Hacking Your Way into the APRS Network on the Cheap Extended Edition

hi folks Angie here unfortunately we had an audio problem we didn't capture any audio till about the 10 minute and 54 second mark sorry for inconvenience

um I should also point out that the International Space Station actually has an AP RS digit Peter on it which I think they currently have active they changed things up occasionally up there and one of my friends actually was sending email through that when he was stuck in traffic in Detroit to a friend of his in Seattle and he said that they were the when he checked on the when he asked his friend to check on the route that the email took there were literally two hops from his radio to ISS from ISS to the receivers radio in Seattle and the other thing that you see tons of on the network are weather stations they're

basically like kit built things that you can connect to your radio and they'll continues to give like temperature Direction temperature wind speed Direction barometric pressure all that stuff um and they're very popular the other thing is is that when you set these up the National Weather Service is actually monitoring all of these weather stations on the APRs network so if you don't like the fact that your local meteorologist is getting the weather wrong you can help them out a little bit as far as the frequencies go typically in North America the main frequency is 144 dot three nine zero megahertz which is on the two meter band in Europe they've decided to use 140 4.8

hundred megahertz I think Australia also uses that as well but if you go to Bob Byrne Inga's APRs org website he has a complete it's a map with all the frequencies listed by country and then in South America Africa and Asia each nation has decided on a different frequency like some of them are using the 39.8 but others are on completely different frequencies into meters it's also sometimes used on UHF bands like the for the 440 megahertz 70 centimeter band or the 933 centimeter band this is particularly the case if they're using it like it's a weather balloon project or satellite because they can get very high gain antennas and or spaces at those uh higher band

frequencies and then finally on the HF bands tend 151 megahertz lower sideband on 30 meters is the APRs frequency on HF and that's mainly used by mobile stations in very remote areas like ships in the middle the ocean or people who are no driving RVs are camping in very remote areas like the Yukon Territory or whatever where they're not going to see any kind of local repeater or digit or traffic and it's usually customary to try to leave the 30 meters frequency free for people like that because bandwidth on it is very very limited which I'll get into in a moment applications of a PRS position reporting as the name says it's used a lot for

amateur remote telemetry like the weather stations or balloon projects or search-and-rescue teams the network also receives information from the nautical a maritime AIS network so if there is any any ship or boat in the area that has an EAS beacon on it for the purposes of collision avoidance you also see that and it'll also tell you like the dimensions of the ship and it's you know in terms of its length its beam and its draft and also typically it's an exporter call and when it's expected to be in a lot of people use it when they're traveling to notify other amateurs of the current frequency they're on so that you know if I'm driving along and I start seeing a

packet on my radio I'll see the guys callsign first of all but I also see that he's monitoring you know a certain frequency on two meters so if I want to talk to him I can to my radio to that frequency and we can get in touch as I mentioned before you can send text messages over the network pretty much exactly like a cell phone the only difference is that whereas SMS has 160 character limit APRs I think has 128 character limit and there's a lot of other different ways that you can send the messages back and forth you can also send email and there's even a newer client called yet another APRs client that allows you

to send email to the amateur wind link network over APRs so if you're out of range of a wind link server you can hop through a couple different digit Peters and then send your email that way finally there's my key which reports the model of your radio and because the my key packets are short they're also used frequently on the 30 meters HF because HF is a bit more unreliable and if the packet is mangled in transit it's not going to be received properly so the shorter is better the network is also used for marking events like tornadoes and wildfires I've seen out west vertically in Arizona the local amateurs who are working for unlike the fire

search teams they will be marking the positions of wildfires presumably for fire departments or the Bureau of Land Management or that sort of thing and it's also used for location and current status of search-and-rescue teams in the field also that they can you know be beaconing out that you know hey we're stuck in the mud or we're currently in the search we've just found the person we're looking for and back at the Emergency Operations Center they can look at a screen at a glance and know exactly the status of everybody the a PRS is network is Internet services network it's the internet side of the network and there's at least several dozen servers usually with the domain

name there use the hostname APRs to operating around the world I know I've seen my client connect to servers in Europe in Ukraine one time in China I guess it just did my app just decides to pick whichever server seems to be at least loaded at the time but there's also several dozens spread coast-to-coast in the US each server will provide a full feed of all of the data that it's receiving on TCP port 10150 two people have noted that if you should just connect directly to that TCP port sometimes it does stuff like crash your internet connection because while everybody's sending into the network at 1200 baud when you suddenly ask I want to see all the

