Viewing POCSAG messages with rtl-fm and multimon-ng

If you bought into the hype about the RTL-SDR like I did, you'll probably have at least five of them by now and are looking for something to do with them. Thankfully if you're somewhat computer literate and a bit of a pervert, you may consider using them to listen in to POCSAG pager messages. This guide assumes you're using either macOS or GNU/Linux and have one of these devices. As a disclaimer, this guide is intended for educational purposes only and I do not condone breaking the law.

First of all, make sure you can run rtl_fm from the command line. If you can't, then install the relevant package (rtl-sdr) from your package manager. Afterwards, go to the Multimon-ng Github page and check out the repo and then build it. You'll probably need to install cmake in order to do this. Before you proceed further, make sure you have sox installed as well as it helps for the purpose of listening beforehand.

The next part is to find some POCSAG transmitters. In my case, as I live in New South Wales, I started out by referring to Gough Lui's brilliant blog which has an entry all about his personal journey with pagers. He lists a bunch of different transmitters including the Rural Fire Service, Vodafone, and some hospitals. If you don't live in NSW, I advise you to go onto the ACMA Map and opt to filter transmitters to 148MHz or thereabouts. Not all POCSAG transmitters are at this frequency, but the majority of them are. You can also go into the registry and search directly for outdoor pagers and filter by distance. Don't bother with indoor paging systems unless you're looking to prank your local RSL club by letting everyone know their dinner's ready by using rpitx. If you live in another country then check your local registry for something similar.

As you can see, there are several POCSAG transmitters that I can receive. The first of those seems to be the Sydney West Area Health Service over on the left at 148.1375MHz. I have no idea what they intend with this pager transmitter of theirs as it seems to be emitting constant noisy shit 24/7 with absolutely zero discernible message starts or ends. It has been doing this for years now and I am amazed that nobody has noticed. You can tell when you've stumbled upon a working signal as you'll occasionally hear a tone followed by what sounds like someone waving a piece of cardboard around, or a chainsaw depending on the baud rate. Check SIGIDWIKI to find out more. Anyway, further along you'll notice there are a few other signals which in this case are Vodafone, the NSW Government, another Sydney West Health transmitter, and the Rural Fire Service.

I suggest you orient your antenna and take a moment to properly tune your SDR to the proper frequency in CubicSDR/GQRX/whatever before messing with the command line. In this case, I picked the NSW Government transmitter as it gave me the cleanest signal to work with, and because it had almost constant transmission. Judging by the test pages it outputs, it seems to be operated by Vodafone's paging services. Sydney West also had fairly consistent pages, however the RFS doesn't page very frequently unless there's an active fire going on somewhere and is mostly limited to hourly time transmits along with daily weather conditions. Once you've twiddled your antenna properly and decided upon a frequency, open the command line and type in the following:

rtl_fm -F 0 -E dc -M fm -s 22050 -f 148.962M -g 38 | play -r 22050 -t raw -e s -b 16 -c 1 -V1 -

What this command does is invoke rtl_fm and pipe its output to sox's play program so you can hear it. Make sure you change the frequency to your chosen frequency, and change the gain (-g) so that you can clearly hear the transmitted pages with minimal scratchiness. Refer to the rtl-fm guide for more info on the various parameters.

Once you can hear some nice clear sounding pages, it's time to pipe them into multimon-ng. Keep the first part of your previous invocation before the pipe and then modify it as such:

rtl_fm -F 0 -E dc -M fm -s 22050 -f 148.962M -g 38 | multimon-ng -a POCSAG1200 -a POCSAG512 -a POCSAG2400 -f alpha -t raw /dev/stdin

Make sure to change up the POCSAG values according to what your transmitter is outputting. If it's just sending out POCSAG512 pages like the RFS does, then you can get rid of 1200 and 2400. I've also opted into filtering to alphanumeric messages only with -f alpha. Hopefully very shortly you should be able to see some pages coming in like so.

If you're not receiving pages, make sure to tweak your settings, and most importantly, be patient as some transmitters are only active during certain hours. If you're lucky, you'll quickly discover an entire world of information that is usually hidden to most people. Most of it will either be incredibly banal or otherwise deeply personal in the case of the medical-related ones. If you find that the information you've discovered on a particular transmitter is something helpful, why not consider setting up PAGERMON which interacts with multimon-ng to serve incoming pages on a nice web site with fancy functionality. For something simpler, I suggest piping the output from your above invocation into a text file and then writing a web interface around that. Happy paging!