An ADS-B In Question

Hopefully Darryl will respond to this but anyone with the knowledge will
be appreciated.

I have a home-grown ADS-B system consisting of a Raspberry Pi 2 and a
couple of software defined radios feeding Avare on my smart phone. I
have line of sight to the ADS-B tower on top of Sandia Peak, on the east
side of Albuquerque. I see a number of 1090ES targets around the ABQ
area, one at 10,400PA', one at 8,200PA' over SAF, several in the high
30s to low 40s pressure altitude. But I don't see any targets very far
away from Albuquerque.

Is it that only targets within some volume are being transmitted through
the tower within view or am I simply receiving the 1090ES transmissions
directly from the aircraft? I think this may be the case as I don't see
and aircraft on my display that I couldn't see with binoculars from my
house.

When I first turned on the system I saw some aircraft that appeared to
be in the traffic pattern at ABQ and, from where I live on the east side
of the mountains, their transmissions would be blocked by the
mountains. I speculate that there was an ADS-B Out aircraft flying
relatively low near my house and I was receiving TIS-B transmissions
meant for him. I also saw ADS-B weather that day and there were a lot
of snow storms up and down the Rockies.
--
Dan, 5J

Dan

The ADS-B ground station will be broadcasting ADS-R and TIS-B data for client aircraft that are near (i.e. within the ADS-B service "jockey puck" of +/- 3.500' and 15nm radius around the client aircraft). So it may not be, and does not need to be, client aircraft near *you*. Say a suitable equipped ADS-B Out aircraft was 1,000' directly overhead some other transponder only equipped traffic (within SSR coverage) on the other side of a mountain range, where all those aircraft are out of sight to you. The ADS-B ground you had line of site to the ADS-B ground tower covering that airspace you would still see those ground broadcasts intended really for he client aircraft on the other side of the range.

That's again points to the basic irony looking at TIS-B and ADS-R transmissions, they are made for client aircraft near the target, not necessarily near you. As the other target aircraft moves away from the client aircraft, maybe towards you. You stop seeing it on ADS-B. Oops. And in your case it is more likely than not won't be a ADS-B client aircraft near you that is causing what you see for a remote aircraft on the other side of a mountain, the client aircraft will be over on the other side, closer to the target.

What you see at distances will depend on the signal strength and distance to the aircraft or ground station and you antenna setup. These small software defined radio modules are fun to play with but built at low cost and don't have the worlds best analog RF front ends. It would be fun to compare them to what is used in commercial portable devices. Part of the reason I'm not too excited about folks using these in their aircraft for more than experimenting/playing around. The antenna used and it's location/sky visibility will affect coverage as well. It could well be that you will see lots of distant aircraft via ADS-R and TIS-B but not ADS-B direct, because you can receive transmissions from the ground tower well but not those more distant aircraft even if you have line of site to them.

I've mentioned in the past it is hard to try to reverse engineer overall what is going on, especially you cannot easily tell what is being broadcast for what client aircraft. However it should be relatively easy to technically tell if you are receiving data for a TIS-B target. That information is included in the air broadcast messages and fully exposed in the de-facto standard GDL-90 serial communications these portable (hobby and commercial) ADS-B receivers are using.

The GDL9-90 communication protocol is documented and publicly available. e.g. here https://www.faa.gov/nextgen/programs...c_ICD_RevA.PDF. (that one is old, I'd imagine there may be more recent updates even of he GDL90 has long ago stopped being interesting).

The first question I would have is how much of the GDL-90 protocol does and receiver software really implement and does it software correctly send out the target type field data. I've not played with it so I don't know, hopefully it does. Reading the source code should also make that clear.

So even if most commercial traffic display software won't show on the display what type an ADS-B target is it is possible for somebody a little technical to look at this stuff and tell. Easy for example to just grab the GDL-90 serial steam and process it with a text utility. The software Dan is using does logging and I suspect this is all in those log files or can be turned on, but I've not looked.

it is also clear over the air what a ADS-R or ADS-B direct messages are. If that is simply exposed in the traffic stream form any of these devices should be easy to work out for technical folks.. again just by reading the source code.

Hope that helps.









On Sunday, January 10, 2016 at 11:09:02 AM UTC-8, Dan Marotta wrote:
Hopefully Darryl will respond to this but anyone with the knowledge
will be appreciated.