packets worldwide which is essentially what you're doing there that's a lot of data most servers also support an HTML Status port on 14501 which will tell you what other APRs services the server offers and all servers use TCP port 14,000 580 is a user-defined filter port so initially your if you connect to that you'll get nothing and as you open up more and more of your filters you'll see more and more traffic and a lot of the applications use this to to show you basically limited parts of the network so that you're not doing things like crashing or your cell phone's data connection or your radios connection or whatever now we get into the apps first

of all there's a PRS droid it's free it's available for Android and it's fully featured as a tracker or you can send text messages with it it basically conforms to the spec open APRs is the iOS equivalent yet another APRs client which is available for all major operating systems Windows Mac and you know Linux BSD that sort of thing that's the one that can forward email through and it also supports all the other features it can be a client it can be a tracker that sort of thing and then there's the good old UI view 32 which is for Windows and ApS mention man APRs messenger excuse me which is also for Windows most of the time those aren't

used much anymore but because they have a lot of features about they have flexibility as far as which digital data modes you can send in that makes them more useful on the 30-meters hf band one of the newer ones is called direwolf and it acts as a sound card software terminal node controller it's fully featured and it can act as a digit I gate or virtual TNC for other software packages likes aster or UI view 32 or pretty much you name it and I pronounce aster I've never heard how it's supposed to be pronounced X aster is the open source area APRs client that's available for most UNIX implementations since we I'm not using my laptop I can't really

get out to the internet and show you a PRS done if I so this is the kind of a still of the demo this is actually from when I landed at Baltimore Airport BWI in beautopia rpm anyway it's a Baltimore Airport I was going to shmoocon in 2014 and I fired up a pier asteroid right is my aircraft touched the ground and if you look what I found very interesting it's kind of faint here this red car icon is labeled WB for APR - 9 barber ninja the guy who designed the whole network and built it all was driving by Baltimore Airport right as my airplane touchdown that's his solar powered Toyota Prius right there so it's kind of like what

are the odds I mean I'm just some guy he's the guy who designed all this and apparently he was out for a drive or maybe going to work I don't know but you can kind of see these WX icons those are weather stations and if this was actually the APRs notify website and not just the JPEG when I mouse over it it would tell me the all the weather data that's being received or that has been received at that weather station recently likewise on these tracks like the most recent one is marked with the with the icon and then previous ones are markets little red dots if you click on the red dot or the icon it will also

tell you the information that was in that beacon packet so like kind of tracker it'll tell you probably the person's latitude and longitude their altitude their velocity that sort of thing and also any kind of there's like a text comment field so you can put in anything that you want and so like actually you can kind of see that here on mine I've actually when I was taking the image there's my callsign and I've got SSID - seven there's the date the time my speed the bearing that I've been travelling in and I'm at sea level apparently and then my comment is shmoocon or bust monitoring one for 146th at five eight zero zero megahertz

in simplex so that if somebody saw that they would know my radio has turned on and they could contact me on that two meter frequency if they wanted to talk to me so that's pretty much the what we're gonna have for the demo the basics of hardware that you need to get all this going is an amateur radio a GPS unit for position and time information and a terminal node controller or other packet modem originally back in the eighties even in the 90s each of these devices cost hundreds of dollars each many hams tried to homebrew their gear and if you if you start looking for images of homebrew APRs trackers it's it's a wilderness of all kinds of

weirdness people have put pieces of plywood on the dashboard of their cars and screwed down the radio and screw down the GPS and you know routed cables and odd ways people you know sometimes it's just but that's a jumbled mass of devices in a old military surplus pouch a lot of this stuff winds up being very temperamental because of how people put it together and for a long time there wasn't that many people weren't using the network because it was difficult to get on until the commercial companies started getting into the making of the hardware business in the last decade particularly Kenwood in Yazoo but I think there's a few other amateur radio hardware companies that are now

getting into the act but they're there now building radios that have all of the ApS hardware onboard and GPS unit the TNC you know your packet modem everything is all built into an HT or a mobile radio the first gen units were like the Kenwood th d7a and the Kenwood d700 mobile and they're usable as it goes but they the second generation are greatly improved however all like the DS mu-2 and the d7 10 and the Yazoo vx8 series but all of these still cost several hundred dollars and it depends on how crazy wearing a ham radio like I would buy this stuff when I have the money but there's cheaper ways to go kt8 RTT

who at the time he made the video on youtube if you search for his callsign you'll find it he was I believe an electrical engineering major at case University in Cleveland and he decided to see how cheap he could go on making an AP RS tracker so he used a bull Fung UV 5r + HT which I've got it listed for 45 bucks sometimes you can find him for $30 on Amazon a stereo audio patch cable to go from will get into word that went in minute an old surplus Android phone we all have a drawer full of those right and a purist the APRs droid app from Google Play which if you side loaded

