How to track and stop massive join request from devices!


I have deployed a private TTI network with a couple of antennas and I am facing a problem : since a couple of days a lot of join request are being done (4 to 5 per second) and I would like to make that stop to “free the bandwidth” and to allow my gateways to listen to “real uplinks”.
I have started to look at 2 solutions : trying to geolocate the devices or try to identify the manufacturer of the motes.

  1. for the 1st solution I am close to it as I tried to triangulate and with a mobile antenna near the “suspected” office I have an RSSI of -69, SNR 7

  2. for the 2nd solution I am asking the community if someone identifies a known brand looking at the beginning of the DevEUI or at the appEUI (see attached)
    A look on IEEE doesn’t give me the manufacturer for the deveui with the first 3 bytes, only entering 000400 gives me Lexmark…

Any help on the second point ? Does someone recognize a brand/mote ?

Thank you for your help


plenty join

I can relate somewhat to this. When monitoring traffic at some gateways I administrer, I see devices trying to join endlessly. Apparently they are getting no reply (trying over and over again) and increasing the spreading factor to SF12 (low datarate, long frequency use). I suspect they are ‘abandoned’ devices.

The app eui looks like ASCII characters:

App EUI 50 59 46 5f 54 61 72 61 decodes as ‘PYF_Tara’
App EUI 50 59 46 5f 4c 6f 6f 6e decodes as ‘PYF_Loon’
The last part 41 67 65 6E of the Dev EUI decodes as ‘Agen’

Perhaps this gives you some kind of clue.

Hi Bertrik,

I didn’t think to convert that to ascii !, yes it looks like it means something. I’ll have to google those PYF_tara and PYF_loon

Thanks again

There’s isn’t any technical solution that would “free the bandwidth” - the airwaves are shared.

If someone if violating local legal limits and you can identify them, that you might be able to do something about by getting in touch, or at a stretch, complaining to regulatory authorities.

But since you are using a private instance, TTN fair usage policy, etc is not relevant to what your gateway sees.

You can try moving your entire system (nodes and gateways) to the private preamble sync word; this won’t actually “free the bandwith” but it will reduce what you see.