Rogue Capacity Plus System?

[mwjones]

While I was out this weekend, I was waiting on someone in the Grandscape development in the The Colony. I had looked up in RRDB and the FCC licenses to see what is out there (someone's already identified Nebraska Furniture Mart, but I found licenses for Grandscape's developers, which through a previous visit I have identified a Capacity Plus system in use (will be posting to RRDB soon, just trying to finalize a couple of details) as well as for Scheels Sports (all simplex, no repeaters, boo), and the subject of this thread, Andretti Indoor Karting and Games.

The License, WRFF845, for Andretti Indoor Karting shows 5 frequencies, and they are simplex only, with a Narrow FM or DMR usage. I plugged those frequencies into my SDS100 and all of a sudden it lit up with activity (mostly, if not all encrypted), but also a Capacity Plus Rest Channel.

So after giving the person I was waiting on a ride, I went back home and grabbed my laptop and SDR radios, and figured I'd let DSD Plus have a go at it. Here's what I was able to find:

• Capacity Plus system, "Site 1", there are also "Site 2", "Site 3", and "Site 4" as neighbors.
• LCN 1-5 are in use, LCN 2 is 451.5875, LCN 4 is 451.6875, other 3 are unknown.
• 39 unique talk groups detected in an hour of monitoring, the ones that hit the known LCN channels were encrypted.
• 156 Unique radio ID's (a lot more than the licensed 60)

So, here we have this system that is not licensed (even as a conventional/repeater) and is likely using frequencies not licensed for the location. I've found similar licenses for San Antonio (WRCI513) and Katy (WREZ647), as well as their Georgia and Florida sites, all of which have similar simplex licenses, so that may be the neighbors.

Any thoughts? And has anybody looked at the San Antonio or Katy sites to see if the rogue system shows up there as well?

 

[hiegtx]

While I was out this weekend, I was waiting on someone in the Grandscape development in the The Colony. I had looked up in RRDB and the FCC licenses to see what is out there (someone's already identified Nebraska Furniture Mart, but I found licenses for Grandscape's developers, which through a previous visit I have identified a Capacity Plus system in use (will be posting to RRDB soon, just trying to finalize a couple of details) as well as for Scheels Sports (all simplex, no repeaters, boo), and the subject of this thread, Andretti Indoor Karting and Games.

The License, WRFF845, for Andretti Indoor Karting shows 5 frequencies, and they are simplex only, with a Narrow FM or DMR usage. I plugged those frequencies into my SDS100 and all of a sudden it lit up with activity (mostly, if not all encrypted), but also a Capacity Plus Rest Channel.

So after giving the person I was waiting on a ride, I went back home and grabbed my laptop and SDR radios, and figured I'd let DSD Plus have a go at it. Here's what I was able to find:

• Capacity Plus system, "Site 1", there are also "Site 2", "Site 3", and "Site 4" as neighbors.
• LCN 1-5 are in use, LCN 2 is 451.5875, LCN 4 is 451.6875, other 3 are unknown.
• 39 unique talk groups detected in an hour of monitoring, the ones that hit the known LCN channels were encrypted.
• 156 Unique radio ID's (a lot more than the licensed 60)

So, here we have this system that is not licensed (even as a conventional/repeater) and is likely using frequencies not licensed for the location. I've found similar licenses for San Antonio (WRCI513) and Katy (WREZ647), as well as their Georgia and Florida sites, all of which have similar simplex licenses, so that may be the neighbors.

Any thoughts? And has anybody looked at the San Antonio or Katy sites to see if the rogue system shows up there as well?

Are you seeing Color Code 7?

 

[mwjones]

Are you seeing Color Code 7?

The SRT Log didn't log anything during that time, but the VC log looks like it was Color Code 10, but I will go back in that area this weekend and try to verify (Grandscape/West Legacy is rich in Trunked systems)

 

[hiegtx]

The SRT Log didn't log anything during that time, but the VC log looks like it was Color Code 10, but I will go back in that area this weekend and try to verify (Grandscape/West Legacy is rich in Trunked systems)

Look at this license:

FCC Callsign WPPY432 (American Airlines Group, Inc.)

FCC Callsign WPPY432 (American Airlines Group, Inc.)

www.radioreference.com

That's licensed for a DMR system for American Airlines, Terminal D, at DFW Airport.

