SDRplay RSPdx with go2MONITOR

Thanks to SDRplay, I was sent both their new RSPdx and older RSPduo SDRs at the end of January.

The main reason was to get them integrated into Procitec’s go2MONITOR and go2DECODE software, to increase the number of SDRs that the company’s products are compatible with.

This I’ve been successful in doing with the RSPdx – I’m still to unbox the RSPduo at this time of writing.

First of all though, I’ve been extremely pleased with the RSPdx in its own right. The SDRuno software works really well, is pretty easy to use – and it looks good too.

SDRuno running the RSPdx
The RSPdx also works with SDRConsole

The fact that you can have up to 10 MHz of bandwidth is brilliant, and it isn’t too bad on the CPU usage either – running at around 25% with 10 MHz bandwidth on my ancient PC. Used with SDRConsole you can cover a good number of frequencies at once, and can record them if necessary. Of course, you can do this with SDRuno too, but at the moment only IQ – you can’t record individual frequencies.

Saying that, I’ve seen the SDRuno Roadmap for future releases and not only will recording of individual frequencies be possible, a more advanced scheduler is to be included. This is something I feel SDRConsole – amazing though it is – is lacking when it comes to single frequency recording. There is also the issue with SDRConsole that you are limited to recording only 6 hours worth of wav file per frequency.

Anyway, I digress. Back to the RSPdx and go2MONITOR.

To get the SDRs to work correctly with any of the go2 products means creating a configuration file and adding a ExtIO DLL file to the software. This is reasonably easy to do once you get use to it and it enables a GUI to become active so that you can control the SDR through go2MONITOR.

One interesting aspect with the RSPdx GUI is that regardless of what you enter as some of the parameters in the configuration file, the ExtIO file overrides these. Effectively, I just left some of the data as found in a basic configuration template and let the GUI do all the work for me.

So, below are some of the results with today’s first test.

First of all I went into the VHF/UHF side of things and targeted the local TETRA networks. These were found easily and after messing around with the GUI, I was able to get go2MONITOR set up to nicely find all the emissions within the 1.6 MHz bandwidth I’d chosen to use

From there, all I had to do was to select one of the found emissions and let the software do its thing.

Next I moved on to HF where there’s a plethora of data to choose from to test out the SDR. There was quite a large storm going through at the time and my Wellbrook loop and coax feed were getting a bit of a bashing with some considerable interference being produced with the really strong gusts, as can be seen below – the interference between the two HFDL bursts is one such gust.

I’ve frequently mentioned the Results Viewer that’s part of go2MONITOR and with things such as HFDL and TETRA, that process data quickly from lots of signals, this part of the software comes into its own.

The image below is two minutes of HFDL monitoring. All the red blocks is received data that scrolled through the Channel window too quickly to read live. In the viewer you can select any of the signals and you’ll be shown the message as sent. In this case, it is one sent by an Open Skies Treaty observation flight OSY11F.

By looking at the Lat/Long and comparing it to the flight history from FlightAware and its location at 1313z it ties in nicely. This flight was carried out by the German Air Force A319 1503 specially kitted out to make these flights.

go2MONITOR has a basic map function within the Result Viewer function so if there’s any Lat/Long position within any message it will plot it – as shown below for OSY11F at 1313z.

Within the General tab of Result Viewer you can get all the parameters of the signal.

One final test that I carried out was how well everything coped with a bigger bandwidth. In HF I can use up to 3 MHz of bandwidth with the licence I have – going up to 10 MHz once into VHF/UHF. In HF then, I selected 3 MHz in the GUI and then ran an emissions search.

My PC is nearing the end of its life but it coped easily with the amount of data found despite only having 4 GB of RAM with a 3.6 GHz AMD processor – a new PC is in the pipeline that is going to give me much better processing power.

Despite having 3 MHz available, not everything was identified. Most of this was at the fringes of the bandwidth, but some of the weaker signals also failed. That doesn’t mean you can’t then process them further, you can, it’s just the Emissions scan hasn’t quite been able to ID them. Saying that, the software managed to ID things within 2.2 MHz of the 3 MHz bandwidth.

I picked one of the weaker signals to see how both the RSPdx and software coped and they did very well, pretty much decoding all of the CIS-50-50 messages that were coming through on 8678 kHz.

So, overall, pretty pleased with how the RSPdx works with go2MONITOR.

Once I get a better PC I’ll be able to test at bigger bandwidths but even with 3 MHz here I was able to achieve the same, if not better, results than I have with the considerably more expensive WinRadio G31 Excalibur I have been using previously (running with the G33 hack software).

Not that I’m likely to really use go2MONITOR at big bandwidths – 1.6 MHz is probably fine for me – but for Pro’s there’s no doubt that having these “cheaper” SDRs would make absolutely no difference over using an expensive one such as those in the WinRadio range. In all honesty, I don’t think I’ll be holding on to the WinRadio for much longer – I’m more likely to get another RSPdx to cover this area of my monitoring.

On its own, as an SDR, the RSPdx is worth the money I’d say. I like it just as much as I do the AirSpy HF+ Discovery – the only real difference I can see between these two SDRs is the max bandwidth available.

Link-11 SLEW with go2MONITOR

In early November, whilst working on an article for Janes, I noticed a Link-11 SLEW signal on 4510 kHz (CF) that was slowly growing in reception strength. I’d been monitoring frequencies used by the Northern Fleet of the Russian navy around this one and had already spotted that Link-11 CLEW was being used on a nearby frequency, though this remained at a constant signal strength at my location. The fact that the Link-11 SLEW was getting stronger made me stop what I was doing and start concentrating on this instead.

