콘텐츠로 이동
1337skills 1337skills - 치트시트

multimon-ng

Overview

multimon-ng is a digital radio transmission decoder for various digital radio protocols including POCSAG (Paging), FLEX (Flexible), EAS (Emergency Alert System), SSTV (Slow Scan Television), and many others. It’s essential for RF security professionals analyzing pager traffic, emergency systems, and digital radio communications. The tool decodes FM-modulated digital signals captured from software-defined radios (SDRs) or audio files.

Installation

Prerequisites

# Install dependencies
sudo apt-get update
sudo apt-get install build-essential git libsndfile1-dev sox

# Optional: For radio capture
sudo apt-get install rtl-sdr librtlsdr-dev

From Source

# Clone repository
git clone https://github.com/EliasOenal/multimon-ng.git
cd multimon-ng

# Compile
mkdir build
cd build
cmake ..
make

# Install
sudo make install

# Verify installation
multimon-ng --version

Pre-compiled Binary

# Download binary
wget https://github.com/EliasOenal/multimon-ng/releases/download/v1.1.8/multimon-ng

# Make executable
chmod +x multimon-ng
sudo mv multimon-ng /usr/local/bin/

Docker Installation

# Build Docker image
docker build -t multimon-ng .

# Run in container
docker run -it multimon-ng multimon-ng --help

Basic Usage

Command Structure

multimon-ng [OPTIONS] [INPUT_FILE]

Supported Formats

OptionDescription
-t rawRaw audio (default)
-t wavWAV audio file
-t auAU audio file
-t mp3MP3 audio file
-AAFSK 1200 / Bell 202
-aAFSK 2400 / Bell 202
-PPOCSAG (paging)
-FFLEX (paging)
-EEAS (Emergency Alert)
-SSSTV (Slow Scan TV)
-CCVSD modem

Basic Decoding

# Decode WAV file
multimon-ng -t wav -P input.wav

# Decode multiple formats simultaneously
multimon-ng -t wav -P -F -E input.wav

# Real-time decoding from stdin
sox input.wav -r 22050 -t raw -e signed-integer -b 16 - | multimon-ng -t raw -P

# Decode and save output
multimon-ng -t wav -P -A input.wav > decoded.txt

# Verbose output
multimon-ng -t wav -P -v input.wav

POCSAG Paging Decoder

Overview

POCSAG (Post Office Code Standardization Advisory Group) is a radio paging protocol widely used for pagers and emergency alerts.

POCSAG Decoding

# Basic POCSAG decoding
multimon-ng -t wav -P pager.wav

# Decode with signal quality
multimon-ng -t wav -P -v pager.wav

# Real-time POCSAG from RTL-SDR
rtl_fm -f 152.2425M -s 22050 - | multimon-ng -t raw -P

# Capture and decode
rtl_fm -f 152.2425M -s 22050 paging.raw
multimon-ng -t raw -P paging.raw

POCSAG Output Format

POCSAG Address: 123456 Function: 1 (Numeric)
[Time] RIC: 123456, MSG: 1234567890

# RIC = Receiver Identification Code
# Function codes:
# 0 = Numeric
# 1 = Tone only
# 2 = Numeric
# 3 = Alphanumeric

Frequency Common in US

ServiceFrequencyBandwidth
Public Safety152.8225 MHz12.5 kHz
Commercial454.000-454.625 MHz12.5 kHz
EMS Paging157.4500 MHz12.5 kHz
Private Paging162.550 MHz12.5 kHz

FLEX Paging Decoder

FLEX Protocol

FLEX is a high-capacity paging protocol supporting multiple data rates and message types.

FLEX Decoding

# Basic FLEX decoding
multimon-ng -t wav -F flex_traffic.wav

# Verbose FLEX output
multimon-ng -t wav -F -v flex_traffic.wav

# Real-time FLEX from SDR
rtl_fm -f 929.0425M -s 22050 - | multimon-ng -t raw -F

# FLEX with all decoders
multimon-ng -t wav -F -P -E audio.wav

FLEX Output Format

FLEX Frame: 
Mode: 1 (1600 bps)
Time: [timestamp]
RIC: 123456
Type: Numeric
Message: 1234567890

FLEX Frequencies (US)

BandFrequency RangeNotes
929 MHz929.0125-929.6875 MHzMost common paging
931 MHz931.0125-931.6875 MHzRegional paging
934-936 MHz934.000-936.000 MHzWACS band (deprecated)

EAS (Emergency Alert System) Decoder

EAS Protocol

The Emergency Alert System uses specific tones and protocols for emergency broadcasts.

