Melb2016: Scanning the Airwaves from DC to Daylight (Part 9)

Most of my posts so far about my trip to Melbourne have been revolving around photography in a tourist sense, or as a tram-spotter. While some of the observations included some technical aspects, they were all visible and evident if you cared to observe. This post is a little different.

In this post, I will be looking at what’s “on the air” in Melbourne, using my trusty E4000-based RTL-SDR dongle and my Icom IC-R20, hunting down signals from the hotel window. As I only had a limited number of days to myself in Melbourne, I had to be most efficient about how I did my radio scanning. As a result, a lot of the analysis was done after the fact from IF-recordings I bought home for later analysis. I guess that’s the beauty of technology.

In this post, you will find my “frequency logs”, which may be out by a small amount owing to the accuracy of the RTL-SDR crystals, as well as some audio recordings representing some of the types of channels heard.

Tools

The tools I used included a trusty E4000 based RTL-SDR dongle. While it has an annoying “hump” in the middle, it was my most reliable dongle with good sensitivity all round and slightly less power consumption compared to the R820T. This one had also been pre-calibrated using kalibrate-rtl, so its offset was known to some accuracy.

This was run on a Windows laptop with SDRSharp. The latest version was used, noting that upgrading from older versions doesn’t always work properly, so I started with a fresh download. Because the integrated Recorder plugin has WAV file limitations of 2Gb, I had to use IF Recorder and File Player from rtl-sdr.ru. Manual edits to the front-end and plug-in configuration files were made to use these plugins for recording to and playing back from WAV64 files with navigation.

Digital signals were decoded with appropriate tools – for POCSAG paging, PDW and for DMR/NXDN, DSDPlus. I also gave Taxi MDT Decoder a go, with no luck, and also had Unitrunker on hand for trunking system information decoding.

To get everything connected together, a virtual audio cable is required for looping output from SDRSharp (with Filter Audio turned off and bandwidth increased to 16khz) to the decoder. I use Virtual Audio Cable myself, although other software may be just as appropriate.

For good measure, I bought along my Sony AN-LP1 antenna and my Icom IC-R20. This extends the range for my reception, while giving me another more traditional “alternative” receiver to use. One nice feature of the R20 is the ability to use the internal IC Recorder to record up to 1 hour of signals in a custom ADPCM format which can be downloaded to a PC using CS-R20 and converted back to WAV with a third party tool called icw2wav.

Of course, a decently powerful laptop and a lot of storage space is also required. Carrying a few cables and adapters are also a good idea – a fly-lead to go from the wall (PAL/F-connector) to the tuner (via a PAL to MMCX pigtail) is probably a good idea.

LF/HF & AM Broadcast Bands

What better place to start my little scanning adventure off than the low end of the radio spectrum. I was expecting to get a few NDBs, maybe a few stations here and there, as well as the usual Bureau of Meterology weather faxes along with all the regular AM stations.

Reality was harshly different. I could receive absolutely nothing in these bands. Nothing at all. It seemed that being in too high density living was adversely pushing up the noise floor to the point even a local NDB wasn’t receivable, and AM radio was totally shot.

The prime candidate seemed to be the variable speed drive used in the lift, as well as the collection of a large number of CFLs in the hotel building. Static was roaring loud, and even with the RF Gain turned down to minimum and attenuation turned on, there was nothing that could be done to receive anything. The fact I was relying on the supplied telescopic antenna didn’t help.

FM Broadcast Band

The FM broadcast band was surveyed using the RTL-SDR dongle, so I could grab some RDS information along the way. The stations heard were:

Freq    Station        RDS ID
89.9    WYN-FM         ?
90.7    Syn FM         ?
91.5    smoothfm       3915
92.3    3ZZZ           ?
91.3    SBS Radio      845C
94.9    JOY 94.9       6DF0
100.3   Nova 100       ?
101.1   KIIS1011       3111
101.9   The Fox        3101
102.7   Triple R       ?
103.5   3MBS           ?
104.3   GOLD1043       371E
105.1   Triple M       3105
105.9   ABC Classic FM ?
107.5   triple j       2D5F

This is far short of the full list of stations, but at least I know I’m in the right city now. Instead, it showed another major issue, especially on the IC-R20 – the issue of front end overload. Being in the city, especially high-up, I was either near or in the line of several different transmitters, and the IC-R20 would “desensitize” as any of them keyed up, and other times, “intermodulate” resulting in the reception of product/difference signals. I concluded that the R20 was really not that helpful especially given the RF-harsh environment. The more deaf RTL-SDR, however, seemed much more at home.

