PPSTN New Talkgroups and other info

[Mobby1-Kenobby]

What's this member been seeing.

October 15, 2023.
Unitrunker 2 decoding PPSTN P25 voice channel ISP messages reveals the RCMP F-Division AES Key ID is 0039.

11:42:27.188 047 A ESW MI D2D4D6 A0B150 286500 AES KID 0039 ok.(A260 Indian Head on TG 18).
11:42:27.357 047 5 LC 00 00 44 00 00 12 21 C0 8B Group Voice Channel User I 21C08B G 0012 (4 priority, packet protected) ok.
11:42:30.863 047 A ESW MI 9824B7 F9C23A B45100 AES KID 0039 ok.(Regina DOC on TG 18).
11:42:31.061 047 5 LC 00 00 44 00 00 12 21 DB FE Group Voice Channel User I 21DBFE G 0012 (4 priority, packet protected) ok.
11:42:31.227 047 A ESW MI EFACDF 411730 AE9B00 AES KID 0039 ok.
11:42:31.427 047 5 LC 00 00 44 00 00 12 21 DB FE Group Voice Channel User I 21DBFE G 0012 (4 priority, packet protected) ok.
11:42:33.764 047 A ESW MI EBF438 2C643F CDA700 AES KID 0039 ok.
11:42:33.931 047 5 LC 00 00 44 00 00 12 21 DB FE Group Voice Channel User I 21DBFE G 0012 (4 priority, packet protected) ok.
11:42:34.101 047 A ESW MI 09B210 D1499A 9CAC00 AES KID 0039 ok.
11:42:34.298 047 5 LC 00 00 44 00 00 12 21 DB FE Group Voice Channel User I 21DBFE G 0012 (4 priority, packet protected) ok.
11:42:34.467 047 A ESW MI 2312CC 2D57CF 035300 AES KID 0039 ok.
11:42:34.667 047 5 LC 00 00 44 00 00 12 21 DB FE Group Voice Channel User I 21DBFE G 0012 (4 priority, packet protected) ok.

October 22,
These DELTA member RIDs were on site # 70 Qu'Appelle.
Logins:
08:55:41","Affiliate",162,"RCMP GIS/MCU #2, RID 2211377 Major Crimes Unit-South
08:57:12","Affiliate",162,"RCMP GIS/MCU #2, RID 2213313
08:59:10","Affiliate",162,"RCMP GIS/MCU #2 RID 2216137
08:59:17","Affiliate",162,"RCMP GIS/MCU #2 RID 2211376 Major Crimes Unit-South
Channel Grants:
08:56:55","Group (Enc) TG 162","RCMP GIS #2","2216137
08:59:33","Deny Response: SU: 2211376 (Group Voice Grant): the requesting unit is not valid"
08:59:33","Unit Registration Command -> 2211376"
08:59:33","Unit Registration - SysID: 00A Source ID: 2211376 Working ID: 2211376 Status: Accept"
08:59:34","Group (Enc) TG 162","RCMP GIS #2","2211377
08:59:38","Group (Enc) TG 162","RCMP GIS #2","2211376
08:59:38","Queued TG 162","RCMP GIS #2","2216137
08:59:38","Queued Response - Service Type: Group Voice Grant - Call Options: 0x44 - Group:162 - Target Radio: 2216137 - Reason: : the target group is currently active.
08:59:46","Group (Enc) TG 162","RCMP GIS #2","2216137
08:59:49","Group (Enc) TG 162","RCMP GIS #2","2211376
09:00:09","Group (Enc) TG 162","RCMP GIS #2","2211377
09:02:15","Group (Enc) TG 162","RCMP GIS #2","2216137
09:02:32","Group (Enc) TG 162","RCMP GIS #2","2211377
09:02:36","Group (Enc) TG 162","RCMP GIS #2","2216137
09:02:46","Group (Enc) TG 162","RCMP GIS #2","2211377
09:02:53","Group (Enc) TG 162","RCMP GIS #2","2216137
09:03:31","Group (Enc) TG 162","RCMP GIS #2","2211377
09:03:42","Group (Enc) TG 162","RCMP GIS #2","2216137
09:03:55","Group (Enc) TG 162","RCMP GIS #2","2211377
09:04:11","Group (Enc) TG 162","RCMP GIS #2","2213313
09:04:24","Group (Enc) TG 162","RCMP GIS #2","2211377
09:04:30","Group (Enc) TG 162","RCMP GIS #2","2211376
09:04:38","Group (Enc) TG 162","RCMP GIS #2","2216137
09:04:43","Group (Enc) TG 162","RCMP GIS #2","2211377
09:05:04","Group (Enc) TG 162","RCMP GIS #2","2211376
09:05:09","Group (Enc) TG 162","RCMP GIS #2","2216137
09:05:13","Group (Enc) TG 162","RCMP GIS #2","2211376
09:05:16","Group (Enc) TG 162","RCMP GIS #2","2211376
09:05:20","Group (Enc) TG 162","RCMP GIS #2","2211376
09:05:22","Group (Enc) TG 162","RCMP GIS #2","2211376
09:05:36","Group (Enc) TG 162","RCMP GIS #2","2211376
09:07:11","Group (Enc) TG 162","RCMP GIS #2","2216137
09:07:17","Group (Enc) TG 162","RCMP GIS #2","2211376
10:09:53","Unit Registration - SysID: 00A Source ID: 2211376 Working ID: 2211376 Status: Accept.

October 23,
Unitrunker 2 decoding voice channel P25 ISP messages reveals Saskatchewan Environment CO# 420 Motorola Radio encryption type is AES and the Key ID is 0001.

