Mapping out a DMR CAP+ System

[BinaryMode]

My local hospital seems to have gone CAP+ and with what seems like encryption. Despite that I would like to map it out and add it here to the database.

1) How do I do that? (I'm thinking DSD+)

2) I've never monitored a CAP+ system before. Not a lot in the area. I use a 996P2 in the car. I guess it would be programmed as a trunked system in some way? Again, they seem encrypted because monitoring one frequency was dead silent on the scanner. The scanner would flash CAP+ however.

 

[buddrousa]

What Scanner?
Could it be the rest channel you are seeing?

 

[Whiskey3JMC]

First and foremost you'll need the FCC license so you can check each frequency for the info I'm about to give you..

1) How do I do that? (I'm thinking DSD+)

Yes, having an SDR with DSD+ Fastlane helps tremendously to get visual info on a system. Tune your SDR to each frequency and if you see data bursts, go to DSD+'s channel activity window and take note of what channel pair the frequency you are tuned to reports. Note that CAP+ ch IDs always come in pairs, one ID # per timeslot. One frequency may report Rest Channel 2 so the channel ID pair there would 1&2, the even number always being last. In my example below, with the rest channel being 6 the channel ID pair for this frequency is 5&6. Now your LCN for frequencies in CAP+ systems is the even number of the channel pair divided by 2 so in my example below the LCN would be 6 / 2 = 3.


If/when data bursts disappear on one frequency, check the remaining frequencies on the license for their channel ID pairs. When you're confident you've ID'ed every active frequency on the system (could take hours, maybe days depending on how active the system is and how often rest channels are rotated) and their channel ID pairs / LCNs then you have successfully mapped out the system. Once you have all the channel info and at least one confirmed talkgroup & its use you'll be ready to make your RRDB submission.

The bottom of the DSD+ event log window will give you the site ID, color code & neighbor list if reported (the latter not applicable to CAP+ single site of course)

2) I've never monitored a CAP+ system before. Not a lot in the area. I use a 996P2 in the car. I guess it would be programmed as a trunked system in some way?

Yes, you would program as a MotoTRBO trunked system

 

[mtindor]

My local hospital seems to have gone CAP+ and with what seems like encryption. Despite that I would like to map it out and add it here to the database.

1) How do I do that? (I'm thinking DSD+)

2) I've never monitored a CAP+ system before. Not a lot in the area. I use a 996P2 in the car. I guess it would be programmed as a trunked system in some way? Again, they seem encrypted because monitoring one frequency was dead silent on the scanner. The scanner would flash CAP+ however.

A lot of business trunked systems are fairly idle outside of normal business hours. To make it as easy as possible to map out one, you really want to try and do the monitoring at a time when the system/site is most active.

DSDPlus is one way to map it out (and in my mind the recommended way). On CAP+ systems, DSDplus (and scanners that support DMR trunking) are not going to determine the LCNs associated with the frequencies until voice calls (in-the-clear or encrypted) are heard. So you basically have to sit on the frequencies (usually the best would be the beaconing rest channel) and just wait for a voice call. If you were using DSDPlus and doing that, when a voice call occurs on _that_ frequency it is going to tell you what LCN is associated with that frequency.

If you are logging, which by default DSDPlus would be doing, you can find some info in the 1R-DSDplus.event file (which is just a text file).

Example:

2022/04/02 16:38:57 Freq=451.675000 Current site: 1
2022/04/02 16:39:00 Freq=451.675000 DCC=14 Enc TXI Group call; TG=52 RID=1133 Ch=2 Alg=BP
2022/04/02 16:39:00 Freq=451.675000 DCC=14 Group call; TG=52 Ch=1
2022/04/02 16:39:00 Freq=451.675000 DCC=14 451.675000 is first Cap+ repeater (Ch1 and Ch2)
2022/04/02 16:39:00 Freq=451.675000 DCC=14 Enc TXI Group call; TG=52 RID=1133 Ch=1 Alg=BP 5s
2022/04/02 16:39:05 Freq=451.675000 DCC=14 Enc TXI Group call; TG=52 RID=1161 Ch=1 Alg=BP 6s
2022/04/02 16:39:12 Freq=451.675000 DCC=14 Enc TXI Group call; TG=52 RID=1133 Ch=1 Alg=BP 3s
2022/04/02 16:39:15 Freq=451.675000 DCC=14 Enc TXI Group call; TG=52 RID=1161 Ch=1 Alg=BP 5s