VHF Band (Air, 150Mhz)

Just as I thought the RTL-SDR would do well, it really struggled in the VHF bands. I didn’t end up hearing anything on it, so the R20 came in handy. But even the R20 struggled pretty badly.

My frequency logs showed the following:

Frequency   Description
119.8000    Essendon ATIS
148.3375    Paging
148.3625    Paging
148.5625    Hospital & Others - Mixed 1200/512 POCSAG Hutchison
148.5875    Hospital Related? 512 POCSAG ?Private
148.6375    Hospital & Others - Mixed 1200/512 POCSAG Hutchison
148.6875    Hospital/Ambo? Priv Op 512 POCSAG QD
148.9125    SES/AMBO512 POCSAG QD
148.9375    Paging
149.3250    Paging
149.3750    Paging
152.0750    2CR Chinese Cantonese Community Radio
164.8250    Trunking Control
165.6875    Trunking Voice
166.7500    Trunking Control
167.5750    Trunking Control

Because I didn’t have time during the day to listen in on the air band, the only things I could pick are those who were transmitting around the clock – namely Essendon ATIS. It was quite hard to position myself in a particular way at the window to capture that sample – one step away from the window and it was entirely noise.

Pager-Replay

There were also around 10 paging channels, all appearing to be POCSAG. A few of them appear to be Hutchison channels, and run at mixed rate 1200bps/512bps. The activity can be seen in the above screenshot with the scroll rate set to the lowest. The system messages from those frequencies which could be decoded seem to show certain patterns which imply that 148.5625 and 148.6375 are run by one entity, whereas 148.6875 and 148.9125 are run by another entity. Some of the channels showed visible activity but were too weak to be decoded. Of course, a lookup in the Radcomms database can tell you that. Some systems messages include:

148.5625Mhz
0787910 POCSAG-1  ALPHA   512  07:33 P175666.MDA
0857710 POCSAG-3  ALPHA  1200  07:33 P175666.MDA
0787910 POCSAG-1  ALPHA   512  07:34 P175666.MDA
0857710 POCSAG-3  ALPHA  1200  07:34 P175666.MDA

148.6375Mhz
0001710 POCSAG-3  ALPHA  1200  07:51 P175666.MDA
0507846 POCSAG-1  ALPHA  1200  07:51 P175666.MDA
0507846 POCSAG-1  ALPHA  1200  07:52 P175666.MDA
0001710 POCSAG-3  ALPHA  1200  07:52 P175666.MDA

148.6875Mhz
1856916 POCSAG-1  ALPHA   512  QD12 minute network heartbeat
1856916 POCSAG-1  ALPHA   512  QD12 minute network heartbeat
1856916 POCSAG-1  ALPHA   512  QD12 minute network heartbeat

148.9125Mhz
1856916 POCSAG-1  ALPHA   512  QD12 minute network heartbeat
1856916 POCSAG-1  ALPHA   512  QD12 minute network heartbeat
1856916 POCSAG-1  ALPHA   512  QD12 minute network heartbeat

A good number of messages were hospital/healthcare related, carried on both Hutchison as well as private networks. It also seems that there are SES and RFS messages as well, with the remainder being automated systems alerts for various private companies. There’s more paging activity in Melbourne than there is in Sydney, where only three channels seem to be active.

The two Hutchison/Vodafone channels had one minute interval heartbeats – this is a good thing because it keeps paging receivers aware of their coverage as their out of coverage warning is only a simple “no messages received in X minutes” timer. It also can allow for equipment to set their time as well, as a time-stamp is included. The latter channels with QD12 minute network heartbeat seem to prefix all messages with a two-letter code (e.g @@, Hb, QD etc). The system messages are even addressed to the same capcode. 148.5875Mhz did not have any system messages with a very low traffic load, but prefixed all its messages with a time.

It seems that the VHF ethnic radio “narrowcast” spectrum is also used, with 2CR being heard on the air. The snippet says something like “Using all our efforts, to achieve such excellent results, 2CR Australian Chinese radio.”

