Understanding NexEdge Trunking

[EricCottrell]

Hello,

Some useful scribbles as programs decoding NexEdge trunking become available.

NexEdge trunking has a dedicated control channel.

NexEdge is defined as Type-C in Parts 1-A and 1-C of the NXDN Technical Specifications.

The System ID is split into three Categories based on system size. This determines the number of system and site ids.

  Global   - System Ids 1 to   1022 with Site Ids 1 to 4094
  Regional - System Ids 1 to  16382 with Site Ids 1 to  254
  Local    - System Ids 1 to 131070 with Site Ids 1 to   30

The Radio Access Number (RAN) used is the Site Id modulus 64. A RAN of zero does not mean monitor all RAN values, but rather the RAN for Sites 64, 128, etc.

Channel numbers range from 1 to 1023 with 0 being used as a filler value. There seems to be a couple of pre-defined channel to frequency maps defined for UHF.

6.25KHz NexEdge
Channel Frequency   Step
1       450.000     0.0125
401     460.000     0.0125
801 to 1023 for Custom Frequencies

12.5KHz NexEdge (incomplete)
Channel Frequency   Step
1       451.000     0.0125
401     461.000     0.0125

I have monitored systems on other bands where all the channel numbers appear to be mapped to custom frequencies. This will make it difficult to easily determine site frequencies. More observation is needed.

Group Ids have a normal range from 1 to 65519. A Value of 0 is used as a filler value. Values 65520 to 65534 are used for special purposes. A value of 65535 is used for "All Groups".

Unit Ids have a normal range from 1 to 65519. A Value of 0 is used as a filler value. Values 65520 to 65534 are used for special purposes. A value of 65535 is used for "All Units".

73 Eric

 

[EricCottrell]

Hello,

Some more information to help in figuring out the Channel Map.

Standard UHF Map Formulas
For Channels 1 to 400:
Freq = 450 + (( Ch - 1 ) * 0.0125

For Channels 401 to 800:
Freq = 460 + (( Ch - 401 ) * 0.0125

For Channels 801 to 1023
Custom frequency, i.e. T-Band or on a 6.25 KHz step.

What is the frequency for Ch 511?
Freq = 460 + (( 511 - 401 ) * 0.0125 ) = 461.3750

Otherwise each system implements their own channel map. After getting a few frequencies on the system, you can try the same techniques used to get the frequency mapping of a Motorola Analog VHF/UHF system. For example, the frequencies for these three channels where figured out.
472.350 MHz = Ch 377
471.600 MHz = Ch 257
471.350 MHz = Ch 217

Figure out the step size
( 471.600 - 471.350 ) / ( 257 - 217 ) = 0.00625 KHz (reasonable step size).

Find the base
Base (Ch 1) = 471.350 - (( 217 - 1 ) * 0.00625) = 470.000

See if the other frequencies fit, they do.
471.6000 = 470.000 + (( 257 - 1 ) * 0.00625)
472.3500 = 470.000 + (( 377 - 1 ) * 0.00625)

So the system has a Base (Ch 1) of 470.000 MHz with a 6.25 KHz step size. I do not know if the mapping is always divided into three parts (1 - 400, 401 - 800, 801 - 1023).

73 Eric

 

[jcardani]

I have a question from a tech that works at a local NEXEDGE shop that runs a local wide area SMR.
Does the ESN show up anywhere in the data stream and can it be displayed in a future release? It would help him in his work. He said the Kenwood series ESNs should start with a 680

thanks,
Joe

 

[slicerwizard]

There is no reason for the outbound (repeater TX) transmissions to include ESN data. Even inbound shouldn't need it - authentication doesn't need to send the secret data (the ESN) in the clear - or at all.

 

[jcardani]

Thanks slicer!

 

[WayneH]

NOTICE

I've stuck this thread to better aid folks in understanding how this protocol works. Lets keep the help requests to their own threads and leave these for technical discussion of the protocol's operation.

 

[cg]

I believe the .1250 in Eric's formula is a typo, it should be .0125 or 12.5KHz.

chris

Hello,
Standard UHF Map Formulas
For Channels 1 to 400:
Freq = 450 + (( Ch - 1 ) * 0.125

For Channels 401 to 800:
Freq = 460 + (( Ch - 401 ) * 0.125

For Channels 801 to 1023
Custom frequency, i.e. T-Band or on a 6.25 KHz step.

What is the frequency for Ch 511?
Freq = 460 + (( 511 - 401 ) * 0.125 ) = 461.3750

Otherwise each system implements their own channel map. After getting a few frequencies on the system, you can try the same techniques used to get the frequency mapping of a Motorola Analog VHF/UHF system. For example, the frequencies for these three channels where figured out.
472.350 MHz = Ch 377
471.600 MHz = Ch 257
471.350 MHz = Ch 217

Figure out the step size
( 471.600 - 471.350 ) / ( 257 - 217 ) = 0.00625 KHz (reasonable step size).

