Exploring LoRaWAN Traffic: In-Depth Analysis of IoT Network Communications

Ci a ion: Po alac, A.; K al, J.; A habe , H.; Kola , O.; No ak, M. Explo ing LoRaWAN T a ic: In-Dep h Analysis o IoT Ne wo k Communica ions. Senso s 2023,23, 7333. h ps://doi.o g/10.3390/ s23177333 Academic Edi o : Gianluigi Fe a i Recei ed: 29 June 2023 Re ised: 21 July 2023 Accep ed: 17 Augus 2023 Published: 22 Augus 2023 Copy igh : © 2023 by he au ho s. Licensee MDPI, Basel, Swi ze land. This a icle is an open access a icle dis ibu ed unde he e ms and condi ions o he C ea i e Commons A ibu ion (CC BY) license (h ps:// c ea i ecommons.o g/licenses/by/ 4.0/). senso s A icle Explo ing LoRaWAN T a ic: In-Dep h Analysis o IoT Ne wo k Communica ions Ales Po alac 1,* , Jan K al 1, Holge A habe 2, Ond ej Kola 1and Ma ek No ak 1 1Facul y o Elec ical Enginee ing and Communica ion, B no Uni e si y o Technology, Technicka 12, 61600 B no, Czech Republic; [email p o ec ed] (J.K.); [email p o ec ed] (O.K.); [email p o ec ed] (M.N.) 2Ins i u e o Elec odynamics, Mic owa e and Ci cui Enginee ing, TU Wien, Gusshauss asse 25/354, 1040 Vienna, Aus ia; holge [email p o ec ed] *Co espondence: [email p o ec ed] Abs ac : In he pas decade, Long-Range Wi e-A ea Ne wo k (LoRaWAN) has eme ged as one o he mos widely adop ed Low Powe Wide A ea Ne wo k (LPWAN) s anda ds. Signi ican e o s ha e been de o ed o op imizing he ope a ion o his ne wo k. Howe e , esea ch in his domain hea ily elies on simula ions and demands high-quali y eal-wo ld a ic da a. To add ess his need, we moni o ed and analyzed LoRaWAN a ic in ou Eu opean ci ies, making he ob ained da a and pos -p ocessing sc ip s publicly a ailable. Fo moni o ing pu poses, we de eloped an open-sou ce sni e capable o cap u ing all LoRaWAN communica ion wi hin he EU868 band. Ou analysis disco e ed signi ican issues in cu en LoRaWAN deploymen s, including iola ions o undamen al secu i y p inciples, such as he use o de aul and exposed enc yp ion keys, po en ial b eaches o spec um egula ions including du y cycle iola ions, SyncWo d issues, and misaligned Class-B beacons. This misalignmen can ende Class-B unusable, as he beacons canno be alida ed. Fu he mo e, we enhanced Wi esha k’s LoRaWAN p o ocol dissec o o accu a ely decode eco ded a ic. Addi ionally, we p oposed he passi e ecep ion o Class-B beacons as an al e na i e imebase sou ce o de ices ope a ing wi hin LoRaWAN co e age unde he assump ion ha he issue o misaligned beacons can be add essed o mi iga ed in he u u e. The iden i ied issues and he published da ase can se e as aluable esou ces o esea che s simula ing eal-wo ld a ic and o he LoRaWAN Alliance o enhance he s anda d o acili a e mo e eliable Class-B communica ion. Keywo ds: IoT; LoRa; LoRaWAN; Class-B; da ase ; ne wo k sni e ; a ic moni o ing; ime synch oniza ion 1. In oduc ion The In e ne o Things (IoT) has e olu ionized he way we in e ac wi h ou en i- onmen , enabling a wide ange o applica ions om sma ci ies o indus ial au oma ion. Low Powe Wide A ea Ne wo ks (LPWANs) ha e eme ged as key echnology o IoT, p o iding a balance be ween low powe consump ion and long- ange communica ion. Long-Range Wi e-A ea Ne wo k (LoRaWAN), a popula LPWAN echnology, is based on he Long-Range (LoRa) physical laye and p o ides ea u es such as adap i e da a a es, bidi ec ional communica ion, and a ious de ice classes, making i sui able o di e en use cases. Gi en he limi ed Radio F equency (RF) powe o 25 mW, LoRaWAN acili a es a communica ion dis ance o up o 5 km in u ban a eas [ 1 ]. These di e se capabili ies ha e led o widesp ead adop ion ac oss a ious indus ies, es ablishing i as a i al componen in he g owing IoT ecosys em [2,3]. The LoRa Physical (PHY) laye employs a unique modula ion echnique known as Chi p Sp ead Spec um (CSS). CSS acili a es long- ange communica ion and obus ness agains na ow-band in e e ence by sp eading he in o ma ion signal o e a wide band- wid h [ 4 ]. Abo e his, he LoRaWAN Medium Access Con ol (MAC) laye p o ides a s anda dized p o ocol o IoT de ices [5]. Senso s 2023,23, 7333. h ps://doi.o g/10.3390/s23177333 h ps://www.mdpi.com/jou nal/senso s Senso s 2023,23, 7333 2 o 20 LoRaWAN ea u es h ee dis inc de ice classes—A, B, and C—add essing di e en applica ion equi emen s and powe cons ain s [ 5 ]. Class-A de ices o e he highes ene gy e iciency, sui able o applica ions wi h in equen communica ion needs, wi h b ie ecei e windows a e each ansmission. Class-B de ices p o ide p edic able downlink communica ion la ency by synch onizing wi h ne wo k beacons and enabling scheduled ecei e slo s, main aining mode a e powe consump ion. Class-C de ices p io i ize down- link la ency o e powe e iciency, o e ing con inuous ecei e windows o nea eal- ime communica ion. End de ices use a andom access ansmission me hod (ALOHA), which allows hem communica ion wi hou he need o pai ing wi h a speci ic ga eway. Gi en he complexi y and di e se ope a ing condi ions o LoRaWAN, i is essen ial o gain insigh in o i s ac ual in e nal unc ionali y in eal deploymen s using ools o ne wo k communica ion analysis. To add ess his need, we de eloped a dedica ed ha d- wa e sni e —a specialized de ice designed o cap u e and decode wi eless a ic. In he con ex o LoRaWAN, his sni e can be used o collec a da ase and subsequen ly in es iga e a ious aspec s o he ne wo k, such as signal s eng h, co e age, da a a es, and communica ion p o ocols. These insigh s can help iden i y po en ial issues, e alua e ne wo k deploymen s, and op imize con igu a ions o be e pe o mance. To p o ide he g ea es lexibili y in analyzing he eco ded packe s, we selec ed Wi esha k—a widely ecognized open-sou ce ne wo k p o ocol analyze . Ou esea ch is guided by se e al key ques ions ela ed o he da ase . Fi s ly, we aim o de e mine which in o ma ion can be ex ac ed om cap u ed eal-wo ld a ic wi hin a LoRaWAN ne wo k, wi h pa icula a en ion o downlink a ic and Class-B beacons. Fu he mo e, we in es iga e how Class-B beacons and hei op ional ex ensions a e used in ac ual ins alla ions. I is also c ucial o assess whe he secu i y and spec um egula ions a e ollowed in cu en LoRaWAN deploymen s. Ano he key aspec o ou esea ch is o examine he accu acy and eliabili y o ime synch oniza ion in LoRaWAN, no ably ega ding he Class-B beacons, and hei suscep ibili y o in e e ence and miscon igu a ion. Finally, we explo e he po en ial o new applica ions o Class-B beacons. Con ibu ion o This Wo k We collec ed and analyzed a la ge da ase [ 6 ] o eal-wo ld LoRaWAN a ic om ou Eu opean loca ions. Unlike p e ious da ase s [ 7 – 10 ], ou collec ion includes uplink, downlink, and Class-B a ic. In he Resul s and Discussion sec ion, we p esen an anal- ysis ha encompasses he Class-B beacons and highligh s po en ial issues o LoRaWAN deploymen s. To ob ain his da ase , we used a cus om LoRaWAN ha dwa e sni e . Bo h he ha d- wa e and so wa e sou ces o his de ice a e a ailable online [ 11 ]. Recognizing he ou da ed LoRaWAN p o ocol suppo in Wi esha k, we enhanced i s capabili ies o decoding eal- wo ld a ic. These imp o emen s a e inco po a ed in o he Wi esha k de elopmen b anch and a e now publicly accessible. Fu he mo e, we p oposed an inno a i e app oach o using Class-B beacons as a imebase sou ce in u ban en i onmen s. This me hod o e s se e al ad an ages o e al e na i e ime sou ces such as Global Na iga ion Sa elli e Sys em (GNSS), DCF77, and Ne wo k Time P o ocol (NTP), including be e indoo ecep ion, smalle and mo e cos - e ec i e an ennas, and independence om in e ne connec i i y. Hence, he main con ibu ions o his wo k a e as ollows: • i desc ibes a no el LoRaWAN sni e wi h open ha dwa e design iles and so - wa e amewo k ha allows cap u ing all LoRaWAN a ic and i s examina ion in Wi esha k; • i p o ides a la ge public da ase wi h eal-wo ld a ic cap u ed in mul iple loca ions; • i analyzes he unenc yp ed pa o cap u ed packe s, p o iding insigh s in o ne wo k ope a o s, end de ice manu ac u e s, and LoRaWAN ea u e suppo ; • i p o ides an analysis o Class-B beacons ega ding p ecise iming and ga eway localiza ion; Senso s 2023,23, 7333 3 o 20 • i poin s ou o se e al iden i ied issues, like in alid Class-B beacons, comp omised enc yp ion keys, and in alid LoRaWAN a ic; • i p oposes he no el use o Class-B beacons as a imebase sou ce. 2. Rela ed Resea ch The IoT esea ch communi y ecognizes he signi icance o eal-wo ld, quan i a i e da a o s udying he ne wo k en i onmen s and deploymen s. Se e al LoRaWAN da ase s ha e been made a ailable [ 7 – 10 ]. Bha ia e al. [ 7 ] ga he ed uplink packe s om ga eways in he dense u ban en i onmen o London (UK). They included packe heade in o ma ion and PHY laye p ope ies epo ed by he ga eways, making he da ase one o he la ges and mos ex ensi e [ 12 ]. Ae nou s e al. [ 8 ] collec ed da a ocused on inge p in localiza ion in An we p (Belgium). Thei da ase con ains a la ge olume o aces wi h known end de ice posi ion. Blenn e al. [ 9 ] p esen ed an analysis o The Things Ne wo k (TTN), ob aining a da ase o packe s h ough he TTN Applica ion P og amming In e ace (API) using a known de aul ne wo k key. Howe e , hei indings we e cons ained o TTN uplink a ic due o i s API limi a ions. P esen ly, he acquisi ion o such da ase is no longe easible due o he e olu ion o he TTN backend. Choi e al. [10] de eloped LoRada , a passi e packe moni o ing ool, and conduc ed an analysis o a ic wi hin an anonymized ci y-wide a ea. Thei s udy closely esembles ou esea ch. Howe e , hey we e limi ed o moni o ing uplink sessions due o ha dwa e cons ain s. To he bes o ou knowledge, no p e ious s udy has a emp ed o cap u e bo h uplink and downlink simul aneously. An o e iew o he exis ing sni e s is p o ided in [ 13 ]. These sni e s a e limi ed o a single RF channel [ 14 ] o employ one mul ichannel concen a o [ 9 , 10 ]. They a e ei he based on a ga eway (concen a o ype) [ 9 , 10 ] o de eloped using he GNU adio (SDR- ype) [ 15 ]. So wa e-De ined Radios (SDRs) we e deemed unsui able due o high Signal- o-Noise Ra io (SNR) equi emen s [ 15 – 17 ]. Recen ly, an SDR-based demodula o compe i i e in SNR equi emen s was made a ailable [ 18 ]. Howe e , i s ill demodu- la es one equency and Sp eading Fac o (SF) pe block, equi ing o e 100 di e en ly con igu ed LoRa demodula o blocks o he in ended sni e unc ionali y, which is com- pu a ionally demanding. O he pape s ocus on simula ing a ious LoRaWAN issues (o e iew in [ 19 ]) and he deploymen o cus om expe imen al se ups (con olled en i onmen s o nodes and one o mul iple ga eways) [ 20 , 21 ]. Ou wo k ocuses on passi e moni o ing o eal-wo ld a ic, simila o [ 10 ], bu also includes an impo an s udy o downlink messages and Class-B beacons. Time synch oniza ion in LoRaWAN has been analyzed in se e al s udies, such as [22,23] . Rami ez e al. [ 22 ] achie ed an excellen ime e o below 10 µ s using a cus om p o ocol in a Class-A ne wo k. Rizzi e al. [ 23 ] employed a pos e io i synch oniza ion, enabling ime sync wi h an unce ain y in he o de o ens o milliseconds. No s udies ha e sugges ed passi e lis ening o Class-B beacons o ime synch oniza ion. 3. Sni e Design The sni e is based on comme cially a ailable modules, and i s so wa e is cus omized o cap u ing ne wo k a ic. I ope a es au onomously when connec ed o a powe sou ce, s o ing he collec ed eco ds locally and simul aneously ansmi ing hem o a se e o e he Long Te m E olu ion (LTE) modem. To o e come he limi a ions o cu en ly a ailable de ices, ou new sni e needs o cap u e all LoRaWAN a ic acco ding o he EU868 equency plan, including he RX2 channel [ 24 ]. This necessi a es suppo ing bo h uplink and downlink ecep ion, which di e in he chi p signal pola i y a he physical LoRa laye . Addi ionally, we aimed o ecei e Class-B beacons ansmi ed on RX2 channel wi h a non-in e ed chi p signal. The combina ions o hese pa