AIS (Automatic Identification System)
The VHF broadcast every large ship is required to transmit: identity, position, course and speed, in HDLC frames over a self-organising TDMA, with no authentication of any kind.
AIS (Automatic Identification System) is the VHF broadcast that lets ships see each other and lets coastal authorities see them both. Under IMO SOLAS Chapter V, every ship of 300 gross tonnage or more on an international voyage, every cargo ship of 500 GT or more, and every passenger ship regardless of size must carry a transponder that announces who it is and where it is, continuously, in the clear.
What it is
Two 25 kHz channels in the marine VHF band carry the whole system:
| Channel | Frequency | ITU channel |
|---|---|---|
| AIS 1 | 161.975 MHz | 87B |
| AIS 2 | 162.025 MHz | 88B |
Transponders alternate between them. The modulation is GMSK with BT 0.4 over FM at 9600 bit/s, and the bit stream is NRZI: a zero is a transition, a one is no transition. Access is time-division, 2250 slots per minute per channel, each slot 26.67 ms long, which at 9600 bit/s is exactly 256 bits.
Class A transponders (the mandated ones) use SOTDMA, self-organising TDMA: each station announces, inside the message it is transmitting, which slot it will use next, so neighbours build a shared map of the cell and avoid each other with no base station involved. Class B units, the cheaper leisure ones, generally use CSTDMA, listening for a free slot before transmitting, and defer to Class A. Reporting rate is 2 to 10 seconds under way for Class A depending on speed and rate of turn, 3 minutes at anchor, and 30 seconds for Class B under way.
The framing
Inside a slot the frame is classic HDLC, the same shape as X.25 or AX.25:
[ramp 8][training 24][flag 0x7E][ data 168 ][FCS 16][flag 0x7E][buffer 24]
The 24-bit training sequence is alternating 0101... so the receiver can recover the clock. The start and end flags are the byte 0x7E (01111110), and bit stuffing protects their uniqueness: the transmitter inserts a zero after any run of five ones in the payload, and the receiver removes it. The FCS is the 16-bit HDLC frame check sequence, polynomial 0x1021, reflected, init and final XOR 0xFFFF. It detects channel errors. It authenticates nothing.
The 168-bit default payload opens with a 6-bit message type and a 30-bit MMSI (Maritime Mobile Service Identity, 9 decimal digits, the first three being the country MID). The types you meet most:
| Type | Meaning |
|---|---|
| 1, 2, 3 | Class A position report |
| 4 | Base station report |
| 5 | Static and voyage related data (name, callsign, dimensions, destination) |
| 18, 19 | Class B position report |
| 21 | Aid to navigation report |
| 24 | Class B static data report |
| 27 | Long-range position report, for satellite reception |
A receiver hands the payload up as an NMEA 0183 !AIVDM sentence with the bits armoured six at a time into printable ASCII. Unpacking that armour is four lines:
def sixbit(payload):
bits = ""
for ch in payload:
v = ord(ch) - 48
if v > 40:
v -= 8
bits += format(v & 0x3F, "06b")
return bits
Why it matters
AIS has no authentication, no integrity beyond a CRC that anyone can recompute, and no encryption. A message is believed because it was received. That has produced a steady record of fabricated vessel tracks, ships that appear to be somewhere they are not, spoofed aid-to-navigation marks that place a buoy in open water, and forged AIS-SART distress beacons that pull real rescue assets to an empty patch of sea. Because AIS feeds collision-avoidance displays and port traffic management, a convincing lie here has physical consequences.
Satellite AIS is the same protocol seen from above. A LEO receiver sees a footprint thousands of kilometres wide, far larger than the cell the 2250-slot TDMA was sized for, so slots from distant, mutually invisible ships collide and messages are lost. Message 27, a compressed long-range position report sent on channels 75 and 76 (156.775 and 156.825 MHz), exists specifically to give satellites something uncongested to hear.
Receiving it
Receiving is passive and legal. The maintained tool is AIS-catcher, which supports RTL-SDR, Airspy, SDRplay, HackRF and file input:
AIS-catcher -d:0 -v # device 0, periodic statistics
AIS-catcher -d:0 -N 8100 # plus the built-in web viewer on :8100
AIS-catcher -d:0 -u 127.0.0.1 10110 # forward NMEA over UDP
The older rtl_ais receives both channels with a single RTL-SDR and forwards NMEA over UDP to 127.0.0.1:10110 by default, with -n also printing sentences to the console. Decode a sentence in Python with pyais:
from pyais import decode
msg = decode("!AIVDM,1,1,,B,15M67FC000G?ufbE`FepT@3n00Sa,0*5C")
print(msg.msg_type, msg.mmsi, msg.lat, msg.lon, msg.speed)
Transmitting is a different question entirely. The AIS channels are protected maritime safety-of-life spectrum; injecting traffic is illegal without a licence and can trigger a real search-and-rescue response. Any AIS transmit work belongs in a shielded enclosure on a cabled path.
Pitfalls
AISis written upper case for a reason here. As a lower-case three-letter token it is a substring of ordinary French words such as francais, mais and jamais; when you write tooling that greps for it, anchor on word boundaries and on the upper-case spelling.- Class B is not Class A. A Class B unit reports far less often and carries less data, so an absent target is frequently a small boat, not a dark ship.
gr-aisandgr-aistxare GNU Radio blocks that have gone stale against recent GNU Radio releases; reach for AIS-catcher before you spend an evening on a flowgraph that will not build.- The CRC passing means the radio worked, nothing more. There is no field in an AIS message that a defender can check against a secret.
- Type 5 is sent rarely compared to position reports, so a track can be live for minutes before you learn the vessel's name.