Target Digital Radios

[alcahuete]

Yes. Direct Talk was 900 MHz Digital FHSS.

 

[HavenBTS]

Yes. Direct Talk was 900 MHz Digital FHSS.

Thank you.

 

[n1das]

What alcahuete said.

The DTRs and the DLRs are spinoffs from the Direct Talk feature. The legacy DTR 410/550/650 models shared a common design with a NEXTEL iDEN phone when the phone and the DTRs were first developed. The DTRs and the DLRs use the same FHSS digital protocol but were coded differently from the DT feature in the phones to be incompatible, supposedly on purpose. I don't know the reason(s) why but I suspect the DTRs and DLRs became incompatible with the DT feature in the iDEN phones when more features were added to the DTRs and later DLRs. Marketing might also have had their fingers in it too.

The DT feature in the iDEN phones and the DTRs and DLRs are all based on the MOTO Talk platform. The DT feature in the iDEN phones was an early implementation of MOTO Talk. The latest implementation of MOTO Talk are the DTR600/700 models and the DLR1020/1060 models.

MOTO Talk - Wikipedia

en.wikipedia.org

 

[HavenBTS]

Great information all! Thank you!

The reason I asked is because I am looking for the most inexpensive way for a property management team to connect on site. I can get 2 Motorola i335's for $45. About as much as cheap bubble pack frs but this is digital and would work quite well I think! $90 for 4. I like it.

 

[n1das]

Great information all! Thank you!

The reason I asked is because I am looking for the most inexpensive way for a property management team to connect on site. I can get 2 Motorola i335's for $45. About as much as cheap bubble pack frs but this is digital and would work quite well I think! $90 for 4. I like it.

They will work well in DT mode. Performance should be identical to the legacy DTRs, at least the DTR410. My wife (G/F at the time) and I had a pair of i355 NEXTEL phones back in the day and we used the DT feature. The Tx power output in DT mode is 890mW (+29.5dBm), same as the legacy DTRs. The Part 15 legal limit is 1W (+30.0dBm). The 0.5 dB under the legal limit is to account for measurement uncertainty and unit to unit variation and not exceed the 1W legal limit.

One gotcha to be aware of is that each phone has to have a SIM card in it that was previously activated on an iDEN network in order to use DT mode. The phone will not enter DT mode without a SIM card previously activated on an iDEN network. The DTRs and DLRs have a hardware 11 digit electronic serial number or Private ID in each radio that is used by the FHSS system. In iDEN phones with the DT feature, the 11 digit Private ID is formed from 1 plus the area code and phone number that was assigned to the phone when it was activated on an iDEN network. Make absolutely sure the i355 phones you get have a previously activated SIM card in them. I don't know if anybody has managed to hack a SIM card to enter an 11 digit ID to enable the DT feature.

The i355 uses the same hi-capacity battery that the legacy DTR410/550/650 radios use and replacement batteries are readily available for them. I recently re-batteried my DTR650 fleet with factory fresh new batteries ordered on Amazon so I know batteries are still available for them. The batteries I got are aftermarket batteries and are higher capacity (2000mAh) compared to the original high cap battery (1800mAh). The i355 also uses the same commercial accessories that the legacy DTRs use.

 

[N4KVE]

Most Nextel phones that have DT on E-Bay have a SIM card. Also Nextel SIM cards are easily available on E-Bay for $1, or $2. I bought 2 Nextel phones from the same seller. One still has the entire contact list on the card, while the other was wiped clean. They do work great.

 

[jaspence]

The radios I saw years ago were military and not available for the general public. I do not remember the frequency range, but it didn't really matter as they jumped too fast for any monitoring device.

 

[rescuecomm]

On a cruise around 2005, I witnessed the ultimate RF interference on the FRS radio channels. My radios were working just fine at Cancun when the Disney cruise ship made port. All channels were filled with Roger beeps and yelling children. Next cruise, I had Nextel I355s setup and they worked just fine.

 

[n1das]

If the Target store the OP is talking about is using DLR radios then there's a good chance they are simply using them right out of the box at the factory default settings like FRS bubble packs. If this is the case then they can be easily monitored with another defaulted DLR or DTR radio. If Target is using the 4-digit Profile ID Number (PIN) feature and the PIN is set to something other than the 0000 default then the OP is SOL unless the correct PIN is guessed. Motorola made it insanely easy to secure a fleet of DLRs using the 4-digit PIN feature and without needing the CPS. If the DLR programming has been customized with the CPS then the OP is probably also SOL.