ame e s a e summa ized in Table 1. Senso s 2023,23, 7333 4 o 20 Table 1. LoRaWAN EU868 equency plan wi h possible combina ions o LoRa pa ame e s [24–26]. T ansmission Kind F equency (MHz) Sp eading Fac o Uplink Signal Pola i y Downlink Signal Pola i y RX1 channel 1 868.5 −0.4 =868.1 SF7–SF12 non-in e ed in e ed RX1 channel 2 868.5 −0.2 =868.3 SF7–SF12 non-in e ed in e ed RX1 channel 3 868.5 SF7–SF12 non-in e ed in e ed RX1 channel 4 867.5 −0.4 =867.1 SF7–SF12 non-in e ed in e ed RX1 channel 5 867.5 −0.2 =867.3 SF7–SF12 non-in e ed in e ed RX1 channel 6 867.5 SF7–SF12 non-in e ed in e ed RX1 channel 7 867.5 +0.2 =867.7 SF7–SF12 non-in e ed in e ed RX1 channel 8 867.5 +0.4 =867.9 SF7–SF12 non-in e ed in e ed RX2 869.525 SF7–SF12 1– in e ed Class-B beacon 2869.525 SF9 – non-in e ed 1 SF12 o he LoRaWAN s anda d, SF9 o The Things Ne wo k [ 26 ]. The sni e suppo s all sp eading ac o s. 2Class-B beacons use implici heade mode wi h speci ic se ings [24]. The sni e is based on he indus y-s anda d IMST iC880A LoRaWAN concen a- o [ 27 ], a ha dwa e de ice designed o ecei ing and p ocessing LoRa signals in LoRaWAN ne wo k ga eways. The module is equipped wi h a Sem ech SX1301 digi al baseband chip [ 28 ] and wo Sem ech SX1257 RF on end chips [ 29 ], p o iding up o 10 p og ammable pa allel demodula ion pa hs. I suppo s mul iple LoRaWAN channels in he 868 MHz equency band, enabling he simul aneous ecep ion o da a om mul iple end de ices. Addi ionally, he module is also capable o pe o ming ime-s amping o incoming packe s, which is essen ial o p ecise ime synch oniza ion. The main baseband chip SX1301 p o ides eigh LoRa demodula o s wi h au oma ic SF selec ion on IF0–IF7 signal pa hs. Mo eo e , an addi ional LoRa demodula o wi h ixed pa ame e s and implici heade mode suppo , e e enced as a SingleSF modem, is a ailable on he IF8 signal pa h. The e a e se e al limi a ions in oduced by he chipse . In he LoRa physical laye , he modula ed signal is ep esen ed by a chi p, which is a sinusoidal wa e o m whose equency inc eases o dec eases linea ly o e ime [ 4 ]. The SX1301 demodula o can only de ec chi ps wi h one o wo di e en pola i ies, each ep esen ing i s in e se. Each LoRa demodula o needs o know he pola i y o a LoRa chi p signal in ad ance. As a esul , a leas wo iC880A concen a o modules need o be used o a simul aneous ecep ion o uplink and downlink ansmission, each con igu ed o demodula e a di e en chi p signal pola i y (GW #1 and GW #2). The IF0–IF7 LoRa channels may be connec ed indi idually o adio on ends, e - e enced as Radio A o Radio B [ 27 , 28 ]. Howe e , he use ul bandwid h o SX1257 adios is app oxima ely only 925 kHz [ 30 ], assuming ypical 125 kHz channels in he EU868 band [ 24 ]. This bandwid h is su icien o he simul aneous ecep ion o all RX1 channels using bo h on ends. Ne e heless, he RX2 channel ope a es a a signi ican ly di e en equency, making i impossible o ecei e using he ypical con igu a ion. This is no an issue o a s anda d concen a o , as i only ansmi s on RX2 wi hou ecei ing. Howe e , o a sni e , comple e da a ecep ion is desi ed. To o e come his limi a ion, a hi d iC880A concen a o mus be added o he sni e sys em (GW #3). This concen a o enables ecep ion in he RX2 downlink wi h one o i s eigh LoRa demodula o s. Figu e 1illus a es he ela ionship be ween channels, bands, and adio on ends. Ano he goal o he sni e is o ecei e Class-B beacons. These beacons a e ansmi ed on he RX2 equency wi h speci ic pa ame e s in ol ing he implici LoRa heade [ 24 ]. Demodula ion o he heade is suppo ed by he SingleSF modem on he IF8 signal pa h. An implici heade e e s o a packe o ma whe e he leng h o he packe is no explici ly included in he packe heade . Ins ead, he packe leng h is assumed o be ixed and known in ad ance. This ecep ion is handled by he hi d concen a o module (GW #3). Senso s 2023,23, 7333 5 o 20 band P RX2 band M RX1 channels 1–3 band L RX1 channels 4–8 867.1 MHz 867.3 MHz 869.525 MHz 867.5 MHz 868.5 MHz 868.3 MHz 868.1 MHz 867.9 MHz 867.7 MHz GW #1 GW #2 GW #3 Radio B Radio A Radio A Figu e 1. LoRaWAN EU868 channels and sni e on ends. 3.1. Sni e Ha dwa e O e iew Figu e 2shows he block diag am o ou LoRaWAN sni e . Ini ially, he adio signal is ecei ed by an Ul a-High F equency (UHF) omnidi ec ional an enna wi h a gain o 2 dBi and e ical pola iza ion. This signal is subsequen ly il e ed by a na ow bandpass il e , ampli ied by a Low Noise Ampli ie (LNA), and hen dis ibu ed o he inpu s o h ee iC880A modules ia a powe spli e . Table 2ou lines he unc ion o each iC880A module. Raspbe y Pi SD ca d RTC module Ga eway IMST iC880A-SPI Ga eway IMST iC880A-SPI Ga eway IMST iC880A-SPI GPS ecei e LNA 1:4 RF spli e 1PPS UART I2C SPI SPI SPI LTE modem USB Figu e 2. Block diag am o he de eloped LoRaWAN sni e . Table 2. Roles o iC880A modules in he LoRaWAN sni e . Concen a o Recei es on IF0–IF7 Pa hs IF8 Pa h GW #1 RX1 channel 1–8 downlink – GW #2 RX1 channel 1–8 uplink – GW #3 RX2 downlink (IF0 only) Class-B beacon A Raspbe y Pi minicompu e se es as he cen al p ocessing uni , which communi- ca es wi h he iC880A modules h ough i s in eg a ed Se ial Pe iphe al In e aces (SPIs). In addi ion, i ob ains he cu en ime om a GNSS ecei e module o accu a e imes- amping o he ecei ed packe s. Fo his pu pose, a 1 pps signal is dis ibu ed om he GNSS module o all iC880A concen a o s. The Raspbe y Pi also has a Real Time Ci cui (RTC) connec ed o i s I 2 C in e ace and an LTE modem connec ed ia USB o emo e managemen and sending he measu ed da a o he se e . An ex e nal 24 V adap e powe s he whole de ice. Figu e 3shows he pho o o he sni e in e nal ha dwa e. Comple e schema ics and ha dwa e design iles a e a ailable online [11]. F om a mechanical pe spec i e, he comple e LoRaWAN sni e is enclosed in an IP68- a ed aluminum box, enabling sa e ou doo ins alla ions. To accommoda e he sni e ’s equi emen o GNSS-based ime synch oniza ion and LTE