EAS Decoding

# Decode EAS signals
multimon-ng -t wav -E eas_alert.wav

# EAS with verbose output
multimon-ng -t wav -E -v eas_alert.wav

# Monitor FM radio for EAS
rtl_fm -f 101.5M -s 22050 - | multimon-ng -t raw -E

# Real-time EAS monitoring
sox -d -r 22050 -t raw -e signed-integer -b 16 - | multimon-ng -t raw -E

EAS Tone Patterns

Header Tone: 1000 Hz, 1 second
Data Transmission: 520/1850 Hz, 40-50 ms per bit
End of Message: 1000 Hz, 300 ms

Common EAS Codes

CodeMeaning
RWTRequired Weekly Test
EANEmergency Alert Now
CEMCivil Emergency Message
PEPPrimary Entry Point

SSTV (Slow Scan Television)

SSTV Basics

SSTV transmits images slowly over radio frequencies, allowing reception with basic radio equipment.

SSTV Decoding

# Decode SSTV transmission
multimon-ng -t wav -S sstv_signal.wav

# SSTV with verbose output
multimon-ng -t wav -S -v sstv_signal.wav

# Real-time SSTV from audio
sox -d -r 22050 -t raw -e signed-integer -b 16 - | multimon-ng -t raw -S

# Save SSTV output
multimon-ng -t wav -S sstv.wav > sstv_image.raw

SSTV Modes

ModeLinesDurationProtocol
Scottie 1256110 sec7-bit
Scottie 2256111 sec7-bit
Martin 1256114 sec7-bit
Martin 225658 sec7-bit

Advanced Usage

Multiple Decoder Simultaneous

# Decode all formats
multimon-ng -t wav -P -F -E -S -A audio.wav

# Specific combination
multimon-ng -t wav -P -F -E -v audio.wav

# Output to multiple files
multimon-ng -t wav -P audio.wav > pocsag.txt 2>&1
multimon-ng -t wav -F audio.wav > flex.txt 2>&1

Audio Processing

# Convert MP3 to WAV
ffmpeg -i audio.mp3 -acodec pcm_s16le -ar 22050 output.wav

# Resample audio
sox input.wav -r 22050 resampled.wav

# Apply noise reduction
sox input.wav -t raw -r 22050 -b 16 - noisered | multimon-ng -t raw -P

# Split stereo to mono
sox stereo.wav mono.wav remix 1

# Enhance signal
sox input.wav enhanced.wav noisered norm gain -l

Software-Defined Radio Integration

# RTL-SDR with multimon-ng
rtl_fm -f 152.2425M -s 22050 -p 0 - | multimon-ng -t raw -P

# Tune and record
rtl_fm -f 929.0425M -s 22050 > paging.raw
multimon-ng -t raw -P paging.raw

# Real-time with gain adjustment
rtl_fm -f 152.2425M -s 22050 -g 40 - | multimon-ng -t raw -P -v

# Multiple frequencies (sequential)
for freq in 152.2425M 152.4425M 154.2800M; do
  echo "Monitoring $freq"
  rtl_fm -f $freq -s 22050 - | multimon-ng -t raw -P
done

Hackrf Integration

# Capture with HackRF
hackrf_transfer -r paging.bin -f 929000000 -s 5000000 -n 20000000

# Decode HackRF capture (needs conversion)
sox -r 5000000 -b 16 -c 1 -e signed-integer paging.bin \
  -r 22050 -t wav output.wav
multimon-ng -t wav -P output.wav

