LoRaWAN monitoring
Guardian Air monitors LoRaWAN radio traffic to observe join and data message activity and to infer end device presence on long-range wireless networks.
Overview
long range wide area network (LoRaWAN) is a low-power, wide-area network protocol used extensively in Internet of Things (IoT) deployments for long-range communication between sensors and gateways. Guardian Air uses a dedicated LoRa radio module to capture LoRaWAN packets on supported frequency bands. Gateways are not directly identifiable from LoRa PHY frames; downlink transmissions indicate network infrastructure activity. Because LoRaWAN frequency plans vary by region and country, Guardian Air applies a country-specific configuration to monitor the correct frequency bands. Guardian Air synchronizes the data to Vantage for analysis and alert generation.
What Guardian Air discovers
During LoRaWAN monitoring, Guardian Air collects the following information from each captured transmission. LoRaWAN payloads are end-to-end encrypted; monitoring is limited to message metadata and frame structure.
| Data point | Description |
|---|---|
| Device EUI (device extended unique identifier (DevEUI)) | The globally unique 64-bit identifier assigned to a LoRaWAN end device, present in join request frames. |
| Device address (DevAddr) | The 32-bit network address assigned to an end device after a successful join. Present in uplink and downlink data frames. |
| Network ID (NetID) | The network identifier (ID) present in join-accept frames, used to identify the LoRaWAN network server operator. |
| Message type | The LoRaWAN message type: join request, join accept, confirmed uplink data, unconfirmed uplink data, confirmed downlink data, unconfirmed downlink data, or rejoin request. |
| Signal strength (received signal strength indicator (RSSI)) | The received signal strength of the packet in dBm. |
| Noise floor | The ambient RF noise level measured alongside the received packet, used to calculate signal-to-noise ratio. |
Attack detection
Guardian Air analyzes LoRaWAN frame metadata to detect anomalies that may indicate replay attacks or protocol manipulation.
| Attack type | Description |
|---|---|
| Invalid frame counter value | A LoRaWAN frame counter regression is detected, which may indicate a replay attack or a security issue with the end device. |
| Incorrect frame payload length | A mismatch between the declared and actual payload length in a LoRaWAN packet, which may indicate data manipulation or a protocol violation. |
Frequency configuration
LoRaWAN operates on different frequency bands depending on the region. Guardian Air applies a country-specific configuration to monitor the correct frequencies, set during sensor onboarding in Vantage. The following table lists the frequency plan applied for each supported country.
| Frequency plan | Frequency range | Supported countries |
|---|---|---|
| EU868 | 863 to 870 MHz | Albania, Andorra, Austria, Bahrain, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Egypt, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Kuwait, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Montenegro, Netherlands, North Macedonia, Poland, Portugal, Qatar, Romania, San Marino, Saudi Arabia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, United Arab Emirates, United Kingdom, Vatican City |
| EU868 (Macau variant) | 863 to 870 MHz | Macau |
| US915 | 902 to 928 MHz | Canada, Colombia, Guatemala, United States |
| AU915 | 915 to 928 MHz | Australia, Brazil, New Zealand |
| AS923-1 | 920 to 925 MHz | Japan, Singapore |
| KR920 | 920 to 923 MHz | South Korea |
Hardware
LoRaWAN monitoring uses a dedicated LoRa radio module (interface
ttylora0). The module is separate from the Wi-Fi and
Bluetooth modules, and operates exclusively on LoRa frequencies as defined by the
active regional configuration.