Tagged: POCSAG

Forwarding Pager Messages Received with an RTL-SDR to Email

Over on YouTube Jack Riley has created a video that documents his system which uses an RTL-SDR to receive POCSAG pager messages and forward messages sent to specific pager addresses to an email address. He uses his RTL-SDR on a Raspberry Pi, together with rtl_fm and multimon-ng to receive and decode the pager messages.

Then using a custom program that is available on his website he filters messages for a particular 'capcode' which indicates the address of a particular pager. When a pager message to the specified capcode address is received, the program turns the message into an email which is instantly sent out.

This is a nice way to forward pager messages on to a more modern device such as a smart phone.

Creating a Pager using a Raspberry Pi and RTL-SDR to send alerts via Email.

Hacker Warehouse Demonstrates Pager Decoding with an RTL-SDR

Over on YouTube the web show Hacker Warehouse have created a video explaining wireless pagers and how RTL-SDRs can be used to sniff them. In the video host Troy Brown starts by explaining what pagers are and how they work, and then he shows how to decode them with SDR# and PDW. We have a tutorial on this project available here too.

Later in the video he shows some examples of pager messages that he's received. He shows censored messages such as hospital patient data being transmitted in plain text, sports scores, a memo from a .gov address claiming allegations of abuse from a client, office gossip about a hookup, a message about a drunk man with a knife, a message from a Windows server with IP address and URL, a message from a computer database, and messages from banks.

In the past we've also seen an art installation in New York which used SDR to highlight the blatant breach of privacy that these pager messages can contain.

Decoding Pager Data with RTLSDR - Tradecraft

Art Installation Eavesdrops on Hospital Pagers with a HackRF

HolyPager Art Installation. HackRF One, Antenna and Raspberry Pi seen under the shelf.
HolyPager Art Installation. HackRF One, Antenna and Raspberry Pi seen under the shelf.

For a long time now it has been known that pager data is sent in the clear and in plain text over a strong and easily received RF signal. The signal can easily be intercepted with a standard scanner radio or more recently with an SDR such as the RTL-SDR. Software such as PDW can then be used to decode the signal into plain text. We have a tutorial on this available here.

In these more modern days of cell phones and secure text messaging very few people still use pagers. But one heavy user of pagers is the medical community who still prefer them as they are already widely implemented in hospitals and are very reliable. The lower frequencies and high transmission powers used by pager systems allows for better reception especially in areas prone to poor cellphone reception such as in big buildings like hospitals with many walls underground areas. They are also very reliable as they receive messages instantly, whereas text messages can be delayed in times of high network traffic which is obviously a problem when a doctor is needed urgently. Finally, another advantage is that most pagers only receive, so there are no local transmissions that could interfere with sensitive medical machines. A major downside however is that pager use means that a lot of very private patient data can be easily intercepted by anyone anywhere in the same city as the hospital.

Back in October artist and programmer Brannon Dorsey displayed an art installation at the Radical Networks conference in Brooklyn which he calls Holypager. The idea is to bring attention to the breach of privacy. The installation simply prints out the pager messages as they are sent in real time, accumulating patient data that any visitor can pick up and read. He doesn't mention it on his page, but in one of the photos we see a HackRF One, antenna and Raspberry Pi hiding underneath the installation which is how the pager messages are received. A simple RTL-SDR could also be used as the receiver. Brannon writes:

Holypager is an art installation that intercepts all POCSAG pager messages in the city it resides and forwards them to one (holy) pager. The installation anonymizes all messages and forwards them randomly to one of three pagers on display. Each message is also printed on a contiguous role of receipt paper amassing a large pile of captured pages for gallery goers to peruse.

Pagers use an outdated protocol that requires all messages to be broadcast unencrypted to each pager in the area. It is the role of the individual pager to filter and display only the messages intended for its specific address. The pagers below have been reprogrammed to ignore this filter and receive every message in the city in real time. Today, these devices are primarily used in hospitals to communicate highly sensitive information between doctors and hospital staff.

