Ci a ion: Po alac, A.; K al, J.;
A habe , H.; Kola , O.; No ak, M.
Explo ing LoRaWAN T a ic:
In-Dep h Analysis o IoT Ne wo k
Communica ions. Senso s 2023,23,
7333. h ps://doi.o g/10.3390/
s23177333
Academic Edi o : Gianluigi Fe a i
Recei ed: 29 June 2023
Re ised: 21 July 2023
Accep ed: 17 Augus 2023
Published: 22 Augus 2023
Copy igh : © 2023 by he au ho s.
Licensee MDPI, Basel, Swi ze land.
This a icle is an open access a icle
dis ibu ed unde he e ms and
condi ions o he C ea i e Commons
A ibu ion (CC BY) license (h ps://
c ea i ecommons.o g/licenses/by/
4.0/).
senso s
A icle
Explo ing LoRaWAN T a ic: In-Dep h Analysis o IoT
Ne wo k Communica ions
Ales Po alac 1,* , Jan K al 1, Holge A habe 2, Ond ej Kola 1and Ma ek No ak 1
1Facul y o Elec ical Enginee ing and Communica ion, B no Uni e si y o Technology, Technicka 12,
61600 B no, Czech Republic; [email p o ec ed] (J.K.); [email p o ec ed] (O.K.); [email p o ec ed] (M.N.)
2Ins i u e o Elec odynamics, Mic owa e and Ci cui Enginee ing, TU Wien, Gusshauss asse 25/354,
1040 Vienna, Aus ia; holge [email p o ec ed]
*Co espondence: [email p o ec ed]
Abs ac :
In he pas decade, Long-Range Wi e-A ea Ne wo k (LoRaWAN) has eme ged as one o
he mos widely adop ed Low Powe Wide A ea Ne wo k (LPWAN) s anda ds. Signi ican e o s
ha e been de o ed o op imizing he ope a ion o his ne wo k. Howe e , esea ch in his domain
hea ily elies on simula ions and demands high-quali y eal-wo ld a ic da a. To add ess his
need, we moni o ed and analyzed LoRaWAN a ic in ou Eu opean ci ies, making he ob ained
da a and pos -p ocessing sc ip s publicly a ailable. Fo moni o ing pu poses, we de eloped an
open-sou ce sni e capable o cap u ing all LoRaWAN communica ion wi hin he EU868 band. Ou
analysis disco e ed signi ican issues in cu en LoRaWAN deploymen s, including iola ions o
undamen al secu i y p inciples, such as he use o de aul and exposed enc yp ion keys, po en ial
b eaches o spec um egula ions including du y cycle iola ions, SyncWo d issues, and misaligned
Class-B beacons. This misalignmen can ende Class-B unusable, as he beacons canno be alida ed.
Fu he mo e, we enhanced Wi esha k’s LoRaWAN p o ocol dissec o o accu a ely decode eco ded
a ic. Addi ionally, we p oposed he passi e ecep ion o Class-B beacons as an al e na i e imebase
sou ce o de ices ope a ing wi hin LoRaWAN co e age unde he assump ion ha he issue o
misaligned beacons can be add essed o mi iga ed in he u u e. The iden i ied issues and he
published da ase can se e as aluable esou ces o esea che s simula ing eal-wo ld a ic and o
he LoRaWAN Alliance o enhance he s anda d o acili a e mo e eliable Class-B communica ion.
Keywo ds:
IoT; LoRa; LoRaWAN; Class-B; da ase ; ne wo k sni e ; a ic moni o ing; ime
synch oniza ion
1. In oduc ion
The In e ne o Things (IoT) has e olu ionized he way we in e ac wi h ou en i-
onmen , enabling a wide ange o applica ions om sma ci ies o indus ial au oma ion.
Low Powe Wide A ea Ne wo ks (LPWANs) ha e eme ged as key echnology o IoT,
p o iding a balance be ween low powe consump ion and long- ange communica ion.
Long-Range Wi e-A ea Ne wo k (LoRaWAN), a popula LPWAN echnology, is based
on he Long-Range (LoRa) physical laye and p o ides ea u es such as adap i e da a a es,
bidi ec ional communica ion, and a ious de ice classes, making i sui able o di e en
use cases. Gi en he limi ed Radio F equency (RF) powe o 25 mW, LoRaWAN acili a es a
communica ion dis ance o up o 5 km in u ban a eas [
1
]. These di e se capabili ies ha e
led o widesp ead adop ion ac oss a ious indus ies, es ablishing i as a i al componen
in he g owing IoT ecosys em [2,3].
The LoRa Physical (PHY) laye employs a unique modula ion echnique known as
Chi p Sp ead Spec um (CSS). CSS acili a es long- ange communica ion and obus ness
agains na ow-band in e e ence by sp eading he in o ma ion signal o e a wide band-
wid h [
4
]. Abo e his, he LoRaWAN Medium Access Con ol (MAC) laye p o ides a
s anda dized p o ocol o IoT de ices [5].
Senso s 2023,23, 7333. h ps://doi.o g/10.3390/s23177333 h ps://www.mdpi.com/jou nal/senso s
Senso s 2023,23, 7333 2 o 20
LoRaWAN ea u es h ee dis inc de ice classes—A, B, and C—add essing di e en
applica ion equi emen s and powe cons ain s [
5
]. Class-A de ices o e he highes
ene gy e iciency, sui able o applica ions wi h in equen communica ion needs, wi h b ie
ecei e windows a e each ansmission. Class-B de ices p o ide p edic able downlink
communica ion la ency by synch onizing wi h ne wo k beacons and enabling scheduled
ecei e slo s, main aining mode a e powe consump ion. Class-C de ices p io i ize down-
link la ency o e powe e iciency, o e ing con inuous ecei e windows o nea eal- ime
communica ion. End de ices use a andom access ansmission me hod (ALOHA), which
allows hem communica ion wi hou he need o pai ing wi h a speci ic ga eway.
Gi en he complexi y and di e se ope a ing condi ions o LoRaWAN, i is essen ial
o gain insigh in o i s ac ual in e nal unc ionali y in eal deploymen s using ools o
ne wo k communica ion analysis. To add ess his need, we de eloped a dedica ed ha d-
wa e
sni e —a
specialized de ice designed o cap u e and decode wi eless a ic. In
he con ex o LoRaWAN, his sni e can be used o collec a da ase and subsequen ly
in es iga e a ious aspec s o he ne wo k, such as signal s eng h, co e age, da a a es,
and communica ion p o ocols. These insigh s can help iden i y po en ial issues, e alua e
ne wo k deploymen s, and op imize con igu a ions o be e pe o mance. To p o ide
he g ea es lexibili y in analyzing he eco ded packe s, we selec ed Wi esha k—a widely
ecognized open-sou ce ne wo k p o ocol analyze .
Ou esea ch is guided by se e al key ques ions ela ed o he da ase . Fi s ly, we aim
o de e mine which in o ma ion can be ex ac ed om cap u ed eal-wo ld a ic wi hin
a LoRaWAN ne wo k, wi h pa icula a en ion o downlink a ic and Class-B beacons.
Fu he mo e, we in es iga e how Class-B beacons and hei op ional ex ensions a e used in
ac ual ins alla ions. I is also c ucial o assess whe he secu i y and spec um egula ions
a e ollowed in cu en LoRaWAN deploymen s. Ano he key aspec o ou esea ch is
o examine he accu acy and eliabili y o ime synch oniza ion in LoRaWAN, no ably
ega ding he Class-B beacons, and hei suscep ibili y o in e e ence and miscon igu a ion.
