An ADS-B In Question

Hopefully Darryl will respond to this but anyone with the knowledge will
be appreciated.

I have a home-grown ADS-B system consisting of a Raspberry Pi 2 and a
couple of software defined radios feeding Avare on my smart phone. I
have line of sight to the ADS-B tower on top of Sandia Peak, on the east
side of Albuquerque. I see a number of 1090ES targets around the ABQ
area, one at 10,400PA', one at 8,200PA' over SAF, several in the high
30s to low 40s pressure altitude. But I don't see any targets very far
away from Albuquerque.

Is it that only targets within some volume are being transmitted through
the tower within view or am I simply receiving the 1090ES transmissions
directly from the aircraft? I think this may be the case as I don't see
and aircraft on my display that I couldn't see with binoculars from my
house.

When I first turned on the system I saw some aircraft that appeared to
be in the traffic pattern at ABQ and, from where I live on the east side
of the mountains, their transmissions would be blocked by the
mountains. I speculate that there was an ADS-B Out aircraft flying
relatively low near my house and I was receiving TIS-B transmissions
meant for him. I also saw ADS-B weather that day and there were a lot
of snow storms up and down the Rockies.
--
Dan, 5J

Dan

The ADS-B ground station will be broadcasting ADS-R and TIS-B data for client aircraft that are near (i.e. within the ADS-B service "jockey puck" of +/- 3.500' and 15nm radius around the client aircraft). So it may not be, and does not need to be, client aircraft near *you*. Say a suitable equipped ADS-B Out aircraft was 1,000' directly overhead some other transponder only equipped traffic (within SSR coverage) on the other side of a mountain range, where all those aircraft are out of sight to you. The ADS-B ground you had line of site to the ADS-B ground tower covering that airspace you would still see those ground broadcasts intended really for he client aircraft on the other side of the range.

That's again points to the basic irony looking at TIS-B and ADS-R transmissions, they are made for client aircraft near the target, not necessarily near you. As the other target aircraft moves away from the client aircraft, maybe towards you. You stop seeing it on ADS-B. Oops. And in your case it is more likely than not won't be a ADS-B client aircraft near you that is causing what you see for a remote aircraft on the other side of a mountain, the client aircraft will be over on the other side, closer to the target.

What you see at distances will depend on the signal strength and distance to the aircraft or ground station and you antenna setup. These small software defined radio modules are fun to play with but built at low cost and don't have the worlds best analog RF front ends. It would be fun to compare them to what is used in commercial portable devices. Part of the reason I'm not too excited about folks using these in their aircraft for more than experimenting/playing around. The antenna used and it's location/sky visibility will affect coverage as well. It could well be that you will see lots of distant aircraft via ADS-R and TIS-B but not ADS-B direct, because you can receive transmissions from the ground tower well but not those more distant aircraft even if you have line of site to them.

I've mentioned in the past it is hard to try to reverse engineer overall what is going on, especially you cannot easily tell what is being broadcast for what client aircraft. However it should be relatively easy to technically tell if you are receiving data for a TIS-B target. That information is included in the air broadcast messages and fully exposed in the de-facto standard GDL-90 serial communications these portable (hobby and commercial) ADS-B receivers are using.

The GDL9-90 communication protocol is documented and publicly available. e.g. here https://www.faa.gov/nextgen/programs...c_ICD_RevA.PDF. (that one is old, I'd imagine there may be more recent updates even of he GDL90 has long ago stopped being interesting).

The first question I would have is how much of the GDL-90 protocol does and receiver software really implement and does it software correctly send out the target type field data. I've not played with it so I don't know, hopefully it does. Reading the source code should also make that clear.

So even if most commercial traffic display software won't show on the display what type an ADS-B target is it is possible for somebody a little technical to look at this stuff and tell. Easy for example to just grab the GDL-90 serial steam and process it with a text utility. The software Dan is using does logging and I suspect this is all in those log files or can be turned on, but I've not looked.

it is also clear over the air what a ADS-R or ADS-B direct messages are. If that is simply exposed in the traffic stream form any of these devices should be easy to work out for technical folks.. again just by reading the source code.

Hope that helps.









On Sunday, January 10, 2016 at 11:09:02 AM UTC-8, Dan Marotta wrote:
Hopefully Darryl will respond to this but anyone with the knowledge
will be appreciated.