2022/04/05 09:05:22 Freq=452.075000 Group call; TG=5 Ch=3 2s
2022/04/05 09:05:26 Freq=452.075000 DCC=1 Group call; TG=5 Ch=4
2022/04/05 09:05:26 Freq=452.075000 DCC=1 Group call; TG=5 RID=6008 Ch=4
2022/04/05 09:05:26 Freq=452.075000 DCC=1 452.075000 is second Cap+ repeater (Ch3 and Ch4)

So we we were parked on 451.675 just monitoring one particular frequency of one Cap+ site. When a voice call occurred, DSDPlus determined that 451.675 was the first Cap+ repeater (aka LCN 1).

And when we were parked on 452.07 monitoring a frequency from another Cap+ site, when a voice call occurred DSDPlus determined that 452.075 was the second Cap+ repeater (aka LCN 2).

LCN 1 (ch1 / ch2 in the Channel Activity Window)
LCN 2 (ch3 / ch4 in the Channel Activity Window)

In this case, those were from two different Cap+ systems. But those freqs very well could have been from the same Cap+ site. I just know they weren't because they were using different color codes (DCC).

Notice that an encrypted voice call occurred on 451.675, which is what enabled DSDPlus to determine the LCN. And a clear call occurred on 452.075 that enabled DSDPlus to determine its LCN.

 

[mtindor]

First and foremost you'll need the FCC license so you can check each frequency for the info I'm about to give you..

Yes, having an SDR with DSD+ Fastlane helps tremendously to get visual info on a system. Tune your SDR to each frequency and if you see data bursts, go to DSD+'s channel activity window and take note of what channel pair the frequency you are tuned to reports. Note that CAP+ ch IDs always come in pairs, one ID # per timeslot. One frequency may report Rest Channel 2 so the channel ID pair there would 1&2, the even number always being last. In my example below, with the rest channel being 6 the channel ID pair for this frequency is 5&6. Now your LCN for frequencies in CAP+ systems is the even number of the channel pair divided by 2 so in my example below the LCN would be 6 / 2 = 3.
View attachment 169259

If/when data bursts disappear on one frequency, check the remaining frequencies on the license for their channel ID pairs. When you're confident you've ID'ed every active frequency on the system (could take hours, maybe days depending on how active the system is and how often rest channels are rotated) and their channel ID pairs / LCNs then you have successfully mapped out the system. Once you have all the channel info and at least one confirmed talkgroup & its use you'll be ready to make your RRDB submission.

The bottom of the DSD+ event log window will give you the site ID, color code & neighbor list if reported (the latter not applicable to CAP+ single site of course)
View attachment 169260

Not always true about the rest channel. There could be a 3-channel system that was heavily in use, and that system could easily have two (or all three) frequencies beaconing that the Rest channel is 6. That doesn't mean the the frequency reporting the Rest channel info is ch 6. So you can't just determine it was LCN 3 based upon that.

Colonial Terminals out of Savannah Georgia, or the Charleston Co SC School District Cap+ system are very active. At any given time during business hours, there are multiple channels beaconing the current rest channel for the site.

The accurate way to determine the LCN is to wait for a voice call to occur on the Cap+ freq that you are monitoring, at which time DSDPlus will specifically tell you what the LCN is (see my previous post).

Mike

 

[RoninJoliet]

Assension hospital in my town installed aCap system,...I programmed all three frequencies as conv and labeled them digital, the active one shows "cap", , pressing f2 on my 996P2 shows "cc8" and pressing f3 shows the UIDs,. I then programmed it as a Moto TRBO single channel system and it works great....It is NOT encrypted,....

 

[BinaryMode]

Very good information. I don't use DSD+ that often, but am familiar with it. I just open those human readable text files with Notepad++.

