multimon-ng
Overview
Section titled “Overview”multimon-ng is a digital radio transmission decoder for various digital radio protocols including POCSAG (Paging), FLEX (Flexible), EAS (Emergency Alert System), SSTV (Slow Scan Television), and many others. It’s essential for RF security professionals analyzing pager traffic, emergency systems, and digital radio communications. The tool decodes FM-modulated digital signals captured from software-defined radios (SDRs) or audio files.
Installation
Section titled “Installation”Prerequisites
Section titled “Prerequisites”# Install dependencies
sudo apt-get update
sudo apt-get install build-essential git libsndfile1-dev sox
# Optional: For radio capture
sudo apt-get install rtl-sdr librtlsdr-devFrom Source
Section titled “From Source”# Clone repository
git clone https://github.com/EliasOenal/multimon-ng.git
cd multimon-ng
# Compile
mkdir build
cd build
cmake ..
make
# Install
sudo make install
# Verify installation
multimon-ng --versionPre-compiled Binary
Section titled “Pre-compiled Binary”# Download binary
wget https://github.com/EliasOenal/multimon-ng/releases/download/v1.1.8/multimon-ng
# Make executable
chmod +x multimon-ng
sudo mv multimon-ng /usr/local/bin/Docker Installation
Section titled “Docker Installation”# Build Docker image
docker build -t multimon-ng .
# Run in container
docker run -it multimon-ng multimon-ng --helpBasic Usage
Section titled “Basic Usage”Command Structure
Section titled “Command Structure”multimon-ng [OPTIONS] [INPUT_FILE]Supported Formats
Section titled “Supported Formats”| Option | Description |
|---|---|
-t raw | Raw audio (default) |
-t wav | WAV audio file |
-t au | AU audio file |
-t mp3 | MP3 audio file |
-A | AFSK 1200 / Bell 202 |
-a | AFSK 2400 / Bell 202 |
-P | POCSAG (paging) |
-F | FLEX (paging) |
-E | EAS (Emergency Alert) |
-S | SSTV (Slow Scan TV) |
-C | CVSD modem |
Basic Decoding
Section titled “Basic Decoding”# Decode WAV file
multimon-ng -t wav -P input.wav
# Decode multiple formats simultaneously
multimon-ng -t wav -P -F -E input.wav
# Real-time decoding from stdin
sox input.wav -r 22050 -t raw -e signed-integer -b 16 - | multimon-ng -t raw -P
# Decode and save output
multimon-ng -t wav -P -A input.wav > decoded.txt
# Verbose output
multimon-ng -t wav -P -v input.wavPOCSAG Paging Decoder
Section titled “POCSAG Paging Decoder”Overview
Section titled “Overview”POCSAG (Post Office Code Standardization Advisory Group) is a radio paging protocol widely used for pagers and emergency alerts.
POCSAG Decoding
Section titled “POCSAG Decoding”# Basic POCSAG decoding
multimon-ng -t wav -P pager.wav
# Decode with signal quality
multimon-ng -t wav -P -v pager.wav
# Real-time POCSAG from RTL-SDR
rtl_fm -f 152.2425M -s 22050 - | multimon-ng -t raw -P
# Capture and decode
rtl_fm -f 152.2425M -s 22050 paging.raw
multimon-ng -t raw -P paging.rawPOCSAG Output Format
Section titled “POCSAG Output Format”POCSAG Address: 123456 Function: 1 (Numeric)
[Time] RIC: 123456, MSG: 1234567890
# RIC = Receiver Identification Code
# Function codes:
# 0 = Numeric
# 1 = Tone only
# 2 = Numeric
# 3 = AlphanumericFrequency Common in US
Section titled “Frequency Common in US”| Service | Frequency | Bandwidth |
|---|---|---|
| Public Safety | 152.8225 MHz | 12.5 kHz |
| Commercial | 454.000-454.625 MHz | 12.5 kHz |
| EMS Paging | 157.4500 MHz | 12.5 kHz |
| Private Paging | 162.550 MHz | 12.5 kHz |
FLEX Paging Decoder
Section titled “FLEX Paging Decoder”FLEX Protocol
Section titled “FLEX Protocol”FLEX is a high-capacity paging protocol supporting multiple data rates and message types.
FLEX Decoding
Section titled “FLEX Decoding”# Basic FLEX decoding
multimon-ng -t wav -F flex_traffic.wav
# Verbose FLEX output
multimon-ng -t wav -F -v flex_traffic.wav
# Real-time FLEX from SDR
rtl_fm -f 929.0425M -s 22050 - | multimon-ng -t raw -F
# FLEX with all decoders
multimon-ng -t wav -F -P -E audio.wavFLEX Output Format
Section titled “FLEX Output Format”FLEX Frame:
Mode: 1 (1600 bps)
Time: [timestamp]
RIC: 123456
Type: Numeric
Message: 1234567890FLEX Frequencies (US)
Section titled “FLEX Frequencies (US)”| Band | Frequency Range | Notes |
|---|---|---|
| 929 MHz | 929.0125-929.6875 MHz | Most common paging |
| 931 MHz | 931.0125-931.6875 MHz | Regional paging |
| 934-936 MHz | 934.000-936.000 MHz | WACS band (deprecated) |
EAS (Emergency Alert System) Decoder
Section titled “EAS (Emergency Alert System) Decoder”EAS Protocol
Section titled “EAS Protocol”The Emergency Alert System uses specific tones and protocols for emergency broadcasts.
