This article demonstrates how the POCSAG pager network can be monitored and the transmitted messages can be read.
The POCSAG protocol used to operate pager networks is already several decades old but still in use. There are multiple networks available world wide operated by commercial network operators. The communication is by default unencrypted so it can be received and understood by anyone.
Needed Hardware and Software
The needed hardware is quite inexpensive and the software is available as open source, such that the entry barrier to start own experiments is quite low.
In principle any software defined radio (SDR) covering a frequency range up to 800 MHz should be suitable to monitor POCSAG communication. This includes also RTL-SDR USB sticks which allow an inexpensive start into the SDR world. The RTL-SDR was initially produced as DVB-T tuner and is available for around 25€. However, we use a LimeSDR receiver in this article.
The following software is necessary. In a Linux system it can usually directly be installed using the distribution’s package management system. Additionally appropriate drivers for the used SDR are required.
GQRX is graphical frontend for the SDR. It is used to configure the SDR, e.g. the correct frequency or modulation scheme. It also offers the possibility to to forward the received signal stream via UDP to other applications.
SoX is the self-claimed Swiss army knife of sound processing programs. It is used to down-sample the received signal stream from GQRX such that it can be processed by the final program – multimon-ng.
Multimon-ng is able to decode multiple digital communication protocols. The list of supported protocols includes also POCSAG.
The input controls as shown as in the next image can act as a starting point. Fine tuning of the gain controls is recommended as these depend on the used hardware equipment.
The final configuration step in GQRX is to enable UDP output such that the received and demodulated audio signal can be used by other programs. This can be done by selecting the UDP button on the lower right window. By default GQRX opens a UDP socket on port 7355.
The decoding of the received signal is done with multimon-ng. It can be started in a console with the following command.
nc -l -u localhost 7355 | sox -t raw -esigned-integer -b16 -r 48000 - -t raw -esigned-integer -b16 -r 22050 - | multimon-ng -t raw -a POCSAG512 -a POCSAG1200 -a POCSAG2400 -f alpha -e --timestamp -
After a while you should be able to see decoded messages in the terminal window.