# Misbehaving nodes

**URL:** <https://www.thethingsnetwork.org/forum/t/misbehaving-nodes/46066>\
**Category:** End Devices (Nodes)\
**Created:** [March 28, 2021, 6:55am UTC](https://www.thethingsnetwork.org/forum/t/misbehaving-nodes/46066 "2021-03-28T06:55:30Z")\
**Posts on this page:** 1\
**Showing post:** 73

<div class="post-metadata">

**Author:** ![pe1mew](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/pe1mew/32/48520_2.png) [@pe1mew](https://www.thethingsnetwork.org/forum/u/pe1mew)\
**Post date:** [December 30, 2021, 9:58am UTC](https://www.thethingsnetwork.org/forum/t/misbehaving-nodes/46066/73 "2021-12-30T09:58:23Z")

</div>

Last night I have captured all LoRaWAN traffic that the community gateways of TTN-Apeldoorn and my own (a total of 14 gateways) received over a period of 18 hours. The result is presented in the following table:

![afbeelding](https://www.thethingsnetwork.org/forum/uploads/default/original/3X/5/3/533c85b7dfa206c98f90ebe9e8e308ea7590ad52.png)

_KPN is a Dutch commercial LoRaWAN operator_

The analysis is done on all non JOIN request uplink messages and analysed the device address. This is not 100% exact but because of the number of packets, I expect that the results are representative:

**KPN** has 2286 active end devices that send 20425 packets. **TTN** has 364 active end devices that send 79451 packets. **Helium** has 16 active end devices that sent 441 packets.

From all received packets **66% are related to TTN** while 17% of all packets are from KPN end devices. The rest of the packets (17%) are not related to these networks.

![afbeelding](https://www.thethingsnetwork.org/forum/uploads/default/original/3X/b/3/b3e19b81d3e59190f42fc1b10fb1f812384f2fba.png)

![afbeelding](https://www.thethingsnetwork.org/forum/uploads/default/original/3X/e/7/e7b8a9afe828739792be243f5ee7da7e89d1ab5d.png)

**How about the 0100da30 end device**  
This device address is heard over all 14 gateways. From these gateways, 50% have no geographical binding as they are too far away for line-of-sight and they do not share the same coverage area. Therefore it is not possible that transmissions by “0100da30” are done by a single and unique end device unless it is airborne.

**My conclusions so far**

- Although KPN has more end devices (packet rate per hour is 1135), TTN is occupying the frequency spectrum the most with 66% of all received packets and a packet rate of 4414 per hour.
- With 14 end devices and a packet rate of 25 per hour, Helium has no serious presence in the 868 MHz band.
- If the “0100da30” end device can be related to Helium, the packet rate of Helium end devices increases to 126 packets per hour.

**When evaluating frequency occupancy, the “0100da30” end device is not misbehaving.** From LoRaWAN specification point of view there may be other reasons to judge otherwise.

---

_[View the full topic](https://www.thethingsnetwork.org/forum/t/misbehaving-nodes/46066)._