I built a LoRa analyser because I was sick of guessing

LoRaScope is a small radio that shows what is on the air across LoRa, MeshCore and LoRaWAN. I built it because I was tired of guessing at link problems, and it has become a demonstration of the firmware work I do.

Debugging a LoRa link used to go like this. A node stops reporting, so I swap the antenna, move the gateway and drop the spreading factor. Something improves, or it doesn’t, and I have no idea why, because I cannot see the band.

So I built the thing I kept wishing I had. LoRaScope is a small radio that listens to the band and shows what is on the air: LoRa, MeshCore and LoRaWAN, with live switching between them. There is no gateway or network server in the path. The radio receives the packet, the box decodes it, and it shows up on a screen.

The product site is lora.dd.com.au. This is the field note version of what it does and why.

What you see

It shows who is transmitting, how often, at what RSSI and SNR, how busy the channel is and whether the link is healthy. Most of the guesswork went away once I could look.

For LoRaWAN and MeshCore it reads the headers without any keys: DevAddr, frame counter, port and airtime. You cannot see the payload without the session keys, but you do not need it to find the node that is hogging the channel, or to notice that a device is rejoining every ten minutes. When you do have the keys, it decrypts the payload as well.

Decoding on the box, or in the browser

Plain binary payloads and encrypted ones decode on the device itself and go straight to its screen. That covers the sensors I build and most of what I run into in the field: a few bytes of packed fields, sometimes encrypted with a symmetric key.

For anything more involved there is a JavaScript plugin runtime in the browser. You write a small decoder against the live feed, reload, and your packets show up as fields instead of hex. I have used it for site-specific formats and for vendor encodings that were never documented. It is the same feed the rest of the dashboard uses, so a plugin’s output goes into the plots and the logs like everything else.

Walking the site

The dashboard is served from the box, so a laptop or a phone on the same WiFi is all you need. A lot of LoRa problems depend on where you are standing, so there is a screen on the device as well.

It also has GPS and a ping test. Walk away from the other end, press ping, and distance, RSSI and SNR come up on the screen and get written to the SD card with the position. A range survey becomes one trip with the box in your hand, and nobody has to sit at the far end reading numbers over the phone.

Everything else gets logged to SD too, raw frames and decoded, and you can browse and plot the captures in the browser afterwards.

Other things I use

Airtime per station, with bandwidth and duty cycle. That is usually the number you need, and it is the one people are most often surprised by.

Channel scanning shows what is where before you pick a frequency. There is a LoRaWAN mode that watches for join requests and uplinks across the sub-band.

The box can also emulate a hub or a repeater, so you can test a single node in isolation without touching the field hardware.

Handing it to an agent

Everything the browser can see and do is also exposed over telnet and REST. That was a deliberate choice, and it paid off sooner than I expected.

I had a run of packet corruption on the bench. Instead of reading hex myself, I gave an AI agent the telnet and REST addresses and let it watch the feed, form a hypothesis, inject a test packet and look at what came back. It ran that loop on its own and found the fault. The full session is written up on the LoRaScope site: How I let an AI debug my LoRa network.

Being able to query and drive the analyser is what makes automated testing possible.

What building it covered

I am building LoRaScope to sell. I am also building it because it is a compact demonstration of the work I do for clients.

The firmware is C++ on an ESP32. Getting three protocols onto one radio meant pulling apart the binary framing for each and writing decoders that run on a microcontroller. The decrypt path is AES, with the key handling that goes with it. There is a capture store on SD with an API over the top, a web dashboard served from flash, and the telnet and REST surface that the agent used above.

The same skills show up in client work: ESP-IDF and Zephyr firmware, LoRa and BLE, binary protocol design and reverse engineering, encryption on constrained devices, device provisioning, and the database and API end that the data lands in.

If you have a mesh that drops packets or a binary protocol with no documentation, I take on that kind of work. The LoRa and LoRaWAN work I do is described in more detail there, or get in touch.