18:00:11.118 047 A ESW MI B408DD 246319 D8F000 AES KID 0001 ok
18:00:11.315 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:11.484 047 A ESW MI 53EDFB 60C68E A26E00 AES KID 0001 ok
18:00:11.654 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:11.850 047 A ESW MI E7CAB4 197FF4 E2E900 AES KID 0001 ok
18:00:12.019 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:12.217 047 A ESW MI F635F9 719804 784700 AES KID 0001 ok
18:00:12.384 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:12.552 047 A ESW MI FD449F 31900F B81B00 AES KID 0001 ok
18:00:12.750 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:12.920 047 A ESW MI C31018 710DB3 011200 AES KID 0001 ok
18:00:13.118 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:13.287 047 A ESW MI DEE71C E8917D 5D5E00 AES KID 0001 ok
18:00:13.456 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:14.020 047 A ESW MI CCE0AA 9F4C02 AF8000 AES KID 0001 ok
18:00:14.190 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User 228226 = RID 2261542, 1770 = TG 6000 (4 priority, packet protected) ok.
See the zip file for a more detailed look at the voice channel ISP messages from this RID.

It will be interesting to see all of the key IDs that are in use.
The shared common Key ID utilized by the province and the feds?
The SPOOK's Key ID?
This information maybe the "key" to revealing the identity of the unknown users.

October 26,
1:30 pm RID 2261401 = CO280 login on TG 6000.
1:35 pm RID 2261373 = CO373 login on TG 6000.
1:36 pm RID 2261651 = CO154/204/214 Mobile JR/HR47 Shaunavon login TG 6000.
1:38 pm RID 2261619 = CO0441/375/326/518/064 Mobile HR47 Shaunavon login TG 6000.

Cheers.

 

[Mobby1-Kenobby]

Hi, to all.
What this RR member has been seeing and hearing.

October 30,
Most of the new Motorola portable radios are still sending their GPS data to nowhere.
09:13:35 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 81 D7)=TX RID 2261463, 2A 42=CRC.
09:36:19 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 5F 51)=TX RID 2252625, ED 24=CRC.
14:15:23 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 5F 50)=TX RID 2252624, FD 05=CRC.

October 30, these 2 were seen in P25 ISP messages, so CO#0329 was very close to my location.
RID 2261628 CO# 0329 Melville Mobile login on site 71 at 3:50 pm.
RID 2263651 CO# 0329 Melville portable login 3:55 pm.

October 30,
RID 2211223 ERT unit is now a white F250 "camper-special" login on TAC 3 at 4:21 pm.
RID 2214763 (NBCRU) North Battleford Crime Reduction Unit coms on TAC 3.
RID 2212716 CIRT coms on TAC 3.
RID 2212720 CIRT coms on TAC 3.
RID 2211215 ERT commander coms on TAC 3, Black Suburban.
All coms end at 4:28 pm, as the "camper-special" had gone north to the "campsite".
Yes, that ERT unit looks like a truck-camper unit.

November 2,
RID 2263651 CO0329 Melville portable login on site 71 at 3:28 pm.
RID 2261576 CO0337 Melville mobile login 3:33 pm.
RID 2261392 CO0337 Melville portable login 3:33 pm.

November 3,
RID 2261568 CO0432 Hudson Bay mobile login 10:48 am on site 71.
RID 2263651 CO0329 Melville portable login 4:32 pm.
TG 912 RCMP Announce Group at 6:39 pm.

Recently RR member Wolffe asked a question about channel plans, as Unitrunker 2 was showing many incorrect frequencies for P25 sites. I referred to these as ghost-channels as I believed they did not really exist. I have not seen this phenomenon, but what Wolffe’s post did was to encouraged me to share with all of you what I have encountered over the past 5 years.

Some useful information for those utilizing Unitrunker 1 or 2.
P25 packets can arrive with some octets out of their correct sequence and then are decoded by the program to display incorrect RID information.
Examples:
November 3, 2023 at 6:44 pm.
RID 14417953 is HEX = DC 00 21, but was in fact the HEX 21 DC 00 = DEC 2219008 is an RCMP F-Division DOC RID.

May 22, 2018 at 6:48 pm.
RID 2210000 is HEX 21 B8 D0, but was in fact the HEX 21 D0 B8 = DEC 2216120 is an RCMP F-Division GIS DELTA member RID.

November 15, 2022 at 7:57 pm.
RID 2210001 is HEX = 21 B8 D1, but was in fact the HEX 21 D1 B8 = DEC 2216376.
The true RCMP RID start is 2211001 = A591 Regina.

Some other false RID information that may be displayed by the Unitrunker programs are:
RID 222 is the HEX DE, only the last octet of the packet was seen and then decoded on 04/29/2023.
RID 50 is the HEX 32, talk-group is displayed as an RID on 04/10/2018.
RID 10 is the HEX 0A, is the system ID and was displayed as an RID on 02/04/2019.
RID 18 is the HEX 12 is a talk-group displayed as an RID on 09/22/2022.
RID 62 is the HEX 3E and is another talk-group seen as an RID by the program.
RID 80 is the HEX 50 and is yet another talk-group seen as an RID by the program.
RID 65536×256 = 16777216 is an FNE address. The program failed at the mathematics.
RID 65537×256 = 16777472 is another FNE address that the data messages are sent to.

There are other examples, but they are not so easily explained as these were.
Converting the DEC to Hex has helped to decode the mystery RIDs and the number 256 is of very great importance for understanding P25 messaging. The HEX 01 00 = 256 DEC and 256×256×256=16777216. Most of the time Unitrunker will see an error in the packet and then discard the message so that you will not see it.

I hope this has been of some help with understanding the origin of some of those mystery RIDs.

November 6,
RID 2261576 CO0337 Melville Mobile login 10:14 am on site 71.
RID 2213250 is Yorkton portable 18 in unit B466 on TG 50, confirmed by voice 4:19 pm to 4:22 pm. I have been wondering for quite some time, about this group of new RIDs that I had been seeing on the Yorkton talk-group. These were the new Harris portables. They are Yorkton rural and are not Yorkton city.