it's free if you decide to support the developers they asked for $4.95 and basically what he did was he connected used the patch cable to connect the 3.5 millimeter jack and the Android phone to the mic and jack on the HT he also connected an external I believe it was five thousand milliamp hour USB battery to recharge the whole thing and what winds up happening is this APRs trade when it senses a change in position it sends a packet out as audio into the radio which is set as voice operated transmit so when it hears something on the mic jack it just transmits it and this is what the whole system kind of looked like and basically

what he as an experiment what he did was he boxed all this up and I think shipped at UPS back to his parents house in Indiana or Illinois something like that and the surprising thing was that it worked and also I when I gave him our earlier version this talk I think it was at Derby con a couple years ago somebody pointed out that shipping an electrical device that's that's powered on and a lithium-ion battery violates postal regulations so don't do that but what I found interesting was and you see it in the video he actually was he actually was able to see four packets from this even though he had no control over the

orientation antenna no control over where in the UPS truck the the package was shipped like it sit in the center and therefore it really shielded or did it happen to wind up you know in the top right next to that nice fiberglass skylight but basically something this cheap and this random when it got within maybe 300 meters of a digit eater or an I gate was able to transmit packets and verify its position you can also use Raspberry Pi and there's a more and more kits available for I think they called them capes on the Raspberry Pi and on Arduino there's fields or you could just run faster or yak or whatever you like especially on the Raspberry Pi 3 because

you know what is it like it's I think aren't they over at gigahertz in terms of clock speed now and the thing that I've been working on on my PI is I want to run I'll also run you know something like a light SQL database where I can put all kinds of events in there for my hacker space and so you know the digit Peter at our hacker space will then you know on meeting nights it'll like six hours before the meeting it'll start reminding people who have amateur hey you know we're gonna have a public meeting you might want to stop by or you know there's a class coming up about this craft or how to use the lathe or

whatever and you could use that for anything you like but I think that would add and it would add even more flexibility to a network where you could just basically be scheduling packets to tell people about things that are coming up rather than just what's happening right now and the pie could probably also be used as a winning email node but when link is a little bit outside of what we're talking about basically it's a it's a global amateur radio email network that allows people to send us some TP email basically from anywhere and it's sort of the a double RL is sort of pushing it as the future of long-range text communications and has

been for about the last ten years for Arduino which I mentioned before there's a there's a bird OS I guess it's called a project that is implementing a Paris for the Arduino and then there's several different shields that you can get like the trekked immuno Adafruit makes their own a ter APRs shield as does argent data argent data does a lot of different things with packet radio generally they have a lot of products for APRs but they also have a lot of products for commercial land mobile radio and things like that and some of which you can actually modify if you like back into ham radio and then there's also the ext digi software that's a software image

for the Arduino that implements a PRS tracker client as far as open source software the great granddaddy of them all which apparently just it's still in beta it's like latest version I found is 0.69 I think it's not updated very frequently at all but it confers your computer directly into a TNC using the sound card audio cable and my cable connected to your radio a variant of this is used especially with HHF APRs on 30 meters and of course exasperate of the art in order to get both of them to work you need to compile in the x.25 packet module into your kernel and the AP RSD server daemon must be installed and running we're gonna get

into we're gonna start getting into HF high frequency radio and so I just briefly want to go over what I'm sort of talking about here there's UHF which is where most people want to do a lot of their work then I'm saying even commercially it's the hot band right now it's 300 megahertz to 3 gigahertz in terms of frequency propagation is line-of-sight but it's best for high bandwidth applications and for use in urban areas all your cell phones operating Li which have been Wi-Fi at 2.4 gigahertz operates in the UHF band HDTV is up here um the for 40 megahertz ham band the 900 Hertz ham band the 1.2 gigahertz ham band 2.4 gigahertz is also a ham band in addition

to being Wi-Fi um all that stuff is UHF and then VHF which is 30 megahertz 300 megahertz is mostly line-of-sight when you get into the very low VHF part part of the VHF spectrum like on the 6 meter band or down around 30 megahertz occasionally these clouds of ionized gas they're ionized by sunlight and the ultraviolet light in the elay or the atmosphere will refract VHF signals so occasionally you'll get stuff where the band that you were expecting to only get a 50 mile range out of all of a sudden you're getting a 500 or 1500 mile range out of but that's not predictable you can't rely on it it's low bandwidth most of the time like on on the amateur now

