RadioReference on Facebook   RadioReference on Twitter   RadioReference Blog
 

Go Back   The RadioReference.com Forums > Computer Aided Monitoring and Programming > Voice/Control Channel Decoding Software


Voice/Control Channel Decoding Software - For discussion of software applications which decode digital voice formats and trunking control channels. Please use the HF Digital Signals forum for anything below 30MHz.

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #1 (permalink)  
Old 09-10-2014, 3:47 PM
Member
  RadioReference Database Admininstrator
Database Admin
Amateur Radio Operator
Amateur Radio
 
Join Date: Nov 2002
Location: Boston, Ma
Posts: 2,085
Default Understanding NexEdge Trunking

Hello,

Some useful scribbles as programs decoding NexEdge trunking become available.

NexEdge trunking has a dedicated control channel.

NexEdge is defined as Type-C in Parts 1-A and 1-C of the NXDN Technical Specifications.

The System ID is split into three Categories based on system size. This determines the number of system and site ids.
Code:
  Global   - System Ids 1 to   1022 with Site Ids 1 to 4094
  Regional - System Ids 1 to  16382 with Site Ids 1 to  254
  Local    - System Ids 1 to 131070 with Site Ids 1 to   30
The Radio Access Number (RAN) used is the Site Id modulus 64. A RAN of zero does not mean monitor all RAN values, but rather the RAN for Sites 64, 128, etc.

Channel numbers range from 1 to 1023 with 0 being used as a filler value. There seems to be a couple of pre-defined channel to frequency maps defined for UHF.
Code:
6.25KHz NexEdge
Channel Frequency   Step
1       450.000     0.0125
401     460.000     0.0125
801 to 1023 for Custom Frequencies
Code:
12.5KHz NexEdge (incomplete)
Channel Frequency   Step
1       451.000     0.0125
401     461.000     0.0125
I have monitored systems on other bands where all the channel numbers appear to be mapped to custom frequencies. This will make it difficult to easily determine site frequencies. More observation is needed.

Group Ids have a normal range from 1 to 65519. A Value of 0 is used as a filler value. Values 65520 to 65534 are used for special purposes. A value of 65535 is used for "All Groups".

Unit Ids have a normal range from 1 to 65519. A Value of 0 is used as a filler value. Values 65520 to 65534 are used for special purposes. A value of 65535 is used for "All Units".

73 Eric
Reply With Quote
Sponsored links
  #2 (permalink)  
Old 10-06-2014, 1:37 PM
Member
  RadioReference Database Admininstrator
Database Admin
Amateur Radio Operator
Amateur Radio
 
Join Date: Nov 2002
Location: Boston, Ma
Posts: 2,085
Default

Hello,

Some more information to help in figuring out the Channel Map.

Standard UHF Map Formulas
For Channels 1 to 400:
Freq = 450 + (( Ch - 1 ) * 0.0125

For Channels 401 to 800:
Freq = 460 + (( Ch - 401 ) * 0.0125

For Channels 801 to 1023
Custom frequency, i.e. T-Band or on a 6.25 KHz step.

What is the frequency for Ch 511?
Freq = 460 + (( 511 - 401 ) * 0.0125 ) = 461.3750

Otherwise each system implements their own channel map. After getting a few frequencies on the system, you can try the same techniques used to get the frequency mapping of a Motorola Analog VHF/UHF system. For example, the frequencies for these three channels where figured out.
472.350 MHz = Ch 377
471.600 MHz = Ch 257
471.350 MHz = Ch 217

Figure out the step size
( 471.600 - 471.350 ) / ( 257 - 217 ) = 0.00625 KHz (reasonable step size).

Find the base
Base (Ch 1) = 471.350 - (( 217 - 1 ) * 0.00625) = 470.000

See if the other frequencies fit, they do.
471.6000 = 470.000 + (( 257 - 1 ) * 0.00625)
472.3500 = 470.000 + (( 377 - 1 ) * 0.00625)

So the system has a Base (Ch 1) of 470.000 MHz with a 6.25 KHz step size. I do not know if the mapping is always divided into three parts (1 - 400, 401 - 800, 801 - 1023).

73 Eric

Last edited by WayneH; 03-09-2015 at 7:16 PM.. Reason: Fixed 0.125
Reply With Quote
  #3 (permalink)  
Old 10-10-2014, 5:06 PM
jcardani's Avatar
Member
   
Join Date: Jan 2002
Location: Orlando, FL & Ocean City, NJ
Posts: 1,263
Default

I have a question from a tech that works at a local NEXEDGE shop that runs a local wide area SMR.
Does the ESN show up anywhere in the data stream and can it be displayed in a future release? It would help him in his work. He said the Kenwood series ESNs should start with a 680

thanks,
Joe
__________________
Joe Cardani, W3FOY
Owner, PhillyScanner Yahoo Group and Greater Orlando Communications Group
Reply With Quote
  #4 (permalink)  
Old 10-10-2014, 5:24 PM
Member
   
Join Date: Sep 2002
Location: Toronto, Ontario
Posts: 4,412
Default

There is no reason for the outbound (repeater TX) transmissions to include ESN data. Even inbound shouldn't need it - authentication doesn't need to send the secret data (the ESN) in the clear - or at all.
Reply With Quote
  #5 (permalink)  
Old 10-10-2014, 5:29 PM
jcardani's Avatar
Member
   
Join Date: Jan 2002
Location: Orlando, FL & Ocean City, NJ
Posts: 1,263
Default

Thanks slicer!
__________________
Joe Cardani, W3FOY
Owner, PhillyScanner Yahoo Group and Greater Orlando Communications Group
Reply With Quote
Sponsored links
  #6 (permalink)  
Old 10-10-2014, 9:12 PM
WayneH's Avatar
Forums Veteran
  RadioReference Database Admininstrator
Database Admin
 
Join Date: Dec 2000
Location: Sitting in an airport somewhere
Posts: 8,434
Default

NOTICE

I've stuck this thread to better aid folks in understanding how this protocol works. Lets keep the help requests to their own threads and leave these for technical discussion of the protocol's operation.
__________________
If you PM me expect a long delay. Please use direct email for a quicker response.
Got an admin question? -> Forum Rules & Guidelines
Please follow the forum rules and contact a moderator directly, not via a thread.
Reply With Quote
  #7 (permalink)  
Old 02-17-2015, 8:05 AM
cg cg is offline
Member
  Premium Subscriber
Premium Subscriber
 
Join Date: Dec 2000
Location: Connecticut
Posts: 2,724
Default

I believe the .1250 in Eric's formula is a typo, it should be .0125 or 12.5KHz.

chris

Quote:
Originally Posted by EricCottrell View Post
Hello,
Standard UHF Map Formulas
For Channels 1 to 400:
Freq = 450 + (( Ch - 1 ) * 0.125

For Channels 401 to 800:
Freq = 460 + (( Ch - 401 ) * 0.125

For Channels 801 to 1023
Custom frequency, i.e. T-Band or on a 6.25 KHz step.

What is the frequency for Ch 511?
Freq = 460 + (( 511 - 401 ) * 0.125 ) = 461.3750

Otherwise each system implements their own channel map. After getting a few frequencies on the system, you can try the same techniques used to get the frequency mapping of a Motorola Analog VHF/UHF system. For example, the frequencies for these three channels where figured out.
472.350 MHz = Ch 377
471.600 MHz = Ch 257
471.350 MHz = Ch 217

Figure out the step size
( 471.600 - 471.350 ) / ( 257 - 217 ) = 0.00625 KHz (reasonable step size).

Find the base
Base (Ch 1) = 471.350 - (( 217 - 1 ) * 0.00625) = 470.000

See if the other frequencies fit, they do.
471.6000 = 470.000 + (( 257 - 1 ) * 0.00625)
472.3500 = 470.000 + (( 377 - 1 ) * 0.00625)

So the system has a Base (Ch 1) of 470.000 MHz with a 6.25 KHz step size. I do not know if the mapping is always divided into three parts (1 - 400, 401 - 800, 801 - 1023).

73 Eric
Reply With Quote
  #8 (permalink)  
Old 09-20-2015, 4:14 AM
rbrtklamp2's Avatar
Member
  Premium Subscriber
Premium Subscriber
 
Join Date: Dec 2005
Location: Dupage County, Illinois
Posts: 601
Default DSDPlus NXDN TRS Help

Just wondering if anybody could help me understand this formula better. I am not getting the same results. Here is the band plan I have so far the only verified frequency I have at the moment is ch 623. the others I have been trying to find using a scanner while watching the control channel Plus activity. And yes I am using DSDPlus. This is from my frequencies file.