Given the severity of the HIPPA Privacy Act, one would assume that appropriate measures would be taken to prevent this information from being publicly accessible to the general public. This project serves as a reminder that as the complexity and proliferation of digital systems increase the cultural and technological literacy needed to understand the safe and appropriate use of these systems often do not.

Holypager

[Also seen on Hackaday and Motherboard]

PagerMon: A browser based app for displaying pager messages from multimon-ng

Thank you to Dave for submitting information about his new pager message display software called PagerMon. PagerMon is a web browser based tool for displaying POCSAG pager messages decoded by multimon-ng. It is based around nodejs and uses a sqlite database for storing the messages. Multimon-ng is an RTL-SDR compatible digital mode decoder which can decode multiple protocols including POCSAG pagers.

PagerMon and the features and future features are listed below:

PagerMon is an API driven client/server framework for parsing and displaying pager messages from multimon-ng.

It is built around POCSAG messages, but should easily support other message types as required.

The UI is built around a Node/Express/Angular/Bootstrap stack, while the client scripts are Node scripts that receive piped input.

Features

  • Capcode aliasing with colors and FontAwesome icons
  • API driven extensible architecture
  • Single user, multiple API keys
  • SQLite database backing
  • Configurable via UI
  • Pagination and searching
  • Filtering by capcode or agency
  • Duplicate message filtering
  • Keyword highlighting
  • WebSockets support – messages are delivered to clients in near realtime
  • Pretty HTML5
  • May or may not contain cute puppies

Planned Features

  • Multi-user support
  • Other database support (MongoDB and DynamoDB planned)
  • Horizontal scaling
  • Enhanced message filtering
  • Bootstrap 4 + Angular 2 support
  • Enhanced alias control
  • Graphing
  • Push notifications
  • Non-sucky documentation

The GitHub readme has a getting started section which shows how to set up the server and get it running on your local machine.

PagerMon displaying POCSAG messages
PagerMon displaying POCSAG messages

Listening in on Burger Pagers with the RTL-SDR

Oona has written on her blog www.windytan.com about how she used an RTL-SDR to listen in on those wireless devices that are given out at some restaurants and cafes to notify you when your food is ready.

While at a local burger chain she found a label on the back of the device given to her which specified the radio frequency used by the device. By tuning to that frequency with her RTL-SDR, she discovered that the device uses the POCSAG protocol, which is the same protocol that is used by pagers. She then decoded the data packet and found that it contains the device address, which is used to notify the correct device.

burgerPagerpocsagBurger

Decoding Pagers on the Raspberry Pi with RTL-SDR

Hackaday has brought to attention a tutorial written on the Raspberry Pi forums by Sonny_Jim showing how to decode pager transmissions on the Raspberry Pi. In the tutorial he also shows how to set up a web server to be able to view the decoded transmissions in a web browser.

He uses a RTL-SDR and Raspberry Pi and pipes the output of rtl_fm into the multimonNG software to decode the messages.

RTL-SDR Tutorial: POCSAG Pager Decoding

The RTL-SDR software defined radio combined with SDRSharp, and a POCSAG/Flex capable decoding application can be used to decode pager messages. With this setup you can receive pager messages from all pager users on the system. If you don't know what a pager is, since they are now uncommon, here is a brief explanation from Wikipedia:

A pager is a wireless telecommunications device that receives and displays numeric or text messages, or receives and announces voice messages.

Not many people use pagers these days with mobile phone text messaging being used more, but pagers are still popular with doctors, hospitals in general, some fire and ambulance agencies and various IT companies, as they tend to be more reliable and have greater coverage. 

A Pager
A Pager

Privacy and Security

Obviously a lot of messages sent through pagers are plain text and contain personal data. Especially messages from hospitals. This is a concern as it is a major breach of patient privacy.

Security concerns also stem from the fact that many IT companies set up systems that forward notices of emails being received with the subject line visible, and system messages that contain IP addresses, email addresses and names, database error messages, and URLs.

Previously an art installation in New York was set up with an SDR to try and highlight some of the privacy and security concerns that pager use brings.

