Hi

There is very little signal hitting the ground from a normal GPS bird. Even a few mili watts close at hand is going to be an enormous overload. The typical GPS does not use a lot of bits in the front end A/D.

I suspect that if you tuned your little gizmo down to the FM broadcast band, it would take out your favorite FM station quite nicely. Same would be true of your cell phone if you tuned it there. Jamming from close by isn't all that hard to figure out, or to implement. There are switching power supplies that make wonderful jammers for low frequency signals. If it's RF, it can be jammed. The real question is can you jam it from a reasonable distance?

Bob

On Nov 22, 2010, at 12:43 PM, John Green wrote:

On 11/23/2010 12:19 AM, Bob Camp wrote:

There are a few reports and articles going into the susceptibility of
civilian receivers to jammers. Some public texts have also been written,
so the field is not completely covered only on green paper.

A CW jammer will basically grab the AGC and as it gains down the CW the
GPS reception is gained down with it. In particular 1-bit receivers is
susceptable to this effect. 1,5-bit receivers with separate AGC
detection was developed and was able to combat the CW jammer situation.
The relative time when the code can control the bits quickly becomes
just a fraction since a sine spends long times in the extremes far away
from detection limits.

Next thing to attack is lack of supression in the C/A code, and list of
offset-frequencies which is more susceptible can be found.

Noise jammers is also possible.

Things like these alongside the weak signal makes civilian receivers
quite sensitive, so quite a bit of line-of-sight distance can be jammed
with a fairly low output.

Cheers,
Magnus

The Phrack article's jammer attacks the offset frequencies.

Phrack.org/issues.html?issue=60&id=13

This article shows just how vulnerable L1 GPS is

Scott
Sent from my Verizon Wireless BlackBerry

-----Original Message-----
From: Magnus Danielson magnus@rubidium.dyndns.org
Sender: time-nuts-bounces@febo.com
Date: Tue, 23 Nov 2010 01:29:56
To: time-nuts@febo.com
Reply-To: Discussion of precise time and frequency measurement
time-nuts@febo.com
Subject: Re: [time-nuts] GPS jamming susceptibility

On 11/23/2010 12:19 AM, Bob Camp wrote:

There are a few reports and articles going into the susceptibility of
civilian receivers to jammers. Some public texts have also been written,
so the field is not completely covered only on green paper.

A CW jammer will basically grab the AGC and as it gains down the CW the
GPS reception is gained down with it. In particular 1-bit receivers is
susceptable to this effect. 1,5-bit receivers with separate AGC
detection was developed and was able to combat the CW jammer situation.
The relative time when the code can control the bits quickly becomes
just a fraction since a sine spends long times in the extremes far away
from detection limits.

Next thing to attack is lack of supression in the C/A code, and list of
offset-frequencies which is more susceptible can be found.

Noise jammers is also possible.

Things like these alongside the weak signal makes civilian receivers
quite sensitive, so quite a bit of line-of-sight distance can be jammed
with a fairly low output.

Cheers,
Magnus

time-nuts mailing list -- time-nuts@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.

Hi

If you run through the article the author claims that he's getting a few hundred feet of range with a few hundred mw of power into a good antenna.

Your cell phone and FM broadcast radio are equally susceptible under typical conditions.

Bob

On Nov 22, 2010, at 8:24 PM, scmcgrath@gmail.com wrote:

John Green wrote:

The GPS antenna is perhaps 35 feet away

OK... typical received signal at a GPS receiver (L1) is on the order of
-130dBm.  Thermal noise floor (assuming noiseless receiver and no
losses) is -114 dBm in 1 MHz BW.

Remember, the typical GPS is a single bit quantizer, which works just
fine considering the signal is 20dB below the noise floor.

So, let's do a little link calculation: 32+20log10(1500)+20log10(.010)
between isotropic antennas (which is not a bad starting point for your
jammer and the GPS)..
32+64-40 -> a link loss of 56 dB.. you're radiating +17dBm, so let's
call it -40dBm into the GPS..  Yep, jamming is almost assured..

