Scanning MPT1327

(Don't know what MPT1327 is? Short answer, long answer [.pdf warning])

Getting Started

Unfortunately all this is pretty much US-centric, while in Europe and rest of the world the MPT1327 open standard is more widespread. Being the scanner enthusiast's market much smaller, less resources have been developed.

Some benefactors have dedicated time to fill the void and developed Windows and Linux software to allow at least basic tracking. Limiting the range to free stuff, these are the options:

• Linux:
  • Tronkito was the first tool to appear. Unfortunately all links to the project homepage seem broken. Tronkito started a series of Windows ports.
• Windows:
  • TrunkSnort/TrunkSniffer by Jochen DF1VB, derived from the above mentioned Tronkito. Being quite basic I found it to be a good starting point.
  • Unitrunker by rfmobile Rick, a very interesting attempt to group the several standards under one decoder, tracking units, talgroups and much more. Being very powerful and flexible and me a beginner, its workings are still outside my comprhension. I'll add notes as soon as I get started with it. Support available through the RadioReference forum.
    Update: preliminary findings show some strange behaviour in reading GTC messages. Unfortunately the author has no MPT systems in his area and code is basically untested.
  • NEW! Trunkview. Starting point for this software was probably Tronkito/TrunkSnort, but a significant effort was made in porting it to a GUI and adding new options. Overview.

What I found missing was some "howto" to get started, as much technical information is available, including protocol specifications, engineer guides and sound samples (Google), but no stuff for dummies like me.

I mean to use this page just as a notepad to avoid you the hassle of re-inventing the wheel. Just assume that info hereby contained is incomplete and wrong/incorrect. Any contribution will be most welcome at sinager [at] o2.co.uk.

Connect audio output from the radio to the line-in/microphone jack on your computer, launch vbtrunk.exe and tune to a frequency where you hear that data noise.

If you are tuned to a MPT1327 control channel TrunkSnort will display at least something like this. You won't hear any voice communication on this channel, as it's used only by the system to exchange data with mobile terminals. Info in the header: SYS: id number, in hex format, of the system you're listening to. TrunkU2: you will see something different here, as it's just a label edited in the vbturnk.ini file to translate the hex id into something more human friendly. Can't remember exactly what was the default. CCh-Frequency: here again you won't find anything meaningful until vbturnk.ini is edited. ALOHA is the very minimum you should see, meaning that the system is operational and idle. More often you will see several messages. Opposite to other standards, where bandplans are fixed and the control channel alone is enough to give you the entire channel mapping, MPT1327 can be set everywhere in the spectrum and there's no fix channel<>frequency correspondace.

GTC (GO TO CHANNEL) messages are instructions for mobile units to tune a certain frequency to establish contact with another. Monitoring the control channel for a while you should be able to note a list of channel numbers (Ch) the mobile units are sent to. Editing vbturnk.ini can enable logging onto a text file, so that you can leave the system on and come later to examine collected data. I understand the broadcasted (BCAST) system message Registration Parameters has to do with the affiliation of mobile units to the system, while Call Maintenance it's used to avoid them remaining stuck on the control channel. Once you have collected a few channel numbers units are referred to, search the spectrum around the control channel. If you are in Europe a couple of MHz in 12.5 kHz steps should do (although there are some in 6.25 spacing too -tks Tigger). You're looking for clear voice communications preceeded and followed by a small data burst.

When you find valid MPT1327 voice channels, TrunkSnort decodes the data bursts, telling: details about the communication (CLEAR for communication end, for example) control channel that sent mobile units on that frequency (CCh) channel number in use (Ch on the right) frequency: this is meaningliess until you map the system in vbturnk.ini timestamp Note down channel numbers and frequencies found in this way. Ch numbers should match those recorded monitoring the control channel. Once you identify a few channels you will be able to define the bandplan of your system. In many cases knowing the LCN (Logical Channel Number) for the Control Channel and and one Traffic Channel may be enough to make a guess.

The simplest way is to put them down into a spreadsheet and filling the void between known channels using the standard step (again mostly 12,5 kHz in Europe). You can do that both visually or setting formulas.

Stretch it down to channel 0 and you'll get the Begin of Band info.

You can now fill in the details you worked out into the vbtrunk.ini file. For some reason TrunkSnort expects the offset parameter to be 2 when the right Begin of Band is set. (Doesn't matter in terms of getting things to work but I like things to be right. - Tigger)

Should you have two receivers (one of them being an AOR 8200/8600 or Uniden UBC780XLT) you can operate in two-radio mode: one tuned on the control channel, the other (AOR or Uniden) will automatically be tuned to the voice channels mobile units are sent to.

Contrary to the documentation, I managed it to work with a USB to RS232 adapter, however this is true only for certain models/drivers. As specified in the "read_me" file for TrunkSnort: * Sometimes it could happen that the Software seems not to Control the Scanner via RS-232. Try this: Stopp TrunkSnort (ctrl-c), use another Program like Hyperterm or so to use the RS-232, and after that, start again TrunkSnort. That helps is any cases of that error I saw. With AOR radios this is the case when you see the computer control symbol (dotted circle) but the receiver doesn't tune. In that case just open HyperTerminal with the same communication parameters you've set on the radio, then close it. There's no need to send commands, as probably TrunkSnort is simply unable to initialize correctly the serial port on all OS/hardware combinations. On the Uniden receiver you must remember to activate Remote Mode by pressing the E key for two seconds or until "RMT" appears on the display (see page 59 on the operating guide).

• Trunksniffer group on Yahoo Groups
  In the file section you can find a "bandplan howto" and a spreadsheet by Tigger more accurate than my explaination. I wish I saw that before...
  
• Ftrunk_users group on Yahoo Groups
  
• Radioreference forums and Wiki