Using my ADS-B receiver, In the past few months I've seen a lot of what I think are TIS-B contacts. They seem to cycle through a few different ICAO ID prefixes, but I see a lot that are of the form (in hex) 29xxxx and 31xxxx. E.g. 298c12 and 318512. I'm looking for a specification of exactly which ranges of ICAO codes can be used for TIS-B.
In this answer I'll assume you are analysing ADS-B data on 1090 MHz, which is the defacto global standard. I am less familiar with the ADS-B on UAT (987 MHz) which is used in addition to 1090MHz in the USA, but I assume the same logic applies.
There are no ICAO addresses assigned to TIS-B targets.
If an aircraft has an ICAO-address which is detected by the surveillance sensors (e.g. Mode S radar, multilateration system) and the aircraft is not transmitting ADS-B, then a TIS-B target will be created with the ICAO 24 bit address.
If an aircraft has no ICAO-address, (i.e. it has a Mode A/C transponder / ATCRBS) and is not transmitting ADS-B, then a TIS-B target will be created with a 24 bit address that consists of the Mode A code (first 12 bits) and a unique surveillance system track number (last 12 bits). Primary radar targets are allocated a "Mode A code" of all zeros.
To determine whether you receive an ADS-B message or a TIS-B message you should start looking at the Downlink Format (DF, first 5 bits of the message) if the DF = 17, then it is an ADS-B message. If the DF = 18 then you look at the control field (CF, bits 6-8). CF = 0 and CF = 1 are ADS-B messages. CF = 2,3 & 5 are TIS-B messages. CF = 6 are ADS-R messages. CF = 4 are TIS-B / ADS-R system status messages.
The TIS-B messages contain an ICAO/Mode A Flag (IMF) bit which indicates how to interpret the 24 bit address. The location of this bits varies by message type (e.g. position, velocity) and replaces a bit in the ADS-B format that has no meaning in TIS-B.