Probably six months, or more, ago, I was going through licenses in use around the airport area. There are several that are not in the database. This one was encrypted, but if I entered it correctly, at that time I was seeing the Color Code as 7. I was using my TRX-1 to search for these various systems, but never had the time to sit out there long enough for the LCN Finder on my SDS100, or 436HP, to map it out.

The color could have changed since then, or maybe I was looking at the wrong system for the code.

AA also has other trunked licenses:

FCC Callsign WRCI238 (AMERICAN AIRLINES GROUP INC)

FCC Callsign WRCI238 (AMERICAN AIRLINES GROUP INC)

www.radioreference.com

That shows bases at the terminal as well as one of their hangers on the northwest side of the airport.

FCC Callsign WRCA698 (AMERICAN AIRLINES GROUP INC)

FCC Callsign WRCA698 (AMERICAN AIRLINES GROUP INC)

www.radioreference.com

I'm well out of range at home. I do occasionally visit a friend in Grapevine, but I have not had the free time to park over at Founders Plaza for a long enough time to fill in some blanks.

 

[mwjones]

That last license does have both frequencies, so it is plausible, although I seem to recall the signal strength was quite strong, and not a signal from a 50 Watt site 16+ miles Line of Sight (and my SDS100 was with a rubber duck, not a vehicle mounted antenna) - Of course I could be wrong, my SDR's was picking up Medical Center Denton's 100 Watt Capacity Plus repeater, 23 1/2 miles away on the vehicle mounted antenna at Coit and Plano Parkway, eschewing another system I was trying to identify (Dallas Morning News Plano Production Plant).

When I revisit the site, I'll try and rule out distant signals, using a tried and true method (SDS100, no antenna - only very strong signals will reach the inputs - worked like a champ on the TeamConnect sites that I recently updated).

DFW Airport was on my list of areas with a number of DMR sites, but I was kinda waiting until we get back to "normal", since I normally work at Cypress Waters (Beltline and 635), and could set up a mobile base to log and record during the day while I'm in the office, and I've got plenty of others to work on in the meantime (That said, when investigating the status of the Baylor NXDN network last week, I did dial up ARINC's Motorola system, and it is still on the air - old habits die hard, I used to deal with ARINC at a couple of other airports, and their iDEN Harmony system looks to mostly be gone from those locations) .

 

[hiegtx]

That last license does have both frequencies, so it is plausible, although I seem to recall the signal strength was quite strong, and not a signal from a 50 Watt site 16+ miles Line of Sight (and my SDS100 was with a rubber duck, not a vehicle mounted antenna) - Of course I could be wrong, my SDR's was picking up Medical Center Denton's 100 Watt Capacity Plus repeater, 23 1/2 miles away on the vehicle mounted antenna at Coit and Plano Parkway, eschewing another system I was trying to identify (Dallas Morning News Plano Production Plant).

When I revisit the site, I'll try and rule out distant signals, using a tried and true method (SDS100, no antenna - only very strong signals will reach the inputs - worked like a champ on the TeamConnect sites that I recently updated).

DFW Airport was on my list of areas with a number of DMR sites, but I was kinda waiting until we get back to "normal", since I normally work at Cypress Waters (Beltline and 635), and could set up a mobile base to log and record during the day while I'm in the office, and I've got plenty of others to work on in the meantime (That said, when investigating the status of the Baylor NXDN network last week, I did dial up ARINC's Motorola system, and it is still on the air - old habits die hard, I used to deal with ARINC at a couple of other airports, and their iDEN Harmony system looks to mostly be gone from those locations) .

The thing that shoots us in the foot at times, in trying to identify the user on a DMR system is this:
Take just about any of the Uhf frequencies on the licenses we've ween talking about, and do a license search. Either for a specific county (like Dallas, Collin, or Tarrant), or use the license search for the frequency on the main Texas database page, which will show you all users, all counties, in the state licensed for that frequency, For 451.5875, I see a half dozen different licensees in Collin County, around a dozen in Dallas County, about that many in Tarrant, and three in Denton. Granted a number of those are likely just used simplex, or not currently in use. You would not the signal to carry very far (if simplex), but that's still a lot of users, even if you qualify it and say that a fair percentage of them might not use DMR.

When I first got the DMR upgrade, on my 536HP, I programmed in the licensed frequencies for the Southwest Airlines DMR system at Love Field. (There are more frequencies licensed than show on Southwest's trunked system.) I'm probably 7 or 8 miles from Love. No reception on the 536, even though at that time, it was connected to a rooftop antenna. But, I was getting hits on one of the frequencies that were from a different DMR trunked system. Turns out that I was hearing a DMR system used at the Kohl's fulfillment warehouse in Desoto, which is about 7 or so miles south of my location.