AirSpy HF+ Discovery SDR with SDRConsole operating software. Link-11 SLEW signal in Receiver 1, and the weaker Link-11 CLEW signal in Receiver 3. Whilst there a two SLEW signals showing, there is just one, with the left hand one being produced by the strong signal. You can see the weaker transmissions from a receiving station between the stronger ones on the correct frequency, but not on the “reflection”.

Link-11 SLEW (Single-Tone Link-11 waveform) ,or STANAG 5511, is a NATO Standard for tactical data exchange used between multiple platforms, be it on Land, Sea or Air. Its main function is the exchange of radar information, and in HF this is particularly useful for platforms that are beyond line of sight of each other and therefore cannot use the UHF version of Link-11.

With propagation being the way it is, in theory radar data could be exchanged between platforms that are hundreds to thousands of miles apart, therefore providing a wider picture of operations to other mobile platforms and fixed land bases. This data can also be forwarded on using ground stations that receive the data and then re-transmit on another frequency and/or frequency band. However, the approximate range of an individual broadcast on HF is reported to be 300nm.

As well as radar information, electronic warfare (EW) and command data can also be transmitted, but despite the capability to transmit radar data, it is not used for ATC purposes. In the UK, Link-11 is used by both the RAF (in E-3 AWAC’s and Tactical Air Control Centres) and the Royal Navy. Primarily it is used for sharing of Maritime data. Maritime Patrol Aircraft (MPA’s) such as USN P-8’s and Canadian CP-140’s use Link-11 both as receivers and transmitters of data, so when the RAF start using their P-8’s operationally in 2020 expect this to be added to the UK list. Whilst it is a secure data system, certain parameters can be extracted for network analysis and it can be subjected to Electronic Countermeasures (ECM).

Link-11 data is correlated against any tracks already present on a receivers radar picture. If a track is there it is ignored, whilst any that are missing are added but with a different symbol to show it is not being tracked by their own equipment. As this shared data is normally beyond the range of a ships own radar systems, this can provide an early warning of possible offensive aircraft, missiles or ships that would not normally be available.

I started up go2MONITOR and linked it to my WinRadio G31 Excalibur. Using a centre frequency of 4510 kHz I ran an emission search and selected the Link-11 SLEW modulation that it found at this frequency.

It immediately started decoding as much as it could, and I noticed that three Address ID’s were in the network.

go2MONITOR in action just after starting it up. Note, three ID’s in the network – 2_o, 30_o and 71_o

As the signal was strong, and it is normally maritime radar data that is being transmitted, I decided to have a quick look on AIS to see if there was anything showing nearby. Using AISLive I spotted that Norwegian navy Fridtjof Nansen class FFGHM Thor Heyerdahl was 18.5 nm SW of my location, just to the west of the island Ailsa Craig. Whilst it was using an incorrect name for AIS identification, its ITU callsign of LABH gave me the correct ID. This appeared to be the likely candidate for the strong Link-11 signal.

Position of Thor Heyerdahl from my AIS receiver using AISLive software

It wasn’t the best day and it was pretty murky out to sea with visibility being around 5nm – I certainly couldn’t see the Isle of Arran 11.5 nm away. I kept an eye on the AIS track for Thor Heyerdahl but it didn’t appear to be moving.

Whilst my own gear doesn’t allow me to carry out any Direction Finding (DF) I elected to utilise SDR.hu and KiwiSDR’s to see if I could get a good TDoA fix on a potential transmitter site – TDoA = Time Difference Of Arrival, also known as multilateration or MLAT. Whilst not 100% accurate, TDoA is surprisingly good and will sometimes get you to within a few kilometres of a transmission site with a strong signal.

One of my thoughts was that the signal was emanating from the UK Defence High Frequency Communications Service (DHFCS) site at either St. Eval in Cornwall or Inskip in Lancashire. With this in mind I picked relevant KiwiSDR’s that surrounded these two sites and my area and ran a TDoA.

St. Eval transmitter site at 50°28’43.0″N 4°59’58.0″W
Inskip transmitter site at 53°49’26.6″N 2°50’14.1″W

As expected, the result showed the probable transmitter site as just over 58 kilometres from St. Eval, though the overall shape and “hot area” of the TDoA map also covered Inskip, running along the West coast of England, Wales and Scotland. It peaked exactly in line to where the Norwegian navy ship and I were located! With the fact that there were signals being received from three different sources it is highly likely this has averaged out to this plot.

TDoA result showing the likely transmitter site at 50.60N 4.20W. Note the elongated “hot spot” which denotes the area that the transmitter site is likely to be situated.

Just after 10am the weather cleared allowing me to see a US Navy Arleigh Burke class DDGHM between myself and Arran. This added an extra ship to the equation, and also tied in with the TDoA hot spot. Things were getting even more interesting!

Link-11 SLEW at its strongest which also coincided with USS Gridley being its closest to my location.

Thor Heyerdahl still hadn’t moved according to AISLive but the Arleigh Burke was clearly heading in to the Royal Navy base at Faslane. With my Bearcat UBC-800T scanning the maritime frequencies it wasn’t long before “Warship 101” called up for Clyde pilot information along with an estimate for Ashton Buoy of 1300z. Warship 101 tied up with Arleigh Burke USS Gridley.

The Link-11 SLEW signal was considerably weaker at the time USS Gridley was at Ashton Buoy.

As USS Gridley progressed towards Faslane, the signal started to get weaker. Ashton Buoy is where most ships inbound for Faslane meet the pilot and tugs, taking up to another 30 minutes to get from there to alongside at the base – a journey of about 8.5nm.

At 1328z the Link-11 SLEW signal ended which coincided with the time that USS Gridley approached alongside at Faslane. It would be at about this time that most of the radar systems used on the ship would have been powered down so data was no longer available for transmission, therefore the Link-11 network was not required any further and it was disconnected.

