Decoding P25 with RTL-SDR on Debian

There are several basic tools one can use for this. I'd prefer to use the commandline rtl_sdr or rtl_fm from the rtl-sdr Debian package. The issue I ran into was that we're tuning into a relatively narrow-band signal, so the tuning is sensitive, and small tuning errors make you miss the signal you want entirely. RTL-SDR is a cheap device, and its tuning inaccuracy alone is enough to break this. There exists an RTL-SDR calibration tool to compensate for the hardware inaccuracy, but I still wasn't able to successfully tune into the frequencies, as defined in the LAPD channel list linked above. I didn't push on this very hard, so this could very well be my fault.

So instead of the commandline tools, I ended up GQRX. Pretty much all the LAPD frequencies are in the 484MHz range or the 506MHz range. I set the tuner into the right neighborhood, then the FFT waterfall plot in GQRX visually shows you which frequencies are active. You can roughly tune in simply by looking at the plot, and you can fine-tune by listening to the demodulated signal, trying to find the characteristic digital buzz and no static. There are multiple digital-sounding channels and multiple types of encoding are present (sound different). You can play around to find a signal that dsd knows how to decode. Note that since we're now looking for channels empirically, we compensate for tuning inaccuracies, but the LAPD frequency list becomes useless, and we don't even know what specifically we're listening to.

The GQRX window looks like this:

We're clearly listening to an active transmission: we're tuned to the channel indicated by the red line, and the waterfall plot shows intermittent activity there. The signal is intermittent because the transmitter is only active when there's data to send, i.e. when the human talking into the radio is pressing the button.

We now need to get the data out of GQRX and into dsd. dsd wants to get its input from (and send its output to) /dev/audio. Even if my input was coming from a sound device, it wouldn't be /dev/audio on my box. That's a holdover from some ancient system that ALSA doesn't provide by default, and I want to avoid it if possible. Turns out dsd just looks at raw samples, so we can simply send it appropriately-formatted bits (16 bits per sample, little endian, 48KHz sample rate). GQRX has several export capabilities, one of them being raw UDP output. This is perfect for this application, and I turn on that GQRX mode by pressing the appropriate button (bottom of the screenshot; two computers are pictured).

We now have raw 48KHz samples coming out on UDP port 7355. We can make a named pipe, or better yet, we can pass the data to dsd on standard input:

socat UDP-RECV:7355 - | ./dsd -i /dev/stdin

Almost done. We can now tune interactively with GQRX and decode the demodulated FM data on the fly with dsd. dsd says lots of stuff about signals it's receiving. When successfully decoding audio, I see things like this:

Sync:  +P25p1     mod: C4FM inlvl:  7% nac:  466 src:   180359 tg:     1  LDU1  e:========================
Sync:  +P25p1     mod: C4FM inlvl:  7% nac:  467 src:   180359 tg:     1  LDU2  e:=========
Sync:  +P25p1     mod: C4FM inlvl:  7% nac:  466 src:   180359 tg:     1  LDU1  e:=====
Sync:  +P25p1     mod: GFSK inlvl:  7% nac:  466 src:   180359 tg:     1  LDU2  e:======R================R=========
Sync:  +P25p1     mod: C4FM inlvl:  7% nac:  466 src:   180359 tg:     1  LDU1  e:==================
Sync:  +P25p1     mod: C4FM inlvl:  7% nac:  466 src:   180359 tg:     1  LDU2  e:===
Sync:  +P25p1     mod: C4FM inlvl:  7% nac:  466 src:   180359 tg:     1  LDU1  e:=====================
Sync:  +P25p1     mod: C4FM inlvl:  7% nac:  466 src:  1228951 tg:     1  LDU2  e:========
Sync:  +P25p1     mod: C4FM inlvl:  7% nac:  466 src:  1228951 tg:     1  LDU1  e:====
Sync:  +P25p1     mod: GFSK inlvl:  7% nac:  466 src:   180359 tg:     1  LDU2  e:==================

We still can't hear the results because dsd doesn't write them anywhere useful. We can send those to ALSA with a named pipe and aplay:

# In one shell
mkfifo /tmp/pipe
socat UDP-RECV:7355 - | ./dsd -i /dev/stdin -o /tmp/pipe

# In another shell, in parallel
aplay -r 8000 -f S16_LE -t raw -c 1 < /tmp/pipe

So this setup works for me. Now one can go back, and fix stuff; stuff like inaccurate tuning. It'd be nice to automatically tune into valid channels, of better yet to follow the trunking signals, but that's more work than I'm willing to put into this.