P25 TDMA Control Channel decoding -- requesting help from experts

[slicerwizard]

A DUID value of D1 isn't a 4 bit value. The P25p2 specs show DUIDs as only 4 bit values, but there are also 4 parity bits, so if D1 represents DUID value plus parity bits, winner, winner, chicken dinner.

 

[scannerboy02]

A DUID value of D1 isn't a 4 bit value. The P25p2 specs show DUIDs as only 4 bit values, but there are also 4 parity bits, so if D1 represents DUID value plus parity bits, winner, winner, chicken dinner.

View attachment 106831

This is getting exciting, thank you to everyone for working on this! It's also giving me a LOT of new stuff to learn and I love to learn.

 

[boatbod]

Modulation should be the same as TDMA voice. Burst OECI format is coded a little different but appears documented in the TIA102 spec. It really should be that hard to extend any of the existing P25 sdr apps to work with it. First thing I'd like to see is someone park op25 on the frequency and make some raw symbol captures so we can explore it offline.

 

[nd5y]

On the AEP TX and OK systems the RFSS number and site number are the same.
The NAC is the RFSS/Site number in hexadecimal.
If you know what site the audio sample came from you can figure out the NAC that way.
I can't supply high quality audio or I/Q like what you would get by using a calibrated SDR on a nearby strong signal.

 

[nd5y]

Uniden and Whistler need to get on this but I won't hold my breath.

 

[mtindor]

Uniden and Whistler need to get on this but I won't hold my breath.

Probably wouldn't even consider it until they see results from the OP25 / DSDPlus / BTT / SDRTrunk guys. After all, they know that these guys can do it better than they can lol.

Mike

 

[nd5y]

I posted in the other thread that this new type of CC sounds exactly like whatever modulation the CC is on every P25 simulcast system I have seen (and that is only in North TX and OK). Some people maybe have never listened to that and don't know what they sound like so they think the wideband High Velocity Data channel, which sounds very different and not at all like a 9600 baud control channel, is the same thing.

 

[slicerwizard]

The long strings of 8's are this:




080B888888888888888888

MCO = 8

Length value = 11

Total length = 11 bytes


P25p2 CC CONFIRMED.

 

[btt]

The wav file is definitely a P2 control channel. 65 P2 sync words, 86 bursts. The file is decoding fine, but the scrambling is not initialized correctly. I used: scrambler_init(0x92715, 0x1f8, 0x033); //WACN, SYS_ID, NAC

Results:
found 65 total p2 syncs, 86 valid bursts

 

[slicerwizard]

DUID D: LCCH without scrambling...

 

[mtindor]

The wav file is definitely a P2 control channel. 65 P2 sync words, 86 bursts. The file is decoding fine, but the scrambling is not initialized correctly. I used: scrambler_init(0x92715, 0x1f8, 0x033); //WACN, SYS_ID, NAC

Results:
found 65 total p2 syncs, 86 valid bursts

Edit: If someone has the correct values for WACN, SYS_ID, and NAC, I will give them a try.

Try 2C and 0D for NACs. @ralexander5 mentioned the GeorgeWest site. And that site _may_ end up being 1F8-44.44 (NAC 2C) or 1F8-13.13 (NAC 0D). I'm guessing. But if it's easy enough to test those two, try em.

I'm confident you have the WACN / SYS_ID right. Of course, on these new sites I guess it is _possible_ that they might be using a SysID other than 1F-through-1F9 such as 1FA. So maybe try 1FA as well.

Mike

 

[mtindor]

@btt nevermind what I said. Looks like no scrambling according to slicendice. Have to take everything I say with a grain of salt, since I'm clueless about most things.

mike

 

[btt]

Just started trying all possible NAC values. It works with a NAC value of 0x02C.

 

[btt]

@btt nevermind what I said. Looks like no scrambling according to slicendice. Have to take everything I say with a grain of salt, since I'm clueless about most things.

mike

Much of it is scrambled.

 

[mtindor]

Just started trying all possible NAC values. It works with a NAC value of 0x02C.

Awesome, thanks for that. We definitely know what site @ralexander5 ' s audio came from.

Mike

 

[mtindor]

Just started trying all possible NAC values. It works with a NAC value of 0x02C.

BTW, I just uploaded another raw audio file to Index of /p25tdmacc -- another one graciously supplied by @ralexander5. It's a longer capture of data, if that is of any use. It begins with GW-

Mike

 

[ralexander5]

Confirming, the raw audio file is from George West Site on 854.8125. I am no longer able to pick up any of the original "non TDMA" sites to confirm NAC. They all appear to have switched.

 

[btt]

BTW, I just uploaded another raw audio file to Index of /p25tdmacc -- another one graciously supplied by @ralexander5. It's a longer capture of data, if that is of any use. It begins with GW-

Mike

It looks pretty much the same as the first one. It appears to be an idle channel. That file had 1857 total p2 syncs, 2394 valid bursts. No voice. No Grants. One MAC IDLE message.

 

[mtindor]

It looks pretty much the same as the first one. It appears to be an idle channel. That file had 1857 total p2 syncs, 2394 valid bursts. No voice. No Grants. One MAC IDLE message.

Probably nothing to be surprised about, since it's not really possible for anyone to know when there is traffic on these sites unless they are simultaneously monitoring the voice channels. Plus, it is an energy utility, and they are pretty damned quiet most of the time when there is no inclement weather to deal with. And given how recently these sites appear to have been brought online down there in TX, one has to wonder if they have any subscriber traffic on them at all at this point other than maybe a couple of tester radios.

Mike

 

[nd5y]

I'm sure they replaced all the subscriber units before they started converting the sites to P25. Up here the new sites immidiately had voice calls, just not very much.