Utility Dxing: Krypto500: Monitoring Quarterly 1
Utility Dxing: Krypto500: Monitoring Quarterly 1
1| FEBRUARY 2012
Utility DXing:
Krypto500
iBooks Author
HF: Still full of Signals
Still shortwave is full of signals, mostly digital. Many of them can be demodulated and even decoded with some
sophisticated software decoders. This iBook focuses on the new Krypto500 decoder, mainly using this new piece of software
for a very short introduction into utility DXing. You will also find some hands-on comparisons with other high-tech
decoders like GX430 by Rohde & Schwarz, Code3-32P by Hoka and W-Code by Wavecom.
Below: Some signals around 8600 kHz show many different modes and stations from all over the world.
Marine Ankara
Russia
iBooks Author
M UCH TO LISTEN TO frequencies. Their ALE
signals can be heard and
Utility DXing today decoded worldwide.
iBooks Author
or just transmitting tests over and over again. Take the net of available hardware and software is considered to be “open”.
French Navy with stations from Tahiti to Djibouti, which all Hundreds of stations do even verify reception reports.
can be clearly read in a code called STANAG4285. However, there are some stations and some countries
disliking this view.
Are you allowed to tune in? It depends. In a law suit of
German Authorities against me it was judged that the source Decoders: Focusing on Krypto500
of communications takes control of what is “public” and what
Key to this world is a software decoder. The most recent one is
is “secret”. At this stage of technical development it can be
named Krypto500. It has been developed in the Czech
stated that all communications which can be read with freely
Republic, and is distributed by their website. At a price tag of
US-$ 7400 or nearly 6000 Euros, it plays in the same league
as e.g. Wavecom’s W-PC or Hoka’s Code300-32P. In this
realm of decoders, GX430 of Rohde & Schwarz reigns king.
Thanks to generous loans, I had the chance of testing all of
them. This publication focuses on the Krypto500.
iBooks Author
pinpoint the geographical location of the transmission and To find a signal, a sonagram (page 1) is a must. In classifying
doing a finger printing on each transmitter. You can also log the mode, function of “analyzers” or even “classifiers” as part
their activity. of professional decoders will do the bigger part of this work.
For “decoding”, the decoder must have a great selection of
Sounds disappointing in the ears of an ordinary SWL?
up-to-date codes which nowadays are filling the air.
Mustn’t! There literally are thousands of stations which can be
received, and many of their transmissions are decoded by a Helping hands
professional decoder like Krypto500. But this is only one part
If you are a mere newbie to utility DXing, you surely will get
of the fun. You also need a good receiver, most preferably a
lost between all the signals. But not only in this case, I would
software-defined radio, or SDR. Mainly for two reasons: they
like to recommend two valuable reference books, namely
provide exceptionally linear filters of flexible bandwidths, and
Michael Marten’s “Spezial-Frequenzliste” with about 30 000
a large spectrum of HF can be recorded; like up to 4 MHz with
detailed entries and Joerg Klingenfuß’ “Guide to Utility Radio
Winradio’s ExcaliburPRO. Most Utility DXing should be made
Stations”, covering around 8 300 frequencies. To dive deeper
on recorded files where you can repeat playing and changing
into monitoring, Roland Proesch’s excellent “Technical
e.g. bandwidths, AGC or passband tuning.
Handbook for Radio Monitoring HF“ is a reliable guide
through most of the modes you encounter on shortwave.
Three steps to monitoring
SDRs do also provide a sonagram, or “waterfall”. This is a
panorama of frequency and time. It considerably helps in
revealing short-time activity and often assists in classifying
the mode due to some distinctive patterns.
• unearthing a signal
• decoding
iBooks Author
There are several Yahoo Newsgroups dealing with utility
USB dongles are the key to professional decoders: Krypto500,
DXing, most notabliy that of UDXF. Among those many Code3-32), W-Code and GX430 - from above.
websites providing audio bites of several modes, that of Leif
Dehio is a first to stop.
iBooks Author
F IRST S TEPS The signal from the receiver must reach the input of the
decoder. Krypto500 does accept audio and I/Q signals.
