Most of my posts so far about my trip to Melbourne have been revolving around photography in a tourist sense, or as a tram-spotter. While some of the observations included some technical aspects, they were all visible and evident if you cared to observe. This post is a little different.
In this post, I will be looking at what’s “on the air” in Melbourne, using my trusty E4000-based RTL-SDR dongle and my Icom IC-R20, hunting down signals from the hotel window. As I only had a limited number of days to myself in Melbourne, I had to be most efficient about how I did my radio scanning. As a result, a lot of the analysis was done after the fact from IF-recordings I bought home for later analysis. I guess that’s the beauty of technology.
In this post, you will find my “frequency logs”, which may be out by a small amount owing to the accuracy of the RTL-SDR crystals, as well as some audio recordings representing some of the types of channels heard.
The tools I used included a trusty E4000 based RTL-SDR dongle. While it has an annoying “hump” in the middle, it was my most reliable dongle with good sensitivity all round and slightly less power consumption compared to the R820T. This one had also been pre-calibrated using kalibrate-rtl, so its offset was known to some accuracy.
This was run on a Windows laptop with SDRSharp. The latest version was used, noting that upgrading from older versions doesn’t always work properly, so I started with a fresh download. Because the integrated Recorder plugin has WAV file limitations of 2Gb, I had to use IF Recorder and File Player from rtl-sdr.ru. Manual edits to the front-end and plug-in configuration files were made to use these plugins for recording to and playing back from WAV64 files with navigation.
Digital signals were decoded with appropriate tools – for POCSAG paging, PDW and for DMR/NXDN, DSDPlus. I also gave Taxi MDT Decoder a go, with no luck, and also had Unitrunker on hand for trunking system information decoding.
To get everything connected together, a virtual audio cable is required for looping output from SDRSharp (with Filter Audio turned off and bandwidth increased to 16khz) to the decoder. I use Virtual Audio Cable myself, although other software may be just as appropriate.
For good measure, I bought along my Sony AN-LP1 antenna and my Icom IC-R20. This extends the range for my reception, while giving me another more traditional “alternative” receiver to use. One nice feature of the R20 is the ability to use the internal IC Recorder to record up to 1 hour of signals in a custom ADPCM format which can be downloaded to a PC using CS-R20 and converted back to WAV with a third party tool called icw2wav.
Of course, a decently powerful laptop and a lot of storage space is also required. Carrying a few cables and adapters are also a good idea – a fly-lead to go from the wall (PAL/F-connector) to the tuner (via a PAL to MMCX pigtail) is probably a good idea.
LF/HF & AM Broadcast Bands
What better place to start my little scanning adventure off than the low end of the radio spectrum. I was expecting to get a few NDBs, maybe a few stations here and there, as well as the usual Bureau of Meterology weather faxes along with all the regular AM stations.
Reality was harshly different. I could receive absolutely nothing in these bands. Nothing at all. It seemed that being in too high density living was adversely pushing up the noise floor to the point even a local NDB wasn’t receivable, and AM radio was totally shot.
The prime candidate seemed to be the variable speed drive used in the lift, as well as the collection of a large number of CFLs in the hotel building. Static was roaring loud, and even with the RF Gain turned down to minimum and attenuation turned on, there was nothing that could be done to receive anything. The fact I was relying on the supplied telescopic antenna didn’t help.
FM Broadcast Band
The FM broadcast band was surveyed using the RTL-SDR dongle, so I could grab some RDS information along the way. The stations heard were:
Freq Station RDS ID 89.9 WYN-FM ? 90.7 Syn FM ? 91.5 smoothfm 3915 92.3 3ZZZ ? 91.3 SBS Radio 845C 94.9 JOY 94.9 6DF0 100.3 Nova 100 ? 101.1 KIIS1011 3111 101.9 The Fox 3101 102.7 Triple R ? 103.5 3MBS ? 104.3 GOLD1043 371E 105.1 Triple M 3105 105.9 ABC Classic FM ? 107.5 triple j 2D5F
This is far short of the full list of stations, but at least I know I’m in the right city now. Instead, it showed another major issue, especially on the IC-R20 – the issue of front end overload. Being in the city, especially high-up, I was either near or in the line of several different transmitters, and the IC-R20 would “desensitize” as any of them keyed up, and other times, “intermodulate” resulting in the reception of product/difference signals. I concluded that the R20 was really not that helpful especially given the RF-harsh environment. The more deaf RTL-SDR, however, seemed much more at home.
