SDR# TETRA Demodulator Trunk Tracking Demonstration

[hamradionl]

Is there any software to decode frames / get any data out of the transmissions the mobile stations send to the Base stations? I know there are devices which detect these signals

These are very simple to showup when use SSB, DSB or CW hear single side band tone and use the plugin AUXVFO, interesting thing notice the HH not allways use 10MHz space but some part in the downlink spectrum. There deferent in Group or private calls. Or use plugin detector that detect short burst and make BEEP or buzzer sound LSB between 400 - 1 kHz above Freq and +/- 4000 BW give nice pitch.

 

[Ubbe]

Do you know how often these impulses are sent in Tetra networks when the user of a mobile station doesn't actively trasmit any data?

You can set that time in the system but probably once each 4 hour. If a tetraradio are mobile and moving and the received signal level goes worse it could transmit as it tries to find a better site. Each time a radio switch sites it transmits. Each time the TG are changed it will transmit. Also most public safety systems sends GPS signals very frequently, like 30 sec intervals when moving.

Those background signalling are pretty much the same in GSM systems as in Tetra. Leave you mobile phone on a table and it will transmit with some 4 hour interval if you only have one strong site in your location. Having a bad signal or several sites the phone transmits much more often to try and find a better signal or switch to different sites when signals fade up and down in strenght. When you live close to a mobile mast your battery will last much longer than when you constantly have a weak signal reception that makes the phone transmit much more often.

/Ubbe

 

[WireDelphin]

Thanks for your detailed information.
TG = Talk Group?

I'm not sure if in Germany these mobile stations will transmit GPS without beeing polled external, because of their extreme protection laws. Theres a newspaper article claiming that system was overloaded even tracking only a few GPS positions Polizei in München - "Was wir heute können, ist funken"

So probably the claim of these Tetra detector vendors detecting tetra mobile stations a lot in advance might in Germany not be true.

Do you know if there is a difference in transmitting (transmit power and transmit frequency) between mobile stations integrated into a car which have plenty of power and handheld tetra devices with only a small battery?

 

[Ubbe]

I'm not sure if in Germany these mobile stations will transmit GPS without beeing polled external, because of their extreme protection laws. Theres a newspaper article claiming that system was overloaded even tracking only a few GPS positions Polizei in München - "Was wir heute können, ist funken"

So probably the claim of these Tetra detector vendors detecting tetra mobile stations a lot in advance might in Germany not be true.

Do you know if there is a difference in transmitting (transmit power and transmit frequency) between mobile stations integrated into a car which have plenty of power and handheld tetra devices with only a small battery?

You can poll from the system to get the GPS position but isn't used on a regular basis as it loads the system too much with several transmissions going back and forth. When a mobile sends GPS position in a normal way it only sends that "in the blind" without getting any acknowledge message back, just to keep the channel load to a minimum. The system can send configuration messages to mobiles to change the parameters for the GPS transmission, to have longer times between transmissions if the load are too big or to make a mobile transmit much more often to get a more accurate position on the map.

In stockholm there are more than 2000 busses that transmits GPS together with other technical info with each transmission and share the tetra system with subway and railroad and service and security personel with GPS positions and there's no problem in their system. But they also occupie a whole 2MHz bandwidth with each 25KHz channel in use.

Mobiles can have up to 25watt transmitters and portables up to 5watt. But they seldom use that power as it is regulated down depending of how strong signal they receive. If they receive a strong signal the site is near and the output power are reduced to match it. It can go down to 0,5watt or even lower. It works very much like a GSM net. In a city you usually have a lot of sites to get a high capacity to handle a lot of mobiles and they will mostly be working at lowest or moderate powers which makes a tetradetector have a very short range.

/Ubbe

 

[WireDelphin]

These are very simple to showup when use SSB, DSB or CW hear single side band tone and use the plugin AUXVFO, interesting thing notice the HH not allways use 10MHz space but some part in the downlink spectrum. There deferent in Group or private calls. Or use plugin detector that detect short burst and make BEEP or buzzer sound LSB between 400 - 1 kHz above Freq and +/- 4000 BW give nice pitch.