I have a home-grown ADS-B system consisting of a Raspberry Pi 2 and
a couple of software defined radios feeding Avare on my smart
phone.* I have line of sight to the ADS-B tower on top of Sandia
Peak, on the east side of Albuquerque.* I see a number of 1090ES
targets around the ABQ area, one at 10,400PA', one at 8,200PA' over
SAF, several in the high 30s to low 40s pressure altitude.* But I
don't see any targets very far away from Albuquerque.



Is it that only targets within some volume are being transmitted
through the tower within view or am I simply receiving the 1090ES
transmissions directly from the aircraft?* I think this may be the
case as I don't see and aircraft on my display that I couldn't see
with binoculars from my house.



When I first turned on the system I saw some aircraft that appeared
to be in the traffic pattern at ABQ and, from where I live on the
east side of the mountains, their transmissions would be blocked by
the mountains.* I speculate that there was an ADS-B Out aircraft
flying relatively low near my house and I was receiving TIS-B
transmissions meant for him.* I also saw ADS-B weather that day and
there were a lot of snow storms up and down the Rockies.


--

Dan, 5J

Very helpful, thanks!

So far I've only looked at the data stream being sent to the Avare
application. It's a text stream which includes aircraft call sign (if
avaliable, e.g., UAL178), the ICAO address, lat, lon, and altitude. I'd
look at the source code, but my eyes get bleary pretty quickly.

I don't intend for this to me much more than a toy, though I do plan to
try it in flight just to see how it works. When the time comes, I'll
get proper equipment.

Thanks again.

On 1/10/2016 1:43 PM, Darryl Ramm wrote:
Dan

The ADS-B ground station will be broadcasting ADS-R and TIS-B data for client aircraft that are near (i.e. within the ADS-B service "jockey puck" of +/- 3.500' and 15nm radius around the client aircraft). So it may not be, and does not need to be, client aircraft near *you*. Say a suitable equipped ADS-B Out aircraft was 1,000' directly overhead some other transponder only equipped traffic (within SSR coverage) on the other side of a mountain range, where all those aircraft are out of sight to you. The ADS-B ground you had line of site to the ADS-B ground tower covering that airspace you would still see those ground broadcasts intended really for he client aircraft on the other side of the range.

That's again points to the basic irony looking at TIS-B and ADS-R transmissions, they are made for client aircraft near the target, not necessarily near you. As the other target aircraft moves away from the client aircraft, maybe towards you. You stop seeing it on ADS-B. Oops. And in your case it is more likely than not won't be a ADS-B client aircraft near you that is causing what you see for a remote aircraft on the other side of a mountain, the client aircraft will be over on the other side, closer to the target.

What you see at distances will depend on the signal strength and distance to the aircraft or ground station and you antenna setup. These small software defined radio modules are fun to play with but built at low cost and don't have the worlds best analog RF front ends. It would be fun to compare them to what is used in commercial portable devices. Part of the reason I'm not too excited about folks using these in their aircraft for more than experimenting/playing around. The antenna used and it's location/sky visibility will affect coverage as well. It could well be that you will see lots of distant aircraft via ADS-R and TIS-B but not ADS-B direct, because you can receive transmissions from the ground tower well but not those more distant aircraft even if you have line of site to them.

I've mentioned in the past it is hard to try to reverse engineer overall what is going on, especially you cannot easily tell what is being broadcast for what client aircraft. However it should be relatively easy to technically tell if you are receiving data for a TIS-B target. That information is included in the air broadcast messages and fully exposed in the de-facto standard GDL-90 serial communications these portable (hobby and commercial) ADS-B receivers are using.

The GDL9-90 communication protocol is documented and publicly available. e.g. here https://www.faa.gov/nextgen/programs...c_ICD_RevA.PDF. (that one is old, I'd imagine there may be more recent updates even of he GDL90 has long ago stopped being interesting).

The first question I would have is how much of the GDL-90 protocol does and receiver software really implement and does it software correctly send out the target type field data. I've not played with it so I don't know, hopefully it does. Reading the source code should also make that clear.

So even if most commercial traffic display software won't show on the display what type an ADS-B target is it is possible for somebody a little technical to look at this stuff and tell. Easy for example to just grab the GDL-90 serial steam and process it with a text utility. The software Dan is using does logging and I suspect this is all in those log files or can be turned on, but I've not looked.

it is also clear over the air what a ADS-R or ADS-B direct messages are. If that is simply exposed in the traffic stream form any of these devices should be easy to work out for technical folks.. again just by reading the source code.

Hope that helps.









On Sunday, January 10, 2016 at 11:09:02 AM UTC-8, Dan Marotta wrote:
Hopefully Darryl will respond to this but anyone with the knowledge
will be appreciated.



