Unknown RF data signal identification

[sgofferj]

Hi,

When playing with my software SA, I ran into this signal around 406,670MHz which seems to be all around me. There are different signal sources with different RF levels but they seem to talk well coordinated. I suspect it could be smart meters but all my attempts to decode or otherwise positively identify the signal have yet failed.

Could anybody provide some insight? Maybe somebody can identify the signal?

-Stefan

[Richard Crowley]

Not much context here.  Are you in a place (office? home?) where there are wireless intrusion alarms on windows, etc?

[mij59]

Hi,

It could be a digital channel for emergency services, police etc.

[sgofferj]

Not much context here.  Are you in a place (office? home?) where there are wireless intrusion alarms on windows, etc?

I'm in a residential area in a rural smalltown in Finland. To my knowledge, nobody in the wide vicinity has those kind of systems. People tend to even leave their front doors unlocked here. Also, those applications are usually in the 868MHz range or 433MHz if it's an old system. 406.670 is pretty far off the HAM and ISM bands here.

It could be a digital channel for emergency services, police etc.

That's pretty much impossible. The national EMS network in Finland is Tetra in the 380-390MHz range. Additionally, the unknown signal is too narrowband and too sparse to be any kind of digital voice communications.

[andtfoot]

Funnily enough, it seems to be in the middle of what is meant to be kept clear for radio astronomy observation.
http://www.ukaranet.org.uk/basics/frequency_allocation.htm
I know bugger all about radio stuff, so can't really comment further... 

[ConKbot]

https://www.viestintavirasto.fi/attachments/Taajuusjakotaulukko_31122013_en.pdf

406.625 - 406.925 MHz
(0.300 MHz)
Control, alarm, telemetry,
telecommand, data transmission

25 khz channel seperation, 16 khz bandwidth
class of emisison or standard type 'FM 1/406'  but a brief search hasn't yielded anything,

https://www.viestintavirasto.fi/attachments/PMR_EN.pdf is applicable standards.

I couldnt find any other information about who is licensed to operate in that band. But either way 1W max, its going to be close.
Time to build a yagi and go hunting

[sgofferj]

I already have been mapping but I can't locate it precisely enough. I mean, I can tell that it's somewhere in our luhtitalo-complex and also in a few houses around but not more precise. That's why I thought that it's maybe smartmeters. We are about a kilometer direct line from the electricity company's HQ.

[T3sl4co1l]

Spectrum seems like it could be single tone modulated FM, or multi-tone AM.  Pulsed carrier, in either case.  Neither really sounds like a standard I'm aware of offhand.

Tim

[babysitter]

Your country-mate oona aka windytan might save your day!

[G7PSK]

Have you just uncovered the new Krogers. 

[scatha]

Things are a little clearer once you look at the time domain data. Each of the periodic RF bursts consists of two discrete transmissions (a query/response?). Once isolated, the first looks pretty straightforward. It starts with a preamble consisting of an unmodulated carrier (used for carrier recovery at the receiver?) before switching to continuous-phase binary FSK with a delta f of about +/- 100Hz. The second (response to the first?) is more complex - higher bandwidth, no carrier. Probably higher rate/spread digital FSK or PSK.

[sgofferj]

@scatha:
Thanks! That's about as far as I got . I tried every digital signal decoding I could find but as of now I wasn't even able to get an uninterrupted data stream for further protocol analysis out of it.

Mysteries just bug me, especially if they are obviously very close around me .

Edit:
Is it possible that you mistake the brief noise period before the squelch hits for a second signal? I looked at the data again and I didn't see a second signal.

[sgofferj]

Here's the signal again without squelch. Every second burst, one can hear a very faint reply.

[Alexei.Polkhanov]

Modulation appears to be NFM (Narrowband FM?). Take a look at this page:

http://www.sigidwiki.com/wiki/Signal_Identification_Guide

Signal "Unknown 40" and "Unknown 40 2". Maybe you are close to solving mystery of one of these signals?

[chrisbrown]

What about Unknown 167? Wrong carrier frequency obviously, but it seems to be the same type of burst at a slightly higher bitrate.

[Alexei.Polkhanov]

406 MHz is used by emergency beacons as well: http://www.cospas-sarsat.int/en/ It is 406 MHz NFK. People are talking about them here: http://forums.radioreference.com/marine-monitoring-forum/268093-406mhz-beacons.html Try to search for software online - maybe you can decode it if it is a beacon then it should transmit coordinates or something.

[sgofferj]

I agree, the unknown 167 sounds very similar in principle. The 40 and 40/2 are pretty different. I also don't think, it's a COSPAS/SARSAT beacon as I believe that there are multiple signal sources in my vicinity and you also hear a faint reply every second burst. I guess, I'll have to find a handheld receiver and go hunting for that faint reply.

[chrisbrown]

You might be on to something with the smart meter idea. Unknown 169 showed up around 169.4 MHz. Now here's the European frequency allocation table: http://www.erodocdb.dk/docs/doc98/official/pdf/ERCRep025.pdf
In that document the phrase "meter reading" occurs exactly once, and the frequency range is 169.400-169.475 MHz.

Nevermind, 167, not 169.

[TerraHertz]

http://www.windytan.com/   Would probably be interested in helping.

A directional antenna and some driving around would seem to be your next logical step. Where's the powerful source, and the weak replier?

Hey, I bet the national security services, who no doubt like to secrete little bug-like things in some places, really hate amateurs with SDRs.

[sgofferj]

Yup, Oona figured it out in a matter of minutes . It's Bell 103 300 baud. Each burst are a 5 byte sequence. Now I only have to make sense of the data...

[Alexei.Polkhanov]

Hmm, but bell 103 is a phone line modem. What is it doing on 406.6 MHz?

[gxti]

It used to be used for phone lines (and for some special applications probably still is). Now it's used for radio:

Bell 103 modulation is still in use today, in shortwave radio, amateur radio, and some commercial applications. Its low signalling speed and use of audio frequencies makes it suitable for noisy or unreliable narrowband links.

[G7PSK]

My frequency guide which is now out of date says that 406.500 to 409.500 is sub band for north sea positioning systems located in excess of 100 km from the UK.