There were a few trunking systems in the upper end of the VHF band, but nothing that I recorded. I didn’t hear any action on the amateur 2m band, which was unfortunate.

400Mhz Band

The 400Mhz band is amongst the most crowded bands in Australia, owing to its popularity for land-mobile usage, be it in company vans or in hand-held transceivers. The band offers a good mixture of propagation characteristics and physical size requirements. As a result, everyone from security, public service, transportation, couriers, taxis, etc use this band. Formerly, the band was also ripe for scanning with lots of action to hear.

Unfortunately, due to a lack of space in the band (even when taking away a little of the 70cm amateur band for governmental agency use), there has been a push for higher spectral efficiency to squeeze more conversations into the same bandwidth. To meet future requirements for spectral efficiency, this has necessitated the move to digital radio technologies, with very little analog NFM audio left. This also adds a secondary wrinkle to scanner enthusiasts – with so many standards, it’s not possible to buy a scanner that supports every digital system. Furthermore, due to the ease of configuring and enabling encryption, many of the channels on the air cannot be listened to like former analogue transmissions.

The effects can be seen in the list of logged frequencies and transmissions.

Frequency   Description
412.4625    DMR Voice Channel
413.8250    OFDM 16k wide data?
414.5000    DMR Voice Channel
416.5625    DMR Trunking Control
416.8250    Continuous AFSK Data
416.9000    Burst FSK Data (Taxi Pager?)
417.0150    Burst FSK Data (Taxi Pager?)
417.0250    Burst FSK Data (Taxi Pager?)
417.6125    P25 Trunking Control
417.6375    P25 Trunking Control
417.7875    P25 Unencrypted Voice NAC 162
417.8000    Continuous AFSK Data
418.0625    NFM Voice Maxi Taxi Request + Unkey Burst
418.1250    Weak beep
418.1500    Weak beep
418.1750    Weak beep
418.2500    Weak beep
418.4500    Weak beep
418.7500    Weak beep
419.0500    Weak beep
419.8125    P25 Voice Channel
419.9625    Weak P25 Voice Channel
420.0125    P25 Trunking Control
420.0375    P25 Trunking Control
420.1625    P25 Voice Channel NAC 161 Ambulance?
420.4625    P25 Voice Channel NAC 161 Ambulance?
420.4875    P25 Voice Channel NAC 162
420.6125    P25 Voice Channel NAC 161 Encrypted
420.6375    P25 Voice Channel NAC 162 Encrypted
420.7125    P25 Voice Channel NAC 161 Encrypted
421.2625    P25 Voice Channel NAC 161 
421.3125    P25 Voice Channel NAC 162 Encrypted
421.3375    P25 Voice Channel NAC 161 Encrypted
421.4125    P25 Voice Channel NAC 161 Encrypted
421.5625    P25 Voice Channel NAC 161 
421.6125    P25 Voice Channel NAC 162 Encrypted
421.6375    P25 Voice Channel NAC 161 Encrypted
421.7125    P25 Voice Channel NAC 161 Encrypted
421.7625    P25 Voice Channel NAC 162 Encrypted
421.8625    P25 Voice Channel NAC 161 
421.9125    P25 Voice Channel NAC 161
421.9375    P25 Voice Channel NAC 161 
422.0375    P25 Voice Channel NAC 161 Encrypted
422.0375    P25 Voice Channel NAC 161
422.0625    P25 Voice
422.2125    P25 Voice Channel NAC 162
422.2375    P25 Voice Channel NAC 161
422.3375    P25 Voice Channel NAC 161 Encrypted
422.3625    P25 Voice Channel NAC 161
422.5125    P25 Voice Channel NAC 162
422.5375    P25 Voice Channel NAC 161
422.6375    P25 Voice Channel NAC 161 Encrypted
422.8375    P25 Voice Channel NAC 161
422.9375    P25 Voice Channel NAC 161 Encrypted
424.1625    P25 Voice Channel NAC 162
424.2625    P25 Voice Channel NAC 161
424.3125    P25 Voice Channel NAC 162
424.3375    P25 Voice Channel NAC 161 Encrypted