The Link-11 SLEW signal disappeared at 1328z
Some images of USS Gridley arriving into Faslane taken by good friend Dougie Coull

So, was this Link-11 SLEW connected to USS Gridley? And was the ship also the NCS of the network? I think the answer is yes to both, and I’ll explain a couple of things that leads me to this conclusion. But first…………….

Link-11 SLEW Technical details

Using Upper Side Band (USB) in HF, a single waveform is generated in a PSK-8 modulated, 1800 Hz tone. The symbol rate is 2400 Bd and the user data rate is 1800 bps. Link-11 SLEW is an improved version of the older Link-11 CLEW modulation and due to enhanced error detection and correction is a more robust method of sending data. This makes it more likely that transmissions are received correctly the first time. Moreover, an adaptive system is used to counter any multipath signals the receiving unit may experience due to HF propagation.

The waveform transmission consists of an acquisition preamble followed by two or more fields, each of which is followed by a reinsertion probe. The field after the preamble is a header field containing information that is used by the CDS (Combat Data System) and an encryptor. If a network Participating Unit (PU) has any data, for instance track data, this follows the reinsertion probe. Finally, an end-of-message (EOM) is sent followed by a reinsertion probe.

The header is made up of 33 data bits and 12 error detection bits (CRC – Cyclic Redundancy Check). The 45 bit sequence is encoded with a 1/2 rate error correction code therefore giving a 90 bit field. The header contains information on the transmission type used, Picket/Participating Unit (PU) address, KG-40 Message Indicator, the NCS/Picket designation and a spare field.

Broken down, each piece of information is made up as follows:

The transmission type indicates the format of the transmission – 0 for a NCS (Network Control) Interrogation Message (NCS IM); 1 for a NCS Interrogation with Message (NCS IWM) or a Picket reply.

The address contains either the address of the next Picket or that of the Picket that initiated the call.

The KG-40 Message Indicator (MI) contains a number sequence generated by a KG-40AR cryptographic device. Synchronization is achieved when the receiver acquires the correct MI. For a NCS IM this will be made up of zeros as no message or data is actually sent.

The NCS/Picket designation identifies whether the current transmission originates from the NCS or PU: 0 = NCS; 1 = PU

Following on from the header, the SLEW data field consists of 48 information data bits along with 12 error detection and correction bits, themselves encoded with 2/3 rate error correction. This creates a 90 bit data field. 

The EOM indicates the end of the transmission and is also a 90 bit field. There are no error detection or correction bits. Depending on the unit that is transmitting, a different sequence is sent – NCS = 0’s; PU = 1’s

Analysis

There is a specific order of transmissions which takes place for data to be exchanged.

Ordinarily the NCS sends data that creates the network, synchronizing things such as platform clocks etc. Each PU is called by the NCS and any data that a PU has is then sent, or the NCS sends data, or both. This is a very simple explanation of how data is exchanged but if you monitor a SLEW network you’ll see the exchanges take place rapidly. Except for the message itself which is encrypted, go2MONITOR will decode all the relevant information for you for analysis. This means that you don’t need to look at each raw data burst as sent to calculate whether it was a PU reply or NCS IWM, the decoder will do this for you.

At this point I need to say that Link-11 decoding is only available in the Mil version of go2MONITOR so doesn’t come as standard. Should you be interested in Link-11 decoding yourself then you would need to go for the full go2MONITOR package to enable this.

As previously mentioned, the data itself is encrypted but it is possible to try to calculate who is who within the network, and the analysis of the header information in particular will give you a good clue if you already know of potential PU’s that could be on the frequency.

In this case we already have four possible PU’s:

  1. USS Gridley
  2. Thor Heyerdahl
  3. St. Eval transmitter site
  4. Inskip transmitter site

It later transpired that Thor Heyerdahl had gone into Belfast Harbour for repairs so this practically cancelled out this ship as the NCS though it could still be a PU. Moreover, Thor Heyerdahl and USS Gridley were part of the same NATO squadron at that time which meant it was highly likely they were on the same network. This left us with three choices for the NCS, but still four for the network.

Here, I’d cancel out Inskip completely as both the NCS and a PU as the TDoA appeared to give a stronger indication to St. Eval – that left us with three in the network.

The pure fact that the strength of the major signal increased as USS Gridley got closer to my location, then slowly faded as she went further away added to my theory of her being the NCS. This was practically confirmed when the signal stopped on arrival to Faslane. Throughout the monitoring period he other signals on the frequency remained at the same strength.

Based on this, this meant that the strong signal was USS Gridley using ID Address 2_o.

Let’s take a look at one the previous screenshots, but this time with annotations explaining a number of points.

Firstly, we need to look for the NCS. The easiest way to do this is to look at the NCS/Picket Designation and find transmissions that are a zero, combined with a Message Type that indicates it is a NCS IWM. Here, there is just one transmission and that emanates from Address ID 2_o – the long one that includes a data message.

We next need to find NCS/Picket Designation transmissions that still have a zero – therefore coming from the NCS – but that have a Message Type that show it to be a NCS IM. These are calls from the NCS to any PU’s that are on the network looking to see if they have any “traffic” or messages.

Because of this there should be numerous messages of this type, and if you notice none have an ID address of 2_o. However, all of these messages are actually coming from 2_o as the ID address shown in a NCS IM is that of the PU being called rather than who it is from.

Any reply messages from PU’s will show as a NCS IWM/PU Reply transmission, but importantly the NCS/PU designation will be a one – showing it isn’t the NCS. Here there is one data reply from 71_o. You’ll notice that in the “reflection” there isn’t any transmission, unlike the ones from 2_o.

Moreover, though not shown here as the messages were off screen and not captured in the screen grab, you can see that one of the PU’s sent another reply message. As I was able to look at the complete message history I was able to see that this was also from 71_o – and 2_o either replied to this or sent further data.

