How resistent is Meshtastic to attacks? Can it withstand a flood of bogus messages?

[Darin755]

My concern is that an adversary attacking Meshtastic could flood the network in order to cause an outage. Does Meshtastic have any rate limiting for misbehaving nodes? If so, how effective is it?

[VectorPeak]

Meshtastic has some protections against accidental or poorly behaved traffic, but it is not resistant to a determined RF denial-of-service attack. If someone transmits continuously, or sends lots of packets on the same frequency/modem preset, they can consume airtime and prevent legitimate packets from getting through. No mesh-layer rate limiter can solve that because the radio channel is already busy.

The firmware does limit how traffic propagates: packets have hop limits, duplicate packet IDs are remembered so the same packet is not endlessly rebroadcast, and nodes apply channel/packet validation before processing traffic. Nodes also have airtime/duty-cycle related limits so normal Meshtastic devices don’t flood the channel under normal use.

There is not, in the general sense, a strong automatic “ban this misbehaving node and protect the mesh” mechanism. If an attacker has the channel key, they can generate valid-looking traffic. If they don’t, they can still jam or flood the RF channel with noise or bogus LoRa packets and cause loss of service.