Using VSELP radio to monitor Nextel iDEN?

[billlayton]

Is it possible to monitor a Nextel channel using an old Motorola VSELP radio?

Has anybody found another way to receive and monitor an iDEN frequency?

Is there any affordable test gear available, or can the Nextel phones be placed in test mode to receive a voice channel?

Tks,
BL

[batdude]

R2660 TDMA/iden service monitor


only way i know of to do it.



d

[radioinstl]

there was someone who took a VLSEP radio and jammed a IBME codeplug in it and did some other things (i dont know what)and was able to scan nextel freqs. it was like using a digital conventional scanner to scan a trunked system, load in all the freq and you land on you what ever you get. This was not a "FPP Spectra" i held it in my hand and saw it working.

[n7maq]

Most Nextel DC is now AMBE +.


To tell from the unit use this menu, #*# 321 #*# and look under Primary dispatch. If it shows "N6:1 Dispatch On" then it is AMBE. You can turn the AMBE off with iDEN LAB RSS.

Jim

[Hightower]

there was someone who took a VLSEP radio and jammed a IBME codeplug in it and did some other things (i dont know what)and was able to scan nextel freqs. it was like using a digital conventional scanner to scan a trunked system, load in all the freq and you land on you what ever you get. This was not a "FPP Spectra" i held it in my hand and saw it working.

Just curious, how long ago did you see this in hand. Early 90's when they introduced the iDen system?

Never seen one myself, but heard it is or was possable.......

LOL, FPP Spectra. If you removed everything from a 1meg firmware but conventional operation, there is enough room for simple FPP firmware code.

[Batwings21]

Better yet, the FPP spectra was a spectra, not astro spectra. Something about a government/ railroad spectra hybrid.

[mancow]

Oh God no, please not that nightmare again.

[turbovectorz]

[quote="billlayton"]Is it possible to monitor a Nextel channel using an old Motorola VSELP radio?

The only Moto radio models I know that could do that were Astro Sabers at the 800MHz band. Unless you workout some kind of down converter RF front-end to translate the narrowband frequencies to 450 -- it is possible since I have done it with other radio systems. Also, it depends on how each slot channel is assigned or setup from the service provider. If you managed to get it working, you may just get the interconnect phone calls from time to time instead of the dispatch radio because of different vocoder assignments. It will probably work on tracking a base radio channel with one session, and most other times the speech is garbled.

Has anybody found another way to receive and monitor an iDEN frequency?

Field techs with an iDEN Service Monitor (around $30K USD depending on options)-- It has all the vocoder modes including VSELP and AMBE+2.
They are the only ones I know that were able to do that to test the voice quality of the cellular coverage.

Is there any affordable test gear available, or can the Nextel phones be placed in test mode to receive a voice channel?

This is possible, but it takes a lot work and technical experties to modify the embedded firmware and cellular handset circuit boards.
I remember someone did this on a few systems, eventhough it was limited, on a D-AMPS, GSM, TDMA, CDMA system.

Overall, the iDEN cellular system is rather secure it assigns dispatch ID's and TMSI's rather frequently. Even if someone managed to receive and decode the traffic using a radio, it is difficult to track someone unless you know their specific IMSI's, TMSI's and Dispath ID's.

Hope that helps!

[motoman30]

Can we please put this myth to rest?

I can't believe no one has chimed in/recognized the different modulation schemes involved.

iDEN = TDMA
ASTRO/VSELP = C4FM

There is NO way to use a VSELP-flashed Digital Saber, Spectra or XTS 3000, to monitor iDEN. It's like trying to receive SSB on your WFM car stereo.

[Pj]

This is where most people have heard of it. I have met a couple a couple of people years ago that said that this was possible. It is like listening in DCSQ, but you are also going to be hearing all sorts of other voice traffic. If your in a low traffic cell site, you will hear more distinguiable audio than a high traffic site.

I've never tried or personally seen this work, but the above was relayed to me by two different people.

VSELP, IMBE and iDEN

iDen is VSELP based. It allows for up to 6:1 compression using TDMA (Time Division Multiple Access).

We have reason to believe that TDMA decoding is a built-in function of the Astro hardware, part of the modulation scheme. Although, this information is not documented in the software or mentioned in the service manuals (we are still trying to confirm all this for sure).

We have been told that there may be able to monitor iDEN radio traffic using an Astro Saber.

What you need to do is take a VSELP Astro of the appropriate band and cram an IMBE codeplug into it (using Lab or whatever).

The theory behind this being that you should be able to use the "digital squelch" options of the codeplug, along with the VSELP hardware to monitor the traffic.

We have no idea if this works for sure or not, but hey, you never know!.

[turbovectorz]

Hi,

Sorry, I forgot to mention the I/Q modulation scheme. iDEN uses what Moto calls "M16-QAM", what it is really 4 x subchannels using Phase-Amplitude Modulation (PAM) per TX and another set for RX. On the top of that is a 6-slot, 15ms per slot, TDMA layer. The voice (dispatch radio and interconnect calls) traffic works in different Base Radios(BR) RF carriers other than the Primary Control Channel Channel(there could be a Secondary Control Channel SCCH also). The two vocoder VSELP modes that is more than likely to be decoded is 3:1 interleave (meaning using 2 TDMA slots) VSELP at 8000bps (higher quality) versus the 6:1 VSELP (one TDMA slot) at 4200bps (lower quality). Most iDEN service providers here in the U.S. now use AMBE+2 for most of the traffic which is an altogether a different vocoder. However, there is still a few service providers in the world that uses VSELP only.

The Astro Saber I/Q receiver front-end if modified via firmware, like a Software-Defined Radio (SDR), could possibly do this with the proper timing considerations for TDMA --- this may have to be triggered externally, such as a microcontroller designed to sense the sync bursts.

Here's a quick reference someone posted awhile back:
http://batboard.batlabs.com/viewtopic.php?f=4&t=69615

I just want to make sure I provide you the best objective information I can provide to the folks here, because I would expect the same.
Overall, It is possible, but it takes considerable effort and technical expertise.

Sincerely,

TVZ

[motoman30]

TVZ, you have made one of the most excellent posts I've read on this board in quite some time. Thank you!

My point was, as-is, the ASTRO Saber cannot demodulate iDen VSELP traffic, by jamming in a CAI/IMBE codeplug and pressing the monitor button. That's an urban legend started by someone and it's absolutely, without a doubt, false information. It didn't happen and cannot happen with the radio as-is. Whoever made it up is a bold-faced liar.

Once you start modifying the firmware, or possibly make hardware changes, anything is possible as like you suggest, the radio is a software-defined piece of apparatus.

Again, thank you very much for your most thoughtful and technical post. It was a pleasure to reading it.

[MattSR]

ROFL.

I jammed a wideband TV receiver into my AS3 and now it works across all bands like an MBITR or Thales Liberty too.

True story. I've got it in my hand and it works.

[CTAMontrose]

yeah! besides everyone knows all you have to do is take your astro spectra, and hook it to a DTV converter box to listen to Nextel...

lolol

[ai4ui]

That's an awful lot of trouble to hear someone ask 'Where you at?"

[tvsjr]

That's an awful lot of trouble to hear someone ask 'Where you at?"

You're close... try "where u be?"

[MattSR]

yeah! besides everyone knows all you have to do is take your astro spectra, and hook it to a DTV converter box to listen to Nextel...

lolol

I heard that's how you give them FPP - its done via the DTV's remote control

[akardam]

Ok guys, this thread is making loop de loops the way it's gone off course. I think the OP's question has been answered.