We note that in most countries it is perfectly legal to receive pager messages, as they are plain text unencrypted, but it is illegal to share or act on the information received. In some countries it may be illegal to even set up a receiver. Please research and respect your local laws before attempting this project.

Examples

Here YouTube user nerdymark shows 18 minutes of pager decoding using SDRSharp, PDW and an RTL-SDR.

18 Minutes of Pager Traffic 2012 July 12 San Jose rtlsdr sdr# pdw flex

Tutorial

While directed at the RTL-SDR, this tutorial may also be useful for use with other software defined radios such as the Funcube dongle, Airspy and HackRF, or even traditional hardware radios with a discriminator tap.

Since pager signals are usually transmitted at a very strong power, usually almost any antenna will work to receive them, even the stock antenna that comes with the dongle. Pager frequencies differ among different countries. Usually they will be anywhere from 137 - 160 MHz, around ~450 MHz, or around 900 MHz. Check radioreference.com or Google for frequencies in your area, or just search for them manually - they are usually quite easy to spot. Pagers normally use either the POCSAG or FLEX protocols, and the signals will look on a waterfall something like the signal shown below. They also have a distinctive sound when played with NFM mode. A sound sample is also shown below.

POCSAG Waterfall Image
POCSAG Waterfall Image

For this tutorial, you will need to have an RTL-SDR dongle set up and working with SDRSharp. We will assume you have this much done already. If you do not, visit the Buy RTL-SDR page, and then the Quickstart guide. You will also need to have an audio piping method installed and set up. Audio piping will allow the audio from SDRSharp to be passed to a decoding program. You can use either windows stereo mixVB-cable (free) or Virtual Audio Cable (paid with trial version). 

Now, to decode the POCSAG or Flex signals, you need need to download and install a free program called PDW, which can be downloaded from this page, then follow these steps.

  1. Open SDRSharp and set the audio piping method to the one you will use under the Audio Output drop down box and then press Play.
  1. Tune to a pager POCSAG/Flex signal. Set the receive mode to NFM, filter bandwidth to 12500 Hz, filter order to 10, turn squelch OFF and filter audio OFF. Adjust the RF gain settings under the configure menu until good reception is achieved.
  1. Open PDW. You may initially receive some errors upon first opening it, but they can be safely ignored. Go to Options -> Options and Click Enable Pocsag Decoding, and ensure the 512, 1200 and 2400 boxes are all checked. Also, ensure Enable Flex Decoding is enabled and that the 1600, 3200 and 6400 boxes are all checked. Press OK.

PDW Enable POCSAG

  1. Go to Interface -> Setup. Enable the Soundcard checkbox, set the Configuration to Custom, and choose your audio piping method in the Soundcard drop down box. If you only have one audio piping method enabled in the Windows recording properties, it will automatically choose that method. Press OK.

PDW Soundcard Interface Setup

  1. Go to Monitor, and ensure POCSAG/FLEX is ticked.
  1. Now, if everything is set up correctly, the pager audio from SDRSharp should be being sent to PDW. In the top right hand corner of PDW, there should be a volume gauge. You will need to adjust the volume settings in SDRSharp, and/or the Windows volume settings so that the volume meter goes up when a pager signal is sent. The percentage shown below the gauge shows the decode error rate. If you are receiving good signals the error rate should be very low and the percentage should be at or near 100%.

PDW Decoding

Other Decoding Software

MultimonNG is a Linux based decoder which is lightweight enough to run on a Raspberry Pi using rtl_fm.

PagerMon is a app that records and displays all messages from MultimonNG in a nice web page.

Some Tips

  • Pager signals are generally very strong, and so almost any antenna can pick them up - even the stock antenna included with many dongle packages. However, if you live far away from the transmitter a better antenna matched to the pager frequency you want to monitor may be required.
     
  • If reception is very poor, you may get some garbled messages in the PDW window.
     
