Tutorial LoRaWAN

Tutorial: LoRaWAN

What it is. LoRaWAN is the low-power wide-area network standard used for IoT devices such as meters, trackers and agricultural sensors. Devices send short frames to gateways. OnAir shows the clear headers that every gateway in range receives: device address, frame counter, message type and so on. The payload is encrypted and stays that way.

Read this first. Receive only. Only the clear headers are shown. Payloads are encrypted with keys you do not have, and OnAir makes no attempt to read them. The devices belong to other people and companies; do not publish device identifiers. Check your local rules. See Legal and Privacy.

What you need

• A radio at 2 Msps or more. The mode works from 1 Msps, and an RTL-SDR can listen to the three default EU868 channels (868.1, 868.3, 868.5 MHz) if it runs at a wide enough rate. The tuning range is 400 to 2500 MHz.
• An 868 or 915 MHz antenna.
• Frequencies from the database: EU868 868.1, 868.3, 868.5 MHz and the RX2 channel 869.525 MHz; US915 902.3 MHz (channel 0, upstream 902.3 to 914.9 MHz in 200 kHz steps) and 903.9 MHz (sub-band 2, TTN); AU915 915.2 MHz; AS923 923.2 MHz; IN865 865.0625 MHz; KR920 922.1 MHz; EU433 433.175 MHz. The mode starts on 868.1 MHz.

Before you start

The decoder runs one demodulator per channel and spreading factor (SF7 to SF12), so it uses much more CPU than other modes. The EU868 plan listens to 868.1, 868.3 and 868.5 MHz, and to 867.1 to 867.9 MHz when the capture is wide enough. Keep the gain moderate.

Step by step

1. In the mode list open IoT & sensors and choose IoT, 868.1 MHz.
2. Pick your radio and start the receiver. A rate near 2 Msps covers the three default channels.
3. Open Settings and choose the Band plan for your region (check the list in the panel: it includes a US plan and an ANZ plan).
4. Watch Devices and Frames.

What you should see

Devices appear as DevAddr (or DevEUI for join requests) with the network taken from the NetID, last-heard time, level, SNR, frame counter and spreading factor. The frame log has one row per frame.

Reading the screen

• Devices: DevAddr / DevEUI, Network, Vendor / JoinEUI, Heard, Last, Level dBFS, SNR, FCnt, SF, Missed (frames missed by counter gaps).
• Frames: Time, MHz, SF, SNR dB, Type (uplink, downlink, join request), DevAddr / DevEUI, FCtrl, FCnt, Port, MAC commands, encrypted length and MIC. Hover a row to see the frame's bytes in hex.
• A small status line counts uplinks, downlinks and join requests.

Options and settings

• Filter by network, message type or device. all networks shows everything.
• join-only devices: also list devices heard only by their join requests (by DevEUI). After joining they use a DevAddr that the network assigns, which cannot be linked to the DevEUI without the network's keys.
• Clear empties the lists.

Troubleshooting

• No frames. LoRaWAN traffic is sparse. Check the plan matches your region and that gateways are near. Use a good antenna.
• Only a few frames per hour. Normal for sensors.
• CPU is high. Reduce the sample rate or use fewer channels.
• Device names are unknown. The network keeps names in its server; only the header is public.
• Payload shows as encrypted length. Always; payloads are encrypted with the network and application keys.

Tips

A gateway-side view: you see uplinks well and downlinks only when a gateway is close.

Legal and privacy notes

Never try to decrypt or join networks. Do not publish device addresses of networks you do not own.

Under the hood

LoRa modulation with sync word 0x34, SF7 to SF12 at 125 kHz (EU868). Frame layout from the LoRa Alliance LoRaWAN specification and regional parameters (RP002): MHDR, DevAddr, FCtrl, FCnt, FOpts, FPort, encrypted payload, MIC.

Related

Mode-LoRaWAN, Tutorial-LoRa-raw, Tutorial-Meshtastic, Tutorial-ISM-sensors, Modes, Main-window, Supported-radios, Troubleshooting, FAQ, Legal.