Mode, NID, SID, CH#, RX, TX, Sort Order

NEXEDGE48, 14, 2, 128, 471.85000, 471.85000, 0
NEXEDGE48, 14, 2, 207, 472.42500, 472.42500, 0
NEXEDGE48, 14, 2, 484, 472.2125, 472.2125, 0
NEXEDGE48, 14, 2, 491, 472.25, 472.25, 0
NEXEDGE48, 14, 2, 493, 472.58125, 472.58125, 0
NEXEDGE48, 14, 2, 544, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 590, 472.7, 472.7, 0
NEXEDGE48, 14, 2, 623, 472.975, 472.975, 0, CC
NEXEDGE48, 14, 2, 734, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 837, 0.0, 0.0, 0
__________________

Stop streaming public safety comms before encryption kills our hobby!
Reply With Quote
  #9 (permalink)  
Old 09-20-2015, 12:06 PM
mmckenna's Avatar
Member
   
Join Date: Jul 2005
Location: WTVLCA01DS0
Posts: 8,535
Default

Quote:
Originally Posted by slicerwizard View Post
There is no reason for the outbound (repeater TX) transmissions to include ESN data. Even inbound shouldn't need it - authentication doesn't need to send the secret data (the ESN) in the clear - or at all.
A year late with this comment, but I just saw it.

I think this may be incorrect.
I run a NexEdge trunked system and I think the subscriber units do send their ESN in with transmissions. The NexEdge systems can be set up to match the radio ESN to the Radio ID as a method of subscriber access control. I know for sure if you program the system to do this it will reject a radio call if the UID and the radio ESN it's tied to do not match.
There are 3 methods in the Kenwood systems:
1. No ESN validation.
2. Manufacturer validation (68 for Kenwood)
3 Full validation, ESN and UID must match.

I'm running my system with the full ESN validation. For a radio to connect and even hear traffic, the UID has to be programmed into the system. The UID set up has a field where I enter the radios ESN number. If either of those is missing or wrong, the radio won't receive traffic, won't be allowed to connect to the system, and won't be allowed to transmit.
Since the ESN/s seem to be hardcoded into the radio, I'm not sure if there is any way to hack around this.

At least it helps keep all my customers honest.
Reply With Quote
  #10 (permalink)  
Old 09-22-2015, 12:32 AM
Member
   
Join Date: Sep 2002
Location: Toronto, Ontario
Posts: 4,412
Default

Nothing you wrote requires that the actual ESN be transmitted on any easily monitored inbound or outbound RF channel.

The NXDN specs are freely available. From TS 1-A:

6.4.2.8: system sends (random) 16 bit authentication parameter

6.4.2.9: subscriber unit sends back 56 bit authentication value

No mention of an ESN going over the air.
Reply With Quote
  #11 (permalink)  
Old 09-22-2015, 1:01 AM
mmckenna's Avatar
Member
   
Join Date: Jul 2005
Location: WTVLCA01DS0
Posts: 8,535
Default

I haven't read the NXDN specs that closely, I'm sure you are correct.

I do have my trunked system set up to control access, and it requires the ESN for each and every radio to be in the system. How it handles that is something I'd need to research.
Without the ESN -and- the UID matching to what is in the system, the individual radios will not connect to the system, won't even receive traffic.

Some day when I have the time, I'll have to dig into the NXDN specs more than I have.
Reply With Quote
  #12 (permalink)  
Old 09-22-2015, 10:29 AM
Forts's Avatar
Mentor
  RadioReference Database Admininstrator
Database Admin
Audio Feed Provider
Audio Feed Provider
 
Join Date: Dec 2002
Location: Strathroy, Ontario Canada
Posts: 5,464
Default

Quote:
Originally Posted by rbrtklamp2 View Post
Just wondering if anybody could help me understand this formula better. I am not getting the same results. Here is the band plan I have so far the only verified frequency I have at the moment is ch 623. the others I have been trying to find using a scanner while watching the control channel Plus activity. And yes I am using DSDPlus. This is from my frequencies file.


Mode, NID, SID, CH#, RX, TX, Sort Order

NEXEDGE48, 14, 2, 128, 471.85000, 471.85000, 0
NEXEDGE48, 14, 2, 207, 472.42500, 472.42500, 0
NEXEDGE48, 14, 2, 484, 472.2125, 472.2125, 0
NEXEDGE48, 14, 2, 491, 472.25, 472.25, 0
NEXEDGE48, 14, 2, 493, 472.58125, 472.58125, 0
NEXEDGE48, 14, 2, 544, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 590, 472.7, 472.7, 0
NEXEDGE48, 14, 2, 623, 472.975, 472.975, 0, CC
NEXEDGE48, 14, 2, 734, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 837, 0.0, 0.0, 0
I could be that this system is running a custom bandplan perhaps? I'm not sure how FCC lookups work over there but is it possible to look up one of these frequencies and find the others associated with the same system? For us here in Canada it's usually pretty easy to lookup via callsign/licensee name etc and find all the associated frequencies.
__________________
Middlesex County/Strathroy-Caradoc Fire Paging Alerts: http://groups.google.com/group/middlesex-fire
Reply With Quote
  #13 (permalink)  
Old 09-22-2015, 3:28 PM
RonnieUSA's Avatar
Member
  Shack Photos
Shack photos
 
Join Date: Aug 2005
Location: Rowan County,KY (Morehead)
Posts: 2,143
Default

Quote:
Originally Posted by Forts View Post
I could be that this system is running a custom bandplan perhaps? I'm not sure how FCC lookups work over there but is it possible to look up one of these frequencies and find the others associated with the same system? For us here in Canada it's usually pretty easy to lookup via callsign/licensee name etc and find all the associated frequencies.
I think this is who it is.

ULS License - Industrial/Business Pool, Trunked License - WPLV256 - A BEEP, LLC
__________________
PSR-800 - BCT15X - FreeSCAN - NooElect R820T2+ SDR - NooElect R820T2 SDR - DSDPlus Fast Lane
Reply With Quote
  #14 (permalink)  
Old 09-22-2015, 10:44 PM
rbrtklamp2's Avatar
Member
  Premium Subscriber
Premium Subscriber
 
Join Date: Dec 2005
Location: Dupage County, Illinois
Posts: 601
Default

Quote:
Originally Posted by RonnieUSA View Post
Could you please post the frequency information for me it will not bring up the page for me when I click on the link.

Thanks,
Bob
__________________

Stop streaming public safety comms before encryption kills our hobby!
Reply With Quote
  #15 (permalink)  
Old 09-22-2015, 11:57 PM
Member
  RadioReference Database Admininstrator
Database Admin
 
Join Date: Dec 2002
Location: San Diego County, California
Posts: 2,284
Arrow

Visit this page and type in the FCC Callsign.
http://wireless2.fcc.gov/UlsApp/UlsS...rchLicense.jsp
or
https://www.radioreference.com/apps/...llsign=WPLV256
Reply With Quote
  #16 (permalink)  
Old 09-23-2015, 2:11 AM
rbrtklamp2's Avatar
Member
  Premium Subscriber
Premium Subscriber
 
Join Date: Dec 2005
Location: Dupage County, Illinois
Posts: 601
Default

well the page opened for me now I don't know what was wrong earlier. Anyway yes that is the system, I saw that over the weekend. but that license only covers 8 frequencies and site 14-6 consists of 10 frequencies leaving me 2 short and unable to match anything definitively against the channel numbers which seem to be random. So short of searching the T-Band and possibly the 450 bushiness band I am out of ideas does anyone else have any info on the new A-Beep digi talk system?
__________________

Stop streaming public safety comms before encryption kills our hobby!
Reply With Quote
  #17 (permalink)  
Old 09-23-2015, 11:41 AM
Member
  RadioReference Database Admininstrator
Database Admin
Amateur Radio Operator
Amateur Radio
 
Join Date: Nov 2002
Location: Boston, Ma
Posts: 2,085
Default

Quote:
Originally Posted by rbrtklamp2 View Post
Just wondering if anybody could help me understand this formula better. I am not getting the same results. Here is the band plan I have so far the only verified frequency I have at the moment is ch 623. the others I have been trying to find using a scanner while watching the control channel Plus activity. And yes I am using DSDPlus. This is from my frequencies file.


Mode, NID, SID, CH#, RX, TX, Sort Order

NEXEDGE48, 14, 2, 128, 471.85000, 471.85000, 0
NEXEDGE48, 14, 2, 207, 472.42500, 472.42500, 0
NEXEDGE48, 14, 2, 484, 472.2125, 472.2125, 0
NEXEDGE48, 14, 2, 491, 472.25, 472.25, 0
NEXEDGE48, 14, 2, 493, 472.58125, 472.58125, 0
NEXEDGE48, 14, 2, 544, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 590, 472.7, 472.7, 0
NEXEDGE48, 14, 2, 623, 472.975, 472.975, 0, CC
NEXEDGE48, 14, 2, 734, 0.0, 0.0, 0
NEXEDGE48, 14, 2, 837, 0.0, 0.0, 0
Hello,

You really need to get at least two frequencies confirmed to start making sense of the frequency map. This appears to be a custom map. The hundreds of values can be custom set to any valid frequency. I have seen maps where the lower channel numbers are the original sites in ascending frequency order. Frequencies of new sites that were not already in the map were added at the end.