VHF Band (Air, 150Mhz)
Just as I thought the RTL-SDR would do well, it really struggled in the VHF bands. I didn’t end up hearing anything on it, so the R20 came in handy. But even the R20 struggled pretty badly.
My frequency logs showed the following:
Frequency Description 119.8000 Essendon ATIS 148.3375 Paging 148.3625 Paging 148.5625 Hospital & Others - Mixed 1200/512 POCSAG Hutchison 148.5875 Hospital Related? 512 POCSAG ?Private 148.6375 Hospital & Others - Mixed 1200/512 POCSAG Hutchison 148.6875 Hospital/Ambo? Priv Op 512 POCSAG QD 148.9125 SES/AMBO512 POCSAG QD 148.9375 Paging 149.3250 Paging 149.3750 Paging 152.0750 2CR Chinese Cantonese Community Radio 164.8250 Trunking Control 165.6875 Trunking Voice 166.7500 Trunking Control 167.5750 Trunking Control
Because I didn’t have time during the day to listen in on the air band, the only things I could pick are those who were transmitting around the clock – namely Essendon ATIS. It was quite hard to position myself in a particular way at the window to capture that sample – one step away from the window and it was entirely noise.
There were also around 10 paging channels, all appearing to be POCSAG. A few of them appear to be Hutchison channels, and run at mixed rate 1200bps/512bps. The activity can be seen in the above screenshot with the scroll rate set to the lowest. The system messages from those frequencies which could be decoded seem to show certain patterns which imply that 148.5625 and 148.6375 are run by one entity, whereas 148.6875 and 148.9125 are run by another entity. Some of the channels showed visible activity but were too weak to be decoded. Of course, a lookup in the Radcomms database can tell you that. Some systems messages include:
148.5625Mhz 0787910 POCSAG-1 ALPHA 512 07:33 P175666.MDA 0857710 POCSAG-3 ALPHA 1200 07:33 P175666.MDA 0787910 POCSAG-1 ALPHA 512 07:34 P175666.MDA 0857710 POCSAG-3 ALPHA 1200 07:34 P175666.MDA 148.6375Mhz 0001710 POCSAG-3 ALPHA 1200 07:51 P175666.MDA 0507846 POCSAG-1 ALPHA 1200 07:51 P175666.MDA 0507846 POCSAG-1 ALPHA 1200 07:52 P175666.MDA 0001710 POCSAG-3 ALPHA 1200 07:52 P175666.MDA 148.6875Mhz 1856916 POCSAG-1 ALPHA 512 QD12 minute network heartbeat 1856916 POCSAG-1 ALPHA 512 QD12 minute network heartbeat 1856916 POCSAG-1 ALPHA 512 QD12 minute network heartbeat 148.9125Mhz 1856916 POCSAG-1 ALPHA 512 QD12 minute network heartbeat 1856916 POCSAG-1 ALPHA 512 QD12 minute network heartbeat 1856916 POCSAG-1 ALPHA 512 QD12 minute network heartbeat
A good number of messages were hospital/healthcare related, carried on both Hutchison as well as private networks. It also seems that there are SES and RFS messages as well, with the remainder being automated systems alerts for various private companies. There’s more paging activity in Melbourne than there is in Sydney, where only three channels seem to be active.
The two Hutchison/Vodafone channels had one minute interval heartbeats – this is a good thing because it keeps paging receivers aware of their coverage as their out of coverage warning is only a simple “no messages received in X minutes” timer. It also can allow for equipment to set their time as well, as a time-stamp is included. The latter channels with QD12 minute network heartbeat seem to prefix all messages with a two-letter code (e.g @@, Hb, QD etc). The system messages are even addressed to the same capcode. 148.5875Mhz did not have any system messages with a very low traffic load, but prefixed all its messages with a time.
It seems that the VHF ethnic radio “narrowcast” spectrum is also used, with 2CR being heard on the air. The snippet says something like “Using all our efforts, to achieve such excellent results, 2CR Australian Chinese radio.”
