"Off the Air" and "Switch" Based Pager Intercept System

  The SyTech Pager Intercept System provides the ability to intercept "Off the Air" and "Switch" based paging signals. "Off the Air" paging signals are intercepted using a radio receiver and SyTech proprietary software. Configurations exist for 2 thru 32 channel systems. Two Way paging signals are intercepted from the service provider switch location. The intercepted text from the pagers is automatically inserted into the ADACS allowing for database queries. Both "Off the Air" and Two Way pagers may only be intercepted for U.S. Law Enforcement through court ordered wire taps.

View Pager System Intercept Capabilities: This section provides details of the "Off the Air" and "Switch" based pager intercept system. Information is available to only authorized law enforcement and national intelligence personnel. To obtain a Password please call or submit the Request Form below, (703) 941-7887.

The following information was obtained from open source literature and is provided as a primer on Pager systems in use throughout the world.

POCSAG -Post Office Code Standardization Advisory Group (POCSAG) Pager system developed in 1981 and is described in CCIR Recommendation 584, Radio Paging Code 1. This system can handle up to 2 million individual addresses per carrier and can support tone only, numeric and text pagers. Operates at 512, 200 and 2400 bps (1200 and 2400 bps are commonly referred to as Super-POCSAG. Transmits in FM Narrow using frequency bands that are country specific.  POCSAG is an asynchronous protocol, it has a start up preamble signal that alerts the pager to an incoming message (wake up). Pagers are assigned to 1 of 8 groups based on address. Pagers only pay attention to the address group to which they are assigned. Two (2) coding formats are used for message text: BCD and 7 bit ASCII.

FLEX - Paging protocol introduced by Motorola late in 1994 and will be the protocol of choice as paging company upgrade from POCSAG to FLEX in the US. FLEX supports rates of 1600, 3200 and 6400bps and can handle up to 5 billion addresses. FLEX has a 4 frequency signal arranged as evenly  spaced tones with usual shifts (in Hz) of: -4800/-1600/+1600/+4800.  FLEX is a synchronous time slot protocol. The FLEX protocol does not send messages at random but instead sends all paging data destined for a particular pager during a pre-defined time slot.

The pager only wakes up only when a message is expected to arrive in real time thereby saving battery life.  FLEX technology organizes the message into frames of data or a specific sized packet containing bits of data. There are a total of 128 frames in a FLEX protocol system numbered zero through 127. It takes  exactly four minutes to transmit all 128 frames regardless of the FLEX protocol speed. The transmission of all 128 frames is called a FLEX cycle. Since one cycle has a duration of four minutes, 15 cycles  can be transmitted in one hour. The FLEX protocol supports over five billion pagers.

GOLAY - Golay Sequential Pager Signaling System is a digital system used to transmit tone only, numeric, alphanumeric and voice pages. This is a Motorola proprietary system but now obsolete according to Motorola. It may be that GOLAY is no longer found in those frequency bands that support pagers but is still believed to be on US Satellite. Pagers are divided into groups and a preamble is sent prioritize to paging alerts. Only pagers within the group number sent in the preamble need to examine  the data stream for their address. Supports bit rates of 300 or 600 bps. The pager address is sent  at 300bps and any numeric or alphanumeric information is sent at 600bps. Also known as GSC - Golay Sequential Coding. APOC - Advanced Pager Operating Code, developed by Philips Telecom and announced in 1993,  that offers higher speed and some new features while retaining backwards compatibility with POCSAG. Supports bit rates between 1200 to 6400 or about 1200 to 3200 baud using 2-PAM/FM or 4-PAM/FM modulation. Extended addressing is supported, allowing support for more then 2 million pagers. Also called Super POCSAG.

Two-Way Paging Signals

ReFLEX - A Motorola two-way paging scheme. Currently comes in 2 forms. ReFLEX 25, which supports an outbound channel capacity of 12,800bps and inbound capacity up to 9600bps and ReFLEX 50, which supports an outbound channel capacity of 25,600bs and inbound capacity up to 9600 bps. Both forms utilize a 50kHz channel. This scheme is designed to give the end user the ability to acknowledge a message, send replies and download data.

InFLEXion- A Motorola two-way paging protocol that allows voice and data messaging using a 50kHz Narrow Band PCS channel with a throughput of 112K bps. This system is based on the ReFLEX.