Motorola probably can monitor these very easily with home grown test equipment that was used for testing during the DLR's and DTR's development. Another method would be to use a DLR or DTR radio running custom firmware. The MOTO Talk platform the DTRs and DLRs use is an ID-based system and each radio has an 11-digit hardware Private ID for Private talkgroups and Private 1 to 1 calling. With public groups, a radio responds to any incoming Private ID on a given frequency hopset. With private groups, a radio responds only to a list of Private IDs already stored in the radio. Custom firmware for monitoring all traffic on a given frequency hopset would simply respond to ANY incoming Private ID, regardless of whether it is for a public group, private group, or private 1 to 1 calling. Motorola might already have this as developmental firmware and these features were never released in production radios.

The Direct Talk (DT) feature in (old) iDEN phones such as the i355 was organized more primitively than the DTRs. I suspect the DTRs and DLRs became incompatible with DT when more features were added to the DTRs to make the DTR410/550/650 models. The DT feature also needed to be kept as simple as possible for iDEN phone users. The DT feature had 10 channels (hopsets) and 15 codes (public group IDs) for each channel. The group IDs also included a Monitor All group ID. When using Monitor All, PTT is disabled but the radio is able to listen to all traffic on all 15 group IDs on the channel (hopset). No private groups were available. Private 1 to 1 calling was available by entering 1 plus the area code and phone number of the phone being called. The 1 plus area code and phone number were used to form the 11 digit Private ID to use the DT feature.

Wanting to monitor DTR/DLR traffic on a given frequency hopset reminded me of the Monitor All group ID in DT mode in the old iDEN phones like the i355. While technically not encrypted, the DTRs and DLRs were set up to be very secure and completely scanner proof but they really are not quite as secure as people would like to think. Security through obscurity is really not security at all.

 

[Polymathic]

One more question please.

Was the Direct Talk feature of Nextel 900 mhz frequency hopping and digital? I just want to be clear that I am asking about Direct Talk and not Direct Connect.

That's my understanding. I have a small fleet of old iDEN handsets and have been exploring exactly what they will and won't do with Direct Talk in these post-Nextel network days.

My hypothesis is that when you put them into Direct Talk mode (and you're right to be clear about terminology, as there are THREE different transmission modes one might use by pressing the PTT button on one of these), they stop using the SMR baseband and become Direct Talk-only devices for a while. Am going to empirically determine this with some test equipment at some point.

I have read posts to the effect that while the same people implemented this functionality as that in the Motorola FHSS handhelds, that they're not intereoperable with Direct Talk on the old NEXTEL phones. That's something I'd like to confirm for myself. I think the chip rates are similar.

 

[n1das]

That's my understanding. I have a small fleet of old iDEN handsets and have been exploring exactly what they will and won't do with Direct Talk in these post-Nextel network days.

My hypothesis is that when you put them into Direct Talk mode (and you're right to be clear about terminology, as there are THREE different transmission modes one might use by pressing the PTT button on one of these), they stop using the SMR baseband and become Direct Talk-only devices for a while. Am going to empirically determine this with some test equipment at some point.

I have read posts to the effect that while the same people implemented this functionality as that in the Motorola FHSS handhelds, that they're not intereoperable with Direct Talk on the old NEXTEL phones. That's something I'd like to confirm for myself. I think the chip rates are similar.

You are correct in that when in off network Direct Talk mode, the iDEN network (i.e., NEXTEL) is not used at all. The off network Direct Talk (DT) feature is not to be confused with the Direct Connect (DC) PTT feature which used the iDEN network. No iDEN network service is available while in DT mode and the phone can't see any network service if there is (was) network service available.

The DT feature in the iDEN handsets (i.e., NEXTEL phonse), the legacy DTR410/550/650 radios, the DLR10/1060 radios, and the new DTR600/700 radios all use the same FHSS system. The DT feature in iDEN handsets was coded differently from the DTRs and DLRs such that they are not compatible. This supposedly was done on purpose. The feature originally was called MotoTALK. The DLRs and the DTR600/700 radios and the new Curve Series radio (not available yet) is the latest implementation of the MotoTALK platform.

