Saturday Night’s All Right For Scanning

I reported two weeks ago about the loss of my primary VHF/UHF communications monitoring antenna after almost 20 years of yeoman service. Despite being a unity-gain, albeit wide-spectrum, antenna, the Diamond discone performed well, and monitoring distances out to 60 miles in certain directions were possible, allowing us to hear as far as Long Island and the Catskills.

Last night I decided to make two determinations. The first was to see how far one might possibly listen with an inside antenna, and the second was to see what one could listen to in this locale that was not P25 Phase II or encrypted. I listened for one hour (2100-2200 EST) yesterday evening monitoring the VHF & UHF public safety, and VHF aircraft bands. Listening location was Plymouth, CT ( Maidenhead Grid FN31lq). Elevation was ~800′ ASL which is maybe a little higher than average terrain in the area. Equipment was a whistler WS1040 handheld scanner with a 22″ telescoping whip antenna (approx resonant frequency 130 MHz.).

In the course of one hour I logged 28 frequencies. Six of those frequencies were VHF aircraft band. One was VHF-low band. Four were P25. None were encrypted. Overall it was a quiet evening. Longest distance received on public safety bands was 35 miles. Not surprisingly this distance was achieved with the aid of terrain as Stratford, CT is right down the Naugatuck River valley on the Long Island Sound shore, and Clove Mountain, NY is at 1400′ ASL giving it a decided height advantage being 600 feet above us, and 200 feet above the next highest elevation on the RF path. Being that the frequency was on VHF-low band didn’t hurt either. VHF Aeronautical band reception was typical, and >100 Mile reception range of in-flight aircraft is to be expected when the transmitter is up at >30,000′ ASL. Being snuggled up against TRACON N90 ensures that there is always plenty of radio traffic to be heard from 118-137 MHz., and plenty of it can be heard with just a rubber duck antenna indoors.

The following frequencies were logged during this exercise:

  • 46.360 – FM – CSQ – Dutchess County, NY FD
  • 118.475 – AM – Waterbury/Oxford TWR
  • 132.175 – AM – ZNY Elk Mountain
  • 132.825 – AM – Albany (NY) APP/DEP
  • 133.425 – AM – ZBW Woodstock
  • 134.3000 – AM – ZBW Kingston
  • 135.800 – AM – ZBW Islip
  • 151.0325 – NFM – PL 67.0 – Beacon Falls, CT FD
  • 151.3700 – NFM – PL 82.5 – Seymour, CT FD
  • 152.3225 – P25 – NAC 033 – Torrington, CT PD
  • 153.1250 – NFM – PL 179.9 – Tolland County, CT Dispatch “TN”, West/Vernon (FD/EMS)
  • 154.1300 – NFM – PL 74.4 – Meriden, CT FD
  • 154.1900 – NFM – DPL 205 – Farmington, CT FD
  • 154.3100 – NFM – PL 167.9 – Hartford, CT FD
  • 154.3100 – P25 – NAC FD2 – Stratford, CT FD
  • 155.1075 – PL 82.5 – Litchfield County, CT Dispatch “LCD” (FD/EMS)
  • 155.2275 – NFM – PL 179.9 – Vernon, CT FD
  • 155.2350 – NFM – PL 97.4 – American Medical Response (AMR), Bridgeport, CT
  • 155.4900 – NFM – PL 162.2 – East Hampton, CT PD
  • 158.7750 – NFM – DPL 343 – Washington, CT “town channel”
  • 158.7825 – NFM – PL 186.2 – Oxford, CT FD
  • 158.9775 – NFM – PL 162.2 – Oxford, CT EMS
  • 159.0300 – P25 – NAC 110 – Plainville, CT PD
  • 453.1875 – NFM – DPL 743 – Tolland County, CT Dispatch “TN”, West/Vernon (FD/EMS)
  • 460.3250 – NFM – PL 203.5 – Watertown, CT PD
  • 460.6000 – P25 – NAC 293 – Thomaston, CT PD
  • 462.9500 – NFM – PL 192.8 – Northwest CT C-MED
  • 462.9750 – NFM – PL 118.8 – North Central CT C-MED

Connecticut has a bit of a reputation in the scanning community with the recent upgrade of the state’s trunked system to P25 Phase II and the widespread use of encryption on public safety radio systems. It has led many to claim that communications monitoring with low to mid-tier equipment is difficult to impossible in this state. Yet, at present there is still plenty of COMINT potential with a simple P25 Phase I capable unit monitoring conventional (non-trunked) radio systems in the state.

Like many other matters dystonautic, when it comes to local COMINT it is important for you to do your own independent research and not reply on the often incorrect information found online.


Part 95 (and bootleg VHF/UHF) Surveys (aka Point Search) with Whistler WS1040

The WS1040 and scanners with similar architecture are easy and ideal for this as frequency and service searches can be chained together as objects all in a single bank. In this case you would start by programming the following objects into their own bank:

  • MURS/FRS/GMRS Service search
  • CB service search
  • Sweeper search for VHF-High and UHF bands (2, 5, 6)

The biggest performance obstacle with this arrangement is the difference in antenna size (and resonance) between VHF-high and UHF bands used by the more common Part 95 services, and CB which is technically down in the HF band. If you want to have peak performance on one, there will be degraded reception on the other. Still, however, using a common 2m/70cm ham antenna will still let you hear CB units within a mile or so. Using a resonant antenna (or even one that is close to resonant such as a 10 meter ham antenna) will extend that CB monitoring range out quite a bit. Similarly, the more gain your antenna has on VHF and UHF will equal better detection range on those bands. With that said, on Thanksgiving, 2020 I heard “Radio Roadkill 252” from Amarillo, Texas on CB Channel 3, AM mode, with nothing more than a 22” whip antenna at a distance of 1600 miles. Admittedly though, he’s probably running a lot more than 3 watts.

