WaveShark

390-400 MHz

TETRA

The network, its cells and who is called, clear calls heard as speech, and a wgpu key search on the ciphers in a source build carrying the tea feature.

TETRA is the European standard for public safety and transport, and its broadcasts name the network, the cell and the neighbours a radio could move to. Call setup names who is being called, which makes a busy system readable as a structure rather than a wall of noise.

A clear call is heard, decoded with the ETSI speech codec, with stolen slots concealed rather than clicked through. When several sites of a network carry the same call it is listed once with every site, and when one site drops out the call carries on from another.

The keys view lists every enciphered channel and what is known about its key. The tea feature, in a source build only, links the ciphers and a key search that runs on any GPU through wgpu, so an enciphered channel can be worked on rather than only counted.

Checked against off-air captures, asserted against what the transmission itself says.

What comes out

  • Mobile country and network code, and the cell
  • Neighbour cells with their carrier frequencies
  • Called and calling identities on call setup
  • Speech on clear calls, recorded with the rest
  • Which security class the cell is running
  • The cipher in use, in the keys view

Decryption and key recovery need a source build with the tea feature. The monitor is always there.

$ waveshark --tune 395 --calls

Read next

DMRP25 phase 1GSM

Something did not decode?

Record the burst with --record and open an issue with the capture. A capture that decodes becomes a test fixture.

Open an issue