LoRa: LoraPipe

Added: 2026-10

The LoraPipe source captures LoRa packets from a LoRa radio microcontroller running the LoraPipe sniffer firmware, connected over a serial port.

Kismet decodes Meshtastic and MeshCore mesh networks from LoRa captures, and records other LoRa packets as generic LoRa.

LoraPipe sources are named lorapipe, and must include the device and region options:

kismet -c lorapipe:device=/dev/ttyUSB0,region=US

Supported hardware #

The LoraPipe source requires a LoRa microcontroller running LoraPipe sniffer firmware, connected via USB serial.

LoraPipe firmware #

The Kismet LoraPipe support uses the LoraPipe firmware from krak3n77. This firmware runs on just about any microcontroller which can run Meshtastic or Meshcore, and precompiled binaries which are flashable via the MeshCore web flasher should be available in the DataParty.js GitHub.

Compiling LoraPipe support #

LoraPipe support is built automatically, and needs no additional libraries.

Kismet LoraPipe support #

LoRa radios receive on one frequency, bandwidth, spreading factor, and sync word at a time. The sync word separates networks: Meshtastic uses 0x2b, and MeshCore uses 0x12. Kismet passes packets to the Meshtastic or MeshCore decoder based on the sync word they were received with.

Changing channels on a LoRa radio is slow, and mesh networks transmit infrequently, so the LoraPipe source hops at most once every 30 seconds. For best results, lock the source to the channel used by the network you want to watch.

Packets are logged in pcapng and kismetdb logs with LoRaTAP headers, which Wireshark can decode.

Channels #

Channels can be given as a protocol preset, or as raw radio settings with an optional protocol.

Presets #

Preset channels are named protocol-region-preset:

meshtastic-US-LONG_FAST
meshcore-US-NARROW

Preset names are not case-sensitive, and underscores are ignored, so meshtastic-us-longfast is the same as meshtastic-US-LONG_FAST.

Meshtastic presets are LONG_FAST, LONG_SLOW, LONG_MODERATE, LONG_TURBO, MEDIUM_FAST, MEDIUM_SLOW, SHORT_FAST, SHORT_SLOW, and SHORT_TURBO. The frequency is chosen the same way the Meshtastic firmware chooses the default frequency slot for the preset in the region. Turbo presets are not available in EU_868.

MeshCore presets are taken from the preset list used by the MeshCore apps, and grouped by region: for example meshcore-US-NARROW, meshcore-EU_868-NARROW, and meshcore-ANZ-DEFAULT.

The frequency and radio settings of every preset in every region are listed in the channel reference below.

The LoRa header carries the coding rate, so a radio receives packets of any coding rate on the same frequency, bandwidth, and spreading factor. MeshCore presets which differ only in coding rate share a single slot in the hopping list.

Raw radio settings #

Any radio configuration can be given as frequency-bandwidth-spreading-coding-syncword, with the frequency in MHz, the bandwidth in kHz, and the sync word in hex:

906.875-250-11-5-2b
910.525-62.5-7-5-12

For Meshtastic and MeshCore networks on settings which don’t match a preset, the sync word can instead come from the protocol, as protocol-frequency-bandwidth-spreading-coding. The protocol is meshtastic (sync word 0x2b) or meshcore (sync word 0x12), and is not case-sensitive:

meshcore-919.500-500-10-5
meshtastic-906.875-250-11-5

Raw radio settings are reported using the name they were given with.

Regions #

The region selects the channel list for hopping, and the presets available. The supported regions are US, EU_433, EU_868, EU_866, EU_N_868, CN, JP, ANZ, ANZ_433, RU, KR, TW, IN, NZ_865, TH, UA_433, MY_433, MY_919, SG_923, PH_433, PH_868, PH_915, KZ_433, KZ_863, NP_865, BR_902, ITU1_2M, ITU2_2M, ITU3_2M, ITU2_125CM, ITU1_70CM, ITU2_70CM, ITU3_70CM, and LORA_24.

The hopping list for a region contains the Meshtastic presets, followed by the MeshCore presets for the region. A source can only be opened in a region with at least one preset; regions with no Meshtastic or MeshCore presets, such as EU_866, EU_N_868, and the ITU amateur bands, can not currently be used.

LoraPipe source parameters #

Naming and description options #

All data sources accept the common naming and description options.

Device options #

Channel options #

source=lorapipe:device=/dev/ttyUSB0,region=US,channel=meshcore-US-NARROW,channel_hop=false

source=lorapipe:device=/dev/ttyUSB0,region=US,channels="meshtastic-US-LONG_FAST,meshcore-US-NARROW"

The common channel and hopping options are also supported.

Meshtastic #

Kismet decodes Meshtastic packets, including node info, position, and text messages. Packets on encrypted channels are decrypted when the channel key is known; the default channel for every modem preset, with the default key, is always enabled.

Additional channels and keys are set in kismet_meshtastic.conf, as meshtastic_key=channelname,base64key:

meshtastic_key=MyChannel,AQ==

The channel name must exactly match the Meshtastic channel name, and the key is the base64 key shown by the Meshtastic apps or in a channel URL.

The number of messages kept per channel is set with meshtastic_num_messages, by default 128.

Channels and recent messages are available from the REST API at /meshtastic/channels.json.

MeshCore #

Kismet decodes MeshCore packets. Devices are created from node adverts, which carry the node public key, name, type (companion, repeater, room server, or sensor), and optional location, and are signed by the node. Only adverts with valid signatures create devices; other packets refer to nodes by the first bytes of their public key, and are attributed to nodes already known from adverts.

When a packet is relayed through the mesh, the repeater which transmitted it is credited with relaying the packet.

Group messages on the public channel are decrypted automatically. Private channels and hashtag channels are set in kismet_meshcore.conf:

meshcore_key=MyChannel,base64key
meshcore_hashtag=#test

Private channel keys are the 16 or 32 byte channel secret shown by the MeshCore apps, in base64. Hashtag channel keys are derived from the channel name.

The number of messages kept per channel is set with meshcore_num_messages, by default 128.

Channels and recent messages are available from the REST API at /meshcore/channels.json.

Direct messages between nodes are encrypted with keys known only to the two nodes, and can not be decoded.

An advert with an invalid signature raises the MESHCOREBADSIG alert, as it may be an attempt to impersonate a node.

Channel reference #

The channels generated for each region, in hopping order, with the radio settings each one tunes to. Channels marked “not hopped” are MeshCore presets which share a frequency, bandwidth, and spreading factor with an earlier preset; they are left out of the hopping list, but can still be used with channel=.

US #

EU_433 #

EU_868 #

CN #

JP #

ANZ #

ANZ_433 #

RU #

KR #

TW #

IN #

NZ_865 #

TH #

UA_433 #

MY_433 #

MY_919 #

SG_923 #

PH_433 #

PH_868 #

PH_915 #

KZ_433 #

KZ_863 #

NP_865 #

BR_902 #

LORA_24 #

These regions have no Meshtastic or MeshCore presets, and can not currently be used: EU_866, EU_N_868, ITU1_2M, ITU2_2M, ITU3_2M, ITU2_125CM, ITU1_70CM, ITU2_70CM, ITU3_70CM.