Exploring LoRaWAN Traffic: In-Depth Analysis of IoT Network Communications

Abstract

In the past decade, Long-Range Wire-Area Network (LoRaWAN) has emerged as one of the most widely adopted Low Power Wide Area Network (LPWAN) standards. Significant efforts have been devoted to optimizing the operation of this network. However, research in this domain heavily relies on simulations and demands high-quality real-world traffic data. To address this need, we monitored and analyzed LoRaWAN traffic in four European cities, making the obtained data and post-processing scripts publicly available. For monitoring purposes, we developed an open-source sniffer capable of capturing all LoRaWAN communication within the EU868 band. Our analysis discovered significant issues in current LoRaWAN deployments, including violations of fundamental security principles, such as the use of default and exposed encryption keys, potential breaches of spectrum regulations including duty cycle violations, SyncWord issues, and misaligned Class-B beacons. This misalignment can render Class-B unusable, as the beacons cannot be validated. Furthermore, we enhanced Wireshark's LoRaWAN protocol dissector to accurately decode recorded traffic. Additionally, we proposed the passive reception of Class-B beacons as an alternative timebase source for devices operating within LoRaWAN coverage under the assumption that the issue of misaligned beacons can be addressed or mitigated in the future. The identified issues and the published dataset can serve as valuable resources for researchers simulating real-world traffic and for the LoRaWAN Alliance to enhance the standard to facilitate more reliable Class-B communication.

Keywords: Class-B; IoT; LoRa; LoRaWAN; dataset; network sniffer; time synchronization; traffic monitoring.

Figure 1

LoRaWAN EU868 channels and sniffer front ends.

Figure 2

Block diagram of the developed LoRaWAN sniffer.

Figure 3

Photo of the LoRaWAN sniffer internal hardware.

Figure 4

Distribution of LoRaWAN packets for individual receive chains for packets with valid, invalid, and missing CRC in: (a) Liege dataset; (b) Graz dataset; (c) Vienna dataset; (d) Brno dataset.

Figure 5

LoRaWAN message types: Join Request, Join Accept, Unconfirmed/Confirmed Data Up/Down, RFU, Proprietary, and Class-B Beacon in: (a) Vienna dataset; (b) Brno dataset.

Figure 6

Parameters of captured LoRaWAN messages in the Vienna dataset: (a) Spreading factor; (b) Coding ratio; (c) Channel occupation; (d) Payload length; (e) Received Signal Strength Indicator (RSSI); (f) Signal-to-Noise Ratio (SNR).

Figure 7

LoRaWAN sniffer placement and identified Class-B gateways beaconing its position in: (a) Liege; (b) Vienna. Map source: “Mapy.cz”.

Figure 8

Time offset and corresponding distance between the GNSS reference and the received Class-B beacons.

Figure 9

Difference between the actual reception time and the reported time in invalid Class-B beacons from the Vienna dataset.

Figure 10

Channel utilization by LoRaWAN packets in (a) Vienna dataset; (b) Brno dataset.

Figure 11

Duplicate packets with different chirp polarities in the Brno dataset.