Lscott

Well then it wasn't DMR after all. The FCC database shows Delta Com is licensed for 462.53125, which is a standard frequency. The location shown is in Southfield, another is in Novi. NX48 is the very narrow mode of NXDN. This was the result of doing a search on digitalfrequencysearch.com under NXDN. Then looked up the license on the FCC's ULS license database. https://wireless2.fcc.gov/UlsApp/UlsSearch/licenseLocDetail.jsp?licKey=1925372&keyLoc=15068559 The building in Southfield I think is the huge gold coated glass building near Evergreen and 10 Mile in Southfield. Right across the expressway from Lawrence Technological University, LTU, and down the street from Channel 7 TV. The signal might be a strong reflection off the water tower by the AAM plant in Royal Oak. I can't monitor an NXDN trunked system using my Kenwood NXDN radios. The firmware will refuse to open the audio on the radio. It detects the packets are coming from a trunked system and as a security measure won't produce audio unless the radio is registered on the system. Entering the frequencies as simplex won't work either. I've been told that Icom NXDN radios would likely work, they don't have that quirk builtin to their firmware, however I can't confirm that. NXDN Standards.zip

I’ve attached one of the DMR standards documents I have on file. Starting in section 10 the RF specifications start. That covers permissible frequency errors, slot timing etc. Elsewhere the various types and headers are covered. The are about 7 documents for the base DMR protocol. When reading the document “BS” is read as Base Station and “MS” as Mobile Station. ETSI TS 102 361-1 V2.5.1.pdf

Apparently there are some of the VHF NOAA transmitters connected to the studio/control site through a UHF link. See attached file. So far I haven’t had any luck with the UHF link frequencies but others might. NOAA UHF Weather Link Frequencies.pdf

This looks like it’s going off the rails. I would quit looking at what’s coming out of the packet decoders until with 100 percent certainly the mode is positively identified. For the various modes the RF has some very characteristic features. For example DMR, P25 Phase-2 and Tetra are all TDMA based with particular bandwidths of the signal and slot timing. P25 Phase-1 is like NXDN, both are ONLY FDMA based. But, NXDN has two bandwidths, narrow and very narrow that are used. Once there is zero doubt about the mode then worry what’s coming out of the decoders. For now it looks like garbage mostly. Even if the voice payload is encrypted the headers are not. It’s has to be this way for the state machine in the radio’s firmware to figure out what type of packet it is and what to do with it. If you’re getting good decodes then at least the packet type should be identifiable even if the payload is encrypted. Assuming it’s a Motorola system then the encryption is likely one of several types, basic - enhanced - AES/DES. The basic mode used on Motorola radios is a low bit count scrambler type proprietary to Motorola. It’s available on many of their digital radios. The enhanced encryption is usually RC4, a 40 bit stream encryption, available on many radios besides Motorola. I have it on several of my Kenwood NX-1300DUK5’s. https://forums.mygmrs.com/gallery/image/290-nx-1300duk5/?context=new The AES/DES encryption is available on the higher end Motorola radios only, I believe, and on other manufacturers as well. It’s also on my Anytone D878 and D578 too at no extra cost. Currently you’re not likely to find much in the way of decryption software since the FCC rules now make it clear it’s against the law to decode encrypted transmissions you’re not authorized to receive. The guys doing the SDR software have said they won’t touch it for that reason.

Microprocessor crystals are not that accurate compared to communication grade TCXO’s.

If it’s really a transmitter you can only program in fixed step sizes unless it has a “true” VFO. The common usual step sizes I’m aware of by are 2.5, 3.125, 6.25, 12.5, 20 and 25 KHz. The frequency you’re measuring is likely a combination of the frequency error of both the SDR dongle and the transmitter’s reference oscillator.

That’s the very narrow mode of NXDN. The bandwidth is only 6.25KHz.

NXDN is FDMA only. There is no TDMA mode, so it can’t be DCDM. The later is for DMR only. Motorola doesn’t sell any NXDN equipment I’m aware of. Now if it’s really TDMA it could be a P25 Phase 2 trunking system. So far TDMA mode is only used with P25 on trunking systems, not used for simplex as far as I know.

That’s a Doppler direction finding setup. You see about the same thing on cop cars, Lojack system I believe it’s called.

The mystery continues.

It looks like there are some cell phone slot antennas up there in the photo. I doubt those are 900MHz. I wouldn't trust their response just yet.

Yeah, there is specific software for that sort of thing, CAD-AVL, Computer Aided Dispatch - Automatic Vehicle Location, applications. Acom Automax CAD.pdf Kenwood_KGP-2A_KGP-2B.pdf

Now that would start to make a lot more sense.