RID 2213233 Yorkton Portable 01
RID 2213234 Yorkton Portable 02
RID 2213235 Yorkton Portable 03
RID 2213236 Yorkton Portable 04
RID 2213237 Yorkton Portable 05
RID 2213238 Yorkton Portable 06
RID 2213239 Yorkton Portable 07
RID 2213240 Yorkton Portable 08
RID 2213241 Yorkton Portable 09
RID 2213242 Yorkton Portable 10
RID 2213243 Yorkton Portable 11
RID 2213244 Yorkton Portable 12
RID 2213245 Yorkton Portable 13
RID 2213246 Yorkton Portable 14
RID 2213247 Yorkton Portable 15
RID 2213248 Yorkton Portable 16
RID 2213249 Yorkton Portable 17
RID 2213250 Yorkton Portable 18 Regina DOC called, “Yorkton 18”.
RID 2213251 Yorkton Portable 19
RID 2213252 Yorkton Portable 20

November 9,
From 2:01 pm to 2:34 pm lots of coms on TAC 5 from these RIDs, but they were not around my location. NBCRU?
RID 2214359 seen on TG 45 for the EQINOP on September 21, 2023.
RID 2214781
RID 2214783
RID 2214829
RID 2214831
RID 2214832
RID 2214833

Until the next time, Cheers!

 

[Mobby1-Kenobby]

What this RR member has been hearing and seeing recently.

November 15, 2023
RID 2212230 is E300/E335/C9410/C9239 Radio Techs login at 12:09 pm on talk-group 37, Hits 1.
RID 2212231 on talk-group 202, some unencrypted testing seen bellow in a P25 ISP voice message.
There were many voice messages with this being the final one, followed by 4 Call Terminations and
then 31 never seen before, Reserved for Harris messages to the FNE, followed by 4 Call Terminations.
(0A=10=System ID, A4=164=Harris, 00, FF FF FC=16777212=FNE ID, 21 C1 87=2212231=RID)

12:14:12.791 047 A ESW MI 000000 000000 000000 Unencrypted KID 0000 OK
12:14:12.824 047 5 Cell Fix 1: 197 0 61B 0 472 0 267 0 03F 0 2B5 0 29C 0 15 e 0
12:14:12.859 047 5 Cell Fix 2: 627 0 327 0 3E3 0 5F6 0 7C0 0 469 0 2F2 0 34 e 0
12:14:12.859 047 5 Cell Fix 3: 66F 0 177 0 68F 0 CDE 0 7C6 0 060 0 5FB 0 10 e 0
12:14:12.892 047 5 Cell Fix 4: 627 0 375 0 2A6 0 CA8 0 7C4 0 696 0 276 0 0C e 0
12:14:12.892 047 5 Cell Fix 5: 5AE 0 D52 0 156 0 1D5 0 7CC 0 301 0 45A 0 0E e 0
12:14:12.925 047 5 Cell Fix 6: 52E 0 4F5 0 506 0 E63 0 780 0 085 0 212 0 17 e 0
12:14:12.925 047 5 Cell Fix 7: 4EC 0 5F5 0 BA1 0 2CB 0 780 0 6AA 0 268 0 0B e 0
12:14:12.959 047 5 Cell Fix 8: 4E5 0 E36 0 E8A 0 96A 0 783 0 07A 0 2E6 0 11 e 0
12:14:12.990 047 5 Cell Fix 9: 4DC 0 EBC 0 64F 0 024 0 783 0 7EF 0 23B 0 38 e 0 LSD 00
12:14:12.990 047 5 LC 00 00 04 00 00 CA 21 C1 87 Group Voice Channel User I 21C187 G 00CA (4 priority, packet) OK
12:14:13.004 047 A Cell Fix 10: 4DB 0 F66 0 9C9 0 C49 0 682 0 414 0 2E1 0 30 e 0
12:14:13.026 047 A Cell Fix 11: 4DA 0 DBB 0 2C0 0 6A2 0 400 0 120 0 17E 0 21 e 0
12:14:13.059 047 A Cell Fix 12: 190 0 87F 0 668 0 71B 0 031 0 24E 0 563 0 0D e 0
12:14:13.059 047 A Cell Fix 13: 193 0 A1B 0 321 0 3A1 0 035 0 4A6 0 550 0 39 e 0
12:14:13.092 047 A Cell Fix 14: 196 0 623 0 634 0 C7A 0 03B 0 348 0 3A6 0 21 e 0
12:14:13.092 047 A Cell Fix 15: 190 0 877 0 DC2 0 B7C 0 03C 0 4F9 0 67F 0 19 e 0
12:14:13.126 047 A Cell Fix 16: 197 0 20B 0 1A3 0 0AD 0 034 0 0D7 0 44A 0 19 e 0
12:14:13.126 047 A Cell Fix 17: 192 0 83F 0 76C 0 EFA 0 02A 0 7A9 0 1B8 0 01 e 0
12:14:13.159 047 A Cell Fix 18: 191 0 A5B 0 B98 0 27B 0 027 0 5A7 0 242 0 31 e 0 LSD 00
12:14:13.159 047 A ESW MI 000000 000000 000000 Unencrypted KID 0000 OK
12:14:13.192 047 5 Cell Fix 1: 194 0 06F 0 CF6 0 087 0 027 0 35F 0 3EE 0 21 e 0
12:14:13.192 047 5 Cell Fix 2: 192 0 83F 0 7F4 0 E02 0 01B 0 6A8 0 0FD 0 25 e 0
12:14:13.225 047 5 Cell Fix 3: 195 0 04F 0 85A 0 7CF 0 011 0 712 0 745 0 3D e 0
12:14:13.258 047 5 Cell Fix 4: 192 0 A3B 0 709 0 7E9 0 013 0 536 0 0C2 0 21 e 0
12:14:13.258 047 5 Cell Fix 5: 194 0 0EE 0 6EC 0 413 0 013 0 5EE 0 29A 0 21 e 0
12:14:13.291 047 5 Cell Fix 6: 197 0 20B 0 0A2 0 467 0 013 0 4FE 0 26F 0 31 e 0
12:14:13.294 047 5 Cell Fix 7: 191 0 85F 0 B74 0 BD2 0 01D 0 439 0 5B0 0 19 e 0
12:14:13.326 047 5 Cell Fix 8: 040 0 CFD 0 7BF 0 B7D 0 793 0 6CF 0 33C 0 22 e 0
12:14:13.326 047 5 Cell Fix 9: 040 0 CFD 0 7BF 0 B7D 0 793 0 6CF 0 33C 0 22 e 0 LSD 00
12:14:13.326 047 5 LC 00 00 04 00 00 CA 21 C1 87 Group Voice Channel User I 21C187 G 00CA (4 priority, packet) OK
12:14:13.392 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:13.425 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:13.459 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:13.527 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:21.405 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.469 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.505 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.670 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.706 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.769 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.805 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.839 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.903 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.939 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.973 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.038 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.073 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.106 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.173 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.206 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.242 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.306 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.340 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.373 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.439 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.474 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.539 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.574 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.606 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.674 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.706 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.739 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.806 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.838 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.874 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.974 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:23.006 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:23.074 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:23.106 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK

November 16,
RID 2211146 login site 72 at 6:51 am and then onto site 71 an hour later on PA TG 70.
This RID was on site 71 TG 70 until 5:13 pm and then logs onto site 72 at 5:33 pm.
There was a trailer on the east side, that burnt to the ground in the night.
This RID must be the Forensic ID service arson investigator from Yorkton.
The upcoming police report should confirm this.

November 16, from 8:54 am to 10:52 am.
These 9 RIDs were confirmed by voice, many times.
RID 2212110 is C813 FQ TS.
RID 2211979 is A260 IH.
RID 2212099 is A276 FQ is a Chevy Silverado.
RID 2213147 is E390 Yorkton Provo van.
RID 2211984 is A318 IH.
RID 2212118 is FQ5 portable.
RID 2212109 is C812 FQ TS.
RID 2212835 is C704 TS Yorkton.
RID 2211063 is M455 RPS CTS and has only the # 55 on this unit.

November 18,
RID 2244449 Preeceville FD on site 71/72 from 10:44 am to 11 :00 am.
Melville COs utilizing talk-group 6007 TAC 2 for a decoy operation. They were on and then off site 72 in the am.
The same group of RIDs listed before were utilizing TAC 5 again today.

Cheers

 

[wolffe]

Hi, to all.
What this RR member has been seeing and hearing.

October 30,
Most of the new Motorola portable radios are still sending their GPS data to nowhere.
09:13:35 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 81 D7)=TX RID 2261463, 2A 42=CRC.
09:36:19 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 5F 51)=TX RID 2252625, ED 24=CRC.
14:15:23 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 5F 50)=TX RID 2252624, FD 05=CRC.

October 30, these 2 were seen in P25 ISP messages, so CO#0329 was very close to my location.
RID 2261628 CO# 0329 Melville Mobile login on site 71 at 3:50 pm.
RID 2263651 CO# 0329 Melville portable login 3:55 pm.

October 30,
RID 2211223 ERT unit is now a white F250 "camper-special" login on TAC 3 at 4:21 pm.
RID 2214763 (NBCRU) North Battleford Crime Reduction Unit coms on TAC 3.
RID 2212716 CIRT coms on TAC 3.
RID 2212720 CIRT coms on TAC 3.
RID 2211215 ERT commander coms on TAC 3, Black Suburban.
All coms end at 4:28 pm, as the "camper-special" had gone north to the "campsite".
Yes, that ERT unit looks like a truck-camper unit.

November 2,
RID 2263651 CO0329 Melville portable login on site 71 at 3:28 pm.
RID 2261576 CO0337 Melville mobile login 3:33 pm.
RID 2261392 CO0337 Melville portable login 3:33 pm.

November 3,
RID 2261568 CO0432 Hudson Bay mobile login 10:48 am on site 71.
RID 2263651 CO0329 Melville portable login 4:32 pm.
TG 912 RCMP Announce Group at 6:39 pm.

Recently RR member Wolffe asked a question about channel plans, as Unitrunker 2 was showing many incorrect frequencies for P25 sites. I referred to these as ghost-channels as I believed they did not really exist. I have not seen this phenomenon, but what Wolffe’s post did was to encouraged me to share with all of you what I have encountered over the past 5 years.

Some useful information for those utilizing Unitrunker 1 or 2.
P25 packets can arrive with some octets out of their correct sequence and then are decoded by the program to display incorrect RID information.
Examples:
November 3, 2023 at 6:44 pm.
RID 14417953 is HEX = DC 00 21, but was in fact the HEX 21 DC 00 = DEC 2219008 is an RCMP F-Division DOC RID.

May 22, 2018 at 6:48 pm.
RID 2210000 is HEX 21 B8 D0, but was in fact the HEX 21 D0 B8 = DEC 2216120 is an RCMP F-Division GIS DELTA member RID.

November 15, 2022 at 7:57 pm.
RID 2210001 is HEX = 21 B8 D1, but was in fact the HEX 21 D1 B8 = DEC 2216376.
The true RCMP RID start is 2211001 = A591 Regina.

Some other false RID information that may be displayed by the Unitrunker programs are:
RID 222 is the HEX DE, only the last octet of the packet was seen and then decoded on 04/29/2023.
RID 50 is the HEX 32, talk-group is displayed as an RID on 04/10/2018.
RID 10 is the HEX 0A, is the system ID and was displayed as an RID on 02/04/2019.
RID 18 is the HEX 12 is a talk-group displayed as an RID on 09/22/2022.
RID 62 is the HEX 3E and is another talk-group seen as an RID by the program.
RID 80 is the HEX 50 and is yet another talk-group seen as an RID by the program.
RID 65536×256 = 16777216 is an FNE address. The program failed at the mathematics.
RID 65537×256 = 16777472 is another FNE address that the data messages are sent to.

There are other examples, but they are not so easily explained as these were.
Converting the DEC to Hex has helped to decode the mystery RIDs and the number 256 is of very great importance for understanding P25 messaging. The HEX 01 00 = 256 DEC and 256×256×256=16777216. Most of the time Unitrunker will see an error in the packet and then discard the message so that you will not see it.

I hope this has been of some help with understanding the origin of some of those mystery RIDs.

November 6,
RID 2261576 CO0337 Melville Mobile login 10:14 am on site 71.
RID 2213250 is Yorkton portable 18 in unit B466 on TG 50, confirmed by voice 4:19 pm to 4:22 pm. I have been wondering for quite some time, about this group of new RIDs that I had been seeing on the Yorkton talk-group. These were the new Harris portables. They are Yorkton rural and are not Yorkton city.