There were a few trunking systems in the upper end of the VHF band, but nothing that I recorded. I didn’t hear any action on the amateur 2m band, which was unfortunate.
The 400Mhz band is amongst the most crowded bands in Australia, owing to its popularity for land-mobile usage, be it in company vans or in hand-held transceivers. The band offers a good mixture of propagation characteristics and physical size requirements. As a result, everyone from security, public service, transportation, couriers, taxis, etc use this band. Formerly, the band was also ripe for scanning with lots of action to hear.
Unfortunately, due to a lack of space in the band (even when taking away a little of the 70cm amateur band for governmental agency use), there has been a push for higher spectral efficiency to squeeze more conversations into the same bandwidth. To meet future requirements for spectral efficiency, this has necessitated the move to digital radio technologies, with very little analog NFM audio left. This also adds a secondary wrinkle to scanner enthusiasts – with so many standards, it’s not possible to buy a scanner that supports every digital system. Furthermore, due to the ease of configuring and enabling encryption, many of the channels on the air cannot be listened to like former analogue transmissions.
The effects can be seen in the list of logged frequencies and transmissions.
Frequency Description 412.4625 DMR Voice Channel 413.8250 OFDM 16k wide data? 414.5000 DMR Voice Channel 416.5625 DMR Trunking Control 416.8250 Continuous AFSK Data 416.9000 Burst FSK Data (Taxi Pager?) 417.0150 Burst FSK Data (Taxi Pager?) 417.0250 Burst FSK Data (Taxi Pager?) 417.6125 P25 Trunking Control 417.6375 P25 Trunking Control 417.7875 P25 Unencrypted Voice NAC 162 417.8000 Continuous AFSK Data 418.0625 NFM Voice Maxi Taxi Request + Unkey Burst 418.1250 Weak beep 418.1500 Weak beep 418.1750 Weak beep 418.2500 Weak beep 418.4500 Weak beep 418.7500 Weak beep 419.0500 Weak beep 419.8125 P25 Voice Channel 419.9625 Weak P25 Voice Channel 420.0125 P25 Trunking Control 420.0375 P25 Trunking Control 420.1625 P25 Voice Channel NAC 161 Ambulance? 420.4625 P25 Voice Channel NAC 161 Ambulance? 420.4875 P25 Voice Channel NAC 162 420.6125 P25 Voice Channel NAC 161 Encrypted 420.6375 P25 Voice Channel NAC 162 Encrypted 420.7125 P25 Voice Channel NAC 161 Encrypted 421.2625 P25 Voice Channel NAC 161 421.3125 P25 Voice Channel NAC 162 Encrypted 421.3375 P25 Voice Channel NAC 161 Encrypted 421.4125 P25 Voice Channel NAC 161 Encrypted 421.5625 P25 Voice Channel NAC 161 421.6125 P25 Voice Channel NAC 162 Encrypted 421.6375 P25 Voice Channel NAC 161 Encrypted 421.7125 P25 Voice Channel NAC 161 Encrypted 421.7625 P25 Voice Channel NAC 162 Encrypted 421.8625 P25 Voice Channel NAC 161 421.9125 P25 Voice Channel NAC 161 421.9375 P25 Voice Channel NAC 161 422.0375 P25 Voice Channel NAC 161 Encrypted 422.0375 P25 Voice Channel NAC 161 422.0625 P25 Voice 422.2125 P25 Voice Channel NAC 162 422.2375 P25 Voice Channel NAC 161 422.3375 P25 Voice Channel NAC 161 Encrypted 422.3625 P25 Voice Channel NAC 161 422.5125 P25 Voice Channel NAC 162 422.5375 P25 Voice Channel NAC 161 422.6375 P25 Voice Channel NAC 161 Encrypted 422.8375 P25 Voice Channel NAC 161 422.9375 P25 Voice Channel NAC 161 Encrypted 424.1625 P25 Voice Channel NAC 162 424.2625 P25 Voice Channel NAC 161 424.3125 P25 Voice Channel NAC 162 424.3375 P25 Voice Channel NAC 161 Encrypted 463.5125 Weak? 463.5500 DMR Voice/Data 463.6500 DMR Voice/Data 466.8750 DMR Voice/Data 467.1500 DMR Voice/Data 467.9000 P25 Voice Channel NAC 161 467.9250 P25 Voice Channel NAC 162 Encrypted 468.2000 P25 Voice Channel NAC 161 Encrypted 468.2250 P25 Voice Channel NAC 162 468.2250 P25 Voice Channel NAC 162 Encrypted 468.5000 P25 Voice Channel NAC 161 Encrypted 468.5250 ? 