communica ion, an addi ional plas ic con aine conceals he GNSS and LTE an ennas, elimina ing he need o wa e p oo ex e nal an ennas. The wo con aine s a e secu ely bonded oge he and all openings a e sealed o main ain wa e igh in eg i y. Senso s 2023,23, 7333 6 o 20 Figu e 3. Pho o o he LoRaWAN sni e in e nal ha dwa e. 3.2. Sni e So wa e O e iew The so wa e elies on adap ed open-sou ce u ili ies supplied by Sem ech, speci ically liblo agw om he lo a_ga eway eposi o y [ 30 ] and lo a_pk _ wd om he packe _- o wa de eposi o y [ 31 ]. The LoRa ga eway lib a y manages SPI communica ion be ween he hos compu e and he SX1301 baseband chip. The packe o wa de employs he ga eway lib a y o ecei e packe s, inco po a e de ailed da a, and ansmi he packe ia a s anda dized UDP socke . I was necessa y o add suppo o handling mul iple SPIs, swi ching chi p signal pola i y, ecei ing packe s wi hou a alid Cyclic Redundancy Check (CRC), and decoding he Class-B beacon implici heade . As a esul , he packe o wa de was modi ied o pa se con igu a ion Ja aSc ip Objec No a ion (JSON) iles and pass he ele an se ings o he lib a y, enhancing i s e sa ili y and adap abili y. The comple e so wa e amewo k is a ailable online [11]. 3.3. Da a P ocessing To add ess he limi a ions o o iginal Wi esha k LoRa encapsula ion, we de eloped an upda ed e sion o he LoRaTap heade o e icien ly manage he addi ional PHY laye in o ma ion, such as equency channel, signal le el, imes amp, and o he ele an de ails [ 32 ]. The sni e ’s JSON ou pu p oduced by he packe o wa de u ili y can be con e ed o he pcap o ma by con e sion u ili y [11]. We also signi ican ly upda ed he Wi esha k LoRaWAN dissec o . Key enhancemen s include he addi ion o a LoRaWAN Class-B beacon dissec o , Join Accep dec yp ion, suppo o MAC commands om he LoRaWAN 1.0.4 speci ica ion [ 5 ], and a ious imp o emen s o enable success ul decoding o eal-wo ld a ic cap u ed by he sni e . These modi ica ions a e in eg a ed in o he de elopmen b anch o u u e o icial elease and a e cu en ly a ailable h ough he Wi esha k au oma ed builds [33]. 3.4. Analysis and Dec yp ion Subsequen da a p ocessing can be pe o med manually in Wi esha k o h ough au oma ed sc ip s in Wi esha k’s console e sion, TSha k. We employed an au oma ed app oach o he quan i a i e analysis o cap u ed packe s. Da a pos -p ocessing om he TSha k u ili y is execu ed wi h Py hon sc ip s, while inal s a is ical and isual p ocessing is ca ied ou in MATLAB. The sc ip s a e a ailable online [11]. LoRaWAN packe s a e usually pa ially enc yp ed, wi h he keys gene ally unknown o a sni e de ice. Howe e , he e a e se e al p ope ies o LoRaWAN communica ion ha can be analyzed wi hou knowing he dec yp ion keys. The ollowing ields o a LoRaWAN packe a e no enc yp ed: Senso s 2023,23, 7333 7 o 20 • Message Heade (MHDR): Con ains in o ma ion abou he message ype (MType) and LoRaWAN e sion. • De ice Add ess (De Add ): A unique 32-bi iden i ie o he end de ice wi hin a speci ic ne wo k. • F ame Con ol (FC l): Con ains in o ma ion abou he Adap i e Da a Ra e (ADR), F ame Op ions Leng h, and o he con ol lags. • F ame Coun e (FCn ): A 16-bi coun e alue ha inc emen s wi h each uplink ame o p e en eplay a acks. • F ame Op ions (FOp s): Con ains op ional MAC commands. • F ame Po (FPo ): Indica es he po numbe o applica ion-speci ic o MAC laye communica ion. The applica ion payload (FRMPayload) and Message In eg i y Check (MIC) a e en- c yp ed o bo h uplink and downlink packe s, equi ing he co esponding keys o dec yp ion and e i ica ion [5]. LoRaWAN ac i a ion p ocesses include he O e - he-Ai Ac i a ion (OTAA) and Ac i a ion By Pe sonaliza ion (ABP). OTAA in ol es an end de ice ansmi ing a Join Reques , enc yp ed wi h a p e-sha ed Applica ion Key (AppKey). The ne wo k se e e i ies he eques , gene a es session keys, namely he Ne wo k Session Key (NwkSKey) o he MIC and he Applica ion Session Key (AppSKey) o he payload, and esponds wi h a Join Accep message, which includes he assigned De ice Add ess (De Add ). Gi en he necessa y keys, Wi esha k can dec yp he join p ocess packe s, allowing o a mo e comp ehensi e analysis. ABP, on he o he hand, in ol es p e-con igu ing he end de ice wi h session keys (NwkSKey and AppSKey) and a De Add , enabling immedia e communica ion wi hou a join p ocedu e. While his app oach simpli ies he p ocess, i may inc ease secu i y isks due o p olonged use o he same keys. 4. Resul s and Discussion Da a om he LoRaWAN ne wo ks we e collec ed in ou ci ies: Liege (Belgium), G az (Aus ia), Vienna (Aus ia), and B no (Czechia). These ci ies we e chosen o da a ga he ing due o a ious ac o s, such as hei cen al Eu opean loca ion, hei p ominence as majo u ban a eas wi h well-es ablished LoRaWAN ne wo ks, and he in en ion o cap u e a di e se ange o ci y en i onmen s o da a collec ion. Table 3p o ides a summa y o he cha ac e is ics and de ails associa ed wi h each cap u e. Table 3. Da ase de ails. Loca ion Geog aphic Coo dina es Sni e Placemen Cap u e In e al Days A e age Packe s pe Day Valid LoRaWAN Packe s pe Day Liege (Belgium) 50.66445° N 5.59276° E Roo o a esiden ial building in a subu b a ea; limi ed iew. 25 Augus 2022– –19 Sep embe 2022 17.8 14,088 6609 G az (Aus ia) 47.07049° N 15.44506° E Enclosed balcony o a his o ical building in he ci y cen e ; indoo . 