I will try and map this out as best I can. I don't know if sitting in the hospital parking lot would be the best of decisions though. Nearby there are a few places I could "loiter" I suppose. But, I've been taking my mother to her appointments at this hospital so I could do some logging there. That's when I discovered that the supposed NXDN frequency was no more and my scanner flashed CAP+. Also, Close Call kept going off.

I suppose there's really no way to find the LCNs with the scanner rather than an SDR and DSD+ ?

LCNs used in trunking systems is not something I have really ever messed with much. I have, but not very often. I think for LTR trunking systems there's math to figure out the LCNs? Can that idea be applied here for a CAP+ system or no?

DSD+ says DCC. CC is Color Code but what does the D stand for? Digital?

Thanks.

Assension hospital in my town installed aCap system,...I programmed all three frequencies as conv and labeled them digital, the active one shows "cap", , pressing f2 on my 996P2 shows "cc8" and pressing f3 shows the UIDs,. I then programmed it as a Moto TRBO single channel system and it works great....It is NOT encrypted,....

It's interesting because I noticed a few other hospitals in this state of this non-profit company (?) in the database are also CAP+ systems. I wonder why they chose that over anything else? Must be a reason. When I could hear their NXDN conventional channel (and now that I think of it, I might be able to hear their CAP+ system here at home) it seemed like their panic buttons on the parking lot lights were somehow tied to the NXDN system as I heard the robotic voice when someone pressed the panic button out in the parking lot. So knowing this, and how I read data can somehow be used in a DMR system, perhaps that's one reason.

What Scanner?
Could it be the rest channel you are seeing?

Probably was the rest channel since the BCD996P2 flashed CAP+. That frequency used to be NXDN conventional. Thus I had it programed in the scanner in my car. To my surprise it is now CAP+.

 

[mtindor]

Very good information. I don't use DSD+ that often, but am familiar with it. I just open those human readable text files with Notepad++.

I will try and map this out as best I can. I don't know if sitting in the hospital parking lot would be the best of decisions though. Nearby there are a few places I could "loiter" I suppose. But, I've been taking my mother to her appointments at this hospital so I could do some logging there. That's when I discovered that the supposed NXDN frequency was no more and my scanner flashed CAP+. Also, Close Call kept going off.

I suppose there's really no way to find the LCNs with the scanner rather than an SDR and DSD+ ?

LCNs used in trunking systems is not something I have really ever messed with much. I have, but not very often. I think for LTR trunking systems there's math to figure out the LCNs? Can that idea be applied here for a CAP+ system or no?

DSD+ says DCC. CC is Color Code but what does the D stand for? Digital?

Thanks.

If you have a scanner with DMR capabilities, and you know the frequencies associated with the CAP+ site, you can program the CAP+ system as a DMR trunked system and then use the LCN finder to find the LCNs. The problem with that (just like with DSDPlus or anything else) is that the scanner will not be able to determine the LCNs unless there is voice activity on those frequencies.

And to make matters a little more difficult, on a Uniden scanner (for example) if you know a site has 3 licensed frequencies and you know it is a CAP+ site, and you then program in all three frequencies as a DMR Trunked system and run LCN Finder, the LCN Finder will never complete unless it finds voice activity on all three frequencies and is able to determine their LCN. And oftentimes there are more frequencies licensed for a CAP+ site than are actually in use. Thus you run LCN Finder forever and it never completes because it can't find an LCN for the non-active frequency(s). You have to manually stop the LCN Finder at some point (and there is a proper way to do that on a Uniden which I forget) so that you can see what LCNs it actually did find.

Granted, much easier to carry a scanner around and try to sleuth. No doubt. But, as long as the site/system is active and you know all of the suspect frequencies, you can likely more easily determine the LCNs if you have a laptop, dongle and DSDPlus.

Because I know DCC is color code, what D stands for means nothing to me. I suspect it's "Digital" but maybe its "DMR". I don't know that "DCC" exists as an acronym anywhere else other than in DSDPlus itself. So all we need to know is that DCC is "the color code" associated with a particular DMR frequency. And the color code is just a "digital" access code, just like a P25 NAC, or an analog PL/DCSS tone.

