Some of our sites are using new radios, which are supposed to be "linked via cell towers" according to everyone. I'm just starting to get familiar with DMR/TRBO, so I'm not really familiar with how some of their more advanced IP site connect systems work. They don't require any sort of site hardware, as they work in route between sites. I'd like to learn more about how it works, and if the traffic is able to be monitored outside of the rented radios.

What would be the possible system/solutions/subscriptions names that this systems uses?

Radios:
motorola xpr 7550 - UHF 403-512
There is a signal meter that responds similarly to cellular meters when indoors (Loses signal)
A site ID pops up when the radio fires up.
There are a few talk groups programmed in, and a populated contact list.
I haven't been able to find anything on the FCC ULS yet.

Thanks in advance.

They work like cell towers with one main control freq and a few secondary.  They are all linked with T1 lines.  The have a simplex type talk around if the Internet goes down.  They can be on x amount of towers as they move and x amount of frequencies.

Here in Illinois we have the Motorola StarCom21 (P25 700/800) system, tied in via Verizon, they aren't using cell towers persay though I would imagine some locations do.

As a radio network it is pretty slick with the simulcast options and end to end capabilities, my little Part 90 35-40 watt UHF repeater is a punk in comparison :(

Couple things:

I'd guess that they meant to say, "linked similar to how cell towers work" than actually using cellular due to latency issues. Private microwave network is more likely, and it wouldn't be practical to monitor that.

What WOULD be practical to monitor is the voice communications if unencrypted. Even basic, essentially worthless encyrption takes this discussion outside of this site's CoC, but let's assume for the moment your system is running normal DMR Tier II.

An inexpensive may to figure this out is to use a $25-ish RTL-SDR dongle, like used in this tutorial.. Note that they also sell a fantastic entry-level dongle, well worth your consideration. You'll need to spend some time finding your system's frequencies, setting up your software, and some minimal antenna work, but then you'll either get decoded audio or confirmation of encryption.

If unencrypted and the computer/USB dongle/antenna combo isn't the right form-factor, you can then look into other more expensive options that do. Some of the big-name scanner companies now support DMR decoding, alternatively, any DMR handheld can be programmed up with the parameters you learned from running DSD+ (above).

I can answer your questions as I've put in multiple MotoTRBO sites.

When Motorola designed their repeaters for MotoTRBO (DMR) they included an IP based infrastructure to carry the data between sites and/or within a single site for a trunking system.

In a MotoTRBO conventional system you will have a master repeater and up to 15 peer sites. All that is required to link back to the master repeater is an IP connection with the correct UDP port range passed through any firewalls. Then any traffic that comes across any of the 16 sites will be passed along to the other sites if the programming on the repeater side allows it (time slot 1 or 2 can be set to not route traffic over the network and just stay local.)

Individual sites can be linked via a cell modem of some kind. I've done think multiple times and so have others. Works well and does not cause any latency issues as timing information is not passed along the connection. You can also use any other basic internet or intranet setup. Only thing that matters is that there is some sort of IP routing.

Knowing if the system can be monitored outside of an issued radio will take some investigation on your part. As stated above an inexpensive SDR receiver can be used to see what's going on with the system. If it's encrypted you are out of luck. Motorola XPR radios support out of the box two types of encryption, "basic" and "enhanced", basic is a "key" 1-256 and can be though of as similar to the old rolling code voice inversion, enhanced privacy is 40 bit RC4 encryption. Gen 2 MotoTRBO radios do support AES-256 encryption but I doubt that's what you will find here as getting Motorola to release the entitlement key for that is harder than getting Hillary to tell the truth.

Once you've investigated the system then you will know how it can be monitored. It sounds like you might be on a trunked system and that will take either a scanner or another MotoTRBO radio. The caveat here is if the system designers incorporated "RAS" (restricted access to system) which requires a key for the radio to join the system. If that key is not present then the radio will not join the system and will not un-mute and pass any audio along. The other issues is what type of trunking are they running. If it's "Capacity Plus" then you can program up any MotoTRBO radio to listen to the system as there is no authentication with the site controller. If they are running "Connect Plus" or "Capacity Max" (which I don't think Max is out in the wild yet) then your only real option is using a scanner.  

The signal meter you see on this display is a rough indication of signal strength from whatever site you are listening to.

Thanks for the info.

I have a couple rtl-sdr/sdr#/dmr decoder dongles and a vertex dmr radio. I haven't had a lot of luck using software to pull timeslots and color codes.

Is the general consensus that this is a prescription based service?
Is there a common name for the service I could research?
Is there a general frequency range that these systems use?

Thanks again, I'll drag out the laptop/sdr stuff tomorrow and see what else I can find.

The SDR decoding of the time slot information and such can be a little finicky some times. And I don't believe there is any software out yet for decoding a DMR control channel like there is for P25.

What part of AZ do you live in? Feel free to PM me that info if you'd rather.

I really like this picture for a good breakdown of their solutions. The IP site connect can be done either cellular, wifi, or hardline.

It depends on the system. IPSC (IP Site Connect), Capacity Plus and Linked Capacity Plus don't require any additional site hardware. IPSC is Motorola's linking protocol for transport over an IP network. You can use cellular (TLF did it for a few years before I replaced his LTE card with a microwave radio and subscribed the repeater to a local ISP's network). TLF gave a full description of how IPSC works. Capacity Plus is Motorola's pseudo trunking protocol (no dedicated control channel similar to how LTR works). Essentially the master is the host of TS 1 and 2. As subscribers request resources it just goes to the next timeslot above the active timeslot. Linked Capacity Plus is just Capacity Plus and IPSC linking multiple locations together.

Now Connect Plus uses a dedicated control channel like a traditional trunking system but is proprietary to Motorola. It also utilizes additional hardware that has to be present at each site. It has been succeeded by Capacity Max which is Motorola's Tier 3 trunking solution. Same story as it requires additional hardware. A controller per site ~$9000 each but Motorola recommends two and a server to manage configs (~$17,000). One of the more expensive Tier 3 solutions on the market currently.