Decoding POCSAG Pager Transmissions with rtl_fm and multimon-ng

18 June 2019

One of the fun things you can do with RTL-SDR (well, SDR really) is that you can decode pager traffic, with the POCSAG protocol in particular. You’ll be surprised to find that many hospitals still transmit unencrypted pager data over POCSAG.

Step 1. Identify a POCSAG signal

Use SDR software of your choice to locate POCSAG traffic. Frequencies to look for depend on your located jurisdiction. Familiarise yourself with the audio samples from the Signal Identification Wiki. POCSAG has a very distinctive start tone.

In the exmaple below, we saw a very strong POCSAG signal on 148.138Mhz.

GQRX locating POCSAG traffic

Step 2. Install rtl_fm and multimon-ng

Step 3. Profit

Use the command:

rtl_fm -M fm -f 148.5565M -s 22050 -g 100 -l 310 \
    | multimon-ng -t raw -a POCSAG512 -a POCSAG1200 -a POCSAG2400 -a scope /dev/stdin

rtl_fm arguments explained:

multimon-ng arguments explained:

Results

Run the above for a while then you might see some decoded POCSAG messages showing up in your terminal output1, like below2

POCSAG1200: Address:  XXXXXX Function: 2  Alpha:   XXXXXXXX: Hi ------, can you give me a call, not urgent, ---- xxxxx/xxx thanks<NUL>
  1. To record decoded output, you can pipe your multimon-ng stdout to a file by appending > output.txt to the command above; then use tail -f output.txt to watch the output live. 

  2. Disclaimer: Posted messages are imitated and not actual deocded messages. 

? amateur radio
# pocsag rtlsdr multimon-ng gqrx rtl_fm