Monitoring POCSAG Networks using a SDR

This article demonstrates how the POCSAG pager network can be monitored and the transmitted messages can be read.

Background

The POCSAG protocol used to operate pager networks is already several decades old but still in use. There are multiple networks available world wide operated by commercial network operators. The communication is by default unencrypted so it can be received and understood by anyone.

This article shows how a SDR and open source software can be used to receive and display POCSAG messages.

Needed Hardware and Software

The needed hardware is quite inexpensive and the software is available as open source, such that the entry barrier to start own experiments is quite low.

Hardware

In principle any software defined radio (SDR) covering a frequency range up to 800 MHz should be suitable to monitor POCSAG communication. This includes also RTL-SDR USB sticks which allow an inexpensive start into the SDR world. The RTL-SDR was initially produced as DVB-T tuner and is available for around 25€. However, we use a LimeSDR receiver in this article.

Software

The following software is necessary. In a Linux system it can usually directly be installed using the distribution’s package management system. Additionally appropriate drivers for the used SDR are required.

• GQRX
• SoX
• multimon-ng

GQRX is graphical frontend for the SDR. It is used to configure the SDR, e.g. the correct frequency or modulation scheme. It also offers the possibility to to forward the received signal stream via UDP to other applications.

SoX is the self-claimed Swiss army knife of sound processing programs. It is used to down-sample the received signal stream from GQRX such that it can be processed by the final program – multimon-ng.

Multimon-ng is able to decode multiple digital communication protocols. The list of supported protocols includes also POCSAG.

Configuration

The first step is to figure out which POCSAG networks are available in your region and on which frequency they are operating. As a starting point have a look in this Wikipedia article.

Depending on the used SDR device, the configuration of GQRX is different. For a LimeSDR the following configuration works.

The receiver options can be configures as shown in the next picture. The AGC as well as the squelch options can still be improved depending on the used hardware.

The input controls as shown as in the next image can act as a starting point. Fine tuning of the gain controls is recommended as these depend on the used hardware equipment.

The final configuration step in GQRX is to enable UDP output such that the received and demodulated audio signal can be used by other programs. This can be done by selecting the UDP button on the lower right window. By default GQRX opens a UDP socket on port 7355.

The decoding of the received signal is done with multimon-ng. It can be started in a console with the following command.

nc -l -u localhost 7355 | sox -t raw -esigned-integer -b16 -r 48000 - -t raw -esigned-integer -b16 -r 22050 - | multimon-ng -t raw -a POCSAG512 -a POCSAG1200 -a POCSAG2400 -f alpha -e  --timestamp -

After a while you should be able to see decoded messages in the terminal window.