Naughty "Radio-As-A-Scanner?"

Status
Not open for further replies.

ohiodesperado

Member
Joined
Nov 9, 2006
Messages
82
Reaction score
16
Location
Johnstown, Ohio
OK, this is going to be quick, as I have to leave for work.
A radio has to have a valid ID on the system. Since no one is going to issue you an ID, you would have to use one you either made up (typically will not work if system is properly configured) or clone an ID from another radio (creates administration headaches for system admin and gets your radio inhibited)

The radio by design needs to authenticate to the system. This means it HAS TO TRANSMIT.
If you are not authorized on the system, and are transmitting this puts you in the hot seat.

Programming your radio to not TX will not keep it from authenticating. Even if all talk groups are set RX only. It's the way Motorola does it, because they can.

Old type two systems, you could disable the RF output and fool the radio into thinking it was there but electrically disable TX and it would work. Newer radios, and systems require two way communication to work.

Scanners work on RX the same way that full radios do. They both listen to the control channel data watching for specific TG ID's that are in that radio. IF you have that TG in the radio, it pushes the radio to RX on the assigned channel and you hear the conversation. No difference. The difference is the TX part.

Now the bad news.
The newest systems are TDMA. This is the same technology that MOTOTRBO works on and currently there are NO scanners that will receive it. Again, it requires two way communications for timing and will always require that as far as I can see. So as new systems are put on line that are 7.X and above in TDMA, scanner listeners will have less to listen to.
 

W2NJS

Member
Joined
Mar 27, 2006
Messages
1,938
Reaction score
6
Location
Washington DC
After reading this thread it becomes even more apparent how misinformation gets started and then misleads people. Please people, don't comment about things that you know little or nothing about.
 

ohiodesperado

Member
Joined
Nov 9, 2006
Messages
82
Reaction score
16
Location
Johnstown, Ohio
After reading this thread it becomes even more apparent how misinformation gets started and then misleads people. Please people, don't comment about things that you know little or nothing about.


Not sure what you are referring to other than maybe the statements that n5ims made about duplicating ID's on a system and having the radio somehow get directed to a different talkgroup.

OK, for a better explanation of how Motorola trunking works, or at least what I was told when I say in the system training class over at Schaumburg, was that when you turn on a subscriber, it transmits an outbound signalling word on the control channel and tells the system controller that the radio is active. Mind you this is on a type 2 Smart Zone system. Might be Smart Net, I seem to always get it backwards,,, but anyway.

Now when a subscriber (portable or mobile) keys up, it again transmits on the control channel receive frequency. The system considers this an inbound signalling word. It contains the talk group ID it wants to talk on and the assigned ID of the radio. The system checks for an open channel and creates an outbound signalling word telling all other subscribers that the specific talk group is going to be on channel X. This channel number is actually a number and NOT a specific frequency. This is what is changing with regards to the 800Mhz rebanding initiative. The FCC has actually assigned all available 700, 800 and 900 pairs a specific channel number. This is the information contained in the outbound signalling word. Now, again, the controller transmits the channel number and talk group ID out on the control channel in the outbound signaling word. The radios that are on that talk group or a scanning that talkgroup tune from the control channel to the assigned channel and open squelch for lack of a better term. The transmitting subscriber begins transmitting on the input frequency on that assigned channel and the other subscribers begin receiving it. Now a dispatch console is a horse of a different color, and I am not going into how an Embassy switch works here, as it don't apply here and I ain't typing all that out. If you want to know, go look it up on the web or something.

OK, there is HOW it works with a no BS working subscriber. Scanners are a bit different but are similar ion a couple ways. The reason that you ONLY have to program control channels into the scanner and not every channel of the system is this simple. As I mentioned above, the FCC assigned every pair a specific number. So when a talk group is assigned a channel by those numbers the scanner knows where to tune to. Now this is also why the early scanners will not work correctly when rebanding takes place in your area. Case in point, a local city wide type 2 system I know of has it's control channel being reassigned. Scanners with that control channel in them will hear nothing after rebanding and in truth, hear nothing on that frequency now because it's locked out as a control channel because it's going to be changed.
Every channel is not capable of being control channel either. Typically a system will have 1 to 4 control channels. Also, with older scanners, and subscribers for that matter that are not rebanded. If a talk group gets assigned a rebanded channel, it will go to where it thinks it should go but because the frequency for that channel changed due to rebanding, there will be nothing there to listen to.