Connecting Krypto500 Receiver and decoder are usually connected by a so-called
virtual soundcard (VSC) or virtual audio cable (VAC).
Reception of U.S. Navy Napoli/Italy „ICZ“ on 15043 kHz in ALE, MIL-SD 188-141A: tuning and decoding
Krypto500: Spectrum
Krypto500: Decoder
Krypto500: Sonagram
ExcaliburPRO
iBooks Author
Receiver Control SpectraVue can be controlled by Krypto500 and vice versa.
Krypto500 still recommends to use the graphical user
interface (GUI) of the receiver. Nevertheless, the software
provides connection for controlling at least some features of a
vast selection of professional receivers, among SDRs also Krypto500 controls
Perseus and some of RFSpace., and Icom‘s CI-V. With this frequency and mode of
SpectraVue
feature, you can e.g. scan all ALE channels of a network.
SpectraVue forwards
frequency and mode to
Krypto500
iBooks Author
Part of receiver control is a scanner and a
Typically log of some scanned ALE channels, namely 15043 kHz, 13215
recording feature. kHz and 18003 kHz in USB (U). It caught stations from Chroughton/U.K
(CRO), Naples/Italy (ICZ) and Guam (GUA).
The scanner can be programmes with a set of
frequencies, modes and bandwidths. The
dwell time can be set also. After being started,
it will look up channel by channel, stopping on
each for the defined dwell time. If it notes
some activity, it may stop and record and
demodulate.
iBooks Author
Spectrum and Sonagram
Above you have the spectrum, below the sonagram. You can change the representation of the
signals by choosing different values for „FFT Width“ and „FFT Overlap“.
iBooks Author
Unearthing
Signals
The best way to catch signals is to record
a part of the shortwave band and to make
a sonagram (right) of it.
Then you can tune into the wanted
channels at the right time, where they are
active, and propagation allows for a
steady, strong and clear signal. See the
figure on the right side for an example
from some 150 kHz around 12340 kHz,
recorded with SDR-IP from RFSpace and
software SDR-Radio. You see many short
activities which are worthwile to be
scrutinized.
iBooks Author
S TEP - BY -S TEP Have a look at the gallery on the next page, showing this step-
by-step:
Exploring an ALE Net • Firstly, we have a look at a sonagram, 500 kHz wide, and
showing two hours of activity on 15000 lines. As our brain
has a good pattern recognition (some optical illusions also
relying on this fact), we soon discover some distinctive ALE
selcalls. They last for just twelve seconds and will be easily
missed on a conventional radio.
A sonagram is the tool of choice to get an overlook on activi- The results were as follows:
ties in the utility bands. I use software SDR-Radio of Simon
Brown, together with RFSpace’s SDR-IP for its excellent HF • At 20:24:44 UTC “DB5” calls “DBE” on 5584,8 kHz and
performance, and because it can be locked onto GPS for ultra changes at 20:25:02 UTC to 5565,8 kHz with the same call.
stable and precise frequencies.
• At 20:25:36 UTC “DB3” calls “DBE” on 5565,8 kHz and
These are some general steps to follow: changes at 20:25:54 UTC to 5584,8 kHz with the same call.
Choose the band you like to monitor, and the time. Make a re- DBE stands for Iraqi Border Enforcement. DB3 is “III Border
cording, analyze it by SDR’s function “IQ Data File Analysis”. Police Region, Special Troops Batallion, Kut Central Iranian
Border”, whereas “DB5” stands for “V Border Police Region,
Write down time and frequency of the signal. Take that part of Special Troops Batallion, Najaf Saudi Arabien Border”. DBE is
the recording, where the signal performs best. Replay exactly the headquarter. [Thanks to Tom at UDXF for these infos!]
this part of the recording. The “loop” function will help you
with the next steps of analyzing the signal.
11
iBooks Author
Three steps from discover the signal to decoding, just leaf through the screenshots.
Step 1: Identify some interesting signals within the complete sonagram. Here, four ALE signals have been magnified.
