Welcome. It's great to have you here. It's really great to have Roden here, though, because he's the speaker.
If he wasn't here, this would be really boring. So I didn't bother asking him what kind of intro he wanted because I knew I was going to pick this one by myself.
This man is a pillar of the community who has just been making all kinds of fun, well, I mean, I guess phone stuff originally, but, well, I mean, technically it's radio, too.
Running your own phone network and then running your own pager network is, I mean, I guess that's kind of loosely related to one of those freak guys.
Telefreak, yeah. And then a whole repeater network. I mean, basically he says he's a phone guy, but everything I see up there is a radio.
So I got to say, this man has been our brother who we've basically never spoken to for years, and I'm very pleased to finally have him at our event.
So I want everyone to thank Andrew for his time, and please enjoy POCSAG Amateur Radio Pager Network.
What?
Woo-hoo!
Thank you. Thank you. Thank you all for coming. This is kind of a passion that me and my friends and family kind of all share.
And RF Tech's Sidney Vicious was the world's only hacker dog, so I dedicated it to him.
I work for Aspiron Security, Aspiron Security Labs, so shout out to them.
As he said, I'm Andrew Strutt. My call sign is Kilo 6 Alpha Delta Sierra for the Amateur Pager Network and the repeater network, or repeater system.
I have an event call sign for November 7 Tango, so that'll be good until Tuesday.
So I'm going to go through the POCSAG network first, and I have some screenshots for it.
I didn't bring the POCSAG network. It's actually up in my room, still transmitted and working.
So if you page or send a tweet for specific hashtags, it'll come out the pager network and whatnot.
And if you're an amateur radio operator and you have a call sign, you can transmit on that frequency with the appropriate cap codes, and you can communicate with it as well.
So, um...
So we'll get right into it here.
So, talk about how, and also the why.
So, we've been doing this for, gosh, I think five years, and originally the idea was me and Jay Falcon were talking about what we could do radio-wise, and something really old school.
And we got inspired by a former or current old school telefreaker who gave a talk at DEFCON 16.
He goes by NYC Mike and Snuffleupagus.
So, originally that was his thing, and so we decided to bring it back.
And it's been a success. This is our fifth year doing it.
So, the idea originally was to put together the equipment and to design and test it.
At the time, when I was talking with Jay Falcon about it, we rolled around the different ideas over extreme distances and extreme time zone differences.
It was a long process to decide what to do and how to do it.
I had engineered it all kind of in my head on paper.
And he had some ideas.
He had some ideas on the software and the coding of it.
And so, while I was in Afghanistan, I ended up buying all the equipment and did some tests with it, and then I sent it all to Jay Falcon.
So, major props to Mr. Jay Falcon, who did significant amount of grunt work to make it all work while I was overseas.
And it's been a success ever since.
So, it pretty much boils down to these five pieces of equipment that make it work.
So, I'll show you some of the pictures.
But most of it really relies on, obviously, the transmitter for the POGSAC.
Which is a cheap Chinese black box.
Not necessarily part 97 FCC compliant, but doing experimentation is something that you can do with amateur radio.
And it works very well.
So, the other piece is the amplifier.
And I'll show you a picture of that.
We're not pushing 100 watts.
The amplifier will take 10 watts in to produce 100 watts out.
Last time I tested it a few years ago when I was a little worried about it and doing the RF exposure math because the antenna was in my hotel room.
The first year.
So, that was pretty funny as we discussed that and doing the measurement of the radiation exposure.
Hey, can you see it?
And so, I think we're only pushing maybe two or three watts out of the transmitter into the amplifier.
And when I last tested it, it was like 40 watts out of the amplifier.
Now, the antenna that I have is a Diamond X50N in connector.
And that's a 5.8 wave high gain antenna used for repeaters.
And it's almost commercial grade.
Very widely used in the amateur radio.
The other point I bring up and bring this up is the feed line and the antenna makes a huge difference.
Even if you have a crappy Chinese transmitter and a quality amplifier, if you're not using good patch cables and good feed line, you're going to get a lot of loss.
And it will add up throughout all your cabling and through the antenna as it gets to the antenna and you won't get very good signals.
