Rapidly scanning DMR channels in promiscuous mode

[footage]

I often "take the pulse" of a place by scanning analog VHF and UHF low-power business frequencies. With the mass migration to DMR, I'd like to load several hundred frequencies between 450-470 MHz and scan them in promiscuous mode to broadly survey specific spectrum usage.

If you were me, would you load freqs into a Uniden DMR-provisioned scanner, or would you set up an SDR? Has anyone done the latter, and if so, what SDR and software did you use?

I am aware my Anytone can do this, but it scans very slowly.

I would be grateful for any thoughts.

 

[sonm10]

I usually go target hunting. I usually look through the fcc database listings for anything that looks interesting, and scan those frequencies. I have used both the scanner method and SDR method together. Usually, I'll scan a list of frequencies for an activity, analog or digital. Once I confirm digital, I will park DSD+ fast lane to collect color codes, talk groups, etc. DSD+ has a scanner plugin to s an frequencies also.

I live in a rural area, so a lot of farmers and schools use DMR.

Don't forget about NXDN too. Not quite as popular as DMR, but does get quite a bit of use around here to.

 

[BinaryMode]

I'm about to do this very thing with an SDR and HOPEFULLY with SDR#'s Frequency Manager. What I intend to do is either use Notepad++ or some script that will take the band of the low frequency, say 450 and the upper frequency, say 470, and spit out all the possible frequencies using the correct step. I think DMR's bandwidth is narrow band so 12.5 kHz? Then you take that mass of text (and there will be several hundred lines of frequencies) and copy/paste that to the frequency manager file in SDR#.

Again, I'm not too sure if this will work and it's something I've been meaning to try. The obvious awesomesauce benefit here is that an SDR can scan through all those individual frequencies in a matter of seconds. LOL! And you don't have to limit yourself to any band, either. Air, military, Ham? I came up with this idea from the dilemma that you can't really use an SDR as a traditional scanner since the noise flow changes all the time and the SDR keeps (annoyingly) stopping on static. But by scanning all possible frequencies at once you can lookout birdies, harmonics and whatnot as you scan through all the list of frequencies while at the same time keep your squelch above that band's noise floor.

I also came up with this idea when I needed a whole boat load of IP addresses from a CIDR (Classless Interdomain Routing (for reasons)) and found a website to do just that. So I figured why not frequencies too!


You wanna hear a "cool story, Bro?" Speaking of CIDRs, I block over 400 ASNs at the Cloudflare level for a website I run. ASNs are freaking groups of CIDRs... and CIDRs and groups of IP addresses. These ASNs belong to cloud providers and other junk... Like Digital Ocean, Vultr, Linode, etc.

Anyway... The SDR route would be the best in terms of "promiscuous mode" since you can scan through a whole band in short order. A netbook would come in handy for this. I used a Dell Mini 910. It worked great with SDR#. Of course a headless Pi via VNC and Android could suffice as well... LOL!

Edit-

The close call feature of Uniden scanners works great for this, too. You just have to make sure that when you're in search mode you're not also searching for CTCSS/DCS or NAC codes. You can keep RAN/CC on for DMR/NXDN, but any others and when the scanner stops on a digital DMR/NXDN transmission you won't hear anything in terms of DMR/NXDN.

 

[footage]

I asked ChatGPT to make me a list of all frequencies in ranges I selected that were likely to be used by DMR in large cities. At first it responded by telling me that some of these frequencies were in ranges unauthorized for transmission and that the FCC regulated transmissions in the US. I responded back, telling the bot that this query was not about transmitting, and it gave me a list. I imported the list into Sentinel and began scanning.

The results have been a little surprising. I hear much less than I expected in the RF-dense environment of the SF Bay Area. Of course the scan stops on control channels, and there are many transmissions that seem to be encrypted, but much of the time it seems as if the BCD436 is not properly decoding DMR transmissions. Some of this may be due to late entry during an ongoing transmissions, but I think there are other reasons that so far remain unclear. Maybe I'll try DSD+ next. But it is easier to travel with handheld scanners than SDRs.