26 Oc obe 2022– –29 No embe 2022 26.3 6225 3215 Vienna (Aus ia) 48.19666° N 16.37101° E Roo o a uni e si y building in he ci y cen e ; clea iew. 1 Decembe 2022– –4 Janua y 2023 34.1 72,892 58,330 B no (Czechia) 49.22685° N 16.57536° E Roo o a uni e si y building in a subu b a ea; clea iew. 16 Feb ua y 2023– –30 Ma ch 2023 42.0 46,467 30,937 Ideal placemen o he sni e in Vienna and B no is e iden in he dis ibu ion o he numbe o packe s ecei ed in uplink, downlink, and independen downlink (RX2), as depic ed in Figu e 4. To accoun o a ying ime pe iods ac oss he da ase s, packe coun s in all his og ams we e no malized o display he numbe o packe s pe day. Senso s 2023,23, 7333 8 o 20 (a) (b) (c) (d) Figu e 4. Dis ibu ion o LoRaWAN packe s o indi idual ecei e chains o packe s wi h alid, in alid, and missing CRC in: ( a ) Liege da ase ; ( b ) G az da ase ; ( c ) Vienna da ase ; ( d ) B no da ase . In Liege, he si e is p ima ily cha ac e ized by he downlink a ic—uncon i med da a wi hou a checksum, pa icula ly on he RX2 channel. The G az da a also sugges a subop imal sni e placemen , as he sni e p edominan ly cap u ed downlink signals om ga eways (be e posi ioned han nodes). Consequen ly, mos o he ecei ed uplink a ic was disca ded due o w ong checksums, as shown in Figu e 4. 4.1. Selec ed Resul s o Da a Pos -P ocessing Despi e op imal sni e placemen in Vienna and B no, a highe numbe o packe s was ecei ed in he downlink compa ed o he uplink. The dis ibu ion o alid LoRaWAN message ypes is depic ed in Figu e 5. To de e mine he alidi y o eal LoRaWAN messages, he CRC e i ica ion was applied a he physical LoRa packe le el, and packe heade s we e checked o e o s. Payload checksums we e e i ied o he Class-B beacons. Subop imal placemen in Liege and G az esul ed in he ecep ion o p edominan ly downlink packe s. Class-B beacons we e obse ed in B no, Liege, and Vienna. In some in- s ances, pa icula ly in Liege, hese beacons also con eyed addi ional in o ma ion ega ding he geog aphic posi ion o he ga eway. The Vienna da ase can be conside ed a ep esen a i e sou ce o da a. The his og ams in Figu e 6demons a e he iden i ied ansmission pa ame e s. Sp eading ac o s SF7 and SF12 a e dominan , wi h a coding a e o 4/5 equi ed by he s anda d [ 24 ]. Channels a e occupied almos uni o mly (excep o he 867.5 MHz equency), and mos packe s a e ela i ely sho , wi h leng hs o 12–19 by es in he downlink and 20–40 by es in he uplink. The Recei ed Signal S eng h Indica o (RSSI) and he SNR con i m he supe io placemen o ga eways compa ed o nodes in e ms o adio co e age. Senso s 2023,23, 7333 9 o 20 (a) (b) Figu e 5. LoRaWAN message ypes: Join Reques , Join Accep , Uncon i med/Con i med Da a Up/Down, RFU, P op ie a y, and Class-B Beacon in: (a) Vienna da ase ; (b) B no da ase . Table 4shows he pe cen age o a ic wi h decla ed Adap i e Da a Ra e (ADR) suppo om end de ices (ex ac ed om uplink ames) and ne wo k se e s ( om downlink ames), decla ed end de ice Class-B suppo , and he pe cen age o downlink messages con aining alid payload CRC. Table 4. Suppo o ADR and Class-B ea u es along wi h he occu ence o payload CRC in downlink messages ound in cap u ed LoRaWAN messages. Loca ion Ga eway Packe s wi h ADR Suppo End De ice Packe s wi h ADR Suppo End De ice Packe s wi h Class-B Suppo Downlink Messages wi h Payload CRC Liege (Belgium) 3.9% 79.8% 2.3% 1.2% G az (Aus ia) 99.7% 57.4% 34.1% 99.7% Vienna (Aus ia) 79.2% 83.6% 1.4% 81.9% B no (Czechia) 96.6% 86.6% 0.0% 99.3% ADR is a ea u e ha op imizes he da a a e, ansmission powe , and ai ime o end de ices based on hei connec i i y condi ions [ 5 ]. In uplink ames, he ADR lag se by he end de ice indica es i s suppo o he ADR ea u e and eques s he ne wo k se e o manage i s da a a e and ansmission powe se ings. When he ADR bi is se in a downlink ame, i in o ms he end de ice ha he ne wo k se e can send ADR commands. The ClassB lag in he uplink packe heade indica es o he ne wo k se e ha he end de ice ac i a ed Class-B mode and is eady o ecei e scheduled downlink pings. In acco dance wi h he LoRaWAN s anda d, uplink and downlink packe s a e dis in- guished by he p esence o payload CRC. While payload CRC is manda o y in he uplink packe s, he s anda d does no equi e i in he downlink, allowing o educed ai ime and associa ed du y cycle o ga eway ansmissions [ 5 ]. Howe e , he obse ed da a indica e ha , aside om he Liege si e, payload CRC is appended in he downlink by he majo i y o LoRaWAN ga eways. Senso s 2023,23, 7333 16 o 20 Rejec ion Ra io (IMRR) o he adio on ends ound in LoRaWAN ga eways and he sni e . An example o his can be iden i ied in packe s #306 and #307 in he B no da ase , wi h he key cha ac e is ics depic ed in Figu e 11. F ame 306: 62 by es cap u ed (496 bi s) Epoch Time: 1676538576.498914000 seconds S c: b8:27:eb:a :ac:00:00:02 Flags: 0x0a, IQ In e ed, Checksum: CRC OK F equency: 867300000 Hz Cu en RSSI: -112 dBm SNR: -12.0 dB Message ype: Uncon i med Da a Up F ame Payload: 0a79b794613ecd1c1d34b251 066 F ame 307: 62 by es cap u ed (496 bi s) Epoch Time: 1676538576.498908000 seconds S c: b8:27:eb:a :ac:00:00:01 Flags: 0x08, Checksum: CRC OK F equency: 867700000 Hz Cu en RSSI: -59 dBm SNR: 10.5 dB Message ype: Uncon i med Da a Up F ame Payload: 0a79b794613ecd1c1d34b251 066 Figu e 11. Duplica e packe s wi h di e en chi p pola i ies in he B no da ase . The packe s we e ecei ed almos simul aneously, wi h a negligible 6 µ s di e ence. F ame #307 is a alid uplink ansmission wi h a signal s eng h o − 59 dBm and a non- in e ed chi p. Gi en a ecei ed equency o 867.7 MHz and a on end cen e equency o 867.5 MHz (as shown in Table 1), we can an icipa e a mi o signal a 867.3 MHz. This is con i med by ame #306, which has a signal s eng h o − 112 dBm. The di e ence o 53 dB co esponds o he IMRR alue o he SX1257 on end employed in he sni e . Due o he signal spec um in e sion, such in alid packe s can be easily iden i ied by he in e ed chi p lag, because da a ma ked as uplink in he LoRaWAN heade should no be de ec ed by he downlink sni e . To ensu e da a accu acy, hese packe s we e il e ed ou du ing p ocessing. The desc ibed beha io could po en ially o e shadow a legi ima e weak packe a he mi o equency. Howe e , he likelihood o i s occu ence is almos negligible, gi en he low usage o he channels. 