  • Since pagers can be so strong, you may actually need to reduce the RF gain to clearly discern between a real pager and an image. Reducing the gain may also help decoding if it is so strong that it begins overloading in the RF spectrum.
     
  • Sometimes setting the volume too loud can cause the pager audio signal to become distorted. Make sure you do not have the audio set too loud.

 

If you enjoyed this tutorial you may like our book available on Amazon. Available in eBook and physical formats.

The Hobbyist's Guide to the RTL-SDR: Really Cheap Software Defined radio.

 

Radio Signal Identification Guide

NOTE: Recent changes to WordPress seem to have broken the audio on this page. Please use the new Signal Identification Wiki which has many new signals. Anyone can edit and improve the information on the pages on the wiki.

A guide to help you identify some amateur and utility digital radio signals and sounds which you may find on the frequency spectrum. Most of these have been received with an RTL-SDR software defined radio. I will be slowly adding more to this list over time. If you enable stereo mix and pass the sample audio to an appropriate decoding program the sample audio should be decodable for most samples.

If you would like to suggest a modification or contribute a sample, please send a sample, waterfall image and information about the signal to [email protected], or post in the comments. (Note I am currently backlogged with contributed signals, if I haven’t replied or added your signal yet it will be done within a month or two).

More sites with sample audio can be found at this list on dxzone.com. A very nice overview video of the HF spectrum by balint can be found here. There are also two paperback books: Technical Handbook for Radio Monitoring VHF/UHF (PDF Excerpt) & Technical Handbook for Radio Monitoring HF (PDF Excerpt) which have a very comprehensive list, description and images of many signals.

ACARS

Sample Audio:

Typical Frequency: 131.550 MHz

Mode: AM

Bandwidth: 5000-8000 Hz

Description: Aircraft Communications Addressing and Reporting System (ACARS). Short messages sent to and from aircraft.

Decoding Software: PlanePlotter, ACARSD

Video Examples: [1], [2]

ACARS Packets

P25 Phase 1 (C4FM Modulation) (Encrypted)

Sample Audio:

Typical Frequency: ~860 MHz, ~500 MHz + others

Mode: NFM

Bandwidth: 10000 Hz

Description: P25 encrypted digital voice signal with C4FM modulation.

Decoding Software: Digital Speech Decoder (DSD). Note, only unencrypted can be decoded.

Video Examples:  [1], [2][3]

P25 Waterfall Example

DMR/MotoTRBO

Sample Audio:

Typical Frequency: ~860 MHz

Mode: NFM

Bandwidth: 10000 Hz

Description: Motorola digital voice signal known as MotoTRBO (pronouced Moto-Turbo).

Decoding Software: Digital Speech Decoder (DSD). Note, only unencrypted can be decoded.

Video Examples: [1], [2]

DMR/MOTOTRBO Signal Waterfall

POCSAG/FLEX-A

Sample Audio:

Typical Frequency: ~151 MHz, ~900-950 MHz

Mode: NFM

Bandwidth: 10000 Hz

Description: Pager digital signal known as POCSAG. An acronym of Post Office Code Standardization Advisory Group.

Decoding Software: PDW

Video Examples: [1], [2]

 POCSAG/FLEX Pager Waterfall Image

Weather Balloon (Radiosonde) Vaisala RS92SGP

Sample Audio:

Typical Frequency: ~400 MHz

Mode: NFM

Bandwidth: ~5500 Hz

Description: Weather balloon (Radiosonde) telemetry data. Only transmits during a weather balloon launch.

Decoding Software: SondeMonitor

Video Examples: [1], [2]

  RS92SGP Radiosonde Waterfall Image

TETRA Downlink

Sample Audio:

Typical Frequency: 380 – 430 MHz

Mode: –

Bandwidth: 25000 Hz

Description: Terrestrial Trunked Radio (TETRA), also know as Trans-European Trunked Radio is a professional mobile radio and two-way transceiver (walkie-talkie) specification. Modulated with π/4 DQPSK. Audio sample recorded in NFM mode.

Thanks to Jenda for the submission.

