• To anyone looking to acquire commercial radio programming software:

    Please do not make requests for copies of radio programming software which is sold (or was sold) by the manufacturer for any monetary value. All requests will be deleted and a forum infraction issued. Making a request such as this is attempting to engage in software piracy and this forum cannot be involved or associated with this activity. The same goes for any private transaction via Private Message. Even if you attempt to engage in this activity in PM's we will still enforce the forum rules. Your PM's are not private and the administration has the right to read them if there's a hint to criminal activity.

    If you are having trouble legally obtaining software please state so. We do not want any hurt feelings when your vague post is mistaken for a free request. It is YOUR responsibility to properly word your request.

    To obtain Motorola software see the Sticky in the Motorola forum.

    The various other vendors often permit their dealers to sell the software online (i.e., Kenwood). Please use Google or some other search engine to find a dealer that sells the software. Typically each series or individual radio requires its own software package. Often the Kenwood software is less than $100 so don't be a cheapskate; just purchase it.

    For M/A Com/Harris/GE, etc: there are two software packages that program all current and past radios. One package is for conventional programming and the other for trunked programming. The trunked package is in upwards of $2,500. The conventional package is more reasonable though is still several hundred dollars. The benefit is you do not need multiple versions for each radio (unlike Motorola).

    This is a large and very visible forum. We cannot jeopardize the ability to provide the RadioReference services by allowing this activity to occur. Please respect this.

Target Digital Radios

n1das

Member
Premium Subscriber
Joined
Feb 17, 2003
Messages
1,598
Location
Nashua, NH
What alcahuete said.

The DTRs and the DLRs are spinoffs from the Direct Talk feature. The legacy DTR 410/550/650 models shared a common design with a NEXTEL iDEN phone when the phone and the DTRs were first developed. The DTRs and the DLRs use the same FHSS digital protocol but were coded differently from the DT feature in the phones to be incompatible, supposedly on purpose. I don't know the reason(s) why but I suspect the DTRs and DLRs became incompatible with the DT feature in the iDEN phones when more features were added to the DTRs and later DLRs. Marketing might also have had their fingers in it too.

The DT feature in the iDEN phones and the DTRs and DLRs are all based on the MOTO Talk platform. The DT feature in the iDEN phones was an early implementation of MOTO Talk. The latest implementation of MOTO Talk are the DTR600/700 models and the DLR1020/1060 models.

 
Last edited:

HavenBTS

Member
Premium Subscriber
Joined
May 18, 2020
Messages
139
Location
Atlantic City, NJ
Great information all! Thank you!

The reason I asked is because I am looking for the most inexpensive way for a property management team to connect on site. I can get 2 Motorola i335's for $45. About as much as cheap bubble pack frs but this is digital and would work quite well I think! $90 for 4. I like it.
 
Last edited:

n1das

Member
Premium Subscriber
Joined
Feb 17, 2003
Messages
1,598
Location
Nashua, NH
Great information all! Thank you!

The reason I asked is because I am looking for the most inexpensive way for a property management team to connect on site. I can get 2 Motorola i335's for $45. About as much as cheap bubble pack frs but this is digital and would work quite well I think! $90 for 4. I like it.
They will work well in DT mode. Performance should be identical to the legacy DTRs, at least the DTR410. My wife (G/F at the time) and I had a pair of i355 NEXTEL phones back in the day and we used the DT feature. The Tx power output in DT mode is 890mW (+29.5dBm), same as the legacy DTRs. The Part 15 legal limit is 1W (+30.0dBm). The 0.5 dB under the legal limit is to account for measurement uncertainty and unit to unit variation and not exceed the 1W legal limit.

One gotcha to be aware of is that each phone has to have a SIM card in it that was previously activated on an iDEN network in order to use DT mode. The phone will not enter DT mode without a SIM card previously activated on an iDEN network. The DTRs and DLRs have a hardware 11 digit electronic serial number or Private ID in each radio that is used by the FHSS system. In iDEN phones with the DT feature, the 11 digit Private ID is formed from 1 plus the area code and phone number that was assigned to the phone when it was activated on an iDEN network. Make absolutely sure the i355 phones you get have a previously activated SIM card in them. I don't know if anybody has managed to hack a SIM card to enter an 11 digit ID to enable the DT feature.

The i355 uses the same hi-capacity battery that the legacy DTR410/550/650 radios use and replacement batteries are readily available for them. I recently re-batteried my DTR650 fleet with factory fresh new batteries ordered on Amazon so I know batteries are still available for them. The batteries I got are aftermarket batteries and are higher capacity (2000mAh) compared to the original high cap battery (1800mAh). The i355 also uses the same commercial accessories that the legacy DTRs use.
 

