N4JRI's Radio Pages

Security Scanning Strategy

NOTE: The information on this page reflects my strategies prior to the refarming of the land mobile bands. Even so, many of these radio systems day back to the 1970's and the strategies should work fairly well. I will include my own comments on how the situation has changed, and you can also see some obvious ways of updating this process.

STIPULATION: We're going assume that it's just you and your radio. No FCC records, no copies of Beyond Police Call, no frequency counters, etc. These would obviously be first lines of attack, but sometimes it's just you and the radio.

First Line of Attack:  Do you see the radio? What frequency band?

Hopefully, you will actually see the person that you want to monitor and be able to determine from his/her radio, the frequency band that it probably occupies. It used to be easy. 6" and thick was high band, 6" and thin or 3" and thick was UHF. 6" thin at the top and thick for the bottom 3" was 800. Now, it's more common to find shorter duckies for high band, and 6" thin antennas for 800/900 MHz.

Second Line of Attack: Does the entity being guarded qualify for frequencies other than the Business Service?

If your entity qualifies for Governmental, Manufacturing, Motion Picture, Power/Water, etc. frequencies, then these should be checked. If you have accurate info on these bands, try them out. If not, go ahead to your preprogrammed frequencies.

Third Line of Attack:  Preprogrammed memory banks of commonly used frequencies.

Even if you don't know what band to search, it's always a good idea to try and eliminate the most commonly used frequencies ASAP. I keep four memory banks (20 channels each) programmed in at all times, so that I can go to work quickly. Often, I hit paydirt right off the bat. If they come up silent, I know that it's time for band searching.

• Advantages of Memory Scanner over band searching: (particularly with simpler radios like my PRO-60)
  • Band searching can be very confining. Many of the commonly used frequencies are widely separated. Even the 'colored dot' frequencies can't all be covered in a single, non-linked band search.  Using a memory bank, I can search low power allocations at 154, 457, 462, 467, 853, etc. all together at one time.
  • Simpler scanners, particularly handhelds, can't lock out frequencies in search mode. If you find a busy freq in a memory scan, it's easy to lock out, and also easy to unlock if you want to try it again.
  • While simpler radios won't allow search banks to be linked (and some don't even have multiple search banks) you can scan any combination of memory banks together.

I maintained four memory banks for guard-hunting, based on the supposition that Business service frequencies were going to be the primary target in hotels, malls, office buildings, etc.  These banks were:

• VHF-Hi business channels - There used to be only 16 of these. Now there are several potential search ranges to consider.
• UHF "Local Control" and GMRS frequencies (base side)
• UHF "Local Control" and GMRS frequencies (mobile side)
• Low Power, Itinerant & Colored Dot frequencies

Fourth Line of Attack:  Band Searching

Prior to refarming, the memory scan eliminated my high band frequency targets. Many more frequencies are available now, and a band search is probably needed for the following ranges in 7.5 kHz steps.

• 151.490 -151.985 (former Business Radio Svc)

• 152.270-152.480 (former Taxicab)

• 152.870-153.020 (former Special Industrial)

• 154.490-154.640 (former Business & Special Industrial)

• 157.530-157.740 (former Taxicab)

• 159.495-160.200 (former Land Transportation)

But at the time, I could consider VHF eliminated in most urban areas. So searching concentration was on UHF.

• 460.650-462.1875 - This business band extends from the upper end of the public safety band, and goes just shy of the Manufacturer's allocation staring at 462.200.
• 465.650-467.925 - This addressed the mobile side--and thus the repeater inputs if any--of the previous band. If in a crowded area, I would scan here so that I would only hear radios that were close to me. I'd run this band a little high (467.925) in order to check out splinters in the GMRS and 2w marine range. Just above this band are the MED channels, so it seemed like a good breaking point)
• 463.200-464.9875 - Beginning just above the MED channels, I'd sweep the rest of the UHF business band. Obviously more would have to be done in "T-Band" cities.
• 468.200-466.9875 - Again, the mobile side of the previous band. Helps to localize activity when too many repeaters or other strong stations are encountered.

Today, we would also add refarmed bands:

• 451.775-452.850 - refarmed from taxicab, manufacturing, special industrial and others.
• 456.775-457.850 - mobile side of the above band. Note purely business, but covers most of the new frequencies
• 462.200-462.450 - refarmed from manufacturing
• 467.200-467.450 - mobile to the above

After UHF was thorough searched, I would relucatantly start dealing with the 800 band. I would always hope for a conventional system, but be ready to search for a trunked system.

• 851.0000-855.9875 - Conventional 800 for the most part. Always worth a try, but not that much found.
• 806.0125-810.9875 - Conventional 800 mobile. Again, a localizing action if conventional 800 had trunked freqs or paging to contend with.

Fifth Line of Attack:  Searching for a Trunk

This was easier in the early days of trunking than it is now. Most trunked systems had repeater outputs at 856.0125-860.9875 with mobiles at 811.0125-815.9875, or 861.0125-865.9875 with mobiles at 816.0125-820.9875. In most cases the number of frequencies would be a multiple of 5, and there would be sets of 5 channels, neatly spaced 1 MHz apart.

Step 1 would be to search the repeater outputs and see just how busy the band was. If it was very thin, I'd grab a freq like 861.2375, and program it in along with 862.2375, 863.2375, 864.2375 and 865.2375.  If the band were loaded, I'd put in moble channels like 816.2375, 817.2375, 818.2375, 819.2375 and 820.2375. This is how I found the system for the Virginia State Fair. A friend got a counter hot, we plugged in all the matching mobile freqs, and by scanning them could follow conversations that were local to the fairgrounds.

Today, this is very difficult because they frequencies don't always form cute, predictible patterns. You'd probably have to do quite a bit of mobile searching, followed by control channel monitoring before everything matches up. Not being much of a trunktracker, I'd have to refer you to the Real Virginia Radio page where an expert does reside. (link coming soon)

Back to Security Scanning Page

Back to Scanner Page    Home      Email N4JRI