Do you or somebody else has a wav or iq file providing tetra traffic in uplink? Especially interesting would be such short bursts and how an tetra call looks like.

I wonder if this short peak in Tetra spectrum could be such a short burst, but its really really short, hard to notice.

 

[WireDelphin]

Addition (Mod can merge that with previous message): Since in Tetra Networks you press the talk button and then have to wait about 1s until you got connection and can talk, there should also be a short burst when mobile station trasmit this talk request, shouldn't it?

 

[Ubbe]

there should also be a short burst when mobile station transmit this talk request

When they push the PTT it will send a request containing their ID and the TG that are selected and the system will acknowledge it and then look in its database what the permissions are for that ID and TG and the relation to that particular site. In a well designed and configured system you hardly notice the delay but could be very noticable during weak signal conditions or during a high system load situation.

When a mobile are talking the uplink has a machine gun kind of pulsating signal. Standard GPS signalling are just a short 13mS burst. All signalling has to be at least one time slot long, 13mS and there's 3 more of them to be used by other users on the same frequency, and if more data are needed to be sent it will use the same time slot each 50mS that will create that pulsating modulation.

/Ubbe

 

[FR33MAN]

Hello, I am very grateful for the work done in TTT, I use it and it really works very well and I find it very useful. My question is I have found open networks in which if I have GPS position of equipment with LRRP but another network instead I have no position with LRRP, can you help me? If I can modify something to have those positions because I know that if they emit that signal because in their central they have positioning. This is the message I have with said network.

SSI:10xxxxx D_SDS_Data Party_SSI:10xxxxx Type:UDT-4 Length:81 Protocol:Simple_location_system LocationSystemCodingScheme:User defined (128 = unknown data) DATA:'11001001101000110101101101101100110111111110111011100011000101010'


Thank you

 

[thewraith2008]

It could be:

• MS sends location data on uplink, we only monitor downlink so no way to capture them. You would normally see a response from BS if this was the case.
• MS uses some other means to send location data (i.e. not TETRA)

If the location data is in the PDU you posted, then it's sent in an unknown structure ( User defined (128 = unknown data) )



Latest version (v1.7.1.0) can be found here: Release post

 

[hamradionl]

SSI:10xxxxx D_SDS_Data Party_SSI:10xxxxx Type:UDT-4 Length:81 Protocol:Simple_location_system LocationSystemCodingScheme:User defined (128 = unknown data) DATA:'11001001101000110101101101101100110111111110111011100011000101010'

If you see any logic characters or coordinates i this
19346B6D9BFDDC62A
c9 a3 5b 6c df ee e3 15 00
201 163 91 108 223 238 227 21 0

 

[Jojox44]

Windows 10 Pro - 64 bit, cpu AMD, RAM 8 G, gpu Nvidia 1050Ti

TTT v1.7.1.0
Airspy SDR# v1.0.0.1784 RTL-SDR USB


TTT works very good. You have done a very good job.
My position is in the middle of Europe, at the near of several borders. I have access to more Tetra Networks.
It should be clear that I will not public here either the names of these countries or of the networks.

• Network 390-395 MHz – the provider is known – country 1
• Network 396-430 MHz – the provider is unknown – country 1
• Network 423-426 MHz – the provider is konown – country 2

My question is : What does it depend on? TTT is working perfektly at the networks 2 and 3.

The network 1 is actually the official network in the country where I am now.
TTT doesn’t activate the User in the Group. It depends on that the T-Demodulator has no clear Audio. Why can the T-Demodulator encrypt the Network not in the right way? May be are there some additonal crypts? The sound is like from some pipe in waterfall.
I have read some articles about the problem on the Internet, but nobody has found any solution for it.

Can you please explain it to me, if there is any explanation for it?

 

[FR33MAN]

If you see any logic characters or coordinates i this
19346B6D9BFDDC62A
c9 a3 5b 6c df ee e3 15 00
201 163 91 108 223 238 227 21 0

Hello and thanks for the answers.

I can't find anything in the data, the coordinate format that I know doesn't match and I don't see any logic.