RID 2213233 Yorkton Portable 01
RID 2213234 Yorkton Portable 02
RID 2213235 Yorkton Portable 03
RID 2213236 Yorkton Portable 04
RID 2213237 Yorkton Portable 05
RID 2213238 Yorkton Portable 06
RID 2213239 Yorkton Portable 07
RID 2213240 Yorkton Portable 08
RID 2213241 Yorkton Portable 09
RID 2213242 Yorkton Portable 10
RID 2213243 Yorkton Portable 11
RID 2213244 Yorkton Portable 12
RID 2213245 Yorkton Portable 13
RID 2213246 Yorkton Portable 14
RID 2213247 Yorkton Portable 15
RID 2213248 Yorkton Portable 16
RID 2213249 Yorkton Portable 17
RID 2213250 Yorkton Portable 18 Regina DOC called, “Yorkton 18”.
RID 2213251 Yorkton Portable 19
RID 2213252 Yorkton Portable 20

November 9,
From 2:01 pm to 2:34 pm lots of coms on TAC 5 from these RIDs, but they were not around my location. NBCRU?
RID 2214359 seen on TG 45 for the EQINOP on September 21, 2023.
RID 2214781
RID 2214783
RID 2214829
RID 2214831
RID 2214832
RID 2214833

Until the next time, Cheers!

Great information, thanks Mobby 1

 

[ve5wil]

Morning all - at 8:47 this morning , tg 384 (assume Tower radio) popped on with the id 2213484. there were 5 consecutive transmissions of what sounded like a lower end digital alarm. ( 5 or so tones stepping up up then down).

 

[Mobby1-Kenobby]

November 20,


The first thing that I must do is thank RR member Wolffe for sharing that Unitrunker 2 xml file.
Thank you so much for sharing that file with me, Wolffe!
Lots of great RID location information in there.
I'm finding even more valuable data every time I take a look at it.
Thanks again!

Wil, that's a radio tech utilizing that site radio along with his testing equipment on that talk-group.
I hear those same sounds at my location, thanks for the update.

November 23,
RID 2216462 is a member of the (STRT) located in Swift Current.
Talk-group 180 is (STRT) Saskatchewan Trafficking Response Team.
There is a (CRT) Crime Reduction Team located in Moose Jaw and we require RID and TG information for this team.
We are looking to our well known and trusty RR Wil, in MJ for help with this.

November 25 pm,
The Decoy Operation
Saskatchewan Environment conservation officers from Melville, Weyburn and Fort Qu'Appelle were all on TG 6006 SE TAC1 at 3:14 pm.
RID 2261463 CO0415 portable FQ
RID 2261606 C00415 mobile FQ
RID 2261649 CO0275 mobile Weyburn
RID 2261593 CO0339 mobile Melville
RID 2261499 CO0339 portable Melville
The operation did not take place within the footprint of site 71 or site 72 and was over at 6:00 pm.
At 1:30 pm I was traveling north on the #35 highway and just to the south of Lipton I met a south bound
SE white unmarked Ford F250SD. I thought that this was CO0415, but after looking at the Unitrunker data,
logins, joins and logouts, it could have only been CO0275.

 

[Mobby1-Kenobby]

Hi to all of you.

I will start by asking a couple of questions. Can a P25 system get a virus? What would that look like?

I have recently discovered a very unusual control channel OSP message being broadcast from both PPSTN sites 71 (47) and 72 (48).

Unitrunker 2 sees the unusual message (UM) and then discards it. I do understand why the program is discarding this UM. The UM is labelled as Harris but the MFID A4 is not seen in the message. This UM is seen at regular intervals and appears to be an "extension" of the (SSB) system service broadcast message.

If this is a new (Extended) system service broadcast (SSB-E) message, that explains why it is being broadcast by all of the PPSTN sites. I have been trying to understand what this new “addition” (UM) is all about. Bellow you can see the UM as it occurs just after the SSB, but then there are 33 SSB messages without the UM following them and then the 34th SSB message is again followed by the UM. Then there are 33 SSB messages without the UM following them.

Message as seen on PPSTN site 71 = 47. Unedited version.
18:03:49.287 047 C 37 FD 00 47 30 0A 81 3A 00 00 00 A6 RFSS Status Broadcast (Extended) Sys 00A Sub 47 Site 47 TX 0-105(139.30500) RX 0-2F1(141.76500)(data,voice,registration)
18:03:49.287 047 C -47 47 01 05 02 F1 70 00 B9 13 3A D4
18:03:49.352 047 C 37 FD 00 47 00 0A 81 3B 00 00 18 1A Network Status Broadcast (Extended) WACN 0000A Sys 00A TX 0-105(139.30500) RX 0-2F1(141.76500)(data,voice,registration)
18:03:49.352 047 C -00 00 A0 01 05 02 F1 70 19 C7 61 1E
18:03:49.387 047 7 -B4 00 05 00 00 28 01 A5 24 80 22 30 Identifier Update 0 Base 138000000 Spacing 5000 Tx Offset 0
18:03:49.420 047 7 -B8 00 04 0F 2C 08 0F 2C 08 01 FB 98 System Service Broadcast Set Normal Available 0F2C08 Supported 0F2C08 WID 12.0 hours Priority 1
18:03:49.520 047 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded <<----------------UM Unusual Message.
18:03:49.556 047 7 -A9 00 47 47 00 DB 00 00 01 04 5A 00 Secondary Control Channel Broadcast Explicit Sub 47 Site 47 TX 0-0DB(139.09500) RX 0-001(138.00500) (backup control channel only)

See timing of the UM. Edited version.
18:03:54.562 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:03:59.570 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:04.576 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:09.585 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:14.624 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:19.632 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:24.676 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:29.714 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:34.757 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:44.772 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:09.845 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:14.853 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:19.859 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:24.898 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:29.907 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:34.915 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:39.990 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:44.999 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:50.041 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B

Timing of the UM as seen on site 72 = 48. Unedited version.
16:42:20.165 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:24.743 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:27.313 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:32.321 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:34.923 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:42.402 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:46.442 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:47.412 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:51.750 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:52.952 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:54.122 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:57.462 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:43:02.470 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:43:05.307 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:43:07.075 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:43:52.750 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:43:57.759 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:44:02.767 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded

Update: Unitrunker is now showing the UM as: Standard Discarded. Harris is no longer seen after the message.

