Ideally the first thing you want to see if there are any EAMs: Emergency Action Messages that have been transmitted when you see large fleet movements. In this case we have one recorded today at 0500 hrs Zulu - click on link to play recording.
Shared with Jumpshare
jumpshare.com
Secondly look for Callsigns, for instance:
View attachment 205206
We know that at least x3 refuelers are operating with the Callsign CLEAN.
View attachment 205205
By referencing the callsign we can ascertain if these are Coronets or movements. Corenets are basically tractor movements of refuelers such as the KC3R helping bombers and fighters fly long distances:
Now we can delve a little deeper we look at is the movement - is the movement
preceding any major developments or public statements from officials. In this case they are.
Then we look at any available ACARS messages for the aircraft. For instance:
View attachment 205208
For instance the ACRAS for the KC135
Callsign Clean is currently showing it is operating on the 3400-3500 MHz frequency. This is standard
SINCGARS frequency for US military and NATO militaries - unlike civil radio, this is a frequency hopping channel that hops 2,320 channels with 25 kHz spacing across the lower VHF band. This helps with COMSEC (communications security) and TRANSEC (transmission security) protocols.
View attachment 205210
And whilst you can tune into this frequency using SDR - due to its AES-256 encryption, all you will get is white noise.
View attachment 205211
I hope this helps explain things a little better.