468.7500 ? 468.7688 Periodic Carrier Burst 468.8250 P25 Voice Channel NAC 162 Encrypted 469.1000 P25 Voice Channel NAC 161 Encrypted 469.9250 DMR Voice/Data 470.1500 ? 470.2500 DMR Voice/Data 470.3250 DMR Voice/Data 470.4250 DMR Trunking Control 470.4500 DMR Voice/Data 470.5500 DMR Voice/Data 472.0938 Weak? 472.1000 Weak 472.3250 DMR Voice/Data 472.4500 Carrier Pips 472.7500 NXDN Trunking Control 4800bps 472.8500 NXDN Voice 473.0750 DMR Voice/Data 473.1500 DMR Trunking Control 473.3250 NXDN Voice 473.4500 NXDN Voice 473.5188 Weak? 473.8250 DMR Voice/Data 474.1250 Weak? 476.5750 NFM CB 478.0500 NXDN Voice 478.1500 Rapid intermittent bursts of data? 485.7750 DMR Voice/Data 486.1250 Intermittent bursts of data 486.9750 Data with intermittent beep (Taxi?) 487.1250 NFM Voice 487.9250 NFM Trunked Sub-audible Tone 488.3250 P25 NAC 141 Encrypted 488.3750 V strong carrier bursts 488.5000 NFM Taxi Voice 488.5250 NFM Weak Voice 488.5500 Data with intermittent beep (Taxi?) 488.6750 DMR Voice/Data 488.7500 Data with intermittent beep (Taxi?) 488.7750 NFM Voice 488.9750 DMR Data Bursts 489.9750 Data with intermittent beep (Taxi?) 490.0500 NXDN Voice Bus 490.6625 NXDN Voice Bus 490.7500 Weak beep 490.9250 NXDN Voice Bus 491.2063 ? 491.2250 NXDN Trunking Control 4800bps 491.3250 ? 491.3250 ? 492.3000 Carrier Pips 492.6000 Carrier Pips 492.6750 DMR Voice/Data 494.0000 DMR Voice/Data 494.5875 DMR Voice/Data 494.1000 Weak beep 493.0125 NXDN Voice 501.1375 Data with intermittent beep (Taxi?) 501.2000 Data with intermittent beep (Taxi?) 501.5000 DMR Voice/Data 501.6000 Data AFSK 501.7250 NFM Voice 501.8000 DMR Voice/Data 502.1000 DMR Voice/Data 502.1375 Weak Beep 503.5250 P25 NAC 16A Trunking Channel 503.4750 ? 503.5500 P25 Voice Channel NAC 16A Encrypted 503.6000 ? 503.6250 ? 503.7250 ? 503.7500 P25 Voice Channel NAC 16A Encrypted 503.8250 P25 Voice Channel NAC 16A Encrypted 504.6875 NFM Voice 504.9625 Dead Carrier 503.9063 Periodic Data Burst 504.6125 Data with intermittent beep (Taxi?) 504.6250 Data with intermittent beep (Taxi?) 504.6500 Data with intermittent beep (Taxi?) 504.6625 Data with intermittent beep (Taxi?) 504.6750 Data with intermittent beep (Taxi?) 505.6375 DMR Voice/Data 507.2250 Data AFSK 507.3750 DMR Voice/Data 507.5000 Data AFSK 507.5500 Data AFSK 507.5750 Data AFSK 507.2000 NFM Voice 507.8750 Data AFSK 508.5250 DMR Voice/Data 508.8500 Data Pips 509.1500 Data Pips 509.0500 DMR Voice/Data 511.2000 Carrier Pips 511.1375 Strong Bursts 509.1500 Carrier Pips 509.1750 Carrier Pips 511.2750 NFM Voice 509.4250 DMR Voice/Data 517.5000 Infrequent Short Data Bursts (Taxi?) 517.5500 Infrequent Short Data Bursts (Taxi?) 517.5750 Infrequent Short Data Bursts (Taxi?) 517.8750 Infrequent Short Data Bursts (Taxi?) 518.7375 Infrequent Short Data Bursts (Taxi?) 519.0375 Infrequent Short Data Bursts (Taxi?) 519.0625 Infrequent Short Data Bursts (Taxi?) 519.1125 Infrequent Short Data Bursts (Taxi?)