 

[serial14]

"take the pulse"... I like it. I do that too.

I utilize the Custom Band search feature on all of my uniden scanners for this sort of task. By default, they have a custom band scan set for UHF business I think its number 6 or 7. Turn that on and see what you find. I typically find with the first couple of passes I can easily lock out noise sources and obvious things I'm not interested in. After that its a continual scan and listen sort of deal. On my 436HP and SDS I leverage the record feature and just let the radio be and come back to it later. When playing back the recordings, the scanner will show you all the information about the signal.

You specifically mention DMR. There is a growing amount of DMR activity in my area and areas that I travel to, so having the DMR license key has been worth while. My 996p2, 436HP, and SDS200 have all successfully scanned & picked up DMR in the custom search mode. Meaning, I didn't have to have pre-knowledge of what frequencies or what DMR parameters( CC, TGID, etc ) were being used.

 

[Ubbe]

If you were me, would you load freqs into a Uniden DMR-provisioned scanner, or would you set up an SDR? Has anyone done the latter, and if so, what SDR and software did you use?

SDR receivers has too many false signals and usually bad overall receiver performance. I use a BCD536 and program lists with the frequencies channel by channel, as search only allows 255 frequencies to be avoided. I monitor all valid frequencies, split up in different departments for different frequency blocks, and avoid known active frequencies to find any unknowns. I use a -10sec delay to only sample 10 sec of a signal and record and later study all recordings in UniversalScannerAudioPlayer.

If you only want to check how much transmission there are in an area then the normal search bands should work if you set a -5 sec delay to catch the signalling type before it continues its search. If you set a scanner to record everything you can then look thru the logs how much activity and what signalling type are used over a certain time span. If you can do one search range at a time then some scanners have conventional discovery that will automatically log the number of hits of a frequency, and record its audio if you want that, and if the same frequency are hit several times it will automatically stop recording and only log the number of hits.

/Ubbe

 

[kd4das]

This can work very well with an Airspy or RTL-SDR using SDR# with the FreqMan and Frequency Scanner plugins. Set the proper search bands in the 450 and 460 MHz ranges and either use the SimpleDMR plugin or, if you're really feeling adventurous, use a virtual audio cable and pipe it to DSD+. Using DSD+ allows for decoding both DMR and NXDN transmissions. You can either lockout the control/carrier signals or there's a setting in Frequency Scanner to skip transmissions that don't have voice. That requires using the DSD+ setup, though.

 

[BinaryMode]

This can work very well with an Airspy or RTL-SDR using SDR# with the FreqMan and Frequency Scanner plugins. Set the proper search bands in the 450 and 460 MHz ranges and either use the SimpleDMR plugin or, if you're really feeling adventurous, use a virtual audio cable and pipe it to DSD+. Using DSD+ allows for decoding both DMR and NXDN transmissions. You can either lockout the control/carrier signals or there's a setting in Frequency Scanner to skip transmissions that don't have voice. That requires using the DSD+ setup, though.

The problem I have using that method myself is the constant hits due to a changing noise floor or the scan never stops on a hit.

The idea I have here is to program all possible frequencies via the 12.5 kHz or 6.25 kHz spacing using the FMSuite.DataTools.exe program. Then hopefully (not sure) I'll have a better scanning experience. I can't describe it, it's just how the SDR works. My thinking is if it just scanned one frequency at a time it'd be different. This is all in theory though. I have yet to try it. Data Tools Wizard User's Guide

Although, I'm having an issue with the BS .Net dependency. I HATE code that requires dependencies! It can not only be problematic, but introduces yet more holes in an OS...