MURS and FRS are the VHF and UHF free parking spaces on the RF Monopoly board and even if the users of those frequencies aren’t quite operating within FCC Regs, the chances of legal hassles are minimal so it gives all the Baofeng buyers a “safe” place to go play. CB has a bit of a reputation that keeps a lot of people away, despite the fact that you almost never hear anything on the 40 channels except for Channels 6, 19 near highways, and 38 during a band opening. Sad, because a properly installed CB station will always out perform MURS and FRS. You just need to use a proper antenna. However, those Baofeng (and other model) radios can run from 136-174 and 400-520 MHz. Some semi-clever types might consider just playing dial roulette with their transceivers. A normal sector search for those two frequencies would take a while, but using Spectrum Sweeper will decrease that time significantly, along with a decrease in receive sensitivity. Still, the Spectrum Sweeper function will in a matter of seconds detect an HT signal within a quarter-mile.

So what this setup gets you is a means to detect nearby portable and mobile radio activity on the most common frequencies used by non-government actors. Whether are they are good actors or bad actors is either irrelevant, or depends on who and what you are. Either way, a bunch of rando people playing with radios in your neighborhood is something you want to know about.

If you found this article useful, please consider making a donation to help offset our costs for research and development.



Cyber-Tek Zine Donations





Covert Antenna Placement In Residential Radio Communications Stations or Listening Posts #sigint #comint #diy

If you already haven’t been there, check out our social media presences on Twitter and Facebook.


You can also get a look at the history of Cybertek and read some of the earlier issues at I don’t run that site, and the guy that did is an idiot despite his high technical skill level, but it’s still nice to see someone decided to put it all online. All of that material is now public domain. Copy, fold, spindle, mutilate, make derivatives, write fanfic, set up a mirror, have fun, enjoy!

The site was hosted by Joe Loritz/GBPPR who I have no connection with, and with whom I disagree with sociopolitically. Considering his legal issues, it won’t be up forever and I’m surprised this mirror still exists. Anyway, please do what you will with it, and tell me about any derivatives which I’ll then promote and mention on cybertekzine.com.

In a previous post, I mentioned how good intelligence collection and analysis can help you with ferreting out deceptive information whether it’s from some some troll living in his friend’s basement, or a professional operation setting up a honeypot, perhaps in the hopes of catching a bunch of a particular special interest group with something like an IMSI catcher. To that end, links to a couple of nice intelligence and counterintelligence manuals from archive.org were posted up.

One of the nicer means of collecting information to be turned into intelligence is communications monitoring. The discipline is broadly known as Signals Intelligence (SIGINT), and for our purposes we concentrate on a subset of SIGINT known as COMINT or Communications Intelligence. COMINT can help confirm or deny a lot of data you come across on the internet.

DIY hobbyist COMINT has been a thing since the 1990s, and there is a plethoria of information out there. I first wrote about it in 1991, and have since written many subsequent articles. This article puts a more covert, security-oriented spin on things.

In the United States, it is currently legal to monitor non-broadcast radio communications as long as they are not encrypted. Other countries are less fortunate in this regard. However, even in this country you might decide to enhance your level of discretion.

In this picture, there are two antennas on the roof of this house. The lower one is a VHF vertical dipole element often used for land mobile radio stations. When mounted on a mast like this, it is broadly directional in the direction the antenna is pointing. The antenna on top is a 2 Meter Amateur Radio horizontal loop used in VHF weak signal (SSB/CW as opposed to FM) operations. It is obvious looking at this installation that the resident is a ham radio operator with more than a casual interest in VHF operation. A discone antenna would present a different appearance and send a different message to an observer, as they are often used by individuals engaged in communications monitoring due to their broadband non-directional characteristics. In certain situations this level of advertising may not be optimal for some people. More realistically speaking, mounting a mast on the roof with antennas is a bit of an undertaking some may not be quite up to accomplishing yet (if at all).

Here is the same antenna mounted in an attic. To simulate a mast and put the signal lobe in the desired direction, it was mounted on a piece of scrap 1/2″ copper pipe. Functionality is not seriously compromised compared to a rooftop installation. From a security standpoint, there is no external indication of a communications station in the structure, and also no way an observer can determine the frequency band in use by estimating the length of the antenna.

Lest anyone think that using antennas is anything new, here is an example on HF (Shortwave) from the communications chapter of the old US Army Special Forces Field Manual. It’s just easier to do on VHF and UHF.

From a communications monitoring standpoint, you might have multiple receivers to hook up to a single antenna. In that case, you will need a signal splitter. Consumer grade TV splitters will work fine. You just need adapters to go from the F connector to whatever your receiver uses. You may also come across an LMR grade splitter. This one splits the input into four outputs. It’s spec’d for VHF high-band, but works fine elsewhere in the bands too.

By getting a proper antenna in your attic, you’ll see increased signal gain from the added elevation and noise reduction from getting away from all those consumer electronic devices on the same floor as you. You can also enjoy the fact of having a super secret squirrel listening post that your neighbors and random people passing by are unaware of. Extra style points if you have a Brill Lyle lab tucked away in a closet.

Mucho bonus points if you have one of these in there.