Finally, we explo e he po en ial o new applica ions o Class-B beacons.
Con ibu ion o This Wo k
We collec ed and analyzed a la ge da ase [
6
] o eal-wo ld LoRaWAN a ic om
ou Eu opean loca ions. Unlike p e ious da ase s [
7
–
10
], ou collec ion includes uplink,
downlink, and Class-B a ic. In he Resul s and Discussion sec ion, we p esen an anal-
ysis ha encompasses he Class-B beacons and highligh s po en ial issues o LoRaWAN
deploymen s.
To ob ain his da ase , we used a cus om LoRaWAN ha dwa e sni e . Bo h he ha d-
wa e and so wa e sou ces o his de ice a e a ailable online [
11
]. Recognizing he ou da ed
LoRaWAN p o ocol suppo in Wi esha k, we enhanced i s capabili ies o decoding eal-
wo ld a ic. These imp o emen s a e inco po a ed in o he Wi esha k de elopmen
b anch and a e now publicly accessible.
Fu he mo e, we p oposed an inno a i e app oach o using Class-B beacons as a
imebase sou ce in u ban en i onmen s. This me hod o e s se e al ad an ages o e
al e na i e ime sou ces such as Global Na iga ion Sa elli e Sys em (GNSS), DCF77, and
Ne wo k Time P o ocol (NTP), including be e indoo ecep ion, smalle and mo e cos -
e ec i e an ennas, and independence om in e ne connec i i y.
Hence, he main con ibu ions o his wo k a e as ollows:
•
i desc ibes a no el LoRaWAN sni e wi h open ha dwa e design iles and so -
wa e amewo k ha allows cap u ing all LoRaWAN a ic and i s examina ion
in Wi esha k;
•
i p o ides a la ge public da ase wi h eal-wo ld a ic cap u ed in mul iple loca ions;
•
i analyzes he unenc yp ed pa o cap u ed packe s, p o iding insigh s in o ne wo k
ope a o s, end de ice manu ac u e s, and LoRaWAN ea u e suppo ;
•
i p o ides an analysis o Class-B beacons ega ding p ecise iming and ga eway
localiza ion;
Senso s 2023,23, 7333 3 o 20
•
i poin s ou o se e al iden i ied issues, like in alid Class-B beacons, comp omised
enc yp ion keys, and in alid LoRaWAN a ic;
• i p oposes he no el use o Class-B beacons as a imebase sou ce.
2. Rela ed Resea ch
The IoT esea ch communi y ecognizes he signi icance o eal-wo ld, quan i a i e
da a o s udying he ne wo k en i onmen s and deploymen s. Se e al LoRaWAN da ase s
ha e been made a ailable [
7
–
10
]. Bha ia e al. [
7
] ga he ed uplink packe s om ga eways in
he dense u ban en i onmen o London (UK). They included packe heade in o ma ion
and PHY laye p ope ies epo ed by he ga eways, making he da ase one o he la ges
and mos ex ensi e [
12
]. Ae nou s e al. [
8
] collec ed da a ocused on inge p in localiza ion
in An we p (Belgium). Thei da ase con ains a la ge olume o aces wi h known end
de ice posi ion.
Blenn e al. [
9
] p esen ed an analysis o The Things Ne wo k (TTN), ob aining a
da ase o packe s h ough he TTN Applica ion P og amming In e ace (API) using a
known de aul ne wo k key. Howe e , hei indings we e cons ained o TTN uplink
a ic due o i s API limi a ions. P esen ly, he acquisi ion o such da ase is no longe
easible due o he e olu ion o he TTN backend.
Choi e al. [10] de eloped LoRada , a passi e packe moni o ing ool, and conduc ed
an analysis o a ic wi hin an anonymized ci y-wide a ea. Thei s udy closely esembles
ou esea ch. Howe e , hey we e limi ed o moni o ing uplink sessions due o ha dwa e
cons ain s. To he bes o ou knowledge, no p e ious s udy has a emp ed o cap u e bo h
uplink and downlink simul aneously.
An o e iew o he exis ing sni e s is p o ided in [
13
]. These sni e s a e limi ed
o a single RF channel [
14
] o employ one mul ichannel concen a o [
9
,
10
]. They a e
ei he based on a ga eway (concen a o ype) [
9
,
10
] o de eloped using he GNU adio
(SDR- ype) [
15
]. So wa e-De ined Radios (SDRs) we e deemed unsui able due o high
Signal- o-Noise Ra io (SNR) equi emen s [
15
–
17
]. Recen ly, an SDR-based demodula o
compe i i e in SNR equi emen s was made a ailable [
18
]. Howe e , i s ill demodu-
la es one equency and Sp eading Fac o (SF) pe block, equi ing o e 100 di e en ly
con igu ed LoRa demodula o blocks o he in ended sni e unc ionali y, which is com-
pu a ionally demanding.
O he pape s ocus on simula ing a ious LoRaWAN issues (o e iew in [
19
]) and
he deploymen o cus om expe imen al se ups (con olled en i onmen s o nodes and
one o mul iple ga eways) [
20
,
21
]. Ou wo k ocuses on passi e moni o ing o eal-wo ld
a ic, simila o [
10
], bu also includes an impo an s udy o downlink messages and
Class-B beacons.
Time synch oniza ion in LoRaWAN has been analyzed in se e al s udies, such
as [22,23]
.
Rami ez e al. [
22
] achie ed an excellen ime e o below 10
µ
s using a cus om p o ocol in
a
Class-A
ne wo k. Rizzi e al. [
23
] employed a pos e io i synch oniza ion, enabling ime
sync wi h an unce ain y in he o de o ens o milliseconds. No s udies ha e sugges ed
passi e lis ening o Class-B beacons o ime synch oniza ion.
3. Sni e Design
The sni e is based on comme cially a ailable modules, and i s so wa e is cus omized
o cap u ing ne wo k a ic. I ope a es au onomously when connec ed o a powe sou ce,
s o ing he collec ed eco ds locally and simul aneously ansmi ing hem o a se e o e
he Long Te m E olu ion (LTE) modem.
To o e come he limi a ions o cu en ly a ailable de ices, ou new sni e needs o
cap u e all LoRaWAN a ic acco ding o he EU868 equency plan, including he RX2
channel [
24
]. This necessi a es suppo ing bo h uplink and downlink ecep ion, which
di e in he chi p signal pola i y a he physical LoRa laye . Addi ionally, we aimed o
ecei e
Class-B
beacons ansmi ed on RX2 channel wi h a non-in e ed chi p signal. The
combina ions o hese pa ame e s a e summa ized in Table 1.
Senso s 2023,23, 7333 4 o 20
Table 1. LoRaWAN EU868 equency plan wi h possible combina ions o LoRa pa ame e s [24–26].
T ansmission
Kind F equency (MHz) Sp eading
Fac o
Uplink Signal
Pola i y
Downlink
Signal Pola i y
RX1 channel 1 868.5 −0.4 =868.1 SF7–SF12 non-in e ed in e ed
RX1 channel 2 868.5 −0.2 =868.3 SF7–SF12 non-in e ed in e ed
RX1 channel 3 868.5 SF7–SF12 non-in e ed in e ed
RX1 channel 4 867.5 −0.4 =867.1 SF7–SF12 non-in e ed in e ed
RX1 channel 5 867.5 −0.2 =867.3 SF7–SF12 non-in e ed in e ed
RX1 channel 6 867.5 SF7–SF12 non-in e ed in e ed
RX1 channel 7 867.5 +0.2 =867.7 SF7–SF12 non-in e ed in e ed
RX1 channel 8 867.5 +0.4 =867.9 SF7–SF12 non-in e ed in e ed
RX2 869.525 SF7–SF12 1– in e ed
Class-B beacon 2869.525 SF9 – non-in e ed
1
SF12 o he LoRaWAN s anda d, SF9 o The Things Ne wo k [
26
]. The sni e suppo s all sp eading ac o s.