Decoding Software: osmocomTETRA

Video Examples: [1], [2]

TETRA Downlink

Trunking Control MPT1327

Sample Audio:

Typical Frequency: ~420 MHz

Mode: NFM

Bandwidth: 10000 Hz

Description: Radio trunking control channel.

Decoding Software: Trunkview, UniTrunker

Video Examples: [1]

MPT1327 Waterfall Image

Trunking Control Motorola Type II Smartnet

Sample Audio:

Typical Frequency: ~860 MHz

Mode: NFM

Bandwidth: 8000 Hz

Description: Radio trunking control channel.

Decoding Software: UniTrunker

Video Examples:

Motoroal 2F1D Trunking Channel

Trunking Control EDACS96

Sample Audio:

Typical Frequency: ~860 MHz

Mode: NFM

Bandwidth: 10000 Hz

Description: Radio trunking control channel.

Decoding Software: UniTrunker

Video Examples:

EDACS96 Trunking Channel

Trunking Control APCO P25

Sample Audio:

Typical Frequency: ~860MHz

Mode: NFM

Bandwidth: 12500 Hz

Description: Radio trunking control channel.

Decoding Software: UniTrunker

Video Examples:

APCO P25 Trunking Channel

AFSK1200

Sample Audio:

Typical Frequency: ~144 MHz

Mode: NFM

Bandwidth: 10000 Hz

Description: Audio frequency-shift keying (AFSK). Used by amateur radio hams for packet radio, Automatic Packet Reporting System (APRS) and telemetry.

Decoding Software: QTMM

Video Examples: [1]

AFSK1200

AIS

Sample Audio:

Typical Frequency:

Marine Channel 87 – 161.975 MHz
Marine Channel 88 – 162.025 MHz

Mode: NFM

Bandwidth: 12500 Hz OR 25000 Hz

Description: Automatic Identification System (AIS). Used by ships to broadcast position and vessel information. Uses 9.6 kbit GMSK modulation.

Decoding Software: ShipPlotter, AISMon (In the Files Section of the Yahoo Group)

Video Examples: [1], [2]

AIS Waterfall

NOAA Weather Satellite (APT)

Sample Audio:

Typical Frequency:

NOAA 15 137.620
NOAA 18 137.9125
NOAA 19 137.100

Mode: WFM

Bandwidth: 30000 Hz

Description: NOAA Automatic Picture Transmission (APT) signal. Used to by the NOAA weather satellites to transmit satellite weather photos.

Only transmits at certain times throughout the day when the satellite passes overhead at your location.

Decoding Software: WXtoImg

Video Examples: [1], [2], [3]

 NOAA APT Waterfall Screenshot

Stereo Wideband FM (WFM)

Sample Audio: –

Typical Frequency:

Common – 87.5 to 108.0 MHz
OIRT – 65 to 74 MHz
Japan – 76 to 90 MHz
Consumer Wireless Devices – ~860 MHz

Mode: WFM

Bandwidth: 30000 Hz

Description: Stereo Wideband FM signal. Used for typical broadcast radio, and in some wireless headsets and speakers. This particular signal is from an AKG headset.

Top signal is WFM transmitted with low amplification. Bottom signal is WFM transmitted with high amplification.

Thanks to Tobby for the submission.

Decoding Software: Unencoded

Video Examples: [1], [2]

 WFM

Amplitude Modulation (AM)

Sample Audio: –

Typical Frequency:

Long wave – 153 to 279 kHz
Medium wave – 531 to 1,611 kHz in ITU regions 1 and 3 and 540 to 1610 kHz in ITU region 2.
Short wave – 2.3 to 26.1 MHz

Aircraft – 108 to 137 MHz

Mode: AM

Bandwidth: 10000 Hz

Description: Amplitude Modulation broadcast audio radio station.

Thanks to rtlsdr_is_fun for the submission.

Decoding Software: Unencoded

Video Examples: [1], [2]

 AM Waterfall

Weatherfax (HFFAX)

Sample Audio:

Typical Frequency: HF ~3 to 16 KHz. Location dependant.