Mobitex - RD-LAP  Pager Frequencies

35.xx .20 .22 .24 .26 .30 .34 .38 .42 .46 .50 .54 .56 .58 .60 .62 .66
43.xx .20 .22 .24 .26 .30 .34 .38 .42 .46 .50 .54 .56 .58 .60 .62 .66
152.xx   .03 .06 .09 .12 .15 .18 .21 .24
152.xx   .51 .54 .57 .60 .63 .66 .69 .72 .75 .78 .81 .84
158.xx   .10 .70
454.xxx  .025 .050 .075 .100 .125 .150 .175 .200 .225 .250 .275
 .300 .325 .350 .375 .400 .425 .450 .475 .500 .525 .550 .575
  .600 .625 .650
929.xxxx  .0125 .0375 .0625 .0875 .1125 .1375 .1625 .1875
.2125 .2375 .2625 .2875 .3125 .3375 .3625 .3875
.4125 .4375 .4625 .4875 .5125 .5375 .5625 .5875
.6125 .6375 .6625 .6875 .7125 .7375 .7625 .7875
.8125 .8375 .8625 .8875 .9125 .9375 .9625 .9875

Old Style Voice Pager Ranges: 

152.010  - 152.21
453.025  - 453.125
454.025  - 454.65
462.750  - 462.925


    

POCSAG and GOLAY can also be found on U.S. domestic C/Ku-band Satellite SCPC carriers. POCSAG as defined in the standard, (original POCSAG) is 512 bits per second direct FSK not AFSK) of the carrier wave with +/- 4.5 khz shift.  Data is NRZ coded with the higher frequency representing 0 (space) and the lower one representing 1 (mark). The basic unit of data in a POCSAG message is the codeword, which is always a 32 bit long entity. 

The most significant bit of a codeword is transmitted first followed  immediately by the next most significant bit and so forth.  The data is NRZ, so that mark and space values (plus and minus voltages) as sampled on the output of the receiver discriminator at a 512 hz rate correspond directly to bits in the codeword starting with the MSB. The first (msb) bit of every POCSAG codeword (bit 31) indicates  whether the codeword is an address codeword (pager address) (bit 31 =0) or a message codeword (bit 31 = 1). The two codeword types have different internal structure. Message code words (bit 31 = 1) use the 20 bits starting at bit 30 (bit 30-11) as message data. Address code words (bit 31 = 0) use 18 bits starting at bit 30 as address (bits 30-13) and bits 12 and 11 as function  bits that indicate the type and format of the page.  Bits 10 through 1 of both types of code words are the bits  of a BCH (31,21) block ECC code computed over the first 31 bits of the codeword, and bit 0 of both codeword types is an even parity bit.

The BCH-ECC code used provides a 6 bit hamming distance between all valid code words in the possible set (that is every valid 32 bit codeword differs from ever other one in at least 6 bits). This makes one or two bit error correction of code words possible, and provides a robust error detection capability (very low chance of false pages). The generating polynomial for the (31,21) BCH code is  x**10 + x**9 + x**8 + x**6 + x**5 + x**3 + 1. Code words are transmitted in groups of 16 (called batches), and each batch is preceded by a special 17th codeword that contains a fixed frame synchronization pattern.  At least as of the date of the spec I have, this sync magic word was 0x7CD215D8. Batches of code words in a transmission are preceded by a start of transmission preamble of reversals (10101010101 pattern) which must be at least 576 bits long.  Thus a transmission (paging burst) consists of carrier turn on during which it is modulated with 512 baud reversals (the preamble pattern) followed by at least 576/512 seconds worth of actual preamble, and then a sync codeword (0x7CD215D8), followed by 16 data/address code words, another sync codeword, 16 more data/address code words and so forth until the traffic is completely transmitted.

In order to save on battery power and not require that a pager receive all the bits of an entire transmission a convention for addressing has been incorporated which splits the pager population into 8 groups.  Members of each group only pay attention to the two address code words following the sync codeword of a  block that correspond to their group.  This means that as far as addressing is concerned, the 16 code words in a batch are divided into 8 frames of two code words apiece and any given pager pays attention only to the  two in the frame to which it assigned.

A message to a pager consists of an address codeword in the proper two codeword frame within the batch to match the recipients frame assignment (based on the low three bits of the recipient's 21 bit effective address), and between 0 and n of the immediately following code words which contain the message text.  A message is terminated by either another address code word or an idle codeword.  Idle code words have the special hex  value of 0x7A89C197.  A message with a long text may potentially spill over between two or more 17 codeword  batches.

Space in a batch between the end of a message in a transmission and either the end of the batch or the start of the next message (which of course can only start in the two correct two codeword frame assigned to the recipient) is filled with idle code words.  A long message which spills between two or more batches does not disrupt the batch structure (sync codeword and 16 data/address code words - sync code word and  16 data/address code words  and so forth) so it is possible for a pager not being addressed to predict when to next listen for its address and only turn on it's receiver then.

There are two message coding formats defined for the text of messages, BCD and 7 bit ASCII.  BCD encoding packs 4 bit BCD symbols 5 to a codeword into bits 30-11.  The most significant nibble (bits 30,29,28,27) is the Left most (or most significant) of a BCD coded numeric datum. 

Values beyond 9 in each nibble (i.e. 0xA through 0xF) are encoded as follows:

   0xA   Reserved (probably used for something now – address extension)

   0xB   Character U (for urgency)

   0xC   " ", Space (blank)

   0xD   "-", Hyphen (or dash)

   0xE   ")", Left bracket

   0xF   "(", Right bracket 

BCD messages are space padded with trailing 0xC's to fill the codeword. Alphanumeric messages are encoded in 7 bit ASCII characters packed into the 20 bit data area of a message codeword bits 30-11).  Since four seven bit characters are 21 rather than 20 bits and the designers of the standard did not want to waste transmission time, they chose to pack the first 20 bits of an ASCII message into the first code word, the next 20 bits of a message into the next codeword  and so forth. 

This means that a 7 bit ASCII character of a message that falls on a boundary can and will be split between  two code words, and that the alignment of character boundaries in a particular alpha message code word depends on which code word it is of a message.   Within a codeword 7 bit characters are packed from left to right (MSB to LSB). The LSB of an ASCII character is sent first (is the MSB in the codeword) as per standard ASCII transmission conventions,  so viewed as bits inside a codeword the characters are bit reversed. ASCII messages are terminated with ETX, or EOT and the remainder of the last message codeword is padded to the right with zeros.  

FLEX PROTOCOL - FLEX operates as either a four level code or a two level code. The concept of a four level code is not new as other protocols have utilized four level transmissions for quite some time. The modulation range of FLEX is plus and minus forty-eight hundred kilohertz of deviation. FLEX's four levels are defined as -4,800 hertz, -1,600 hertz, +1,600 hertz, and +4,800 hertz (referencing the operating frequency). Each level represents two bits in a given  transmission.  They represent `00', `01', `11', and `10' respectively. The duty cycle (period) of each FLEX modulation symbol length is defined as time `Y'. Because we are using the four  level code we can double the amount of data bits transmitted in the same amount of time allocated to time `Y'.

Additionally, FLEX will adjust its bit rate based upon the channel loading. It can operate at 1,600, 3,200, and  6,400 bits per second. During times of peak traffic, FLEX will adjust its operating speed to the maximum bit rate of 6,400. During times of low traffic (such as the early morning hours), the bit rate will be adjusted to the  minimum speed of 1,600 bits per second. During times of moderate traffic, the bit  rate of 3,200 will be used.  Additionally, FLEX can switch between four level and two level operations as needed. FLEX can start at  1600 BPS bipolar FSK, and then upgrade to higher speeds when system upgrades permit.  FLEX pagers can accept 1600, 3200 and 6400 BPS speeds without changes. The advantages of these flexibilities are to improve paging quality during times of low or reduced activity and increase channel capacity during times of high traffic.   This allows maximum optimization of the medium as a function of loading. FLEX pagers  must see  FLEX sync at least once per minute, and channel sharing must be synchronized. FLEX operates on a 4-minute overall cycle.  During this 4 minutes, there are 128 frames of 1.875 second each.  Each of these frames contains a 1600 BPS sync header, followed by 10 data blocks.  At 1600 BPS, these blocks are 256 bits in size.  At 3200 BPS, they are 512 bits in size, and at 6400 BPS they are 1024 bits in size.

The blocks contain information arranged as 1, 2 or 4 groups of eight 32-bit BCH code words each.   Motorola refers to the coding as (32,21)BCH code.  Each 32-bit codeword contains 21 bits of data and 11 bits of error correction data. The groups of eight code words are stacked in rows but transmitted by columns, which interleaves the data. At 1600 BPS, each block consists of eight 32-bit code words, or 256 bits, and these bits are transmitted as 1600 BPS bipolar FSK.

At 3200 BPS, each block consists of 512 bits from two multiplexed eight-codeword groups, and these bits are transmitted as 4-FSK at 1600 symbols per second.  At 6400 BPS, each block consists of 1024 bits from four multiplexed eight-codeword groups, and these bits are transmitted as 4-FSK at 3200 symbols per second.  At the receiving end, the data is de-muxed and de-interleaved into the original groups of eight code words and then BCH checked; up to 2 errors in each 32-bit codeword can be corrected. The breaking up of data into interleaved blocks is done for error management purposes only.  The 10 groups of 8 code words following the sync header carry a block information word, an address field, a vector field, a message data field, and any leftover space. 

These words and fields are contained in every frame following the sync header, but they do not necessarily align with the codeword-group boundaries.  Addresses are carried first in each field, so pagers can "sleep" for the rest of the field if they are not being addressed.

There can be unused leftover space after the message data field because the message lengths are variable and not all addresses require vectors, yet the 10 blocks must remain at their fixed sizes for synchronicity.  Motorola says the leftover space is filled with idle codes.  And at 3200 and 6400 BPS where two or four sub-frames are multiplexed into each transmitted frame, the block information words, the address, vector and data fields and the leftover space of each sub-frame are of independent sizes.

ReFLEX Information-ReFLEX is a protocol to enable true two-way paging and messaging. By adding a response channel to a traditional paging system.  The ReFLEX protocol runs outbound on a 25 or 50 kHz channel in, for example, the 929-932 and 940-941 MHz frequency bands. Depending on the carrier's capacity requirements, the ReFLEX protocol is capable of running outbound at 1600, 3200 or 6400 bits per second (bps) per signaling channel.

The ReFLEX protocol operates on 12.5 kHz inbound channels. Depending on the carrier's capacity requirements, the ReFLEX protocol is capable of supporting inbound data rates at 800, 1600, 6400, or 9600 bits per second. The ReFLEX protocol is being deployed in the US in the 896-902 MHz frequency band. Motorola and local operators and regulators are continually working to secure spectrum around the world. Two versions are available: the ReFLEX 25 Protocol and the ReFLEX 50 Protocol. The ReFLEX 25 Protocol operates on a 25 or 50 kHz outbound channel. On a 25 kHz channel, speeds are 1600, 3200 or 6400 bits per second (bps). Three channels can be put in 50 kHz. The inbound channel is 12.5 kHz at speeds up to 9,600 bps. The ReFLEX 50 Protocol operates on a 50 kHz channel up to 25,600 bits per second (bps) on an outbound channel; the inbound 12.5 kHz channel can accommodate response messages at 9,600 bps.

InFLEXion Information - The InFLEXion two-way, high-speed protocol is based on linear modulation and enables the transmission and storage of advanced voice messages. InFLEXion offers significant advantages for service providers and subscribers alike, including: guaranteed message delivery, message receipt acknowledgement, and optimal re-use of the over-the-air spectrum. The InFLEXion Protocol operates on a 50 kHz channel outbound and a 12.5 kHz channel inbound.  Outbound, the InFLEXion protocol operates on 50 kHz Narrowband PCS channels in the 930-931 and 940-941 MHz frequency bands. The InFLEXion protocol, outbound, uses digitally processed voice resulting in variable compression rates allowing the system provider to tailor the system to best serve subscribers. The InFLEXion protocol for voice paging supports up to one million users on a nationwide 50 kHz channel. Inbound, the InFLEXion protocol operates on 12.5 kHz channels in the 896-902 MHz frequency band. Depending on the carrier's capacity requirements, the InFLEXion protocol is capable of running outbound at 800, 1600, 6400 or 9600 bits per second (bps).

Information Request Form

Select the items that apply, and then let us know how to contact you.

Send product literature
Send company literature
Have a salesperson contact me

Request, comment or suggestion:

Name
Title
Company
Address
E-mail
Phone

About us | Our clients | Products | Services | Employment | News | Downloads

Send mail to webmaster@sytechcorp.com with questions or comments about this web site.

Top of page

© Copyright 2003 SyTech Corporation