They have no idea whose antennas are on THEIR tower! The repeater is likely in the small block house at ground level. Maybe if you could gain access to the inside you might find some contact info on the equipment. That would save you a lot of research.

Yup, just don't expect to get the full boogie out of it.

Still getting basically sporadic noise bursts.

Closest I can tune my radio is 462.53125MHz.

For the moment I have my cheap tri-band radio tuned for 462.5325MHz before screwing around with my DMR radio. I am getting sporadic bursts, mostly noise. The building I'm in has metal mesh in the concrete walls so its a bit of a Faraday cage. However every-once in a while I can make out the TDMA pulsing. Water Tower In Question - 2852 Samoset Rd - Google Maps.pdf This is the water tower right behind the AAM plant.

I would trust Delta Com if they say it's not them. So Delta Com is saying they are experiencing interference too? A complaint to the FCC from them may trigger some response since they are a business paying for the spectrum they use. I would like to know what the water tower people have to say about it, if that's the antenna and source. Maybe it a rouge Chinese Repeater. Keep us updated. It might end up like a knit sweater. You find the end of the thread and start yanking on it. Soon the whole thing starts to unravel.

I have one. Bottom right corner of photo. https://forums.mygmrs.com/gallery/image/415-amplifiersjpeg/?context=new The power output falls off outside of the Ham band. For example the DC current input at 13.8VDC with 4 watts of RF input was about 5 amps. At the GMRS frequencies it dropped to around 3 amps. I need to put it on my Bird watt meter and get a power measurement now that I got some higher power UHF slugs for it. I'm guessing I'm only getting MAYBE 20 to 30 watts at most out of it on GMRS frequencies. https://forums.mygmrs.com/gallery/image/321-bird-43-wattmeter/

The oscillator in the repeater also could be off frequency a bit too. I have heard of some repeaters where they use an OCXO, Oven Controlled Crystal Oscillator, for very high frequency accuracy. I think the cheap SDR dongles use a simple TCXO, Temperature Compensated Crystal Oscillator, module. The usual specifications for those are +/- 0.5 PPM, Parts Per Million, frequency accuracy more or less. Usually portable or battery operated equipment use the TCXO module since the power requirements are way to much due to the electrically heated oven on an OCXO module. Understanding Ovenized Oscillators.pdf

Good point. I think once the correct frequency is nailed down looking it up in the FCC's database would yield results.

This is turning out to be a bit of a real mystery. I wondering now if the owner even licensed the frequency, and not just stuck up their repeater and said screw the FCC. I'm getting the feeling there is a lot of crap out there on the air that isn't properly licensed and the FCC just ignores it until somebody complains. That's not how it's supposed to work.

A good resource to track down digital licenses in the FCC's database is here: https://digitalfrequencysearch.com/index.php If it's a trunking system on a water tower I'm going to guess it's owned and operated by a company that rents out capacity on their system to various users who don't want to put up their own repeater and or don't have the expertise to do so. A small company, with a single location, with their own repeater would typically be located on site if they have one. Given the frequencies and location I''m certain it had to go through an FCC frequency coordinator and should be in their database. They would need to make sure the antenna height, power level and antenna gain won't interfere with other users in the coverage area. And in this case it seems like that area is going to be rather large too. One company would be Deltacom. https://wireless2.fcc.gov/UlsApp/UlsSearch/licenseFreqSum.jsp?licKey=1925372&pageNumToReturn=2 https://wireless2.fcc.gov/UlsApp/UlsSearch/licenseLocSum.jsp?licKey=1925372 The closest to your frequency of 462.5325 is 462.5375. Given the tolerance of the oscillator in the SDR dongle this could be it. It's off by only 5.0KHz. https://wireless2.fcc.gov/UlsApp/UlsSearch/licenseFreqSum.jsp?licKey=2926515&pageNumToReturn=2 https://wireless2.fcc.gov/UlsApp/UlsSearch/licenseLocSum.jsp?licKey=2926515 Here's another company. This one is sort of odd. They are licensed state wide with a frequency range. No channel frequencies listed. https://wireless2.fcc.gov/UlsApp/UlsSearch/license.jsp?licKey=3770395

I see that "RAS" is showing up. I believe that's a Motorola specific feature to validate a radio on a trunking system. This might explain why you're having problems getting audio and multiple frequencies. If it's a trunking system there might be even more frequencies in use you haven't found yet. https://cwh050.mywikis.wiki/wiki/Restricted_Access_to_System