So, this is one of the things that I've pushed and learned over the many years of doing amateur radio and engineering is to use quality equipment, quality connectors.
And it really helps.
It really makes a big difference on the actual end point.
So, the cabling is important and obviously the laptop.
But that's kind of the simplest part was, well, maybe not the simplest because I needed help with it.
Because I'm not a big coder.
But over the years, I think there's been every year a new generation of people who have sat down at my laptop and like refactor the code.
And in fact, Mr. Chucks here wants to refactor the code.
He's refactoring code extraordinaire.
So, he's been begging me all week, saying, let me get on your laptop and rewrite it.
Let me rewrite the code.
So, I think Jay Falcon wrote it the first time.
I fussed with it and then Far fussed with it and rewrote it.
And then, I think that might be it.
Maybe Jens from the CCC did a couple of iterations on it.
And so, it's kind of a group effort.
And it's a simple Python code that just communicates over serial.
So, we'll get a little more into it.
So, here's the POGSAC and FLEX transmitter.
It will do FLEX, which is the more sophisticated protocol.
And we wanted to.
Even though it could do a little bit better protocol and our watches can do the better
protocol, we wanted to keep it even more old school.
So, we continued with POGSAC, even though we could do FLEX, which does bigger payload,
more data.
You can push through it.
You can do time sync and a bunch of other things, which is cool, but we wanted to keep
it extra old school.
So, that's the transmitter is all it is.
I found it on, I want to say, one of those sites like Alibaba or something like that
or Banggood.
There's one of those Chinese sites and we search and search and search.
What they sell them for over there in excess all over the place is for like restaurant
pagers and stuff like that.
Those aren't really used much here in the US, but paging is still used all over for
many different industries.
And it's a huge information disclosure issue.
And I'm not going to repeat a lot of that.
I'm going to mostly talk about the hardware and our implementation of it.
If you want to cover all that, definitely see NYC Mike's talk from DEF CON 16.
And he covers all the intimate details of decoding it and so on.
So, a lot of good information there, but I'm not going to dig too deep into that.
But also, Vlad Gostomelsky is here who can also help.
He works with me at Spirant.
And if you want to get into decoding paging and need a little pointers, Mr. Gostomelsky
can help with that.
He's at Recompiler.
So, he's right there.
So, I appreciate his help too.
So, this is a good piece that makes it all kind of happen.
Not only do you need a good feed line and a good antenna, but you need a good amplifier.
Obviously, you need a good amplifier.
Obviously, we could turn up the power on the transmitter, but it's only capable maybe
five watts if the Chinese specs are right.
But we turn it down so it's not going to work so hard.
And we let this do all the work.
This is a high-quality amateur radio amplifier.
And you can see it will do anything from 430 megahertz to 450 megahertz.
And as I mentioned before, 10 watts in and 100 watts out.
It uses N connectors for UHF, microwave frequencies, and it has some other features in there that
we don't use for amateur radio.
So, it's a high-quality amp, it doesn't have any spurious emissions and any issues like
that.
And that's one of the things I was adamant about is when I was going to build this and
do this is that A, we could stay legal, and B, we weren't going to spam the bands with
a bunch of spurious emissions and piss off local ham operators and whatnot and so on.
One thing I do, and I'll get into it a little bit, is I am members of the local ham clubs
here in Las Vegas, and so I do a lot of research on frequency listening and making sure I'm
not going to stomp on other people's projects and other repeaters and so on.
So, we were adamant about choosing the right frequency, and fortunately, for the last five
years, no one's complained.
Every year we come back, I always check in with my local ham buddies and see if anyone's
complained or wanted to file a complaint or so on, because they could file a complaint
to the FCC if they were pissed, but no one has, thankfully.
And I've been on a good frequency that no one seems to be using.
One of the things that we do, and I'll get into it a little bit more, is that in the
software, it does send a call sign, but it doesn't show up on the pager, because it doesn't
send it with a cap code.
So every 10 minutes, there is a call sign that's sent out for this time.
It is N17, November 7, Tango, for TeleFreak, and this is one of the creators of TeleFreak,
Champ, right here.
So this year, it's an event call sign.