I ask. If I send an IQ file, would it help you to advance on this issue and learn about this positioning system that is not known right now?

Thank you very much .

 

[hamradionl]

I can't find anything in the data, the coordinate format that I know doesn't match and I don't see any logic.

there 4x type NMEA string contain position, heading or speed
Above is not "ready" you need to search for it and if you found it, than you know what type string NMEA is used. If you dont know what NMEA is, than its not possible to find out

 

[FR33MAN]

there 4x type NMEA string contain position, heading or speed
Above is not "ready" you need to search for it and if you found it, than you know what type string NMEA is used. If you dont know what NMEA is, than its not possible to find out

Thanks for your answer, if I only know the NMEA 0183 protocol, but in this frame the parameters are not identified and I do not see 4x NMEA information.
You can help me a little more, I see that you do know him.


Thanks, again

 

[hamradionl]

I do not see 4x NMEA information.

NMEA there are 4 independent strings who carry GPS position and/or speed and/or heading and time or a mix of those
Normal they use 1 of those 4 i dont know who they use the short one or the long one, it look the short one only give position without speed or heading. Most MtoM GPS unit i know are able to spit out the location in ASCII, HEX, ANSI, Binairy, SIRF and some others (like serial data) its depending how output is programmed. but up to you to find out i cant help because i dont know. And if you find out you able to edit in the "userdefine" file i dont know if that file / function still in newer TTT because i dont use that i switch to Linux version floating around on internet who is fully in development logging etc etc

 

[sok_z_zuka]

Hi,
I have some problem with Demodulator plugin. All the prerequisites are installed, yet upon startup i'm having this error:



Also seems there is no sound when this plugin is enabled. Old version was outputting some sound (distorted (scrambled?)).


PS: Sorry @thewraith2008
i was not able to send a PW.

 

[thewraith2008]

Hi,
I have some problem with Demodulator plugin. All the prerequisites are installed, yet upon startup i'm having this error:

Use a version of SDR# (1700-1716) that the TETRA plug-in was designed to work with.
I have not tried the last versions of SDR# because it keeps changing and breaking things every 3 minutes.

Also seems there is no sound when this plugin is enabled. Old version was outputting some sound (distorted (scrambled?)).

No idea, maybe an option needs changing.



Latest version (v1.7.1.0) can be found here: Release post

 

[hermite]

Hello, I'm using the latest SDRSharp release V1.0.0.1800 (.Net rewrite). Upon start up it complains about Tetra control...





Once I click OK, all works fine.... Any clue? Tks.

 

[thewraith2008]

The error is asking for a file 'System.Web.Extensions.dll'.
This is used for TTT to plug-in COMs.
If you don't enable TTT mode, it probably won't matter.

This error is because SDR# now uses .NET 5.
Copy the System.Web.Extensions.dll file from a location like this 'C:\Windows\Microsoft.NET\Framework\v4.0.30319' to your SDR# folder.
- This maybe different for you and it must be the v4.8.xxxx.x version of the file.

See first part of this post.
I have no plans to spend time on this anytime soon.



Latest version (v1.7.1.0) can be found here: Release post

 

[oz1jua]

Hi Ubbe. Thanks for that really worthful information.

So that means if devices do a handover to another tetra basestation they get another SSI and can't be tracked over multiple base stations, right?

Is there any software to decode frames / get any data out of the transmissions the mobile stations send to the Base stations? I know there are devices which detect these signals called Python Detectors or Target Blue eye. But don't know if they actually decode anything or just detect signals in the Tetra uplink band and warn based upon the received signalstrength. Didn't provide links to these devices, because I don't know if this is allowed or perhaps not welcomed here.

Hi WireDelphin
I have seen a setup with 10 Yes 10 PC with SRDSharp and TTT. And yes it is possible to be tracked over multiple base stations.
But it is hard to do becouse the SSI can change after some time. In this network I have seen that it changed every 1 week.
The network was using TEA2 encryption. The SSI is of course incrypted showing up in SDR Tetra Window. The TTT was not startet at all.
But it is a hard time to go thrue all the logs to see this.