MOTO Talk - Wikipedia

en.wikipedia.org

In DT mode, you have 10 channels and 16 codes available to select. The 10 channels are actually the 10 hopsets of 50 frequencies each. Codes 1-15 are public talkgroup IDs, similar to public groups in the legacy DTRs, DLRs, and DTR600/700 models. Code 0 is a "listen all" talkgroup to monitor all 15 talkgroup IDs on a channel. Transmitting is disabled when using the Listen All talkgroup (code 0). The DT feature does not have any private groups like the DTRs and the DLRs have. Private 1 to 1 calling in DT mode uses 1 plus the area code and phone number in the SIM card which serves as an 11-digit Private ID for each phone. Note that an iDEN handset will not enter DT mode without a SIM card that was previously activated with a phone number on an iDEN network.

The DTRs and DLRs also have an 11 digit Private ID of the same format but the ID is assigned to the radio at the factory and cannot be changed by the end user or with the CPS.

The DTR radios and DLR added more features including Private groups and a 1 to 1 Private Reply feature for private 1 to 1 calling. More available talkgroup IDs were added too. The DTRs also added talkgroup scanning capability, probably a fancy version of the Listen All group ID in DT mode in iDEN handsets.

I don't know this for a fact but I suspect the DT feature in iDEN handsets became incompatible with the DTRs and DLRs as more features were added to the DTRs (and DLRs). The incompatibility may be due to the evolution of features and not due to marketing saying they can't be compatible even though they all use the exact same FHSS system. This is speculation on my part but it appears to be the case based on how they program and operate. I have owned NEXTEL i355 handsets and used them with my wife (G/F at the time), have owned and still own legacy DTRs, previously owned some DLRs, and currently own some DTR700 radios. I have had the DTRs and DLRs all working with each other on public and private talkgroups and also had the DLRs and DTR700s working with each other with the 4 digit Profile ID Number (PIN) feature. The PIN feature is a new feature which started with the DLRs and carried forward in the DTR600/700 models.

I have never tested a DTR compatibility with an iDEN phone in DT mode. I don't have any iDEN handsets to try DT mode to try to talk to a DTR on public groups 1-15. There is a chance it might work because they use the same FHSS system so it's worth a try.

 

[Polymathic]

Note that an iDEN handset will not enter DT mode without a SIM card that was previously activated with a phone number on an iDEN network.

Thanks for a thoughtful and informative reply. I have one result that might differ from yours. I bought a pile of used iDEN handsets and a bag of new old stock SIM cards - never even punched out of the carrier card, with many still shrinkwrapped in the original booklet. They clearly haven't been activated with a telephone number, but the handsets seem to work just fine with them for DirectTalk purposes. They were from the same carrier as the handsets, though, so I'm sure the network codes (whatever the iDEN equivalent of MCC-MNC is called) do match.

I think your observation that there might be an airside protocol mismatch due to protocol version and feature set makes a lot of sense and fits Occam's Razor. Things like differences in default codes aren't necessarily showstoppers for someone willing to reverse engineer and rewrite firmware, but reverse engineering air/phy protocols for feature parity would be a pain.

 

[KB3KBR]

@n1das Where does one purchase these radios at?

 

[GlobalNorth]

@n1das Where does one purchase these radios at?

The older radios can be acquired through eBay [< $100] and the latest DTR radios are available from your local friendly Moto dealer.

 

[tonybx]

It is not impossible to monitor a four pin DLR radio from Target or Walmart. Most likely they will use them right out of the box with the default "0000". But if not then patients will pay off if you just go through the four pin combinations in order until you get the right one for that user. Yes it may take time but then once you have the four pin, you are set. I am considering purchasing DLR 1060. It has up to six channels that may be used. I wonder if each channel can use a different four pin profile? I am asking this because if I find the four pin for Target, lets say, then I would put them in Channel one. And if I found the four pin to Walmart, I could put them on channel 2. Probably only one pin can be set at one time so I would have to switch pins as needed. Still I would hate to have to purchase a DLR radio just to listen to store chatter, but I hate being left out! Lol

 

[n1das]