463.5125    Weak?
463.5500    DMR Voice/Data
463.6500    DMR Voice/Data
466.8750    DMR Voice/Data
467.1500    DMR Voice/Data
467.9000    P25 Voice Channel NAC 161 
467.9250    P25 Voice Channel NAC 162 Encrypted
468.2000    P25 Voice Channel NAC 161 Encrypted
468.2250    P25 Voice Channel NAC 162
468.2250    P25 Voice Channel NAC 162 Encrypted
468.5000    P25 Voice Channel NAC 161 Encrypted
468.5250    ?
468.7500    ?
468.7688    Periodic Carrier Burst
468.8250    P25 Voice Channel NAC 162 Encrypted
469.1000    P25 Voice Channel NAC 161 Encrypted
469.9250    DMR Voice/Data
470.1500    ?
470.2500    DMR Voice/Data
470.3250    DMR Voice/Data
470.4250    DMR Trunking Control
470.4500    DMR Voice/Data
470.5500    DMR Voice/Data
472.0938    Weak?
472.1000    Weak
472.3250    DMR Voice/Data
472.4500    Carrier Pips
472.7500    NXDN Trunking Control 4800bps
472.8500    NXDN Voice
473.0750    DMR Voice/Data
473.1500    DMR Trunking Control
473.3250    NXDN Voice
473.4500    NXDN Voice
473.5188    Weak?
473.8250    DMR Voice/Data
474.1250    Weak?
476.5750    NFM CB
478.0500    NXDN Voice
478.1500    Rapid intermittent bursts of data?
485.7750    DMR Voice/Data
486.1250    Intermittent bursts of data
486.9750    Data with intermittent beep (Taxi?)
487.1250    NFM Voice
487.9250    NFM Trunked Sub-audible Tone
488.3250    P25 NAC 141 Encrypted
488.3750    V strong carrier bursts
488.5000    NFM Taxi Voice
488.5250    NFM Weak Voice
488.5500    Data with intermittent beep (Taxi?)
488.6750    DMR Voice/Data
488.7500    Data with intermittent beep (Taxi?)
488.7750    NFM Voice
488.9750    DMR Data Bursts
489.9750    Data with intermittent beep (Taxi?)
490.0500    NXDN Voice Bus
490.6625    NXDN Voice Bus
490.7500    Weak beep
490.9250    NXDN Voice Bus
491.2063    ?
491.2250    NXDN Trunking Control 4800bps
491.3250    ?
491.3250    ?
492.3000    Carrier Pips
492.6000    Carrier Pips
492.6750    DMR Voice/Data
494.0000    DMR Voice/Data
494.5875    DMR Voice/Data
494.1000    Weak beep
493.0125    NXDN Voice
501.1375    Data with intermittent beep (Taxi?)
501.2000    Data with intermittent beep (Taxi?)
501.5000    DMR Voice/Data
501.6000    Data AFSK
501.7250    NFM Voice
501.8000    DMR Voice/Data
502.1000    DMR Voice/Data
502.1375    Weak Beep
503.5250    P25 NAC 16A Trunking Channel
503.4750    ?
503.5500    P25 Voice Channel NAC 16A Encrypted
503.6000    ?
503.6250    ?
503.7250    ?
503.7500    P25 Voice Channel NAC 16A Encrypted
503.8250    P25 Voice Channel NAC 16A Encrypted
504.6875    NFM Voice
504.9625    Dead Carrier
503.9063    Periodic Data Burst
504.6125    Data with intermittent beep (Taxi?)
504.6250    Data with intermittent beep (Taxi?)
504.6500    Data with intermittent beep (Taxi?)
504.6625    Data with intermittent beep (Taxi?)
504.6750    Data with intermittent beep (Taxi?)
505.6375    DMR Voice/Data
507.2250    Data AFSK
507.3750    DMR Voice/Data
507.5000    Data AFSK
507.5500    Data AFSK
507.5750    Data AFSK
507.2000    NFM Voice
507.8750    Data AFSK
508.5250    DMR Voice/Data
508.8500    Data Pips
509.1500    Data Pips
509.0500    DMR Voice/Data
511.2000    Carrier Pips
511.1375    Strong Bursts
509.1500    Carrier Pips
509.1750    Carrier Pips
511.2750    NFM Voice
509.4250    DMR Voice/Data
517.5000    Infrequent Short Data Bursts (Taxi?)
517.5500    Infrequent Short Data Bursts (Taxi?)
517.5750    Infrequent Short Data Bursts (Taxi?)
517.8750    Infrequent Short Data Bursts (Taxi?)
518.7375    Infrequent Short Data Bursts (Taxi?)
519.0375    Infrequent Short Data Bursts (Taxi?)
519.0625    Infrequent Short Data Bursts (Taxi?)
519.1125    Infrequent Short Data Bursts (Taxi?)

