P25 Text Messages on PPSTN

Status
Not open for further replies.

Shlappy

Member
Premium Subscriber
Joined
Oct 30, 2010
Messages
8
Location
Regina, SK
Wow, the term "Drama Queens" comes instantly to mind. I had a chuckle over the "Discreet is Elite" comment. Sounds a lot like "Security through Obscurity" to me. They are right that everything will eventually be encrypted, but it will not be that way because of days old partial data dumps on radio reference.
 

mobile_1

Member
Joined
Nov 21, 2011
Messages
203
We now know what these messages look like

See the files that I posted here.
 
Last edited:

mobile_1

Member
Joined
Nov 21, 2011
Messages
203
More Data

PPSTN Motorola mobile radios get data capability April 11, 2013.
SERM officer #048's truck radio is now sending packet data once every minute.
CO# 048 returned home from Prince Albert after having his mobile radio upgraded for data transmission.
He enters this tower site's service area and his radio affiliates to it.
"04/11 17:04:41","Affiliate",6000,"Sask Environment",2261542,"CO # 048 M Echo Park"
Channel Grants OSP:
"04/11 17:04:59","Data","00-0048","138.24000","","","2261542","CO # 048 M Echo Park"
"04/11 17:04:59","Data","00-0048","138.24000","","","2261542","CO # 048 M Echo Park"
"04/11 17:05:01","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:05:01","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:06:03","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:06:03","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:07:04","Data","00-0219","139.09500","","","2261542","CO # 048 M Echo Park"
"04/11 17:07:04","Data","00-0219","139.09500","","","2261542","CO # 048 M Echo Park"
"04/11 17:08:07","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:08:07","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:09:09","Data","00-0048","138.24000","","","2261542","CO # 048 M Echo Park"
"04/11 17:09:09","Data","00-0048","138.24000","","","2261542","CO # 048 M Echo Park"
"04/11 17:10:11","Data","00-0219","139.09500","","","2261542","CO # 048 M Echo Park"
"04/11 17:10:11","Data","00-0219","139.09500","","","2261542","CO # 048 M Echo Park"
"04/11 17:11:13","Data","00-0219","139.09500","","","2261542","CO # 048 M Echo Park"
"04/11 17:11:13","Data","00-0219","139.09500","","","2261542","CO # 048 M Echo Park"
"04/11 17:12:15","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:12:15","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:13:17","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:13:17","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:14:19","Data","00-0219","139.09500","","","2261542","CO # 048 M Echo Park"
"04/11 17:14:19","Data","00-0219","139.09500","","","2261542","CO # 048 M Echo Park"
"04/11 17:15:21","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:15:21","Data","00-0093","138.46500","","","2261542","CO # 048 M Echo Park"
"04/11 17:16:23","Data","00-0048","138.24000","","","2261542","CO # 048 M Echo Park"
"04/11 17:16:23","Data","00-0048","138.24000","","","2261542","CO # 048 M Echo Park"
"04/11 17:17:25","Data","00-0219","139.09500","","","2261542","CO # 048 M Echo Park"
"04/11 17:17:25","Data","00-0219","139.09500","","","2261542","CO # 048 M Echo Park"
"04/11 17:18:27","Unaffiliate",0,"",2261542,"CO # 048 M Echo Park"
28 minutes later CO# 048 turns his radio off at the end of his shift. It must be great to be back home.
-----------------------------------------------------------------------------------------------------
April 12, 2013 Affiliation when CO# 048 first turns his radio on at his home.
"04/12 08:07:22","Affiliate",6000,"T: 7171 DT: 4/12/13@7:52",2261542,"TG: 6000 DT: 4/12/13@8:07"
April 12,2013 Grants OSP :
"04/12 08:07:23","Data","00-0219","139.09500","","","2261542","TG: 6000 DT: 4/12/13@8:07"
"04/12 08:07:23","Data","00-0219","139.09500","","","2261542","TG: 6000 DT: 4/12/13@8:07"
The radio sent 62 of these packets (31x2) over the next 32 minutes until CO# 048 turned the radio off at the office.
"04/12 08:39:13","Data","00-0048","138.24000","","","2261542","TG: 6000 DT: 4/12/13@8:07"
"04/12 08:39:13","Data","00-0048","138.24000","","","2261542","TG: 6000 DT: 4/12/13@8:07"
