Programing a Trunked radio for monitoring only

[dsheli]

As another user pointed out, I think the reason the folks at Batboards get rude and blunt about programming to monitor only is because there are more bloggers there that have an understanding of the system. There seems to be more users / monitors here, which makes sense because that is the spirit of radio reference. I am not trying to be a “saps” here, and if my opinions are coming across as such I will bow out of this discussion. To be frank, I am frustrated by people who put radios on illegally without any regard for the system or legitimate users.

I did a test this morning based on Skypilot’s recommendation. I changed a codeplug and enabled TXIN (TX Inhibit) as suggested. I sat in front of the administration console, using radio affiliation display, and turned the radio on. I watched it affiliate. I pressed TXIN, and cycled the power. The radio did not leave the system at power off and eventually timed out. I sent the radio commands and it came back as not found. The radio remained TX inhibited even when cycling power or removing the battery. After cycling power, the radio did not affiliate when turning on.

However, while the radio was in TX inhibit mode it would not receive any audio on any system talkgroup. So it appears the radio needs to be affiliated to receive audio, on a 7.x system.

I do not think there is a solution to this problem. If there was an easy answer we would not be having the problems with illegal users and the resulting talkgroup issues. The next release of Astro system software will have a new feature called radio authentication. It will employ an encryption key from a KVL with the radio ID, so it will stop this problem (although this will be a major pain in the rear for programmers and administrators). I feel if Motorola took the time and resources to develop this authentication protocol, it shows that this is a problem and that there is no easy solution.

Glad you used my tip. hahah Whats funny is I did the same exact thing on our system that you just described. The fact that the radio will not un-mute kinda makes the whole programing to monitor a system pointless, on a 7.x system that is.

 

[Seadoo]

This is pretty much what I said earlier in these posts but we do it on the System side of our rebanded legacy SMR system to force the illegal radios to have to affilliate. That way we know exaclty what radios are on the system and can disable the radios as the system red flags the radio ID's that dont belong on the system, same goes for duplicate ID's as well.

 

[immelmen]

.....So it appears the radio needs to be affiliated to receive audio, on a 7.x system.

I do not think there is a solution to this problem.......

Just to clear this up, for the record, this is not correct. It is possible to get Astro25 AND Astro(with correct firmware) radios to trunk a 9600 system and unmute the audio with out affiliation. It was first only thought possible on 800mhz but has since been proven possible on OBT systems as well. There are older threads here on RR where this has been mentioned as well as a thread on the BatBoard where myself and another person spell out the procedure. After alot of self-education and testing, and even though motorola will deny it can be done, there is actually an intentional loophole in their design that makes it possible.

Successful tests have been carried out (with admin approval) to demonstrate the procedure on 800 and OBT systems with both Astro and Astro25 portables and mobiles. The radios will continuously trunk the control channel and unmute a given talkgroup or a scanlist of talkgroups without ever affiliating with the system.

Have not been to RR in quite a while. Nice to see this topic tacked so maybe it can be put to bed.

 

[OpSec]

Can a radio be programmed to act as an illegitimate scanner? Yes. Should you? No.

Using a rogue radio to access a trunked system is illegal. What part of this is so hard for people to understand? It has been prosecuted in several states. How can you be prosecuted when you only use the radio for receive, you ask? Simple possession of the system key has been prosecuted in some cases, and unauthorized network/computer access has been prosecuted in others.

I skimmed most of the replies, but it should also be noted that there are a lot of system administrators that are active on this forum and many more that only read it. Nothing like posting your illegal intentions all over a public website for the whole world to see.

Please do us all a favor and just buy a scanner. I'm waiting for the first lawsuit filed because a rogue radio interfered or otherwise prohibits a legit trunked system user from communicating with dispatch or backup in a critical situation and gets injured or killed.

 

[EDACS_247]

I'm very surprised that no one here has spelled out the obvious method typically used for this very type of passive monitoring. Yes, you can monitor any trunked radio system P25, Type II, etc. without affiliating. It is commonly referred to as the hidden talkgroup method & works flawlessly. I've seen it referenced many times on RR, but surprisingly not in this thread. Basically, you program the 1st system/zone of your radio with all conventional channels. Then you program all of your trunked systems/zones in all systems/zones after zone 1. You remove the Zone Buttons from the menu so that you can't access those trunked systems/zones. You add the trunked talkgroups to the scanlist/s & apply that scanlist/s to the conventional channels you CAN access. The result is a radio that can Scan trunked talkgroups from a conventional channel, Unmute (on P25 or any other trunked system), & display Radio ID's while scanning, etc. The only downfall to this is that you are limited to scanning only 10 talkgroups & you don't have any control as to which talkgroup should take priority, but you can program a button for nuisance delete. That can help thin out the list when necessary. The only thing to be careful about is whether your scan list is programmed to transmit on the selected channel or the landed on scanned channel. Make sure you select to Tx on the selected channel, as it is conventional. If you can't access the trunked zones or transmit on a landed on scanned talkgroup, then the radio can NOT affiliate. It could not even tell the system what talkgroup it is on, because it isn't on any talkgroup, it is on a conventional channel.