It seems there is a governmental system or similar in the low end of the band, just like in Sydney, using APCO P25 Phase 1 technologies. Two P25 networks with different NACs can be seen in the low end of the band, with another P25 network further up the band. That’s more P25 systems than we get in Sydney (one, the Government Radio Network as far as I’m aware). The dedicated P25 trunking control channel like this, while an audio channel sounds like this. The samples are of high enough quality to decode back into audio with DSDPlus. Of course, the channels themselves are not encrypted or unencrypted, but the talkgroups are. The frequency of occurring the encrypted/unencrypted transmission as surveyed gives you an idea of the proportion of transmissions that actually are encrypted, which doesn’t bode well for the scanner enthusiast.

The next most popular digital mode is DMR (also sold as MotoTRBO). A dedicated control channel sounds like this, whereas a data transmission sounds like this and actual decodable DMR voice sounds like this. Without a suitable decoder, you can see why scanning digital systems is fairly boring and annoying – many DMR transmissions on the air seem to use basic security encryption which means no audio.

A distant third is the NXDN system, which is a Kenwood/Icom collaboration that was supposed to challenge DMR, but has since “lost the race”. It has a much narrower profile, with dedicated trunking control sounding like this and decodable audio sounding like this. It very aggressively hops between channels in the trunking pool with no unkey “hang time” resulting in a very frustrating “chase around the band” to decode a conversation. It can be done though.

Aside from that, there are a few scraps of NFM analog audio still around. I suspect those systems won’t be around for long though. Even though the band reshuffle has opened up the possibility for TETRA systems to be used, I didn’t seem to encounter any TETRA systems on the air, and if I did, I probably didn’t realize it.

There were a few systems which I have heard in Sydney but not positively identified or decoded. The Continuous AFSK Data signal is something I’ve associated with Taxi pagers for one reason or another, and operates in Sydney, along with the Data with intermittent beep and Burst FSK Data. All of these are heard in Sydney too, but I don’t know the modulation specifically. The burst FSK data appears to be 4-level FSK from an audio editor:

burst-fsk-data-4l

There were also channels with periodic weak “beep” signals which sound like this and are spread across swaths of the band. I’m not sure what it is, but it could be some smart-metering application potentially or demand management system?

900Mhz Band

The upper UHF bands are normally thought of as occupied only by telecommunications services, such as the 700Mhz LTE, 850Mhz HSPA+ and LTE, 900Mhz GSM. But it seems that there are some non-telecommunications company users of the frequencies.

16k-ofdm

I found, what appeared to be 16khz wide OFDM style flat-top carriers which were not GSM, but not anything I already knew. Were they TETRA? I don’t know. I also found a few constant data/control channel transmissions as well which piqued my interest.

Frequency   Description
864.0625    16k OFDM
865.2125    16k OFDM
865.3875    16k OFDM
865.5875    16k OFDM
865.6188    16k OFDM
865.7125    16k OFDM
865.9125    16k OFDM
865.9875    Droning Control Channel?
866.3875    16k OFDM
866.4625    16k OFDM
866.5875    16k OFDM
866.5125    16k OFDM
866.9125    16k OFDM
867.3875    16k OFDM
867.6125    16k OFDM
867.9125    16k OFDM
868.9125    16k OFDM
869.1875    16k OFDM
869.5875    16k OFDM
869.9125    16k OFDM
928.0625    Cyclic Control Channel?
929.6500    White Noise Control?
929.7500    White Noise Control?

The “droning” channel sounded like this, whereas the cyclic control channel sounded like this and the white noise control sounded like this. In all cases, the channels appeared to be using FSK with various “idle patterns” and different rates resulting in the different sounds. The OFDM really sounded like white noise, so no recording was made. It’s interesting to note the presence of such systems in the 860Mhz region down there, as last I heard in Sydney, operators still run some sort of trunked voice system in these ranges.