12
iBooks Author
A UTOMATIC VS . O PERATOR Some six modes - how they look, how they sound
What mode?
iBooks Author
Automatic Classification How classification works.live and on the air.
14
iBooks Author
Krypto 500 is
JJF on 8313 kHz with a 1500 baud QPSK signal, correctly analyzed as originating from the
quite generous. Japanese Navy. Alas, there is no green arrow behind the mode. Thus, this version of Krypto500
The software even will not decode this signal.
identifies many of
those signals
which in at least
this version it can-
not decode. Take
for example the
1500 QPSK of the
Japanese Navy.
Yes, mostly those
channels carry an 1500 QPSK
8-tone ASK (ampli-
tude shift keying)
signal called „Slot
Machine“, but this
is sometimes re-
placed by a QPSK
signal, Krypto500
correctly deter-
mines - see the screenshot.
The next chapter will deal with identifying also exotic signals
manually by analyzing their specific characteristics.
15
iBooks Author
T AKING M EASUREMENT
How high
the ACF?
iBooks Author
O F PHASES AND C ORRELATION
FSK
FSK and PSK, X-rayed FSK in its most easy form consists of two frequencies,
switched alternatively according to the information. The shift
between those two signals is as important as the Baud rate,
and the pattern of those bits. ACF, or auto correlation
function, will show this bit pattern. Krypto500 also most
automatically will find both signals, and will determine the
shift between them by „FSK Autotune“.
A RTTY station with 7,5 Bit (ACF) will show this window. Above you see
both tones, followed by some measured values, starting with „Center
Frequency“, followed by „spectrum“ of ACF, and its graphical
As the manual of Krypto500 provides an instructive representation below.
step-by-step introduction in analyzing a signal, I here
just want to give a few examples.
17
iBooks Author
PSK Switched to decoding ARINC-635, the phase gets sharper.
In PSK, phase shifting carries the information. With data
communications within a bandwidth of 3000 Hz, two to 16
phases are common. They are represented by the phase plane.
18
iBooks Author
ACF can also be detected and shown in PSK signals. Here a
STANG4285 signal, exhibiting an ACF of 106,67 millseconds.
19
iBooks Author
O N AIR
Some Modes
iBooks Author
ARINC 635 Three ground stations
This is a system of worldwide ground stations, built by
„Aeronautical Radio Corporation Inc.“ of Annapolis
MD/USA. You can receive and decode telegrams of ground
stations as well as airborne stations which are sent in a
GPS-controlled time pattern on numerous frequencies. The
so-called „Squitters“ from the ground stations do carry the
identification plus those stations and frequencies on this net
which this specific
station is able to
ARINC 635, structure of the signal receive. Thus, you
can tune into exactly
Date, 1,8 or 4,2 s
their frequencies to
check whether the
ionospheric path is
open. Tuned to 10075 kHz, I received Bahrain transmitting a list
of ARINC station they hear.
Pre-key,
Exactly that has
249 ms been done for the
gallery on the right
side, starting with
Preamble,
Bahrain von 10075
295 ms
kHz, switching to
Guam 6552 kHz and
eventually
Johannesburg on
13321 kHz.
21
iBooks Author
ALE
This „automatic link establishment“ is somewhat ubiquitous
on the bands as in this publication.Just some quickly picked
up examples below.
Iraqi Army, 7th Brigade Special Troop Bataillon, Ninawa („NAN“) calling Iraqi Border Police Tikrit („DB2“), 5493
kHz, 17:15 UTC
Navy Lithuania („P1G“), calling another station („S1B“), 8166 kHz, 17:45 UTC
Croation Amateur Radio Emergency Operation Network (HRSVKS), near Samabor/south-east of Zagreb („9A5EX“),
5403,5 kHz, 17:20 UTC
22
iBooks Author
CTCSS Open, sesame!
In FM, some transmitters
add a special tone in the
lower audio range to open
up e.g. the receiver of a
relay. This „continous
tone-coded squelch
system“ is used by hams in
the 10 m band, as well in
CB radio, and also among
radio stations with some
feeder transmitters from
studio to the main
transmitter. The CTCSS
tones range from 67.0 Hz
to 250.3 Hz, and are
filtered out („notched“) at
the cooperating receiver.
