P25 Text Messages on PPSTN

Status
Not open for further replies.

mobile_1

Member
Joined
Nov 21, 2011
Messages
203
We are seeing what looks to be MA/Com unit to unit data grants (text messages) being sent on the PPSTN site #05 in Regina. RR member Mikey60 and I are trying to decode these unknown packets. Have a look at the file.

Thank's to RR member Shlappy for his Pro96com logs.
 
Last edited:

Jay911

Silent Key (April 15th, 2023)
Feed Provider
Joined
Feb 15, 2002
Messages
9,378
Location
Bragg Creek, Alberta
I love playing with these hex code dumps. Excuse me if I'm posting stuff you already know.

Code:
  37 FD 00 FF FF FD 82 10 04 00 54 D1
  00 00 A0 0A FF FF FD 21 BE A1 00 9F
  02 8E 00 A0 0A 21 BE A1 C0 2B 23 9A

As you say: 21 BE A1 = RID 2211489

First of all - manufacturer (3rd octet) is 00 so this is a P25-standard function, not just for M/A-COM.
Second of all - according to the standard, this is an obsolete opcode. Read what you want into how up-to-date PPSTN is from that. :)

Target address is supposed to be the three octets after manufacturer ID. As you note in the top of the text file, that's $FFFFFD = 16777213. I doubt this is a valid radio ID, or if it is, it's not intended for a regular use radio. Either a tech or a console (IIRC the standard or M/A-COM allows for specific high- and low-end values to be reserved for console and other use).

First block:
Octet 0 has some format and system parameters. $37 generally means an "alternate multiblock trunking control" OSP.
Octet 1 identifies if it's "protected" or not, with 1s in the 2 most significant bits. $3D here ($FD with the 2 MSBs stripped) = non-protected.
Octet 2 is manufacturer ID, as mentioned above.
Octet 3-5 is the "Logical Link ID" - the target RID.
Octet 6 is supposed to be "blocks to follow" with 1 in the MSB. $82 = 2 blocks to follow.
Octet 7 is the opcode (with 0s in the 2 MSBs). $10 here.
Octet 8 is Service Options. Somewhere I have what $04 means... here we go, non-emergency call, non-protected, half-duplex, circuit-mode (these four are all the 0 means), and default priority (4).
Octet 9 is "Reserved" (I have never seen anything other than $00 here).
Octet 10-11 is, as usual, the CRC of the "header" (first) block.

Second block:
Octet 0-3 is Source WACN and SysID (octet 2 first four bits is part of WACN, last four is part of SysID).
Octet 4-6 = Source ID. This is the unlikely ID again.
Octet 7-9 = Target ID. You've already got this as $21BEA1.
Octet 10-11 = Rx LCN. You've decoded this as $009F or 00-0159 or 138.795.

Third block:
Octet 0-1 = Tx LCN. $028E = 00-0654 = 141.27 is your "input" frequency for 138.795.
Octet 2-7 = "Reserved" - presumably the message. $00A00A21BEA1. Looks a lot like the SysID twice and the target RID once to me.
Octet 8-11 = Packet CRC.

General thoughts:
The standard may have some typos in it, or I'm confusing things at this early hour. In the description for the multiblock trunking format, the first radio ID is supposed to be the target ID for the OSP. In the description for the individual data grant, it's referenced as the source address, as is the first one in the 2nd block, with the 2nd one in the 2nd block (the one you have as $21BEA1) as the target address. I'm wondering if this is actually the other way around. Maybe PPSTN is using this as a way of the unit indicating its status (i.e. responding, arrived, clear), instead of the STS_UPDT opcode (18). Sending a message from $21BEA1 to $FFFFFD (the system controller responsible for transporting the status update into the CAD system, perhaps?) makes more sense to me.

Would I be able to get the dump logs for the site so I can play with them? As I said, it's a hobby. :)
 
Last edited:

mobile_1

Member
Joined
Nov 21, 2011
Messages
203
Ok Jay

I was was hoping you would have a look at this data. I do have dumps from the site. I will send you a PM.
 

Shlappy

Member
Premium Subscriber
Joined
Oct 30, 2010
Messages
8
Location
Regina, SK
There was more of this traffic again today. I will be sending my logs off to you tonight Mobile.

Cheers,

Cory
 

mobile_1

Member
Joined
Nov 21, 2011
Messages
203
More units are able to text now.

There was more of this traffic again today. I will be sending my logs off to you tonight Mobile.

Cheers,

Cory

Thank's for your data, Cory.

The Unknown packets show RID 2212053 = A786 File Hills Police Service and Regina dispatch sending text messages to each other.
This unit is on site #72 and #71 most of the time so I hope to see some of these messages out here today. All the other RIDs from the other logs were Regina units. It would be nice if we could view the messages.
 

mobile_1

Member
Joined
Nov 21, 2011
Messages
203
Thats good news Mike !

I have this added for the next release.

Mike


Thank you very much Sir ! Keep up the good work.
I have not seen any of these text messages out here on my local sites yet.
I am going to try to get some of the ISP packets sent by the SUs to see
what they look like.
 

mobile_1

Member
Joined
Nov 21, 2011
Messages
203
Texting ?

Could these be AVL packets or canned Status messages?