Find the base
Base (Ch 1) = 471.350 - (( 217 - 1 ) * 0.00625) = 470.000

See if the other frequencies fit, they do.
471.6000 = 470.000 + (( 257 - 1 ) * 0.00625)
472.3500 = 470.000 + (( 377 - 1 ) * 0.00625)

So the system has a Base (Ch 1) of 470.000 MHz with a 6.25 KHz step size. I do not know if the mapping is always divided into three parts (1 - 400, 401 - 800, 801 - 1023).

73 Eric

 

[rbrtklamp2]

DSDPlus NXDN TRS Help

Just wondering if anybody could help me understand this formula better. I am not getting the same results. Here is the band plan I have so far the only verified frequency I have at the moment is ch 623. the others I have been trying to find using a scanner while watching the control channel Plus activity. And yes I am using DSDPlus. This is from my frequencies file.


Mode, NID, SID, CH#, RX, TX, Sort Order
NEXEDGE48, 14, 2, 128, 471.85000, 471.85000, 0
NEXEDGE48, 14, 2, 207, 472.42500, 472.42500, 0
NEXEDGE48, 14, 2, 484, 472.2125, 472.2125, 0
NEXEDGE48, 14, 2, 491, 472.25, 472.25, 0
NEXEDGE48, 14, 2, 493, 472.58125, 472.58125, 0
NEXEDGE48, 14, 2, 544, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 590, 472.7, 472.7, 0
NEXEDGE48, 14, 2, 623, 472.975, 472.975, 0, CC
NEXEDGE48, 14, 2, 734, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 837, 0.0, 0.0, 0

 

[mmckenna]

There is no reason for the outbound (repeater TX) transmissions to include ESN data. Even inbound shouldn't need it - authentication doesn't need to send the secret data (the ESN) in the clear - or at all.

A year late with this comment, but I just saw it.

I think this may be incorrect.
I run a NexEdge trunked system and I think the subscriber units do send their ESN in with transmissions. The NexEdge systems can be set up to match the radio ESN to the Radio ID as a method of subscriber access control. I know for sure if you program the system to do this it will reject a radio call if the UID and the radio ESN it's tied to do not match.
There are 3 methods in the Kenwood systems:
1. No ESN validation.
2. Manufacturer validation (68 for Kenwood)
3 Full validation, ESN and UID must match.

I'm running my system with the full ESN validation. For a radio to connect and even hear traffic, the UID has to be programmed into the system. The UID set up has a field where I enter the radios ESN number. If either of those is missing or wrong, the radio won't receive traffic, won't be allowed to connect to the system, and won't be allowed to transmit.
Since the ESN/s seem to be hardcoded into the radio, I'm not sure if there is any way to hack around this.

At least it helps keep all my customers honest.

 

[slicerwizard]

Nothing you wrote requires that the actual ESN be transmitted on any easily monitored inbound or outbound RF channel.

The NXDN specs are freely available. From TS 1-A:

6.4.2.8: system sends (random) 16 bit authentication parameter

6.4.2.9: subscriber unit sends back 56 bit authentication value

No mention of an ESN going over the air.

 

[mmckenna]

I haven't read the NXDN specs that closely, I'm sure you are correct.

I do have my trunked system set up to control access, and it requires the ESN for each and every radio to be in the system. How it handles that is something I'd need to research.
Without the ESN -and- the UID matching to what is in the system, the individual radios will not connect to the system, won't even receive traffic.

Some day when I have the time, I'll have to dig into the NXDN specs more than I have.

 

[Forts]

Just wondering if anybody could help me understand this formula better. I am not getting the same results. Here is the band plan I have so far the only verified frequency I have at the moment is ch 623. the others I have been trying to find using a scanner while watching the control channel Plus activity. And yes I am using DSDPlus. This is from my frequencies file.


Mode, NID, SID, CH#, RX, TX, Sort Order
NEXEDGE48, 14, 2, 128, 471.85000, 471.85000, 0
NEXEDGE48, 14, 2, 207, 472.42500, 472.42500, 0
NEXEDGE48, 14, 2, 484, 472.2125, 472.2125, 0
NEXEDGE48, 14, 2, 491, 472.25, 472.25, 0
NEXEDGE48, 14, 2, 493, 472.58125, 472.58125, 0
NEXEDGE48, 14, 2, 544, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 590, 472.7, 472.7, 0
NEXEDGE48, 14, 2, 623, 472.975, 472.975, 0, CC
NEXEDGE48, 14, 2, 734, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 837, 0.0, 0.0, 0

I could be that this system is running a custom bandplan perhaps? I'm not sure how FCC lookups work over there but is it possible to look up one of these frequencies and find the others associated with the same system? For us here in Canada it's usually pretty easy to lookup via callsign/licensee name etc and find all the associated frequencies.

 

[RonnieUSA]

I could be that this system is running a custom bandplan perhaps? I'm not sure how FCC lookups work over there but is it possible to look up one of these frequencies and find the others associated with the same system? For us here in Canada it's usually pretty easy to lookup via callsign/licensee name etc and find all the associated frequencies.

I think this is who it is.

ULS License - Industrial/Business Pool, Trunked License - WPLV256 - A BEEP, LLC

 

[rbrtklamp2]

I think this is who it is.