4.8. In alid LoRaWAN T a ic wi h Valid Checksum LoRa packe s a he PHY laye con ain a Synch oniza ion Wo d (SyncWo d), which se es o di e en ia e he con en s o he ollowing payload. The use o he SyncWo d can be con using due o limi ed in o ma ion om he manu ac u e . Sem ech ecommends only wo SyncWo d alues: 0x12 o p i a e ne wo ks, and 0x34 o public/LoRaWAN ne wo ks [ 41 , 43 ]. Documen s om he LoRaWAN Alliance [ 24 ] and ce ain sou ce codes [ 30 ] imply ha SyncWo d 0x34 is designa ed o all ne wo ks u ilizing he LoRaWAN p o ocol a he MAC laye . This in e p e a ion sugges s ha bo h publicly and p i a ely designed ne wo ks ollowing he LoRaWAN s anda d should employ SyncWo d 0x34. The p i a e SyncWo d 0x12 appea s o be ese ed o de ices u ilizing LoRa modula ion a he PHY laye wi hou engaging he LoRaWAN MAC laye . The SyncWo d se ing is c ucial o bo h modula ion and demodula ion, as he ecei e does no accep packe s ansmi ed wi h a di e en SyncWo d [ 44 ]. This issue is no me ely abou disca ding packe s in he case o a misma ch; i a ises om he inabili y o synch onize on he p eamble–SyncWo d pai [45]. All da ase s con ain packe s wi h e o s ha he LoRaWAN dissec o canno decode. The Liege da ase includes a signi ican numbe o in alid packe s (4.7% o he o al). In alid packe s a e iden i ied by dissec o e o s o in alid MAC heade en ies, which include a non-ze o Rese ed o Fu u e Use (RFU) ield and a Majo e sion ha is no equal o R1. Recei ing an in alid LoRaWAN packe can be a ibu ed o a miscon igu a ion o he LoRa ansmi e , which uses a cus om payload o packe s se wi h a public SyncWo d. The co ec app oach would be o use a dedica ed p i a e SyncWo d, which appea s o be he issue occu ing in he Liege da ase . Ano he possibili y in ol es accep ing in alid packe s ha a e e oneously e alua ed as alid due o a ious ac o s. This could be a ibu ed o he limi ed eliabili y o he 16-bi payload CRC [ 41 ], which may occasionally ail o iden i y packe co up ion, o i could be due o he unwan ed accep ance o packe s wi h a p i a e SyncWo d. Senso s 2023,23, 7333 17 o 20 The SyncWo d issue was in es iga ed in he In e OP p ojec ATCZ175 [ 46 ], and i s esul s indica e a ela i ely low capabili y o he ga eway o il e packe s based on Sync- Wo d. The success a e o ecei ing a p i a e SyncWo d packe when he ga eway is se o he public SyncWo d depends on he signal s eng h and he SF used, wi h he possibili y o eaching up o 10%. Consequen ly, any a ic wi h a p i a e SyncWo d may lead o he obse a ion o in alid packe s in sni e da ase s. 4.9. Class-B Beacons as a Timebase Sou ce Class-B beacons in LoRaWAN ne wo ks ha e he po en ial o se e as al e na i e imebase sou ce in u ban en i onmen s. Beacon ecei e s ypically lock wi hin 128 seconds, p o iding excellen long- e m s abili y, as hei iming is usually de i ed om a GNSS ecei e . Acco ding o he LoRaWAN s anda d, beacon iming is accu a e wi hin ± 1 µ s, while measu emen s aken by he sni e wi hou u he op imiza ions e ealed an accu acy o ± 5 µ s. This accu acy is u he educed by he wi eless p opaga ion delay—e e y 300 m o dis ance ep esen s an addi ional 1 µs o se . Compa ed o GNSS, Class-B beacons can be ecei ed indoo s, making hem sui able o ime synch oniza ion in buildings and o he s uc u es whe e GNSS signals a e weak o una ailable. Unlike GNSS, Class-B beacons do no equi e a clea iew o he sky, enhancing hei eliabili y in u ban en i onmen s whe e all buildings, ees, o o he obs acles migh obs uc GNSS signals. Class-B beacons also o e se e al bene i s compa ed o he DCF77, a Long-Wa e (LW) ime signal b oadcas om Ge many. They exhibi high immuni y o noise, making hem mo e eliable in u ban en i onmen s whe e speci ic ypes o RF in e e ence a e common, e.g., he LW in e e ence a ec ing DCF77 signals. Class-B beacon ecei e s can use small, cheap an ennas, lowe ing he o e all cos and making hem mo e accessible o a wide ange o applica ions. Mo eo e , Class-B beacons ha e a simila lock speed o DCF77, wi h a lock ime o up o 128 seconds compa ed o DCF77’s ypical lock ime o 2–3 minu es [ 47 ]. Compa ed o NTP, Class-B beacons do no equi e an in e ne connec ion o ime synch oniza ion, making hem sui able o en i onmen s wi h limi ed o no in e ne ac- cess. This independence om in e ne connec ions makes Class-B beacons a compelling al e na i e o a ious applica ions. To u he enhance he lock ime, a mul ichannel (e.g., SDR-based) de ice may lis en o Class-A downlink a ic, which may con ain he De iceTimeAns ime command in i s unenc yp ed MAC heade . Despi e he limi ed accu acy o ± 100 ms as de ined in [ 5 ], his may allow o a coa se lock. The lis ening de ice can also de i e he ime window o Class- B beacon ecep ion om his in o ma ion, po en ially educing con inuous ecei e ime. Howe e , his p oposed ime synch oniza ion may encoun e di icul ies i nea by ga eways ansmi beacons ha iola e he LoRaWAN s anda d. Such issues ha e al eady been obse ed in he Vienna and B no egions, as p e iously discussed. Cu en ly, no me hod exis s o e i y he au hen ici y o a ecei ed beacon. Mo eo e , due o he ha sh RF en i onmen , beacons may be dis up ed by a wide-band UHF in e e ence, esul ing in decoding e o s and signi ican ly longe lock ime. Despi e hese challenges, by le e aging he bene i s o Class-B beacons, ime syn- ch oniza ion in u ban en i onmen s can be signi ican ly imp o ed. The indoo ecep ion capabili ies, noise immuni y, cos e ec i eness, and independence om sa elli e a ailabil- i y and in e ne connec ions make Class-B beacons an a ac i e al e na i e o exis ing ime synch oniza ion me hods, p o ided ha he associa ed disad an ages can be e ec- i ely managed. 