2Class-B beacons use implici heade mode wi h speci ic se ings [24].
The sni e is based on he indus y-s anda d IMST iC880A LoRaWAN concen a-
o [
27
], a ha dwa e de ice designed o ecei ing and p ocessing LoRa signals in LoRaWAN
ne wo k ga eways. The module is equipped wi h a Sem ech SX1301 digi al baseband
chip [
28
] and wo Sem ech SX1257 RF on end chips [
29
], p o iding up o 10 p og ammable
pa allel demodula ion pa hs. I suppo s mul iple LoRaWAN channels in he 868 MHz
equency band, enabling he simul aneous ecep ion o da a om mul iple end de ices.
Addi ionally, he module is also capable o pe o ming ime-s amping o incoming packe s,
which is essen ial o p ecise ime synch oniza ion.
The main baseband chip SX1301 p o ides eigh LoRa demodula o s wi h au oma ic
SF selec ion on IF0–IF7 signal pa hs. Mo eo e , an addi ional LoRa demodula o wi h
ixed pa ame e s and implici heade mode suppo , e e enced as a SingleSF modem, is
a ailable on he IF8 signal pa h.
The e a e se e al limi a ions in oduced by he chipse . In he LoRa physical laye ,
he modula ed signal is ep esen ed by a chi p, which is a sinusoidal wa e o m whose
equency inc eases o dec eases linea ly o e ime [
4
]. The SX1301 demodula o can only
de ec chi ps wi h one o wo di e en pola i ies, each ep esen ing i s in e se. Each LoRa
demodula o needs o know he pola i y o a LoRa chi p signal in ad ance. As a esul , a
leas wo iC880A concen a o modules need o be used o a simul aneous ecep ion o
uplink and downlink ansmission, each con igu ed o demodula e a di e en chi p signal
pola i y (GW #1 and GW #2).
The IF0–IF7 LoRa channels may be connec ed indi idually o adio on ends, e -
e enced as Radio A o Radio B [
27
,
28
]. Howe e , he use ul bandwid h o SX1257 adios
is app oxima ely only 925 kHz [
30
], assuming ypical 125 kHz channels in he EU868
band [
24
]. This bandwid h is su icien o he simul aneous ecep ion o all RX1 channels
using bo h on ends. Ne e heless, he RX2 channel ope a es a a signi ican ly di e en
equency, making i impossible o ecei e using he ypical con igu a ion. This is no an
issue o a s anda d concen a o , as i only ansmi s on RX2 wi hou ecei ing. Howe e ,
o a sni e , comple e da a ecep ion is desi ed. To o e come his limi a ion, a hi d iC880A
concen a o mus be added o he sni e sys em (GW #3). This concen a o enables
ecep ion in he RX2 downlink wi h one o i s eigh LoRa demodula o s. Figu e 1illus a es
he ela ionship be ween channels, bands, and adio on ends.
Ano he goal o he sni e is o ecei e Class-B beacons. These beacons a e ansmi ed
on he RX2 equency wi h speci ic pa ame e s in ol ing he implici LoRa heade [
24
].
Demodula ion o he heade is suppo ed by he SingleSF modem on he IF8 signal pa h.
An implici heade e e s o a packe o ma whe e he leng h o he packe is no explici ly
included in he packe heade . Ins ead, he packe leng h is assumed o be ixed and known
in ad ance. This ecep ion is handled by he hi d concen a o module (GW #3).
Senso s 2023,23, 7333 5 o 20
band P
RX2
band M
RX1 channels 1–3
band L
RX1 channels 4–8
867.1 MHz
867.3 MHz
869.525 MHz
867.5 MHz
868.5 MHz
868.3 MHz
868.1 MHz
867.9 MHz
867.7 MHz
GW #1
GW #2
GW #3
Radio B Radio A
Radio A
Figu e 1. LoRaWAN EU868 channels and sni e on ends.
3.1. Sni e Ha dwa e O e iew
Figu e 2shows he block diag am o ou LoRaWAN sni e . Ini ially, he adio signal is
ecei ed by an Ul a-High F equency (UHF) omnidi ec ional an enna wi h a gain o 2 dBi
and e ical pola iza ion. This signal is subsequen ly il e ed by a na ow bandpass il e ,
ampli ied by a Low Noise Ampli ie (LNA), and hen dis ibu ed o he inpu s o h ee
iC880A modules ia a powe spli e . Table 2ou lines he unc ion o each iC880A module.
Raspbe y Pi
SD ca d
RTC
module
Ga eway
IMST
iC880A-SPI
Ga eway
IMST
iC880A-SPI
Ga eway
IMST
iC880A-SPI
GPS
ecei e
LNA
1:4 RF spli e
1PPS
UART
I2C
SPI
SPI
SPI
LTE
modem
USB
Figu e 2. Block diag am o he de eloped LoRaWAN sni e .
Table 2. Roles o iC880A modules in he LoRaWAN sni e .
Concen a o Recei es on IF0–IF7 Pa hs IF8 Pa h
GW #1 RX1 channel 1–8 downlink –
GW #2 RX1 channel 1–8 uplink –
GW #3 RX2 downlink (IF0 only) Class-B beacon
A Raspbe y Pi minicompu e se es as he cen al p ocessing uni , which communi-
ca es wi h he iC880A modules h ough i s in eg a ed Se ial Pe iphe al In e aces (SPIs).
In addi ion, i ob ains he cu en ime om a GNSS ecei e module o accu a e imes-
amping o he ecei ed packe s. Fo his pu pose, a 1 pps signal is dis ibu ed om he
GNSS module o all iC880A concen a o s. The Raspbe y Pi also has a Real Time Ci cui
(RTC) connec ed o i s I
2
C in e ace and an LTE modem connec ed ia USB o emo e
managemen and sending he measu ed da a o he se e . An ex e nal 24 V adap e powe s
he whole de ice. Figu e 3shows he pho o o he sni e in e nal ha dwa e. Comple e
schema ics and ha dwa e design iles a e a ailable online [11].
F om a mechanical pe spec i e, he comple e LoRaWAN sni e is enclosed in an
IP68- a ed
aluminum box, enabling sa e ou doo ins alla ions. To accommoda e he sni e ’s
equi emen o GNSS-based ime synch oniza ion and LTE communica ion, an addi ional
plas ic con aine conceals he GNSS and LTE an ennas, elimina ing he need o wa e p oo
ex e nal an ennas. The wo con aine s a e secu ely bonded oge he and all openings a e
sealed o main ain wa e igh in eg i y.

Senso s 2023,23, 7333 6 o 20
Figu e 3. Pho o o he LoRaWAN sni e in e nal ha dwa e.
3.2. Sni e So wa e O e iew
The so wa e elies on adap ed open-sou ce u ili ies supplied by Sem ech, speci ically
liblo agw
om he
lo a_ga eway
eposi o y [
30
] and
lo a_pk _ wd
om he
packe _-
o wa de
eposi o y [
31
]. The LoRa ga eway lib a y manages SPI communica ion be ween
he hos compu e and he SX1301 baseband chip. The packe o wa de employs he
ga eway lib a y o ecei e packe s, inco po a e de ailed da a, and ansmi he packe ia a
s anda dized UDP socke .