Previous years, it was other TeleFreaker's call signs, either myself or SleeveStack's
call sign, or who was the other one?
Nerds.
Nerds, yeah.
What was it?
N3RDS?
Yeah.
So we've used different call signs all legally, but this year, I saw that it was very easy
to get a one-by-one event call sign coordinated with the ARRL, and I got that this year.
They approved it within the same day or the next day, and so I was pretty excited about
that, to have that.
So this is the big piece of it, is to have a good amplifier.
Obviously, you don't need to drive it too hard.
When it's paging really hard, when people are hammering it, the amp does get a little
bit warm.
But compared to some of the other amateur radio stuff.
It's more like lukewarm, where some of my other equipment, for example, the UHF 70
centimeter repeater, it can essentially get up to like lava hot.
This only gets up to like lukewarm, because we're not working it too hard.
One of the interesting things is that we do link it to Twitter and a couple other things,
but Twitter has 140 characters, POCSAC only allows 90 characters.
So most tweets come out in like three pages.
So it's not really efficient, but we're cramming new technology into old technology, but it
works.
So as I mentioned, the feed line, and I'm not going to get too deep into it, but it's
very important to get good feed line.
LMR 900, don't use RG58.
You need good shielding, good connectors on the end.
And when you get an adapter, you need a good adapter.
So I, to get into the Chinese transmitter, it's BNC.
So I adapt N to BNC, and I made sure those are all gold connectors and so on.
So that's an important piece.
It makes a huge difference.
You lose approximately half a dB per channel.
That's a good connection.
So one connection, two connections, and then the other connections on the back of the amp,
I mean, you're losing a couple of dB through that.
So you want to minimize that loss so you get as much power to the antenna, which does
some amplification naturally, and it makes a huge difference.
I've built a lot of amateur radio systems, I've done a lot of engineering with that,
and I've gone where I've used the cheap connectors, I've used the cheap coax, and it works.
But then when I update it with new stuff, it works like 40% better.
With the same amount of wattage and so on.
So antenna makes a big difference, and the feed line makes a big difference.
So for the cabling and whatnot, it's just serial into the back of the Chinese transmitter,
but if you notice back in one of the other slides, it does have RJ45, it will talk network,
but it only does telnet.
The web interface, it was so atrocious, I saw it once and I never looked at it again.
Never tried.
Jay Falcon looked at a couple of the other interfaces that the transmitter uses.
The Chinese transmitter had, but we decided just to maintain old school and just keep
it serial, super simple, and it works really well.
When I get into the other talk, I'll talk a little bit more about the importance of
the serial interface.
So this is just a normal USB to serial interface, but it's one with a more sophisticated driver
so that you can tweak the latency, the buffers, the speed at which it'll communicate serial.
The Chinese transmitter doesn't like anything over 9600 baud.
And not even 9600 baud.
Fast.
Like if you try to go exactly 9, it'll skip characters, it'll drop out.
So I slow it down a little bit just to keep it happy, and mostly for this kind of stuff.
So that's an important piece.
Fortunately I've had this thing forever, and I only have one, and I've been trying
to find another one that has that special driver, and I haven't had any luck.
But it's an important piece there.
So I run it off a virtual machine, and as you guys know, I am the rodent, so you'll
see some of this stuff in there.
So it just runs off a virtual machine off of Ubuntu.
I think it's five years old.
If it ain't broke, don't fix it.
And it never touches the internet, really.
So well, one way with the reverse tunnel.
So it just runs on a virtual machine with a virtual serial adapter, and that's how it
communicates to the transmitter.
And also shout out to 2600 and to the Telefreak badge crew.
As you can see, this is our badge this year.
So that's an important piece because if there's no data to push into the transmitter, it's
obviously not going to work.
But it's very simple.
We tried to keep it as simple as possible.
It just runs with a simple set of Python scripts that just dump the data to serial, and the
transmitter just accepts anything you throw at it over serial.
So like I said, it does send a call sign every 10 minutes, and then it does send cap
codes for different types of messages and so on.
Vlad had asked me to do some special cap codes, but unfortunately I didn't have time
to do it.
But we might be able to do that a little bit later.