5. Conclusions In his s udy, we c ea ed an ex ensi e, publicly a ailable da ase encompassing com- ple e LoRaWAN a ic om ou Eu opean ci ies. This da ase enabled igo ous examina- ion o eal-wo ld LoRaWAN ne wo k unc ionali y. Ou analysis e ealed secu i y and sys em challenges, which include: Senso s 2023,23, 7333 18 o 20 • in alid Class-B beacon packe s, which pose a signi ican synch oniza ion issue and a e likely o cause andom Class-B ne wo k p oblems; • de aul enc yp ion keys om Sem ech and Milesigh in exis ing LoRaWAN ins alla- ions, which pose a secu i y isk; • end de ices iola ing he du y cycle limi a ion o EU868 sub-bands, which could po en ially deg ade he quali y o se ice o o he wi eless de ices. We enhanced Wi esha k’s LoRaWAN p o ocol dissec o o accu a ely decode eco ded a ic, including da a and MAC command dec yp ion o packe s wi h known keys. These imp o emen s a e now publicly accessible. Addi ionally, we p oposed he use o Class-B beacons as a imebase sou ce in u ban en i onmen s. Fu u e esea ch should inco po a e da ase s om a b oade ange o loca ions o enhance unde s anding o LoRaWAN ne wo ks. Addi ionally, add essing he issues ela ed o in alid Class-B beacons is a c i ical nex s ep. Class-B de ices cu en ly allow he allback o Class-A when hey expe ience di icul ies in acking he beacon. Howe e , his depends on he speci ic de ice implemen a ion, since he documen a ion only sugges s an ini ial non-speci ic synch oniza ion [5,40]. Valida ing ecei ed beacons emains a challenge. The beacon payload may con ain an op ional ne wo k/ga eway iden i ica ion. Howe e , o he bes o ou knowledge, no beacon il e ing implemen a ion has been in oduced ye . Ano he app oach could in ol e ansmi ing he ini ial synch oniza ion o e a secu e channel, speci ically wi hin a unicas packe wi h a MIC signa u e. This me hod can be employed o acqui e he co ec Class-B beacon. While a solu ion ha u ilizes he De iceTimeAns command o acqui e coa se ime has been implemen ed, i s use emains op ional. Au ho Con ibu ions: Concep ualiza ion, A.P. and J.K.; me hodology, A.P. and J.K.; so wa e, A.P. and O.K.; alida ion, A.P., O.K. and M.N.; o mal analysis, A.P.; in es iga ion, A.P.; esou ces, J.K., H.A. and M.N.; da a cu a ion, A.P.; w i ing—o iginal d a p epa a ion, A.P.; w i ing— e iew and edi ing, A.P., J.K. and H.A.; isualiza ion, A.P.; supe ision, J.K. and H.A.; p ojec adminis a ion, A.P. and J.K.; unding acquisi ion, J.K. All au ho s ha e ead and ag eed o he published e sion o he manusc ip . Funding: This esea ch was suppo ed by he In e nal G an Agency o B no Uni e si y o Technology unde p ojec no. FEKT-S-23-8191. The da ase was c ea ed wi h he suppo o he Technology Agency o he Czech Republic unde g an ag eemen no. TK04020173. Ins i u ional Re iew Boa d S a emen : No applicable. In o med Consen S a emen : No applicable. Da a A ailabili y S a emen : The da a p esen ed in his s udy a e openly a ailable on Zenodo a 10.5281/zenodo.8090619, e e ence numbe [6]. Acknowledgmen s: Du ing he p epa a ion o his wo k, he au ho s u ilized Cha GPT o help e ine language and s yle. A e using his se ice, he au ho s e iewed and edi ed he pape as necessa y, and hey ake ull esponsibili y o he con en o he publica ion. Con lic s o In e es : The au ho s decla e no con lic o in e es . Senso s 2023,23, 7333 19 o 20 Re e ences 1. Sem ech. LoRa ® and LoRaWAN ® : A Technical O e iew. A ailable online: h ps://lo a-de elope s.sem ech.com/uploads/ documen s/ iles/LoRa_and_LoRaWAN-A_Tech_O e iew-Downloadable.pd (accessed on 12 July 2023). 2. Raza, U.; Kulka ni, P.; Soo iyabanda a, M. Low Powe Wide A ea Ne wo ks: An O e iew. IEEE Commun. Su . Tu o ials 2017, 19, 855–873. [C ossRe ] 3. Haxhibeqi i, J.; De Poo e , E.; Moe man, I.; Hoebeke, J. A Su ey o LoRaWAN o IoT: F om Technology o Applica ion. Senso s 2018,18, 3995. [C ossRe ] [PubMed] 4. Sem ech. AN1200.22 LoRa ™ Modula ion Basics. A ailable online: h ps://www.sem ech.com/p oduc s/wi eless- /lo a- connec /sx1276 (accessed on 2 May 2023). 5. LoRa Alliance. TS001-1.0.4 LoRaWAN ® L2 1.0.4 Speci ica ion. A ailable online: h ps://lo a-alliance.o g/ esou ce_hub/ s001-1 -0-4-lo awan-l2-1-0-4-speci ica ion/ (accessed on 2 May 2023). 6. Po alac, A.; K al, J. LoRaWAN T a ic Analysis Da ase . Ve sion 2. Zenodo. 2023. A ailable online: h ps://zenodo.o g/ eco d/ 8090619 (accessed on 16 Augus 2023). 7. Bha ia, L.; B eza, M.; Ma ie ici, R.; McCann, J.A. LoED: The LoRaWAN a he Edge Da ase : Da ase . In P oceedings o he Thi d Wo kshop on Da a: Acquisi ion To Analysis, New Yo k, NY, USA, 16–19 No embe 2020; DATA ’20, pp. 7–8. [C ossRe ] 8. Ae nou s, M.; Be k ens, R.; Van Vlaende en, K.; Weyn, M. Sig ox and LoRaWAN Da ase s o Finge p in Localiza ion in La ge U ban and Ru al A eas. Da a 2018,3, 13. [C ossRe ] 9. Blenn, N.; Kuipe s, F. LoRaWAN in he Wild: Measu emen s om The Things Ne wo k. a Xi 2017 , a Xi :1706.03086. h ps: //doi.o g/10.48550/a Xi .1706.03086. 10. Choi, K.N.; Kolamunna, H.; Uyanwa a, A.; Thilaka a hna, K.; Sene i a ne, S.; Holz, R.; Hassan, M.; Zomaya, A.Y. LoRada : LoRa Senso Ne wo k Moni o ing h ough Passi e Packe Sni ing. SIGCOMM Compu . Commun. Re . 2020,50, 10–24. [C ossRe ] 11. Po alac, A. LoRaWAN T a ic Analysis Tools. A ailable online: h ps://gi hub.com/alpo /lo awan-sni e (accessed on 10 May 2023). 12. Spadaccino, P.; C inó, F.G.; Cuomo, F. LoRaWAN Beha iou Analysis h ough Da ase T a ic In es iga ion. Senso s 2022 ,22, 2470. [C ossRe ] [PubMed] 13. Ruo salainen, H.; Shen, G.; Zhang, J.; Fujdiak, R. LoRaWAN Physical Laye -Based A acks and Coun e measu es, A Re iew. Senso s 2022,22, 3127. [C ossRe ] [PubMed] 14. B oxson, J. Fea he TFT LoRa Sni e . A ailable online: h ps://gi hub.com/Imp obableS udios/Fea he _TFT_LoRa_Sni e (accessed on 2 May 2023). 15. B a o-Mon oya, A.F.; Rondón-Sanab ia, J.S.; Gaona-Ga cía, E.E. De elopmen and Tes ing o a Real-Time LoRawan Sni e Based on GNU-Radio. TecnoLógicas 2019,22, 130–139. [C ossRe ] 16. Robyns, P.; Quax, P.; Lamo e, W.; Thenae s, W. A Mul i-Channel So wa e Decode o he LoRa Modula ion Scheme. In P oceedings o he 3 d In e na ional Con e ence on In e ne o Things, Big Da a and Secu i y, Funchal, Po ugal, 19–21 Ma ch 2018; pp. 41–51. [C ossRe ] 17. Ma que , A.; Mon a on , N.; Papadopoulos, G.Z. Towa ds an SDR implemen a ion o LoRa: Re e se-enginee ing, demodula ion s a egies and assessmen o e Rayleigh channel. Compu . Commun. 