Don't assume anything about the voice frequencies. In a correctly configured P25 system you really don't need to know where they are because the control channel will tell your receiver where to tune. Once you have identified what you think is a control channel, turn off the -T (trunking) feature of OP25 and park it on the control channel. When it is accurately tuned, the system NAC will be scrolling in the terminal window. Note this hex value and set up the appropriate trunk.tsv file so that you can turn trunking back on (-T trunk.tsv). If you got the configuration correct, you should see some lines of data start to appear (including the voice frequencies) in the Traffic tab. If the stars align, you might even get good audio decode :) Operationally, when a user keys the PTT button on a P25 radio, a series of messages are exchanged that either grants or denys access to the requested TGID. Typically the user hears a "beep" or a "bong" and at that point they can start speaking and this is transmitted over the uplink freq. The repeater then turns the data stream back around and retransmitts it on the downlink for other affiliated radios to receive. As a "fly on the wall" scanner user, OP25 can monitor for these messages and use them to determine where to tune, what tgid and timeslot etc. When the PTT key is released, more messages are passed and a message pops out on the control channel notifying client radios that the call has ended. (Note: these messages are coded as various types of DUID and typically carry additional information such as encryption status, radios ids, tgids etc.)