It is not impossible to monitor a four pin DLR radio from Target or Walmart. Most likely they will use them right out of the box with the default "0000". But if not then patients will pay off if you just go through the four pin combinations in order until you get the right one for that user. Yes it may take time but then once you have the four pin, you are set. I am considering purchasing DLR 1060. It has up to six channels that may be used. I wonder if each channel can use a different four pin profile? I am asking this because if I find the four pin for Target, lets say, then I would put them in Channel one. And if I found the four pin to Walmart, I could put them on channel 2. Probably only one pin can be set at one time so I would have to switch pins as needed. Still I would hate to have to purchase a DLR radio just to listen to store chatter, but I hate being left out! Lol

The local Cosco Wholesale near me uses DLR radios at the factory default settings. I am able to easily hear them when in range. People seem to be using these radios right out of the box at the factory default settings like FRS bubble packs.

I purposely keep the default public talkgroups in my DTR700 and DTR650 programming to listen and be able to talk to defaulted DLRs and DTRs. I also have them in the scan list to scan for activity and I have monitored local business activities in my travels. Retail districts and large urban areas are where I find the most activity. I added several private talkgroups to my programming to keep my radios secure when I want to secure them. I also have several channels programmed with Profile ID mode talkgroups which use the PIN feature. My DTR700 programming contains a mix of public group, private group, and Profile ID group channels. My DTR650 programming contains a mix of public and private talkgroups. The legacy DTR650 does not have the PIN feature which started with the DLRs in 2015.

The 4 digit Profile ID Number (PIN) feature is a radio wide feature and applies to Profile ID mode channels. The PIN feature also added Call All Available and Page All Available features which are all-call features on a given frequency hopset. Public group and private group channels program and function identical to public and private talkgroups in the legacy DTR410/550/650 models.

The DLR1060 is marketed as a 6 channel radio but can be expanded to 10 channels with the CPS. The DLR1020 is a 2 channel model and is not expandable to more channels. Early DLR1060 radios manufactured prior to a certain date in 2017 are not expandable to 10 channels with the CPS without upgrading the firmware. Motorola did a firmware update to the DLR1060 sometime in 2017 but never released an update tool for the firmware. So if you have a new or a recent build (post 2017) DLR1060 then you should be able to expand it to 10 channels with the CPS.

The two Target stores near me still use the (POS) analog UHF Motorola CLS series radios. Maybe someday they will upgrade to DLR radios.

 

[Ilikeradiostuff]

Hi, I’ve been reading over all these posts about DTRs and frequency hopping radio, so let’s presume that I had a radio capable of frequency hopping, How interoperable are they? If I was to be able to play around with a radio such as a DTR650 could I find the right info to program it into another personal radio? Thanks for any help understanding these anti scanner radios

 

[Ilikeradiostuff]

It is not impossible to monitor a four pin DLR radio from Target or Walmart. Most likely they will use them right out of the box with the default "0000". But if not then patients will pay off if you just go through the four pin combinations in order until you get the right one for that user. Yes it may take time but then once you have the four pin, you are set. I am considering purchasing DLR 1060. It has up to six channels that may be used. I wonder if each channel can use a different four pin profile? I am asking this because if I find the four pin for Target, lets say, then I would put them in Channel one. And if I found the four pin to Walmart, I could put them on channel 2. Probably only one pin can be set at one time so I would have to switch pins as needed. Still I would hate to have to purchase a DLR radio just to listen to store chatter, but I hate being left out! Lol

Exactly what I’m thinking, I have no need for a radio of such standards and I would only be listening to a churches radios a few times a month, but the possibility of radio signals not being heard makes me curious

 

[vagrant]

Read post #36 and #8 in this same thread.

Hi, I’ve been reading over all these posts about DTRs and frequency hopping radio, so let’s presume that I had a radio capable of frequency hopping, How interoperable are they? If I was to be able to play around with a radio such as a DTR650 could I find the right info to program it into another personal radio? Thanks for any help understanding these anti scanner radios

 

[Giddyuptd]

The plan to switch for Sam's Club and Walmart to a similar system was also announced several months ago. The only way to monitor is by having a radio set up with the same parameters as the radios in the store. Your chances of guessing that setup are less than winning the lottery.

Given employees loose them or they get taken by employees won't take long before cats out the bag on it. Most are using default box settings atm.