Krypto500 decodes those
tones and shows their PL
(private line) code,
introduced by Motorola.
Two examples are given in
the picture gallery, both
with feeder transmissions WBAP from Dallas/Texas provides their transmitters on 820 kHz AM and 96,7 FM by an FM
from the U.S. feeder on 25910 kHz from their studios at 3090 Olive Street, Dallas. They secure the input of their
transmitters - „relay“, technically speaking - by a CTCSS tone of 151.4 Hz. This corresponds to a PL
designation of „5Z“. See also the peak at this frequency in the spectrum of Krypto500.
23
iBooks Author
[M823] Differential GPS DGPS transmitter Zeven with its parameters and the Radio Beacon Almanac of
A service on longwave, providing GPS this station plus some in its vicinity (chain 3D4x). Received on 303,5 kHz.
receivers with information for
correcting their values for most
demanding resolution of the 3D
geographical position. Also called
„DGPS“ for short.
Zeven parameters
24
iBooks Author
STANAG4285 FUV Djibouti - French Navy „East of Suez“
You will find this mode nearly everywhere
on shortwave, but only few signal can be
decoded by the ordinary listener. Most of
those do belong to the French and include
such rare spots like Noumea,
Point-a-Pitre, Papeete and Djibouti. You
may already have seen some of them in
this iBook, and more are to come.
Signal fading from weak to fair, plus some interference of PLC. Nevertheless,
Krypto500 provides a near-perfect copy.
25
iBooks Author
AX25 - Packet Radio Amateur Radio mailbox on 14113 kHz.
Since years, Packet Radio has
been widely used by hams, on
shortwave as well as on the
higher bands.
26
iBooks Author
ARQ-E3 ARQ-E3 signal, 192 Baud, 388 Hz, 11421,6 kHz: Crozet, Mayotte, Djibouti?
A mode, which nowadays is a rare one on
shortwave. One of the very few stations still can be
found on 11421,7 kHz. This is listed as DTRE Base
Alfred-Faure Crozet Island, far south in the Indian
Ocean. Most of the time idling, the few
five-letter-groups and texts in French are regularily
received here under just marginal conditions.
Krypto500 is among the few decoders reading at
least parts of these transmissions, and is doing this
first class - see screenshot on the right.
27
iBooks Author
SITOR-A, ARQ WLO, Mobile Radio AL/USA on 1258,5 kHz with a TOR
massage (teletype on radio). The QBF („quick brown
A mode with automatic request, or ARQ. The transmitter
fox“) text has been receivednot completly
sends out the message in small packets. The receiver has to
check each packet wit a special algorithm and to acknowledge
that this packet almost certainly has been received correctly or
not. In the latter case, this packet is repeated by the
transmitter. If you only listen, you may miss some packets,
because you cannot acknowledge, neither aks for a second try.
Still used for communications between ship and shore in the
maritime bands.
28
iBooks Author
SITOR-B, FEC Algiers Radio on 518 kHz with a weather report.
A mode with so-called „forward-error correction/FEC“, which
in fact is redundancy. Still used e.g. for weather broadcasts in
the maritime bands.
29
iBooks Author
EFR - Europäische Funk-Rundsteuerung 135,6 kHz, transmitter Lakihegy/Hungary.
Kind of a remote control service, operated by three longwave Transmitting time information between the
control signals.
stations; one of them in Germany, the other one in Hungary.
30
iBooks Author
Global Wireless FSK (GW-FSK)
This U.S.-based organisation is responsible for a good part of
today‘s maritime communications. Their FSK channel
markers are daily visitors from numerous locations around
the world. As some of their identifiers are ambigous, you have
in these cases to consult a frequency handbook.
It‘s a fast ship to China: 16 channel markers of GW-FSK. Have a look at the slighty differing shifts.