I hope this helps educate those who would prefer to use a radio to monitor. This is the only "Fool Proof" RX only method I'm aware. Doing it this way you could hand the radio to a tech & ask him to make it transmit on the system, and without hooking it up to CPS he wouldn't be able to.

 

[kb0uxv]

Agreed that the above method does work without affiliation. But this method still involves hacking a system key. Think of this like getting access to someone's house key, making a copy without their knowledge, and entering their home with the copied key to look around without that person's knowledge. You could still be prosecuted for using this method, at least here under Minnesota law. Although it will not have the negative system affects as affiliated scan, you could still be breaking a criminal law. Its much safer to just buy a scanner – plus with a scanner you can make changes on the fly on the front panel. With your Motorola radio your tied to CPS and a PC, which I would think is a pain if you want to make a quick change.

 

[wa1emt]

Pull out the stick and breath.

Sure anything is possible. You could go rob a bank, that would be possible. But not legal, just like its not legal to put your unauthorized radio on a trunking system. Here it is a felony. If you are smart enough to hack a radio onto a trunking system and grab a ID that is working, you force the legal radio to slave to your radio. Now the police officer screaming for help on his law main is actually talking on whatever talkgroup you have your radio set to. You can get somone hurt, and you can bet when the admin sees a duplicate ID on the system they will start to track you down. If you have a working ID on a trunking system, at least a P25 system (I have no knowledge of other types of trunking systems), it is a legit user ID. IDs not created will not work. Don't be stupid, if you currently doing this on a P25 system you need to knock it off before you get someone hurt.

Some people are helpful and they have radios that do this. Others are not and they also have radios that do this. The funny part is this. Were all here to learn and if I can put a scanner on the system then I should be able to put commercial grade rugged radio on the system too. What?????...just becuse it has a transmit button....Oh dear lord..what will we do.
But what they dont tell you is how many times they have done this for their freinds and keep it hush hush.
I also am trying to program a radio for a trunked system WITH NO TX CAPABILITY so that I can listen to the disaster channels incase something happens and I work for a EMS company. THat way I can get info to the people that need it so that care and aid can be rendered faster.
So, for the people who are here trying to help...thank you so very much for being kind.
For the others that seem to spend their day wearing a helmet and licking windows...STFU...
Thank you.

 

[wa1emt]

Yes, the radio works and you receive audio. You are also right that your Motorola sounds far better than any scanner on the market. But if you have a radio ID in your trunking system, your radio is still affiliating with the system. I know its fun to program radios yourself and figure out how things work, but this is very dangerous when you don’t know about how the SYSTEM as a whole works.

For example:
My radio is #123 and I am affiliated with the system on LAW MAIN. The system knows this (from the control channel) and sends audio from this talkgroup to my radio.

You buy your own radio, hack the system key, and just pick some random ID number, which happens to be mine, #123. You affiliate with the system (even though you have voice TX disabled) and set your radio to FIRE TAC1. The system now sees radio #123 is set to FIRE TAC1 where it was previously on LAW MAIN (when my LEGAL radio was on). Now I start to hear your FIRE TAC1 traffic on my radio. Whats worse, I key up to call for help and now that audio is going out on FIRE TAC1. There is no dispatcher listening to this talkgroup. And you, with the hacked radio, don’t even realize this is going on.

See how dangerous this is?

Did he just have a micro seizure or does he really believe the stuff he is saying...WOW....

 

[mikewazowski]

Did he just have a micro seizure or does he really believe the stuff he is saying...WOW....

I don't see anything in his post that's incorrect.

The situation as he described has happened when an unauthorized radio managed to affiliate with the system.

Sure, it's possible to program up a radio for recieve only without affiliating but most people err on the side of caution and don't publically mention it.

Too many uneducated people out there who can't follow instructions and can cause some serious havoc.

 

[FFPM571]

I agree with Mr.Oxlong. The people who need to have the radios have them legit. There are reasons why that is way beyond the scanner buffs self imposed need to have a commercial grade radio that is unathorized on the system The EMT's ,Skywarn,REACT,CERT, Girls scouts,VFW or Knights of Columbus do not need for any reason. If the system admin wanted you on the system they would have issued your organizaton a radio with a legit ID.

BUY A SCANNER.

 

[jim202]

From a person who has been in the public safety and radio service field for over 45 years, this issue comes up frequently. Many people ask the same question on can I put a commercial radio on a trunking system and not transmit with it. The bottom line, like was said before, these radios were made to function on the trunking system and not made to be receivers only.