This may be nothing more than a P25 system messaging failure, but if it is, why have they done nothing about it? When change occurs, this is how it first appears.

Now on to other things.

December 6, SHP was heard, unencrypted, then on the 11th, heard coms from SE Dispatch, and then on the 18th open P25 coms heard from DOC on TG 18.

December 20, at 6:50 am RID 2214836 ERT/CIRT black F250 SD (no camper cap) is seen on TAC 3 site 72 and then on site 71 at 7:14 am, followed by a logout at 7:23 am.

December 22, at 5:30 pm RIDs 2215420 and 2212458 the link RID to Flin Flon are on TG 116. At 6:30 pm RIDs 2242283 and 2242284 are on DELTA 1, site 72.
I suspect that these and some of the other 22422## RIDs are utilized by the Firefighter Training Facility at Melville.

December 23, the unusual message is still being sent on those sites.

Cheers.

 

[Mobby1-Kenobby]

Hi, it's me again. I believe it's time for sharing.

I have been utilizing Unitrunker 2 to decode PPSTN site control channel OSP messages along with the ISP messages being sent by the SUs on the system.

Unitrunker 2 was designed to decode control channel OSP messages, but not the ISP messages.
Most of the ISP messages are not labelled or are labelled as unknown, as the author of Unitrunker 2 has not include ISP decoding in the program.
The sharing of knowledge about P25 ISP opcodes could be used by Unitrunker's author to improve the program's decoding capabilities.

This is a list of 10 ISP opcodes utilized by the PPSTN that Unitrunker 2 is unable
to decode: 0x17, 0X23, 0x36, 0x92, 0x93, 0x98, 0xA3, 0xA4, 0xAB, and 0xAD.

Unitrunker 2 ISP message errors seen in other partially decoded messages:
Message has the opcode incorrectly labelled.
Message labelled as a Response, but is in fact be a Request.
Message labelled as Grant, but is in fact be a Request.
Message labelled as Update, but is in fact be a Request.
Message labelled as a Command, but is in fact be a Request.

Examples of incorrect/false ISP messages decoded by Unitrunker 2:
opcode = 0x8A = Telephone Incoming Request, Harris, (Caller ID).
opcode = 0x08 = TELE INT DIAL REQ, Harris, (Telephone Voice Grant).
No telephone voice grant OSP messages have ever been seen on the PPSTN.

In addition to all of those, Unitrunker 2 will not always display the RID, TG and FNE information correctly.

Some ISP opcodes are "Reserved" for future use or special purpose, so they will be unknown until we discovered their purpose.
There is always a very high inbound packet message error rate, but the more time that I spend doing this, I learn to recognize those errors.
I look at both the ISP request messages and the OSP response messages at the same time to decode the unknown ISP messages.
Making my task even more difficult are those ISP messages having being sent and never seeing a visible response message from the network.

But I have discovered what those 10 unknown ISP opcodes are used for and labeled them.
This list contains 13 opcodes with the first opcode 0x17 message being (Extended 01.1) and it shows the previous radio site ID the RID was registered on.
The opcode 0x17 message is seen when an RCMP Zone 3 (East-Central) SU travels outside of it's home Zone and into Zone 4 (South).

01 is opcode = 0x17 = Unit Extended Function Command, Response, FD 00, 21 CC E6 = RID 2215142, 81 2D 00 00, C7 1F = CRC-->
01.1 is (Extension), A0 0A = WACN System ID, 21 CC E6 = RID 2215142, 48 = site #72, 00 32 = TG 50, D5 9C CA 8C = CRC
02 is opcode = 0x23 = Unit Cancel Service Request, 08 00, 21 C1 06 = RID 2212102 80 00 00 00, D2 D3.
03 is opcode = 0x36 = Unit Roaming Address Request, 00 00 00 00, (9F FC), 22 5E DE = RID 2252510, 99 64 = CRC.
04 is opcode = 0x80 = Unit Group Voice Channel Request, 00 04 = Unprotected, 00 00, 14 07 = TG 5127, 22 5F 72 = 2252658, 60 25 = CRC.
05 is opcode = 0x92 = Unit Data Channel Request, 00 01 00 01 00 = FNE 16777472, 00 21 C1 05 = RID 2212101, 97 92 = CRC.
06 is opcode = 0x93 = Unit Cancel Data Service Request, 00 01 20 00 01 00 = 18874369 FNE, 21 C2 B1 = RID 2212529, A7 4A = CRC.
07 is opcode = 0x98 = Unit Status Message, 00 01 00 = is used to call the RCMP DOC, FF FF FC = FNE 16777212, 21 C1 03 = RID 2212099, F8 5A = CRC.
08 is opcode = 0xA3 = Unit Cancel Service Request, 00 12 20 00 00 00, 22 82 26 = RID 2261542, 9E 15 = CRC.
09 is opcode = 0xA4 = Unit Extended Function Radio Check Command, Response (not to be confused with the Harris MFID 0xA4)
10 is opcode = 0xA8 = Unit Group Affiliation Request, 00 00 00 0A 00, 12 = TG 18, 21 C1 15 = RID 2212117, CE 47 = CRC.
11 is opcode = 0xAB = Unit De-Registration Request, 00 00 00 00 A0 0A = WACN System ID = 10, 21 C1 02 = RID 2212098, 2F 5C = CRC
12 is opcode = 0xAC = Unit Global Registration Request, 00 00 00, 00 A0 0A = WACN System ID = 10, 22 5F 53 = RID 2252627, 1B C6 = CRC.
13 is opcode = 0xAD = Unit Location Registration Request, 00 00 00, 47 = site 71, 00 12 = TG 18, 21 C1 03 = RID 2212099, 5A 93 = CRC.



Moving on to look at the PPSTN Data Services.