But at that kind of power, you'd jam almost ANY receiver that's trying
to receive a signal at -130dBm.  90dB instantaneous dynamic range is
pretty good when you can't use a filter to remove the interfering signal
(e.g. a HF receiver has a narrow band filter in the IF to solve this
problem).

realistically, you need about, say, 10 dB J/S so you'd need -120 dBm
into the receiver from the jammer.  A microwatt 10 meters away would do
it nicely.  Inverse square helps a bit.. if you were 1 km away, your
interfering 50mW signal would be down another 40 dB.. -80dBm.

10km away, your jammer is down into the area where it probably won't jam
all the time.

Obviously, real radios that need reliable GPS reception do things to
make life easier.  Aside from using 1.5-2 bit detection, or signal
excisers, etc.  There are also techniques that rely on looking at the
post correlation signal (where the interferer is suppressed to a certain
extent): with modern signal processing, you can correlate against all
possible phases of the code in one shot, for instance.

scmcgrath@gmail.com wrote:

I'm not very impressed by design...
That old Freescale/Motorola MC145151 PLL, and using a separate
prescaler?  That's a 1970s-1980s design out of some old ap note. Can you
even buy a 145151 anymore? I suppose you can, there's probably millions
of them out there in all manner of radios.

Why not get an eval board for one of the plethora of MMIC PLLs out there
that has VCO, dividers, etc. all on one die.  Heck, NS has a whole
webbench application that will basically design the thing for you.

On a related note... What about a GPS signal simulator.. Yes, there are
commercial vendors out there who will be happy to sell you one for many
tens of $k.. how about something simpler?  Seems it should be easy to
have a FPGA programmed up to generate all the PN codes and nav messages,
and just run it out to a mixer with a 1575 MHz LO (generated by one of
the aforementioned $100 NatSemi eval boards)..

Or is it too much of a pain to do the doppler?  That would take
something like an DDS to create a reference for each S/V simulator, with
the DDS programmed for the required doppler.  So it would take N
channels to do N S/Vs in view.  Yeah... the multi $10k starts to seem
reasonable now..

I was sort of hoping, in the back of my mind, that some grad student out
there had created some FPGA code to run on a Xilinx eval board (or a USRP2)

On 23/11/10 16:12, jimlux wrote:

Should not be impossible.

It would not be too expensive actually. Just as you do N channels of
PN-code generation you do N channels of doppler carrier and chip-rate
DDS within the FPGA. One needs some form of doppler calculator that
updates the doppler offsets in real-time and then you would need some
application cooking up N channels of NAV-data, but it should not be
prohibitively expensive. Adding things like multi-path simulation on a
per channel basis is more expensive, as it would be a bunch of FIR taps
spread out and in need of updates. Also would a filter for ionospheric
and tropospheric simulation be needed, which parmeters also needs
changes as time goes by... and some added thermal noise unless the
noise-level of the system does not match up with reality. :)

It's not that different from a FPGA based receiver.

Cheers,
Magnus

Hi

The same basic equations apply (as you point out) to any receiver. Lay down
enough on channel noise power and the receiver doesn't have much of a
chance. Nothing magic or terribly hard to figure out. Easy to do wideband at
"I could use a baseball bat" to "I could use a bow and arrow" type ranges.

Because it's easy to do, it happens all the time. Fire up some hair dryers
at close range and they do a fine jamming job. Some of the jamming is
electrical, some of it is the fact you can't hear anything over the noise
they are making.

An axe (or good sling shot) is a fine way to take out a cell site and you
can get them just about anywhere. Jamming GPS isn't even going to make them
drop a call for at least a day or more. It won't make airplanes drop from
the sky either.

Taking out cell sites one at a time isn't a real big deal. It's a rare area
that's covered by only one site. They go in and out of service now and then,
it mostly goes un-noticed. If it is noticed, it's by a small number of
people. I have a nasty suspicion that sites that fail don't get fixed as
fast as they might for just those reasons.

The timing setups are indeed fragile. They could be improved quite a bit.
They aren't so fragile that they melt down immediately when a single fault
occurs. Lots of axes (or a big hurricane) are by far the more likely source
of full system failure.

Bob

-----Original Message-----
From: time-nuts-bounces@febo.com [mailto:time-nuts-bounces@febo.com] On
Behalf Of jimlux
Sent: Tuesday, November 23, 2010 9:37 AM
To: Discussion of precise time and frequency measurement
Subject: Re: [time-nuts] GPS jamming susceptibility

John Green wrote:

The GPS antenna is perhaps 35 feet away

OK... typical received signal at a GPS receiver (L1) is on the order of
-130dBm.  Thermal noise floor (assuming noiseless receiver and no
losses) is -114 dBm in 1 MHz BW.

