Hi

Anything that will receive up there should be able to tell you when a jammer comes by. The issue is that not a lot of gear is made for that band (other than GPS receivers). The easy approach would be to use a modern GPS module that puts out noise level / jamming information.

Bob

On Oct 7, 2013, at 12:59 AM, Hal Murray hmurray@megapathdsl.net wrote:

On 10/6/13 9:59 PM, Hal Murray wrote:

There were a series of articles in GPSWorld last year(?) that described
test on some jammers.  For the most part, swept VCOs, as I recall.

Yes..
Or do what real sigint receivers do, use multiple antennas less than a
have wavelength apart and interferometry to do direction determination.

Yes, but more in the long term policy sense. you could measure the data
and publish a paper saying "here's what the jammer incidence is".

It's not like you could say "I detected a jammer, and it appears to be
coming from license plate ABC 123".  I suppose you could send such data
to the FCC, but I don't know that they have a good ingest mechanism.

Poorly operating TV antenna booster amplifiers are notorious, as are
some plasma flat screens.

Many "scanners" now go to that frequency e.g AOR AR-8600. (100kHz to 2GHz )
They are hardly state-of-the-art receivers but should be capable of
detecting jammers driving past. However a new unit is quite pricey $1000
equivalent in the UK as little as $300 for a used version. Also the AMSAT
FCD Pro+ USB SDR at $200 and free software.

Alan
G3NYK

----- Original Message -----
From: "Bob Camp" lists@rtty.us
To: "Discussion of precise time and frequency measurement"
time-nuts@febo.com
Sent: Monday, October 07, 2013 12:36 PM
Subject: Re: [time-nuts] How hard is it to detect a GPS Jammer?

On 10/7/13 7:46 AM, Collins, Graham wrote:

This illustrates is the fundamental problem with leveraging cheap
consumer or government surplus gear.  The hacker community moves much
slower than the commercial one, so you wind up with projects requiring
things that are no longer sold.  It's particularly endemic in the
amateur radio community where we are always repurposing something that
hasn't been made for 30 years.  But it makes it hard for the new
entrant, who doesn't have a box full of old MASTR-II VHF radios or Bell
202 modems or whatever sitting around.

But the existence of that gear in some folks's garages tends to ossify
the development.  How many Bell 202 modems are still in use? But VHF
packet radio is 202 compatible, because every product made for the last
30 years was compatible with the 202.  Not because it's inherently good,
but because you want to be compatible with the other people, and there's
a sort of rolling compatibility.

(Amateur radio is not the only instance of this. The Scientific
Spaceflight community is the same.  We love to use spares from previous
missions to reduce costs, but that brings along the need to be
compatible with the interfaces of those spares.  As a result,
MIL-STD-1553B Notice 2 or Notice 4 is still used on spacecraft, even if
it's not the most appropriate, lowest power, etc.)

For a particularly interesting example, look at the plethora of versions
of the WRT-54G WiFi router popular with hackers; there's about 50
versions listed on the DD-WRt website.  Some of he versions  are
amenable to dropping in a new OS and/or software, others are not, and
still others are "modifiable" (as in cutting traces, soldering, adding
parts and/or connectors) to put in new software.

On 10/7/13 8:01 AM, David J Taylor wrote:

So much for receiving signals from Transit at 400 MHz (<grin>) or from
Mars (The rovers relay through the orbiters in the 400 MHz band)

There are apparently multiple types of jammers. The swept VCO takes a lot of power and is really obvious. Feeding a noise source to a VCO takes the same power but is apparently a bit more stealthy. I'm seeing reference to a "chirped" type of jammer, which I assume takes less power?
At the Institute of Navigation GNSS conference a few weeks ago, there was a whole track on interference and spectrum issues:http://www.ion.org/gnss/program.cfm
I haven't looked to see if they're available anywhere, but a good starting point might be to track down some of these papers:
Signal Acquisition and Tracking of Chirp-Style GPS Jammers: R. Mitch, M. Psiaki, S. Powell, B. O'Hanlon, Cornell University; J. Bhatti, University of Texas at Austin
A Novel Detection and Tracking Algorithm of Chirp Type Civilian GNSS Interference: C.H. Kang, S.Y. Kim, C.G. Park, Seoul National University, Republic of Korea
An Interference Monitoring System for GNSS Reference Stations: J. Wendel, C. Kurzhals, Astrium GmbH, Germany; M. Houdek, Iguassu Software Systems; J. Samson, ESA
-Nate B-
Bob Camp  wrote:

I think that when a GPS chip reports that there are no satellites found then you got a jammer or a tunnel!