 

[BinaryMode]

...but much of the time it seems as if the BCD436 is not properly decoding DMR transmissions. Some of this may be due to late entry during an ongoing transmissions, but I think there are other reasons that so far remain unclear. Maybe I'll try DSD+ next. But it is easier to travel with handheld scanners than SDRs.

This has been my issue too. Don't you just love digital fancy pancy crap?

I think the issue is the "tuning decode" ability in the scanner. Like P25, you go into "that mode" in the scanner and sit on a voice channel for a good five minutes and watch the decode rate. Then manually change the decode rate to match the tower/s as closely as possible. It's different for everyone. Even though some same 8 is what they use (which I think is the default). In my case for P25 I have to use 11.

Having said that, it's probably the same crap for DMR/NXDN. i.e having to "tune" the decode rate. Refer to your manual.

I once tried to use ChatGPT, but they wanted a phone number. I said forgetaboutit. So you can link all my queries to a phone number? I don't think so... Others want an account, i.e your e-mail. Nope^10.

You may be interested in this website: Digital Frequency Search Chose DMR or NXDN at the top. All results are straight for the ULS...

 

[kd4das]

The problem I have using that method myself is the constant hits due to a changing noise floor or the scan never stops on a hit.

The idea I have here is to program all possible frequencies via the 12.5 kHz or 6.25 kHz spacing using the FMSuite.DataTools.exe program. Then hopefully (not sure) I'll have a better scanning experience. I can't describe it, it's just how the SDR works. My thinking is if it just scanned one frequency at a time it'd be different. This is all in theory though. I have yet to try it. Data Tools Wizard User's Guide

Although, I'm having an issue with the BS .Net dependency. I HATE code that requires dependencies! It can not only be problematic, but introduces yet more holes in an OS...

Are you using the frequency manager and scanner linked from here? 2.56 MB folder on MEGA. I have not encountered those issues using these plugins. You do have to adjust the yellow and red squelch and signal retention lines to get it lined up with how a non-SDR scanner would work.

 

[dave3825]

The idea I have here is to program all possible frequencies via the 12.5 kHz or 6.25 kHz spacing using the FMSuite.DataTools.exe program. Then hopefully (not sure) I'll have a better scanning experience.

If your using the correct plugin you program the range, like 450 to 460, or 450 to 454.995, eliminating inputs, and then set the step size like 12.500

The problem I have using that method myself is the constant hits due to a changing noise floor or the scan never stops on a hit.

I have not encountered those issues using these plugins. You do have to adjust the yellow and red squelch and signal retention lines to get it lined up with how a non-SDR scanner would work.

I scan air 118 to 130, uhf 450 to 455, 460 to 465, 7/800 etc, all in one scan with the noise floor all over the place. Like @kd4das says, adjust the settings on the plug in.

 

[ecps92]

If your using the correct plugin you program the range, like 450 to 460, or 450 to 454.995, eliminating inputs, and then set the step size like 12.500






I scan air 118 to 130, uhf 450 to 455, 460 to 465, 7/800 etc, all in one scan with the noise floor all over the place. Like @kd4das says, adjust the settings on the plug in.

I'd urge not to avoid the inputs - but put them in a different search, as (IMHO) I have found many a simplex user on what could be considered/called/defined as an input frequency

 

[BinaryMode]

Are you using the frequency manager and scanner linked from here? 2.56 MB folder on MEGA. I have not encountered those issues using these plugins. You do have to adjust the yellow and red squelch and signal retention lines to get it lined up with how a non-SDR scanner would work.

I have the community plug-in package. Scroll down to the bottom here: SDR# and Airspy Downloads - airspy.com

 

[BinaryMode]

I'm about to do this very thing with an SDR and HOPEFULLY with SDR#'s Frequency Manager. What I intend to do is either use Notepad++ or some script that will take the band of the low frequency, say 450 and the upper frequency, say 470, and spit out all the possible frequencies using the correct step. I think DMR's bandwidth is narrow band so 12.5 kHz? Then you take that mass of text (and there will be several hundred lines of frequencies) and copy/paste that to the frequency manager file in SDR#.

