Data Calls, what can I do with them?

[Ryan Thompson]

So when I am listening sometimes the Fire Department will ask for dispatch to send the directions over to their truck and then a data call goes across. Is there anything I can do with that or decode or look at the traffic. If not is there any use for me and data calls?

[Ryan Thompson]

Such as a way to capture the packet and download it or are they just there to show there is a data call going across.

[Patrick C]

Is this P25? Phase 1 or 2? I'm just curious because I have the same question. 

[Ryan Thompson]

They are Phase 1 UDP packets from port 2002 to port 2002, there are also SNDCP page requests to an unknown talkgroup. 

[Ryan Thompson]

here are some screenshots of the data calls

On Saturday, May 9, 2020 at 3:17:55 PM UTC-4, Ryan Thompson wrote:

[Ryan Thompson]

On Saturday, May 9, 2020 at 3:17:55 PM UTC-4, Ryan Thompson wrote:

[sdrtrunk]

Ryan,

If the data packets are not encrypted, I can probably add support to sdrtrunk to properly decode those packet types.  Our local P25 county consortium uses MDTs in parallel with their P25 system, so I don't have much sample P25 packet data to experiment with.

There's currently support in sdrtrunk to decode Motorola Automatic Registration Service (ARS) packets and I have some samples of GPS data that I still have to work through.

If you want to turn on bitstream (.bits) recording for traffic channels, and then assemble a couple bits recordings from a timeframe when you know they're sending Fire Department data, I can look through the packets to see if there's more that we can do with the data in sdrtrunk.

Denny

[Ryan Thompson]

Will do that and go ahead and send those over, I am 90% sure they arent encrypted. How do I differentiate between all the recordings to know which streams that are data recordings.

[Ryan Thompson]

Nevermind I figured it out will begin to put all the data calls I capture into a folder.

[Иван Иванов]

Я тоже считаю что было бы хорошо добавить поддержку Data Calls потому-что у меня тоже очень много регистраций!!!!!!!! и как их посмотреть??????

суббота, 9 мая 2020 г., 22:17:55 UTC+3 пользователь Ryan Thompson написал:

Поэтому, когда я слушаю, иногда пожарная служба запрашивает отправку, чтобы отправить указания в их грузовик, и затем происходит передача данных. Есть ли что-нибудь, что я могу сделать с этим или расшифровать или посмотреть на трафик. Если нет, то есть ли какая-то польза от меня и передачи данных?

[sdrtrunk]

The Motorola Automatic Registration Service (ARS) packets are decoded automatically.  If you click on a data channel that in in the Now Playlist section and click the Events tab below, you can see the IP packets being decoded.  The ARS packets are automatically marked as ARS and the Details column shows the ARS event type for the packet. 

[LordDonkey]

In my area they use GPS on their APX 8000 and 8500 radios, and dispatch talks about seeing them on the map. I usually see a data call when that happens. I will try to get some bits files and upload them.

[LordDonkey]

Here are some.

[Ryan Thompson]

I am not sure if this is how it is supposed to work, however, when a data call comes across it is Phase 1 and for a short duration (.2 seconds~) it records a data call and in status shows DATA. However, the call will remain active for 2-3 minutes after. Could it possibly not be receiving the whole data call due to the issue where Phase 1 calls aren't being shown as the proper status ie. Encrypted or Data? I mentioned this issue in Github and I believe that Denny has put it on the 0.5.0 roadmap.

On Saturday, May 9, 2020 at 3:17:55 PM UTC-4, Ryan Thompson wrote:

[Ryan Thompson]

heres what I have so far

--
You received this message because you are subscribed to a topic in the Google Groups "sdrtrunk" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/sdrtrunk/RITv1b2HQ08/unsubscribe.
To unsubscribe from this group and all its topics, send an email to sdrtrunk+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sdrtrunk/16652ca9-ea7b-4306-9d74-bb0b635f786d%40googlegroups.com.

[Patrick C]

I have also seen some ARS data (if thats a thing) and UDP/IP packets. Can I decode either of these?