At 07-10-2013, you wrote:

OK so let's say you have a receiver and detect a certain about of power at
the right frequency.  How do you determine which of three cases you have
(1) an actual GPS signal from a satellite. (2) a spoofer (who tries hard to
look like #1) or (3) a jammer.

You can't just go by the amount of power received because the
spoofer/jammer can have any amount of power because they can be at any
distance from you and the GPS satellites have variable power because of the
distance from the horizon.  I think you have to look at the signal itself.
You can scan a directional antenna to determine direction but you will get
many false positives when real GPS satellites are near the horizon.  You
would have to track the orbits of all of them.

Spoofers are a real problem.  A sophisticated spoofer tries very hard to
look like the real thing.  I think you would have to compare the position,
velocity and time you get from GPS with your known position, velocity and
time and if there is enough difference assume you are being spoofed.  But
again a good spoofer will create a subtle error.  For example if the
spoofer is protecting a building from GPS guided bombs it only needs to
create a 200 yard position error.  The spoofer may be tracking the location
of the falling bomb and may start by transmitting a GPS signal with no
error and then add more and more error so as to guide the falling bomb off
target.  This is actually how the some radar jammers work, they send out a
signal designed to be "believable" so that the guidance system in the
anti-air missile dose not detect that it is being jammed an simply goes off
target.    I think the only way to detect a sophisticated spoof is to have
multiple receivers with known relative positions.  A change in relative
position would indicate a spoofed GPS signal.

Jammers can be sophisticated as well the better ones will use a directional
antenna aimed at the target and will adjust their power output based on
distance to the target.  A truck driver likely would not use such a device.
A national military might deploy a very sophisticated GPS jammer as part
of an air defense system. It would by design be hard to detect.

So the easiest thing to detect would be a cheap, GSP jammer that is moving.
You could use multiple receivers to triangulate the location and then
determine it is not in orbit and is not a reflection from a metal roof or
something.    The problem is the jammer's very low power.  These things are
inteneded to only cover a tiny area

On Mon, Oct 7, 2013 at 7:46 AM, Collins, Graham CollinG@navcanada.cawrote:

--

Chris Albertson
Redondo Beach, California

On spacecraft hardware, even though something is a bit old, it does make
sense to use it.

Space qualifying a piece of hardware is very, very expensive, because it
requires a lot of shake and bake plus thermal vaccuum and other things.

Furthermore, there are always unknowns.

Do YOU really want to see a Billion dollar mission go wrong, because you
used a new, unproven, design of Cammand Receiver or Sequencer?

In my view, if you are going into the unknown, you want to use the best
available, tested and proven, stuff you can get whereever you can.

Remember, many of the launch vehicles still used were made in the 1950s or
1960s, and sat in a missile silo somewhere, as ICBMs for 30+ years. Until
fairly recently, the Atlas used sub-mini vacuum tubes.

I'm not against inovation, but it's not necessarily about saving a few
bucks when older gear is used.

YMPV,

-John

=======================

Hi Hal:

Yes you can detect jammers driving by.

There was a prior case of unintentional GPS jamming around Moss Landing harbor, Monterey Bay, California caused by a
faulty (oscillating) active TV antenna on a boat that was powered 24/7.

Military GPS receivers, like the DAGR or PLGR-II, include jamming detection.
http://www.prc68.com/I/DAGR.shtml#P2APPS

The patent Handheld GPS jammer locator
https://www.google.com/patents/US7233284
Contains some interesting info plus detailed plans for the hardware including mfg & model numbers, but not the Altera
Model EPM7064STC44-10 FPGA code.  I suspect the FPGA not only does what's required for the patent to work, but also some
other stuff like switching the LO to other frequencies (maybe both hi and lo side) so that it works not just for L1, but
also all the GNSS positioning frequencies.  But you could use a micro controller to do the same thing for a one off unit.

What was not mentioned in the TED talk was how a US UAV was captured pretty much intact by spoofing a military GPS receiver.