I was necessa y o add suppo o handling mul iple SPIs, swi ching chi p signal
pola i y, ecei ing packe s wi hou a alid Cyclic Redundancy Check (CRC), and decoding
he Class-B beacon implici heade . As a esul , he packe o wa de was modi ied o pa se
con igu a ion Ja aSc ip Objec No a ion (JSON) iles and pass he ele an se ings o he
lib a y, enhancing i s e sa ili y and adap abili y. The comple e so wa e amewo k is
a ailable online [11].
3.3. Da a P ocessing
To add ess he limi a ions o o iginal Wi esha k LoRa encapsula ion, we de eloped
an upda ed e sion o he LoRaTap heade o e icien ly manage he addi ional PHY
laye in o ma ion, such as equency channel, signal le el, imes amp, and o he ele an
de ails [
32
]. The sni e ’s JSON ou pu p oduced by he packe o wa de u ili y can be
con e ed o he pcap o ma by con e sion u ili y [11].
We also signi ican ly upda ed he Wi esha k LoRaWAN dissec o . Key enhancemen s
include he addi ion o a LoRaWAN Class-B beacon dissec o , Join Accep dec yp ion,
suppo o MAC commands om he LoRaWAN 1.0.4 speci ica ion [
5
], and a ious
imp o emen s o enable success ul decoding o eal-wo ld a ic cap u ed by he sni e .
These modi ica ions a e in eg a ed in o he de elopmen b anch o u u e o icial elease
and a e cu en ly a ailable h ough he Wi esha k au oma ed builds [33].
3.4. Analysis and Dec yp ion
Subsequen da a p ocessing can be pe o med manually in Wi esha k o h ough
au oma ed sc ip s in Wi esha k’s console e sion, TSha k. We employed an au oma ed
app oach o he quan i a i e analysis o cap u ed packe s. Da a pos -p ocessing om he
TSha k u ili y is execu ed wi h Py hon sc ip s, while inal s a is ical and isual p ocessing
is ca ied ou in MATLAB. The sc ip s a e a ailable online [11].
LoRaWAN packe s a e usually pa ially enc yp ed, wi h he keys gene ally unknown
o a sni e de ice. Howe e , he e a e se e al p ope ies o LoRaWAN communica ion ha
can be analyzed wi hou knowing he dec yp ion keys. The ollowing ields o a LoRaWAN
packe a e no enc yp ed:
Senso s 2023,23, 7333 7 o 20
•
Message Heade (MHDR): Con ains in o ma ion abou he message ype (MType) and
LoRaWAN e sion.
•
De ice Add ess (De Add ): A unique 32-bi iden i ie o he end de ice wi hin a
speci ic ne wo k.
•
F ame Con ol (FC l): Con ains in o ma ion abou he Adap i e Da a Ra e (ADR),
F ame Op ions Leng h, and o he con ol lags.
•
F ame Coun e (FCn ): A 16-bi coun e alue ha inc emen s wi h each uplink ame
o p e en eplay a acks.
• F ame Op ions (FOp s): Con ains op ional MAC commands.
•
F ame Po (FPo ): Indica es he po numbe o applica ion-speci ic o MAC laye
communica ion.
The applica ion payload (FRMPayload) and Message In eg i y Check (MIC) a e en-
c yp ed o bo h uplink and downlink packe s, equi ing he co esponding keys o
dec yp ion and e i ica ion [5].
LoRaWAN ac i a ion p ocesses include he O e - he-Ai Ac i a ion (OTAA) and
Ac i a ion By Pe sonaliza ion (ABP). OTAA in ol es an end de ice ansmi ing a Join
Reques , enc yp ed wi h a p e-sha ed Applica ion Key (AppKey). The ne wo k se e
e i ies he eques , gene a es session keys, namely he Ne wo k Session Key (NwkSKey)
o he MIC and he Applica ion Session Key (AppSKey) o he payload, and esponds
wi h a Join Accep message, which includes he assigned De ice Add ess (De Add ). Gi en
he necessa y keys, Wi esha k can dec yp he join p ocess packe s, allowing o a mo e
comp ehensi e analysis.
ABP, on he o he hand, in ol es p e-con igu ing he end de ice wi h session keys
(NwkSKey and AppSKey) and a De Add , enabling immedia e communica ion wi hou a
join p ocedu e. While his app oach simpli ies he p ocess, i may inc ease secu i y isks
due o p olonged use o he same keys.
4. Resul s and Discussion
Da a om he LoRaWAN ne wo ks we e collec ed in ou ci ies: Liege (Belgium), G az
(Aus ia), Vienna (Aus ia), and B no (Czechia). These ci ies we e chosen o da a ga he ing
due o a ious ac o s, such as hei cen al Eu opean loca ion, hei p ominence as majo
u ban a eas wi h well-es ablished LoRaWAN ne wo ks, and he in en ion o cap u e a
di e se ange o ci y en i onmen s o da a collec ion. Table 3p o ides a summa y o he
cha ac e is ics and de ails associa ed wi h each cap u e.
Table 3. Da ase de ails.
Loca ion Geog aphic
Coo dina es Sni e Placemen Cap u e In e al Days
A e age
Packe s
pe Day
Valid LoRaWAN
Packe s pe Day
Liege
(Belgium)
50.66445° N
5.59276° E
Roo o a esiden ial building in a
subu b a ea; limi ed iew.
25 Augus 2022–
–19 Sep embe 2022
17.8 14,088 6609
G az
(Aus ia)
47.07049° N
15.44506° E
Enclosed balcony o a his o ical
building in he ci y cen e ; indoo .
26 Oc obe 2022–
–29 No embe 2022
26.3 6225 3215
Vienna
(Aus ia)
48.19666° N
16.37101° E
Roo o a uni e si y building in he
ci y cen e ; clea iew.
1 Decembe 2022–
–4 Janua y 2023 34.1 72,892 58,330
B no
(Czechia)
49.22685° N
16.57536° E
Roo o a uni e si y building in a
subu b a ea; clea iew.
16 Feb ua y 2023–
–30 Ma ch 2023 42.0 46,467 30,937
Ideal placemen o he sni e in Vienna and B no is e iden in he dis ibu ion o he
numbe o packe s ecei ed in uplink, downlink, and independen downlink (RX2), as
depic ed in Figu e 4. To accoun o a ying ime pe iods ac oss he da ase s, packe coun s
in all his og ams we e no malized o display he numbe o packe s pe day.
Senso s 2023,23, 7333 8 o 20
(a) (b)
(c) (d)
Figu e 4.
Dis ibu ion o LoRaWAN packe s o indi idual ecei e chains o packe s wi h alid,
in alid, and missing CRC in: (
a
) Liege da ase ; (
b
) G az da ase ; (
c
) Vienna da ase ; (
d
) B no da ase .
In Liege, he si e is p ima ily cha ac e ized by he downlink a ic—uncon i med
da a wi hou a checksum, pa icula ly on he RX2 channel. The G az da a also sugges
a subop imal sni e placemen , as he sni e p edominan ly cap u ed downlink signals
om ga eways (be e posi ioned han nodes). Consequen ly, mos o he ecei ed uplink
a ic was disca ded due o w ong checksums, as shown in Figu e 4.