N4KVE

Member
Joined
Mar 1, 2003
Messages
3,644
Location
PALM BEACH, FLORIDA
Most Nextel phones that have DT on E-Bay have a SIM card. Also Nextel SIM cards are easily available on E-Bay for $1, or $2. I bought 2 Nextel phones from the same seller. One still has the entire contact list on the card, while the other was wiped clean. They do work great.
 

jaspence

Member
Premium Subscriber
Joined
Mar 21, 2008
Messages
2,583
Location
Michigan
The radios I saw years ago were military and not available for the general public. I do not remember the frequency range, but it didn't really matter as they jumped too fast for any monitoring device.
 

rescuecomm

Member
Joined
Jun 20, 2005
Messages
1,133
Location
Travelers Rest, SC
On a cruise around 2005, I witnessed the ultimate RF interference on the FRS radio channels. My radios were working just fine at Cancun when the Disney cruise ship made port. All channels were filled with Roger beeps and yelling children. Next cruise, I had Nextel I355s setup and they worked just fine.
 

n1das

Member
Premium Subscriber
Joined
Feb 17, 2003
Messages
1,598
Location
Nashua, NH
If the Target store the OP is talking about is using DLR radios then there's a good chance they are simply using them right out of the box at the factory default settings like FRS bubble packs. If this is the case then they can be easily monitored with another defaulted DLR or DTR radio. If Target is using the 4-digit Profile ID Number (PIN) feature and the PIN is set to something other than the 0000 default then the OP is SOL unless the correct PIN is guessed. Motorola made it insanely easy to secure a fleet of DLRs using the 4-digit PIN feature and without needing the CPS. If the DLR programming has been customized with the CPS then the OP is probably also SOL.

Motorola probably can monitor these very easily with home grown test equipment that was used for testing during the DLR's and DTR's development. Another method would be to use a DLR or DTR radio running custom firmware. The MOTO Talk platform the DTRs and DLRs use is an ID-based system and each radio has an 11-digit hardware Private ID for Private talkgroups and Private 1 to 1 calling. With public groups, a radio responds to any incoming Private ID on a given frequency hopset. With private groups, a radio responds only to a list of Private IDs already stored in the radio. Custom firmware for monitoring all traffic on a given frequency hopset would simply respond to ANY incoming Private ID, regardless of whether it is for a public group, private group, or private 1 to 1 calling. Motorola might already have this as developmental firmware and these features were never released in production radios.

The Direct Talk (DT) feature in (old) iDEN phones such as the i355 was organized more primitively than the DTRs. I suspect the DTRs and DLRs became incompatible with DT when more features were added to the DTRs to make the DTR410/550/650 models. The DT feature also needed to be kept as simple as possible for iDEN phone users. The DT feature had 10 channels (hopsets) and 15 codes (public group IDs) for each channel. The group IDs also included a Monitor All group ID. When using Monitor All, PTT is disabled but the radio is able to listen to all traffic on all 15 group IDs on the channel (hopset). No private groups were available. Private 1 to 1 calling was available by entering 1 plus the area code and phone number of the phone being called. The 1 plus area code and phone number were used to form the 11 digit Private ID to use the DT feature.

Wanting to monitor DTR/DLR traffic on a given frequency hopset reminded me of the Monitor All group ID in DT mode in the old iDEN phones like the i355. While technically not encrypted, the DTRs and DLRs were set up to be very secure and completely scanner proof but they really are not quite as secure as people would like to think. Security through obscurity is really not security at all.
 
Last edited:

Polymathic

Hacker/Ham/Pilot
Joined
Apr 29, 2010
Messages
7
One more question please.

Was the Direct Talk feature of Nextel 900 mhz frequency hopping and digital? I just want to be clear that I am asking about Direct Talk and not Direct Connect.
That's my understanding. I have a small fleet of old iDEN handsets and have been exploring exactly what they will and won't do with Direct Talk in these post-Nextel network days.

My hypothesis is that when you put them into Direct Talk mode (and you're right to be clear about terminology, as there are THREE different transmission modes one might use by pressing the PTT button on one of these), they stop using the SMR baseband and become Direct Talk-only devices for a while. Am going to empirically determine this with some test equipment at some point.

I have read posts to the effect that while the same people implemented this functionality as that in the Motorola FHSS handhelds, that they're not intereoperable with Direct Talk on the old NEXTEL phones. That's something I'd like to confirm for myself. I think the chip rates are similar.
 

n1das

Member
Premium Subscriber
Joined
Feb 17, 2003
Messages
1,598
Location
Nashua, NH
That's my understanding. I have a small fleet of old iDEN handsets and have been exploring exactly what they will and won't do with Direct Talk in these post-Nextel network days.

My hypothesis is that when you put them into Direct Talk mode (and you're right to be clear about terminology, as there are THREE different transmission modes one might use by pressing the PTT button on one of these), they stop using the SMR baseband and become Direct Talk-only devices for a while. Am going to empirically determine this with some test equipment at some point.