----------------------------------------------------------------------------------------------------------
Dump OSP data looks like this:
94 00 00 00 5D 03 7B 22 82 26 7F FF 04/12 08:29:46 Data Channel Grant Explicit - Radio ID: 2261542 RX Channel: 0-0093(138.46500) TX Channel: 0-0891(142.45500)
94 00 00 00 30 03 4E 22 82 26 FE 08 04/12 08:30:48 Data Channel Grant Explicit - Radio ID: 2261542 RX Channel: 0-0048(138.24000) TX Channel: 0-0846(142.23000)
94 00 00 00 5D 03 7B 22 82 26 7F FF 04/12 08:34:03 Data Channel Grant Explicit - Radio ID: 2261542 RX Channel: 0-0093(138.46500) TX Channel: 0-0891(142.45500)
94 00 00 00 30 03 4E 22 82 26 FE 08 04/12 08:35:05 Data Channel Grant Explicit - Radio ID: 2261542 RX Channel: 0-0048(138.24000) TX Channel: 0-0846(142.23000)
94 00 00 00 5D 03 7B 22 82 26 7F FF 04/12 08:36:07 Data Channel Grant Explicit - Radio ID: 2261542 RX Channel: 0-0093(138.46500) TX Channel: 0-0891(142.45500)
RAW Data Dump OSP:
P25,9400000030034E228226FE08
P25,9400000030034E228226FE08
P25,9400000030034E228226FE08
P25,940000005D037B2282267FFF
P25,940000005D037B2282267FFF
P25,940000005D037B2282267FFF
-----------------------------------------------------------
ISP Data starts here:
SERM CO# 048 turns his radio on at the office for the trip home for a late lunch.
"04/12 12:34:15","Affiliate",6000,"Sask Environment",2261542,"CO# 048 M Echo Park"
Looking at some (1 out of every 3) of the ISP data messages sent by # 048's mobile radio.
Data is being sent on Voice Channels #717 = 141.5850 MHz and #891 = 142.4550 MHz
23 0A 00 22 82 26 80 00 00 00 D1 D9 04/12 12:35:02 ****23 = Cancel Service Request.****
------------------------------------------------------------------------------------------------------
Data Messages ISP:
03 08 00 22 82 26 80 00 00 00 2E B3 04/12 12:36:05****(03 08=ISP Data Packet)****
03 08 00 22 82 26 80 00 00 00 2E B3 04/12 12:37:07****(00=Mfg=Standard)****
03 08 00 22 82 26 80 00 00 00 2E B3 04/12 12:39:44****(22 82 26=2261546=RID#)****
03 08 00 22 82 26 80 00 00 00 2E B3 04/12 12:42:50
03 08 00 22 82 26 80 00 00 00 2E B3 04/12 12:42:50
-------------------------------------------------------------------------------------------------------
PSR-Data dump ISP.
P25:T0002:230A0022822680000000D1D9****Cancel Service Request RID 2261542****
P25:T0002:6B95609151656D696D65222F E
P25:T0002:76C600228226810A08009882
P25:T0002:060118262C262C262C181979 E
P25:T0002:56C600228226810238000DBB****(56 same as in RCMP Data)*(C6 here,is C4 in RCMP Data) (RID)*(81 02 here, is 83 04 in RCMP Data)****
P25:T0002:05E69C0000000002000F4EC0 E
---------------------------------------------------
P25:T0002:030800228226800000002EB3****(22 82 26) = 2261542 = Unencrypted RID that is sending the data.****
P25:T0002:4140A7ED50FCA517D2973EBD E****Encrypted Data****
P25:T0002:56C6002282268102480005E2****Unencrypted (C6=198)*(22 82 26=RID#)*(81 02 never changes)*(48=72 this changes)****
P25:T0002:05E69C000010000200074EC0 E****(01 00 00 20) = 16777248 = Unencrypted NEW RID# that this data is being sent to.*****
---------------------------------------------------
P25:T0002:030800228226800000002EB3****Unencrypted (RID#)****
P25:T0002:114007DAA16D48150AAAA804 E****Encrypted Data****
P25:T0002:56C600228226810228000EC8***Unencrypted (RID#)*(81 02=33026 never changes)*(28=40 this changes)****
P25:T0002:05E69C000010000200074EC0 E****Unencrypted (RID#)****
---------------------------------------------------
P25:T0002:030800228226800000002EB3****Unencrypted RID#****
P25:T0002:05AAAAAAAAAAAAAAAA56AAAA E****Encrypted****
-----------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:DAAAAAAAAAA0AAAAAAAAAAAA E
P25:T0002:56C60022822681020800082E****(08=8 same as seen in RCMP Data. This one is always 08 in the RCMP message****
P25:T0002:05E69C00000A000200074EC0 E
---------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:FD6AAAA000AAAAABFAAAAAAA E
---------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:AAAAAAAAA0AA0FAAAAAAAAAA E
P25:T0002:56C60022822681020800082E****(08=8 again)****
P25:T0002:05E69C000000000200074EC0 E
---------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:0AAAAAAAAAAA000AAAAAAABF E
P25:T0002:56C600228226810238000DBB****(38=56 changed ****
P25:T0002:05E69C0000000002000F4EC0 E
