P-25 Input Frequencies/Inbound Trunking

Status
Not open for further replies.

natedawg1604

Member
Premium Subscriber
Joined
Jun 29, 2013
Messages
2,733
Location
Colorado
So recently I got a close call hit on an input frequency of a P-25 trunked system, and it got me thinking: how does the P-25 protocol work for repeater input frequencies on a P-25 Trunked site? Would it be possible to "trunk track" input frequencies with any scanner or program like DSD+? I was looking over an old Aeroflex application note and it mentions the following:
In P25 Trunking systems, the inbound trunking sends information words called Inbound Signaling Packets or ISPs.

So, is there any way for Unitrunker or other programs to track "inbound trunking" P-25 messages? For example if I were to park Unitrunker on a single input frequency for a P-25 site, would it display talkgroups or other information?
 

boatbod

Member
Joined
Mar 3, 2007
Messages
3,410
Location
Talbot Co, MD
It would be hard to trunk track the inbound traffic since you'd have to be close enough to the subscriber unit to pick up the signal and it is generally lower power than the repeater output.
 

slicerwizard

Member
Joined
Sep 19, 2002
Messages
7,685
Location
Toronto, Ontario
There are some differences, including RF modulation type, between inbound and outbound P25 signals. Scanners and software-based decoders might not handle the inbound signals, especially Phase II. Who's got a P25 subscriber and is willing to experiment?
 

Capella

Member
Premium Subscriber
Joined
Nov 21, 2002
Messages
7
Location
Twin Cities Metro
In the 2015-2017 timeframe I monitored the Fairfax County, VA, P25 repeater input frequencies and it worked well. My goal was to not listen to the entire Fairfax County P25 network but instead just activity within blocks of my house ("radio line of sight" from the handheld/mobile units to my house). The frequencies I monitored were as follows minus 45 MHz:

RFSSSiteNameCountyFreqs
1 (1)002 (2)SimulcastFairfax854.1375854.2625854.2875855.2625855.3875855.9625855.9875
856.2625c856.5375856.9125857.0125857.2625a857.5625858.2625a
858.5375858.6125859.2625a859.5375859.6375860.2625

I noticed Fairfax County is P25 Phase II and I don't remember if they were P1 in the 2015-2017 timeframe then switched to PII after I left but monitoring the frequencies worked well. It's not trunk tracking but rather scanning the 20 individual input frequencies.
 

boatbod

Member
Joined
Mar 3, 2007
Messages
3,410
Location
Talbot Co, MD
If I recall, all inbound modulation is C4FM, but if it's phase 2 it will be transmitted in TDMA bursts. On the outbound side, phase 2 will be H-DQPSK modulated.
 

Project25_MASTR

Millennial Graying OBT Guy
Joined
Jun 16, 2013
Messages
4,357
Location
Texas
P25 works off the idea of a bandplan. With a P25 subscriber the bandplan is typically provided via programming but it can also be adapted (learned) by listening to an active control channel assuming the system is advertising the band plan (some don't but it is an exception). The band plan info contains the base frequency, bandwidth, offset, offset direction, and channel spacing and is typically advertised as something like:
  • 01-851.00625-(-)45.000-6.25
  • 02-762.00625-(+)30.000-6.25
  • 03-851.01250-(-)45.000-12.5
  • 04-762.00625-(+)30.000-12.5
The first object in the hash is the Channel ID, second is the Base Frequency, then the offset shift direction, offset and finally the channel width. In my example I provided the basics for a 7/800 MHz system which is advertising Phase 2 capability (though may not be utilizing Phase 2). When the radio is programmed one simply provides the control channel's Channel ID and RX frequency (it will calculate the rest) and it can communicate with the control channel (registration, affiliation, paging, status requests, channel requests, etc). When a user hit's the PTT on the radio the radio makes a channel request (since the radio is affiliated to a specific talkgroup the system already knows what talkgroup the radio wants to talk on). The system will either reply with a busy (and put the call into the queue), denial (in the case the user ID is RX only for the specific talkgroup at the system level or send a channel grant. In the case of a busy, the system will send a channel grant when the call has made it through the queue. The channel grant will look something like this on the control channel:
  • TGID-01-2005 or TGID-03-0198-1
Where the TGID is whatever talkgroup is being used, 01/03 is the channel ID and 2005/0198 is the channel number. The final number is only present with Phase 2 and signifies the timeslot. The radio will then perform some quick math. For the 01-2005, the radio will look up the info in it's bandplan and calculate 851.00625+2005*0.00625 = 863.5375 RX with RX-45 = 818.5375 TX. For 03-0198-1 the radio will perform a similar calculation, 851.0125+198*0.0125 = 853.4875-1 RX, 808.4875-1 TX.

That's all the information the radio needs to know in order to transmit and receive. The radio doesn't actually need to even need to have the control channel information programmed into it to use a specific site as it can either learn it off of an active site who's control channel info is programmed into the radio via advertised adjacent site info or via a feature called spectrum wide scanning (where the radio scans for any control channel with a matching WACN). Whenever new control channels are learned, info is typically stored in the flash memory and can be recalled at a later date (or until the radio is reprogrammed which wipes the flash out).

Some other things to note, this only really covers 7/800/900 MHz trunking. VHF and UHF is what we call Other Band Trunking (OBT) and the control channels actually operate differently (as VHF has no truly predictable standard offsets) and while most of my professional Astro 25 career has been working with VHF OBT systems...I've never actually taken the time to learn exactly how the TX frequency is provided to the radio via the control channel as I've always lived under 7/800 MHz coverage and how VHF OTA assignment works simply is unimportant when you are physically looking at the repeaters that make up the site which are clearly labeled with their RX and TX frequencies. Also, the uplink to the control channel (the frequency the radio transmits on) will always be C4FM and the uplink on a Phase 1 system will always be C4FM even if the system is transmitting CQPSK (LSM) on the downlink. One should keep in mind that the uplink and downlink modulations are different with Phase 2 so just because a scanner can listen to a Phase 2 downlink doesn't always mean it can listen to the uplink.
 
Joined
Feb 3, 2015
Messages
249
l
So recently I got a close call hit on an input frequency of a P-25 trunked system, and it got me thinking: how does the P-25 protocol work for repeater input frequencies on a P-25 Trunked site? Would it be possible to "trunk track" input frequencies with any scanner or program like DSD+? I was looking over an old Aeroflex application note and it mentions the following:


So, is there any way for Unitrunker or other programs to track "inbound trunking" P-25 messages? For example if I were to park Unitrunker on a single input frequency for a P-25 site, would it display talkgroups or other information?
I have been using the Pro96com program and a PSR500 to decode many of the ISP messages for years. I load both input and output frequencies in the scanner and start Pro96com on the CC then move to the desired input channel. I then go back and clear all tabs of the CC data. It can take hours to get ISP data. The program will decode most messages but some messages in the raw dump I have to decode manually. You can get information from the ISP messages such as the type of encryption being used as well as all the encryption key IDs as well as channel numbers and the last tower site ID the SU roamed from. Also you will be able to see any AVL/GPS data grants that an SU maybe sending to the FNE. I will not get into any in-depth discussion here as I do not want to get banned. Please understand.
 
Status
Not open for further replies.
Top