2020,153, 595–605. [C ossRe ] 18. Tappa el, J.; A isiadis, O.; Mayo az, P.; Bala soukas-S imming, A.; Bu g, A. An Open-Sou ce LoRa Physical Laye P o o ype on GNU Radio. In P oceedings o he 2020 IEEE 21s In e na ional Wo kshop on Signal P ocessing Ad ances in Wi eless Communica ions (SPAWC), A lan a, GA, USA, 26–29 May 2020; pp. 1–5. [C ossRe ] 19. Sil a, F.S.D.; Ne o, E.P.; Oli ei a, H.; Rosá io, D.; Ce quei a, E.; Bo h, C.; Zeadally, S.; Ne o, A.V. A Su ey on Long-Range Wide-A ea Ne wo k Technology Op imiza ions. IEEE Access 2021,9, 106079–106106. [C ossRe ] 20. Ma ais, J.M.; Malekian, R.; Abu-Mah ouz, A.M. E alua ing he LoRaWAN P o ocol Using a Pe manen Ou doo Tes bed. IEEE Sens. J. 2019,19, 4726–4733. [C ossRe ] 21. Fujdiak, R.; Mikhaylo , K.; Pospisil, J.; Po alac, A.; Misu ec, J. Insigh s in o he Issue o Deploying a P i a e LoRaWAN. Senso s 2022,22, 2024. [C ossRe ] [PubMed] 22. Rami ez, C.G.; Dyusseno a, A.; Se geye , A.; Iannucci, B. LongShoT: Long-Range Synch oniza ion o Time. In P oceedings o he 2019 18 h ACM/IEEE In e na ional Con e ence on In o ma ion P ocessing in Senso Ne wo ks (IPSN), Mon eal, QC, Canada, 16–18 Ap il 2019; pp. 289–300. [C ossRe ] 23. Rizzi, M.; Depa i, A.; Fe a i, P.; Flammini, A.; Rinaldi, S.; Sisinni, E. Synch oniza ion Unce ain y Ve sus Powe E iciency in LoRaWAN Ne wo ks. IEEE T ans. Ins um. Meas. 2019,68, 1101–1111. [C ossRe ] 24. LoRa Alliance. RP002-1.0.3 LoRaWAN ® Regional Pa ame e s. A ailable online: h ps://lo a-alliance.o g/ esou ce_hub/ p2-1-0 -3-lo awan- egional-pa ame e s/ (accessed on 2 May 2023). 25. ETSI EN 300 220-2 V3.2.1: Sho Range De ices (SRD) Ope a ing in he F equency Range 25 MHz o 1 000 MHz; Pa 2: Ha monised S anda d o Access o Radio Spec um o Non Speci ic Radio Equipmen . A ailable online: h ps://www.e si.o g/ deli e /e si_en/300200_300299/30022002/03.02.01_60/en_30022002 030201p.pd (accessed on 4 May 2023). 26. The Things Ne wo k. LoRaWAN F equency Plans. A ailable online: h ps://www. he hingsne wo k.o g/docs/lo awan/ equency-plans/ (accessed on 2 May 2023). 27. IMST GmbH. WiMOD iC880A Da ashee . A ailable online: h ps://wi eless-solu ions.de/download ile/ic880a-spi-documen s/ (accessed on 2 May 2023). Senso s 2023,23, 7333 20 o 20 28. Sem ech. SX1301: LoRa Co e ™ Digi al Baseband Chip o Ou doo LoRaWAN ® Ne wo k Mac o Ga eways. A ailable online: h ps://www.sem ech.com/p oduc s/wi eless- /lo a-co e/sx1301 (accessed on 2 May 2023). 29. Sem ech. SX1257: LoRa Co e ™ Low Powe Digi al I and Q RF Mul i-PHY Mode Analog F on End 860-1000MHz. A ailable online: h ps://www.sem ech.com/p oduc s/wi eless- /lo a-co e/sx1257 (accessed on 2 May 2023). 30. Sem ech. LoRa Ga eway P ojec . A ailable online: h ps://gi hub.com/Lo a-ne /lo a_ga eway (accessed on 2 May 2023). 31. Sem ech. LoRa Ne wo k Packe Fo wa de P ojec . A ailable online: h ps://gi hub.com/Lo a-ne /packe _ o wa de (accessed on 2 May 2023). 32. De Jong, E. LoRaTap: Encapsula ion Fo ma o be Used o S o e LoRa T a ic in Pcap Files. A ailable online: h ps://gi hub.com/ e iknl/LoRaTap (accessed on 2 May 2023). 33. Wi esha k. Au oma ed Builds. A ailable online: h ps://www.wi esha k.o g/download/au oma ed/win64/ (accessed on 19 June 2023). 34. LoRa Alliance. TS002-1.1.0 LoRaWAN Backend In e aces Speci ica ion. A ailable online: h ps://lo a-alliance.o g/ esou ce_ hub/ s002-110-lo awan-backend-in e aces/ (accessed on 2 May 2023). 35. LoRa Alliance. Ne ID Alloca ion. A ailable online: h ps://lo a-alliance.o g/wp-con en /uploads/2022/06/LoRa-Alliance- Ne ID-Alloca ion-1.pd (accessed on 2 May 2023). 36. IEEE S anda ds Associa ion. Guidelines o Use o EUI, OUI, and CID. A ailable online: h ps://s anda ds.ieee.o g/wp-con en / uploads/impo /documen s/ u o ials/eui.pd (accessed on 3 May 2023). 37. Hu, Y.H. LoRa Ai -Time Calcula o . A ailable online: h ps://gi hub.com/i TNT/lo a-ai - ime (accessed on 2 May 2023). 38. Lewandowski, W.; A ias, E.F. GNSS imes and UTC. Me ologia 2011,48, S219. [C ossRe ] 39. NIST. Leap Second and UT1-UTC In o ma ion. A ailable online: h ps://www.nis .go /pml/ ime-and- equency-di ision/ ime- ealiza ion/leap-seconds (accessed on 2 May 2023). 40. Sem ech. An In-Dep h Look a LoRaWAN ® Class B De ices. A ailable online: h ps://lo a-de elope s.sem ech.com/uploads/ documen s/ iles/LoRaWAN_Class_B_De ices_In_Dep h_Downloadable.pd (accessed on 26 May 2023). 41. Sem ech. SX1272: Long Range, Low Powe RF T anscei e 860-1000MHz wi h LoRa ® Technology. A ailable online: h ps: //www.sem ech.com/p oduc s/wi eless- /lo a-connec /sx1272 (accessed on 2 May 2023). 42. Milesigh . 3D ToF People Coun ing Senso Use Manual. A ailable online: h ps://www.milesigh .com/s a ic/ ile/en/ download/da ashee /3d- o /Milesigh -3D-ToF-People-Coun ing-Senso -Use -Manual-en.pd (accessed on 4 May 2023). 43. Sem ech. SX1261: LoRa Connec ™ Long Range Low Powe LoRa ® RF T anscei e +15 dBm, Global F equency Co e age. A ailable online: h ps://www.sem ech.com/p oduc s/wi eless- /lo a-connec /sx1261 (accessed on 2 May 2023). 44. Haxhibeqi i, J.; Van den Abeele, F.; Moe man, I.; Hoebeke, J. LoRa Scalabili y: A Simula ion Model Based on In e e ence Measu emen s. Senso s 2017,17, 1193. [C ossRe ] [PubMed] 45. Selle , O.B.; So nin, N. Low Powe Long Range T ansmi e . Pa en US9252834B2, 2 Feb ua y 2016. 46. ATCZ175 In e OP. P i a e/Public-Syncwo d C oss alk. A ailable online: h ps://www.in e eg-in e op.eu/ esul s/lo awan/ p i a epublic_syncwo d_c oss alk/index.h ml (accessed on 2 May 2023). 47. Engele , D. Pe o mance analysis and ecei e a chi ec u es o DCF77 adio-con olled clocks. IEEE T ans. Ul ason. Fe oelec . F eq. Con ol 2012,59, 869–884. [C ossRe ] [PubMed] Disclaime /Publishe ’s No e: The s a emen s, opinions and da a con ained in all publica ions a e solely hose o he indi idual au ho (s) and con ibu o (s) and no o MDPI and/o he edi o (s). MDPI and/o he edi o (s) disclaim esponsibili y o any inju y o people o p ope y esul ing om any ideas, me hods, ins uc ions o p oduc s e e ed o in he con en .