But the cap codes are important for the POCSAC decoding.
And you can get more info on that.
So this is what it looks like when it's all put together.
It's not super fancy, but you need a good power supply.
And obviously there's the amp in operation and there's the transmitter.
And then it's just serial to the laptop.
So this is a good switching power supply.
So there's no spurious noise off of that, no AC hum, stuff like that.
That can affect not only the RF transmission, even though it's digital, but it can affect
noise getting into other things.
The serial and all that is important.
So for overall reliability of your system, you want to make sure that all these different
components are of higher quality.
If you can, go commercial grade, but amateur radio grade is effective enough.
So that's an important piece, is to have a good power supply to make it all work.
And I like to have things mobile, transportable, and be able to use multiple power interfaces
or types.
So I try to run everything all 12-volt, because it's easy to get 12-volt off of batteries
and to convert that and so on.
So that's what it looks like when it's all working.
I took that out.
I took this picture this morning.
I rebuilt it all last night.
There was a little bit of interference or jamming or something like that, but that seemed to
go away, and I wanted to deconstruct it and rebuild it all back again, the repeater and
the transmitter for the POG sac, and it's all working good now.
So the legalities around amateur radio is not that difficult.
To get into amateur radio, you can learn a lot.
To get a simple technician's license, it's only 36 questions, multiple choice, and you
only need to answer 27 of them correct.
So the entry level to get into it is very easy, and it's $13 for 10 years, and it gives
you federally licensed ability to experiment and to do all these cool things on the amateur
band.
So I encourage people, if you want to transmit POG sac, get a ham license and don't stomp
on those bands.
I request that.
The FCC requests that.
But it's also just gentleman's agreement or just being polite with your neighbors and
stuff like that, and that matters.
We all have to cohabitate in the RF spectrums, whether it's cell phones or Bluetooth or whatever,
but in particular with amateur radio, there's an important piece to that.
Now talking with other old school ham radio operators, I've had them argue that it's illegal,
that you can't do it.
And so the two bullets in part 97 FCC that I pull out is beaconing, which is used all
over the place for propagation testing and stuff like that, and then also broadcasting
transmissions.
It used to be that you could only broadcast to everyone if it was like the space shuttle
or QST from the ARRL.
But now it's all broadcast.
It's all stuff like that.
So they've since modified the wording a little bit since we don't fly the shuttle, unfortunately.
But you can't broadcast with intended reception by the general public, indirect or relayed.
So there's other bullets that do fall under this type of transmission, but these are the
ones that I think follow what we're doing best.
And so it is legal.
It's very easy to be legal, and I ask you to do that.
So one of the pieces that works, and I mentioned it before, is coordination.
To know your local ham operators that you're going to be sharing those frequencies with
potentially, to know your local ham clubs and whatnot, get friendly with them.
The last ham club I joined in Washington, D.C. was $25 for five years.
So I mean, it's not really hard to get in with those guys.
I went to their amateur field day.
I brought my repeater out, and you can learn a lot from these guys and share information,
and they'll kind of look out for you as well.
So if you're using a frequency or doing something wrong, they'll give you some help.
They'll give you some help.
They'll give you some advice.
Just yesterday, Drew brought another friend of ours, and he's an amateur extra, the highest
class you can get, and he's helped me diagnose some of that stuff.
And we're all on the same page, but it's nice to be able to bounce stuff off other
hams and other tech-savvy people to either validate what you're thinking or to invalidate
it and say, no, you don't know what you're thinking, it's something else.
So it was nice to be able to talk with other hams, and it really works well.
Research, one of the things I did is just to Google my face off to find what other people
are using on frequencies and these types of transmissions.
And that's a big effort of it.
And then also just listening and observation.
Before I get on a frequency and start stomping on it and using it, I'll listen for days or
weeks at a time to see if anyone else pops up on that frequency and uses it.
So you want to share it and be polite about it.
POGSAC, the transmissions are very intermittent, so it comes and goes, so you're not necessarily
transmitting all the time.
So it's kind of hard to determine if you're messing with someone or not.
So one of the things I did before we started transmitting here in Vegas was ask questions.