I have a home-grown ADS-B system consisting of a Raspberry Pi 2 and
a couple of software defined radios feeding Avare on my smart
phone. I have line of sight to the ADS-B tower on top of Sandia
Peak, on the east side of Albuquerque. I see a number of 1090ES
targets around the ABQ area, one at 10,400PA', one at 8,200PA' over
SAF, several in the high 30s to low 40s pressure altitude. But I
don't see any targets very far away from Albuquerque.



Is it that only targets within some volume are being transmitted
through the tower within view or am I simply receiving the 1090ES
transmissions directly from the aircraft? I think this may be the
case as I don't see and aircraft on my display that I couldn't see
with binoculars from my house.



When I first turned on the system I saw some aircraft that appeared
to be in the traffic pattern at ABQ and, from where I live on the
east side of the mountains, their transmissions would be blocked by
the mountains. I speculate that there was an ADS-B Out aircraft
flying relatively low near my house and I was receiving TIS-B
transmissions meant for him. I also saw ADS-B weather that day and
there were a lot of snow storms up and down the Rockies.


--

Dan, 5J

--
Dan, 5J

If you have a GDL-90 compatible text stream from stratusx out of curiosity can you email it to me. My gmail email as used here.

Email sent with attached file, out.bin. Not text, but that's what I got
when executing the save function on the Avare External I/O app on my phone.

good luck!

On 1/10/2016 2:13 PM, Darryl Ramm wrote:
If you have a GDL-90 compatible text stream from stratusx out of curiosity can you email it to me. My gmail email as used here.

--
Dan, 5J

On Sunday, January 10, 2016 at 12:44:03 PM UTC-8, Darryl Ramm wrote:
Dan

The ADS-B ground station will be broadcasting ADS-R and TIS-B data for client aircraft that are near (i.e. within the ADS-B service "jockey puck" of +/- 3.500' and 15nm radius around the client aircraft). So it may not be, and does not need to be, client aircraft near *you*. Say a suitable equipped ADS-B Out aircraft was 1,000' directly overhead some other transponder only equipped traffic (within SSR coverage) on the other side of a mountain range, where all those aircraft are out of sight to you. The ADS-B ground you had line of site to the ADS-B ground tower covering that airspace you would still see those ground broadcasts intended really for he client aircraft on the other side of the range.

That's again points to the basic irony looking at TIS-B and ADS-R transmissions, they are made for client aircraft near the target, not necessarily near you. As the other target aircraft moves away from the client aircraft, maybe towards you. You stop seeing it on ADS-B. Oops. And in your case it is more likely than not won't be a ADS-B client aircraft near you that is causing what you see for a remote aircraft on the other side of a mountain, the client aircraft will be over on the other side, closer to the target.

What you see at distances will depend on the signal strength and distance to the aircraft or ground station and you antenna setup. These small software defined radio modules are fun to play with but built at low cost and don't have the worlds best analog RF front ends. It would be fun to compare them to what is used in commercial portable devices. Part of the reason I'm not too excited about folks using these in their aircraft for more than experimenting/playing around. The antenna used and it's location/sky visibility will affect coverage as well. It could well be that you will see lots of distant aircraft via ADS-R and TIS-B but not ADS-B direct, because you can receive transmissions from the ground tower well but not those more distant aircraft even if you have line of site to them.

I've mentioned in the past it is hard to try to reverse engineer overall what is going on, especially you cannot easily tell what is being broadcast for what client aircraft. However it should be relatively easy to technically tell if you are receiving data for a TIS-B target. That information is included in the air broadcast messages and fully exposed in the de-facto standard GDL-90 serial communications these portable (hobby and commercial) ADS-B receivers are using.

The GDL9-90 communication protocol is documented and publicly available. e.g. here https://www.faa.gov/nextgen/programs...c_ICD_RevA.PDF. (that one is old, I'd imagine there may be more recent updates even of he GDL90 has long ago stopped being interesting).

The first question I would have is how much of the GDL-90 protocol does and receiver software really implement and does it software correctly send out the target type field data. I've not played with it so I don't know, hopefully it does. Reading the source code should also make that clear.

So even if most commercial traffic display software won't show on the display what type an ADS-B target is it is possible for somebody a little technical to look at this stuff and tell. Easy for example to just grab the GDL-90 serial steam and process it with a text utility. The software Dan is using does logging and I suspect this is all in those log files or can be turned on, but I've not looked.

it is also clear over the air what a ADS-R or ADS-B direct messages are. If that is simply exposed in the traffic stream form any of these devices should be easy to work out for technical folks.. again just by reading the source code.

Hope that helps.









On Sunday, January 10, 2016 at 11:09:02 AM UTC-8, Dan Marotta wrote:
Hopefully Darryl will respond to this but anyone with the knowledge
will be appreciated.



I have a home-grown ADS-B system consisting of a Raspberry Pi 2 and
a couple of software defined radios feeding Avare on my smart
phone.* I have line of sight to the ADS-B tower on top of Sandia
Peak, on the east side of Albuquerque.* I see a number of 1090ES
targets around the ABQ area, one at 10,400PA', one at 8,200PA' over
SAF, several in the high 30s to low 40s pressure altitude.* But I
don't see any targets very far away from Albuquerque.



Is it that only targets within some volume are being transmitted
through the tower within view or am I simply receiving the 1090ES
transmissions directly from the aircraft?* I think this may be the
case as I don't see and aircraft on my display that I couldn't see
with binoculars from my house.



When I first turned on the system I saw some aircraft that appeared
to be in the traffic pattern at ABQ and, from where I live on the
east side of the mountains, their transmissions would be blocked by
the mountains.* I speculate that there was an ADS-B Out aircraft
flying relatively low near my house and I was receiving TIS-B
transmissions meant for him.* I also saw ADS-B weather that day and
there were a lot of snow storms up and down the Rockies.


--

Dan, 5J

Darryl,

As always I appreciate your knowledge on this and I have a serious concern, based on what several of my programmer geek friends have noted after reading the TSO.

Here is the concern: The ADS-B protocols have no encryption/security protection! I.E. we have a "network" that easily hacked or spoofed, new pseudo-planes could be added to the network with scripted GPS/Altitude data, and no one would know. The whole system is based on the assumption that everyone is playing "nice" with the data.

It that what you understand? How secure is the network?

MB

ADS-B is inherently not secure, a very bad mistake IMNSHO. Nothing is encrypted or cryptographically authenticated. Many technical folks, including experts on encryption etc. that I know also express extreme surprise with that. It is trivial to use to track aircraft which is good at times, but may be a security or physical attack risk, is easily spoofable with possibly bad consequences, including flooding/denial of service style attacks. And all that ground infrastructure, is potentially physically attackable.

That is one reason why it is good there is no way that ADS-B actually issues TCAS-II TYPE RAS (even if you have TCAS II version 7.1 with ADS-B enhancements). You could imagine what could happen with a malicious actor forcing aircraft TCAS systems to issue false RAs.

if its a low-level attack or some idiot just "messing around" then I expect the FAA to use technical means to mitigate some of the harm and to help track down the attackers. Obviously at on extreme they revert back to SSR, A serious technically sophisticated malicious attack, oh that sure worries me..

I do worry that FAA goals of eventually decommissioning a number of approach SSR systems as ADS-B is adopted is a dangerous fantasy. Proffered up by the FAA to congress to show how ADS-B would help save money. That SSR capability is needed as a complement and fallback to ADS-B in case bad things happen. The primary radar facilities are also needed so that somebody just can't turn off ADS-B Out and their transponder and cruise around with no radar coverage. The joint ARTCC/USAF ASRS-4 defense radar facilities are really impressive primary radars but you still want some backup with those local approach primary radars, even if they don't have capacities like the primary radar altitude capability that the big ARSR-4 systems have. How vulnerable that whole radar/SSR infrastructure is is another whole question.


On Sunday, January 10, 2016 at 3:28:06 PM UTC-8, SoaringXCellence wrote:
/snip/
As always I appreciate your knowledge on this and I have a serious concern, based on what several of my programmer geek friends have noted after reading the TSO.

Here is the concern: The ADS-B protocols have no encryption/security protection! I.E. we have a "network" that easily hacked or spoofed, new pseudo-planes could be added to the network with scripted GPS/Altitude data, and no one would know. The whole system is based on the assumption that everyone is playing "nice" with the data.

It that what you understand? How secure is the network?

MB

On Sunday, January 10, 2016 at 6:58:27 PM UTC-8, Darryl Ramm wrote:
ADS-B is inherently not secure, a very bad mistake IMNSHO. Nothing is encrypted or cryptographically authenticated. Many technical folks, including experts on encryption etc. that I know also express extreme surprise with that. It is trivial to use to track aircraft which is good at times, but may be a security or physical attack risk, is easily spoofable with possibly bad consequences, including flooding/denial of service style attacks. And all that ground infrastructure, is potentially physically attackable.

That is one reason why it is good there is no way that ADS-B actually issues TCAS-II TYPE RAS (even if you have TCAS II version 7.1 with ADS-B enhancements). You could imagine what could happen with a malicious actor forcing aircraft TCAS systems to issue false RAs.

if its a low-level attack or some idiot just "messing around" then I expect the FAA to use technical means to mitigate some of the harm and to help track down the attackers. Obviously at on extreme they revert back to SSR, A serious technically sophisticated malicious attack, oh that sure worries me.

I do worry that FAA goals of eventually decommissioning a number of approach SSR systems as ADS-B is adopted is a dangerous fantasy. Proffered up by the FAA to congress to show how ADS-B would help save money. That SSR capability is needed as a complement and fallback to ADS-B in case bad things happen. The primary radar facilities are also needed so that somebody just can't turn off ADS-B Out and their transponder and cruise around with no radar coverage. The joint ARTCC/USAF ASRS-4 defense radar facilities are really impressive primary radars but you still want some backup with those local approach primary radars, even if they don't have capacities like the primary radar altitude capability that the big ARSR-4 systems have. How vulnerable that whole radar/SSR infrastructure is is another whole question.


On Sunday, January 10, 2016 at 3:28:06 PM UTC-8, SoaringXCellence wrote:
/snip/
As always I appreciate your knowledge on this and I have a serious concern, based on what several of my programmer geek friends have noted after reading the TSO.

Here is the concern: The ADS-B protocols have no encryption/security protection! I.E. we have a "network" that easily hacked or spoofed, new pseudo-planes could be added to the network with scripted GPS/Altitude data, and no one would know. The whole system is based on the assumption that everyone is playing "nice" with the data.

It that what you understand? How secure is the network?

MB

Darryl,

Thanks for your reply, I fly almost every day in the ATC system of the US and I appreciate both the volume of traffic and the fragile nature of the human element in the ATC. I have yet to get what I believe was a truly dangerous clearance from a controller, but I've also had a few too-close encounters with VFR traffic while descending out of the clouds. ADS-B would sure be nice.

I can see a scenario where a malicious entity could fly into a busy area, engage a false data feed into the ADS-B out, spoofing a track in one direction while going altogether some place else. That's scarier that VFR traffic today.

Thanks again for your knowledgeable participation in these usegroups.

MB

Well that got technical right away. In general terms, would I be able to know about small aircraft with transponders, ie C172 etc, flying into the airport I fly? It's a class E airport, but near a class B airport so, most aircraft are transponder equipped. The device I am looking at is an ADS B - in, receiver, and I would send the information to my iPhone 6+ via wifi. It seems like most major areas now have ADS -B coverage and since I don't have to install an ADS-B out signal, yet. It seems like a solution to what I am looking for, which is some indication of another aircraft near me when my eyes did not pick him up.
Since I am not sending the "out" signal, would I not receive the transponder only traffic? Also since the "out" signal is not present, would the set up just report useless information to me and maybe even show my own glider as traffic?
The device I'm looking at is a TRX1000 from Air Avionics, used with iGlide software.
Thank you.

On Wednesday, January 13, 2016 at 6:21:40 PM UTC-5, wrote:
Well that got technical right away. In general terms, would I be able to know about small aircraft with transponders, ie C172 etc, flying into the airport I fly? It's a class E airport, but near a class B airport so, most aircraft are transponder equipped. The device I am looking at is an ADS B - in, receiver, and I would send the information to my iPhone 6+ via wifi. It seems like most major areas now have ADS -B coverage and since I don't have to install an ADS-B out signal, yet. It seems like a solution to what I am looking for, which is some indication of another aircraft near me when my eyes did not pick him up.
Since I am not sending the "out" signal, would I not receive the transponder only traffic? Also since the "out" signal is not present, would the set up just report useless information to me and maybe even show my own glider as traffic?
The device I'm looking at is a TRX1000 from Air Avionics, used with iGlide software.
Thank you.

While you may see Transponder equipped aircraft transmitted via TIS-B by your local ADS-B ground station, this only happens if there is and ADS-B OUT equipped aircraft in the area. The ONLY way you can reliably expect to see all Transponder equipped aircraft in your vicinity is if your own aircraft is ADS-B OUT equipped.

Personally, I think that installing an ADS-B IN receiver without an ADS-B OUT transmitter is a really bad idea. It will have a tendency to make you falsely think that you are seeing all the traffic out there, which will inevitably breed a very dangerous form of complacency.