 

[mwjones]

The thing that shoots us in the foot at times, in trying to identify the user on a DMR system is this:
Take just about any of the Uhf frequencies on the licenses we've ween talking about, and do a license search. Either for a specific county (like Dallas, Collin, or Tarrant), or use the license search for the frequency on the main Texas database page, which will show you all users, all counties, in the state licensed for that frequency, For 451.5875, I see a half dozen different licensees in Collin County, around a dozen in Dallas County, about that many in Tarrant, and three in Denton. Granted a number of those are likely just used simplex, or not currently in use. You would not the signal to carry very far (if simplex), but that's still a lot of users, even if you qualify it and say that a fair percentage of them might not use DMR.

When I first got the DMR upgrade, on my 536HP, I programmed in the licensed frequencies for the Southwest Airlines DMR system at Love Field. (There are more frequencies licensed than show on Southwest's trunked system.) I'm probably 7 or 8 miles from Love. No reception on the 536, even though at that time, it was connected to a rooftop antenna. But, I was getting hits on one of the frequencies that were from a different DMR trunked system. Turns out that I was hearing a DMR system used at the Kohl's fulfillment warehouse in Desoto, which is about 7 or so miles south of my location.

Problems I know all too well. Take Grandscape for instance. In my initial survey of their 2-channel trunked system, I got both LCN's, and determined the color code is 12. I then set about to capture talkgroups, and have one somewhat positive identified, but when I tried recently with the SDRs and Laptop, I kept picking up another system with Color Code 6 and the same LCN for one of the two channels, so the rest channel was flipping back and forth like somebody keying Morse code. My next visit to the site will involve disconnecting the vehicle mounted antenna, and just picking up a signal off the open connectors.

I also had a similar problem at the Galleria, but was able to quickly sort it out (at one point it was acting like it was a multi-site system, and you saw that I got the update for that system published Sunday, although there's more talkgroups to go).

Texas Heath Frisco and Medical City Frisco were some easy ones, as I could do all the work with my SDS200 sitting at home. Toyota Headquarters Connect Plus is a work in progress (on pause with the testing of the new Collin County system), for the same reason, since I can pick them up even though I'm 7+ miles away (Toyota, like your Southwest example, is using only 3 of 5 licensed frequencies from what I can tell).

 

[musicman476]

What I've found from monitoring the Toyota system in the past was only one TG in use (4301001). It's been a bit since I've monitored them, though.

When I mapped out the NXDN System at the Star in Frisco, I noticed that not all their licensed frequencies are in use, either.

 

[mwjones]

What I've found from monitoring the Toyota system in the past was only one TG in use (4301001). It's been a bit since I've monitored them, though.

When I mapped out the NXDN System at the Star in Frisco, I noticed that not all their licensed frequencies are in use, either.

4301001 is the busiest of the talkgroups on Toyata (Security). There were a few others I've heard (I seem to recall hearing a mailroom talkgroup at one point), but don't have recordings or logs of. I can monitor the system from my Frisco home, so I probably need to put one of my radios to work on getting some recordings and logs (but traffic may be down since many employees are likely still working from home).

I have decided to release the information on Toyota (and Grandscape) to the RRDB admins, and will get that off later tonight (which as long as it doesn't get stuck like my current request to add some talkgroups on the NCTCOG system should be up in a few days).

As far as the Rogue system, your idea it may be American Airlines holds more water today. I picked up the same Encrypted system again, using a Color Code of 7, the RSSI went anywhere from -60 to -101 on the SDS100 with a rubber duck, so judging range was a serious PITA. Since the temperature was a little less hot, I ventured out for 30 minutes with my SDS100, and set just outside the front door of Andretti with the SDS set to record all communications. On top of the aforementioned Encrypted system, I was also getting some communications on Color Codes 3 and 8, which hold more reliability (one was talking about pinball machines, another about a Go-Cart being broke down). Still not enough to submit data to RRDB, and it may have to wait until we start getting back to a normal (I didn't feel like going through the hassles of going inside in the current environment, plus carrying my SDS100 might have raised some eyebrows).

 

[jason51]

Sounds like you are hearing the AA system. That is the only one I know of that is encrypted, and I can hear it well west of the airport.
Dont let the LCN’s fool you. There are a few cap+ systems in the DFW area that are only one channel, and the LCN is not 1.