It is real hard to not allow a commercial radio on a trunking system to transmit. If it is a P25 system, there is no way to keep the transmitter from keying up when it hears the control channel. The P25 specs force the radio to affiliate on the P25 system. That is the way the radio firmware is programmed to function.

With that said, there are always ways to circumvent the radio design. The best way is to remove the power feed from the PA stage of the radio and do the same for the exciter. That way, there is no way for your radio to send a signal that the trunking system will hear. Problem doing this is that many radios obtain the control head power and receiver power from the PA stage of the radio. You have also just taken a very valuable radio and turned it into a pile of junk for the most part. Why go and get a trunking radio and almost have to cut the guts out of it.

Your way better off spending a whole lot less money and go buy a scanner. It will do the same thing. You won't have to find someone with the skill to cut up the commercial trunking radio trying to disable the transmitter in it. You won't have to bootleg the radio programming software to program the commercial radio. You won't have to bootleg a user ID on the trunking system. You won't have to figure out all the little in and outs of the trunking software for the system you want to listen to. You won't have the local cops giving you a hard time when they hear their traffic coming out of your radio.

 

[kb0uxv]

I don't see anything in his post that's incorrect.

The situation as he described has happened when an unauthorized radio managed to affiliate with the system.

Sure, it's possible to program up a radio for recieve only without affiliating but most people err on the side of caution and don't publically mention it.

Too many uneducated people out there who can't follow instructions and can cause some serious havoc.

wa1emt, I realize people will probably do as they please, I am just trying to educate so people know the risks before they put the radio on the system. I know Radio Reference is geared towards scanning, so I understand why some are hostile when told they can't or should'nt do something from a system aspect.

Like Mr. Oxlond stated, it does happen - by either an illegal radio or mistakes made by radio programmers (accidently using the same trunking ID in different radios when setting them up).

In fact, it happened to my mobile radio last year. I set up some codeplugs and I made a dumb mistake and had the default radio ID in the trunking system as my mobile radio ID (it should have been ID of 1 which is not valid for affiliation). One of the programmers read a portable radio and changed the radio alias name, but forgot to change the radio ID, and it defaulted to my mobile ID. The user with the portable with my mobile ID was listening to law main 2. I had my mobile set to law main 1. I would hear law main 2 audio while selected on law main 1 at various times, and sometimes when I transmitted the dispatcher told me I was on 2 when I was set on 1.

If you're with a local EMS company you are a legitimate user, I would suspect whoever runs your system would issue you a radio ID?

 

[b7spectra]

One thing that people also think is that all they have to do is put any old ID number in the radio and they are on line. Well, that is the problem. If you put in an ID that is already in use, the sys-admin will get notified that the ID has shown up twice and most likely, they will issue a INHIBIT command out and kill both of them. The one that is legit, they sys-admin will un-inhibit it and reassign them a new ID number. The rouge radio will become a doorstop unless they have Depot tools to clear it. Depot tools do exist, but you have a better chance of winning the $355m lotto than getting them. Sys-admins DON'T give them out.

I love having sources that let me know what is going on within various jurisdictions - in Metro Atlanta they (some of the DTRS operators) are searching for these rouge radio's and are ready to prosecute for theft of service.

GET A SCANNER & STAY OUT OF COURT!

 

[wa1emt]

I totally agree that it can happen. All I am saying is that I would bet that atleast 75% of the people on here have done it for "friends of theirs". And yes, I am a legit person, however, here in harris county, you'd have to go thru a congressional hearing to get a system id, which they probably wouldn't do anyway and then you would have to buy THEIR radios as you cannot own one on their system. They have to own it. So that kinda blows that out of the water.
And heres the funny thing. There is a guy somewhere in Spring texas that sells spectra's to ANYONE that are programmed up on the starnet system that do not auto affiliate. Wrecker drivers, taxis, etc,etc and they dont do crap about this guy. He is listed on houstons craigslist for all the world to see.

wrecker radio's complete county set

And you guys say get a scanner...well, the commercial stuff out performs any scanner and is also tough enough to be used everyday and not have to worry about breaking it. Thats the reason i want to go this route.
trust me, the criminals have and do listen to this system all day long...
The other reason I want to use commercial equipment is that it is cheaper to get then a $600 scanner with a $300 remote head for the purpose of putting in a truck as well as the difference between a $500 handheld scanner or a $100 ht radio.....