Now some final thoughts on using an actual subscriber as a scanner.
First off, the city I work in has a specific law stating that possessing a radio programmed for the public safety system is a crime. You can own all the 800Mhz type 2 trunking radios you want, you just can't program them for the cities system. A number of cities have similar laws. Some states ban scanner use in vehicles all together unless you are with public safety or a ham. It would be my guess that those areas would frown on having a full radio programmed up with their system. Now, back to the ID thing, past, present and a look forward. At least in this area. In the past there was a receive only ID that news media and such could use to access the system. The controller had it assigned so that it was not granted access to talk on any talk group but could listen to them. It was turned off and set to inhibit ANY radio (read that brick the radio) that was programmed with that ID. The system owner decided to charge per ID and began monitoring the system with advanced software so that it would see if a radio would come on the system multiple times... IE more than one radio with the same ID. When the advanced software detected this more than once, it would inhibit ALL radios with that ID. Of course the paying customer would receive a new ID, and the radio got turned back on with a new ID. I will not specifically go into how this works, but if you have a radio that gets inhibited and you are not authorized on the system, it requires the radio to be sent into the depot (Motorola equipment) and fixed. Before anyone says something silly, yes there are ways around it, but get caught doing it and you WILL have a problem with several legal departments including Motorola's.
That's how it rolls now.
A look ahead.
With newer systems comes new hurdles. Radios are becoming something else. With the newest wizbang stuff, the control channel data is changing again. Taking a page from the cell phone industry, all the newest stuff has in addition to a system administrator assigned ID will have an ESN or electronic serial number. In addition to having this ESN, it will have advanced remote control functions that can allow the system admit to track the location of the radio by GPS. So if you clone an ID, you will trigger a system alarm. The administrator will get a warning that two radios with different ESN's but the same assigned ID are on the system. At that point the admin can locate the radio via GPS, by enabling it as ALL the radios have it. And in the same action brick the radio. So the radio is sitting there, transmitting it's GPS location to the system admin and is bricked. And you CAN'T change the ESN as it's hard coded. So if you go playing that game,,,, you WILL get a knock at the door. And you and your ebay radio will be going for a free ride in a police car. Now make no mistake, if you are buying $7000 radios on ebay that are new technology, they came from somewhere and someone is probably looking for them. Either they are stolen or they are demo or prototypes that are NO suppose to be sold to ANYONE under any circumstance. I realize they are out there. But you can also buy explosives, automatic weapons without a tax stamp (ATF paper work) or anything else on a long list of illegal or stolen items.

Final word, DON"T BOTHER WITH TRYING TO USE A PROGRAMMED SUBSCRIBER RADIO FOR A SCANNER.
 

rdale

Completely Banned for the Greater Good
Joined
Feb 3, 2001
Messages
11,380
Reaction score
6
Location
Lansing, MI
He also could be referring to your note about the "newest" systems being unscannable, which is not quite true.
 

ohiodesperado

Member
Joined
Nov 9, 2006
Messages
82
Reaction score
16
Location
Johnstown, Ohio
He also could be referring to your note about the "newest" systems being unscannable, which is not quite true.

OK, so how exactly are you going to scan a TDMA 7.x Motorola system? Other than with a subscriber from the system it's self and we are talking specifically about why that is NOT a good idea.

For that matter how are you scanning a MOTORTRBO system?
And yes, I know that yoyu can tap discriminator audio and run it through a PC and decode it.
That is NOT scanning, that is monitoring a specific channel.
 

rdale

Completely Banned for the Greater Good
Joined
Feb 3, 2001
Messages
11,380
Reaction score
6
Location
Lansing, MI
I think it's the way you worded it. A tremendously large majority of systems ARE scannable and will be for years to come.
 

mikegilbert

MHz so good
Joined
Sep 7, 2004
Messages
555
Reaction score
383
Location
Los Angeles
OK, this is going to be quick, as I have to leave for work.

So much mis-information in your post. Where do I begin?

The radio by design needs to authenticate to the system. This means it HAS TO TRANSMIT.
If you are not authorized on the system, and are transmitting this puts you in the hot seat.

Programming your radio to not TX will not keep it from authenticating. Even if all talk groups are set RX only. It's the way Motorola does it, because they can.

Wrong. On a 3600 system, you can RX all day long without ever affiliating. On a 9600 system, you can use the 'hidden talkgroups' method and your radio will never affiliate.

Old type two systems, you could disable the RF output and fool the radio into thinking it was there but electrically disable TX and it would work. Newer radios, and systems require two way communication to work.

Again. False.

Now the bad news.
The newest systems are TDMA. This is the same technology that MOTOTRBO works on and currently there are NO scanners that will receive it. Again, it requires two way communications for timing and will always require that as far as I can see. So as new systems are put on line that are 7.X and above in TDMA, scanner listeners will have less to listen to.

What industry do you work in? And where the hell are you getting all your information (or lack thereof) from? Might want to go back to Illinois for a refresher on Motorola trunking theory...

The GRE PSR-800 will decode Motorola's proprietary X2 TDMA trunking all day long.

GRE PSR-800 monitoring X2-TDMA P25 system - YouTube
 
Last edited:

n5ims

Member
Joined
Jul 25, 2004
Messages
3,993
Reaction score
301
What I love about these threads is someone asks a fairly simple question that only requires a simple (although not necessarly 100% accurate in all situations) answer and folks insist on showing just how much they know by providing exacting details over the fine points and exceptions.

When somebody is thirsty and asks the simple question "Water?" they don't need the graduate level answer of how you use a catalyst to control the combination of two molecules of hydrogen and two molecules of oxygen to end up with two molecules of dihydrogen monoxide (otherwise known as water). They generally are best served by pointing to the nearest working water fountain even if you know that better water may be available from a spa 20 miles down the road. Now if they then ask about better water after seeing the fountain, by all means tell them about that spa!
 
Last edited:
Status
Not open for further replies.
Top