And here's the code to do just that. It's a PHP script with an HTML form so you either need to A) run this on a web server with PHP installed, B) install PHP in your OS, or C) install something like XAMPP and run it that way since XAMPP has PHP built-in. (Highly recommend XAMPP by the way)...

<!DOCTYPE html>
<html>
<head>
    <title>Frequency Generator</title>
</head>
<body>
<form method="post">
    Start Frequency: <input type="number" name="start" step="any" required><br>
    End Frequency:   <input type="number" name="end" step="any" required><br>
    Step Size beginning with decimal i.e .0125 for a 12.5 step size or .0625 for 6.25: <input type="number" name="step" step="any" required><br>
    <input type="submit" value="Generate">
</form>

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    // Retrieve input values
    $start = isset($_POST["start"]) ? floatval($_POST["start"]) : 0;
    $end = isset($_POST["end"]) ? floatval($_POST["end"]) : 0;
    $step = isset($_POST["step"]) ? floatval($_POST["step"]) : 0;

    // Validate input
    if ($step == 0) {
        echo "Step value cannot be zero!";
    } elseif ($end < $start) {
        echo "End value must be greater than start value!";
    } else {
        // Generate sequence of numbers
        $current = $start;
        while ($current <= $end) {
            echo number_format($current, 4) . "<br>"; // Output each number
            $current += $step;
        }
    }
}
?>
</html>
</body>

Save in a text editor with the file extension .php

While I'd like to take credit for this script, it was actually with the awesome help of ChatGPT this code came about. LOL! (Sucker is fantastic)! Took a few times to get it right though as ChatGPT kept back slashing (escaping out (/) certain code. But in the end I got it right.

I then massaged the mass of frequency data in Notepad++ with regex to important into the FMSuite.Data.db database file with FMSuite.DataTools (real PITA with the .Net dependencies) It seems to work. Note the word "seems" is the operative. I'm going to post a thread in the SDR subforum...

So there you have it. Once the range of 450 MHz to 470 MHz is outputted in 12.5 kHz steps and imported into the database then a Pi or netbook can be used... Is it redundant scanning all possible channels versus that of just scanning the band in 12.5 kHz steps? Perhaps. But the cool thing here is that you can mix and match frequencies if you want. So say all of aviation and 450 to 470 or something into one group... The better the bandwidth of the SDR the faster it'll scan through all the channels. Tip: You can open the FMSuite.Data.db file with the program "DB Browser for SQLite."

 

[BinaryMode]

I asked ChatGPT to make me a list of all frequencies in ranges I selected that were likely to be used by DMR in large cities. At first it responded by telling me that some of these frequencies were in ranges unauthorized for transmission and that the FCC regulated transmissions in the US. I responded back, telling the bot that this query was not about transmitting, and it gave me a list. I imported the list into Sentinel and began scanning.

The results have been a little surprising. I hear much less than I expected in the RF-dense environment of the SF Bay Area. Of course the scan stops on control channels, and there are many transmissions that seem to be encrypted, but much of the time it seems as if the BCD436 is not properly decoding DMR transmissions. Some of this may be due to late entry during an ongoing transmissions, but I think there are other reasons that so far remain unclear. Maybe I'll try DSD+ next. But it is easier to travel with handheld scanners than SDRs.

From the horse's ULS mouth... Digital Frequency Search (Chose DMR or NXDN, etc at the top)...

I had asked ChatGPT if it had access to the FCC database and said in a nutshell nope.

 

[rcool101]

Am I the only one to Google "promiscuous mode". I get that way sometimes
Sorry. Never heard that term in radio

​

 

[BinaryMode]

It's a term typically used in Wi-Fi...

 

[Harold]

Just get a Whistler TRX1 or TRX 2 and use the Spectrum Sweeper mode.