Skip to content

Verify RFSAM-LORA-SP-01 with real 916 MHz US915 capture #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arlethmichellopez wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Verify RFSAM-LORA-SP-01 with real 916 MHz US915 capture #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 3 additions & 13 deletions src/content/controls/rfsam-lora-sp-01.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,9 +89,9 @@ bsam: []
resources:
- RFSAM-RES-01
- RFSAM-RES-07
reviewStatus: reviewed
reviewStatus: verified
confidence: high
lastResearched: 2026-06-14
lastResearched: 2026-09-02
---
## Mechanism

Expand Down Expand Up @@ -140,17 +140,7 @@ All steps below are passive receive-only. No transmission is involved; even so,

## Field case

Illustrative walkthrough — substitute the values you capture: run an EU868 survey with an RTL-SDR Blog V4 on 868.3 MHz in gqrx. The waterfall typically looks almost flat — a handful of faint diagonal streaks during the watch window, easy to dismiss as "a couple of devices, mostly quiet". Capturing the channel to I/Q and de-chirping it with gr-lora_sdr swept across SF7–SF12 is where the gap shows: frames can resolve at several spreading factors, including transmissions that left no visible mark on the plain FFT at all. The point this control makes is exactly that contrast — an energy-detector read ("band mostly empty") and a de-chirped read of the same capture can disagree completely, and only the de-chirped read reflects the real occupancy.

Concrete numbers to record in a worked write-up (mark unmeasured values rather than inventing them):

- Region / sub-band surveyed: EU868, centre 868.3 MHz, 125 kHz channel.
- Watch window before declaring "quiet": [FILL: minutes/hours observed].
- Frames the plain FFT showed vs frames gr-lora_sdr recovered after de-chirp: [FILL: counts].
- Lowest SNR at which a frame still decoded: [FILL: measured dB] — Semtech's stated envelope is up to 20 dB below the thermal noise floor [semtech2019longrange].
- Spreading factors observed once de-chirp locked: [FILL: e.g. SF7, SF9, SF12].

The reproducible lesson is the gap itself: establishing the de-chirp / processing-gain baseline is what lets a passive observer see an entire LoRaWAN deployment that an energy-only survey misses. The bracketed `[FILL: …]` values above are placeholders — fill them from a real survey before citing this section as a measured finding; do not present the placeholders as measured results.
In a 30.0 s session in the lab (extracted from a continuous 106.6 s capture) with a HackRF One at 916.0 MHz (US915, 125 kHz) and Gain -9.0 dB (a=1 l=32 g=40), stock antenna in fixed position, gqrx 2.17.7 showed a flat waterfall with no clearly distinguishable CSS diagonals (0). Processing the same 30 s with gr-lora_sdr (bw 125 kHz, SF7–SF12 sweep, sync 0x12/0x34) recovered 2 frames with valid CRC, both SF7 private LoRa; repeating the same processing on the full 106.6 s window the count rose to 4 with the same SF. Frames were recovered ~7–8 dB below the in-channel noise floor (SF7 threshold ≈ -7.5 dB SNR, within Semtech's up to 20 dB envelope [semtech2019longrange]) and nothing decoded at SF8–SF12.

## Remediation

Expand Down