4.1. Selec ed Resul s o Da a Pos -P ocessing
Despi e op imal sni e placemen in Vienna and B no, a highe numbe o packe s
was ecei ed in he downlink compa ed o he uplink. The dis ibu ion o alid LoRaWAN
message ypes is depic ed in Figu e 5. To de e mine he alidi y o eal LoRaWAN messages,
he CRC e i ica ion was applied a he physical LoRa packe le el, and packe heade s
we e checked o e o s. Payload checksums we e e i ied o he Class-B beacons.
Subop imal placemen in Liege and G az esul ed in he ecep ion o p edominan ly
downlink packe s. Class-B beacons we e obse ed in B no, Liege, and Vienna. In some in-
s ances, pa icula ly in Liege, hese beacons also con eyed addi ional in o ma ion ega ding
he geog aphic posi ion o he ga eway.
The Vienna da ase can be conside ed a ep esen a i e sou ce o da a. The his og ams
in Figu e 6demons a e he iden i ied ansmission pa ame e s. Sp eading ac o s SF7 and
SF12 a e dominan , wi h a coding a e o 4/5 equi ed by he s anda d [
24
]. Channels a e
occupied almos uni o mly (excep o he 867.5 MHz equency), and mos packe s a e
ela i ely sho , wi h leng hs o 12–19 by es in he downlink and 20–40 by es in he uplink.
The Recei ed Signal S eng h Indica o (RSSI) and he SNR con i m he supe io placemen
o ga eways compa ed o nodes in e ms o adio co e age.
Senso s 2023,23, 7333 9 o 20
(a) (b)
Figu e 5.
LoRaWAN message ypes: Join Reques , Join Accep , Uncon i med/Con i med Da a
Up/Down, RFU, P op ie a y, and Class-B Beacon in: (a) Vienna da ase ; (b) B no da ase .
Table 4shows he pe cen age o a ic wi h decla ed Adap i e Da a Ra e (ADR)
suppo om end de ices (ex ac ed om uplink ames) and ne wo k se e s ( om
downlink ames), decla ed end de ice Class-B suppo , and he pe cen age o downlink
messages con aining alid payload CRC.
Table 4.
Suppo o ADR and Class-B ea u es along wi h he occu ence o payload CRC in downlink
messages ound in cap u ed LoRaWAN messages.
Loca ion Ga eway Packe s wi h
ADR Suppo
End De ice Packe s
wi h ADR Suppo
End De ice Packe s
wi h Class-B Suppo
Downlink Messages
wi h Payload CRC
Liege (Belgium) 3.9% 79.8% 2.3% 1.2%
G az (Aus ia) 99.7% 57.4% 34.1% 99.7%
Vienna (Aus ia) 79.2% 83.6% 1.4% 81.9%
B no (Czechia) 96.6% 86.6% 0.0% 99.3%
ADR is a ea u e ha op imizes he da a a e, ansmission powe , and ai ime o
end de ices based on hei connec i i y condi ions [
5
]. In uplink ames, he ADR lag
se by he end de ice indica es i s suppo o he ADR ea u e and eques s he ne wo k
se e o manage i s da a a e and ansmission powe se ings. When he ADR bi is se
in a downlink ame, i in o ms he end de ice ha he ne wo k se e can send ADR
commands. The ClassB lag in he uplink packe heade indica es o he ne wo k se e ha
he end de ice ac i a ed Class-B mode and is eady o ecei e scheduled downlink pings.
In acco dance wi h he LoRaWAN s anda d, uplink and downlink packe s a e dis in-
guished by he p esence o payload CRC. While payload CRC is manda o y in he uplink
packe s, he s anda d does no equi e i in he downlink, allowing o educed ai ime and
associa ed du y cycle o ga eway ansmissions [
5
]. Howe e , he obse ed da a indica e
ha , aside om he Liege si e, payload CRC is appended in he downlink by he majo i y
o LoRaWAN ga eways.
Senso s 2023,23, 7333 16 o 20
Rejec ion Ra io (IMRR) o he adio on ends ound in LoRaWAN ga eways and he sni e .
An example o his can be iden i ied in packe s #306 and #307 in he B no da ase , wi h he
key cha ac e is ics depic ed in Figu e 11.
F ame 306: 62 by es cap u ed (496 bi s)
Epoch Time: 1676538576.498914000 seconds
S c: b8:27:eb:a :ac:00:00:02
Flags: 0x0a, IQ In e ed, Checksum: CRC OK
F equency: 867300000 Hz
Cu en RSSI: -112 dBm
SNR: -12.0 dB
Message ype: Uncon i med Da a Up
F ame Payload: 0a79b794613ecd1c1d34b251 066
F ame 307: 62 by es cap u ed (496 bi s)
Epoch Time: 1676538576.498908000 seconds
S c: b8:27:eb:a :ac:00:00:01
Flags: 0x08, Checksum: CRC OK
F equency: 867700000 Hz
Cu en RSSI: -59 dBm
SNR: 10.5 dB
Message ype: Uncon i med Da a Up
F ame Payload: 0a79b794613ecd1c1d34b251 066
Figu e 11. Duplica e packe s wi h di e en chi p pola i ies in he B no da ase .
The packe s we e ecei ed almos simul aneously, wi h a negligible 6
µ
s di e ence.
F ame #307 is a alid uplink ansmission wi h a signal s eng h o
−
59 dBm and a non-
in e ed chi p. Gi en a ecei ed equency o 867.7 MHz and a on end cen e equency
o 867.5 MHz (as shown in Table 1), we can an icipa e a mi o signal a 867.3 MHz. This
is con i med by ame #306, which has a signal s eng h o
−
112 dBm. The di e ence o
53 dB co esponds o he IMRR alue o he SX1257 on end employed in he sni e .
Due o he signal spec um in e sion, such in alid packe s can be easily iden i ied by
he in e ed chi p lag, because da a ma ked as uplink in he LoRaWAN heade should no
be de ec ed by he downlink sni e . To ensu e da a accu acy, hese packe s we e il e ed
ou du ing p ocessing. The desc ibed beha io could po en ially o e shadow a legi ima e
weak packe a he mi o equency. Howe e , he likelihood o i s occu ence is almos
negligible, gi en he low usage o he channels.
4.8. In alid LoRaWAN T a ic wi h Valid Checksum
LoRa packe s a he PHY laye con ain a Synch oniza ion Wo d (SyncWo d), which
se es o di e en ia e he con en s o he ollowing payload. The use o he SyncWo d can
be con using due o limi ed in o ma ion om he manu ac u e .
Sem ech ecommends only wo SyncWo d alues: 0x12 o p i a e ne wo ks, and
0x34 o public/LoRaWAN ne wo ks [
41
,
43
]. Documen s om he LoRaWAN Alliance [
24
]
and ce ain sou ce codes [
30
] imply ha SyncWo d 0x34 is designa ed o all ne wo ks
u ilizing he LoRaWAN p o ocol a he MAC laye . This in e p e a ion sugges s ha
bo h publicly and p i a ely designed ne wo ks ollowing he LoRaWAN s anda d should
employ SyncWo d 0x34. The p i a e SyncWo d 0x12 appea s o be ese ed o de ices
u ilizing LoRa modula ion a he PHY laye wi hou engaging he LoRaWAN MAC laye .
The SyncWo d se ing is c ucial o bo h modula ion and demodula ion, as he ecei e
does no accep packe s ansmi ed wi h a di e en SyncWo d [
44
]. This issue is no
me ely abou disca ding packe s in he case o a misma ch; i a ises om he inabili y o
synch onize on he p eamble–SyncWo d pai [45].