EAS Decoding
Section titled “EAS Decoding”# Decode EAS signals
multimon-ng -t wav -E eas_alert.wav
# EAS with verbose output
multimon-ng -t wav -E -v eas_alert.wav
# Monitor FM radio for EAS
rtl_fm -f 101.5M -s 22050 - | multimon-ng -t raw -E
# Real-time EAS monitoring
sox -d -r 22050 -t raw -e signed-integer -b 16 - | multimon-ng -t raw -EEAS Tone Patterns
Section titled “EAS Tone Patterns”Header Tone: 1000 Hz, 1 second
Data Transmission: 520/1850 Hz, 40-50 ms per bit
End of Message: 1000 Hz, 300 msCommon EAS Codes
Section titled “Common EAS Codes”| Code | Meaning |
|---|---|
| RWT | Required Weekly Test |
| EAN | Emergency Alert Now |
| CEM | Civil Emergency Message |
| PEP | Primary Entry Point |
SSTV (Slow Scan Television)
Section titled “SSTV (Slow Scan Television)”SSTV Basics
Section titled “SSTV Basics”SSTV transmits images slowly over radio frequencies, allowing reception with basic radio equipment.
SSTV Decoding
Section titled “SSTV Decoding”# Decode SSTV transmission
multimon-ng -t wav -S sstv_signal.wav
# SSTV with verbose output
multimon-ng -t wav -S -v sstv_signal.wav
# Real-time SSTV from audio
sox -d -r 22050 -t raw -e signed-integer -b 16 - | multimon-ng -t raw -S
# Save SSTV output
multimon-ng -t wav -S sstv.wav > sstv_image.rawSSTV Modes
Section titled “SSTV Modes”| Mode | Lines | Duration | Protocol |
|---|---|---|---|
| Scottie 1 | 256 | 110 sec | 7-bit |
| Scottie 2 | 256 | 111 sec | 7-bit |
| Martin 1 | 256 | 114 sec | 7-bit |
| Martin 2 | 256 | 58 sec | 7-bit |
Advanced Usage
Section titled “Advanced Usage”Multiple Decoder Simultaneous
Section titled “Multiple Decoder Simultaneous”# Decode all formats
multimon-ng -t wav -P -F -E -S -A audio.wav
# Specific combination
multimon-ng -t wav -P -F -E -v audio.wav
# Output to multiple files
multimon-ng -t wav -P audio.wav > pocsag.txt 2>&1
multimon-ng -t wav -F audio.wav > flex.txt 2>&1Audio Processing
Section titled “Audio Processing”# Convert MP3 to WAV
ffmpeg -i audio.mp3 -acodec pcm_s16le -ar 22050 output.wav
# Resample audio
sox input.wav -r 22050 resampled.wav
# Apply noise reduction
sox input.wav -t raw -r 22050 -b 16 - noisered | multimon-ng -t raw -P
# Split stereo to mono
sox stereo.wav mono.wav remix 1
# Enhance signal
sox input.wav enhanced.wav noisered norm gain -lSoftware-Defined Radio Integration
Section titled “Software-Defined Radio Integration”# RTL-SDR with multimon-ng
rtl_fm -f 152.2425M -s 22050 -p 0 - | multimon-ng -t raw -P
# Tune and record
rtl_fm -f 929.0425M -s 22050 > paging.raw
multimon-ng -t raw -P paging.raw
# Real-time with gain adjustment
rtl_fm -f 152.2425M -s 22050 -g 40 - | multimon-ng -t raw -P -v
# Multiple frequencies (sequential)
for freq in 152.2425M 152.4425M 154.2800M; do
echo "Monitoring $freq"
rtl_fm -f $freq -s 22050 - | multimon-ng -t raw -P
doneHackrf Integration
Section titled “Hackrf Integration”# Capture with HackRF
hackrf_transfer -r paging.bin -f 929000000 -s 5000000 -n 20000000
# Decode HackRF capture (needs conversion)
sox -r 5000000 -b 16 -c 1 -e signed-integer paging.bin \
-r 22050 -t wav output.wav
multimon-ng -t wav -P output.wavOutput and Filtering
Section titled “Output and Filtering”Output Redirection
Section titled “Output Redirection”# Save to file
multimon-ng -t wav -P input.wav > output.txt
# Append to log
multimon-ng -t wav -P input.wav >> paging.log
# JSON output (if supported)
multimon-ng -t wav -P --json input.wav > data.json
# CSV-like format
multimon-ng -t wav -P -v input.wav | grep "POCSAG" > pocsag.csvPost-Processing
Section titled “Post-Processing”# Filter POCSAG by RIC
multimon-ng -t wav -P input.wav | grep "123456"
# Extract messages only
multimon-ng -t wav -P -v input.wav | grep "MSG:" | cut -d: -f2
# Count occurrences
multimon-ng -t wav -P input.wav | wc -l
# Find specific addresses
multimon-ng -t wav -P input.wav | grep "Address: 999999"Bash Scripting
Section titled “Bash Scripting”#!/bin/bash
# Batch decode paging files
INPUT_DIR="/samples/paging"
OUTPUT_DIR="/results/pocsag"
for file in "$INPUT_DIR"/*.wav; do
filename=$(basename "$file" .wav)
echo "Processing $filename..."
