How to decode the communication from ISTA? The water meter sends such a packet every 42 seconds.

Hello.
I'm sitting around trying to figure out the communication with the ISTA water meter.
Unfortunately I'm stuck.
Every 42 seconds the water meter transmits something like this:
.

Maybe someone can associate what this modulation and possibly coding is.

After transmitting "this something" there is a pause of 17.26 ms and flies :

.

This is clear:
GFSK, 76kbit, 20khz deviation etc....
We have:
preamble(4), sync (2), date (1).
This agrees with what we were able to extract from the CC1101 (from the registers).

I just don't know what kind of crap is flying in front of it.

This decoded packet is the same all the time. .
edit . However, no. This 'data' byte changes from time to time. Each water meter in the range transmits a different value.
I suspect this is information about the end of the communication window.
The question is how to decode this 'something' from the beginning.

Maybe someone / something ....

Nothing ?

Then maybe someone can suggest what the registers are about:
------------------------------
CC1101 Register
------------------------------
IOCFG2 6
IOCFG1 8
IOCFG0 2
FIFOTHR 8
SYNC1 73
SYNC0 68
PKTLEN 1
PKTCTRL1 44
PKTCTRL0 40
ADDR 0
CHANNR 22
FSCTRL1 12
FSCTRL0 0
FREQ2 21
FREQ1 62
FREQ0 76
MDMCFG4 6B
MDMCFG3 80
MDMCFG2 12
MDMCFG1 20
MDMCFG0 0
DEVIATN 34
MCSM2 7
MCSM1 20
MCSM0 18
FOCCFG 1D
BSCFG 1C
AGCCTRL2 C7
AGCCTRL1 0
AGCCTRL0 B2
WOREVT1 87
WOREVT0 6B
WORCTRL F8
FREND1 B6 .
FREND0 10
FSCAL3 EA
FSCAL2 2A
FSCAL1 0
FSCAL0 11
RCCTRL1 41
RCCTRL0 0
FSTEST 59
PTEST 7F
AGCTEST 3F
TEST2 88
TEST1 31
TEST0 B

According to my pdf - 0xB6 in FREND1 doesn't make sense - but maybe I haven't read some errata.

Hey,
you may have managed to do something on the subject.
I found this note with a description of the protocol:
https://www.ista.com/fileadmin/twt_customer/c...s_System/Protokollbeschreibung_modul_mbus.pdf

I tried to figure out RTL_SDR RTL_WMBUS because I think wmbus is generally available in the EU, but the command:

Quote:

rtl_sdr -f 868.95M -s 1600000 - | build/rtl_wmbus

.

Quote:

rtl_sdr -f 868.625M -s 1600000 - | build/rtl_wmbus -s

.

returns nothing, but looking like this:

Quote:

rtl_433 -f 868950000 -A

.
drops some frames there....

Hi.
Every 100 seconds the processor sends to the CC1101:

12 0x12 MDMCFG2
10 out of 10 - was 12
3e Patable
85 Power
44 BURST 0x04 SYNC1
73 04 SYNC1
68 05 SYNC0

01 IOCFG1 or LEN to 1
44
22
00
22
35 STX
36 SIDLE
08 0x08 PKTCTRL2
40
12 0x12 MDMCFG2
12
18 0x18 MCSM0
08 calibrate
3b SFTX
39 Power Down

3e Patable
85 Power
13 0x13 MDMCFG1
20 b
3f TX fifo
7f send into the ether bf,7f, 1f, 5f, 3f (channel number to receive)?
35 STX
0a 0x0A- CHANNR - channel ...

0f set channel 0f ???? (channel dependent on previously transmitted byte)

3a SFRX

18 0x18 MCSM0

18 change to 18 ?????? auto calibrate
39 Power down after CSn
44 BURST 0x04 SYNC1
8c 04 SYNC1
97 05 SYNC0
09
44
44
34 SRX
f4 data
00 255-signal power
36
36 SIDDLE
39 Power Down !!! ;/