There are two fainter transmissions which were not captured by go2MONITOR. These were from a PU, and must have been 30_o as there are no transmissions at all in the sequence that are from this ID address.

We now have a quandry. Who was 30_o and who was 71_o?

Data is definitely being sent by 71_o so to me this is more likely to be a ship rather than a transmitter site – but – a strong TDoA signal pointing at St. Eval makes it look like 71_o is this location instead.

Now though, we need to think outside the box a bit and realise that I’m looking at two different sources of radio reception. The TDoA receivers I selected were nowhere near my location as I’d selected KiwiSDR’s that surrounded St. Eval. This meant the signal that was weak with me could have been strong with these, therefore giving the result above.

If I base the fact that I think USS Gridley is 2_o due to strength, then I must presume the same with 71_o and call this as Thor Heyerdahl as this is the second strongest signal. I can also say that having gone through the four and a half hours of Link-11 SLEW transmissions available that 30_o never sent a single data transmission – or rather, not one that was received by me.

Full four and a half hours of Link-11 SLEW as shown in the go2MONITOR results page. You can see other areas (in red) that I was decoding at the same same. By selecting an area in the results page you can access the data as decoded, saved into files. I could have further enhanced this and carried out a full audio recording for further analysis, but I didn’t on this occasion.

Here then is my conclusion:

  1. USS Gridley = 2_o and the NCS
  2. Thor Heyerdahl = 71_o
  3. St. Eval transmitter site = 30_o

Of course, we’ll never really know, but I hope this shows some of the extra things you can do with go2MONITOR and that it isn’t just a decoder. It really can add further interest to your radio monitoring if you’re an amateur; and if you’re a professional with a full plethora of gear, direction finders, receiver networks etc. then you really can start getting some interesting results in SIGINT gathering with this software – and highly likely be able to pinpoint exactly who was who in this scenario.

Now, how do I get some Direction Finders set up near me….Hmmmmmm??

SDR Console V3 analyser

The shack, finally operational after a few months off.

With the rebuild of my shack complete I’ve been able to start testing out all my radios, new connections etc.

The Mini-Circuits components all come well packaged in anti-static bags

A whole bundle of new cables from Mini-Circuits arrived last of all and have helped tidy up the back of the radio 19″ rack considerably. I’ve previously installed quite a few Mini-Circuits components, including 0.141″ diameter Hand-Flex interconnect cables, and so it was more of these that I opted for. The bonus with these cables is that they are hand formable meaning you can shape and bend them into pretty much any area that you want to. The 141 series (which I use) are capable of a 8mm bend radius, whilst the thinner 086 series can be bent to 6mm.

Being able to manipulate the cables certainly helps in tight spaces, and when you don’t want them to hang down

Previously I used hand-made cables with RG58U coax, but in order to have a 19″ rack that can slide out from under the desk, the cables needed to be longer than actually required. Because of this the cables would drop down into all the others attached to the PC and in some cases cause a little interference. With the Hand-Flex cables I’ve been able to use the same length of coax to allow me to move out the rack, but be able to bend them up and out of the way of the PC cables.

They’re also very good for the radios on the rack, being able to bend them and hold in place around the radios and other cables. They are near lossless too with a quoted insertion loss of 0.01 dB in the HF band to 0.55 dB at 18GHz. I normally run tests of the Mini-Circuit components when I receive them and find that the figures quoted are near spot on. I highly recommend these cables if you’re looking to upgrade your systems, and are available from the Mini-Circuits website, along with lots of other goodies that will tempt you.

Measurement of insertion loss of the Mini-Circuits ZF3RSC-542B-S+ Power Splitter/Combiner I also purchased as part of my plans for satellite communication monitoring. This is connected to the AirSpy SDR and takes feeds from two SatCom connections (currently deactivated) and a WinRadio AX-71C Discone Antenna. Mini-Circuits quote an insertion loss of around 19.5dB at 130 MHz which is confirmed here with a signal generated at -20dB being less than 1dB out at -40.48dB when passed through the combiner.

This image shows how the cables can be held in place without cable ties

The radio setup now includes two new SDR’s – an AirSpy HF+ and a standard AirSpy with the HF+ replacing the Enablia TitanPro. I’ve also reinstated my WinRadio G31DDC which had been in storage for a year or so. I really do like the TitanPro, and have put it into storage for the time being. The recording capabilities in particular are great with it being able to select 40 frequencies at once spread over numerous bandwidths, but I have had issues with the power supply – one being it caused interference. I attempted to make one of my own but it has a 6v(+/-1v)/2.5 Amp current requirement and no matter how many different methods of building my own supply using a 12v feed downgrading to 5, 6 or 7 volts, it just wouldn’t work in a stable manner. In the end it was easier to remove it and slot the G31DDC back in its place.

As it is, I’d forgotten how good the G31DDC is and I don’t really feel like I’m missing much thanks to the ability to use the other SDR’s with SDR Console V3 and it’s SDR Analyser.

The three 19″ racking units from Penn Elcom, along with all the shelves, have been very useful and certainly makes things easier when it comes to changing radios and connections over. I can just disconnect a few things and slide the whole unit out. I also obtained a 19″ Project box from them which I used as my main 12v switch unit. This is connected to two regulated desktop power supplies that act as master switches.

Although the SDR Console website page for the Analyser states it isn’t available yet, this is incorrect and it is downloaded with the latest version of the main programme.

If you’re a current user of V2 or have been in the past then you won’t notice much difference. You can have up to 24 parallel demodulators operating within the SDR’s bandwidth that you have chosen, all of which can run independent of each other in receive and record. You can also run each demodulator through a decoder such as MultiPSK independently and decode these in parallel with each other. This capability has taken that step towards those of the TitanPro, especially when being used with the Elad FDM-S2 that can provide a Maximum DDC bandwidth of 6144kHz’s.

Unfortunately, whilst you can schedule recordings of IQ data, you still can’t do this for individual channel recordings. This is a real shame as it would be a fantastic addition to the capabilities of SDR Console.

Getting back to the analyser though this does, in theory, cancel out the lack of channel recording scheduling.

When you record IQ data it is saved as WAV files, split into multiple ones depending on how long a recording you make . All of these files can be individually played back through the incorporated SDR Console player but even better is the use of the File Analyser.

With this you get a visual “image” of the complete recording, whereby after opening the analyser you get it to combine all the files into one XML file. For the image below I used the FDM-S2 with a selected bandwith of 768kHz centred on 4425kHz, hoping to catch calls to Russian Naval base Severomorsk in CW(RJD99) from ships operating in the region. I set the scheduler up to record from 0000z to 0700z which worked perfectly, giving me 78 files totalling 78GB – obviously, the bigger the bandwidth, the larger the total file size.

After clicking on New in the analyser and browsing to the relevant folder the WAV files are saved in, the analyser finds the first one and gives this as an option to open – it automatically adds the remaining WAV files and starts the process. This can take quite some time to extract, around 45 minutes for the example shown. But you only need to do this once because once it has finished you can save it as an XML file and open it at any time – in this case it was a 28MB XML file.

A note here – do not then delete the WAV files as the analyser still needs them.

As you can see, I was successful in locating calls to RJD99, and I have highlighted some of the others that I took a look at – this is just a screenshot of two hours out of the seven recorded.

All you then need to do is find any signal of interest, and after clicking on select and start in the top ribbon, click on the signal. This will then start playing the file from that location in the main SDR Console window. You don’t need to stay on that frequency, you can use the Console as if you were listening live and move around the frequency range you dictated in the bandwidth of the recording.

And, as it is basically a live screen you can do additional things such as record and use decoding software.

RJI92 calling RJD99 on 4416 kHz during playback of the Analyser

When using the Analyser I run this through a separate PC meaning SDR Console itself can carry on working on the main radio control PC. This is also handy if you’re away but have time to go through the IQ data using a laptop. Just copy over the original WAV files to a portable hard drive/memory stick and carry on as described above.

There are numerous other functions available for you to use with the main part of SDR Console, some I still haven’t had the chance to play with completely. I’m still exploring things such as the Signal History function which can store up to 48 hours of data. Here you can export data in CSV format to third-party programs such as QtiPlot. Signal history can also be used within the Analyser

This is useful as it can give you a quick overview into single frequency use, signal strengths, fading and such like. Definitely something I need to spend more time on.

It’s been a long time coming, but Version 3 of SDR Console has been well worth the wait.

Monitoring the Russian Navy – Part One

As I normally do, a few months after publication in The Spectrum Monitor, here’s one of my articles that was published in the February edition.

Monitoring the Russian Navy – Part One

Amur Class Floating Workshop PM-138 (ПМ-138) passes through the Bosporus. This uses the callsign RBIZ (РБИЗ) on the CW networks. PM-138 is part of the Black Sea Fleet and normally carries out a six month rotation off Tartus, Syria, with the Amur Class PM-56 (ПМ-56), callsign RIR98 (РИР98) - Photo by

Amur Class Floating Workshop PM-138 (ПМ-138) passes through the Bosporus. This uses the callsign RBIZ (РБИЗ) on the CW networks. PM-138 is part of the Black Sea Fleet and normally carries out a six month rotation off Tartus, Syria, with the Amur Class PM-56 (ПМ-56), callsign RIR98 (РИР98) – Photo by Yörük Işık

As I said in one of my first articles for TSM, I only really got back into HF monitoring because of my move to Scotland and treating myself to a desktop radio for listening to VHF/UHF. I decided to push the boat out and get an Icom IC-R8500 as I’d always fancied one and the specifications, as we all know, are top notch. I also thought that as I was going to be working in the same room as Shanwick Oceanic that I would get something that would let me listen to them, I used to love listening to Shanwick. Of course, I soon discovered a lot had changed on the Ocean and the HF got put aside for a while.

It was whilst reading through a Military aviation forum that I noticed that a couple of guys had been monitoring the Russian navy using CW, and that what they had been tracking was possibly the Kiev Class Aircraft Carrier Admiral Kuznetsov and its carrier group. Well, I found this fascinating and started listening to the same frequencies they had listed to see if my makeshift antenna could get anything – and sure enough it did.

Since I was a kid I’d been interested in Russian military hardware, after I’d been given a book called “The Soviet War Machine” to read when visiting my grandparents. Even though it was library book, I took it away on a long-term loan and read it hundreds of times, sucking in as much knowledge as possible. There was something about the design and ruggedness of all their equipment that intrigued me, and man, their Submarines were awesome!!

When I joined the RAF years later, my interest in the Russians changed from the navy to the Air Force and Nuclear threat that I was now (in theory) facing. And from then, up until the moment I found out about monitoring the Russian navy on CW, I didn’t really think much about the navy again. Now I was really interested and I wanted to learn more about this side of monitoring.

Through the UDXF Yahoo group I found lots more logs and frequencies; and then I discovered Fritz Nusser’s great website at http://www.astrosol.ch/. Fritz unfortunately died in July 2014 and so did his website (the domain name now used by Asics trainers!!), but the information held there was nothing but brilliant – frequencies, callsigns, examples of messages, the navy bases and the ships in the different fleets. It was the perfect site for a beginner, which I most certainly was.

Well, now a few years down the line I hope I’m pretty good at what I know, though I can honestly say there are guys out there whose knowledge still amazes me – Trond Jacobsen from Norway for starters. What I’d like to do here though is show you how you can listen in on the Russian navy on CW, and amazingly, be able to track their positions.

