ACARS Drama

A project to map out every broken coffee maker in the sky

A question I’ve been asked a few times since I took a little project I had for a year or so operating privately under my desk, and turned it into a social media bot.

Note: this post is designed as a more high-level overview of what ACARS/VDLM2 messages are, and what my bot they feed is. So, if you’re looking for a more detailed technical overview of how the bot works, check out this earlier post from when it was first created as a Slack app.

When an aircraft is flying overhead, various radio signals are being transmitted and received by said aircraft constantly. Some examples of the radio signals, of course, are voice communications between pilots and air traffic controllers, that most people are familiar with. These are, of course, critical for safety, and ensuring planes are at the right altitude, going in the right direction, and at the right speed.

In addition to voice, there are also a boat-load, well, plane-load I guess, of data signals. Amongst these data signals are the two types of signal that feed the bot’s insatiable thirst for drama. They are ACARS and VDLM2.

ACARS, which stands for Aircraft Communications Addressing and Reporting System, is a 1970’s era protocol that is still used today. A bunch of ground stations around the world are used to translate messages between computers in dispatch, maintenance and operations control rooms of the various airlines and their aircraft, and vice-versa, from the aircraft cockpit back to those airline computers.

VDLM2, which stands for VHF Data Link Mode 2, is similar in that it is a data transmission protocol that works over very high frequency (VHF) radio-waves, but it’s a bit more modern, uses different frequencies, is a bit faster, and can also carry ACARS messages.

So, in summary, ACARS is where the drama usually is, sometimes transmitted in raw ACARS form, other times it is encapsulated in VDLM2. Same result all round really, you just have to look in a slightly different place to decode the ACARS inside of VDLM2 messages.

Because I am a massive nerd when it comes to both radio stuff and planes (I was a PPL, almost did commercial but got rejected by the flight school I wanted to train at age 17 because I was ‘too quiet’, a problem I later rectified), I was able to buy a few relatively cheap bits of equipment that can listen for these signals from planes flying over my house, and using some open source software that other, much smarter people than me wrote, I was able to decode them. I then wrote some extra bits of software that fixes up the message (extracts only the human readable interesting bits, removes bad formatting etc), and turns it into the posts you see on ACARS Drama. That software also does the job of finding the aircraft photo and adding the tracking link too.

Below is an image of an FMC from a cockpit:

Now, because of how the system works, it is extremely hard to capture the ground to air signals, unless you live in close proximity to an airport or ground station, which I do not. So this means that pretty much 99% of what you see on ACARS Drama is air to ground. Essentially one side of a conversation, from the plane to folks on the ground. Sometimes it picks up ground to air, but it’s rare, and I honestly don’t know why it works when it does. If you do see a ground to air message, the bot will say “ACARS Message To” instead of “ACARS Message From”.

Because of the sheer volume of the messages it picks up, around 2,000 an hour, most of which are just position and weather data, and automated readings from equipment, it would not be reasonable to post them all via the bot. That would just be annoying. So, I have carefully curated a list of keywords that the bot looks for in the messages received, to ensure that it only shares the ones with human-entered, “free-text” content. So when you see a message on the bot, it means that a pilot or crew member on the aircraft typed that into their ACARS terminal, which is usually a Flight Management Computer (FMC) device, like the one shown above.

As a message is typed and sent via ACARS, if that plane is in range of one of my antennas (there are two currently being used for the ACARS drama bot), and on a frequency I’m monitoring (I currently monitor five total — 3 ACARS and 2 VDLM2), then it’ll be processed by my software and turned into the bot post that you see on Masto like this:

In this example, the message was captured in a VDLM2 frequency. The transmitting aircraft registration was N305SY, and its flight number was OO3682. OO is the code for Skywest Airlines, and N305SY is an Embraer 175 aircraft. The Track Aircraft link in the bot points to the registration, so you can see where in the sky the plane is at any given time, unless it’s on the ground of course.

It’s fair to say that the overwhelming majority of messages transmitted are extremely routine and boring, contrary to the name of the bot — which to be honest, is part of the joke. So, you’ll mostly see things about asking for gate confirmations, reporting “snags” with the aircraft, usually toilet or coffee maker related, but occasionally you’ll see reports of drunk passengers, fights onboard — you know, air travel things. That’s what makes it an interesting and fun project. You also get to see the pilots’ personalities shine through as well, which I love. We all have good days and bad days at work, so you might see the occasional snarky message — but ultimately, these are professionals doing a wonderful job in not always the easiest of circumstances.

So that’s what you’re seeing and how the bot works. You can follow along at https://infosec.exchange/@acarsdrama if you aren’t already.

Harvest your sky drama!

If you would like to contribute to ACARS Drama, we’d love to have you! It’s very easy to get started, all you need is a $30 SDR (like an RTL-SDR), an antenna, some open source software, and Internet access. This is how:

Quick Start

If you already have an instance of acarsdec, dumpvdlm2, or acars_router running, then all you need to do is include our ingestion endpoint in your configuration.

Send ACARS messages to: feedthe.acarsdrama.com:5550

Send VDLM2 messages to: feedthe.acarsdrama.com:5555

The connection can be either UDP or TCP (UDP is preferred), and should be in JSON format (the default for the three tools mentioned above).

acars_router is required to be able to send acarsdec/dumpvdlm2 traffic to multiple servers, so if you are already feeding elsewhere directly from acarsdec or dumpvdlm2, you will need to introduce an acars_router instance in your pipeline to continue to feed both.

If you do start feeding, be sure to DM @acarsdrama@infosec.exchange, and let us know where you are!

Need a bit more guidance?

For information about running your own acarsdec, dumpvdlm2 and acars_router containers, have a read through this earlier post, but remember you only need to do the container bit.

Check out our sample config on Github for an example of how you can set up a minimal container setup to feed the drama engine.