Have Fun,

Brooke Clarke
http://www.PRC68.com
http://www.end2partygovernment.com/2012Issues.html

Hal Murray wrote:

Yes, there is equipment out there today that can be used: UBlox offers jamming detection and level. We incorporated that into the later JLT products, and even made a special board for a customer that displays the GPS spectrum in real time showing the jammers in the frequency domain.

Bye,
Said

Sent From iPhone

On Oct 6, 2013, at 21:59, Hal Murray hmurray@megapathdsl.net wrote:

From: Jim Lux

So much for receiving signals from Transit at 400 MHz (<grin>) or from
Mars (The rovers relay through the orbiters in the 400 MHz band)

Jim,

Just get a FUNcube Dongle Pro (original version) instead!  There's a Yahoo
group where we often see those sold and bought.  Or use one of the DVB-T
dongles perhaps with a suitable pre-amp and filter.

Cheers,
David

SatSignal Software - Quality software written to your requirements
Web: http://www.satsignal.eu
Email: david-taylor@blueyonder.co.uk

On Sun, Oct 06, 2013 at 09:59:50PM -0700, Hal Murray wrote:

I would think this would be a natural task for one of the SDR

setups like the USRP and gnuradio... and using the more sophisticated
MIMO versions of the USRP and a suitable DF antenna array of GPS
antennas you could use correlation interferometry to get a pretty good
bearing on a passing jammer (no mechanical rotating antenna needed).
Use a couple of these in a suitable relationship to the road and you
probably could locate the vehicle in question and capture video of it.

Might be some quite interesting statistics near an interstate

with heavy truck traffic.

--
Dave Emery N1PRE/AE, die@dieconsulting.com  DIE Consulting, Weston, Mass 02493
"An empty zombie mind with a forlorn barely readable weatherbeaten
'For Rent' sign still vainly flapping outside on the weed encrusted pole - in
celebration of what could have been, but wasn't and is not to be now either."

On 10/7/13 10:44 AM, David J Taylor wrote:

Well, Transit is dead, as far as I know.. And the last person I know who
recorded the UHF signals from Mars used the 100meter antenna at Green
Bank.

Good to know though..

On 10/7/13 8:31 AM, Chris Albertson wrote:

The jammers put out many milliwatts and have enormous signals that are
obvious on a spectrum analyzer.  GPS signals are invisible on a spectrum
analyzer, normally.  IN fact, most GPS receivers don't work very well if
there are signals above the noise floor: they depend on the noise to
make them work with their mighty 1 bit quantizers.

I doubt anyone is selling spoofers on eBay.
Sure, one can probably find some  code to run on a USRP from some grad
student's project.

They are not designed with coverage area in mind.  They are basically
"whatever power the VCO puts out coupled to the antenna"  From a jamming
standpoint, they're not very sophisticated.

As a result they dump out something like +10dBm.
So running a quick Friis formula link budget, and assuming you want to
have a Prec of around -100dBm (10 MHz BW, kTB)

110 = 32+ 20log10(1575) + 20log10(d)
110-32 - 25 = 20*log10(d)
d = 400 km...

This is why they are such a problem

On 10/7/13 4:51 PM, David I. Emery wrote:

AN excellent project for a student.  You could make a nice senior
project or Master's thesis with this.

On Mon, Oct 07, 2013 at 08:02:13AM -0700, Jim Lux wrote:

This is also rather a sin of the marketing driven "innovation"

economy - product life cycles are so terribly short that by the time
someone spots a device that can be re-purposed in an interesting way it
is usually already EOL and unavailable in traditional new product
channels.

It takes time to do the reverse engineering (schematics, source

code, FPGA VHDL - what is that and why should we give it to you ?)  and
time to figure out how to re-purpose and make the thing work and usually
this is part time and one or two people and not a whole staff.  And then
there is time to write it up and publish articles and plans, and time
for folks to try it and discover it works...

But as many on this list know all too well, even in reasonably

well funded new product development the old story is "hey that is a
really neat chip that does just what I need" only to hear "Sorry too low
demand, or design or production problems, or ROHS or something, not
available in the future - or maybe just vaporware to assess interest and
never really available".  Or you design it in, the company is bought by
someone else, the chip abandoned and now YOUR product is EOL early.

But that is not all bad, if you just need a modem that works.

