Lately I have been scanning the frequency spectrum with an R820T and Realtek RTL2832U DVB-T tuner. Scanning the spectrum for mysterious signals and hunting decryption schemes gives me an immense pleasure. With such a module I am able to do frequency sweeps from 24MHz up to 1.8GHz and a few nights ago I spotted some strange Frequency Shift Keying (FSK) bursts at around 153-154 MHz.
POCSAG FSK Signal Reception
An initial thought was that these are traffic light or possibly train radio relaying signals as I live close to the train station. I was clearly able to distinguish the FSK modulation but the encoding/encryption schemes used were still a mystery. An initial guess was RTTY, however after spending some time on the problem it appeared that this was the so called POCSAG protocol and the messages transmitted were clearly coming from the ambulance/emergency services.
I found about Elias Oenal / Tom Sailer’s multimon-ng decoder and decided to give it a try. Aaah, it’s so great when you can use things ready made by someone else, although a joke-saying we used to often repeat with colleagues during my bachelor studies in Ruse read “You are not a man if you aren’t writing your hardware drivers on your own!”… After some listening I tuned my receiver on 153.345 MHz and started decoding. (offtopic/public non-encrypted messaage: Simon, if you are reading this, ok, yes, no, agreed, this is not a bravery at all).
A quick command for the enthusiasts: “rtl_fm -g 47.2 -E dc -E edge -f 153.345M -M fm -s 22050 | multimon-ng -t raw -i -p -u -e -f alpha /dev/stdin | grep –line-buffered -i POCSAG > pocsaggrep.txt”
I spotted some quite frightening messages and could not believe that so many accidents are actually happening in right now. Here are some examples of what one can hear/read on these bands. It might not be very politically correct to publish such information, but as there are no names in the messages I am more reliant that is should be OK, for the name of science 😉
POCSAG1200: Address: 432795 Function: 2 Alpha: 22:39-11 11/12/2014 22:38:28 INC 11703852 27D03S 2 SLAIDBURN PLACE, RIBBLETON PRESTON, PR2 6JY Male 30 Years MALE – STABBED GRD 357053 430858<NUL>
POCSAG1200: Address: 640324 Function: 2 Alpha: 22:37-78 11/12/2014 22:35:21 INC 11703843 17D03 PENNY FARTHING THEATRE BAR, 89 ROE STREET, LIVERPOOL CITY CENTRE L1, L1 1EP Female 45 Years fem been on drugs and alcohol/ fallen
POCSAG1200: Address: 40078 Function: 2 Alpha: 22:35-39 11/12/2014 22:34:13 INC 11703838 10C02 BROOK COURT – FLAT 45, MOOR LANE, SALFORD 7 SALFORD, M7 3NF Female 85 Years FEMALE CHEST PAIN GRD 382144 402077
POCSAG1200: Address: 1565498 Function: 2 Alpha: 22:31-32 11/12/2014 22:30:12 INC 11703827 01D01 132 SHEAR BROW, BLACKBURN, BB1 8DZ Female 34 Years Pt condition has worsend- Upper stomach and lower back pain GRD 367963 429071<NUL>
POCSAG1200: Address: 1259918 Function: 2 Alpha: 22:31-70 11/12/2014 22:28:52 INC 11703821 19C03 THE VENUS BUILDING, G4 SECURITY, OLD PARK LANE, TRAFFORD PARK MANCHESTER, M41 7HA Male 55 Years Q ANGINA ATTACK GRD 376491 396927
POCSAG1200: Address: 432795 Function: 2 Alpha: 22:30-10 11/12/2014 22:26:49 INC 11703812 11D02 86 YEWTREE AVENUE, GRANGE/RIBBLETON PRESTON, PR2 6QA Male 1 Months BABY NOT BREATHING GRD 357222 431741
POCSAG1200: Address: 432477 Function: 2 Alpha: 22:29-85 11/12/2014 22:28:40 INC 11703820 09E01 45 BEECHWOOD ROAD, BROMBOROUGH WIRRAL CH62, CH62 7BQ Male 79 Years MALE FALLEN GRD 334376 381540<NUL>
POCSAG1200: Address: 16127 Function: 2 Alpha: 22:27-43 11/12/2014 22:25:05 INC 11703810 30D01 (BLUE ANCHOR, AINTREE LANE, AINTREE L10, L10 2JJ Female 67 Years M F HEAD INJ GRD 337376 398861<NUL><NUL>
POCSAG1200: Address: 134937 Function: 2 Alpha: 22:11-02 FOR YOUR INFORMATION **** ****** HAS LEFT THE INCIDENT SCENE AT SHILBOTTLE NOW, IT APPEARS THAT THE 80 YEAR OLD FEMALE OCCUPANT HAS TRIED TO SET A FIRE IN AN AREA OTHER THAN THE FIREPLACE, ALTHOUGH THERE WAS A FIRE IN THE FIREPLACE, THIS HAS SET FIRE TO CURTAINS WHICH SHE HAS REMOVED AND TRIED TO TAKE OUTSIDE WHICH PROBABLY RESULTED IN HER SETTING FIRE TO HER CLOTHING, SHE MAY BE SUFFERING FROM SOME DEMENTIA AS THERE WERE CORNFLAKES IN THE OVEN. PARAMEDICS INDICATE THAT ALTHOUGH SHE IS SUFFERING 45% BURNS THEY DO NOT APPEAR TO BE TOO DEEP BUT AT THIS STAGE IT IS DIFF
However, it seems like these messages are transmitted nationwide, or? Anyone, ideas? Some addresses listed are not even in the region I am…
POCSAG1200: Address: 14904 Function: 0 Alpha: 23:38-11 POLICE SERVICE OF NORTHERN IRELAND PLS CALL BACK 07989 970 160 RE FESABILITY CHECK
POCSAG1200: Address: 1039155 Function: 3 Alpha: <ACK>/
POCSAG1200: Address: 18743 Function: 2 Alpha: 23:39-15 PLS CALL CHILDRENS CDU ON 26876 – 2ND REQUEST<NUL><NUL>
POCSAG1200: Address: 49263 Function: 2 Alpha: 23:39-95 MEDICAL EMERGENCY – WARD 1 – UHND
POCSAG1200: Address: 311674 Function: 0 Alpha: 23:40-84 THIS IS A PAGER TEST PLS RESPOND VIA RADIO
Here is a short video on rtl_sdr and POCSAG decryption (you will note the discontinuity in the sound, it is due to CPU overload, sorry).
The next interesting miniproject would be live weather satellite multispectral image reception and reconstruction. Once I complete the latter I promise a proper post with more and interesting satellite images, hopefully, luckily, Christmas and New Year are approaching… 🙂