It seems there is a governmental system or similar in the low end of the band, just like in Sydney, using APCO P25 Phase 1 technologies. Two P25 networks with different NACs can be seen in the low end of the band, with another P25 network further up the band. That’s more P25 systems than we get in Sydney (one, the Government Radio Network as far as I’m aware). The dedicated P25 trunking control channel like this, while an audio channel sounds like this. The samples are of high enough quality to decode back into audio with DSDPlus. Of course, the channels themselves are not encrypted or unencrypted, but the talkgroups are. The frequency of occurring the encrypted/unencrypted transmission as surveyed gives you an idea of the proportion of transmissions that actually are encrypted, which doesn’t bode well for the scanner enthusiast.
The next most popular digital mode is DMR (also sold as MotoTRBO). A dedicated control channel sounds like this, whereas a data transmission sounds like this and actual decodable DMR voice sounds like this. Without a suitable decoder, you can see why scanning digital systems is fairly boring and annoying – many DMR transmissions on the air seem to use basic security encryption which means no audio.
A distant third is the NXDN system, which is a Kenwood/Icom collaboration that was supposed to challenge DMR, but has since “lost the race”. It has a much narrower profile, with dedicated trunking control sounding like this and decodable audio sounding like this. It very aggressively hops between channels in the trunking pool with no unkey “hang time” resulting in a very frustrating “chase around the band” to decode a conversation. It can be done though.
Aside from that, there are a few scraps of NFM analog audio still around. I suspect those systems won’t be around for long though. Even though the band reshuffle has opened up the possibility for TETRA systems to be used, I didn’t seem to encounter any TETRA systems on the air, and if I did, I probably didn’t realize it.
There were a few systems which I have heard in Sydney but not positively identified or decoded. The Continuous AFSK Data signal is something I’ve associated with Taxi pagers for one reason or another, and operates in Sydney, along with the Data with intermittent beep and Burst FSK Data. All of these are heard in Sydney too, but I don’t know the modulation specifically. The burst FSK data appears to be 4-level FSK from an audio editor:
There were also channels with periodic weak “beep” signals which sound like this and are spread across swaths of the band. I’m not sure what it is, but it could be some smart-metering application potentially or demand management system?
The upper UHF bands are normally thought of as occupied only by telecommunications services, such as the 700Mhz LTE, 850Mhz HSPA+ and LTE, 900Mhz GSM. But it seems that there are some non-telecommunications company users of the frequencies.
I found, what appeared to be 16khz wide OFDM style flat-top carriers which were not GSM, but not anything I already knew. Were they TETRA? I don’t know. I also found a few constant data/control channel transmissions as well which piqued my interest.
Frequency Description 864.0625 16k OFDM 865.2125 16k OFDM 865.3875 16k OFDM 865.5875 16k OFDM 865.6188 16k OFDM 865.7125 16k OFDM 865.9125 16k OFDM 865.9875 Droning Control Channel? 866.3875 16k OFDM 866.4625 16k OFDM 866.5875 16k OFDM 866.5125 16k OFDM 866.9125 16k OFDM 867.3875 16k OFDM 867.6125 16k OFDM 867.9125 16k OFDM 868.9125 16k OFDM 869.1875 16k OFDM 869.5875 16k OFDM 869.9125 16k OFDM 928.0625 Cyclic Control Channel? 929.6500 White Noise Control? 929.7500 White Noise Control?