Ask local hams, ask the local clubs I was a part of, and then I just listened to the
frequency that we used, 433 megahertz, 500 kilohertz, 433.500, and I listened to that
for weeks remotely over the internet and then while I was here on site before we started
transmitting.
And even when I came back five years later this time, before I started transmitting,
I turned on all my radios and I listened to that frequency for hours to make sure that
no one is using it while I was gone.
So it is coordinated in that sense, but it's not necessarily official, like a permanent
repeater pair that gets coordinated with local clubs and with the ARRL and so on.
So observation is a big deal.
If you've done your research and your observation and you still can't feel comfortable with
it, always fall back on your band plans.
ARRL does publish all the plans for different frequency spectrums, and they do also have
slices in some of these spectrums for experimentation.
So if you're doing something that's polite and neighborly, but you isn't necessarily
part 97 compliant, you're doing experimentation, you are allowed to do that.
And that's one of the cool things that I got in the amateur radios because like years
ago before we even had the TSA, I would carry my ham radios on planes and stuff, and they
would harass me.
I would show them my FCC license.
No, I'm federally licensed.
Like I can carry this.
I can use this.
And they don't know what to say.
Don't transmit when you're on a plane.
Trust me.
You don't want to do that.
Legally, if you have the permission of the captain of the flight, you can transmit.
I've gotten that permission before.
And I was able to talk on a repeat.
I had a computer network from like 250 miles away from Sacramento.
That was the best I ever did on VHF.
But I had the permission of the captain.
Since then, many years ago, I think they've kind of tweaked the rules.
But I think the captain has the ultimate say on that.
So definitely utilize your clubs and peers that you're sharing the spectrums with.
That's an important piece.
So let me see what else I got here.
That's towards the end of it.
But you can always find us on rc.2600net.
All the TeleFreakers and us hams and hackers are in poundtelefreak.
You can chat with us.
And you can follow my Twitter, Andrew underscore strut.
And this is basically what I look like when I'm working.
I think that's 25 minutes is what I had.
So if anyone has any questions, I'm happy to answer any.
And we'll start with Miss Lindsey here.
The question is, when am I going to get an extra license?
And actually, I've been studying.
For the general, I'm big on baby steps.
So I'm pretty confident with the general.
I've had a tech plus for like ever.
So I do want to upgrade to general because that gives you more bands that you can use.
I think higher power transmission and certain bands and so on.
And a little more credibility with my fellow peers who are ham operators as well.
So good question.
I'm working on it.
But baby steps.
I'm not going to jump up to extra.
I'll get the general first.
So thank you.
Thank you.
B, what's your question?
What's the range?
And tell me about the source code methodology.
Okay.
So the question is range and source code methodology or naming convention.
Yeah.
Okay.
So the best range that we ever reported was Sleestack drove, was like driving home or
somewhere.
And he was all the way out by state line past Gene, got to the California state border.
And before he got over the hill, he was still getting pages.
So that was well over 50 miles.
Fortunately that year, I had a nice suite.
And it had windows like three quarters of around my room.
And so I had the antenna like with half the view down the strip and half the view down
to the southwest to California.
And so it really depends.
The propagation really is affected by antenna placement and which hotel suite I get.
So that's been the best recorded range that was verifiable was from Sleestack over state
line over 50 miles.
But it definitely saturates the casino or the immediate quarter mile.
Yeah, the range is quite good.
Now the follow up question that he had was about our highly complex source code naming
convention.
And like I said, we've been doing this for five years.
There's been several iterations of the software.
And so the naming convention I think we're on now is test four.
And once it works, it works.
So I haven't like pushed it to GitHub or anything like that.
But I might do that.
But it's very simple stuff.
You're just dumping the raw data to the serial port.
Tux could tell you there's like a half a million different ways you can do that with Python.
And he'll probably do it a quarter of a million different ways.
But we do keep it simple.
And once it's working, we're not going to beat ourselves up over it and make a name
for it, copyright it, trademark it.
We tested and tested.
And like the third or fourth time, it worked.
And remember what it's called.
Because sometimes I just suspend the VM until next year.
And I open it up.
And I'm looking at the scripts.