On Tuesday, May 12, 2020 at 1:02:30 PM UTC-4, Ryan Thompson wrote:

heres what I have so far

On Tue, May 12, 2020 at 12:59 PM Ryan Thompson <rtdil...@gmail.com> wrote:

I am not sure if this is how it is supposed to work, however, when a data call comes across it is Phase 1 and for a short duration (.2 seconds~) it records a data call and in status shows DATA. However, the call will remain active for 2-3 minutes after. Could it possibly not be receiving the whole data call due to the issue where Phase 1 calls aren't being shown as the proper status ie. Encrypted or Data? I mentioned this issue in Github and I believe that Denny has put it on the 0.5.0 roadmap.

On Saturday, May 9, 2020 at 3:17:55 PM UTC-4, Ryan Thompson wrote:

So when I am listening sometimes the Fire Department will ask for dispatch to send the directions over to their truck and then a data call goes across. Is there anything I can do with that or decode or look at the traffic. If not is there any use for me and data calls?

--
You received this message because you are subscribed to a topic in the Google Groups "sdrtrunk" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/sdrtrunk/RITv1b2HQ08/unsubscribe.

To unsubscribe from this group and all its topics, send an email to sdrt...@googlegroups.com.

[sdrtrunk]

@LordDonkey @Ryan Thompson,

Thanks very much for the samples.  I'm completely swamped at the moment, but I will get to these.

Cheer,

Denny

[Matt Tottle]

Is there anything that needs to be done to enable GPS?  I'm wondering if it's a common feature of a P25 system or if our agencies just don't use it.  I monitor a site on our statewide system but I don't ever see anything that refers to data calls.  I do see "Accept Location Registration" in the events (I don't know if that's the GPS or if that's something else), but nothing shows up on the map.  I know when they're discussing adding new agencies to the system, they always mention GPS mapping as one of the selling points so the system at least can do it..

Do I have something set wrong?

[Dean Sauer]

On Wednesday, May 20, 2020 at 9:39:36 PM UTC-4, Matt Tottle wrote:

Is there anything that needs to be done to enable GPS?  I'm wondering if it's a common feature of a P25 system or if our agencies just don't use it.  I monitor a site on our statewide system but I don't ever see anything that refers to data calls.  I do see "Accept Location Registration" in the events (I don't know if that's the GPS or if that's something else), but nothing shows up on the map.  I know when they're discussing adding new agencies to the system, they always mention GPS mapping as one of the selling points so the system at least can do it..

"Location Registration" has NOTHING to do with AVL aka GPS data.

Radios must "register" with the controller there is a full registration and a "location" registration. They occur at different times based on events ie: power on, and moving from a zone to another zone, or even from a tower to another tower in a zone depending on the parameters of the system.

Some radios could be tied to one particular site example, local airport has a numerous admin etc. radios which can ONLY USE the on airport tower... There are a few admin/ARFF etc. radios which can use the neighbor sites of the system.. but the janitors can not. They would get a PTT BONK and/or possibly a displayed message out of range.
 

Do I have something set wrong?

No. The map is not going to populate with data as it needs data that is

1) Likely encrypted
2) Only sent via the mobile to the controller UNLESS SPECIFICALLY SET to relay that data forward

#1 is 99.99999% the situation
#2 is system dependent on who is getting that data in the field and the AVL/GPS server they are using, licensed ($$$$$$$$$ and more $$$$$$$$$$$$$)

So 99.9999% chance this data is not ever going to be shown, at least LE or other PS wise..

There is other data out there like SCADA stuff for lift stations.. pages for fire stations, and other packetized data..some may or may not be encrypted I 100.00000000% assure you that the NCIC/NLETS and other ie: FCIC, CLEAN data is 100000000% encrypted AES... and has been since the mid 90's when RD-LAP was pretty much outed as totally insecure.

Some AVL/GPS is going via cellular and in areas which have FirstNet LTE stuff it may be going that way...

There are a number of solutions to this that use the trunked system or don't. All depends.. and 9.9999/10 we are not going to display it.

Maybe this data is available for other users like the DPW or something.. but if they use the same system then they are using the same AVL/GPS server and if its getting encrypted data from LE, then its likely the same for other users.