multimon-ng -t wav -P "$file" > "$OUTPUT_DIR/${filename}.txt"
# Count messages
count=$(grep "MSG:" "$OUTPUT_DIR/${filename}.txt" | wc -l)
echo "Found $count messages"
doneOptimization and Performance
Section titled “Optimization and Performance”Sample Rate Optimization
Section titled “Sample Rate Optimization”# Standard sample rate (22050 Hz)
multimon-ng -t wav -P input.wav
# Higher sample rate for better quality
sox input.wav -r 48000 -t raw - | multimon-ng -t raw -P
# Lower sample rate for faster processing
sox input.wav -r 11025 -t raw - | multimon-ng -t raw -PBuffer Optimization
Section titled “Buffer Optimization”# Adjust buffer size for performance
# In code or via environment variable
MULTIMON_BUFFER_SIZE=4096 multimon-ng -t wav -P input.wav
# Real-time optimization
nice -n -10 rtl_fm -f 152.2425M -s 22050 - | \
multimon-ng -t raw -PTroubleshooting
Section titled “Troubleshooting”Common Issues
Section titled “Common Issues”# No output detected
# Check sample rate
sox input.wav -n stat
# Verify frequency range
# Ensure proper audio format
# Garbled/incorrect output
# Verify sample rate matches protocol
# Check for clipping in audio
sox input.wav -n stats
# SDR connection issues
rtl_test
hackrf_info
# Audio format errors
file input.wav
sox input.wav input.raw # Convert if neededDebug Mode
Section titled “Debug Mode”# Verbose output
multimon-ng -t wav -P -v input.wav
# Multiple verbose levels (if supported)
multimon-ng -t wav -P -vv input.wav
# Check supported modes
multimon-ng --help | grep -i optionReal-World Applications
Section titled “Real-World Applications”Monitoring Emergency Paging
Section titled “Monitoring Emergency Paging”# Monitor 800 MHz band (requires scanner radio)
# Capture from line-in
sox -d -r 22050 -t raw -e signed-integer -b 16 - | multimon-ng -t raw -P
# Continuous monitoring with logging
while true; do
sox -d -r 22050 -t raw -e signed-integer -b 16 - | \
multimon-ng -t raw -P >> paging.log
doneDecoding Captured Traffic
Section titled “Decoding Captured Traffic”# Multi-format analysis
multimon-ng -t wav -P -F -E radio_capture.wav | tee analysis.log
# Statistical analysis
multimon-ng -t wav -P radio_capture.wav | \
awk '{print $NF}' | sort | uniq -c | sort -rnIntegration with Databases
Section titled “Integration with Databases”#!/bin/bash
# Log POCSAG to database
LOGFILE="/var/log/paging.log"
DATE=$(date +"%Y-%m-%d %H:%M:%S")
multimon-ng -t wav -P signal.wav | while read line; do
echo "[$DATE] $line" >> $LOGFILE
doneOperational Security
Section titled “Operational Security”Privacy Considerations
Section titled “Privacy Considerations”- Check local regulations before monitoring radio frequencies
- Understand legal restrictions on paging traffic interception
- Some pagers may contain sensitive information
- Secure captured files appropriately
- Document all monitoring activities
- Follow responsible disclosure procedures
Data Protection
Section titled “Data Protection”# Encrypt captured files
gpg --encrypt paging.log
# Secure deletion
shred -vfz -n 3 captured_data.raw
# Access control
chmod 600 paging_logs.txtReferences
Section titled “References”- multimon-ng GitHub: https://github.com/EliasOenal/multimon-ng
- POCSAG Specification: https://en.wikipedia.org/wiki/POCSAG
- RTL-SDR Guide: https://www.rtl-sdr.com/
- Radio Protocols: https://www.sigidwiki.com/wiki/Main_Page
Legal Notice
Section titled “Legal Notice”multimon-ng is designed for authorized radio frequency monitoring and analysis. Radio frequency monitoring is subject to local laws and regulations. Ensure you have proper authorization before monitoring any frequencies or capturing radio transmissions.