Repeated join request

A few days ago I moved my gateway from the basement to the roof of the house. Since then the number of messages received has increased to several hundred per day.

When I looked at the console for the gateway I did see many join requests ( two to three times a minute over at least 15 minutes observation), by the same dev/app EUI ( CCA0E5FFFE06A3F8 / 2211FFEEDDCCBBAA ).

I don’t know if something goes wrong on the gateway side, but isn’t this a bit excessive in frequency?

Yes, this appears excessive.

I see this too on some of the gateways I monitor, there’s nothing really you can do about it probably.
In particular I see join requests with the AppEUI and DevEUI probably swapped, because the DevEUI starts with 70 B3 D5 which is normally the prefix for AppEUI. Sometimes bursts of several join attempts with only a second in between. This has been going on for years.

Someone coded a dodgy firmware probably, AND didn’t configure the keys correctly.
Would be nice if we could trace a AppEUI back to an owner, so you can at least contact someone and perhaps help them with their faulty devices.

1 Like

Nope, this is a misbehaving node. There is nothing you can do about it at gateway level. If you really want to get rid of it you need a portable gateway and a directional antenna to try to triangulate the position of the node(s).
I think @pe1mew located a misbehaving node using that method in the past.

1 Like

Thanks for that name. Using that I found this project.

There were another few hundreds of join requests after my posting yesterday, but nothing coming in right now. Looks like they only broadcast certain (office?) hours. It seemed fixed on SF12 and every broadcast takes close to 1.5s of air-time totaling more than half an hour per day of air time, for that node only.

If it comes back, I am going to see if I can adapt Remko’s project to work with a Raspberry Pi and a second gateway hat that I have laying around idle for the moment (after investigating how much it would cost to buy the hardware Remko was using, time=money).

1 Like

I see from your profile that you are near Braunschweig and are a member of the local community with ur GW on south side of the city… perhaps you can reach out to fellow community members as it may be one of them running the offending node or perhaps between you all can go play hunt the node :slight_smile: as a project. I’m sure that if it is affecting you it is likely affecting others wrt on air time ‘stealing’ :wink:

Propably it is not only a problem of the node.
In my neigborhood is a 8 channel gateway wich is not able to make downlinks.
Due to this devices that are using OTAA are not able to join when near this gateway even with other fully functional gateways in range.

@engelking Since my gateway has both received and transmitted messages, I assumed it was functional for downlinks, at least with some nodes.

FWIW this morning it started retrying at 10:07 local time and stopped after slightly over 100 messages.

I have subscribed to the Braunschweig group in August, but not been in contact with anyone else (not a good year for getting together). There is a Technical University (or something similar) in Wolfenbuettel to the south of me. I know they have one or two gateways., From there you have better LOS to my location, than from most of Braunschweig.

Given that the broadcast restarted past 10am this morning, I immediately started suspecting a project of a late sleeping student :wink:

:rofl: Not my son atleast… he is in Hamburg! :wink: (to far to reach your GW unless something miraculous wrt atmospheric ducting). Thinking about it that is also too early…

It might not be, but >95% of the time it is.

Would be good to figure out the identity of that malfunctioning box and report it. Could be a software issue, could be sitting on a too slow backhaul network such that the transmit commands have expired before they actually hit the hardware (even for join accepts, they’re held in the server until less than a second before the transmit deadline, so that they can be shipped to potentially primitive gateways in strict order)

Noticed the other day that the ST micro eval kit’s gateway would basically cause this sort of problem, too, as it lacks the usual transmit amplifier and thus transmits substantially more weakly than a node would - so it would work close in for the owners own lab experiments but cause precisely this kind of problem further out.

@AvdN I do also see the node (from the north of Braunschweig) and two other ones with almost the same DevEUI (4C and 4D at the end). I just installed a Gateway using a self-hosted ChirpStack. My guess is the local energy supplier, who also started to install some gateways and nodes. Also this Thread hints to some energy meters, that use this AppEUI.

I just registered, so cannot send PMs. Maybe you can, so we can solve this privately. Since it’s a regional issue, it’s maybe not of interest for the others.

@JonasS @AvdN I am seeing also OTAA requests every second in Hannover from multiple nodes (cca0e5fffe06XXXX / 2211FFEEDDCCBBAA) with Spreading Factor 12. As the node ID is increasing permanently, I don’t think it is by accident.

Have you already found something? I would like to locate that as well.