DVB-T TV Stations

Just like in Sydney, it seems that Melbourne’s DVB-T is based upon having a main transmitter in the VHF segment using the same frequencies as in Sydney, with the UHF band allocations reserved for SFN and fill-in transmitters.

Frequency   Description
177.5000    Seven Network
184.5000    SBS
191.6250    Nine Network
219.5000    Network Ten
226.5000    ABC
557.6250    Community TV
592.5000    Accor Hotels Hotel Channel
613.5000    SBS
620.5000    Seven Network
627.5000    Community TV
634.5000    ABC
641.5000    Nine Network
648.5000    Network Ten

I used a combination of governmental listings and surveying the airwaves using my stick antenna and the aerial connection provided at the hotel to determine the frequencies the channels are on. I’m not sure if the community station still exists in Melbourne, as it has died in Sydney. Unfortunately for me, reception of any of the broadcast stations proved to be impossible, and it seemed to be a combination of weak signal and high losses in the adapter pigtail to the tuner, as the hotel was using the “fill in” repeater with higher frequency signals which are more prone to loss.

ch7-signpoor

This resulted in a very deeply faded signal with lots of noise. This was especially disappointing to me, because at the time, Melbourne just launched 7HD simulcast of Channel 7’s main programming and it was my intention to record the transport stream for analysis when I got home. Unfortunately, this was not possible, so I ended up analyzing 7HD Sydney which was a simulcast of 7mate instead.

Their internal “hotel channel” at 592.5Mhz was much better, and because of the less complex modulation, was actually decodable.

accor-internal

As a result, I could souvenir the looped hotel channel recording as well.

accor1 accor2 accor3 accor4

They did, however, seem to play it back from a DVD player connected to a modulator by composite connection, so there was very nasty shimmering in the colour, there was the “letterboxing” and there was also dot crawl visible in the MPEG output.

DAB+ Radio Stations

Similarly to Sydney, Melbourne’s DAB+ stations were all on three multiplexes on Channel 9A, 9B and 9C in the VHF band.

Frequency   Multiplex Name
202.9280    DAB Melbourne 1
204.6400    DAB Melbourne 2
206.3520    ME abc&SBS RADIO

I’ll have more about these stations in the next part, so stay tuned.

Other Observations

While doing my night time walkaround for photography, I spotted this mounted up on a pole near the Yarra:

2016051320564876

It’s the first time I’ve seen a firetide mesh network system installed, this one by SNP Security.

Conclusion

I guess I let my old fashioned enthusiasm for radio show – I couldn’t resist spending the time to collect the data so I could later analyze it to “scan” the airwaves of Melbourne while I was there. It’s always interesting to do it yourself, as you come across signals which you might not know about and haven’t seen before. Unfortunately, as the world has made a shift towards more spectrally efficient technologies, this often also means the use of digital voice transmission with optional encryption enabled. The past-time of scanning is soon at risk of being dead. With the vast majority of governmental agencies on APCO P25, some encrypted, and other businesses using DMR/MotoTRBO with basic security or (rarely) NXDN, it’s not really possible to even buy a scanner that will do all these different standards, and partly because of the different vocoders in use which all cost money to license.

It was rather unfortunate that while I felt I was properly equipped, it turns out I wasn’t. Part of my plans to monitor DVB-T was thwarted by poor signal transmission from the wall socket to the tuner, because of a cheap piece of pigtail adapter and fly lead. I was going to bring along extra RTL-SDR dongles (R820T based) to avoid the central hump and extra adapters so I could do some simultaneous monitoring but my baggage weight limit put a stop to that one. The chance to bring a better antenna was also lost, and as a result, I didn’t pick up as many FM stations as I probably should have.

At least I still have a good sense of what is on the air down there – and because radio frequency allocations are dealt with by ACMA which is nation-wide, the band plans and signals seen on the air are broadly similar to those in Sydney. I didn’t have a chance to analyze higher frequencies, but I doubt anything of interest would be received, as is usually the case.

The next post looks at DAB+ in Melbourne with slideshow images! Yay!

About lui_gough

I'm a bit of a nut for electronics, computing, photography, radio, satellite and other technical hobbies. Click for more about me!
This entry was posted in Computing, Radio, Travel and tagged , , , , , , , . Bookmark the permalink.

Error: Comment is Missing!