I have a home-grown ADS-B system consisting of a Raspberry Pi 2 and
a couple of software defined radios feeding Avare on my smart
phone.* I have line of sight to the ADS-B tower on top of Sandia
Peak, on the east side of Albuquerque.* I see a number of 1090ES
targets around the ABQ area, one at 10,400PA', one at 8,200PA' over
SAF, several in the high 30s to low 40s pressure altitude.* But I
don't see any targets very far away from Albuquerque.



Is it that only targets within some volume are being transmitted
through the tower within view or am I simply receiving the 1090ES
transmissions directly from the aircraft?* I think this may be the
case as I don't see and aircraft on my display that I couldn't see
with binoculars from my house.



When I first turned on the system I saw some aircraft that appeared
to be in the traffic pattern at ABQ and, from where I live on the
east side of the mountains, their transmissions would be blocked by
the mountains.* I speculate that there was an ADS-B Out aircraft
flying relatively low near my house and I was receiving TIS-B
transmissions meant for him.* I also saw ADS-B weather that day and
there were a lot of snow storms up and down the Rockies.


--

Dan, 5J

Very helpful, thanks!

So far I've only looked at the data stream being sent to the Avare
application. It's a text stream which includes aircraft call sign (if
avaliable, e.g., UAL178), the ICAO address, lat, lon, and altitude. I'd
look at the source code, but my eyes get bleary pretty quickly.

I don't intend for this to me much more than a toy, though I do plan to
try it in flight just to see how it works. When the time comes, I'll
get proper equipment.

Thanks again.

On 1/10/2016 1:43 PM, Darryl Ramm wrote:
Dan

The ADS-B ground station will be broadcasting ADS-R and TIS-B data for client aircraft that are near (i.e. within the ADS-B service "jockey puck" of +/- 3.500' and 15nm radius around the client aircraft). So it may not be, and does not need to be, client aircraft near *you*. Say a suitable equipped ADS-B Out aircraft was 1,000' directly overhead some other transponder only equipped traffic (within SSR coverage) on the other side of a mountain range, where all those aircraft are out of sight to you. The ADS-B ground you had line of site to the ADS-B ground tower covering that airspace you would still see those ground broadcasts intended really for he client aircraft on the other side of the range.

That's again points to the basic irony looking at TIS-B and ADS-R transmissions, they are made for client aircraft near the target, not necessarily near you. As the other target aircraft moves away from the client aircraft, maybe towards you. You stop seeing it on ADS-B. Oops. And in your case it is more likely than not won't be a ADS-B client aircraft near you that is causing what you see for a remote aircraft on the other side of a mountain, the client aircraft will be over on the other side, closer to the target.

What you see at distances will depend on the signal strength and distance to the aircraft or ground station and you antenna setup. These small software defined radio modules are fun to play with but built at low cost and don't have the worlds best analog RF front ends. It would be fun to compare them to what is used in commercial portable devices. Part of the reason I'm not too excited about folks using these in their aircraft for more than experimenting/playing around. The antenna used and it's location/sky visibility will affect coverage as well. It could well be that you will see lots of distant aircraft via ADS-R and TIS-B but not ADS-B direct, because you can receive transmissions from the ground tower well but not those more distant aircraft even if you have line of site to them.

I've mentioned in the past it is hard to try to reverse engineer overall what is going on, especially you cannot easily tell what is being broadcast for what client aircraft. However it should be relatively easy to technically tell if you are receiving data for a TIS-B target. That information is included in the air broadcast messages and fully exposed in the de-facto standard GDL-90 serial communications these portable (hobby and commercial) ADS-B receivers are using.

The GDL9-90 communication protocol is documented and publicly available. e.g. here https://www.faa.gov/nextgen/programs...c_ICD_RevA.PDF. (that one is old, I'd imagine there may be more recent updates even of he GDL90 has long ago stopped being interesting).

The first question I would have is how much of the GDL-90 protocol does and receiver software really implement and does it software correctly send out the target type field data. I've not played with it so I don't know, hopefully it does. Reading the source code should also make that clear.

So even if most commercial traffic display software won't show on the display what type an ADS-B target is it is possible for somebody a little technical to look at this stuff and tell. Easy for example to just grab the GDL-90 serial steam and process it with a text utility. The software Dan is using does logging and I suspect this is all in those log files or can be turned on, but I've not looked.

it is also clear over the air what a ADS-R or ADS-B direct messages are. If that is simply exposed in the traffic stream form any of these devices should be easy to work out for technical folks.. again just by reading the source code.

Hope that helps.









On Sunday, January 10, 2016 at 11:09:02 AM UTC-8, Dan Marotta wrote:
Hopefully Darryl will respond to this but anyone with the knowledge
will be appreciated.



I have a home-grown ADS-B system consisting of a Raspberry Pi 2 and
a couple of software defined radios feeding Avare on my smart
phone. I have line of sight to the ADS-B tower on top of Sandia
Peak, on the east side of Albuquerque. I see a number of 1090ES
targets around the ABQ area, one at 10,400PA', one at 8,200PA' over
SAF, several in the high 30s to low 40s pressure altitude. But I
don't see any targets very far away from Albuquerque.



Is it that only targets within some volume are being transmitted
through the tower within view or am I simply receiving the 1090ES
transmissions directly from the aircraft? I think this may be the
case as I don't see and aircraft on my display that I couldn't see
with binoculars from my house.



When I first turned on the system I saw some aircraft that appeared
to be in the traffic pattern at ABQ and, from where I live on the
east side of the mountains, their transmissions would be blocked by
the mountains. I speculate that there was an ADS-B Out aircraft
flying relatively low near my house and I was receiving TIS-B
transmissions meant for him. I also saw ADS-B weather that day and
there were a lot of snow storms up and down the Rockies.


--

Dan, 5J

--
Dan, 5J

If you have a GDL-90 compatible text stream from stratusx out of curiosity can you email it to me. My gmail email as used here.

Email sent with attached file, out.bin. Not text, but that's what I got
when executing the save function on the Avare External I/O app on my phone.

good luck!

On 1/10/2016 2:13 PM, Darryl Ramm wrote:
If you have a GDL-90 compatible text stream from stratusx out of curiosity can you email it to me. My gmail email as used here.

--
Dan, 5J

Yesterday I took my home assembled (by someone else) ADS-B In thingy for
a ride in my Pipistrel Sinus within a 10-mile radius of Moriarty, NM.
Using Avare as my display software and my Android phone as the display
device (temporarily), I was very pleased with the traffic displayed.

I currently have the system set to display all traffic out to 100,000' -
I don't know if that's vertical, horizontal, or both, but I did see a
lot of airliners coming and going from ABQ or simply passing overhead in
the high 30s and low 40s. I also saw quite a bit of traffic down low in
the traffic patterns of airports along the Rio Grande (Mid Valley (E98),
Albuquerque (ABQ), Double Eagle II (AEG), and Santa Fe (SAF)). All of
the airports except for SAF were below my radio horizon so I surmise I
received their position, altitude, and direction via a ground station.
I also saw one aircraft southeast of Moriarty at 11,850' PA. I was
about 10 miles horizontally and 1,350' lower than him.

Arriving at the airport yesterday, I could not find my two rolls of Dual
Lock fasteners so I had to make do with duct taping everything to the
top of the glare shield (it's an experimental aircraft and the
components are light weight). I had heard that the system would create
a lot of electrical noise which could interfere with the comm radio, but
I found it to be completely "quiet".

Now, if it would only display targets on XCSoar so I wouldn't have to
switch screens... Note: This is currently simply an experiment and,
this time of year, there is little to no traffic where I'm flying.

I haven't yet figured out how to capture the data stream from the
receiver to see what I can learn from it.

On 1/10/2016 1:59 PM, Dan Marotta wrote:
Very helpful, thanks!

So far I've only looked at the data stream being sent to the Avare
application. It's a text stream which includes aircraft call sign (if
avaliable, e.g., UAL178), the ICAO address, lat, lon, and altitude.
I'd look at the source code, but my eyes get bleary pretty quickly.

I don't intend for this to me much more than a toy, though I do plan
to try it in flight just to see how it works. When the time comes,
I'll get proper equipment.

Thanks again.

On 1/10/2016 1:43 PM, Darryl Ramm wrote:
Dan

The ADS-B ground station will be broadcasting ADS-R and TIS-B data for client aircraft that are near (i.e. within the ADS-B service "jockey puck" of +/- 3.500' and 15nm radius around the client aircraft). So it may not be, and does not need to be, client aircraft near *you*. Say a suitable equipped ADS-B Out aircraft was 1,000' directly overhead some other transponder only equipped traffic (within SSR coverage) on the other side of a mountain range, where all those aircraft are out of sight to you. The ADS-B ground you had line of site to the ADS-B ground tower covering that airspace you would still see those ground broadcasts intended really for he client aircraft on the other side of the range.

That's again points to the basic irony looking at TIS-B and ADS-R transmissions, they are made for client aircraft near the target, not necessarily near you. As the other target aircraft moves away from the client aircraft, maybe towards you. You stop seeing it on ADS-B. Oops. And in your case it is more likely than not won't be a ADS-B client aircraft near you that is causing what you see for a remote aircraft on the other side of a mountain, the client aircraft will be over on the other side, closer to the target.

What you see at distances will depend on the signal strength and distance to the aircraft or ground station and you antenna setup. These small software defined radio modules are fun to play with but built at low cost and don't have the worlds best analog RF front ends. It would be fun to compare them to what is used in commercial portable devices. Part of the reason I'm not too excited about folks using these in their aircraft for more than experimenting/playing around. The antenna used and it's location/sky visibility will affect coverage as well. It could well be that you will see lots of distant aircraft via ADS-R and TIS-B but not ADS-B direct, because you can receive transmissions from the ground tower well but not those more distant aircraft even if you have line of site to them.

I've mentioned in the past it is hard to try to reverse engineer overall what is going on, especially you cannot easily tell what is being broadcast for what client aircraft. However it should be relatively easy to technically tell if you are receiving data for a TIS-B target. That information is included in the air broadcast messages and fully exposed in the de-facto standard GDL-90 serial communications these portable (hobby and commercial) ADS-B receivers are using.

The GDL9-90 communication protocol is documented and publicly available. e.g. herehttps://www.faa.gov/nextgen/programs/adsb/wsa/media/GDL90_Public_ICD_RevA.PDF. (that one is old, I'd imagine there may be more recent updates even of he GDL90 has long ago stopped being interesting).

The first question I would have is how much of the GDL-90 protocol does and receiver software really implement and does it software correctly send out the target type field data. I've not played with it so I don't know, hopefully it does. Reading the source code should also make that clear.

So even if most commercial traffic display software won't show on the display what type an ADS-B target is it is possible for somebody a little technical to look at this stuff and tell. Easy for example to just grab the GDL-90 serial steam and process it with a text utility. The software Dan is using does logging and I suspect this is all in those log files or can be turned on, but I've not looked.

it is also clear over the air what a ADS-R or ADS-B direct messages are. If that is simply exposed in the traffic stream form any of these devices should be easy to work out for technical folks.. again just by reading the source code.

Hope that helps.









On Sunday, January 10, 2016 at 11:09:02 AM UTC-8, Dan Marotta wrote:
Hopefully Darryl will respond to this but anyone with the knowledge
will be appreciated.



I have a home-grown ADS-B system consisting of a Raspberry Pi 2 and
a couple of software defined radios feeding Avare on my smart
phone. I have line of sight to the ADS-B tower on top of Sandia
Peak, on the east side of Albuquerque. I see a number of 1090ES
targets around the ABQ area, one at 10,400PA', one at 8,200PA' over
SAF, several in the high 30s to low 40s pressure altitude. But I
don't see any targets very far away from Albuquerque.



Is it that only targets within some volume are being transmitted
through the tower within view or am I simply receiving the 1090ES
transmissions directly from the aircraft? I think this may be the
case as I don't see and aircraft on my display that I couldn't see
with binoculars from my house.



When I first turned on the system I saw some aircraft that appeared
to be in the traffic pattern at ABQ and, from where I live on the
east side of the mountains, their transmissions would be blocked by
the mountains. I speculate that there was an ADS-B Out aircraft
flying relatively low near my house and I was receiving TIS-B
transmissions meant for him. I also saw ADS-B weather that day and
there were a lot of snow storms up and down the Rockies.


--

Dan, 5J

--
Dan, 5J

--
Dan, 5J

On Thursday, January 14, 2016 at 8:50:31 AM UTC-8, Dan Marotta wrote:

Now, if it would only display targets on XCSoar so I wouldn't have
to switch screens...*

My first day with xcsoar. I am on page 16 of the manual and at the bottom is a reference to ADB input and I thought of your post. Post if you figure it out and I will too.

On Thursday, January 14, 2016 at 3:16:36 PM UTC-8, xcnick wrote:
On Thursday, January 14, 2016 at 8:50:31 AM UTC-8, Dan Marotta wrote:

Now, if it would only display targets on XCSoar so I wouldn't have
to switch screens...*

My first day with xcsoar. I am on page 16 of the manual and at the bottom is a reference to ADB input and I thought of your post. Post if you figure it out and I will too.

What is there to figure out? There is a very widely used defacto standard protocol for soaring software to receive traffic data. That is the FLARM dataport protocol. That is what XCSoar and all the other products use. If you are in the USA with XCSoar you get "ADS-B" traffic into XCSoar from a PowerFLARM. Connect it up and go... like hundreds of other glider pilots in the USA do with their soaring software or flight computers.

"ADS-B" is a fluffy term, what exactly you think it might mean I cannot guess. But in the case of PowerFLARM and the FLARM dataport protocol it means receiving and displaying traffic data from FLARM, 1090ES Out and PCAS. That is it. No UAT anything, No FIS-B, No TIS-B, No ADS-R, Nothing else of the USA specific soup that is not used elsewhere in the world. And like all other soaring software XCSoar supports the FLARM dataport protocol only, not GDL-90 or Garmin TIS or other formats so it does not work with GA ADS-B receivers. Its a soaring product, designed to work with soaring traffic systems.... i.e. in the USA that would be PowerFLARM.

On Sunday, January 10, 2016 at 12:44:03 PM UTC-8, Darryl Ramm wrote:
Dan

The ADS-B ground station will be broadcasting ADS-R and TIS-B data for client aircraft that are near (i.e. within the ADS-B service "jockey puck" of +/- 3.500' and 15nm radius around the client aircraft). So it may not be, and does not need to be, client aircraft near *you*. Say a suitable equipped ADS-B Out aircraft was 1,000' directly overhead some other transponder only equipped traffic (within SSR coverage) on the other side of a mountain range, where all those aircraft are out of sight to you. The ADS-B ground you had line of site to the ADS-B ground tower covering that airspace you would still see those ground broadcasts intended really for he client aircraft on the other side of the range.

That's again points to the basic irony looking at TIS-B and ADS-R transmissions, they are made for client aircraft near the target, not necessarily near you. As the other target aircraft moves away from the client aircraft, maybe towards you. You stop seeing it on ADS-B. Oops. And in your case it is more likely than not won't be a ADS-B client aircraft near you that is causing what you see for a remote aircraft on the other side of a mountain, the client aircraft will be over on the other side, closer to the target.

What you see at distances will depend on the signal strength and distance to the aircraft or ground station and you antenna setup. These small software defined radio modules are fun to play with but built at low cost and don't have the worlds best analog RF front ends. It would be fun to compare them to what is used in commercial portable devices. Part of the reason I'm not too excited about folks using these in their aircraft for more than experimenting/playing around. The antenna used and it's location/sky visibility will affect coverage as well. It could well be that you will see lots of distant aircraft via ADS-R and TIS-B but not ADS-B direct, because you can receive transmissions from the ground tower well but not those more distant aircraft even if you have line of site to them.

I've mentioned in the past it is hard to try to reverse engineer overall what is going on, especially you cannot easily tell what is being broadcast for what client aircraft. However it should be relatively easy to technically tell if you are receiving data for a TIS-B target. That information is included in the air broadcast messages and fully exposed in the de-facto standard GDL-90 serial communications these portable (hobby and commercial) ADS-B receivers are using.

The GDL9-90 communication protocol is documented and publicly available. e.g. here https://www.faa.gov/nextgen/programs...c_ICD_RevA.PDF. (that one is old, I'd imagine there may be more recent updates even of he GDL90 has long ago stopped being interesting).

The first question I would have is how much of the GDL-90 protocol does and receiver software really implement and does it software correctly send out the target type field data. I've not played with it so I don't know, hopefully it does. Reading the source code should also make that clear.

So even if most commercial traffic display software won't show on the display what type an ADS-B target is it is possible for somebody a little technical to look at this stuff and tell. Easy for example to just grab the GDL-90 serial steam and process it with a text utility. The software Dan is using does logging and I suspect this is all in those log files or can be turned on, but I've not looked.

it is also clear over the air what a ADS-R or ADS-B direct messages are. If that is simply exposed in the traffic stream form any of these devices should be easy to work out for technical folks.. again just by reading the source code.

Hope that helps.









On Sunday, January 10, 2016 at 11:09:02 AM UTC-8, Dan Marotta wrote:
Hopefully Darryl will respond to this but anyone with the knowledge
will be appreciated.



I have a home-grown ADS-B system consisting of a Raspberry Pi 2 and
a couple of software defined radios feeding Avare on my smart
phone.* I have line of sight to the ADS-B tower on top of Sandia
Peak, on the east side of Albuquerque.* I see a number of 1090ES
targets around the ABQ area, one at 10,400PA', one at 8,200PA' over
SAF, several in the high 30s to low 40s pressure altitude.* But I
don't see any targets very far away from Albuquerque.



Is it that only targets within some volume are being transmitted
through the tower within view or am I simply receiving the 1090ES
transmissions directly from the aircraft?* I think this may be the
case as I don't see and aircraft on my display that I couldn't see
with binoculars from my house.



When I first turned on the system I saw some aircraft that appeared
to be in the traffic pattern at ABQ and, from where I live on the
east side of the mountains, their transmissions would be blocked by
the mountains.* I speculate that there was an ADS-B Out aircraft
flying relatively low near my house and I was receiving TIS-B
transmissions meant for him.* I also saw ADS-B weather that day and
there were a lot of snow storms up and down the Rockies.


--

Dan, 5J

Darryl,

As always I appreciate your knowledge on this and I have a serious concern, based on what several of my programmer geek friends have noted after reading the TSO.

Here is the concern: The ADS-B protocols have no encryption/security protection! I.E. we have a "network" that easily hacked or spoofed, new pseudo-planes could be added to the network with scripted GPS/Altitude data, and no one would know. The whole system is based on the assumption that everyone is playing "nice" with the data.

It that what you understand? How secure is the network?

MB

ADS-B is inherently not secure, a very bad mistake IMNSHO. Nothing is encrypted or cryptographically authenticated. Many technical folks, including experts on encryption etc. that I know also express extreme surprise with that. It is trivial to use to track aircraft which is good at times, but may be a security or physical attack risk, is easily spoofable with possibly bad consequences, including flooding/denial of service style attacks. And all that ground infrastructure, is potentially physically attackable.

That is one reason why it is good there is no way that ADS-B actually issues TCAS-II TYPE RAS (even if you have TCAS II version 7.1 with ADS-B enhancements). You could imagine what could happen with a malicious actor forcing aircraft TCAS systems to issue false RAs.

if its a low-level attack or some idiot just "messing around" then I expect the FAA to use technical means to mitigate some of the harm and to help track down the attackers. Obviously at on extreme they revert back to SSR, A serious technically sophisticated malicious attack, oh that sure worries me..

I do worry that FAA goals of eventually decommissioning a number of approach SSR systems as ADS-B is adopted is a dangerous fantasy. Proffered up by the FAA to congress to show how ADS-B would help save money. That SSR capability is needed as a complement and fallback to ADS-B in case bad things happen. The primary radar facilities are also needed so that somebody just can't turn off ADS-B Out and their transponder and cruise around with no radar coverage. The joint ARTCC/USAF ASRS-4 defense radar facilities are really impressive primary radars but you still want some backup with those local approach primary radars, even if they don't have capacities like the primary radar altitude capability that the big ARSR-4 systems have. How vulnerable that whole radar/SSR infrastructure is is another whole question.


On Sunday, January 10, 2016 at 3:28:06 PM UTC-8, SoaringXCellence wrote:
/snip/
As always I appreciate your knowledge on this and I have a serious concern, based on what several of my programmer geek friends have noted after reading the TSO.

Here is the concern: The ADS-B protocols have no encryption/security protection! I.E. we have a "network" that easily hacked or spoofed, new pseudo-planes could be added to the network with scripted GPS/Altitude data, and no one would know. The whole system is based on the assumption that everyone is playing "nice" with the data.

It that what you understand? How secure is the network?

MB