Output and Filtering

Output Redirection

# Save to file
multimon-ng -t wav -P input.wav > output.txt

# Append to log
multimon-ng -t wav -P input.wav >> paging.log

# JSON output (if supported)
multimon-ng -t wav -P --json input.wav > data.json

# CSV-like format
multimon-ng -t wav -P -v input.wav | grep "POCSAG" > pocsag.csv

Post-Processing

# Filter POCSAG by RIC
multimon-ng -t wav -P input.wav | grep "123456"

# Extract messages only
multimon-ng -t wav -P -v input.wav | grep "MSG:" | cut -d: -f2

# Count occurrences
multimon-ng -t wav -P input.wav | wc -l

# Find specific addresses
multimon-ng -t wav -P input.wav | grep "Address: 999999"

Bash Scripting

#!/bin/bash
# Batch decode paging files

INPUT_DIR="/samples/paging"
OUTPUT_DIR="/results/pocsag"

for file in "$INPUT_DIR"/*.wav; do
  filename=$(basename "$file" .wav)
  echo "Processing $filename..."
  
  multimon-ng -t wav -P "$file" > "$OUTPUT_DIR/${filename}.txt"
  
  # Count messages
  count=$(grep "MSG:" "$OUTPUT_DIR/${filename}.txt" | wc -l)
  echo "Found $count messages"
done

Optimization and Performance

Sample Rate Optimization

# Standard sample rate (22050 Hz)
multimon-ng -t wav -P input.wav

# Higher sample rate for better quality
sox input.wav -r 48000 -t raw - | multimon-ng -t raw -P

# Lower sample rate for faster processing
sox input.wav -r 11025 -t raw - | multimon-ng -t raw -P

Buffer Optimization

# Adjust buffer size for performance
# In code or via environment variable
MULTIMON_BUFFER_SIZE=4096 multimon-ng -t wav -P input.wav

# Real-time optimization
nice -n -10 rtl_fm -f 152.2425M -s 22050 - | \
  multimon-ng -t raw -P

Troubleshooting

Common Issues

# No output detected
# Check sample rate
sox input.wav -n stat
# Verify frequency range
# Ensure proper audio format

# Garbled/incorrect output
# Verify sample rate matches protocol
# Check for clipping in audio
sox input.wav -n stats

# SDR connection issues
rtl_test
hackrf_info

# Audio format errors
file input.wav
sox input.wav input.raw  # Convert if needed

Debug Mode

# Verbose output
multimon-ng -t wav -P -v input.wav

# Multiple verbose levels (if supported)
multimon-ng -t wav -P -vv input.wav

# Check supported modes
multimon-ng --help | grep -i option

Real-World Applications

Monitoring Emergency Paging

# Monitor 800 MHz band (requires scanner radio)
# Capture from line-in
sox -d -r 22050 -t raw -e signed-integer -b 16 - | multimon-ng -t raw -P

# Continuous monitoring with logging
while true; do
  sox -d -r 22050 -t raw -e signed-integer -b 16 - | \
    multimon-ng -t raw -P >> paging.log
done

Decoding Captured Traffic

# Multi-format analysis
multimon-ng -t wav -P -F -E radio_capture.wav | tee analysis.log

# Statistical analysis
multimon-ng -t wav -P radio_capture.wav | \
  awk '{print $NF}' | sort | uniq -c | sort -rn

Integration with Databases

#!/bin/bash
# Log POCSAG to database

LOGFILE="/var/log/paging.log"
DATE=$(date +"%Y-%m-%d %H:%M:%S")

multimon-ng -t wav -P signal.wav | while read line; do
  echo "[$DATE] $line" >> $LOGFILE
done

Operational Security

Privacy Considerations

  • Check local regulations before monitoring radio frequencies
  • Understand legal restrictions on paging traffic interception
  • Some pagers may contain sensitive information
  • Secure captured files appropriately
  • Document all monitoring activities
  • Follow responsible disclosure procedures

Data Protection

# Encrypt captured files
gpg --encrypt paging.log

# Secure deletion
shred -vfz -n 3 captured_data.raw

# Access control
chmod 600 paging_logs.txt

References

multimon-ng is designed for authorized radio frequency monitoring and analysis. Radio frequency monitoring is subject to local laws and regulations. Ensure you have proper authorization before monitoring any frequencies or capturing radio transmissions.