part of this is actually an FCC regulation but on the amateur bands were typically looking at 1200 baud 9600 baud 19200 baud it's about the max um but part of that to do to a 1979 FCC rule that has limited the bandwidth on amateur bands and we're currently working to overturn that and then there's HF which is three megahertz to thirty megahertz it will refract off of the ionosphere at various layers and depending on the band the band you use an HF you can get somewhere between five hundred miles of range out to half the planet three-quarters of the planet depending on what you do it's extremely low bandwidth however the maximum on the 10-meter band is 1200

baud and on all the other bands it's the maximum is about 300 baud there's some hacks you can do to get it a little bit faster than that but the problem is is that you don't have a reliable essentially your your physical layer is not reliable so you can get you can hear these flutters or your signal will fade or suddenly get stronger so and it's basically because part of your physical layer is the ionosphere which is I would like sort of liken it to looking at the top of a very slowly simmering pot of water that you see all these currents and Eddie's and turbulent upwellings and things like that um that are if you're

trying to refract a signal off of that or bounce it off of that the angle that your signal is going to be coming back down is going to vary so you're going to get weird multipath effects and all sorts of optical and radio effects that don't actually do it that don't affect you at all in line-of-sight instances so with that we'll get into APRs in the 30 meter band like I said previously on 30 meters you typically have a 500 a 200 500 to 2,000 mile range and under favorable conditions that can expand to basically the size of a continent like North Europe or you know Australia I wouldn't really expect it to necessarily cover

all of Africa and Asia from a single location and because of the ionospheric effects I was talking about previously um you want to have your packet format to be as short as possible which is why the Mikey packet that was originally developed to just identify the model of radio that you're using it's about 33% shorter than the standard a Paris packet so it's very favored on HF the comment field that like you saw in the and the example image where I was you know just kind of blathering on about shmoocon or bust and what frequency I'm using on HF I wouldn't be doing that I would have something very very short maybe just my callsign um and

in your packet software configuration you don't want to include a path for the routing protocol because you really don't want to have it to dissipate since you're out since you're there's only 300 baud of bandwidth available in the channel and your signal is quieting an area of possibly 2,000 miles in diameter it's pasta you know basically you could be causing a lot of collisions if you start wanting to repeat a packet that's now effectively orbiting the planet as it gets repeated you can - you can use the typical ax 25 packet mode but on HF phase shift keying at 63 baud or multifunction multi frequency you should shift keying at 16 which basically means you're still changing the tone of your

signal three hundred times a second but you have sixteen different tones so each one of those tone changes can give you two bytes which is a which is a hack to get you effectively more bandwidth and both of those were specifically designed for HF so they're likely to work better than ax 25 and a lot of people and this is part of the reason why you IP 32 and a pierce messenger are still used because they have native support for both of those data modes and I've talked a little bit about this with the keeping your path but keeping your path blank on three meters on two meters or on uhf you might want to put wide there basically a

PRS has a distance vector routing protocol within it that uses these statements in the path as its as the routing protocol so y22 tells the digit Peter did you pick me up to two times and then as it dissipates it's going to reduce that it's going to decrement that last two down to one and then the next digit Peter or I get is going to decrement it down to zero and at that point it's not that your packet is not digit Adeiny more if you're in remote areas like for example the Upper Peninsula of Michigan or rural Canada you might want to use wide three three to get back to an i gate but like in the

place like philadelphia that's going to result in a lot of people seeing a lot of packets that they're gonna think it aren't necessary when you know 500 miles away in Washington DC on two meters they're seeing your car in Philadelphia um this tends to annoy people Wow and like I said on 30 meters don't put anything there because you basically just want it to be received and mostly it's I gates on 30 meters anyway so you want your packet to be received and transferred to the internet as quickly as possible um as for future directions and some of this has already been done I'm starting to see people who are using rtl-sdr s as AI gates but there's a lot

that could be done with the hack RF or other STRs that are bi-directional um you know you could basically configure that SDR as whatever you liked and I get a digit Peter I'm interested in possibly seeing what you can do with frequency hopping spread spectrum similar to the Navy's uh enhance position location reporting system which it's possible bringing to also worked on that but does he also it does research for the Navy or you know did you PD got multiple frequencies like transferring traffic from the two meter band of the 440 band for keeping the two meter band congested but that's all in the future and that's it for me are there any questions yes um I'm honestly

not sure I haven't I haven't seen that I mean I know the DMR repeaters are showing up on a PRS as as you know they they have a lot of them are advertise their presence on a PRS but I'm not sure that there's a I mean it would be a great idea to have to link those two systems together but I haven't personally seen it yet any other questions okay thank you you [Applause]