Utilizing Unitrunker 2, as intended for decoding the OSP control channel messages I see 2 to 3 or more messages together and all are labelled as data.
Those are just data channel grants, Unitrunker 2 does not display any "real" information about those data messages.

To get a greater understanding of what those multi-block (extended) data messages are, I look at the ISP messages sent by the SUs.

The data message sender's RID and the destination FNE address are sent by an SU on the RX input control channel frequency.
Example:
92 00 00 00 00 00 00 21 C2 D0 5B 6A, no destination FNE address, sender's RID is 2212560.
This message is followed by an unknown message to nowhere on a voice channel.
92 00 01 00 01 00 00 21 C2 D0 59 19, 16777472 is FNE address, followed by RID of the sender.
This message is followed by an unencrypted data message.
92 00 01 00 01 00 00 21 C2 D0 59 19, 16777472 is FNE address, followed by RID of the sender.
This message is followed by an AES data message.

The following messages are sent on the RX input side of a voice channel. The FNE address is never seen in these messages.

A Motorola Fire Department SU data message (Extended).

All the messages sent by this and all the other FD/EMS SUs never contain the FNE address, so those messages go nowhere.
56 C6 00 22 3B D4 81 02 68 00 CB 9F, the sender's RID is 2243540, ALGID is DES along with one of the 10 different Key IDs.
0B C2 1C 00 00 02 00 00 00 14 EF AA, unknown message to nowhere.
03 0B 00 22 3B D4 80 00 00 00 CB 6C, the sender's RID is sent again, but this time there is no AGID = unencrypted, no Key ID.
63 60 41 55 46 6B 63 41 5D 73 06 47, data, unknown, as this base station RID is not equipped with a GPS antenna.
These messages are never followed by any Cancel Service Request messages, as no FNE address was in the opcode 0x92 message.

A Harris RCMP SU data message (Extended).

The first message sent by this and all of the RCMP SUs never contains the FNE address, so those messages go nowhere.
56 C6 00 21 C1 08 81 02 58 00 BD FF, the sender's RID is 2212104, ALGID is DES with one of the 10 different Key IDs in use.
0B C2 1C 00 00 02 00 00 00 14 EF AA, unknown message to nowhere and is not followed by a Cancel Service message, as no FNE address was in the 0x92 message.
The second message is sent to FNE address 16777472.
03 0F 00 21 C1 08 80 00 00 00 24 76, the sender's RID is sent again, but this time the message is unencrypted, no key.
51 46 41 60 52 75 51 59 69 64 30 55, GPS location data that is followed by a Cancel Service Request, opcode 0xA3 message.
The third message is again sent to the same FNE address 16777472.
56 C0 00 21 C1 08 84 02 08 02 75 CF, the sender's RID is sent again, ALGID is AES with one of the 10 different Key IDs being used.
09 94 09 FC 02 44 7E 00 22 19 02 EC, encrypted GPS location message is then cancelled by an opcode 0X93 message.

So what did I discover?

All of the radios on the PPSTN utilize encryption for data services.
These radios appear to have been delivered with DES as the default algorithm for data transmission.
The DES having been supplanted by the AES that is currently utilized, and we see the same 10 DES Key IDs
appear to have just been reused for the AES. Yes, the same Key IDs, but with the upgraded (longer) Keys used by the AES.
PPSTN data services appear to have a far greater level or protection than voice services.
The data messages that are sent to the FNE are both unencrypted and encrypted utilizing AES.
And yes, the first part of this data message is unencrypted but because the second part of the
message is encrypted, this makes the decoding the competed message impossible for those on the outside.

Looking at this mix of messages and encryption algorithms, I can only conclude that no effort was made to first delete and then replace.
This helps to explains why I am seeing three different Cancel Service Request opcode messages, following the mix of data messages on the system.
This is akin to upgrading a PC with a new software program, but failing to delete the old software program, because we were afraid of what might happen.

And then there's this unusual OSP message: D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded.
It is now all over the place, frequently following almost any control channel message.

The PPSTN com-techs appear to have mixed and messed things up, but the top-floor management team is far too dim to comprehend it.

Cheers and do remember to share.

 

[wolffe]

Happy New Year to everyone.

Wow Mobby great information as always. Its going to take some time for me to go through it.

TG 5502 is a group that I kept seeing but was never able to get an ID on. As is turns out it is JCH Jim Pattison's Childrens Hospital. They work out of the RUH. Both regular EMS and STARS have been seen on it.

Still looking for the residents of these TG's

5473 I have seen Medavie EMS on it
5493 I have seen STARS on it.

Unknowns all EMS TG's

5141
5144
5145
5146
5168
5171
5174
5180
5119
5232
5234
5241
5261
5299
5368
5369
5385
5304
5314
5341
5342
5493

Not much for other activity, a few chases involving air support. It seems that no matter what direction from Saskatoon the chase is, the same IDs are showing up, I am following up on that to see if these IDs are a special unit.

Thank you Mobby for your dedication, you are helping us all to understand the system more.

 

[Mobby1-Kenobby]

Hi to all.

What I have been seeing.

Jan 21, RID 2212103 A283 is repeatedly Denied from the network, unit has not been used for many weeks and now I see why.
Jan 21, RIDs 2212713 CIRT Sierra 3 and 2214836 E240 ERT, on sites 71 and 72 from 4:25 to 5:25 pm.
Jan 22, RIDs 2263357 SHP and 2211837 C622 both are out of Swift Current, on site 72 from 2:41 to 3:27 pm.