The RCMP have had AVL and the control heads on the radios to send the canned messages for several years now and we have never seen these CC messages before this month. This looks to be something new, Mike.
It is my understanding that those messages are sent on the voice channels and not on the control channels of the PPSTN.
 

mikey60

Member
Joined
Sep 15, 2003
Messages
3,543
Location
Oakland County Michigan
The RCMP have had AVL and the control heads on the radios to send the canned messages for several years now and we have never seen these CC messages before this month. This looks to be something new, Mike.
It is my understanding that those messages are sent on the voice channels and not on the control channels of the PPSTN.

The actual data would be sent on the voice channel... I have the decode done, but I don't have it doing a grant on the channel grant.

Mike
 

mobile_1

Member
Joined
Nov 21, 2011
Messages
203
There must be some reason for traveling to Regina

After looking at even more of Shlappy's Pro96com logs, I see RCMP units coming into Regina from all over the province. Prince Albert, Big River and Indian Head units were all affiliated to site 5 yesterday. These units then all started to TX/RX the Unknow Packets with the dispatch. Are all these units coming to Regina for hardware upgrades so they can handle the text messaging ?
 

mohjo

Member
Joined
Mar 23, 2005
Messages
49
Location
Saskatchewan
This is just me throwing a guess out there but could this be a way for DOCC to see who has switched to what TG? Sometimes cars will switch TG's and when DOCC tries to to a 10-70 on them they aren't even on that TG(mostly Highway Patrol). Then you hear DOCC going through a few TG's trying to find them. This maybe a way of eliminating that problem. When you switch TG's the radio sends a data packet to DOCC telling them what car you are and what TG you have switched too. Again just a thought. I have no actual proof that this is what they are trying to do. :)
 

Shlappy

Member
Premium Subscriber
Joined
Oct 30, 2010
Messages
8
Location
Regina, SK
Well, it looks like the traffic is increasing whatever it is. Today was the busiest day by far. Data started coming in at ~10:25 and continued on and off until 15:08. I will get the logs out tonight.

Cory
 

Jay911

Silent Key (April 15th, 2023)
Feed Provider
Joined
Feb 15, 2002
Messages
9,378
Location
Bragg Creek, Alberta
I'm still not convinced this is text messaging. The "messages" are always the same, and the opcode used is one that is technically obsolete in the P25 standard. There might be another opcode that does handle actual text messages (I'm not near my data right now so I can't check it), but $10 isn't it.
 

mobile_1

Member
Joined
Nov 21, 2011
Messages
203
There is no response ?

The log data shows a total of 7 more units were added today from Lumsden, Broadview, Prince Albert, Spiritwood and Hudson Bay. Regina's Charlie cars and B277 Fort Qu'Appelle were also seen in these logs.

OpCode $10 = Data Service Requests Only.
Where is the data service response message ?
I do not see it in these logs.
 

Jay911

Silent Key (April 15th, 2023)
Feed Provider
Joined
Feb 15, 2002
Messages
9,378
Location
Bragg Creek, Alberta
The same opcode is used twice in the standard - once for ISPs and once for OSPs. An ISP, or Inbound Signaling Packet, is broadcast by the radio in the field, and (unless I'm mistaken) not heard on the trunk control channel - it would be heard on the input if you were listening to it at the right time AND you were close enough to the radio (same rules as always apply when listening to radios on input frequencies). An OSP, or Outbound Signaling Packet, is what the trunk system sends out over the control channel, often in response to an ISP from a radio.

ISP Opcode $10 is "Individual Data Service Request (OBSOLETE)" or "IND_DATA_REQ" - what your documentation apparently has as "Data Service Requests Only".
OSP Opcode $10 is "Individual Data Channel Grant (OBSOLETE)" or "IND_DATA_CH_GRANT".

Receiving an opcode 10 on the control channel, then, is saying "Hi radio_id, you asked for a channel so you can send a data call (as opposed to a voice call) to target_radio_id. Use rx_lcn for that." It's not the actual data message, it's the grant to send the data message on the frequency specified by the LCN being provided in the grant message.

If you're only seeing this on the one site, my impression would be that the policy is when you're in that region, you send a data message (I'm still thinking it's something like a unit status or preprogrammed "canned" message) to indicate a certain benchmark, i.e. "At Depot" or it could even be "open the security gate".

Here's a wild thought. A couple of days ago, a ton of RCMP cars/radios in this area had to have their "10-33" (emergency) buttons tested for functionality. I wonder if that directive was wider than just K Div, and maybe they're using that function instead of the in-built Emergency Call feature in the P25 standard? Do you ever see emergency alarms/grants on PPSTN, from RCMP units?
 

mobile_1

Member
Joined
Nov 21, 2011
Messages
203
Do you ever see emergency alarms/grants on PPSTN, from RCMP units?

Yes we do see these sometimes on the system. Last year when the emergency button on a radio was pushed an unknown packet would show up in the logs.
Unknown code 0x23..RID#.. Cancel Service Request.
Pro96com was updated on November 18, 2011 for this and I then beta tested it for Mike, before he made it public.

When there is a request sent there must be a responce, so today I am logging ISP data from all the units in my area. Two of my local area units that were in Regina the other day and sent the text messages on that site are in todays logs. There are no OpCode 10 ISP Unknown Packet messages so far today.

Units from all over the province are traveling to Regina for this so it must be important to them.
 
Last edited:
Status
Not open for further replies.
Top