 

[Matt Tottle]

Wouldnt that data show up in SDR whether it's encrypted or not? I see absolutely none.

[Ryan Thompson]

No it will come across as data not encrypted status. If the talkgroup that is transmitting has some encrypted traffic then there is the possibility that they encrypt all their data calls but it really just depends on wether or not the agency wants to encrypt their data calls.

[Matt Tottle]

Maybe I'm not being clear..  I am not seeing ANYTHING in Now Playing or Events that looks like what you posted. Nothing with an IP address, nothing that says UDP/IP packet, nothing.  I've had it running for a week continuously and there is nothing in the log. All I see is the control channel and regular voice channels. 

[Ryan Thompson]

Ah I see, however sometimes a data call can come across and you don’t notice them. For example they can come across where the “to” is a radio ID such as “00549115” and thats it and its status is ACTIVE. That is a data call watch your control events for events listed data calls. But who knows your systen just might not use dayta calls which I doubt would be the case.

[sdrtrunk]

Matt,

Make sure the 'Ignore Data Calls' is not checked in the channel configuration.  That will prevent data traffic channels from being processed.

Denny

[Matt Tottle]

Nope, I just checked, it's not...  And Ryan I looked through the events log and did not see any reference to data at all. 

[sdrtrunk]

Ryan,

I went through the P25 packet data recordings that you sent and I was able to extract a couple of the packets from the data.  It's all IPV4 UDP packets going to/from UDP port 2002, but there's not enough variance in the packets to to figure out what any of the packet fields might contain.

cheers,

Denny

NAC:1457 IPPKT LLID:549105 NSAPI:1 IP FROM:10.51.1.134 TO:10.71.1.5 UDP PORT FROM:2002 TO:2002

400640000300B9CE5E400000160000000040020500098644B0001406400005000B0002000900120000000000000000 549105

400640000400B9E1CB400000160000000040020500098644B0001406400005000B0002000900120000000000000000 549107

400640000300B9CE5E400000160000000040020500098644B0001406400005000B0002000900120000000000000000 549105

400640000300B9BF4E400000160000000040020500098644B0001406400005000B00020008003A0000000000000000 549105

On Tuesday, May 12, 2020 at 1:02:30 PM UTC-4, Ryan Thompson wrote:

heres what I have so far

On Tue, May 12, 2020 at 12:59 PM Ryan Thompson <> wrote:

I am not sure if this is how it is supposed to work, however, when a data call comes across it is Phase 1 and for a short duration (.2 seconds~) it records a data call and in status shows DATA. However, the call will remain active for 2-3 minutes after. Could it possibly not be receiving the whole data call due to the issue where Phase 1 calls aren't being shown as the proper status ie. Encrypted or Data? I mentioned this issue in Github and I believe that Denny has put it on the 0.5.0 roadmap.

On Saturday, May 9, 2020 at 3:17:55 PM UTC-4, Ryan Thompson wrote:

So when I am listening sometimes the Fire Department will ask for dispatch to send the directions over to their truck and then a data call goes across. Is there anything I can do with that or decode or look at the traffic. If not is there any use for me and data calls?

--
You received this message because you are subscribed to a topic in the Google Groups "sdrtrunk" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/sdrtrunk/RITv1b2HQ08/unsubscribe.

To unsubscribe from this group and all its topics, send an email to sdrtrunk+unsubscribe@googlegroups.com.

[sdrtrunk]

LordDonkey,

I processed the P25 packet data recordings that you posted, but most of the recordings were pretty beat up and didn't decode well.  There were a few packets where the network was acknowledging that the mobile radio sent data packets, but no actual data packet contents that I could find.

Denny

On Tuesday, May 12, 2020 at 12:07:07 PM UTC-4, LordDonkey wrote:

Here are some.

[Russell Purinton]

I heard that Wireshark has a dissector first p25 traffic. Maybe if the bits could be saved in Pcap format wireshark will know what to do with them.

[Lucas Sacramento]

I am also interested in having .pcap to work with the p25 protocol. can someone help me do this?