Choosing something state of the art that DID NOT become a major defacto
standard (and there are dozens of examples in the modem world alone)
means you only can expect to use the original device and maybe one or
two subsequent versions before it becomes unavailable and completely
obscure and rare and totally incompatible.  And then your design has to
be incompatibly upgraded with no backwards interoperability support
where if you had used some moldy oldy but goody you probably could buy
modern DSP based hardware that does that standard (you can for 202s)
among many other useful ones...and support both higher performance
and backwards compatibility modes at low cost and with high performance.

Obviously the problem then becomes convincing enough old pharte

holdouts to upgrade when it truly becomes a nightmare to support the old.
And that is not always easy.

--
Dave Emery N1PRE/AE, die@dieconsulting.com  DIE Consulting, Weston, Mass 02493
"An empty zombie mind with a forlorn barely readable weatherbeaten
'For Rent' sign still vainly flapping outside on the weed encrusted pole - in
celebration of what could have been, but wasn't and is not to be now either."

Yes, these specific jammers do, but someone asked the general question "how
to detect a jammer" and a sophisticated jammer will use no more power than
is requires so as to avoid detection.  Could it be that there are such
devices and they are successful at avoiding detection?    Likely not as at
present no one cares if they are detected.  But if they start getting
hunted out things will change.

About spoofers, yes thay are not available on eBay.  But I was thinking
about military applications.  Can you know when you are being spoofed?

On Mon, Oct 7, 2013 at 6:11 PM, Jim Lux jimlux@earthlink.net wrote:

--

Chris Albertson
Redondo Beach, California

On 10/7/13 9:30 PM, Bill Hawkins wrote:

or the favorite fishing hole..

Way back when, one of the applications of frequency hopping radios was
for fishermen (ocean) so that they couldn't be DFed.  They had already
done the scrambler thing.

No.

It's that same moral thing.. Should you allow cellphone jammers in movie
theaters?

In my mind, these are all hacks to solve a more fundamental social
question about "appropriate use".

cellphone jammers are a sort of passive aggressive way for a business
owner to not have to confront paying customers about their misuse of
cellphones.

At the Athaeneum, the faculty club at CalTech, cellphone use is not
permitted.  Pull out a cellphone, and the staff politely tells you "Sir,
we would prefer you not use that here, would you like to step outside".
At the Austin Drafthouse theater, they're a bit more confrontational.

Anyone can buy a chainsaw or sledge hammer. There is potential for
misuse, but common decency mitigates against those uses.

On Mon, Oct 07, 2013 at 11:30:57PM -0500, Bill Hawkins wrote:

No.

Jamming can potentially impact a much wider area and safety of

life critical uses of GPS, and  very few wilderness guides are expert
enough to understand, control and mitigate this risk.  And even if one
particular one was, how is this to be reliably ensured ? Should  he or
she be licensed and certified and regulated as to how and when he might
jam safely - we don't current issue GPS denial licenses (except maybe to
LightSquared) ?

And even with someone suitably trained and licensed and

certified there is a balance between the slight risk that his jamming
harm something important or critical that society relies upon and his
own personal interest in denying GPS to his customers that I am not sure
we as a society have quite figured out.  Should private businesses be
allowed to deny GPS (or for that matter cellphone access) to folks
nearby or their customers - is this a legitimate interference with a
public resource ?

Obviously if the answer is yes, businesses should be allowed to

jam cellphones or GPS - then what are the limits - eventually all those
private jammers will make such services MUCH less useful - as they will
be unpredictably unreliable at apparently random times and places which
makes it very hard to trust them for anything important.  We will in
other words have allowed the private interests of certain folks to
destroy a commons, something we are getting increasingly good at BTW.

I suppose it is SOMEWHAT justified for a guide to search his

customers for GPSes, or have a strict policy of dropping them off at the
nearest road if they are found to be using one, or even to use a GPS
detector to ID GPSes in use... but an active attack seems wrong given
the risks involved.

And anything more nuanced in a policy on such invites various

low life scumbags to push the limits and use blatantly excessive power,
dangerous antenna locations, and generally horrid engineering that puts
important uses and users of the technology at serious risk for very
selfish personal reasons - perhaps in some cases just buying some cheapo
jammer instead of a proper licensed and limited one managed and
installed by someone who knows what he is doing.