All da ase s con ain packe s wi h e o s ha he LoRaWAN dissec o canno decode.
The Liege da ase includes a signi ican numbe o in alid packe s (4.7% o he o al).
In alid packe s a e iden i ied by dissec o e o s o in alid MAC heade en ies, which
include a non-ze o Rese ed o Fu u e Use (RFU) ield and a Majo e sion ha is no
equal o R1.
Recei ing an in alid LoRaWAN packe can be a ibu ed o a miscon igu a ion o he
LoRa ansmi e , which uses a cus om payload o packe s se wi h a public SyncWo d. The
co ec app oach would be o use a dedica ed p i a e SyncWo d, which appea s o be he
issue occu ing in he Liege da ase . Ano he possibili y in ol es accep ing in alid packe s
ha a e e oneously e alua ed as alid due o a ious ac o s. This could be a ibu ed
o he limi ed eliabili y o he 16-bi payload CRC [
41
], which may occasionally ail o
iden i y packe co up ion, o i could be due o he unwan ed accep ance o packe s wi h a
p i a e SyncWo d.

Senso s 2023,23, 7333 17 o 20
The SyncWo d issue was in es iga ed in he In e OP p ojec ATCZ175 [
46
], and i s
esul s indica e a ela i ely low capabili y o he ga eway o il e packe s based on Sync-
Wo d. The success a e o ecei ing a p i a e SyncWo d packe when he ga eway is se o
he public SyncWo d depends on he signal s eng h and he SF used, wi h he possibili y
o eaching up o 10%. Consequen ly, any a ic wi h a p i a e SyncWo d may lead o he
obse a ion o in alid packe s in sni e da ase s.
4.9. Class-B Beacons as a Timebase Sou ce
Class-B beacons in LoRaWAN ne wo ks ha e he po en ial o se e as al e na i e
imebase sou ce in u ban en i onmen s. Beacon ecei e s ypically lock wi hin 128 seconds,
p o iding excellen long- e m s abili y, as hei iming is usually de i ed om a GNSS
ecei e . Acco ding o he LoRaWAN s anda d, beacon iming is accu a e wi hin
±
1
µ
s,
while measu emen s aken by he sni e wi hou u he op imiza ions e ealed an accu acy
o
±
5
µ
s. This accu acy is u he educed by he wi eless p opaga ion delay—e e y 300 m
o dis ance ep esen s an addi ional 1 µs o se .
Compa ed o GNSS, Class-B beacons can be ecei ed indoo s, making hem sui able
o ime synch oniza ion in buildings and o he s uc u es whe e GNSS signals a e weak o
una ailable. Unlike GNSS, Class-B beacons do no equi e a clea iew o he sky, enhancing
hei eliabili y in u ban en i onmen s whe e all buildings, ees, o o he obs acles migh
obs uc GNSS signals.
Class-B beacons also o e se e al bene i s compa ed o he DCF77, a Long-Wa e (LW)
ime signal b oadcas om Ge many. They exhibi high immuni y o noise, making hem
mo e eliable in u ban en i onmen s whe e speci ic ypes o RF in e e ence a e common,
e.g., he LW in e e ence a ec ing DCF77 signals. Class-B beacon ecei e s can use small,
cheap an ennas, lowe ing he o e all cos and making hem mo e accessible o a wide
ange o applica ions. Mo eo e , Class-B beacons ha e a simila lock speed o DCF77, wi h
a lock ime o up o 128 seconds compa ed o DCF77’s ypical lock ime o 2–3 minu es [
47
].
Compa ed o NTP, Class-B beacons do no equi e an in e ne connec ion o ime
synch oniza ion, making hem sui able o en i onmen s wi h limi ed o no in e ne ac-
cess. This independence om in e ne connec ions makes Class-B beacons a compelling
al e na i e o a ious applica ions.
To u he enhance he lock ime, a mul ichannel (e.g., SDR-based) de ice may lis en
o Class-A downlink a ic, which may con ain he De iceTimeAns ime command in i s
unenc yp ed MAC heade . Despi e he limi ed accu acy o
±
100 ms as de ined in [
5
], his
may allow o a coa se lock. The lis ening de ice can also de i e he ime window o Class-
B beacon ecep ion om his in o ma ion, po en ially educing con inuous ecei e ime.
Howe e , his p oposed ime synch oniza ion may encoun e di icul ies i nea by
ga eways ansmi beacons ha iola e he LoRaWAN s anda d. Such issues ha e al eady
been obse ed in he Vienna and B no egions, as p e iously discussed. Cu en ly, no
me hod exis s o e i y he au hen ici y o a ecei ed beacon. Mo eo e , due o he ha sh
RF en i onmen , beacons may be dis up ed by a wide-band UHF in e e ence, esul ing in
decoding e o s and signi ican ly longe lock ime.
Despi e hese challenges, by le e aging he bene i s o Class-B beacons, ime syn-
ch oniza ion in u ban en i onmen s can be signi ican ly imp o ed. The indoo ecep ion
capabili ies, noise immuni y, cos e ec i eness, and independence om sa elli e a ailabil-
i y and in e ne connec ions make Class-B beacons an a ac i e al e na i e o exis ing
ime synch oniza ion me hods, p o ided ha he associa ed disad an ages can be e ec-
i ely managed.
5. Conclusions
In his s udy, we c ea ed an ex ensi e, publicly a ailable da ase encompassing com-
ple e LoRaWAN a ic om ou Eu opean ci ies. This da ase enabled igo ous examina-
ion o eal-wo ld LoRaWAN ne wo k unc ionali y. Ou analysis e ealed secu i y and
sys em challenges, which include:
Senso s 2023,23, 7333 18 o 20
•
in alid Class-B beacon packe s, which pose a signi ican synch oniza ion issue and
a e likely o cause andom Class-B ne wo k p oblems;
•
de aul enc yp ion keys om Sem ech and Milesigh in exis ing LoRaWAN ins alla-
ions, which pose a secu i y isk;
•
end de ices iola ing he du y cycle limi a ion o EU868 sub-bands, which could
po en ially deg ade he quali y o se ice o o he wi eless de ices.
We enhanced Wi esha k’s LoRaWAN p o ocol dissec o o accu a ely decode eco ded
a ic, including da a and MAC command dec yp ion o packe s wi h known keys. These
imp o emen s a e now publicly accessible. Addi ionally, we p oposed he use o Class-B
beacons as a imebase sou ce in u ban en i onmen s.
Fu u e esea ch should inco po a e da ase s om a b oade ange o loca ions o
enhance unde s anding o LoRaWAN ne wo ks. Addi ionally, add essing he issues ela ed
o in alid Class-B beacons is a c i ical nex s ep. Class-B de ices cu en ly allow he allback
o Class-A when hey expe ience di icul ies in acking he beacon. Howe e , his depends
on he speci ic de ice implemen a ion, since he documen a ion only sugges s an ini ial
non-speci ic synch oniza ion [5,40].
Valida ing ecei ed beacons emains a challenge. The beacon payload may con ain
an op ional ne wo k/ga eway iden i ica ion. Howe e , o he bes o ou knowledge, no
beacon il e ing implemen a ion has been in oduced ye . Ano he app oach could in ol e
ansmi ing he ini ial synch oniza ion o e a secu e channel, speci ically wi hin a unicas
packe wi h a MIC signa u e. This me hod can be employed o acqui e he co ec Class-B
beacon. While a solu ion ha u ilizes he De iceTimeAns command o acqui e coa se ime
has been implemen ed, i s use emains op ional.