The Basics

First of all, I need to show you how the navy is divided up. It is split up into five fleets:
The Northern Fleet (NF) – HQ at Severomorsk
The Baltic Fleet (BF) – HQ at Kaliningrad
The Black Sea Fleet (BSF) – HQ at Sevastopol
The Caspian Flotilla (CF) – HQ at Astrakhan
The Pacific Fleet (PF) – HQ at Vladivostok

The Northern Fleet has recently been incorporated into a new Arctic Joint Strategic Command structure but still operates under its own command system, and it is by far the largest fleet in the navy. Within these fleets there are a large number of submarines and ships, around 265 in total with another 60 or 70 on order, divided between numerous bases within the fleets.

A close up of the antennas on Ropucha Class Amphibious Landing Ship “Novocherkassk” (Ножосхеркасск), callsign RFH71 (РФН71) – Photo by Yörük Işık

Each HQ has a CW callsign, as does each base and then each major ship. We haven’t found any evidence that smaller vessels, and by this I mean harbour tugs etc., have a CW callsign, and the same goes for Submarines. The tugs will be because they rarely leave the harbour area so would be within normal VHF/UHF range of the base; the submarines have other methods of contacting home though there’s no doubt they use VLF/HF for communications, just like the USN boats with EAM’s. I will say though that we also have a huge amount of unidentified callsigns and that these could in fact be tugs, submarines and such like. The likelihood is though, that most of these are smaller missile boats etc. that also rarely leave the confines of the waters they patrol – and also could be Border Guard ships that also use the same radio networks (they also don’t leave their home waters). There’s also the AGI’s or Intelligence Collection ships that use CW but don’t give away their positions, well most of the time anyway – more on this later. As well as the five fleets, there’s also of course Moscow to think of, and the actual Russian navy high command at St. Petersburg. These too make and receive calls and each has their own callsign.

My Russian Navy Callsigns page here on my blog lists all the CW callsigns that have been found, and if tied up, to which ship/base they belong to. It’s not complete, and there are still some changes that need to be made to it as some of the callsigns aren’t necessarily navy – more investigation and time is required on this front.

I will list the HQ callsigns here though:
Moscow = RIW
National Defence Control Centre, St. Petersburg = RAA
Severomorsk = RIT
Kaliningrad = RMP
Sevastopol = RCV
Astrakhan = RJD52
Vladivostok = RJS

To confuse matters though, St. Petersburg for instance, has a base callsign too – RJC66. This is the actual naval station as opposed to the HQ. And there’s also another callsign associated with Moscow, RJE56, which is the actual transmitter site which sends/receives calls – possibly when RIW (and RAA) are off-line – and these also tend to be between land units only, not to/from ships. RAA also only tends to send/receive to/from HQ’s with messages then forwarded on to ships (and vice versa). It’s not uncommon for bases to have multiple callsigns.

You’ll notice that all the callsigns start with an R which is common for the navy, the ships also beginning with the letter R. But there’s also some other elements within the Russian networks that start with this letter, and it’s because of this that confusion arises as to exactly what is navy and what isn’t – the naval (air) network also uses R as the first letter for instance. Each callsign is either three, four or five digits but there is no correlation between the callsigns and the base or ship name; and the ships don’t have a callsign that links into the base they’re stationed at – ships based at Sevastopol don’t start with RCV for instance. They are totally random.

Ropucha Class Amphibious Landing Ship “Yamal” (Ямал), callsign RHV42 (РХЖ42), highlights the problems with using Latin Russian versus Cyrillic Russian. A direct translation of the ships name would be Ämal if it was used as the CW callsign. Knowledge of Russian alphabets certainly helps with monitoring the Russians – photo by Photo by Yörük Işık

How to track the ships

I’ll list some of the frequencies required later on, but the best place to start is to monitor 12464 kHz during the day from 0600z to 1800z; and 8345 kHz overnight from 1800z to 0600z. This isn’t always the case as propagation has its way sometimes and the ships will try the other frequency, but these are the primary ship frequencies to start with and their associated times of use. The Russians work in the majority using a duplex system with the HQ’s using their own frequencies to transmit on. Whilst all of the HQ’s will have an operator listening out on the primary ship frequencies, the ships will be listening to their HQ frequency (frequencies) only. The only other frequency the ships will be listening to is that that has been allocated to RIW for that day in case Moscow wants to get in contact with them, or for flash messages. Some of the ships ignore their home base and send direct to Moscow, and then sometimes if a ships HQ doesn’t answer them they’ll try another to relay on the message for them. I want to cover message types and methods in greater detail in another article so for this one I’m going to concentrate on the message type that allows us to pinpoint the location of the ships.

So how do we do it? It’s actually quite easy, and the Russians use another western method to give us this information. For some reason they use the same code used by NOAA for Marine Surface Weather Observations, the FM-13-X-SHIP. Whether these reports are sent on to NOAA or not, we don’t know, but I doubt it. The Russians have their own Hydrographic units as you’ll see in a moment or by looking at my callsign list and we can only presume that they use this code as it’s already there and they don’t have to think up their own method.