I have read posts to the effect that while the same people implemented this functionality as that in the Motorola FHSS handhelds, that they're not intereoperable with Direct Talk on the old NEXTEL phones. That's something I'd like to confirm for myself. I think the chip rates are similar.
You are correct in that when in off network Direct Talk mode, the iDEN network (i.e., NEXTEL) is not used at all. The off network Direct Talk (DT) feature is not to be confused with the Direct Connect (DC) PTT feature which used the iDEN network. No iDEN network service is available while in DT mode and the phone can't see any network service if there is (was) network service available.

The DT feature in the iDEN handsets (i.e., NEXTEL phonse), the legacy DTR410/550/650 radios, the DLR10/1060 radios, and the new DTR600/700 radios all use the same FHSS system. The DT feature in iDEN handsets was coded differently from the DTRs and DLRs such that they are not compatible. This supposedly was done on purpose. The feature originally was called MotoTALK. The DLRs and the DTR600/700 radios and the new Curve Series radio (not available yet) is the latest implementation of the MotoTALK platform.


In DT mode, you have 10 channels and 16 codes available to select. The 10 channels are actually the 10 hopsets of 50 frequencies each. Codes 1-15 are public talkgroup IDs, similar to public groups in the legacy DTRs, DLRs, and DTR600/700 models. Code 0 is a "listen all" talkgroup to monitor all 15 talkgroup IDs on a channel. Transmitting is disabled when using the Listen All talkgroup (code 0). The DT feature does not have any private groups like the DTRs and the DLRs have. Private 1 to 1 calling in DT mode uses 1 plus the area code and phone number in the SIM card which serves as an 11-digit Private ID for each phone. Note that an iDEN handset will not enter DT mode without a SIM card that was previously activated with a phone number on an iDEN network.

The DTRs and DLRs also have an 11 digit Private ID of the same format but the ID is assigned to the radio at the factory and cannot be changed by the end user or with the CPS.

The DTR radios and DLR added more features including Private groups and a 1 to 1 Private Reply feature for private 1 to 1 calling. More available talkgroup IDs were added too. The DTRs also added talkgroup scanning capability, probably a fancy version of the Listen All group ID in DT mode in iDEN handsets.

I don't know this for a fact but I suspect the DT feature in iDEN handsets became incompatible with the DTRs and DLRs as more features were added to the DTRs (and DLRs). The incompatibility may be due to the evolution of features and not due to marketing saying they can't be compatible even though they all use the exact same FHSS system. This is speculation on my part but it appears to be the case based on how they program and operate. I have owned NEXTEL i355 handsets and used them with my wife (G/F at the time), have owned and still own legacy DTRs, previously owned some DLRs, and currently own some DTR700 radios. I have had the DTRs and DLRs all working with each other on public and private talkgroups and also had the DLRs and DTR700s working with each other with the 4 digit Profile ID Number (PIN) feature. The PIN feature is a new feature which started with the DLRs and carried forward in the DTR600/700 models.

I have never tested a DTR compatibility with an iDEN phone in DT mode. I don't have any iDEN handsets to try DT mode to try to talk to a DTR on public groups 1-15. There is a chance it might work because they use the same FHSS system so it's worth a try.
 

Polymathic

Hacker/Ham/Pilot
Joined
Apr 29, 2010
Messages
7
Note that an iDEN handset will not enter DT mode without a SIM card that was previously activated with a phone number on an iDEN network.
Thanks for a thoughtful and informative reply. I have one result that might differ from yours. I bought a pile of used iDEN handsets and a bag of new old stock SIM cards - never even punched out of the carrier card, with many still shrinkwrapped in the original booklet. They clearly haven't been activated with a telephone number, but the handsets seem to work just fine with them for DirectTalk purposes. They were from the same carrier as the handsets, though, so I'm sure the network codes (whatever the iDEN equivalent of MCC-MNC is called) do match.

I think your observation that there might be an airside protocol mismatch due to protocol version and feature set makes a lot of sense and fits Occam's Razor. Things like differences in default codes aren't necessarily showstoppers for someone willing to reverse engineer and rewrite firmware, but reverse engineering air/phy protocols for feature parity would be a pain.
 

tonybx

Member
Premium Subscriber
Joined
Jun 3, 2006
Messages
8
Location
Bronx, New York
It is not impossible to monitor a four pin DLR radio from Target or Walmart. Most likely they will use them right out of the box with the default "0000". But if not then patients will pay off if you just go through the four pin combinations in order until you get the right one for that user. Yes it may take time but then once you have the four pin, you are set. I am considering purchasing DLR 1060. It has up to six channels that may be used. I wonder if each channel can use a different four pin profile? I am asking this because if I find the four pin for Target, lets say, then I would put them in Channel one. And if I found the four pin to Walmart, I could put them on channel 2. Probably only one pin can be set at one time so I would have to switch pins as needed. Still I would hate to have to purchase a DLR radio just to listen to store chatter, but I hate being left out! Lol
 
Top