Finally of course, who is to say that I cannot use my cellphone

for important messages - perhaps life critical (my wife is a doctor and
does this from time to time when she is on call)... or my GPS to locate
a store somewhere... perhaps if the jamming ONLY worked in a completely
private space owned or controlled by the jammer and not at all outside
of it would this begin to be marginally acceptable but it certainly
isn't in public spaces.  And I believe there should be mandatory readily
visible notices saying that jamming is use... allowing someone who
truly needs access to know what is happening.

As for the wilderness case specifically there are any number of

strategies to defeat short range jamming of that sort - just announce
you have to "go" as the group leaves the scenic knoll and go back and
take a bearing (maybe automatically from a concealed GPS you already
have in you backpack) while peeing on the special rock...  Inverse
square law applies here of course... hard to radiate enough power to
deny over a long enough distance without being completely unsafe for
other users.

--
Dave Emery N1PRE/AE, die@dieconsulting.com  DIE Consulting, Weston, Mass 02493
"An empty zombie mind with a forlorn barely readable weatherbeaten
'For Rent' sign still vainly flapping outside on the weed encrusted pole - in
celebration of what could have been, but wasn't and is not to be now either."

I for one would insist on complete situational awareness at all times.
The alternative is being LOST.  That can be bad for one's health.

The last time I was willingly lost was when Betty and I were returning
from the Palace Real in Madrid and we decided to just start walking
to the east.  Then there is the Maze at Hampton Court.  Of course we
weren't really lost, but merely in a state of degraded situational
awareness.

On 10/07/2013 09:30 PM, Bill Hawkins wrote:

--
Chuck Forsberg WA7KGX  caf@omen.com  www.omen.com
Developer of Industrial ZMODEM(Tm) for Embedded Applications
Omen Technology Inc      "The High Reliability Software"
10255 NW Old Cornelius Pass Portland OR 97231  503-614-0430

Le 8 oct. 2013 à 10:29, Chuck Forsberg WA7KGX a écrit :

That is not the same as not wanting to be FOUND.

And some of them have considerably higher EIRP,  Like THIS one,  As you
can see they are not sophisticated devices they are intended to swamp the
real GPS signal,

Spoofers would be much harder to detect which is why GNSS systems intended
for military use rely on encrypted signals and fairly sophisticated key
management techniques.

Now for nightmares - the GPS Jammer shown below has an advertised EIRP of
3.4W and the vendor has another with an EIRP of  7.2W

http://hem.passagen.se/communication/gps.html

[image: Inline image 1]

On Mon, Oct 7, 2013 at 9:11 PM, Jim Lux jimlux@earthlink.net wrote:

Hi

But there's obviously something wrong with the 400 KM number.

1. If +10 dbm is good enough to burry a useful signal at that distance, it should be good enough to communicate at that distance. That's pretty impressive QRP without high gain / directional antennas involved.
2. The radios (at least the modern ones) do have CW signal immunity. Weather that's 60 db or something else probably varies with the make / model of the GPS. How well that works with a VCO jammer - again, a that depends sort of thing.
3. There's a (maybe) 40 db variation in GPS signals. To deny service you need to take out the strong ones, not just the weak ones.
4. Even without specific anti-jam in the GPS, the code it's self does have some immunity to a jammer.

Of course you don't have to look very far into the archives to find wonderful examples of slipped decimal points in my posts….

Bob

On Oct 7, 2013, at 9:11 PM, Jim Lux jimlux@earthlink.net wrote:

On 10/8/13 4:17 AM, Bob Camp wrote:

You're right, I forgot the process gain of the despreading.
Assuming you're going from 1 Mchip/sec for the C/A code to 50 bps for
the nav message, that's 43 dB

That alone gets you to 2km jamming range from 400km, but that also
assumes that the jamming signal doesn't inhibit acquiring the code and
despreading.

As Dixon's book on Spread Spectrum says, "acquisition is the hard part";
because you don't have the process gain yet. I suppose with a parallel
acquisition strategy, you're basically trying all codes, and that might
be able to work.

But even so, those sorts of process gain arguments don't necessarily
work if the receiver has a hard limiter or quantizer in it.

I don't know that modern consumer GPSes have CW immunity. If they're
using a 1 or 2 bit quantizer, a strong CW signal pretty much captures
the front end.

Easy to try.  Let me just fire up my kilowatt 1.5 GHz transmitter here<grin>