ULS License - Industrial/Business Pool, Trunked License - WPLV256 - A BEEP, LLC

Could you please post the frequency information for me it will not bring up the page for me when I click on the link.

Thanks,
Bob

 

[MtnBiker2005]

Visit this page and type in the FCC Callsign.
http://wireless2.fcc.gov/UlsApp/UlsSearch/searchLicense.jsp
or
https://www.radioreference.com/apps/db/?fccCallsign=WPLV256

 

[rbrtklamp2]

well the page opened for me now I don't know what was wrong earlier. Anyway yes that is the system, I saw that over the weekend. but that license only covers 8 frequencies and site 14-6 consists of 10 frequencies leaving me 2 short and unable to match anything definitively against the channel numbers which seem to be random. So short of searching the T-Band and possibly the 450 bushiness band I am out of ideas does anyone else have any info on the new A-Beep digi talk system?

 

[EricCottrell]

Just wondering if anybody could help me understand this formula better. I am not getting the same results. Here is the band plan I have so far the only verified frequency I have at the moment is ch 623. the others I have been trying to find using a scanner while watching the control channel Plus activity. And yes I am using DSDPlus. This is from my frequencies file.


Mode, NID, SID, CH#, RX, TX, Sort Order
NEXEDGE48, 14, 2, 128, 471.85000, 471.85000, 0
NEXEDGE48, 14, 2, 207, 472.42500, 472.42500, 0
NEXEDGE48, 14, 2, 484, 472.2125, 472.2125, 0
NEXEDGE48, 14, 2, 491, 472.25, 472.25, 0
NEXEDGE48, 14, 2, 493, 472.58125, 472.58125, 0
NEXEDGE48, 14, 2, 544, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 590, 472.7, 472.7, 0
NEXEDGE48, 14, 2, 623, 472.975, 472.975, 0, CC
NEXEDGE48, 14, 2, 734, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 837, 0.0, 0.0, 0

Hello,

You really need to get at least two frequencies confirmed to start making sense of the frequency map. This appears to be a custom map. The hundreds of values can be custom set to any valid frequency. I have seen maps where the lower channel numbers are the original sites in ascending frequency order. Frequencies of new sites that were not already in the map were added at the end.

A site could be under multiple licenses and a license could cover different system types. Also with 12.5 KHz or 25 KHz wide channel allocations, the user can offset from the assigned frequency and have two channels.

Step sizes are usually multiples of 2.5 KHz for VHF or 3.25 KHz for UHF and higher, with 6.25 KHz and 12.5 KHz commonly used for UHF.

If the map has a 12.5 KHz step then the "base" (channel 1) would be
465.2 = 472.975 - ((623 -1) * 0.0125)
This is not a good base because it covers the repeater input side of 460.0.

If the map has a 6.25 KHz step then the "base" (channel 1) would be
469.0875 = 472.975 - ((623 -1) * 0.00625)
This base frequency is also suspect.

Finally try the 3.125 KHz step
471.03125 = 472.975 - ((623 -1) * 0.003125)
This appears good as it is in the repeater output part of the band.

The next step is to try out the base on the channel map.
NEXEDGE48, 14, 2, 128, 471.428125, 474.428125, 0
NEXEDGE48, 14, 2, 207, 471.675000, 474.675000, 0
NEXEDGE48, 14, 2, 484, 472.540625, 475.540625, 0
NEXEDGE48, 14, 2, 491, 472.562500, 475.562500, 0
NEXEDGE48, 14, 2, 493, 472.568750, 475.568750, 0
NEXEDGE48, 14, 2, 544, 472.728125, 475.728125, 0
NEXEDGE48, 14, 2, 590, 472.871875, 475.871875, 0
NEXEDGE48, 14, 2, 623, 472.975000, 475.975000, 0, CC
NEXEDGE48, 14, 2, 734, 473.321875, 476.321875, 0
NEXEDGE48, 14, 2, 837, 473.643750, 476.643750, 0

This does not appear to be valid as only the control channel matches. The last two channels are out of the repeater output range.

You need to search the other site frequencies and see if any become active when the channel gets assigned. I would also try other frequencies licensed to that location.

73 Eric

 

[vince48]

Eric,
wow, that's a lot of moving parts to these systems

 

[rbrtklamp2]

Wow tell me about it. I think they are custom band plans but I will keep trying Eric's formula is a great starting point though. For right now I am going through the UHF bands and mapping control channels. The only way I can think of to decisively find the voice channels is to keep my PSR800 feeding audio into DSD while watching the CC event screen and matching RANs to Trunked sites.

 

[EricCottrell]

Wow tell me about it. I think they are custom band plans but I will keep trying Eric's formula is a great starting point though. For right now I am going through the UHF bands and mapping control channels. The only way I can think of to decisively find the voice channels is to keep my PSR800 feeding audio into DSD while watching the CC event screen and matching RANs to Trunked sites.

Hello,

The channel map is the same for all sites in the system, so can you post the information on the other sites for this system?

73 Eric