Jan 22, Harris Super-Group patch 2043, 00=No Key, 80=Open, Public Talk-Groups 152 to 155. It lasted about 60 seconds.
16:31:42.711 047 7 -B0 A4 78 07 FB 00 00 80 00 98 EE 96 Harris Patch Super 07FB adds G 0098 status 78
16:31:43.178 047 7 -B0 A4 78 07 FB 00 00 80 00 99 FE B7 Harris Patch Super 07FB adds G 0099 status 78
16:31:43.279 047 7 -B0 A4 78 07 FB 00 00 80 00 9A CE D4 Harris Patch Super 07FB adds G 009A status 78
16:31:43.343 047 7 -B0 A4 78 07 FB 00 00 80 00 9B DE F5 Harris Patch Super 07FB adds G 009B status 78

Commands to end patches:
16:32:08.250 047 7 -B0 A4 00 07 FB 00 00 00 00 00 79 AB Harris Patch Other
16:32:08.284 047 7 -B0 A4 00 07 FB 00 00 00 00 00 79 AB Harris Patch Other
16:32:08.319 047 7 -B0 A4 00 07 FB 00 00 00 00 00 79 AB Harris Patch Other

Jan 23, Harris Super-Group patch 2044, 37=Key ID, 84=AES, Encrypted Talk-Groups 6225 and 76. In place for many hours.
12:37:10.841 047 7 -B0 A4 79 07 FC 00 37 84 18 51 02 BF Harris Patch Super 07FC drops G 1851 status 79
12:37:10.908 047 7 -B0 A4 79 07 FC 00 37 84 00 4C 4B F9 Harris Patch Super 07FC drops G 004C status 79
The Talk-Group 76 is utilized by Lloydminster and is frequently patched to Talk-Group 6225.

Is the Talk-Group 6225 used to connect the PPSTN to the Alberta P25 system?

Calling all Alberta RR members, what are you seeing over there?
This patch is still in place as I post this.
Encrypted patches are only seen in the Unitrunker 2 logging file.

Cheers.

 

[wolffe]

Hmmm, interesting I have been looking for a TG like that. I talked to someone in Lloyd (I forget his name) if he knew of any link from Alberta to Lloyd about a year ago and he hadn't seen anything like that. His thought was that the border RCMP had a radio that covered both systems. I looked it up and they do make radios that does that split so I dropped it. When the Onion Lake manhunt was on I saw a lot of activity that I didn't recognize, but it was summer and I didn't have the time to go through it. I will try to look back on that date.

The units I have seen on 6225 is RID 2214120
6227 2211712
6229 2213955
2213352
6230 2214153
2213776

On TG 2044 all I have seen is Wynyard EMS 2 different units.

If 6225 was a link to Alberta could the other TGs be links from Alberta and Manitoba? I always thought that there would be multiple sites and TGs linking from different parts of the province. I do know that the border towers have an extend range and run more power, the range is more than double other towers. St Walburg falls in that footprint with a tower from Cold Lake, unfortunately I no longer have coverage there. This summer I will have a station set up that is a lot closer to these sites.

This past Monday the 22nd

2043 added 154 155 152 on tower 19 at 16:31

At 16:31 Tower 34 Warman saw SuperGroup 2043 added TG 153

Site 030-030 system 0000A-00C, a site I believe to be at Rosthern or east of Rosthern.
On Monday at 16:25 TG 164 Major Crimes came on the tower then at 16:32 SuperGroup 2043 added TGs 152 154 155

Nothing on tower 047 Langham

Previous to this was a great deal of Fire activity from 4084 Fire Zone 6

Now this may be related or not, I thought you would be interested Mobby

At 16:49 on Tower 36 Warman TG 6136 became active, I see 6136 active on tower 36 on a regular basis.

RID on TG 6136 was 2214689 and he logged on at 17:09 related? RID 2264689 always logs into 6136 on the Warman tower. At 17:12 2264672 joined 6136 on same tower. 2264686 joined at 17:31. at 17:55 2264775 logged out and logged back in at 19:49

 

[wolffe]

Looks like the days of PPSTN may be numbered.

I noticed a significant decrease of EMS traffic and at the same time started hearing dispatch ask for the personnel's Samsung unit number. I started checking and found that they are starting to hand out military grade Samsung Galaxy XCover6 Pros. These phones are tough rugged and capable of push to talk technology. When signing up to the First Net system it gives the personnel easy to use communications as the two way radio is, but also is capable of transmitting real time video, and any or all data that their portable monitoring machines spit out. That way the hospital has real time access to all information and data.

ST-Interworking Mission Critical Push-to-Talk between LTE and LMR Report | Homeland Security

FirstNet Authority | First Responder Network Authority

firstnet.gov

They also serve Canada.

They are also capable of CBRS which effectively turns the phone into a two way radio to communicate with other units on site of any given emergency.

What is CBRS, and how is it transforming enterprise networks? - Samsung Business Insights

An overview of CBRS, including potential use cases and how CBRS stands apart from other deployment options.

insights.samsung.com

Pretty incredible piece of tech.

Only a limited number of units have been handed out and I believe they are only in the testing phase, but if this technology proves to be reliable PPSTN may go the way of the Dodo bird. Combined with MDTs that are already in use, voice traffic on PPSTN will all but disappear.

 

[wolffe]

Hi group, I noticed something today that I have not seen to this extent.

All day an Emergency call has been sent out, if you are using Unitrunker in the column that says action (this column tells you if its login or join) for the emergency call it says "message" and in the service column it say "M 00". This has been going out all day on every control channel that I monitor. Mostly on tower 19 and on tower 34. It is a sometimes a different RID and sometimes its the same.

At first I thought that techs were testing something new, but it continued well into the night. I know these radios can be programed over the air, is that it? I don't think so because I don't believe they would use an emergency call.

I have 16777212 ID listed as Emergency call. Maybe that is where I am going wrong.

 

[Mobby1-Kenobby]

Hi, Wolffe

Back in January I put in a request to Rick for an update of Unitrunker 2 to show Harris Super-Group patches on the PPSTN.
I also asked Rick to update Unitrunker 2 to show unit status update messages on the PPSTN.

On February 4, I downloaded Unitrunker version 2.1.0.107.

The program is now showing Saskatchewan PPSTN unit status update messages.
The status 01 message is an alert tone used to page the DOC in Regina = FNE 16777212.
See the screen shot.
B190 paged the DOC and then.
See the Bonus Zip file.
A 10-70 is a status update request/response.

I have been testing the updated version of Unitrunker 2, but I have not seen any Super-Patches in use so far, this month, so I
do not know if the Super-Patch update was successful or not.


A big thank you must go out to Rick for his quick response to my request for this new update.

Cheers.

 

[wolffe]

Thank you Mobby I did start receiving this message after I upgraded.