Now available: LoRa captures in Wireshark

(Erikde Jong) #1

Hi all,

I have requested (and received) a link layer type identifier for libpcap. This is a magic number that can be used as a link layer type in pcap traces to identify the pcap as containing LoRa captures from the air. This link layer type is to be used with an encapsulation which I've drafted myself: LoRaTap (, recently the dissector for LoRaTap has been merged into the Wireshark master branch. This means you'll be able to open LoRaTap pcap files with the nightly builds.

At the moment I'm working on the LoRaWAN dissector that will be able to dissect the actual data in a LoRa frame with the LoRaWAN syncword. Please stay tuned while I'm working on this, I'm expecting to submit an early version to gerrit this week.

Meanwhile it's time to get TTN as well as manufacturers started on logging their radio data to pcap using the LoRaTap encapsulation so we can use it in Wireshark :smile:


Capture and analyze LoRa packets
(Erikde Jong) #2

And LoRaWAN dissector has been merged as well, should be in the daily Wireshark build tomorrow.

I'll see about getting a gateway at home to use with TTN software so I can get started on getting pcap logging working. I do have a Kerlink gateway at work, but that's not connected to TTN :frowning:

(Rizkyarlin) #3

@ErikdeJong, Do you have any tutorial about how to use it? Like do I need an extra hardware? is connecting LoRa module via USB Serial Interface enough to start using the plugin on wireshark?

I am trying to analyze my LoRa packet (not LoRaWAN).

(Erikde Jong) #4

I don’t know if there are any compatible USB/serial enabled modules that will do this for you.
You might want to take a look at gr-lora which is a set of gnuradio blocks that will allow you to read LoRa frames through SDR devices like the popular RTL-SDR dongles.
There is a tutorial over at the wiki.
I have been experimenting with extcap in Wireshark to enable capturing directly from Wireshark with the appropriate linklayer type, but due to lack of time it’s not finished yet :frowning: