Skip to content

add Certus IC1/IC2/IC8 classification + merge experimental-new-pkt#133

Closed
eimann wants to merge 21 commits into
muccc:masterfrom
eimann:feature/integrate-experimental-new-pkt
Closed

add Certus IC1/IC2/IC8 classification + merge experimental-new-pkt#133
eimann wants to merge 21 commits into
muccc:masterfrom
eimann:feature/integrate-experimental-new-pkt

Conversation

@eimann

@eimann eimann commented Apr 15, 2026

Copy link
Copy Markdown
Contributor

what's here

this is based on experimental-new-pkt branch and adds two things:

  • merge of NP/INP detector and reassembler (unchanged)
  • two small classifier patches for Certus traffic bursts (IC1/IC2/IC8)

nothing that touches existing decode paths for Block1 frames. all new detectors are gated by burst length and the self.next flag, so they don't steal IRA/VOC/etc.

changes

  • bitsparser.py - new IC1:, IC2:, IC8: frame tags recognised by payload symbol count (200 / 432 / 1824) on Certus UW
  • bitsparser.py - guard against misclassifying iridium_access DL frames as IC1/IC2/IC8 (was a false-positive source)
  • picks up NP/INP detector (np_crc8 poly 0x12F, np_crc16 poly 0x1755B, magic_checksum + reassembler) as merged

what INP looks like on-air

based on captures + patent US9733338B1 (Iridium Communications, 2017, "single satellite geolocation systems and methods") this is almost certainly passive-geolocation broadcasts:

  • 100% simplex DL, 1626.40 - 1626.52 MHz
  • 96-bit header (empirically mapped - sync/type word, variant byte, 14-bit source id printed as :%05d, CRC8 on bits 80-87, tail flags)
  • body high-entropy, scrambled from bit 0
  • the known magic_checksum + CRC16 catches them cleanly without needing any FEC

we can't recover the body contents - descrambling looks to live in PHY silicon rather than anywhere we can touch statically.

Certus IC1/IC2/IC8

payload symbol counts consistent with public Certus documentation:

  • IC1 - 200 symbols, QPSK rate 4/5
  • IC2 - 432 symbols, QPSK rate 2/3
  • IC8 - 1824 symbols, 16APSK rate 2/3

content is Turbo-FEC + scrambled, body opaque here. the tags just let you slice out these bursts for further work.

stats

parsed two multi-hour captures from two separate sites with --uw-ec --harder:

  • site A: 790,764 frames, INP = 2,162 (100% simplex DL)
  • site B: 25,507,924 frames, INP = 33,438 (100% simplex DL), plus ~7M Certus NXT traffic

cross-site consistency on INP header bits is good - same sync/variant/source-id structure, additional 96-bit header variants seen at site B (more beams in view).

open questions / wip

  • IC8 being 16APSK: consistent with symbol count + rate, but we don't decode modulation directly yet
  • INP body descrambling: out of scope, treat body bits as opaque
  • a H:2 INP header sub-family (hdr_id == 0110 vs 1000/0111) found in site B captures - handled by the existing NP class, just a different sub-population visible at some locations

testing

  • ran the merged branch against existing master captures - no regressions on known frame types
  • INP detection is additive, only claims frames that the magic_checksum + CRC16 accept
  • IC1/IC2/IC8 classification has the self.next guard so it can't steal iridium_access bursts

Sec42 and others added 21 commits February 22, 2026 18:39
add IC1/IC2/IC8 msgtypes on the simplex-DL band to prevent Certus
bursts from dropping to the unknown-type bucket. payload bits are not
yet decoded - coherent QPSK + Turbo requires a gr-iridium demod path
plus interleaver/rate-matching params that are not publicly documented.
for now classify by symbol count only so we can measure Certus share
of the capture.

IridiumCertusMessage + un_deqpsk() helper added for later payload work.
FORMAT.md: new IC1/IC2/IC8 section documenting the classifier.
Previously our IC1/IC2/IC8 detectors fired on any simplex-DL frame
with matching payload symbol count, including frames using iridium_access
sync. That mislabeled legacy IRA/VOC/IME bursts that happened to have
200/432/1824 payload symbols.

Now only frames with self.next=True (matched next_access_dl or NC1:
prefix) are classified as Certus. Confirmed on a 20k-line sample:
former IC2=328 false positives correctly redistribute back to IRA (+95),
INP (+72), IME (+9), IRI (+3), RAW (+149).
The 14-bit source_id printed as :NNNNN in the frame header partitions
cleanly as [sv_id:8][beam_id:6] across the captures we have looked at
(sv_id = source_id >> 6, beam_id = source_id & 0x3f).

Expose the split on the pretty() line as "sv?:NNN bm?:NN" (the "?"
markers flag the fields as heuristic - some hdr[0] values span many
sv_ids, so the formula is not universally validated).

FORMAT.md: expand the INP section with H:1 / H:2 layouts and document
the source_id split heuristic.
@eimann eimann force-pushed the feature/integrate-experimental-new-pkt branch from f7ef253 to 3b00dfd Compare April 16, 2026 05:38
@eimann eimann closed this Jun 23, 2026
@eimann eimann deleted the feature/integrate-experimental-new-pkt branch June 23, 2026 05:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants