Monitoring Linux based LoRa gateway

As a LoRa TTN gateway owner you want to know what’s going on at your gateway sooner or later. Now the gateway traffic page at The Things Network console offers some insights but it offers no API to get the info and graph it somehow, yet.

Owners of a Linux based gateway (like me) can monitor the IP traffic between the gateway and TheThingsNetwork servers which runs on port 1700. TTN Gateways however use MQTT to exchange data with TheThingsNetwork servers and this post does not apply.

At Hackaday  Bjorn Amann describes how tcpdump can be utilized to snoop the gateway traffic. Note that all LoRa traffic is encrypted so don’t expect to see real userdata, but we are interested in the metrics.

First we need to install tcpdump on the Gateway Raspberry Pi with

sudo apt-get install tcpdump

which should install the neccesary packages. Provided your gateway is connected by WLAN (like me) you could give it a testrun with.

sudo tcpdump port 1700 -s 500 -U -n -t -w - -i wlan0

If connected by Ethernet use eth0 instead of wlan0. The console should spit out data at least at 30 second intervals, but probably more. You might even recognize json parts starting with {“rxpk:”  These are the ones we’re interested in!

Some info on the parameters:

-s 500 = first 500 byte of packet
-U = don’t wait to fill buffer before sending
-n = no domain lookups
-t = give human readable timestamp output
-w – = write output
-i wlan0 = use wifi interface (change to eth0 on a wired gateway)

We will be using Node-Red to process the data and Domoticz to visualize it. Assume your Node-Red instance runs on a machine with IP address NodeRedIP and we will be using a random port “8888” to convey the data.

Now we start our snooping listerer in background and pipe the data to Node-Red with:

sudo tcpdump port 1700 -s 500 -U -n -t -w - -i wlan0 | nc NodeRedIP 8888 &

| = pipe output to
nc = netcat
NodeRedIP = ip to send data to
8888 = port to send data to
& = run in background

This will start sending data over a TCP pipe to Node-Red where we just need to receive it with a TCP node listening on port 8888. That’s it ! A succesful connection will show “1 connection” below the node.

Download the complete Node-Red project from my Github here.

Now the fun starts and the received data, available in the msg.payload as string, can be processed. In the Node-Red example the packets are first checked for rxpk (received packet) or txpk (transmit packet) or anything else (keepalive). Any packet will retrigger a watchdog timer which emails if no packet was received within 65 seconds meaning that the gateway went down.

Then the json is read from the data and the rest of it is discarded. We now have metadata for the received packet but not yet the node address (and thus the network it belongs to). We therefore need to decode de Base64 encoded data packet and get the additional info from there. This conversion requres you to install the node-red-node-base64 node using the nodes palette. All data together are formed into a single object for each received packet like this:

{“device”:113434400,”count”:437,”netid”:3,”tmst”:1573228548,”time”:”2018-04-22T15:45:25.034275Z”,”chan”:2,”rfch”:1,”freq”:868.5,”stat”:1,”modu”:”LORA”,”datr”:”SF10BW125″,”codr”:”4/5″,”lsnr”:-11.8,”rssi”:-117,”size”:54}

which we now can use to:

1. store into a CSV file for later analysis (adapt file name/location)
2. count the packets received
3. count the unique devices seen on a day
4. report the first of a number of packets from a TTN device (a tracker?)
5. Watchdog your gateway (adapt email info in the email node)
6. whatever comes to mind (keep a list of known trackers?)

Graphing is done in Domoticz using an incremental counter virtual device. Mark the IDX value in Domoticz and adjust the corresponding http request node in Node-Red. Eventually the graph in Domoticz will look somewhat like:

Enjoy!