Southernlinc IDEN

[James_Bond_007]

I had a thought. Is there such a thing as putting an IDEN southernlinc mobile into test mode to decode the audio in real time?

just a thought. i was remembering back to the old amps days when you could put an analog phone into test mode and receive audio.

for something like an ambulance service or municipal pd always operating on the same tower it may be a thought.

since southernlinc is really a trs operating on the 800 band with phone patch capabilities and they are only encrypted by virtue of using a format presently not supported in consumer scanning gear the argument could be that it is legal to listen to if you can get the proper receiving equipment.

i have read all the questions over the years and don't recall this specific idea ever coming up as a possible solution.

 

[AZScanner]

I had a thought. Is there such a thing as putting an IDEN southernlinc mobile into test mode to decode the audio in real time?

just a thought. i was remembering back to the old amps days when you could put an analog phone into test mode and receive audio.

for something like an ambulance service or municipal pd always operating on the same tower it may be a thought.

since southernlinc is really a trs operating on the 800 band with phone patch capabilities and they are only encrypted by virtue of using a format presently not supported in consumer scanning gear the argument could be that it is legal to listen to if you can get the proper receiving equipment.

i have read all the questions over the years and don't recall this specific idea ever coming up as a possible solution.

Perhaps a variant on this idea would work:
Digital Voice Conversion Method - The RadioReference Wiki

I think you'd need a fairly high end receiver though that can feed the IDEN radio a really WIDE signal, as I believe (could be wrong on this) that IDEN is spread-spectrum, meaning it uses a wide swath of bandwidth for several virtual "channels" that are interspersed throughout the frequencies used.

What would really be the bee's knees would be to have a hacked iDen blackberry or something you could put into a test mode and snoop around on whatever Direct Connect conversations came your way. That could be quite interesting considering that many local and federal agencies chat on Nextel's for things they don't want folks in scanner-land to know about. But I don't know if that's even possible.

The only sure fire way to do what you want is to get an IDEN service monitor. They're only about $15-20K or so....

-AZ

 

[James_Bond_007]

that would not work for iden. i think it is a 6 or 12 slot tdma or something along those lines. also to be completely legal would require sticking to the regular TRS bands and some how running the radio in a passive mode to prevent the radio from transmitting. the above idea probably would not work, but it was an idea i tossed out there. maybe someone with an iden mobile and some software knowledge will see this and get an idea.

 

[N_Jay]

Nope,. won't work.

1) iDEN is not spread spectrum, but it is TDMA and cellular in nature.
2) Messages are addressed to the unit or group, and not just sitting on the same slot all the time to grab with a simple receiver.
3) No, the units, even in "test mode" do not decode audio not targeted to them.

 

[James_Bond_007]

Nope,. won't work.

1) iDEN is not spread spectrum, but it is TDMA and cellular in nature.
2) Messages are addressed to the unit or group, and not just sitting on the same slot all the time to grab with a simple receiver.
3) No, the units, even in "test mode" do not decode audio not targeted to them.

kind of what i figured.

 

[James_Bond_007]

found this brochure. well out of hobbyist range...

http://www.gdsatcom.com/CTE/datasheets/R2660_5-06v2.pdf

 

[N_Jay]

I don't think an R2660 will monitor an active voice channel.

It will tell you want is on a slot and who it is assigned to.

 

[AZScanner]

I don't think an R2660 will monitor an active voice channel.

It will tell you want is on a slot and who it is assigned to.

Actually, in the brochure they seem to indicate that it can.

Radio-compatible vocoder in both the generate and receive modes allows actual voice testing. You can verify radio performance under actual voice conditions, providing you with absolute confidence in overall radio performance.

Either way, it's rather moot unless you just won the lottery or are otherwise wealthy enough to buy one of these.

-AZ

 

[James_Bond_007]

judging by some of the stuff i have seen in the for sale section and the pic's of your shack section over the years i think we just may have a few people here who may just have the dough to plunk 15k plus on a receiver or piece of test equipment.

 

[N_Jay]

Actually, in the brochure they seem to indicate that it can.

Yes, it can receive calls (emulating a subscriber unit), and it can generate calls (emulating a base site), but intercepting a call is a WHOLE different issue.

Either way, it's rather moot unless you just won the lottery or are otherwise wealthy enough to buy one of these.

-AZ

Nah, you just call a friend either at a shop that supports a iDEN system or at GD and ask to borrow one.

 

[N_Jay]

judging by some of the stuff i have seen in the for sale section and the pic's of your shack section over the years i think we just may have a few people here who may just have the dough to plunk 15k plus on a receiver or piece of test equipment.

If you get it for 15K I would worry about just how bad condition it is in.

I think the R2600 is $20 K to $30 K, and the iden option is probably another $15 K to $20 K

 

[WayneH]

I don't think an R2660 will monitor an active voice channel.

Correct. I used to use one and it could not demodulate voice. The iDEN package allows for simulating the iDEN transmission in to the base station equipment for testing and turn-up.

Nothing we had could do OTA demodulating. When we need to listen to specific mobiles or whatever we'd route the call to a monitor-only phone in the switching office. Maybe LE has stuff available to them but we never bought it.

 

[N_Jay]

LE gets their connection at the switch if they need it.

 

[WayneH]

LE gets their connection at the switch if they need it.

Correct via the whole CALEA thing.

I'm trying not to say the technology isn't out there so someone, such as yourself, doesn't come along and correct me.

 

[N_Jay]

I am not saying that the "technology" is not out there, just that is not really any good driver to create such technology.

LE gets what it wants from the switch.

Any off the air technology would only work in the same cell as the unit, and would probably need to actually be in the same cell when the unit is first turned on and stay in the same cell as the unit through out the monitoring process to stay up with TMSI updates.
Mobility management - Wikipedia, the free encyclopedia
So you would have to do a lot of work for a low chance of success when the group with the greatest need is already satisfied. (Hence, I doubt anyone has developed anything).

If it existed (even in 1.0 barley working form) don't you think someone would have posted something?
Look at the recent P25 Vocoder posting.
How easy or hard was that in comparison?

 

[KA1RBI]

Here's a page with some more info about demodulating iDEN

iDEN-USRP (not sure why the pages aren't loading properly, it's necessary to click "yes" to the popup that appears (at least in firefox)..

Also, I have some complex captures of iDEN as well as some sorta-working software, as a proof-of-concept, which gets as far as demodulating it. Decoding still not there as of now... (if anyone is interested)...

Max

 

[RadioDSPjunkie]

Possibility of decoding and monitoring iDEN

Max, thank you for sharing the info. That looks like the beginning of Layer 1 (Physical) demodulation process for iDEN networks at the 800MHz freqs. Evidently, there are many more steps to do like interleaving, forward error correction, slot descriptor blocks (like GSM and CDMA), layer 2 (data), and layer 3(network) messaging protocols. We have not even talked about the proprietary DVSI AMBE and Moto's VSELP mods.

James_Bond_007 brought up an interesting point on the possibility of a test mode. Long ago, through experimentation, I have seen GSM handsets cloned. However, you have to know the IMSI, TMSI and Ki information in order to the decipher the stream cipher. For the iDEN, you probably need the PTT or Dispatch ID. This could be possible also in iDEN since it has borrowed some GSM standards based on the available info on the net (if it is accurate).

Overall, based on my technical experience, it is possible but considerably lots of effort.
Maybe, just maybe, it could be done someday on a small software-defined radio platform plugged into a PC.