--------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:AAAAAAAABFAAAAAAAAAAAAAA E
P25:T0002:56C600228226810218000B5D
P25:T0002:05E69C000010000200074EC0 E
P25:T0002:56C600228226810268000304****(68=104 now)****
P25:T0002:05E69C000000000200074EC0 E
P25:T0002:56C600228226810218000B5D****(18=24)****
P25:T0002:05E69C000010000200074EC0 E
P25:T0002:56C600228226810258000691****(58=88)****
P25:T0002:05E69C000000000200074EC0 E
--------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:AAAFA557AAAAAAAAAAAAAAAA E
---------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:3D75F80FD547000CD7F855D8 E
P25:T0002:56C600228226810228000EC8
P25:T0002:05E69C000010000200074EC0 E
---------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:556AAFEBF217DAABDAA1FA8D E
P25:T0002:56C600228226810258000691
P25:T0002:05E69C000010000200074EC0 E
---------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:115C37EA801568152AAAFD00 E
P25:T0002:56C60022822681020800082E
P25:T0002:05E69C000000000200074EC0 E
----------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:D54003FAA0AAA83EAAA0003C E
P25:T0002:56C600228226810238000DBB
P25:T0002:05E69C000000000200074EC0 E
-----------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:AAA0517DAAAA10290E03F6AE E
P25:T0002:56C600228226810268000304
P25:T0002:05E69C000010000200074EC0 E
----------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:AAA1F407FFF00AA80001F007 E
P25:T0002:56C600228226810218000B5D
P25:T0002:05E69C000010000200074EC0 E
--------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:0002AFFFD4A87C2AA2AFC400 E
P25:T0002:56C600228226810228000EC8
P25:T0002:05E69C000010000200074EC0 E
---------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:443810FD40375C3AAAA528F0 E
P25:T0002:56C600228226810238000DBB
P25:T0002:05E69C000010000200074EC0 E
---------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:3FAAA150014AAAAAAAAAAAAB E
P25:T0002:56C600228226810258000691
P25:T0002:05E69C000000000200074EC0 E
----------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:D4AA07FADD53D768F6AAAA4A E
P25:T0002:56C600228226810268000304
P25:T0002:05E69C000010000200074EC0 E
----------------------------------------------------
P25:T0002:030800228226800000002EB3
P25:T0002:A5AAAA82AD6AA756ABFEA81D E
P25:T0002:56C600228226810238000DBB
P25:T0002:05E69C000010000200074EC0 E
The radio is turned off at the office and then 048 uses his portable 2261587, no data.
-----------------------------------------------------
Radio is turned on at the office for the trip home.
P25:T0002:030800228226800000002EB3
P25:T0002:04AAAAA5DD44057FF76AA0DD E
CO# 048 travels from the office to home.
P25:T0002:56C6002282268102480005E2
P25:T0002:05E69C000000000200074EC0 E
P25:T0002:56C60022822681020800082E---------(08=8 this was the low#) 8x15=120= high#---------
P25:T0002:05E69C000010000200074EC0 E
P25:T0002:56C600228226810238000DBB
P25:T0002:05E69C000000000200074EC0 E------The data is sent over 3 voice channels---------
P25:T0002:56C600228226810268000304--------These are used to keep the packets in the correct sequence--------
P25:T0002:05E69C000000000200074EC0 E
P25:T0002:030800228226800000002EB3
P25:T0002:AAAAAAAA03FAAAAAAAAAAAAA E
P25:T0002:56C600228226810278000077----------(78=120 this was the high#)----------
P25:T0002:05E69C000000000200074EC0 E
P25:T0002:56C600228226810228000EC8
P25:T0002:05E69C0000100002000F4EC0 E
P25:T0002:030800228226800000002EB3
P25:T0002:AAAAA000AAAAAAAAAAAAAAAA E
P25:T0002:56C600228226810238000DBB
P25:T0002:05E69C00000A000200074EC0 E
P25:T0002:030800228226800000002EB3
P25:T0002:003FAAFFFAAAAAAAAAAAAAA9 E
P25:T0002:56C600228226810268000304
P25:T0002:05E69C000000000200074EC0 E
P25:T0002:030800228226800000002EB3
P25:T0002:AAAAAAAAAAAAFF6AAAF6AAA8 E
P25:T0002:030800228226800000002EB3
P25:T0002:AAAAAAAAAAAAAAAAAAAAAAAA E
P25:T0002:56C600228226810238000DBB
P25:T0002:05E69C000010000200074EC0 E
P25:T0002:030800228226800000002EB3
P25:T0002:AAA7FFF4AAABEAAAAAAAAAAA E
P25:T0002:29494C05B30C593094EE432A E
Radio is turned off at home. A job well done.
So what's all this then ? AVL Automatic Vehicle Location. The unit is sending it's GPS location data to Prince Albert HQ.
 
Status
Not open for further replies.
Top