 

[ts548]

I totally agree that it can happen. All I am saying is that I would bet that atleast 75% of the people on here have done it for "friends of theirs". And yes, I am a legit person, however, here in harris county, you'd have to go thru a congressional hearing to get a system id, which they probably wouldn't do anyway and then you would have to buy THEIR radios as you cannot own one on their system. They have to own it. So that kinda blows that out of the water.
And heres the funny thing. There is a guy somewhere in Spring texas that sells spectra's to ANYONE that are programmed up on the starnet system that do not auto affiliate. Wrecker drivers, taxis, etc,etc and they dont do crap about this guy. He is listed on houstons craigslist for all the world to see.

wrecker radio's complete county set

And you guys say get a scanner...well, the commercial stuff out performs any scanner and is also tough enough to be used everyday and not have to worry about breaking it. Thats the reason i want to go this route.
trust me, the criminals have and do listen to this system all day long...
The other reason I want to use commercial equipment is that it is cheaper to get then a $600 scanner with a $300 remote head for the purpose of putting in a truck as well as the difference between a $500 handheld scanner or a $100 ht radio.....

And its the mentality of the above that is driving system admin's to encryption. Even if you get on the system you'll never hear the traffic. This page needs to be printed and taken to every public hearing about encryption.

 

[b7spectra]

I'm wondering about them. If Harris County is P25, those are analog radio's that he is selling as they are not listed as Astro.

I agree 100% that a Motorola or EFJ radio works 150% better than any scanner out there. It IS Harris County's system and if they do not want you to be on it, that is their right. If you do "hack" into their system, regardless if the radio can xmit or not, you have "hacked" into their network and you can be prosecuted if they catch you with it. 3 FF's in the Metro Atlanta area were "adding" channels to their FD radios so they could talk/monitor PD. When they had upgrades done to their radios, all sh*t hit the fan, the 3 FF's were prosecuted, fined and they lost their jobs. It' ain't worth it. I would love to have an XTS in my work truck so I could listen in all day, but I use my BC396XT.

 

[MTS2000des]

You mean THESE Walton county guys

Well according to him, his unauthorized programming of trunking radios cost him a career, a bunch of money, his family, etc:

http://forums.radioreference.com/ge...-anyone-can-program-my-radios.html#post729378

In our state, (GA) it is a computer trespass crime, not just a radio (FCC) issue. Everytime the radio powers up, changes talkgroups, or is polled, it affiliates. Affiliation attempts are viewed as computer access (hacking) attempts. Ask any jury when a modern Astro 25 zone controller is brought in and explained how it works (a database, security keys, passwords, etc) and it all spells out CONVICTION.

To my knowledge, no on was ever convicted of a crime for merely programming a SCANNER. Do the math. Putting radios on someone else's network without their permission and in a covert manner is a recipe for disaster.

The problem is many well meaning hobbyists who "just want to listen" have little knowledge of how these systems work, and how improper programming of subscriber radios, legit ID's or not, can create stability problems systemwide. Cloning radios can put the legit user in jeopardy, especially if the bootleg radio causes a flag in site lens and is disabled, if the legit user doesn't know his/her radio is also disabled. Imagine what could happen if a firefighter or PD officer's radio goes dead at the WORST time, all because someone wanted to play. Would you want that on your conscience?

Motorola (and other vendors) give classes on use of their tools for a reason. I just completed a course for Kenwood P25 programming, and I can tell you much goes on the system side that the wrong data in the wrong place CAN create problems. (I will say that Kenwood P25 programming platform is WAAAY MORE secure than Motorola is, and this is a GOOD THING for those with systems. Trust me when I say you will NEVER have a Kenwood P25 sub unit illegally programmed on your system!)

Get a scanner, program all you want. Listen to what you want. And don't fear any knocks on the door!

 

[wa1emt]

TS548 stated: "And its the mentality of the above that is driving system admin's to encryption. Even if you get on the system you'll never hear the traffic. This page needs to be printed and taken to every public hearing about encryption"

Dear sir, your so far in the wrong it isn't funny. Harris county has a apco 25 system and an analog system. With my scanner I hear everything. So technically I am on the system. But nonetheless I will leave your comment in the trash bin where it belongs as you obviously haven't been reading. The major fact is that the system is designed solely for public safety which begs to ask why the trashmen and school busses are on it..However, since they have adopted the rule that you have to pay to be on it..and even thats a miracle..they also want you to purchase the equipment but they will own it. Doesn't seem right now does it. And there funded.
Also, the entire reason I started this project up in the first place is to listen to the hospital disaster system so when there is a disaster the people that would be responding to it would have a faster response time instead of 1 or so hours. But we will just act like FEMA..Slow to respond with no satisfying results.

 

[wa1emt]

Oh and also just to inform everyone..I have abandoned the project. If they want help when they need it, they can figure it out. I found a scanner thats to my liking and Im going to go that route. Now if them and the naw-sayers here could just put the energy that has been put into this topic into finding illegals and deporting them we would be a free country.

 

[SCPD]

Wow...You are certifiable.

This thread should be closed...there is nothing of any value to be added.