 

[buddrousa]

@mtindor
The 996P2 does not have a LCN Finder only SDSx00's and the x36's have that.

 

[mtindor]

@mtindor
The 996P2 does not have a LCN Finder only SDSx00's and the x36's have that.

Good to know. I wasn't aware.

 

[BinaryMode]

So, it appears I may need the Fastlane version of DSD+, because this is what I see in the attachment. It appears the frequency I'm monitoring is a rest channel and voice channel. I don't know how DMR trunked systems work.

This is the system. https://wireless2.fcc.gov/UlsApp/UlsSearch/licenseFreqSum.jsp?licKey=1707424

10 frequencies. The other 10 are repeats. I can't load the link now because the government suxx... (been this way with the FCC database for years!) There are repeaters (for lack of the right name) belonging to several hospitals. The one I'm trying to map is location 5 on Rocky Mountain Ave. Each hospital has one repeater and then there are several mobiles. I don't understand how this works. Are the mobiles input frequencies? I guess the repeater is the output?


As you can see from the SDR# attachment that one frequency has what appears to be data and voice. And monitoring that frequency on my scanner it'll sometimes say CAP and ENC.

 

[mtindor]

So, it appears I may need the Fastlane version of DSD+, because this is what I see in the attachment. It appears the frequency I'm monitoring is a rest channel and voice channel. I don't know how DMR trunked systems work.

This is the system. ULS License - Industrial/Business Pool, Conventional License - WPCB551 - POUDRE VALLEY HOSPITAL - Frequencies Summary

10 frequencies. The other 10 are repeats. I can't load the link now because the government suxx... (been this way with the FCC database for years!) There are repeaters (for lack of the right name) belonging to several hospitals. The one I'm trying to map is location 5 on Rocky Mountain Ave. Each hospital has one repeater and then there are several mobiles. I don't understand how this works. Are the mobiles input frequencies? I guess the repeater is the output?


As you can see from the SDR# attachment that one frequency has what appears to be data and voice. And monitoring that frequency on my scanner it'll sometimes say CAP and ENC.

'
When there are voice calls (encrypted or not) on that particular frequency, you need to watch what it says in the EVent Window (or in the DSDplus.event file).

Given that you see ch 3/4 in the Channel Activity window, we know there are at least two repeaters at that site (LCN 1 = ch 1/2, LCN 2 = ch3/4). But we have to be able to determine which LCN you are monitoring. And you'll know that when voice activity occurs on teh frequency you are monitoring and the Event Window says something about it being the First or Second Cap+ repeater.

 

[mtindor]

'
When there are voice calls (encrypted or not) on that particular frequency, you need to watch what it says in the EVent Window (or in the DSDplus.event file).

Given that you see ch 3/4 in the Channel Activity window, we know there are at least two repeaters at that site (LCN 1 = ch 1/2, LCN 2 = ch3/4). But we have to be able to determine which LCN you are monitoring. And you'll know that when voice activity occurs on teh frequency you are monitoring and the Event Window says something about it being the First or Second Cap+ repeater.

oddly, the license only shows one frequency for that location. But DSDplus is showing a ch 3/4 (an LCN 2). So I'm suspecting there would be two frequencies (LCN 1 / ch 1 and 2, and LCN 2 / ch 3 and 4).

 

[n8yid]

Just a thought....

Possible they have another frequency / repeater under a different license...?
I see there is a WPEJ875 - 461.9750 for that same site...
True, it is licensed as 11K2F3E (conventional); but, I've seen things happen...

In my area, we have a Hospital that had a two frequency CAP+ system - one repeater licensed for one frequency; and, another repeater licensed for another frequency...

 

[BinaryMode]

I'm going to give SDRTrunk a try and see what that gives. At the SDRTrunk Github page it doesn't say it supports DMR, but according to ChatGPT it does, but always using the mine cart full of salt philosophy with AI, I searched around and found out that SDRTrunk DOES support DMR as ChatGPT rightfully indicated.

Me thinks the SDRTrunk Devs should update their Wiki...