Au ho Con ibu ions:
Concep ualiza ion, A.P. and J.K.; me hodology, A.P. and J.K.; so wa e, A.P.
and O.K.; alida ion, A.P., O.K. and M.N.; o mal analysis, A.P.; in es iga ion, A.P.; esou ces, J.K.,
H.A. and M.N.; da a cu a ion, A.P.; w i ing—o iginal d a p epa a ion, A.P.; w i ing— e iew and
edi ing, A.P., J.K. and H.A.; isualiza ion, A.P.; supe ision, J.K. and H.A.; p ojec adminis a ion,
A.P. and J.K.; unding acquisi ion, J.K. All au ho s ha e ead and ag eed o he published e sion o
he manusc ip .
Funding:
This esea ch was suppo ed by he In e nal G an Agency o B no Uni e si y o Technology
unde p ojec no. FEKT-S-23-8191. The da ase was c ea ed wi h he suppo o he Technology Agency
o he Czech Republic unde g an ag eemen no. TK04020173.
Ins i u ional Re iew Boa d S a emen : No applicable.
In o med Consen S a emen : No applicable.
Da a A ailabili y S a emen :
The da a p esen ed in his s udy a e openly a ailable on Zenodo a
10.5281/zenodo.8090619, e e ence numbe [6].
Acknowledgmen s:
Du ing he p epa a ion o his wo k, he au ho s u ilized Cha GPT o help e ine
language and s yle. A e using his se ice, he au ho s e iewed and edi ed he pape as necessa y,
and hey ake ull esponsibili y o he con en o he publica ion.
Con lic s o In e es : The au ho s decla e no con lic o in e es .
Senso s 2023,23, 7333 19 o 20
Re e ences
1.
Sem ech. LoRa
®
and LoRaWAN
®
: A Technical O e iew. A ailable online: h ps://lo a-de elope s.sem ech.com/uploads/
documen s/ iles/LoRa_and_LoRaWAN-A_Tech_O e iew-Downloadable.pd (accessed on 12 July 2023).
2. Raza, U.; Kulka ni, P.; Soo iyabanda a, M. Low Powe Wide A ea Ne wo ks: An O e iew. IEEE Commun. Su . Tu o ials 2017,
19, 855–873. [C ossRe ]
3.
Haxhibeqi i, J.; De Poo e , E.; Moe man, I.; Hoebeke, J. A Su ey o LoRaWAN o IoT: F om Technology o Applica ion. Senso s
2018,18, 3995. [C ossRe ] [PubMed]
4.
Sem ech. AN1200.22 LoRa
™
Modula ion Basics. A ailable online: h ps://www.sem ech.com/p oduc s/wi eless- /lo a-
connec /sx1276 (accessed on 2 May 2023).
5.
LoRa Alliance. TS001-1.0.4 LoRaWAN
®
L2 1.0.4 Speci ica ion. A ailable online: h ps://lo a-alliance.o g/ esou ce_hub/ s001-1
-0-4-lo awan-l2-1-0-4-speci ica ion/ (accessed on 2 May 2023).
6.
Po alac, A.; K al, J. LoRaWAN T a ic Analysis Da ase . Ve sion 2. Zenodo. 2023. A ailable online: h ps://zenodo.o g/ eco d/
8090619 (accessed on 16 Augus 2023).
7.
Bha ia, L.; B eza, M.; Ma ie ici, R.; McCann, J.A. LoED: The LoRaWAN a he Edge Da ase : Da ase . In P oceedings o he Thi d
Wo kshop on Da a: Acquisi ion To Analysis, New Yo k, NY, USA, 16–19 No embe 2020; DATA ’20, pp. 7–8. [C ossRe ]
8.
Ae nou s, M.; Be k ens, R.; Van Vlaende en, K.; Weyn, M. Sig ox and LoRaWAN Da ase s o Finge p in Localiza ion in La ge
U ban and Ru al A eas. Da a 2018,3, 13. [C ossRe ]
9.
Blenn, N.; Kuipe s, F. LoRaWAN in he Wild: Measu emen s om The Things Ne wo k. a Xi
2017
, a Xi :1706.03086. h ps:
//doi.o g/10.48550/a Xi .1706.03086.
10.
Choi, K.N.; Kolamunna, H.; Uyanwa a, A.; Thilaka a hna, K.; Sene i a ne, S.; Holz, R.; Hassan, M.; Zomaya, A.Y. LoRada : LoRa
Senso Ne wo k Moni o ing h ough Passi e Packe Sni ing. SIGCOMM Compu . Commun. Re . 2020,50, 10–24. [C ossRe ]
11.
Po alac, A. LoRaWAN T a ic Analysis Tools. A ailable online: h ps://gi hub.com/alpo /lo awan-sni e (accessed on 10 May 2023).
12.
Spadaccino, P.; C inó, F.G.; Cuomo, F. LoRaWAN Beha iou Analysis h ough Da ase T a ic In es iga ion. Senso s
2022
,22,
2470. [C ossRe ] [PubMed]
13.
Ruo salainen, H.; Shen, G.; Zhang, J.; Fujdiak, R. LoRaWAN Physical Laye -Based A acks and Coun e measu es, A Re iew.
Senso s 2022,22, 3127. [C ossRe ] [PubMed]
14.
B oxson, J. Fea he TFT LoRa Sni e . A ailable online: h ps://gi hub.com/Imp obableS udios/Fea he _TFT_LoRa_Sni e
(accessed on 2 May 2023).
15.
B a o-Mon oya, A.F.; Rondón-Sanab ia, J.S.; Gaona-Ga cía, E.E. De elopmen and Tes ing o a Real-Time LoRawan Sni e Based
on GNU-Radio. TecnoLógicas 2019,22, 130–139. [C ossRe ]
16.
Robyns, P.; Quax, P.; Lamo e, W.; Thenae s, W. A Mul i-Channel So wa e Decode o he LoRa Modula ion Scheme. In
P oceedings o he 3 d In e na ional Con e ence on In e ne o Things, Big Da a and Secu i y, Funchal, Po ugal, 19–21 Ma ch
2018; pp. 41–51. [C ossRe ]
17.
Ma que , A.; Mon a on , N.; Papadopoulos, G.Z. Towa ds an SDR implemen a ion o LoRa: Re e se-enginee ing, demodula ion
s a egies and assessmen o e Rayleigh channel. Compu . Commun. 2020,153, 595–605. [C ossRe ]
18.
Tappa el, J.; A isiadis, O.; Mayo az, P.; Bala soukas-S imming, A.; Bu g, A. An Open-Sou ce LoRa Physical Laye P o o ype
on GNU Radio. In P oceedings o he 2020 IEEE 21s In e na ional Wo kshop on Signal P ocessing Ad ances in Wi eless
Communica ions (SPAWC), A lan a, GA, USA, 26–29 May 2020; pp. 1–5. [C ossRe ]
19.
Sil a, F.S.D.; Ne o, E.P.; Oli ei a, H.; Rosá io, D.; Ce quei a, E.; Bo h, C.; Zeadally, S.; Ne o, A.V. A Su ey on Long-Range
Wide-A ea Ne wo k Technology Op imiza ions. IEEE Access 2021,9, 106079–106106. [C ossRe ]
20. Ma ais, J.M.; Malekian, R.; Abu-Mah ouz, A.M. E alua ing he LoRaWAN P o ocol Using a Pe manen Ou doo Tes bed. IEEE
Sens. J. 2019,19, 4726–4733. [C ossRe ]
21.
Fujdiak, R.; Mikhaylo , K.; Pospisil, J.; Po alac, A.; Misu ec, J. Insigh s in o he Issue o Deploying a P i a e LoRaWAN. Senso s
2022,22, 2024. [C ossRe ] [PubMed]
22.
Rami ez, C.G.; Dyusseno a, A.; Se geye , A.; Iannucci, B. LongShoT: Long-Range Synch oniza ion o Time. In P oceedings o he
2019 18 h ACM/IEEE In e na ional Con e ence on In o ma ion P ocessing in Senso Ne wo ks (IPSN), Mon eal, QC, Canada,
16–18 Ap il 2019; pp. 289–300. [C ossRe ]
23.
Rizzi, M.; Depa i, A.; Fe a i, P.; Flammini, A.; Rinaldi, S.; Sisinni, E. Synch oniza ion Unce ain y Ve sus Powe E iciency in
LoRaWAN Ne wo ks. IEEE T ans. Ins um. Meas. 2019,68, 1101–1111. [C ossRe ]
24.
LoRa Alliance. RP002-1.0.3 LoRaWAN
®
Regional Pa ame e s. A ailable online: h ps://lo a-alliance.o g/ esou ce_hub/ p2-1-0
-3-lo awan- egional-pa ame e s/ (accessed on 2 May 2023).
25.
ETSI EN 300 220-2 V3.2.1: Sho Range De ices (SRD) Ope a ing in he F equency Range 25 MHz o 1 000 MHz; Pa 2:
Ha monised S anda d o Access o Radio Spec um o Non Speci ic Radio Equipmen . A ailable online: h ps://www.e si.o g/
deli e /e si_en/300200_300299/30022002/03.02.01_60/en_30022002 030201p.pd (accessed on 4 May 2023).
26.
The Things Ne wo k. LoRaWAN F equency Plans. A ailable online: h ps://www. he hingsne wo k.o g/docs/lo awan/
equency-plans/ (accessed on 2 May 2023).
27.
IMST GmbH. WiMOD iC880A Da ashee . A ailable online: h ps://wi eless-solu ions.de/download ile/ic880a-spi-documen s/
(accessed on 2 May 2023).
Senso s 2023,23, 7333 20 o 20
28.
Sem ech. SX1301: LoRa Co e
™
Digi al Baseband Chip o Ou doo LoRaWAN
®
Ne wo k Mac o Ga eways. A ailable online:
h ps://www.sem ech.com/p oduc s/wi eless- /lo a-co e/sx1301 (accessed on 2 May 2023).
29.
Sem ech. SX1257: LoRa Co e
™
Low Powe Digi al I and Q RF Mul i-PHY Mode Analog F on End 860-1000MHz. A ailable
online: h ps://www.sem ech.com/p oduc s/wi eless- /lo a-co e/sx1257 (accessed on 2 May 2023).
30. Sem ech. LoRa Ga eway P ojec . A ailable online: h ps://gi hub.com/Lo a-ne /lo a_ga eway (accessed on 2 May 2023).
31.
Sem ech. LoRa Ne wo k Packe Fo wa de P ojec . A ailable online: h ps://gi hub.com/Lo a-ne /packe _ o wa de (accessed
on 2 May 2023).
32.
De Jong, E. LoRaTap: Encapsula ion Fo ma o be Used o S o e LoRa T a ic in Pcap Files. A ailable online: h ps://gi hub.com/
e iknl/LoRaTap (accessed on 2 May 2023).
33.
Wi esha k. Au oma ed Builds. A ailable online: h ps://www.wi esha k.o g/download/au oma ed/win64/ (accessed on
19 June 2023).
34.
LoRa Alliance. TS002-1.1.0 LoRaWAN Backend In e aces Speci ica ion. A ailable online: h ps://lo a-alliance.o g/ esou ce_
hub/ s002-110-lo awan-backend-in e aces/ (accessed on 2 May 2023).
35.
LoRa Alliance. Ne ID Alloca ion. A ailable online: h ps://lo a-alliance.o g/wp-con en /uploads/2022/06/LoRa-Alliance-
Ne ID-Alloca ion-1.pd (accessed on 2 May 2023).
36.
IEEE S anda ds Associa ion. Guidelines o Use o EUI, OUI, and CID. A ailable online: h ps://s anda ds.ieee.o g/wp-con en /
uploads/impo /documen s/ u o ials/eui.pd (accessed on 3 May 2023).
37. Hu, Y.H. LoRa Ai -Time Calcula o . A ailable online: h ps://gi hub.com/i TNT/lo a-ai - ime (accessed on 2 May 2023).
38. Lewandowski, W.; A ias, E.F. GNSS imes and UTC. Me ologia 2011,48, S219. [C ossRe ]
39.
NIST. Leap Second and UT1-UTC In o ma ion. A ailable online: h ps://www.nis .go /pml/ ime-and- equency-di ision/
ime- ealiza ion/leap-seconds (accessed on 2 May 2023).
40.
Sem ech. An In-Dep h Look a LoRaWAN
®
Class B De ices. A ailable online: h ps://lo a-de elope s.sem ech.com/uploads/
documen s/ iles/LoRaWAN_Class_B_De ices_In_Dep h_Downloadable.pd (accessed on 26 May 2023).
41.
Sem ech. SX1272: Long Range, Low Powe RF T anscei e 860-1000MHz wi h LoRa
®
Technology. A ailable online: h ps:
//www.sem ech.com/p oduc s/wi eless- /lo a-connec /sx1272 (accessed on 2 May 2023).
42.
Milesigh . 3D ToF People Coun ing Senso Use Manual. A ailable online: h ps://www.milesigh .com/s a ic/ ile/en/
download/da ashee /3d- o /Milesigh -3D-ToF-People-Coun ing-Senso -Use -Manual-en.pd (accessed on 4 May 2023).
43.
Sem ech. SX1261: LoRa Connec
™
Long Range Low Powe LoRa
®
RF T anscei e +15 dBm, Global F equency Co e age.
A ailable online: h ps://www.sem ech.com/p oduc s/wi eless- /lo a-connec /sx1261 (accessed on 2 May 2023).
44.
Haxhibeqi i, J.; Van den Abeele, F.; Moe man, I.; Hoebeke, J. LoRa Scalabili y: A Simula ion Model Based on In e e ence
Measu emen s. Senso s 2017,17, 1193. [C ossRe ] [PubMed]
45. Selle , O.B.; So nin, N. Low Powe Long Range T ansmi e . Pa en US9252834B2, 2 Feb ua y 2016.
46.
ATCZ175 In e OP. P i a e/Public-Syncwo d C oss alk. A ailable online: h ps://www.in e eg-in e op.eu/ esul s/lo awan/
p i a epublic_syncwo d_c oss alk/index.h ml (accessed on 2 May 2023).
47.
Engele , D. Pe o mance analysis and ecei e a chi ec u es o DCF77 adio-con olled clocks. IEEE T ans. Ul ason. Fe oelec .
F eq. Con ol 2012,59, 869–884. [C ossRe ] [PubMed]
Disclaime /Publishe ’s No e:
The s a emen s, opinions and da a con ained in all publica ions a e solely hose o he indi idual
au ho (s) and con ibu o (s) and no o MDPI and/o he edi o (s). MDPI and/o he edi o (s) disclaim esponsibili y o any inju y o
people o p ope y esul ing om any ideas, me hods, ins uc ions o p oduc s e e ed o in he con en .