Open-source decoder sniffs Meshtastic, MeshCore and LoRaWAN in real time

A new open-source decoder made it much easier to watch LoRa traffic across a wide slice of spectrum at once, and that matters immediately for anyone running Meshtastic nodes in the field. The project, Lora-Wideband-Decoder from persistentcache, described itself as a self-hosted, single-user intercept receiver that streamed IQ from an SDR, decoded packets in software near-real-time, and showed the results in a local web UI.

The practical change is breadth. The decoder handled Meshtastic, LoRaWAN and MeshCore across SF7 through SF12 at 62.5, 125, 250 and 500 kHz, then surfaced decoded packets, node identities and a live spectrum waterfall. It also said it could keep up with real-world Meshtastic and LoRaWAN traffic in real time on a multi-core host at 28 Msps wideband, which is the kind of speed that moves this from a lab curiosity to a serious monitoring tool.

That has a direct bearing on troubleshooting and on interception risk. Meshtastic’s own documentation says every device in a mesh must share identical region and modem preset settings to communicate fully, and it exposes controls such as bandwidth, spreading factor, coding rate, frequency offset, frequency slot and override frequency. In practice, that means a decoder that can sweep broad bandwidth and follow multiple configurations at once can help operators spot mismatched settings, but it also lowers the bar for passive observation of traffic that was previously harder to collect cleanly.

The repository showed 78 commits and 20 stars, with a Debian and Ubuntu install path using ./install.sh and python3 run/web.py. The web interface ran locally at 127.0.0.1:5000, and the project said it worked with any SoapySDR-compatible radio or bladeRF, with validation notes for bladeRF, USRP B210 and B205mini, HackRF, RTL-SDR, Airspy, LimeSDR and PlutoSDR. The README noted Python 3.11+ for lora.toml support.

The backdrop is a busier LoRa ecosystem than many mesh operators may assume. Meshtastic listed stable firmware 2.7.15.567b8ea and alpha 2.7.24.472b14c, while Semtech said LoRaWAN was an open LPWAN standard driven by the LoRa Alliance and that more than 500 million LoRa end nodes had been deployed worldwide as of March 2026. MeshCore, meanwhile, described itself as a secure, decentralized mesh radio platform powered by LoRa. A tool that can sniff all of that in real time on small hardware changes the monitoring game, and it sharpens the question every mesh deployment now has to answer: how much of the air around it should be assumed visible.