And I'm like, God, when was the last one we used?
Look at the history.
We used this one, this one, this one, this one, this one.
But we had to go by date this time.
So I looked at the date.
It's 2016, August.
And we were able to find which script we used last time.
So that's the majority of it.
It's the implementation of what makes it all happen and whatnot.
And we can get more into decoding Pogsack and whatnot.
Because we're certainly spamming that ban.
There's a lot of information, a lot of RF going out there.
And we're certainly spamming that ban.
And you can decode it.
It's cool stuff.
Tuck, do you have a question?
What does the TSA have to say about you dragging all of your equipment on the plane?
What does the TSA say about me dragging my equipment on the planes?
Well, nothing very pleasant.
They have a lot of questions.
I use my FCC license pretty heavily.
I use my government ID pretty heavily to, obviously, I'm not just some schmuck with
a bunch of gears going to try to take apart the plane while I'm flying with tools and
so on.
But this year, I actually paid the oversize fee and packed it all in one big, giant box.
So I carry my handhelds.
I carry some tools with me and so on.
But this repeater and the other stuff, I didn't have it on my carry-on.
So TSA didn't say too much.
But I did have them pre-inspect it before they accepted it to go down.
And so I stood there as he opened up the box and went, holy Christ, what is this?
FCC license.
You know?
So.
And he's like, OK.
And he, what is this?
FCC license.
You know?
So it's effective.
And I just told them I'm an amateur radio operator.
And this is my equipment.
And they don't know.
And it's not illegal.
It's just they have questions.
And they'll have to swipe it down and all that stuff.
But they do always ask about my handhelds and why I have that on the plane and so on.
And one of the things that Vlad and I do is ARIES, Amateur Radio Emergency Service.
And, you know, all of our other comms aren't always going to be there.
And so you have to fall back on that.
So you have to go to ARIES and see what they tell you.
And then I'm going to send you a form for you to look through it and tell you about
And you know, I don't know.
But if you're going to work with them and that's a really good service, you can do
You just made it small.
Like, the video, you just make it big.
We're excited.
We'll do a video about your program.
Yes, you can.
The question is, can you do things like APRS messaging
through POGSAC?
For example, Flex has more features within that protocol,
not necessarily location stuff, but I'll get into,
I have another piece that does do APRS
and location-based stuff, but the protocol was,
this was like 30, 40 years ago.
Now, the other piece I'll remind you
is the information disclosure.
If you start decoding the stuff out there,
you'll find stuff from telecommunications,
aviation, medical, and all kinds of stuff
that's out there to decode.
Decode it legally, do it ethically,
don't propagate that information unintentionally.
But my favorite one was watching pages
to central office technicians,
where they get the address of the central office,
the door code, and what they're supposed to do
at the central office.
So with that page, you know,
yeah.
So there's another question.
So the question is regarding formalities or proper etiquette
if you're going to transmit on POGSAC
or use the hashtags and whatnot.
Obviously, some rules apply because it does go
from Twitter to amateur radio.
I think the only major stipulation that is an issue
for me is cursing, unfortunately.
It's not censorship.
It's just, you know,
you don't have to be a dick all the time.
So you don't have to curse.
But that's, I think, the only thing
that is really an issue is just that sort of thing.
So that's the question.
I've actually been looking at it this time.
Four previous years, we never had a problem with it.
This year, there's something different.
So.
Sorry. The question was, are we doing any,
anything to filter the content that we don't like?
So we try not to.
It's usually not an issue.
I think I only noticed it a couple times
in the previous years.
But for some reason this year, I guess people curse more.
They're talking to me more and I curse a lot.
So, not on ham, but, so yeah, great question though.
And we'll look at that more as we advance the code
over the years.
Every year, there's a new reiteration, a new refactoring.
There'll be a test five Python script for next year.
And so on, so, but that's a good question.
And we'll look into that.
Especially, I want to stay as compliant as possible.
It's certainly an issue.
And I was thinking about it that long
and hard the last couple of days.
Because right out the gate, I started noticing it.
And I was like, ah.
So, any other questions?
Great. Thank you very much.
Great questions.
Thank you for listening.
Really appreciate it.