The “droning” channel sounded like this, whereas the cyclic control channel sounded like this and the white noise control sounded like this. In all cases, the channels appeared to be using FSK with various “idle patterns” and different rates resulting in the different sounds. The OFDM really sounded like white noise, so no recording was made. It’s interesting to note the presence of such systems in the 860Mhz region down there, as last I heard in Sydney, operators still run some sort of trunked voice system in these ranges.
DVB-T TV Stations
Just like in Sydney, it seems that Melbourne’s DVB-T is based upon having a main transmitter in the VHF segment using the same frequencies as in Sydney, with the UHF band allocations reserved for SFN and fill-in transmitters.
Frequency Description 177.5000 Seven Network 184.5000 SBS 191.6250 Nine Network 219.5000 Network Ten 226.5000 ABC 557.6250 Community TV 592.5000 Accor Hotels Hotel Channel 613.5000 SBS 620.5000 Seven Network 627.5000 Community TV 634.5000 ABC 641.5000 Nine Network 648.5000 Network Ten
I used a combination of governmental listings and surveying the airwaves using my stick antenna and the aerial connection provided at the hotel to determine the frequencies the channels are on. I’m not sure if the community station still exists in Melbourne, as it has died in Sydney. Unfortunately for me, reception of any of the broadcast stations proved to be impossible, and it seemed to be a combination of weak signal and high losses in the adapter pigtail to the tuner, as the hotel was using the “fill in” repeater with higher frequency signals which are more prone to loss.
This resulted in a very deeply faded signal with lots of noise. This was especially disappointing to me, because at the time, Melbourne just launched 7HD simulcast of Channel 7’s main programming and it was my intention to record the transport stream for analysis when I got home. Unfortunately, this was not possible, so I ended up analyzing 7HD Sydney which was a simulcast of 7mate instead.
Their internal “hotel channel” at 592.5Mhz was much better, and because of the less complex modulation, was actually decodable.
As a result, I could souvenir the looped hotel channel recording as well.
They did, however, seem to play it back from a DVD player connected to a modulator by composite connection, so there was very nasty shimmering in the colour, there was the “letterboxing” and there was also dot crawl visible in the MPEG output.
DAB+ Radio Stations
Similarly to Sydney, Melbourne’s DAB+ stations were all on three multiplexes on Channel 9A, 9B and 9C in the VHF band.
Frequency Multiplex Name 202.9280 DAB Melbourne 1 204.6400 DAB Melbourne 2 206.3520 ME abc&SBS RADIO
I’ll have more about these stations in the next part, so stay tuned.
While doing my night time walkaround for photography, I spotted this mounted up on a pole near the Yarra:
It’s the first time I’ve seen a firetide mesh network system installed, this one by SNP Security.
I guess I let my old fashioned enthusiasm for radio show – I couldn’t resist spending the time to collect the data so I could later analyze it to “scan” the airwaves of Melbourne while I was there. It’s always interesting to do it yourself, as you come across signals which you might not know about and haven’t seen before. Unfortunately, as the world has made a shift towards more spectrally efficient technologies, this often also means the use of digital voice transmission with optional encryption enabled. The past-time of scanning is soon at risk of being dead. With the vast majority of governmental agencies on APCO P25, some encrypted, and other businesses using DMR/MotoTRBO with basic security or (rarely) NXDN, it’s not really possible to even buy a scanner that will do all these different standards, and partly because of the different vocoders in use which all cost money to license.
It was rather unfortunate that while I felt I was properly equipped, it turns out I wasn’t. Part of my plans to monitor DVB-T was thwarted by poor signal transmission from the wall socket to the tuner, because of a cheap piece of pigtail adapter and fly lead. I was going to bring along extra RTL-SDR dongles (R820T based) to avoid the central hump and extra adapters so I could do some simultaneous monitoring but my baggage weight limit put a stop to that one. The chance to bring a better antenna was also lost, and as a result, I didn’t pick up as many FM stations as I probably should have.
At least I still have a good sense of what is on the air down there – and because radio frequency allocations are dealt with by ACMA which is nation-wide, the band plans and signals seen on the air are broadly similar to those in Sydney. I didn’t have a chance to analyze higher frequencies, but I doubt anything of interest would be received, as is usually the case.
The next post looks at DAB+ in Melbourne with slideshow images! Yay!