Just a thought....

Possible they have another frequency / repeater under a different license...?
I see there is a WPEJ875 - 461.9750 for that same site...
True, it is licensed as 11K2F3E (conventional); but, I've seen things happen...

In my area, we have a Hospital that had a two frequency CAP+ system - one repeater licensed for one frequency; and, another repeater licensed for another frequency...

I'll make a note of this. Thanks.

 

[mtindor]

I'm going to give SDRTrunk a try and see what that gives. At the SDRTrunk Github page it doesn't say it supports DMR, but according to ChatGPT it does, but always using the mine cart full of salt philosophy with AI, I searched around and found out that SDRTrunk DOES support DMR as ChatGPT rightfully indicated.

Me thinks the SDRTrunk Devs should update their Wiki...






I'll make a note of this. Thanks.

Go for it. Just keep in mind, for SDRTrunk to properly trunk it wants to know (a) all active freqs on the site and (b) their LCN

 

[BinaryMode]

Yes, found that out. I was hoping it would show the LCNs, but that wasn't the case.

This is all I see in the DSDPlus.event file.

2024/09/16  09:21:45  DSD+ 1.101pt  [Public Release]
2024/09/16  09:21:45  D-STAR decoding enabled
2024/09/16  09:21:45  NXDN4800 decoding enabled
2024/09/16  09:21:45  NXDN9600 decoding enabled
2024/09/16  09:21:45  DMR/MotoTRBO decoding enabled
2024/09/16  09:21:45  P25 Phase 1 decoding enabled
2024/09/16  09:21:45  X2-TDMA decoding enabled
2024/09/16  09:21:45  ProVoice decoding enabled

Again, I think I need the Fastlane version. I read this version doesn't do DMR very well. That screenshot is all I see monitoring that frequency. If I monitor that frequency in the scanner it'll sometimes flash CAP and ENC.

 

[mtindor]

Yes, found that out. I was hoping it would show the LCNs, but that wasn't the case.

This is all I see in the DSDPlus.event file.

2024/09/16  09:21:45  DSD+ 1.101pt  [Public Release]
2024/09/16  09:21:45  D-STAR decoding enabled
2024/09/16  09:21:45  NXDN4800 decoding enabled
2024/09/16  09:21:45  NXDN9600 decoding enabled
2024/09/16  09:21:45  DMR/MotoTRBO decoding enabled
2024/09/16  09:21:45  P25 Phase 1 decoding enabled
2024/09/16  09:21:45  X2-TDMA decoding enabled
2024/09/16  09:21:45  ProVoice decoding enabled

Again, I think I need the Fastlane version. I read this version doesn't do DMR very well. That screenshot is all I see monitoring that frequency. If I monitor that frequency in the scanner it'll sometimes flash CAP and ENC.

You aren't going to see anything "useful" in the DSDPlus.event file until there are actual group / private calls, which in this case sound like they are going to be ENCrypted (at least some of them). But what you show above cannot be the only thing in the DSDPlus.event file. There should be other information in there regarding every system / every digital signal that DSDPlus ends up decoding to any extent.

The best thing to do is just watch the main Event Window sccreen in DSDPlus (that's the main window). When there is a Private Call or Group Call, AND that Private or Group call occurs on the frequency you are parked on, it'll tell you the LCN (This is the First Cap+ Repeater (LSN 1 /2)) or something to that effect. Of ccourse, I'm referring to a CAP+ system only.

You need to leave it parked on a frequency long enough for some activity to occur. Some systems have very little or not active outside of business hours or on weekends. Some have little activity anytime of the day or night.

Mike

 

[mtindor]

Again, I think I need the Fastlane version. I read this version doesn't do DMR very well. That screenshot is all I see monitoring that frequency. If I monitor that frequency in the scanner it'll sometimes flash CAP and ENC.

It should do CAP+ just fine.

 

[BinaryMode]

Do I need to enter the frequency into a DSD+ config file somewhere? Because what I'm doing now is feeding DSD+ audio via SDR#. When I do this all I see are talkgroups, RIDs, etc. No LCN Info. like you pointed out.