31
iBooks Author
CW - Morse Code Dah-dah-didah di-da-dit dah: Not every CW station has gone QRT (Q-Code for: closing
down)
This oldest mode of wireless
communications presents a
hard nut to crack for most
decoders. Even when given by a
machine with consistens length
of dit, dah, and the pause, it
remains reluctant to be
automatically decoded. The
ever-existent noise and
crackling on shortwave makes
this case even mor diffcult.
Rohde & Schwarz‘ GX430 excels
in this field. But as ham with
some knowledge on reading the
code by heart, you are often
disappointed by the
performance of any decoder.
Krypto500 plays in the middle
with W-Code and GX430 in
front of it.
Now for the good news: Five examples, very different in ionospheric conditions and quality of keying. But that‘s live at
Nowadays, there is only few HLG/Seoul, RJH66/Kyrgyzstan, RJH69/Belarus, AQP/Karachi and 4XZ/Haifa.
professional communication in
CW. In the video on the right, I found some stations, mostly
Navy. You will easily see that automatic decoding of CW wants
a stable and clear signal. Please observe: not alle signals in
these examples are perfectly keyed by the transmitter!
32
iBooks Author
ICAO Selcall 8891 kHz. After some exchange in voice with mentioning its
selcall also in voice („echo-lima-sierra-bravo“), the airplane is
Most airplanes do identify themselves in the aero bands by a
transmitting its ICAO Selcall „EL-JS“.
so-called „ICAO Selcall“ check. This is a combination of a two
two-tone signal, coding the „callsign“ of this aircraft by four Its decoded correctly. Inadvertently, some speech formants
letters, grouped into two. can also fall into the secall pattern. Hence, they are also
„decoded“. Just ignorme them or change Krpto500‘s dcoding
The video on the right show as example Aeroflot 315 flying
threshold.
between Moscow and New York, and calling Iceland Air on
On route from Moscow and New York, Aeroflot‘s Airbus A330-343 (VQ-BQZ) does a selcall check with Iceland Air, 8891 kHz.
33
iBooks Author
OLIVIA Like music: Olivia is a multitone mode.
This multi-tone mode is
mostly used by hams. It
refers back to the
PICCOLO system which
tried to keep together
Britain‘s empire in the
1950s - HF-wise, at
least. It‘s rather robust,
and comes in different
bandwidth and
numbers of tones. The
screenshot shows a
QSO between
OH/DK4ZC and G3IVB
on 14107,5 kHz. Mode:
standard, 32 tones.
34
iBooks Author
PSK31 Two phases within a bandwidth fo 31 Hz: PSK31
This BPSK mode of Peter
Martinez, G3PLX, nothing
more than revolutionized
amateur radio
communications with low
power. PSK31 created also a
family of similar codes,
some faster, some slower;
some broader. Still, original
PSK31 is one of the best and
frequency-efficient
rag-chew modes on
shortwave.
35
iBooks Author
D IFFERENCES Screenshot of a comparison - see videos on the next pages
Compare!
iBooks Author
Comparison 1: Weak ALE signal
Copy of the weak ALE signal on 556,820 kHz out of Al-Kut/Iraq: first the signal, then decoding with Code3-32P, Krypto500 and
W-Code. Krypto500 performs best.
iBooks Author
Comparison 2: Weak GW-FSK signal
ZSC Capetown on 19692,5 kHz: Code3-32P, Krypto500 and W-Code. Krypto500 delivers fastest aquisition, followed by W-Code. Also
Code3-32 P gave perfect copy, but a bit slower.
iBooks Author
Strong STANAG4285 signal
FUE Brest on 6348 kHz in STANAG4285, strong with only slight multipath: GX430 (no decoder, but fast acquisition), Krypto500
(fast and clear decoding), Code3-32P (fast classification, slower start of nevertheless clear decoding).
iBooks Author
STANAG4285, modest signal, strong multipath
This signal of the French Navy at Noumea/New Caledonia on 16956 kHz shows heavy multipath, placing the hardest nut to
crack for all decoders. Only Sigmira (above) produced a fluently decoded output - as on the right, whereas ...
40
iBooks Author