If you’re not familiar with the FM-13 code then here’s a link that will take you to the 150 page PDF file on their website. Below though is an example message sent by RKB91 (РКБ91) – Altay Class Tanker “Kola”:

RKB91 605 16 22 1000 605 = SML FOR RJH45 RJD38 =
22061 99572 10081 41598 43408 10004 40110 51024 70202 8////
22252 00140 22012 = + RKB91

What we have here is a combination of both the Russian navy signal method (line 1) followed by the FM-13 code, ending with the Russian message system again. To decode the first line:
RKB91 = callsign
605 = message number
16 = number of groups in message
22 = date
1000 = Moscow time (this was sent at 0600z, but there’s now a three hour time difference between Moscow and UTC)
605 = repeat of message number
SML = Message priority, in this case SML stands for Samolet (fighter jet) – normal priority
FOR = for
RJH45 RJD38 = Hydrographic station callsigns

The next two lines are the FM-13 message giving the weather at the site of the observation. The link to the codebook will give you further information, but the parts we are most interested in are the first three groups:
22061 = 22 (date), 06 (0600z) 1 (1st FM-13 message of the hour)
99572 = 99 (latitude), 572 (57.2N)
10081 = 10 (Longitude – East), 081 (08.1)
The final group we’re interested in is:
22252 = 222 (heading speed), 5 (heading SW), 2 (6 to10kts)

The last number group and the callsign repeat is part of the Russian message system again – 22012 confirming that there’s 12 groups of numbers in the message and the date, in this case the 22nd.

From this then the message translates to an observation position of – 57.2N 08.1E heading SW @ 6-10kts, just off the North Western coast of Denmark. The position can be viewed here on Bing maps

The Bosporus is a busy channel. Here USN Arleigh Burke Class Destroyer USS Ross heads west, whilst Novocherkassk heads east towards the Black Sea - Photo by Yörük Işık

The Bosporus is a busy channel. Here USN Arleigh Burke Class Destroyer USS Ross heads west, whilst Novocherkassk heads east towards the Black Sea – Photo by Yörük Işık

Most of the messages we receive are of course from the Eastern Longitude and Northern Hemisphere, but we do get the odd one from the Western Longitude, in which case in the example above it would have read 70081. I am yet to receive anything from the Southern Hemisphere but if I were to then the first number would be either a 5 (for Western Latitude, Southern Hemisphere) or a 3 (for Eastern Latitude in the south).

Prior to the FM-13 message RKB91 would have called Kaliningrad to establish the connection, and these go like this:
VVV RMP RMP RMP DE RKB91 RKB91 QSA? QTC

So as you can see, they do use Q codes.

With regards to the Hydrographic stations, we don’t know exactly where they are, but we have rough idea. We’re pretty certain that RJH45 is the main one in Moscow. The second callsign in the example above is probably a regional Hydrographic station for the Baltic region, or a collective for all ships of the Baltic Fleet.

Finally, the messages are normally sent every six hours – 0600z, 1200z, 1800z and 0000z. There are certain times where ships send every three hours. As you can imagine, when it’s busy the frequencies can get a bit chaotic as the calls tend to step all over one another.

I said I didn’t know CW that well, and I don’t really. But you do get use to the patterns of the callsigns, in particular the HQ’s. And you also get used to the radio operators and their speed/way of sending the messages. On one occasion we were able to work out the shift pattern of one ship by the changes in the operator methods.

One other quirk to the Russian CW is the short zero. To save time, instead of five dah’s, they will only send one (T), though this is normally in context and is noticeable whether it should be a zero or a T. Not every operator will do this and they’ll send the zero correctly.

Callsign Tie-Ups

So, we have the callsigns for the bases tied up (well some of them) but how do we get the ships? This is down to a couple of methods, the first being the Russian navy themselves. The Russian navy has a very active website and they regularly post movements of their ships and where they’ve docked. You only need to keep an eye on these reports and tie-up arrival/departure dates with any unidentified callsigns to get a pretty good match up.

The second method is down to online photos, blogs and media such as twitter. There’s numerous different websites that promote photos of ships, sites like Marinetraffic.com, shipspotting.com and shipais.com. These all have dates when the photos were taken. A great blog for getting the Black Sea fleet has to be Bosporus Naval News which not only shows photos taken by locals (including some of those in this article by Yörük Işık) but also lists dates when Naval vessels, not just Russian, pass through the Bosporus.

With all these different methods you can find out what callsign belongs to which ship. It’s not easy, and it can take some time, especially if the ships don’t send many FM-13 reports. Of course, we’re not always right at first. In some cases the ships are in a flotilla, and only one ship out of the group will send a report. In this case you haven’t a clue which one you’re listening to, unless you’ve already tied one from the flotilla up previously. Recently we caught a new callsign, RJC20, going through the Bosporus so we waited for some pictures to emerge only to discover that two ships had gone through together, with only one sending reports. For a short while we thought it had to be Sorum Class Sea-going Tug “MB-31” as this was seemingly the escort ship to Dergach Class Missile Patrol Boat “Samum”; it’s normally the case that in a group the tug or tanker escort would do the FM-13 reports. Further into the reports, going on for a month or so, it still looked like the RJC20 belonged to MB-31 until new information came to light that Samum was taking part in the anniversary of the Battle of Navarino memorial flotilla off Pilos in Greece, the exact location of RJC20. It only took another week or so for RJC20 to return to the Black Sea and Samum was captured on “film” again whilst reports were given that MB-31 was escorting another ship off Malta. So this confirmed that RJC20 was Samum – or did it? On the 28th of March RJC20 plotted through the Bosporus again, and this time only MB-31 went westbound. Eventually then, this tied up RJC20. So you see it’s all about patience and almost a bit of Intelligence investigative skills that make this hobby work – its good fun.