Mode: Upper side band (USB)

Bandwidth: ~1900 KHz

Description: HF Weatherfax. Used by boats for weather reports. Also Kyodo News, a Japanese newspaper transmits entire pages via HFFAX.

Decoding Software: FLDIGI

Video Examples: [1], [2]

 WeatherfaxWaterfall

Upper Side Band Voice (USB)

Sample Audio:

Typical Frequency: All HF band.

Mode: USB

Bandwidth: ~1900 Hz

Description: Single side band, specifically upper side band. Used in the HF band by amateur radio hams and aircraft weather reports. Single side band saves bandwidth.

Decoding Software: Unecoded

Video Examples: [1], [2]

 UpperSideBandWaterfall

Over the Horizon (OTH) Radar

Sample Audio:

Typical Frequency: All over HF Band

Mode: –

Bandwidth: 

Description: Over the horizon radar. Used by governments for very long range radar systems.

Decoding Software: Unencoded

 OTHRadar

Analogue PAL TV

Sample Audio:

Typical Frequency: Multiple

Mode: PAL TV

Bandwidth: 5 MHz

Description: Analogue PAL TV. Color TV signal.

Decoding Software: TVSharp

Video Examples: [1]

 Analogue PAL TV

Digital Audio Broadcast (DAB+)

Sample Audio: No Audible Sound Produced

Typical Frequency: 

Multiple channels.
Block 13F – 239.200 MHz

Mode: DAB

Bandwidth: 1,537 KHz

Description: Digital Audio Broadcast (DAB+). A type of digital broadcast radio signal, containing multiple digital radio stations in the signal.

Decoding Software: SDR-J

Video Examples: [1]

 DAB+ Digital Audio Broadcast

Baby Monitor (NFM)

Sample Audio: –

Typical Frequency: ~40 MHz, 49.5 – 50 MHz

Mode: NFM

Bandwidth: < 15 KHz

Description: NFM signal from a baby monitor. Periodically bursts signal when no audio is detected. Thanks to Dean for some extra info.

Decoding Software: Unencoded

Video Examples: [1]

 BabyMonitorNFMSpikes

Digital Radio Mondiale (DRM)

Sample Audio:

Typical Frequency: Below 30 MHz on HF, near other shortwave radio stations.

Mode: USB

Bandwidth: 10000 Hz

Description: Digital Radio Mondiale (DRM). A form of international digital shortwave radio. Replaces AM shortwave radio.

Thanks to Will P. for the contribution.

Decoding Software: DREAM, SODIRA

Video Examples: [1], [2]

 Digital Radio Monodiale Waterfall Digital Radio Monodiale Waterfall

STANAG 4285

Sample Audio:

Typical Frequency: All over HF.

Mode: USB

Bandwidth: 2500 Hz

Description: Standardization Agreement (STANAG) 4285. NATO standard for HF communication.

Decoding Software: Sorcerer (Waring: Potential Virus Alert), Sigmira

Video Examples: [1]

 STANAG 4285 Waterfall Example

GSM Downlink (Non-Hopping)

Sample Audio:

Typical Frequency: 900 MHz and 1800 MHz Band OR 850 MHz and 1900 MHz Band

Mode: –

Bandwidth: 200 KHz

Description: GSM Cell Phone Downlink (Non Hopping Signal). Audio sample used NFM mode.

Decoding Software: Airprobe

 GSM Non Hopping Waterfall Image

GSM Uplink

Sample Audio: No Audible Sound Produced.

Typical Frequency: ~890 MHz

Mode: –

Bandwidth: 200 KHz

Description: Initial connection GSM signal sent from a cellphone.

Decoding Software: 

 GSMUplinkFrequencyHopping

GSM Downlink (Hopping)

Sample Audio: No Audible Sound Produced

Typical Frequency: 900 MHz and 1800 MHz Band OR 850 MHz and 1900 MHz Band

Mode: –

Bandwidth: Each channel 200 KHz

Description: GSM cell phone hopping.