A site could be under multiple licenses and a license could cover different system types. Also with 12.5 KHz or 25 KHz wide channel allocations, the user can offset from the assigned frequency and have two channels.

Step sizes are usually multiples of 2.5 KHz for VHF or 3.25 KHz for UHF and higher, with 6.25 KHz and 12.5 KHz commonly used for UHF.

If the map has a 12.5 KHz step then the "base" (channel 1) would be
465.2 = 472.975 - ((623 -1) * 0.0125)
This is not a good base because it covers the repeater input side of 460.0.

If the map has a 6.25 KHz step then the "base" (channel 1) would be
469.0875 = 472.975 - ((623 -1) * 0.00625)
This base frequency is also suspect.

Finally try the 3.125 KHz step
471.03125 = 472.975 - ((623 -1) * 0.003125)
This appears good as it is in the repeater output part of the band.

The next step is to try out the base on the channel map.
NEXEDGE48, 14, 2, 128, 471.428125, 474.428125, 0
NEXEDGE48, 14, 2, 207, 471.675000, 474.675000, 0
NEXEDGE48, 14, 2, 484, 472.540625, 475.540625, 0
NEXEDGE48, 14, 2, 491, 472.562500, 475.562500, 0
NEXEDGE48, 14, 2, 493, 472.568750, 475.568750, 0
NEXEDGE48, 14, 2, 544, 472.728125, 475.728125, 0
NEXEDGE48, 14, 2, 590, 472.871875, 475.871875, 0
NEXEDGE48, 14, 2, 623, 472.975000, 475.975000, 0, CC
NEXEDGE48, 14, 2, 734, 473.321875, 476.321875, 0
NEXEDGE48, 14, 2, 837, 473.643750, 476.643750, 0

This does not appear to be valid as only the control channel matches. The last two channels are out of the repeater output range.

You need to search the other site frequencies and see if any become active when the channel gets assigned. I would also try other frequencies licensed to that location.

73 Eric
Reply With Quote
  #18 (permalink)  
Old 09-23-2015, 12:17 PM
vince48's Avatar
Member
  Premium Subscriber
Premium Subscriber
 
Join Date: May 2001
Location: Hayward, CA.
Posts: 772
Default

Eric,
wow, that's a lot of moving parts to these systems
Reply With Quote
  #19 (permalink)  
Old 09-24-2015, 12:13 AM
rbrtklamp2's Avatar
Member
  Premium Subscriber
Premium Subscriber
 
Join Date: Dec 2005
Location: Dupage County, Illinois
Posts: 601
Default

Wow tell me about it. I think they are custom band plans but I will keep trying Eric's formula is a great starting point though. For right now I am going through the UHF bands and mapping control channels. The only way I can think of to decisively find the voice channels is to keep my PSR800 feeding audio into DSD while watching the CC event screen and matching RANs to Trunked sites.
__________________

Stop streaming public safety comms before encryption kills our hobby!
Reply With Quote
  #20 (permalink)  
Old 09-24-2015, 12:14 PM
Member
  RadioReference Database Admininstrator
Database Admin
Amateur Radio Operator
Amateur Radio
 
Join Date: Nov 2002
Location: Boston, Ma
Posts: 2,085
Default

Quote:
Originally Posted by rbrtklamp2 View Post
Wow tell me about it. I think they are custom band plans but I will keep trying Eric's formula is a great starting point though. For right now I am going through the UHF bands and mapping control channels. The only way I can think of to decisively find the voice channels is to keep my PSR800 feeding audio into DSD while watching the CC event screen and matching RANs to Trunked sites.
Hello,

The channel map is the same for all sites in the system, so can you post the information on the other sites for this system?

73 Eric
Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT -5. The time now is 10:39 AM.


Powered by vBulletin® Version 3.8.2
Copyright ©2000 - 2018, vBulletin Solutions, Inc.
All information here is Copyright 2012 by RadioReference.com LLC and Lindsay C. Blanton III.Ad Management by RedTyger
Copyright 2015 by RadioReference.com LLC Privacy Policy  |  Terms and Conditions