2013 was the 70th Anniversary of the Battle of the Atlantic and an event was held at Liverpool docks. One of the ships that participated was Udaloy Class Destroyer, Vitse Admiral Kulakov. I was unable to attend but one of the Russian CW monitors, Roger Hutchinson, did manage it and was able to take the tour around the ship. I’m not jealous at all. Here’s one of the many photos he took showing the huge amount of antennas on board this destroyer, which uses the callsign RGR35 (PГР35). As well as all the antennas you can see the 30mm AK-630 6 barrelled gun used for air-defence (of which there are four on board) and its associated “Bass Tilt” Fire Control radar on the structure to its right. There’s seven other radars shown here with another 8 or 9 out of shot – photo Roger Hutchinson

2013 was the 70th Anniversary of the Battle of the Atlantic and an event was held at Liverpool docks. One of the ships that participated was Udaloy Class Destroyer, Vitse Admiral Kulakov. I was unable to attend but one of the Russian CW monitors, Roger Hutchinson, did manage it and was able to take the tour around the ship. I’m not jealous at all. Here’s one of the many photos he took showing the huge amount of antennas on board this destroyer, which uses the callsign RGR35 (PГР35). As well as all the antennas you can see the 30mm AK-630 6 barrelled gun used for air-defence (of which there are four on board) and its associated “Bass Tilt” Fire Control radar on the structure to its right. There’s seven other radars shown here with another 8 or 9 out of shot – photo Roger Hutchinson

Earlier I mentioned the AGI ships. These don’t send FM-13 reports at all, and generally only contact Moscow (RIW) with other message types. This then makes it practically impossible to tie up the callsigns – unless the Russian navy happen to help you out. Callsign RMMA has foxed us for well over two years at least, appearing every now and again, and in fact being one of the very first callsigns that I logged. It always has very strong signals to the UK initially which meant it was in the vicinity of the Northern or Baltic fleet home bases, the North Sea or Eastern Atlantic. It would fade eventually as the distance from here increased, but with the usual propagation affects that sometimes brought it booming in.

In September 2012, a Russian navy ship had been spotted off Cape Canaveral where there were two scheduled launches for the beginning of October. There was also a planned launch of a Trident II D5 from a Royal Navy submarine later on in October. At that time there was an unidentified callsign, RJQ84, operating in that area so at first we thought this would be an AGI of some sort, though sending FM-13 messages was unusual. Then RMMA and RJQ84 sent messages to each other, saying to use VHF radios to communicate. This meant they were close to one another and so we thought maybe RJQ84 was an escort ship to the AGI, RMMA. At the end of September RJQ84 headed for Jacksonville, I seem to remember because of a hurricane hitting the area, and reports followed that a Rescue tug had arrived in port, this turning out to be Sliva Class “Vikr”. A few days later other reports announced that Vishnya Class AGI “Viktor Leonov” had suddenly arrived in Havana. And RMMA had disappeared from sending messages. Was RMMA Viktor Leonov? We never got any solid proof and so I left it pencilled in on my list.

RMMA has cropped up since then but with no news of Viktor Leonov there was nothing to go on. So why is this relevant now you say? Well, RMMA turned up about a month ago (December 2014 at time of writing the article), very strong then fading, again no FM-13 reports. On the 22nd of January Tom spotted a news report that Viktor Leonov had again docked at Havana on the 20th, the day that RMMA went off station. This coincidence was too much and RMMA is now logged as Viktor Leonov.

Frequencies

This is a hard one really. Those of us that monitor the Russian navy have discovered hundreds of frequencies that they use; a file on UDXF lists 578 currently in use. To get you started though here’s a few of the more active frequencies:
8345 Ship night primary (duplex)
12464 Ship day primary (duplex)
11000 Moscow (duplex) c/s RIW
14556 Moscow (duplex) c/s RIW
11155 Severomorsk (duplex) c/s RIT
8120 Navy HQ St. Petersburg (simplex) c/s RAA
4079 Kaliningrad (duplex) c/s RMP
8348 Pacific Fleet ship primary (duplex)
5411 Vladivostok (duplex) c/s RJS
3395.5 Sevastopol (simplex) c/s RCV
19201 Sevastopol (weather/nav warnings) c/s RCV
4635 White Sea area ships calling Severodvinsk (duplex)
4376.5 White Sea area ships calling Severodvinsk (duplex)

WinRadio Excalibur memory list for the Russian Navy CW network, whilst monitoring one of the Severodvinsk frequencies, RJD99 (РЙД99). Note also the repeated transmission on 4625, the famous Russian enigma net “The Buzzer”

WinRadio Excalibur memory list for the Russian Navy CW network, whilst monitoring one of the Severodvinsk frequencies, RJD99 (РЙД99). Note also the repeated transmission on 4625, the famous Russian enigma net “The Buzzer”

The White Sea frequencies are always interesting ones to monitor. On quite a few occasions we’ve caught a build of ships before an exercise or launches of nuclear/cruise missile tests from submarines. Most here remain unidentified as they haven’t left the White Sea, or certainly haven’t gone far from it.

I would say, for the West coast of America the best bet is to listen in on the Pacific/Vladivostok frequencies, but this doesn’t mean the others are out of range. We have recently followed Akademik Krylov Class Survey/Research Ship “Admiral Vladimirskiy” (RHO62) on a round the world tour where here in the UK we were able to pick it up on the Pacific primary of 8348 kHz, as well as getting it on 8345 kHz. In fact it used 8345 more than anything in the later stages of being in the Pacific where we able to catch it on the west coast of Costa Rica and going through the Panama Canal. RHO62 is due to go out on another voyage at the end of this year, this time to the Antarctic.

One last tip – always record the frequency, unless you’re super good at CW; and even then, always record the frequency. Sometimes I wonder whether the radio operators are trying to beat the world record for the fastest message sent by Morse code.

Well, I hope you may have found this interesting. Monitoring the Russian navy can be challenging and it has the added element of lots of investigation and research to make it work fully, but that is the fun part. Through this new “hobby” I renewed my interest in Russian military hardware, deciding to buy a Jane’s Fighting Ships a few years ago so that I knew exactly what the ships looked like that I was listening to. Because of this I got to know the editor of the yearbook and I now provide photos as well as carrying out research on the Russian navy for inclusion within the book.

There is still a huge amount to cover and my next article on the Russian navy will be on other message types you may hear when listening in. So until then, do svidaniya i spasibo (до свидания и спасибо)