Decoding Software: 

 GSM Hopping Waterfall

“Japanese Slot Machine” (XSL)

Sample Audio:

Typical Frequency: Between 4 MHz and 9 MHz

Mode: USB?

Bandwidth:

Description: Known as the Japanese Slot Machine. Thought to be data originating from the Japanese Navy.

Decoding Software: Sigmira (But Cannot Decrypt)

Video Examples: [1], [2]

 Japanese Slot Machine Waterfall

Automatic Dependent Surveillance-Broadcast (ADS-B)

Sample Audio: No Audible Sound Produced

Typical Frequency: 1090 MHz

Mode: –

Bandwidth: 2 MHz

Description: Automatic Dependent Surveillance-Broadcast (ADS-B). Used by aircraft to broadcast their latitude, longitude and altitude.

Decoding Software: ADSB#, Dump1090, RTL1090

Video Examples: [1], [2], [3]

 ADSBWaterfallScreenShot

Cuban Numbers Station HM01

Sample Audio: 

Typical Frequency: 11.530 MHz.

Mode: AM

Bandwidth:

Description: (Previously Unidentified Signal 5). Numbers stations are thought to transmit encoded information for various spy agencies around the world. They are recognized by a voice reading a sequence of numbers or words. This is a Cuban Numbers Station which has a data portion and a voice portion. Sound sample recorded in AM mode.

Thanks to Andrew from the comments section for the ID.

Decoding Software: Information Here

Video Examples: [1], [2], [3], [4], [5]

UnknownSignalWaterfall_5

High Frequency Data Link (HFDL)

Sample Audio: 

Typical Frequency:  HF Band

Mode: USB (1440 Hz below center)

Bandwidth: ~2800 Hz

Description:  (Previously Unidentified Signal 2). An Aircraft Communications Addressing and Reporting System (ACARS) data link that aircraft use to communicate short messages over long distances using HF signals.

Thanks to Andrew from the comments section for the ID.

Decoding Software: PC-HFDL

Video Examples: [1], [2], [3]

UnknownSignalWaterfall_1

Binary Phase Shift Keying (BPSK31)

Sample Audio: 

Typical Frequency:  HF Amateur Band

Mode: SSB

Bandwidth: ~31 Hz

Description:  A digital amateur radio mode based on Phase Shift Keying (PSK) modulation

Thanks to Patrick for the submission.

Decoding Software: Fldigi, MixW, HRD Digital Master 780, MultiPSK

Video Examples: [1], [2][3]

BPSK Waterfall Example

AFSK Paging Link

Sample Audio: 

Typical Frequency: 72-76 MHz

Description: (Previously unidentified signal 10). Identified in the comments section by Ronen as an Asynchronous Frequency Shift Keying (AFSK) pager link. It is easier to transmit the FSK pager signal to the transmitter site as AFSK.

unknown_10_waterfall

Pulse Code Modulated (PCM) RC Toy Signal

Sample Audio: 

Typical Frequency: 27.145 MHz, 72 MHz

Description: (Previously unidentified signal 9). Identified in the comments section by W1BMW as a Pulse-code modulated (PCM) signal used for remote control (RC) Toys. Link to IQ file http://i.nyx.cz/files/00/00/09/99/999880_c640d91142db39ee7d57.zip?name=SDRSharp_20130613_113322Z_27186kHz_IQ.zip. Sample audio recorded in USB mode.

UnknownSigna_9

Overlapping RTTY Signals

Sample Audio: 

Typical Frequency: HF band

Description: Previously unidentified signal (11). Identified in the comments by various contributors as multiple overlapping RTTY signals sent by ham radios.

Unknown CW #3

Voice Frequency Telegraph

Sample Audio: 

Typical Frequency: 7453.50 KHz USB

Description: Previously unidentified signal (13). VFT or Voice Frequency Telegraph is one of several systems for sending multiple RTTY signals over one voice-bandwidth radio channel.