Remember, the typical GPS is a single bit quantizer, which works just
fine considering the signal is 20dB below the noise floor.

So, let's do a little link calculation: 32+20log10(1500)+20log10(.010)
between isotropic antennas (which is not a bad starting point for your
jammer and the GPS)..
32+64-40 -> a link loss of 56 dB.. you're radiating +17dBm, so let's
call it -40dBm into the GPS..  Yep, jamming is almost assured..

But at that kind of power, you'd jam almost ANY receiver that's trying
to receive a signal at -130dBm.  90dB instantaneous dynamic range is
pretty good when you can't use a filter to remove the interfering signal
(e.g. a HF receiver has a narrow band filter in the IF to solve this
problem).

realistically, you need about, say, 10 dB J/S so you'd need -120 dBm
into the receiver from the jammer.  A microwatt 10 meters away would do
it nicely.  Inverse square helps a bit.. if you were 1 km away, your
interfering 50mW signal would be down another 40 dB.. -80dBm.

10km away, your jammer is down into the area where it probably won't jam
all the time.

Obviously, real radios that need reliable GPS reception do things to
make life easier.  Aside from using 1.5-2 bit detection, or signal
excisers, etc.  There are also techniques that rely on looking at the
post correlation signal (where the interferer is suppressed to a certain
extent): with modern signal processing, you can correlate against all
possible phases of the code in one shot, for instance.

time-nuts mailing list -- time-nuts@febo.com
To unsubscribe, go to
https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.

Hi

One bit serial at 16 MHz isn't all that fancy any more. Sounds like a shift register feeding a couple filters.

The money must be in the receive side.

Bob

On Nov 24, 2010, at 5:14 PM, ernieperes@aol.com wrote:

Agreed. The trick is to properly partition what is done in hardware ane
what is done in software. This could eliminate a lot of logic hardware.

Clearly, the RF stuff and modulator are hardware.
Ditto PR code generation.
Everything else in SW, I think.

FWIW,

-John

===============

Hi

It's not real clear that they do anything more than sample the RX and play it back for the TX.

Bob

Sent from my iPhone

On Nov 25, 2010, at 9:39 AM, "J. Forster" jfor@quik.com wrote:

Hi,

The fact they refer that atmospheric s/n degradation and dropouts etc
being replayed precisely lead me to think this is just a spectrum
rec/play machine (no mod/demod of any kind)
like the ham-oriented "time machine" but for GPS.
http://www.expandedspectrumsystems.com/prod2.html

Luis Cupido.
ct1dmk.

Bob Camp wrote:

Luis Cupido wrote:

But they mention software to generate sequences.  It's actually a fairly
clever idea.  It's easy to stream 16.3xx Mbps from a modern computer, so
you could generate an arbitarily complex signal off line..

For a lot of applications this would be great.  A nice test source that
you could replay on command.

The only question I'd have is whether the 1 bit DAC can adequately
represent the real-life complex signal.  I suppose, intuitively, since
your receiver is digitizing it with a 1 bit ADC...

And, I have a question whether the 1 bit DAC can produce a high enough
fidelity waveform for a higher performance receiver that uses a multibit
digitizer.

Since the clock you are recording and playing back with isn't
necessarily as good as the one on the satellite, you probably couldn't
use this for testing your precision receiver.  It would be like
introducing a random propagation variation or coax length variation in
the system.

It is intriguing though.. a homebrew version could be quite simple.. you
can get the USB interface and a small FPGA pretty easily.  One of those
10.23 MHz crystals from Rick might be handy...

Hummm... right...
so I think we need to look inside one to be sure what it is...

lc
ct1dmk.

jimlux wrote:

Hi

My guess is the 1 bit DAC is nothing more than the FPGA output pin. About all you really need is enough of a buffer to stay ahead of the USB bus. That may not be much with a modern USB chip set and a hand made driver on the PC.

Bob

Sent from my iPhone

On Nov 26, 2010, at 10:34 AM, jimlux jimlux@earthlink.net wrote: