Software Defined Radio

multimon-ng

multimon-ng is a decoder for classic digital radio modes. Feed it demodulated audio — typically piped straight from rtl_fm — and it decodes the mode you ask for: POCSAG and FLEX pager messages, AIS ship transponders, DTMF and other tone signaling, and several more. Pager traffic in particular is often sent in the clear, which makes multimon-ng a striking demonstration of unencrypted messaging still in active use.

Official-repo package; Security → Software Defined Radio → multimon-ng.

The help it prints

multimon-ng: unrecognized option '--help'
multimon-ng 1.4.1
  (C) 1996/1997 by Tom Sailer HB9JNX/AE4WA
  (C) 2012-2025 by Elias Oenal
Available demodulators: POCSAG512 POCSAG1200 POCSAG2400 FLEX FLEX_NEXT EAS UFSK1200 CLIPFSK FMSFSK AFSK1200 AFSK2400 AFSK2400_2 AFSK2400_3 HAPN4800 FSK9600 DTMF ZVEI1 ZVEI2 ZVEI3 DZVEI PZVEI EEA EIA CCIR MORSE_CW DUMPCSV X10

Usage: multimon-ng [file] [file] [file] ...
  If no [file] is given, input will be read from your default sound
  hardware. A filename of "-" denotes standard input.
  -t <type>    : Input file type (any other type than raw requires sox)
  -a <demod>   : Add demodulator
  -s <demod>   : Subtract demodulator
  -c           : Remove all demodulators (must be added with -a <demod>)
  -q           : Quiet
  -v <level>   : Level of verbosity (e.g. '-v 3')
                 For POCSAG and MORSE_CW '-v1' prints decoding statistics.
  -h           : This help
  -A           : APRS mode (TNC2 text output)
  -m           : Mute SoX warnings
  -r           : Call SoX in repeatable mode (e.g. fixed random seed for dithering)
  -n           : Don't flush stdout, increases performance.
  -j           : FMS: Just output hex data and CRC, no parsing.
  -e           : POCSAG: Hide empty messages.
  -u           : POCSAG: Heuristically prune unlikely decodes.
  -i           : POCSAG: Inverts the input samples. Try this if decoding fails.
  -p           : POCSAG: Show partially received messages.
  -f <mode>    : POCSAG: Overrides standards and forces decoding of data as <mode>
                         (<mode> can be 'numeric', 'alpha', 'skyper' or 'auto')
  -b <level>   : POCSAG: BCH bit error correction level. Set 0 to disable, default is 2.
                         Lower levels increase performance and lower false positives.
  -C <cs>      : POCSAG: Set Charset.
  -o           : CW: Set threshold for dit detection (default: 500)
  -d           : CW: Dit length in ms (default: 50)
  -g           : CW: Gap length in ms (default: 50)
  -x           : CW: Disable auto threshold detection
  -y           : CW: Disable auto timing detection
  --timestamp  : Add a time stamp in front of every printed line
  --iso8601    : Use UTC timestamp in ISO 8601 format that includes microseconds
  --label      : Add a label to the front of every printed line
  --flex-no-ts : FLEX: Do not add a timestamp to the FLEX demodulator output
  --json       : Format output as JSON. Supported by the following demodulators:
                 DTMF, EAS, FLEX, POCSAG. (Other demodulators will silently ignore this flag.)

   Raw input requires one channel, 16 bit, signed integer (platform-native)
   samples at the demodulator's input sampling rate, which is
   usually 22050 Hz. Raw input is assumed and required if piped input is used.

Examples

# Decode POCSAG pagers straight from an RTL dongle
rtl_fm -f 148.5M -s 22050 | multimon-ng -t raw -a POCSAG1200 -

# Decode multiple pager rates at once
rtl_fm -f 148.5M -s 22050 | multimon-ng -a POCSAG512 -a POCSAG1200 -a POCSAG2400 -

# Decode from a recorded WAV file
multimon-ng -t wav -a POCSAG1200 recording.wav

# Decode AIS (two channels)
multimon-ng -a AIS -a AIS2 -t raw input.raw