74535khzusb

Portable Traffic Lights

Sample Audio: 

Found Frequency: 154.463 MHz

Description: Previously unidentified signal (17). Identified by Peter via email as being signals sent from portable traffic lights that are often used at roadworks.

unid17

X2 on iDEN

Sample Audio: 

Found Frequency: 154.463 MHz

Description: iDEN is an acronym for Integrated Digital Enhanced Network and is a technology developed by Motorola. It is a type of trunked radio with cellular phone benefits.

Link to RR identification discussion from submission email.

Thanks to Mike (VE3HER) for the submission.

x2 on iden

Funcube-1 Satellite

Sample Audio:

Found Frequency: 145.950 – 145.970 MHz

Mode: USB

Bandwidth: ~2 kHz

Description: The Funcube-1 is a Cubesat amateur radio satellite.

Decoding Software: Funcube Telemetry Dashboard

funcube-1_waterfall

Swedish Pocsag Minicall

Sample Audio:

Typical Frequency: ~161 MHz

Mode: NFM

Bandwidth: 20 kHz

Description: A short Pocsag 1200 signal used in electric plants and remote transformer and insulation stations.

Thanks to Joni for the submission.

Decoding Software: PDW

Video Examples: [1], [2]

swedish_minicall_pocsag

Unidentified Signals

If you know what any of these signals are please write in the comments. You can also submit any unidentified signals you would like to be added to [email protected]

(1)

Sample Audio: 

Found Frequency: 171.3 MHz

Description: Recognized by DSD as a NXDN96 signal, but is disputed in the comments section. (Possibly a bug in DSD).

QPSK2

(3) – ALE?

Sample Audio: 

Found Frequency:  HF Band

Description: Sound sample recorded in USB mode. Potentially some sort of 2G ALE signal. Similar signal shown in balints HF tour video. Possible a weather map transmitted from Tokyo as noted in the comments section by Syd, or 4xFSK from China as identified by K2RCN in the comments.

UnknownSignalWaterfall_2

(4)

Sample Audio: 

Found Frequency: HF Band

Description: Periodic pulses. Sound sample recorded in USB mode. Possibly a GlobeWireless signal as identified in the comments section by K2RCN.

 UnknownSignalWaterfall_4

(6)

Sample Audio: 

Found Frequency: 152.652 MHz

Description: Continuous signal. Audio sample recorded in NFM.

UnknownSignal_6

(7)

Sample Audio: 

Found Frequency: 162.863 MHz

Description: Continuous bursts. Audio sample recorded in NFM.

UnknownSignal_7

(8)

Sample Audio: 

Found Frequency: 457.168 MHz

Description: Audio sample recorded in NFM.

UnknownSignal_8

(10)

Sample Audio: 

Found Frequency: 452.325 Mhz

Description: Sent in over email. Sounds like Motorola Type II smartnet, but Unitrunker does not recognize.

unid_10

(12)

Sample Audio: 

Found Frequency: 154.646 MHz

Description: Sent in over email. Repeats every minute.

154646

(14)

Sample Audio: 

Found Frequency: 433 MHz

Description: Sent in over email.

Hello! I was listening in the 433MHz band and saw this blip (about 1-2sec) on the waterfall on 433.873 (Millville, MA). It repeats about every 30-50 seconds, though doesn’t seem to be the same every time. Maybe a wireless instrument of some type (weather or something?). The only clear sound of it I could get was with AM, about a 4.2kHz wide filter (rtl-sdr, gqrx linux). Any ideas? Thanks!

 

(15)

Sample Audio: 

Found Frequency: 455 MHz

Description: Sent in over email.

unid15

(16)

Sample Audio: 

Found Frequency: 173.262 MHz

Description: Sent in over email.

unid16

(18)

Sample Audio: None

Found Frequency: ~856 MHz

Description: Sent in over email.

The antenna has a Yagi pointed to West from 23.5° South latitude, 47.46° West longitude.
The signal can be local or from the sky. The signal is horizontal polarized.

uid16

(19)

Sample Audio: 

Found Frequency: ~409.6 MHz

Description: Sent in over email. Recorded in NFM mode.

screen