's?

ok, i'm back after a long Saturday working with LTRTrunk.

here's something weird i'm seeing: certain 800Mhz Regular LTR systems flesh out to 6 frequencies per site, EXACTLY like the Passport LTR systems i'm decoding...i'm not sure what this means.

of course there are other Regular LTR systems that have more than 6 frequencies per site, but it seems that running LTRTrunk on any ltr frequency in this town eventually fills out to 6 frequencies max.

the only exception so far has been a Passport system that i changed freqs on in mid-decoding and got a false LCN (that never went active again once i switched back).

i know one system, the Time Warner Regular LTR, is comprised of 2 sites with about 19 frequencies (North South), but when i run LTRTrunk on one of the active frequencies off the NOrth site, i max-out at 6 LCN's...

Eric, has LTRTrunk generated more than 6 LCN's for you on local systems that you KNOW have more than 6 LCN's?

 

[EricCottrell]

Hello,

Welcome to the LTR Explorers Club 8->.

In the Boston Area there are an active UHF system with 7 repeaters (1, 3, 8, 9, 12, 13, 17) and a 900 system with 9 channels (1, 3, 5, 7, 9, 13, 15, 17, 19). LTR trunk does fine on both.

I noticed that the TRS database lists Industrial Communications as Regular LTR from the same sites. This is the first known Passport system that maybe mixed mode (Passport and Regular LTR). It would be interesting to see if a repeater can have both Passport and Regular LTR on it. I have seen information that the Passport controllers support both Passport and Regular LTR but what is not known is if a repeater has to be dedicated to either Passport or Regular LTR. There is also a mention that Regular LTR radios can talk to Passport radios but again the details on how it is done is unknown. It could be a crosslink between a Regular LTR repeater and the Passport System at the Controller level.

73 Eric

 

[EricCottrell]

Hello,

I found in LTRDump that group 65535 does not show up in Passport decoding. So during CW IDs all you see displayed is the free channels. Fix will be in the next beta.

I also found a few problems here and there that could cause crashing.

73 Eric

 

[mr_hankey]

as far as bugs, don't forget the tendency of LTRTrunk to map Passport to Plan 8.

every LTR Passport system i've decoded so far i have to stop 1/2 way through and go change the Plan to "0".

 

[EricCottrell]

Hello,

Thanks to user feedback a new call type has been uncovered. LTRDump will decode it as Unknown Type 2. It is not decoded by LTRTrunk so it will not be displayed. It was used by a base station so it could be a special patch.

There are 16 basic message types and I have only decoded a few of the common ones.

73 Eric

 

[EricCottrell]

Hello,

Beta version 4 is available in this thread.
http://www.radioreference.com/modules.php?name=Forums&file=viewtopic&p=88422#88422

73 Eric